auth/mail: Magic-Link-2FA (M1) + Mailversand über die Queue
- Magic-Link-Login übergibt bei aktiviertem 2FA an die 2FA-Challenge, statt sie zu umgehen (M1). - Bestätigungs-/Benachrichtigungs-Mails (Kontakt, Recht, Kündigung, Widerruf, Magic-Link) laufen als ShouldQueue+afterCommit über die Queue, damit die Response nicht am SMTP-Roundtrip hängt. Hinweis: Der Queue-Worker muss im Betrieb laufen und überwacht werden, da fristrelevante Bestätigungen darüber zugestellt werden (siehe Betriebsüberwachung). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
8f517e993d
commit
fe1525b9ff
20 changed files with 135 additions and 60 deletions
|
|
@ -22,7 +22,7 @@ test('requesting access for an unknown email creates nothing and sends no mail',
|
|||
|
||||
expect($sent)->toBeFalse();
|
||||
expect(User::query()->where('email', 'nobody@example.test')->exists())->toBeFalse();
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('requesting access for a known contact lazily creates a scoped account and sends a link', function () {
|
||||
|
|
@ -53,7 +53,7 @@ test('requesting access for a known contact lazily creates a scoped account and
|
|||
expect($user->accessibleCompanyIds())->toContain($company->id);
|
||||
expect($user->gdpr_consent_at)->not->toBeNull();
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
});
|
||||
|
||||
test('requesting access reuses an existing user without creating a duplicate', function () {
|
||||
|
|
@ -73,7 +73,7 @@ test('requesting access reuses an existing user without creating a duplicate', f
|
|||
|
||||
expect(User::query()->where('email', 'existing@example.test')->count())->toBe(1);
|
||||
expect($existing->fresh()->accessibleCompanyIds())->toContain($company->id);
|
||||
Mail::assertSent(MagicLoginLink::class);
|
||||
Mail::assertQueued(MagicLoginLink::class);
|
||||
});
|
||||
|
||||
test('the magic link form responds neutrally and triggers the service for a contact', function () {
|
||||
|
|
@ -92,7 +92,7 @@ test('the magic link form responds neutrally and triggers the service for a cont
|
|||
->assertHasNoErrors()
|
||||
->assertSet('email', '');
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class);
|
||||
Mail::assertQueued(MagicLoginLink::class);
|
||||
expect(User::query()->where('email', 'form@example.test')->exists())->toBeTrue();
|
||||
});
|
||||
|
||||
|
|
@ -109,7 +109,7 @@ test('the magic link form sends a link to an existing active user without a cont
|
|||
->assertHasNoErrors()
|
||||
->assertSet('email', '');
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
});
|
||||
|
||||
test('requestMagicAccess does nothing for an unknown email', function () {
|
||||
|
|
@ -120,7 +120,7 @@ test('requestMagicAccess does nothing for an unknown email', function () {
|
|||
|
||||
expect($sent)->toBeFalse();
|
||||
expect(User::query()->where('email', 'nobody@example.test')->exists())->toBeFalse();
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('requestMagicAccess does not send to an inactive existing user', function () {
|
||||
|
|
@ -132,7 +132,7 @@ test('requestMagicAccess does not send to an inactive existing user', function (
|
|||
$sent = app(ContactAccessService::class)->requestMagicAccess('off@example.test');
|
||||
|
||||
expect($sent)->toBeFalse();
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('a later-added company with the same email is linked on the next password login', function () {
|
||||
|
|
@ -213,7 +213,7 @@ test('a company email lazily creates an account scoped to that company', functio
|
|||
expect($user->name)->toBe('Firma AG');
|
||||
expect($user->accessibleCompanyIds())->toContain($company->id);
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
});
|
||||
|
||||
test('one account is created for an email stored across multiple companies and contacts', function () {
|
||||
|
|
@ -247,7 +247,7 @@ test('one account is created for an email stored across multiple companies and c
|
|||
expect($ids)->toContain($companyB->id);
|
||||
expect($ids)->toContain($companyC->id);
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, 1);
|
||||
Mail::assertQueued(MagicLoginLink::class, 1);
|
||||
});
|
||||
|
||||
test('requesting access does not mutate an existing inactive account', function () {
|
||||
|
|
@ -268,7 +268,7 @@ test('requesting access does not mutate an existing inactive account', function
|
|||
expect($sent)->toBeFalse();
|
||||
// Keine Firmenzuordnung an einem deaktivierten Bestands-Account.
|
||||
expect($existing->fresh()->accessibleCompanyIds())->not->toContain($company->id);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('the honeypot blocks bots without creating an account', function () {
|
||||
|
|
@ -287,6 +287,6 @@ test('the honeypot blocks bots without creating an account', function () {
|
|||
->call('requestLink')
|
||||
->assertHasNoErrors();
|
||||
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
expect(User::query()->where('email', 'bot-target@example.test')->exists())->toBeFalse();
|
||||
});
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ use App\Models\User;
|
|||
use Database\Seeders\RolesAndPermissionsSeeder;
|
||||
use Illuminate\Support\Facades\Mail;
|
||||
use Livewire\Volt\Volt as LivewireVolt;
|
||||
use PragmaRX\Google2FA\Google2FA;
|
||||
use Tests\TestCase;
|
||||
|
||||
test('user can request a magic login link from the magic-link page', function () {
|
||||
|
|
@ -17,7 +18,7 @@ test('user can request a magic login link from the magic-link page', function ()
|
|||
->call('requestLink')
|
||||
->assertHasNoErrors();
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, function (MagicLoginLink $mail) use ($user) {
|
||||
Mail::assertQueued(MagicLoginLink::class, function (MagicLoginLink $mail) use ($user) {
|
||||
return $mail->user->is($user) && str_contains($mail->loginUrl, '/magic-login/');
|
||||
});
|
||||
|
||||
|
|
@ -37,7 +38,7 @@ test('the magic link form validates its email field and clears on success', func
|
|||
->call('requestLink')
|
||||
->assertHasErrors(['email']);
|
||||
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
|
||||
// Gültige Eingabe → Feld wird geleert.
|
||||
LivewireVolt::test('auth.magic-link')
|
||||
|
|
@ -64,7 +65,7 @@ test('magic link requests are rate limited per email', function () {
|
|||
->call('requestLink')
|
||||
->assertHasErrors(['email']);
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, 3);
|
||||
Mail::assertQueued(MagicLoginLink::class, 3);
|
||||
});
|
||||
|
||||
test('admin can login with a valid magic link and lands on admin dashboard', function () {
|
||||
|
|
@ -80,7 +81,7 @@ test('admin can login with a valid magic link and lands on admin dashboard', fun
|
|||
|
||||
$sentMail = null;
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
Mail::assertQueued(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
$sentMail = $mail;
|
||||
|
||||
return true;
|
||||
|
|
@ -111,7 +112,7 @@ test('customer is redirected to me dashboard after magic link login', function (
|
|||
->call('requestLink');
|
||||
|
||||
$sentMail = null;
|
||||
Mail::assertSent(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
Mail::assertQueued(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
$sentMail = $mail;
|
||||
|
||||
return true;
|
||||
|
|
@ -147,6 +148,36 @@ test('a stale intended admin url does not send a customer into the 403 admin are
|
|||
$this->assertAuthenticatedAs($customer);
|
||||
});
|
||||
|
||||
test('magic link login with two-factor enabled is handed to the challenge', function () {
|
||||
/**
|
||||
* Regression zu Befund M1 (Audit 14.07.2026): Magic-Link darf 2FA nicht
|
||||
* umgehen — bei aktivem 2FA wird wie beim Passwort-Login in die Challenge
|
||||
* übergeben, statt direkt einzuloggen.
|
||||
*/
|
||||
/** @var TestCase $this */
|
||||
$user = User::factory()->create(['is_active' => true]);
|
||||
$user->forceFill([
|
||||
'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
|
||||
'two_factor_confirmed_at' => now(),
|
||||
])->save();
|
||||
|
||||
$plainToken = 'twofactor-token';
|
||||
MagicLink::query()->create([
|
||||
'user_id' => $user->id,
|
||||
'token_hash' => hash('sha256', $plainToken),
|
||||
'purpose' => 'login',
|
||||
'expires_at' => now()->addMinutes(5),
|
||||
]);
|
||||
|
||||
$this->get(route('magic-links.consume', ['token' => $plainToken]))
|
||||
->assertRedirect(route('two-factor.challenge'));
|
||||
|
||||
$this->assertGuest();
|
||||
expect(session('login.id'))->toBe($user->id);
|
||||
// Einmal-Nutzung bleibt erhalten: Link ist verbraucht.
|
||||
expect(MagicLink::query()->firstOrFail()->consumed_at)->not->toBeNull();
|
||||
});
|
||||
|
||||
test('expired magic link can not be used', function () {
|
||||
/** @var TestCase $this */
|
||||
$user = User::factory()->create(['is_active' => true]);
|
||||
|
|
|
|||
|
|
@ -79,8 +79,8 @@ test('a dsgvo request is stored in the queue', function () {
|
|||
|
||||
// T10: Vorgangsnummer im Hinweis + Eingangsbestätigung/Queue-Hinweis.
|
||||
expect(session('legal-status'))->toContain($request->reference());
|
||||
Mail::assertSent(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('betroffen@example.test'));
|
||||
Mail::assertSent(LegalRequestSubmitted::class);
|
||||
Mail::assertQueued(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('betroffen@example.test'));
|
||||
Mail::assertQueued(LegalRequestSubmitted::class);
|
||||
});
|
||||
|
||||
test('a personal rights request requires an email', function () {
|
||||
|
|
@ -111,8 +111,8 @@ test('a report can be submitted without an email and feeds the same queue', func
|
|||
expect($request->requester_email)->toBeNull();
|
||||
|
||||
// Ohne E-Mail keine Eingangsbestätigung — der interne Hinweis geht trotzdem raus.
|
||||
Mail::assertNotSent(LegalRequestReceived::class);
|
||||
Mail::assertSent(LegalRequestSubmitted::class);
|
||||
Mail::assertNotQueued(LegalRequestReceived::class);
|
||||
Mail::assertQueued(LegalRequestSubmitted::class);
|
||||
});
|
||||
|
||||
test('a filled honeypot field blocks bots without creating a request', function (string $field) {
|
||||
|
|
|
|||
|
|
@ -48,8 +48,8 @@ test('an illegal content report creates a request and confirms receipt with a re
|
|||
expect(session('report-status'))->toContain($request->reference());
|
||||
|
||||
// DSA Art. 16 Abs. 4: unverzügliche Eingangsbestätigung + interner Hinweis.
|
||||
Mail::assertSent(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
|
||||
Mail::assertSent(LegalRequestSubmitted::class);
|
||||
Mail::assertQueued(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
|
||||
Mail::assertQueued(LegalRequestSubmitted::class);
|
||||
});
|
||||
|
||||
test('a reported url matching a published release is linked to it', function () {
|
||||
|
|
@ -86,7 +86,7 @@ test('the illegal content report requires the truthfulness affirmation and a val
|
|||
->assertSessionHasErrors(['reported_url', 'truth_affirmed']);
|
||||
|
||||
expect(LegalRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('the contact data removal form creates a dsgvo request without affirmation checkbox', function () {
|
||||
|
|
@ -103,7 +103,7 @@ test('the contact data removal form creates a dsgvo request without affirmation
|
|||
$request = LegalRequest::query()->sole();
|
||||
expect($request->type)->toBe(LegalRequestType::Dsgvo);
|
||||
expect($request->portal)->toBe('presseecho');
|
||||
Mail::assertSent(LegalRequestReceived::class);
|
||||
Mail::assertQueued(LegalRequestReceived::class);
|
||||
});
|
||||
|
||||
test('a filled honeypot is silently discarded', function () {
|
||||
|
|
@ -120,7 +120,7 @@ test('a filled honeypot is silently discarded', function () {
|
|||
])->assertSessionHas('report-status');
|
||||
|
||||
expect(LegalRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('an unknown form way responds 404', function () {
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ test('the termination confirmation page renders the § 312k form with the hub sh
|
|||
->toContain('Publisher · Hub');
|
||||
});
|
||||
|
||||
test('an ordinary termination is persisted and both mails are sent immediately', function () {
|
||||
test('an ordinary termination is persisted and both mails are queued after persistence', function () {
|
||||
/** @var TestCase $this */
|
||||
Mail::fake();
|
||||
config()->set('domains.domains.pressekonto.brand.contact_email', 'kontakt@pressekonto.de');
|
||||
|
|
@ -62,8 +62,8 @@ test('an ordinary termination is persisted and both mails are sent immediately',
|
|||
expect($request->status)->toBe('open');
|
||||
|
||||
// § 312k Abs. 4 BGB: sofortige automatische Zugangsbestätigung.
|
||||
Mail::assertSent(TerminationRequestReceived::class, fn (TerminationRequestReceived $mail) => $mail->hasTo('paula@example.test'));
|
||||
Mail::assertSent(TerminationRequestSubmitted::class, fn (TerminationRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
|
||||
Mail::assertQueued(TerminationRequestReceived::class, fn (TerminationRequestReceived $mail) => $mail->hasTo('paula@example.test'));
|
||||
Mail::assertQueued(TerminationRequestSubmitted::class, fn (TerminationRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
|
||||
});
|
||||
|
||||
test('an extraordinary termination requires a reason', function () {
|
||||
|
|
@ -78,7 +78,7 @@ test('an extraordinary termination requires a reason', function () {
|
|||
])->assertSessionHasErrorsIn('termination', ['reason']);
|
||||
|
||||
expect(TerminationRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
|
||||
$this->post('https://pressekonto.test/de/kuendigung', [
|
||||
'kind' => 'ausserordentlich',
|
||||
|
|
@ -123,7 +123,7 @@ test('termination validation errors land in the termination error bag', function
|
|||
])->assertSessionHasErrorsIn('termination', ['kind', 'name', 'email', 'terminate_mode']);
|
||||
|
||||
expect(TerminationRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('honeypot submissions are silently accepted without persisting or mailing', function () {
|
||||
|
|
@ -139,5 +139,5 @@ test('honeypot submissions are silently accepted without persisting or mailing',
|
|||
])->assertSessionHas('termination-status');
|
||||
|
||||
expect(TerminationRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ test('the withdrawal ui is retired on the hub (B2B-only, decision E2)', function
|
|||
->not->toContain('open-withdrawal-modal');
|
||||
});
|
||||
|
||||
test('a withdrawal is persisted and both mails are sent immediately', function () {
|
||||
test('a withdrawal is persisted and both mails are queued after persistence', function () {
|
||||
/** @var TestCase $this */
|
||||
Mail::fake();
|
||||
config()->set('domains.domains.pressekonto.brand.contact_email', 'kontakt@pressekonto.de');
|
||||
|
|
@ -42,8 +42,8 @@ test('a withdrawal is persisted and both mails are sent immediately', function (
|
|||
expect($request->status)->toBe('open');
|
||||
|
||||
// Gesetzlich vorgeschrieben: sofortige automatische Eingangsbestätigung.
|
||||
Mail::assertSent(WithdrawalRequestReceived::class, fn (WithdrawalRequestReceived $mail) => $mail->hasTo('paula@example.test'));
|
||||
Mail::assertSent(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
|
||||
Mail::assertQueued(WithdrawalRequestReceived::class, fn (WithdrawalRequestReceived $mail) => $mail->hasTo('paula@example.test'));
|
||||
Mail::assertQueued(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
|
||||
});
|
||||
|
||||
test('the order reference is optional', function () {
|
||||
|
|
@ -68,7 +68,7 @@ test('withdrawal validation errors land in the withdrawal error bag', function (
|
|||
])->assertSessionHasErrorsIn('withdrawal', ['name', 'email']);
|
||||
|
||||
expect(WithdrawalRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('honeypot submissions are silently accepted without persisting or mailing', function () {
|
||||
|
|
@ -82,7 +82,7 @@ test('honeypot submissions are silently accepted without persisting or mailing',
|
|||
])->assertSessionHas('withdrawal-status');
|
||||
|
||||
expect(WithdrawalRequest::query()->count())->toBe(0);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('a withdrawal from a spoke domain goes to that brand address', function () {
|
||||
|
|
@ -95,5 +95,5 @@ test('a withdrawal from a spoke domain goes to that brand address', function ()
|
|||
'email' => 'paula@example.test',
|
||||
])->assertSessionHas('withdrawal-status');
|
||||
|
||||
Mail::assertSent(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('redaktion@presseecho.de'));
|
||||
Mail::assertQueued(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('redaktion@presseecho.de'));
|
||||
});
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue