E-Mail-Verifizierung (Entscheidung 15.06.): - User implementiert MustVerifyEmail; Registrierung legt inaktives, rollenloses Konto an und leitet auf die Danke-/Notice-Seite; Registered-Event versendet die Verifizierungsmail. Bestätigter Link aktiviert das Konto + vergibt customer-Rolle (ActivateUserAfterVerification). Backfill-Migration setzt email_verified_at für alle Bestands-User (sonst würde die verified-Middleware ~59k aktive Legacy-User aussperren). Seeder-User verifiziert. Auth-Flow-Korrekturen: - Magic-Link-Consume: rollensicherer Redirect ohne intended() (Customer landete sonst per stale intended=/dashboard im 403-Admin-Bereich). - Guest-Redirect (bootstrap/app.php) rollen-/verifizierungsbewusst statt fix /dashboard – schließt die 403-Sackgasse auf /login und /register. - Logout auf der Notice-Seite via echtes POST-Formular statt Livewire-Action (behebt 419 beim Session-Invalidate). - Magic-Link-Anforderung über eigenes Modal mit separater E-Mail-Eingabe. - Unverifizierte Login-Versuche landen auf der Notice-Seite. Sicherheitsfix Legacy-Rollen: - UserImporter mappte Alt-Gruppe 2 (Self-Publisher) auf editor (= Admin-Zugriff). Mapping auf customer korrigiert; Daten-Migration stuft die 65.950 fälschlichen Legacy-Editoren auf customer herab. Echte admin/api-only bleiben unberührt. Tests: Registration, EmailVerification, Authentication (Guest-Redirect), MagicLinkLogin (Modal/Redirect/Regression), Legacy-Import (Gruppen-Mapping). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
102 lines
3.7 KiB
PHP
102 lines
3.7 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Contracts\NewsletterSyncClient;
|
|
use App\Helpers\ThemeHelper;
|
|
use App\Http\Middleware\EnsureUserIsAdmin;
|
|
use App\Http\Middleware\LogSlowAdminRequests;
|
|
use App\Listeners\ActivateUserAfterVerification;
|
|
use App\Models\AdminPreset;
|
|
use App\Models\Category;
|
|
use App\Models\CategoryTranslation;
|
|
use App\Models\Company;
|
|
use App\Models\Contact;
|
|
use App\Models\NewsletterSubscription;
|
|
use App\Models\PressRelease;
|
|
use App\Models\User;
|
|
use App\Observers\AdminPerformanceCacheObserver;
|
|
use App\Services\Admin\AdminRequestPerformanceMetrics;
|
|
use App\Services\Newsletter\NullNewsletterSyncClient;
|
|
use App\Services\PressRelease\PressReleaseService;
|
|
use Illuminate\Auth\Events\Registered;
|
|
use Illuminate\Auth\Events\Verified;
|
|
use Illuminate\Auth\Listeners\SendEmailVerificationNotification;
|
|
use Illuminate\Database\Events\QueryExecuted;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Event;
|
|
use Illuminate\Support\Facades\URL;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Laravel\Cashier\Cashier;
|
|
use Livewire\Livewire;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Register any application services.
|
|
*/
|
|
public function register(): void
|
|
{
|
|
$this->app->bind(NewsletterSyncClient::class, NullNewsletterSyncClient::class);
|
|
$this->app->singleton(PressReleaseService::class);
|
|
$this->app->singleton(AdminRequestPerformanceMetrics::class);
|
|
}
|
|
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$scheme = request()->header('X-Forwarded-Proto')
|
|
?? request()->server('HTTP_X_FORWARDED_PROTO')
|
|
?? (request()->secure() ? 'https' : 'http');
|
|
|
|
if ($scheme === 'https') {
|
|
URL::forceScheme('https');
|
|
}
|
|
|
|
// Registrierung → Verifizierungsmail; bestätigter Klick → Aktivierung.
|
|
Event::listen(Registered::class, SendEmailVerificationNotification::class);
|
|
Event::listen(Verified::class, ActivateUserAfterVerification::class);
|
|
|
|
// Stripe Tax berechnet die USt im Checkout automatisch nach den
|
|
// gleichen Regeln wie der VatResolver im MAN-Kreis (DE mit Steuer,
|
|
// EU nur mit USt-ID befreit, Drittland befreit). Aktiviert zugleich
|
|
// die USt-ID-Abfrage im Stripe Checkout.
|
|
Cashier::calculateTaxes();
|
|
|
|
AdminPreset::observe(AdminPerformanceCacheObserver::class);
|
|
Category::observe(AdminPerformanceCacheObserver::class);
|
|
CategoryTranslation::observe(AdminPerformanceCacheObserver::class);
|
|
Company::observe(AdminPerformanceCacheObserver::class);
|
|
Contact::observe(AdminPerformanceCacheObserver::class);
|
|
NewsletterSubscription::observe(AdminPerformanceCacheObserver::class);
|
|
PressRelease::observe(AdminPerformanceCacheObserver::class);
|
|
User::observe(AdminPerformanceCacheObserver::class);
|
|
Permission::observe(AdminPerformanceCacheObserver::class);
|
|
Role::observe(AdminPerformanceCacheObserver::class);
|
|
|
|
DB::listen(fn (QueryExecuted $query) => app(AdminRequestPerformanceMetrics::class)->record($query));
|
|
|
|
Livewire::addPersistentMiddleware([
|
|
EnsureUserIsAdmin::class,
|
|
LogSlowAdminRequests::class,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Set the asset URL dynamically based on the current theme
|
|
*/
|
|
protected function setDynamicAssetUrl(): void
|
|
{
|
|
try {
|
|
$assetUrl = ThemeHelper::getAssetUrl();
|
|
config(['app.asset_url' => $assetUrl]);
|
|
} catch (\Exception $e) {
|
|
// Fallback to default if theme detection fails
|
|
config(['app.asset_url' => 'https://assets.pressekonto.test']);
|
|
}
|
|
}
|
|
}
|