presseportale/tests/Feature/PressReleasePreviewTest.php

<?php

use App\Enums\Portal;
use App\Enums\PressReleaseStatus;
use App\Models\PressRelease;
use App\Models\PressReleaseImage;
use App\Models\User;
use App\Services\Auth\MagicLinkGenerator;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Storage;
use Livewire\Volt\Volt as LivewireVolt;
use Tests\TestCase;

function makePreviewCustomerWithPressRelease(Portal $portal): array
{
    test()->seed(RolesAndPermissionsSeeder::class);

    $customer = User::factory()->create(['is_active' => true]);
    $customer->assignRole('customer');

    $pr = PressRelease::factory()->forPortal($portal)->create([
        'user_id' => $customer->id,
        'status' => PressReleaseStatus::Draft->value,
    ]);

    return [$customer, $pr];
}

test('preview link returns press release for valid unexpired token', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Geheime Vorschau',
        'text' => 'Vertraulicher Inhalt für unsere Partner.',
    ]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertOk()
        ->assertSee('Geheime Vorschau')
        ->assertSee('Vertraulicher Inhalt');
});

test('preview renders the public release detail layout with preview banner and noindex', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Presseecho)->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Entwurf im Portal-Design',
    ]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertOk()
        ->assertViewIs('web.release-detail')
        ->assertHeader('X-Robots-Tag', 'noindex, nofollow')
        ->assertSee('<meta name="robots" content="noindex,nofollow">', false)
        ->assertDontSee('rel="canonical"', false)
        ->assertSeeText('Vorschau')
        ->assertSeeText('So erscheint die Pressemitteilung nach der Veröffentlichung.')
        ->assertSeeText('Status: Entwurf')
        ->assertSeeText('Entwurf im Portal-Design')
        // Der Werbeplatz-Hinweis erscheint nur auf der öffentlichen Seite.
        ->assertDontSeeText('Hier könnte Ihre Werbung stehen');
});

test('preview applies the theme of the target portal', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Businessportal24)->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Draft->value,
    ]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]));

    expect(config('app.theme'))->toBe('businessportal24');
});

test('preview of a single portal release shows no portal switch', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Presseecho)->create(['user_id' => $owner->id]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertOk()
        ->assertDontSee('?portal=businessportal24', false);
});

test('preview of a both portals release defaults to presseecho and shows the portal switch', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Both)->create(['user_id' => $owner->id]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertOk()
        ->assertSee('?portal=presseecho', false)
        ->assertSee('?portal=businessportal24', false);

    expect(config('app.theme'))->toBe('presseecho');
});

test('preview of a both portals release can be switched to businessportal24', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Both)->create(['user_id' => $owner->id]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token'], 'portal' => 'businessportal24']))
        ->assertOk();

    expect(config('app.theme'))->toBe('businessportal24');
});

test('portal query parameter is ignored for single portal releases', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Presseecho)->create(['user_id' => $owner->id]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token'], 'portal' => 'businessportal24']))
        ->assertOk();

    expect(config('app.theme'))->toBe('presseecho');
});

test('preview link allows access to draft press release without authentication', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Review->value,
    ]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $response = $this->get(route('press-releases.preview', ['token' => $share['plain_token']]));

    $response->assertOk();
    expect(auth()->check())->toBeFalse();
});

test('preview media of an unpublished release is reachable via the signed url but not unsigned', function () {
    /** @var TestCase $this */
    Storage::fake('local');

    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Presseecho)->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Entwurf mit Bild',
    ]);

    $path = "press-releases/{$pr->id}/images/entwurf-detail.jpg";
    Storage::disk('local')->put($path, 'binary');

    $image = PressReleaseImage::query()->create([
        'press_release_id' => $pr->id,
        'disk' => 'local',
        'path' => $path,
        'variants' => ['detail' => $path],
        'is_preview' => true,
    ]);

    // Ohne Signatur ist das Medium einer unveröffentlichten PM anonym gesperrt.
    $this->get(route('media.press-release-images.show', ['image' => $image->id, 'variant' => 'detail']))
        ->assertNotFound();

    // Die im Vorschaumodus erzeugte, signierte URL liefert das Bild aus.
    $signedUrl = $image->variantUrl('detail', signed: true);
    expect($signedUrl)->toContain('signature=');

    $this->get($signedUrl)->assertOk();
});

test('preview page emits signed media urls for the hero image', function () {
    /** @var TestCase $this */
    Storage::fake('local');

    $owner = User::factory()->create();
    $pr = PressRelease::factory()->forPortal(Portal::Presseecho)->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Draft->value,
    ]);

    $path = "press-releases/{$pr->id}/images/hero-detail.jpg";
    Storage::disk('local')->put($path, 'binary');
    PressReleaseImage::query()->create([
        'press_release_id' => $pr->id,
        'disk' => 'local',
        'path' => $path,
        'variants' => ['detail' => $path],
        'is_preview' => true,
    ]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertOk()
        ->assertSee('media/press-release-images', false)
        ->assertSee('signature=', false);
});

test('expired preview link returns 410 gone', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->create(['user_id' => $owner->id]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);
    $share['magic_link']->update(['expires_at' => now()->subMinute()]);

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertStatus(410)
        ->assertSee('abgelaufen');
});

test('invalid token returns 404', function () {
    /** @var TestCase $this */
    $this->get(route('press-releases.preview', ['token' => str_repeat('a', 64)]))
        ->assertStatus(404)
        ->assertSee('ungültig');
});

test('preview link for permanently deleted press release returns 404', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->create(['user_id' => $owner->id]);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    $pr->forceDelete();

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertStatus(404);
});

test('preview link for soft deleted press release returns 404 (Audit F04)', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $pr = PressRelease::factory()->create(['user_id' => $owner->id, 'title' => 'Geloeschte Vorschau-Meldung']);

    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);

    // Normale Löschung (Soft Delete) – der Vorschau-Token darf die Meldung
    // nicht mehr laden, auch wenn die Zeile noch existiert.
    $pr->delete();

    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
        ->assertStatus(404)
        ->assertDontSee('Geloeschte Vorschau-Meldung');
});

test('share panel offers a direct open button for single portal releases', function () {
    /** @var TestCase $this */
    [$customer, $pr] = makePreviewCustomerWithPressRelease(Portal::Presseecho);
    $this->actingAs($customer);

    LivewireVolt::test('customer.press-releases.show', ['id' => $pr->id])
        ->call('generateShareLink')
        ->assertSee('Vorschau öffnen')
        ->assertDontSee('Vorschau presseecho')
        ->assertDontSee('?portal=', false);
});

test('share panel offers one open button per portal for both portal releases', function () {
    /** @var TestCase $this */
    [$customer, $pr] = makePreviewCustomerWithPressRelease(Portal::Both);
    $this->actingAs($customer);

    LivewireVolt::test('customer.press-releases.show', ['id' => $pr->id])
        ->call('generateShareLink')
        ->assertSee('Vorschau presseecho')
        ->assertSee('Vorschau businessportal24')
        ->assertSee('?portal=presseecho', false)
        ->assertSee('?portal=businessportal24', false);
});