gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

auth/mail: Magic-Link-2FA (M1) + Mailversand über die Queue

Browse source 
- Magic-Link-Login übergibt bei aktiviertem 2FA an die 2FA-Challenge,
  statt sie zu umgehen (M1).
- Bestätigungs-/Benachrichtigungs-Mails (Kontakt, Recht, Kündigung,
  Widerruf, Magic-Link) laufen als ShouldQueue+afterCommit über die Queue,
  damit die Response nicht am SMTP-Roundtrip hängt.

Hinweis: Der Queue-Worker muss im Betrieb laufen und überwacht werden, da
fristrelevante Bestätigungen darüber zugestellt werden (siehe
Betriebsüberwachung).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:49:21 +00:00
parent 8f517e993d
commit fe1525b9ff
20 changed files with 135 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/Feature/Web/ReportFormTest.php
View file

@ -48,8 +48,8 @@ test('an illegal content report creates a request and confirms receipt with a re
expect(session('report-status'))->toContain($request->reference());
// DSA Art. 16 Abs. 4: unverzügliche Eingangsbestätigung + interner Hinweis.
Mail::assertSent(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
Mail::assertSent(LegalRequestSubmitted::class);
Mail::assertQueued(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
Mail::assertQueued(LegalRequestSubmitted::class);
});
test('a reported url matching a published release is linked to it', function () {
@ -86,7 +86,7 @@ test('the illegal content report requires the truthfulness affirmation and a val
->assertSessionHasErrors(['reported_url', 'truth_affirmed']);
expect(LegalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('the contact data removal form creates a dsgvo request without affirmation checkbox', function () {
@ -103,7 +103,7 @@ test('the contact data removal form creates a dsgvo request without affirmation
$request = LegalRequest::query()->sole();
expect($request->type)->toBe(LegalRequestType::Dsgvo);
expect($request->portal)->toBe('presseecho');
Mail::assertSent(LegalRequestReceived::class);
Mail::assertQueued(LegalRequestReceived::class);
});
test('a filled honeypot is silently discarded', function () {
@ -120,7 +120,7 @@ test('a filled honeypot is silently discarded', function () {
])->assertSessionHas('report-status');
expect(LegalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('an unknown form way responds 404', function () {