gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

WS-6: E-Mail-Verifizierung, Auth-Flow-Fixes & Legacy-Rollen-Sicherheitsfix

Browse source 
E-Mail-Verifizierung (Entscheidung 15.06.):
- User implementiert MustVerifyEmail; Registrierung legt inaktives, rollenloses
  Konto an und leitet auf die Danke-/Notice-Seite; Registered-Event versendet die
  Verifizierungsmail. Bestätigter Link aktiviert das Konto + vergibt customer-Rolle
  (ActivateUserAfterVerification). Backfill-Migration setzt email_verified_at für
  alle Bestands-User (sonst würde die verified-Middleware ~59k aktive Legacy-User
  aussperren). Seeder-User verifiziert.

Auth-Flow-Korrekturen:
- Magic-Link-Consume: rollensicherer Redirect ohne intended() (Customer landete
  sonst per stale intended=/dashboard im 403-Admin-Bereich).
- Guest-Redirect (bootstrap/app.php) rollen-/verifizierungsbewusst statt fix
  /dashboard – schließt die 403-Sackgasse auf /login und /register.
- Logout auf der Notice-Seite via echtes POST-Formular statt Livewire-Action
  (behebt 419 beim Session-Invalidate).
- Magic-Link-Anforderung über eigenes Modal mit separater E-Mail-Eingabe.
- Unverifizierte Login-Versuche landen auf der Notice-Seite.

Sicherheitsfix Legacy-Rollen:
- UserImporter mappte Alt-Gruppe 2 (Self-Publisher) auf editor (= Admin-Zugriff).
  Mapping auf customer korrigiert; Daten-Migration stuft die 65.950 fälschlichen
  Legacy-Editoren auf customer herab. Echte admin/api-only bleiben unberührt.

Tests: Registration, EmailVerification, Authentication (Guest-Redirect),
MagicLinkLogin (Modal/Redirect/Regression), Legacy-Import (Gruppen-Mapping).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-06-16 08:16:41 +00:00
parent e54f6e2552
commit f06650a641
18 changed files with 608 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

50
tests/Feature/Auth/MagicLinkLoginTest.php
View file

@ -13,7 +13,7 @@ test('user can request a magic login link from login page', function () {
$user = User::factory()->create(['is_active' => true]);
LivewireVolt::test('auth.login')
->set('email', $user->email)
->set('magicEmail', $user->email)
->call('sendMagicLink')
->assertHasNoErrors();
@ -27,6 +27,27 @@ test('user can request a magic login link from login page', function () {
expect($magicLink->token_hash)->toHaveLength(64);
});
test('the magic link modal validates its own email field and closes on success', function () {
Mail::fake();
$user = User::factory()->create(['is_active' => true]);
// Leere Eingabe → Validierungsfehler, keine Mail.
LivewireVolt::test('auth.login')
->set('magicEmail', '')
->call('sendMagicLink')
->assertHasErrors(['magicEmail']);
Mail::assertNothingSent();
// Gültige Eingabe → Feld wird geleert, Schließen-Event wird ausgelöst.
LivewireVolt::test('auth.login')
->set('magicEmail', $user->email)
->call('sendMagicLink')
->assertHasNoErrors()
->assertSet('magicEmail', '')
->assertDispatched('magic-link-sent');
});
test('admin can login with a valid magic link and lands on admin dashboard', function () {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
@ -35,7 +56,7 @@ test('admin can login with a valid magic link and lands on admin dashboard', fun
$user->assignRole('admin');
LivewireVolt::test('auth.login')
->set('email', $user->email)
->set('magicEmail', $user->email)
->call('sendMagicLink');
$sentMail = null;
@ -67,7 +88,7 @@ test('customer is redirected to me dashboard after magic link login', function (
$customer->assignRole('customer');
LivewireVolt::test('auth.login')
->set('email', $customer->email)
->set('magicEmail', $customer->email)
->call('sendMagicLink');
$sentMail = null;
@ -84,6 +105,29 @@ test('customer is redirected to me dashboard after magic link login', function (
$this->assertAuthenticatedAs($customer);
});
test('a stale intended admin url does not send a customer into the 403 admin area', function () {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
$customer = User::factory()->create(['is_active' => true]);
$customer->assignRole('customer');
$plainToken = 'intended-token';
MagicLink::query()->create([
'user_id' => $customer->id,
'token_hash' => hash('sha256', $plainToken),
'purpose' => 'login',
'expires_at' => now()->addMinutes(5),
]);
// Als Gast zuvor /dashboard besucht → intended-URL liegt in der Session.
$this->withSession(['url.intended' => route('dashboard')]);
$this->get(route('magic-links.consume', ['token' => $plainToken]))
->assertRedirect(route('me.dashboard', absolute: false));
$this->assertAuthenticatedAs($customer);
});
test('expired magic link can not be used', function () {
/** @var TestCase $this */
$user = User::factory()->create(['is_active' => true]);