gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

auth/mail: Magic-Link-2FA (M1) + Mailversand über die Queue

Browse source 
- Magic-Link-Login übergibt bei aktiviertem 2FA an die 2FA-Challenge,
  statt sie zu umgehen (M1).
- Bestätigungs-/Benachrichtigungs-Mails (Kontakt, Recht, Kündigung,
  Widerruf, Magic-Link) laufen als ShouldQueue+afterCommit über die Queue,
  damit die Response nicht am SMTP-Roundtrip hängt.

Hinweis: Der Queue-Worker muss im Betrieb laufen und überwacht werden, da
fristrelevante Bestätigungen darüber zugestellt werden (siehe
Betriebsüberwachung).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:49:21 +00:00
parent 6764fb9bc2
commit ea8d017445
20 changed files with 135 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/Feature/Auth/ContactAccessTest.php
View file

@ -22,7 +22,7 @@ test('requesting access for an unknown email creates nothing and sends no mail',
expect($sent)->toBeFalse();
expect(User::query()->where('email', 'nobody@example.test')->exists())->toBeFalse();
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('requesting access for a known contact lazily creates a scoped account and sends a link', function () {
@ -53,7 +53,7 @@ test('requesting access for a known contact lazily creates a scoped account and
expect($user->accessibleCompanyIds())->toContain($company->id);
expect($user->gdpr_consent_at)->not->toBeNull();
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
});
test('requesting access reuses an existing user without creating a duplicate', function () {
@ -73,7 +73,7 @@ test('requesting access reuses an existing user without creating a duplicate', f
expect(User::query()->where('email', 'existing@example.test')->count())->toBe(1);
expect($existing->fresh()->accessibleCompanyIds())->toContain($company->id);
Mail::assertSent(MagicLoginLink::class);
Mail::assertQueued(MagicLoginLink::class);
});
test('the magic link form responds neutrally and triggers the service for a contact', function () {
@ -92,7 +92,7 @@ test('the magic link form responds neutrally and triggers the service for a cont
->assertHasNoErrors()
->assertSet('email', '');
Mail::assertSent(MagicLoginLink::class);
Mail::assertQueued(MagicLoginLink::class);
expect(User::query()->where('email', 'form@example.test')->exists())->toBeTrue();
});
@ -109,7 +109,7 @@ test('the magic link form sends a link to an existing active user without a cont
->assertHasNoErrors()
->assertSet('email', '');
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
});
test('requestMagicAccess does nothing for an unknown email', function () {
@ -120,7 +120,7 @@ test('requestMagicAccess does nothing for an unknown email', function () {
expect($sent)->toBeFalse();
expect(User::query()->where('email', 'nobody@example.test')->exists())->toBeFalse();
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('requestMagicAccess does not send to an inactive existing user', function () {
@ -132,7 +132,7 @@ test('requestMagicAccess does not send to an inactive existing user', function (
$sent = app(ContactAccessService::class)->requestMagicAccess('off@example.test');
expect($sent)->toBeFalse();
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('a later-added company with the same email is linked on the next password login', function () {
@ -213,7 +213,7 @@ test('a company email lazily creates an account scoped to that company', functio
expect($user->name)->toBe('Firma AG');
expect($user->accessibleCompanyIds())->toContain($company->id);
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
});
test('one account is created for an email stored across multiple companies and contacts', function () {
@ -247,7 +247,7 @@ test('one account is created for an email stored across multiple companies and c
expect($ids)->toContain($companyB->id);
expect($ids)->toContain($companyC->id);
Mail::assertSent(MagicLoginLink::class, 1);
Mail::assertQueued(MagicLoginLink::class, 1);
});
test('requesting access does not mutate an existing inactive account', function () {
@ -268,7 +268,7 @@ test('requesting access does not mutate an existing inactive account', function
expect($sent)->toBeFalse();
// Keine Firmenzuordnung an einem deaktivierten Bestands-Account.
expect($existing->fresh()->accessibleCompanyIds())->not->toContain($company->id);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('the honeypot blocks bots without creating an account', function () {
@ -287,6 +287,6 @@ test('the honeypot blocks bots without creating an account', function () {
->call('requestLink')
->assertHasNoErrors();
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
expect(User::query()->where('email', 'bot-target@example.test')->exists())->toBeFalse();
});