WS-6: E-Mail-Verifizierung, Auth-Flow-Fixes & Legacy-Rollen-Sicherheitsfix
E-Mail-Verifizierung (Entscheidung 15.06.): - User implementiert MustVerifyEmail; Registrierung legt inaktives, rollenloses Konto an und leitet auf die Danke-/Notice-Seite; Registered-Event versendet die Verifizierungsmail. Bestätigter Link aktiviert das Konto + vergibt customer-Rolle (ActivateUserAfterVerification). Backfill-Migration setzt email_verified_at für alle Bestands-User (sonst würde die verified-Middleware ~59k aktive Legacy-User aussperren). Seeder-User verifiziert. Auth-Flow-Korrekturen: - Magic-Link-Consume: rollensicherer Redirect ohne intended() (Customer landete sonst per stale intended=/dashboard im 403-Admin-Bereich). - Guest-Redirect (bootstrap/app.php) rollen-/verifizierungsbewusst statt fix /dashboard – schließt die 403-Sackgasse auf /login und /register. - Logout auf der Notice-Seite via echtes POST-Formular statt Livewire-Action (behebt 419 beim Session-Invalidate). - Magic-Link-Anforderung über eigenes Modal mit separater E-Mail-Eingabe. - Unverifizierte Login-Versuche landen auf der Notice-Seite. Sicherheitsfix Legacy-Rollen: - UserImporter mappte Alt-Gruppe 2 (Self-Publisher) auf editor (= Admin-Zugriff). Mapping auf customer korrigiert; Daten-Migration stuft die 65.950 fälschlichen Legacy-Editoren auf customer herab. Echte admin/api-only bleiben unberührt. Tests: Registration, EmailVerification, Authentication (Guest-Redirect), MagicLinkLogin (Modal/Redirect/Regression), Legacy-Import (Gruppen-Mapping). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
e54f6e2552
commit
f06650a641
18 changed files with 608 additions and 86 deletions
|
|
@ -24,6 +24,9 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Willkommen zu
|
|||
|
||||
public bool $remember = false;
|
||||
|
||||
// Eigene Eingabe für das Magic-Link-Modal, getrennt vom Login-Formular.
|
||||
public string $magicEmail = '';
|
||||
|
||||
/**
|
||||
* Handle an incoming authentication request.
|
||||
*/
|
||||
|
|
@ -52,6 +55,14 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Willkommen zu
|
|||
RateLimiter::clear($this->throttleKey());
|
||||
Session::regenerate();
|
||||
|
||||
// Unverifizierte Selbst-Registrierer (Konto angelegt, Mail noch nicht
|
||||
// bestätigt) gehören auf die Notice-Seite, nicht in die Panel-Logik.
|
||||
if ($authenticatedUser && ! $authenticatedUser->hasVerifiedEmail()) {
|
||||
$this->redirect(route('verification.notice', absolute: false));
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
// Rollen-basierter Default-Redirect:
|
||||
// Admin/Editor → /dashboard, Customer → /admin/me.
|
||||
// Ohne navigate:true, weil das Portal ein anderes Vite-Bundle nutzt
|
||||
|
|
@ -68,9 +79,12 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Willkommen zu
|
|||
|
||||
public function sendMagicLink(): void
|
||||
{
|
||||
$this->validateOnly('email');
|
||||
$this->validate(
|
||||
['magicEmail' => 'required|string|email'],
|
||||
attributes: ['magicEmail' => __('E-Mail-Adresse')],
|
||||
);
|
||||
|
||||
$user = User::query()->where('email', $this->email)->first();
|
||||
$user = User::query()->where('email', $this->magicEmail)->first();
|
||||
|
||||
if ($user && $user->is_active) {
|
||||
$generated = app(MagicLinkGenerator::class)->createLoginLink($user, request()->ip());
|
||||
|
|
@ -85,6 +99,9 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Willkommen zu
|
|||
);
|
||||
}
|
||||
|
||||
$this->reset('magicEmail');
|
||||
$this->dispatch('magic-link-sent');
|
||||
|
||||
session()->flash('status', __('If an active account exists for this email, we sent a magic login link.'));
|
||||
}
|
||||
|
||||
|
|
@ -118,7 +135,7 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Willkommen zu
|
|||
}
|
||||
}; ?>
|
||||
|
||||
<div>
|
||||
<div x-data="{ magicModal: false }" x-on:magic-link-sent.window="magicModal = false">
|
||||
@if (session('status'))
|
||||
<div class="field-status mb-4" role="status">
|
||||
{{ session('status') }}
|
||||
|
|
@ -195,17 +212,65 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Willkommen zu
|
|||
|
||||
<button
|
||||
type="button"
|
||||
wire:click="sendMagicLink"
|
||||
wire:loading.attr="disabled"
|
||||
wire:target="sendMagicLink"
|
||||
@click="magicModal = true; $nextTick(() => $refs.magicEmail?.focus())"
|
||||
class="auth-btn-outline !mt-0"
|
||||
>
|
||||
<svg width="13" height="13" viewBox="0 0 16 16" fill="none" aria-hidden="true">
|
||||
<rect x="2" y="3" width="12" height="10" stroke="currentColor" stroke-width="1.4" />
|
||||
<path d="M2.5 4l5.5 5 5.5-5" stroke="currentColor" stroke-width="1.4" stroke-linejoin="round" />
|
||||
</svg>
|
||||
<span wire:loading.remove wire:target="sendMagicLink">Magic-Link senden</span>
|
||||
<span wire:loading wire:target="sendMagicLink">Magic-Link wird gesendet …</span>
|
||||
<span>Magic-Link senden</span>
|
||||
</button>
|
||||
</form>
|
||||
|
||||
{{-- Magic-Link-Modal: eigene E-Mail-Eingabe, unabhängig vom Login-Formular --}}
|
||||
<div
|
||||
x-show="magicModal"
|
||||
x-cloak
|
||||
style="display: none"
|
||||
class="fixed inset-0 z-50 flex items-center justify-center p-4"
|
||||
x-on:keydown.escape.window="magicModal = false"
|
||||
role="dialog"
|
||||
aria-modal="true"
|
||||
>
|
||||
<div class="absolute inset-0 bg-black/50" @click="magicModal = false"></div>
|
||||
|
||||
<div
|
||||
class="relative w-full max-w-sm rounded-lg border border-bg-rule bg-bg-card p-6 shadow-xl"
|
||||
x-transition
|
||||
>
|
||||
<h3 class="text-[15px] font-semibold text-ink mb-1.5">Magic-Link anfordern</h3>
|
||||
<p class="text-[12.5px] text-ink-2 leading-[1.55] mb-4">
|
||||
Geben Sie Ihre E-Mail-Adresse ein. Wir senden Ihnen einen Anmeldelink,
|
||||
mit dem Sie sich ohne Passwort anmelden können.
|
||||
</p>
|
||||
|
||||
<form wire:submit="sendMagicLink">
|
||||
<label class="field-label" for="magic-email">E-Mail-Adresse</label>
|
||||
<input
|
||||
id="magic-email"
|
||||
x-ref="magicEmail"
|
||||
type="email"
|
||||
wire:model="magicEmail"
|
||||
autocomplete="email"
|
||||
class="field-input"
|
||||
placeholder="redaktion@ihr-unternehmen.de"
|
||||
@error('magicEmail') aria-invalid="true" @enderror
|
||||
/>
|
||||
@error('magicEmail')
|
||||
<p class="field-error">{{ $message }}</p>
|
||||
@enderror
|
||||
|
||||
<div class="flex gap-2.5 !mt-4">
|
||||
<button type="button" class="auth-btn-outline !mt-0 flex-1" @click="magicModal = false">
|
||||
Abbrechen
|
||||
</button>
|
||||
<button type="submit" class="auth-btn-primary !mt-0 flex-1" wire:loading.attr="disabled" wire:target="sendMagicLink">
|
||||
<span wire:loading.remove wire:target="sendMagicLink">Link senden</span>
|
||||
<span wire:loading wire:target="sendMagicLink">Senden …</span>
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue