gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

auth/mail: Magic-Link-2FA (M1) + Mailversand über die Queue

Browse source 
- Magic-Link-Login übergibt bei aktiviertem 2FA an die 2FA-Challenge,
  statt sie zu umgehen (M1).
- Bestätigungs-/Benachrichtigungs-Mails (Kontakt, Recht, Kündigung,
  Widerruf, Magic-Link) laufen als ShouldQueue+afterCommit über die Queue,
  damit die Response nicht am SMTP-Roundtrip hängt.

Hinweis: Der Queue-Worker muss im Betrieb laufen und überwacht werden, da
fristrelevante Bestätigungen darüber zugestellt werden (siehe
Betriebsüberwachung).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:49:21 +00:00
parent 8f517e993d
commit fe1525b9ff
20 changed files with 135 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/Feature/Web/WithdrawalRequestTest.php
View file

@ -19,7 +19,7 @@ test('the withdrawal ui is retired on the hub (B2B-only, decision E2)', function
->not->toContain('open-withdrawal-modal');
});
test('a withdrawal is persisted and both mails are sent immediately', function () {
test('a withdrawal is persisted and both mails are queued after persistence', function () {
/** @var TestCase $this */
Mail::fake();
config()->set('domains.domains.pressekonto.brand.contact_email', 'kontakt@pressekonto.de');
@ -42,8 +42,8 @@ test('a withdrawal is persisted and both mails are sent immediately', function (
expect($request->status)->toBe('open');
// Gesetzlich vorgeschrieben: sofortige automatische Eingangsbestätigung.
Mail::assertSent(WithdrawalRequestReceived::class, fn (WithdrawalRequestReceived $mail) => $mail->hasTo('paula@example.test'));
Mail::assertSent(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
Mail::assertQueued(WithdrawalRequestReceived::class, fn (WithdrawalRequestReceived $mail) => $mail->hasTo('paula@example.test'));
Mail::assertQueued(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('kontakt@pressekonto.de'));
});
test('the order reference is optional', function () {
@ -68,7 +68,7 @@ test('withdrawal validation errors land in the withdrawal error bag', function (
])->assertSessionHasErrorsIn('withdrawal', ['name', 'email']);
expect(WithdrawalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('honeypot submissions are silently accepted without persisting or mailing', function () {
@ -82,7 +82,7 @@ test('honeypot submissions are silently accepted without persisting or mailing',
])->assertSessionHas('withdrawal-status');
expect(WithdrawalRequest::query()->count())->toBe(0);
Mail::assertNothingSent();
Mail::assertNothingOutgoing();
});
test('a withdrawal from a spoke domain goes to that brand address', function () {
@ -95,5 +95,5 @@ test('a withdrawal from a spoke domain goes to that brand address', function ()
'email' => 'paula@example.test',
])->assertSessionHas('withdrawal-status');
Mail::assertSent(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('redaktion@presseecho.de'));
Mail::assertQueued(WithdrawalRequestSubmitted::class, fn (WithdrawalRequestSubmitted $mail) => $mail->hasTo('redaktion@presseecho.de'));
});