gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

auth/mail: Magic-Link-2FA (M1) + Mailversand über die Queue

Browse source 
- Magic-Link-Login übergibt bei aktiviertem 2FA an die 2FA-Challenge,
  statt sie zu umgehen (M1).
- Bestätigungs-/Benachrichtigungs-Mails (Kontakt, Recht, Kündigung,
  Widerruf, Magic-Link) laufen als ShouldQueue+afterCommit über die Queue,
  damit die Response nicht am SMTP-Roundtrip hängt.

Hinweis: Der Queue-Worker muss im Betrieb laufen und überwacht werden, da
fristrelevante Bestätigungen darüber zugestellt werden (siehe
Betriebsüberwachung).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:49:21 +00:00
parent 8f517e993d
commit fe1525b9ff
20 changed files with 135 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/Feature/Web/ReportFormTest.php
View file

@ -48,8 +48,8 @@ test('an illegal content report creates a request and confirms receipt with a re
expect(session('report-status'))->toContain($request->reference());
// DSA Art. 16 Abs. 4: unverzügliche Eingangsbestätigung + interner Hinweis.
Mail::assertSent(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
Mail::assertSent(LegalRequestSubmitted::class);
Mail::assertQueued(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
Mail::assertQueued(LegalRequestSubmitted::class);
});
test('a reported url matching a published release is linked to it', function () {
@ -86,7 +86,7 @@ test('the illegal content report requires the truthfulness affirmation and a val
->assertSessionHasErrors(['reported_url', 'truth_affirmed']);
expect(LegalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('the contact data removal form creates a dsgvo request without affirmation checkbox', function () {
@ -103,7 +103,7 @@ test('the contact data removal form creates a dsgvo request without affirmation
$request = LegalRequest::query()->sole();
expect($request->type)->toBe(LegalRequestType::Dsgvo);
expect($request->portal)->toBe('presseecho');
Mail::assertSent(LegalRequestReceived::class);
Mail::assertQueued(LegalRequestReceived::class);
});
test('a filled honeypot is silently discarded', function () {
@ -120,7 +120,7 @@ test('a filled honeypot is silently discarded', function () {
])->assertSessionHas('report-status');
expect(LegalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('an unknown form way responds 404', function () {

12
tests/Feature/Web/TerminationRequestTest.php
View file

@ -34,7 +34,7 @@ test('the termination confirmation page renders the § 312k form with the hub sh
->toContain('Publisher · Hub');
});
test('an ordinary termination is persisted and both mails are sent immediately', function () {
test('an ordinary termination is persisted and both mails are queued after persistence', function () {
/** @var TestCase $this */
Mail::fake();
config()->set('domains.domains.pressekonto.brand.contact_email', 'kontakt@pressekonto.de');
@ -62,8 +62,8 @@ test('an ordinary termination is persisted and both mails are sent immediately',
expect($request->status)->toBe('open');
// § 312k Abs. 4 BGB: sofortige automatische Zugangsbestätigung.
Mail::assertSent(TerminationRequestReceived::class, fn (TerminationRequestReceived $mail) => $mail->hasTo('paula@example.test'));
Mail::assertSent(TerminationRequestSubmitted::class, fn (TerminationRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
Mail::assertQueued(TerminationRequestReceived::class, fn (TerminationRequestReceived $mail) => $mail->hasTo('paula@example.test'));
Mail::assertQueued(TerminationRequestSubmitted::class, fn (TerminationRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
});
test('an extraordinary termination requires a reason', function () {
@ -78,7 +78,7 @@ test('an extraordinary termination requires a reason', function () {
])->assertSessionHasErrorsIn('termination', ['reason']);
expect(TerminationRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
$this->post('https://pressekonto.test/de/kuendigung', [
'kind' => 'ausserordentlich',
@ -123,7 +123,7 @@ test('termination validation errors land in the termination error bag', function
])->assertSessionHasErrorsIn('termination', ['kind', 'name', 'email', 'terminate_mode']);
expect(TerminationRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('honeypot submissions are silently accepted without persisting or mailing', function () {
@ -139,5 +139,5 @@ test('honeypot submissions are silently accepted without persisting or mailing',
])->assertSessionHas('termination-status');
expect(TerminationRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});

12
tests/Feature/Web/WithdrawalRequestTest.php
View file

@ -19,7 +19,7 @@ test('the withdrawal ui is retired on the hub (B2B-only, decision E2)', function
->not->toContain('open-withdrawal-modal');
});
test('a withdrawal is persisted and both mails are sent immediately', function () {
test('a withdrawal is persisted and both mails are queued after persistence', function () {
/** @var TestCase $this */
Mail::fake();
config()->set('domains.domains.pressekonto.brand.contact_email', 'kontakt@pressekonto.de');
@ -42,8 +42,8 @@ test('a withdrawal is persisted and both mails are sent immediately', function (
expect($request->status)->toBe('open');
// Gesetzlich vorgeschrieben: sofortige automatische Eingangsbestätigung.
Mail::assertSent(WithdrawalRequestReceived::class, fn (WithdrawalRequestReceived $mail) => $mail->hasTo('paula@example.test'));
Mail::assertSent(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
Mail::assertQueued(WithdrawalRequestReceived::class, fn (WithdrawalRequestReceived $mail) => $mail->hasTo('paula@example.test'));
Mail::assertQueued(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
});
test('the order reference is optional', function () {
@ -68,7 +68,7 @@ test('withdrawal validation errors land in the withdrawal error bag', function (
])->assertSessionHasErrorsIn('withdrawal', ['name', 'email']);
expect(WithdrawalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('honeypot submissions are silently accepted without persisting or mailing', function () {
@ -82,7 +82,7 @@ test('honeypot submissions are silently accepted without persisting or mailing',
])->assertSessionHas('withdrawal-status');
expect(WithdrawalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('a withdrawal from a spoke domain goes to that brand address', function () {
@ -95,5 +95,5 @@ test('a withdrawal from a spoke domain goes to that brand address', function ()
'email' => 'paula@example.test',
])->assertSessionHas('withdrawal-status');
Mail::assertSent(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('redaktion@presseecho.de'));
Mail::assertQueued(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('redaktion@presseecho.de'));
});