Kevin Adametz
bae8347f6c
Audit: dev/sicherheit/SICHERHEITSAUDIT-2026-10-07.md, Plan und Entscheidungen: dev/sicherheit/ENTWICKLUNGSPLAN-SICHERHEIT-2026-10-07.md. - S-01 Legacy-Rechnungen fremder Kunden nur mit billing:manage (auch Kundenroute). - S-02 Kontaktzuordnung auf der Firmenanzeige verlangt companies:write, $id gesperrt. - S-03 CompanyMembershipObserver: automatische Firmenrechte werden bei jeder Adress-/Zuordnungsänderung sofort neu bewertet; memberships:resync-auto. - S-04 Passwortwechsel beendet alle anderen Sessions (PasswordChanger), Reset alle Sessions und offene Login-Links; Fortify PUT /user/password abgeschaltet. API-Tokens bleiben bestehen. - S-05 Google: email_verified Pflicht, feste Bindung über die Provider-ID; Erstverknüpfung bestehender Konten außerhalb gmail/hd nur per Bestätigungslink in derselben Browser-Session. - S-06 Frischer Identitätsnachweis (Passwort, App-Code, E-Mail-Code oder Passkey) vor E-Mail-Wechsel, erster 2FA-Einrichtung und Token-Erzeugung; Hinweis-Mails an die (bisherige) Kontoadresse. - Entscheidung 5: Passkeys (Fortify, @laravel/passkeys) für alle; Super-Admins und Admins bestätigen die Session für den Admin-Bereich per Passkey oder App-Code (EnsureStrongAdminAuthentication, Notfallschalter AUTH_REQUIRE_STRONG_ADMIN); Reset des zweiten Faktors durch Super-Admins. Neue Migration: create_passkeys_table. Suite 2.403 grün (1 übersprungen), Larastan ohne Meldung. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
89 lines
2.9 KiB
PHP
89 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Models\LegacyInvoice;
|
|
use App\Models\User;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Sicherheitsaudit 07.10.2026, S-01: Fremde Alt-Rechnungen nur mit
|
|
* `billing:manage` — der Panel-Zugang der Rolle `editor` reicht nicht, auf
|
|
* keiner der beiden Downloadrouten.
|
|
*/
|
|
beforeEach(function () {
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
});
|
|
|
|
function legacyInvoiceFor(?User $owner, int $legacyId): LegacyInvoice
|
|
{
|
|
return LegacyInvoice::query()->create([
|
|
'legacy_portal' => 'presseecho',
|
|
'legacy_id' => $legacyId,
|
|
'user_id' => $owner?->id,
|
|
'legacy_user_id' => 900 + $legacyId,
|
|
'number' => 'PE-'.$legacyId,
|
|
'amount_cents' => 9900,
|
|
'total_cents' => 9900,
|
|
'status' => 'paid',
|
|
'invoice_date' => now()->subMonth(),
|
|
'paid_at' => now()->subMonth()->addDays(2),
|
|
'payment_method' => 'SPK_Berlin',
|
|
'raw_snapshot' => [
|
|
'number' => 'PE-'.$legacyId,
|
|
'service_period_begin_date' => now()->subYear()->toDateString(),
|
|
'service_period_end_date' => now()->toDateString(),
|
|
],
|
|
'pdf_payload' => [
|
|
'billing_address' => [
|
|
'name' => 'Kunde GmbH',
|
|
'address' => 'Kundenstrasse 1',
|
|
'postal_code' => '10115',
|
|
'city' => 'Berlin',
|
|
'country_name' => 'Deutschland',
|
|
],
|
|
],
|
|
'imported_at' => now(),
|
|
]);
|
|
}
|
|
|
|
function userWithRole(string $role): User
|
|
{
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
$user->assignRole($role);
|
|
|
|
return $user;
|
|
}
|
|
|
|
test('an editor cannot download a foreign legacy invoice on either route', function () {
|
|
/** @var TestCase $this */
|
|
$invoice = legacyInvoiceFor(userWithRole('customer'), 7001);
|
|
|
|
$this->actingAs(userWithRole('editor'));
|
|
|
|
$this->get(route('me.invoices.pdf', $invoice))->assertForbidden();
|
|
$this->get(route('admin.legacy-invoices.pdf', $invoice))->assertForbidden();
|
|
|
|
expect($invoice->fresh()->pdf_generated_at)->toBeNull();
|
|
});
|
|
|
|
test('a customer downloads only their own legacy invoice', function () {
|
|
/** @var TestCase $this */
|
|
$customer = userWithRole('customer');
|
|
$own = legacyInvoiceFor($customer, 7002);
|
|
$foreign = legacyInvoiceFor(userWithRole('customer'), 7003);
|
|
|
|
$this->actingAs($customer);
|
|
|
|
$this->get(route('me.invoices.pdf', $own))->assertSuccessful();
|
|
$this->get(route('me.invoices.pdf', $foreign))->assertForbidden();
|
|
});
|
|
|
|
test('a billing admin downloads foreign legacy invoices on both routes', function () {
|
|
/** @var TestCase $this */
|
|
$invoice = legacyInvoiceFor(userWithRole('customer'), 7004);
|
|
|
|
$this->actingAs(userWithRole('admin'));
|
|
|
|
$this->get(route('me.invoices.pdf', $invoice))->assertSuccessful();
|
|
$this->get(route('admin.legacy-invoices.pdf', $invoice))->assertSuccessful();
|
|
});
|