presseportale/tests/Feature/Legal/CustomerCorrectionPanelTest.php
Kevin Adametz e6eca9c85f
Some checks failed
linter / quality (push) Has been cancelled
tests / ci (push) Has been cancelled
recht: Meldeverfahren v2 Phasen 5+7 — DSGVO-Strukturformular, 10-€-Checkout mit KI-Vorprüfung, Triage & Panel-Modal
Phase 7 (Spur D, E2 revidiert): KI-Vorprüfung VOR der Zahlung im Modal —
rot lehnt ohne Zahlung ab, gelb/grün führt zum Stripe-Checkout
(SinglePurchaseType::Change, 10 € netto), nach Zahlungseingang übernimmt
der Webhook die geprüfte Fassung sofort (applyPaid: Snapshot, Sperre,
Verlauf). Nur einmal je PM; Obergrenze legal.change_max_distance_percent
(50 %) verhindert die verdeckte Selbst-Depublizierung.

Phase 5 (Spur B): strukturiertes Schwärzungsformular mit Pflicht-Vorschau
im verifizierten Web-Bereich UND als Modal im Kunden-Panel; Admin-Editor
wird aus payload.redaction vorbefüllt. Umsetzungsmail LegalRequestExecuted
an Antragsteller, Bestätigungsmail PressReleaseChangeApplied (Spur A/D,
neuer abbestellbarer Typ press_release_corrected).

Außerdem:
- Re-Sync-Sperre + Sitemap-Invalidierung fest in depublish() verankert
  (Lücke im bezahlten Webhook-Pfad geschlossen)
- Öffentliche „Rechtliches"-Seite als zweistufige Triage: primär der
  Portal-Anmeldelink, Formular nur Fallback mit Identifizierungs-Hinweis;
  Store auf report/dsgvo/personal_rights gehärtet
- Panel-Button „Ändern/Melden" öffnet Anliegen-Modal (4 Spuren) statt
  des Web-Formulars
- Pressekontakt-Fallback für Legacy-Bestände (30k PMs ohne Verknüpfung):
  Detailseite + pressContactEmail() nutzen PM-Kontakt → Firmen-Kontakt →
  Firmendaten
- Korrektur-Gate entity-fest (Editor-Normalisierung zählt nicht als
  Änderung), toEditorHtml() in Admin-Edit + Korrektur-Panel,
  Wochenlimit-Hinweis in Text und Bremsen-Meldung

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-23 13:02:57 +00:00

231 lines
8.4 KiB
PHP

<?php
use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Mail\PressReleaseChangeApplied;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Models\User;
use App\Services\PressRelease\BlacklistService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Queue;
use Livewire\Volt\Volt;
use Tests\TestCase;
beforeEach(function () {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
});
function correctionPanelOwner(): User
{
$owner = User::factory()->create(['is_active' => true]);
$owner->assignRole('customer');
return $owner;
}
test('an owner can apply a minor correction from the panel and it goes live instantly', function () {
/** @var TestCase $this */
Queue::fake();
Mail::fake();
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Betrieb genomen',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Betrieb genommen')
->call('previewCorrection')
->assertHasNoErrors()
->call('applyCorrection')
->assertHasNoErrors();
$pressRelease->refresh();
expect($pressRelease->title)->toBe('Betrieb genommen')
->and($pressRelease->isSyncLocked())->toBeTrue()
->and(LegalRequest::query()->where('type', LegalRequestType::Correction->value)->count())->toBe(1);
// Bestätigungsmail an den Auftraggeber (abbestellbar über die Präferenzen).
Mail::assertQueued(PressReleaseChangeApplied::class, function (PressReleaseChangeApplied $mail) use ($owner) {
return $mail->hasTo($owner->email) && ! $mail->isPaidChange;
});
});
test('a major change passes the green precheck and unlocks the payment step', function () {
/** @var TestCase $this */
config()->set('scoring.classification.provider', 'deterministic');
config()->set('blacklist.words', []);
app()->forgetInstance(BlacklistService::class);
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
->call('previewCorrection')
->assertHasNoErrors()
->call('openPaidChangeModal')
->assertHasNoErrors()
->call('runPaidChangePrecheck')
->assertHasNoErrors()
->assertSet('paidChangePrecheck.classification', 'green')
->assertSee('Prüfung bestanden');
$request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
expect($request->status)->toBe(LegalRequestStatus::Open)
->and($request->payload['ki_check']['classification'])->toBe('green')
->and($request->payload['new_values']['title'])->toContain('Muenchen')
->and($request->executed_at)->toBeNull()
->and($pressRelease->fresh()->title)->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
});
test('a red precheck rejects the change before payment and the process is one-time', function () {
/** @var TestCase $this */
config()->set('scoring.classification.provider', 'deterministic');
config()->set('blacklist.words', ['skandalwort']);
app()->forgetInstance(BlacklistService::class);
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Solaranlage in Hamburg eroeffnet mit Skandalwort dabei')
->call('previewCorrection')
->call('openPaidChangeModal')
->assertHasNoErrors()
->call('runPaidChangePrecheck')
->assertSet('paidChangePrecheck.classification', 'red')
->assertSee('Prüfung nicht bestanden');
$request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
expect($request->status)->toBe(LegalRequestStatus::Rejected)
->and($request->payload['ki_check']['classification'])->toBe('red')
->and($pressRelease->fresh()->title)->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
// Nur einmal möglich: nach der Ablehnung gibt es keinen zweiten Anlauf.
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
->call('previewCorrection')
->call('openPaidChangeModal')
->assertHasErrors('correction');
expect(LegalRequest::query()->where('type', LegalRequestType::Change->value)->count())->toBe(1);
});
test('a change above the paid distance limit cannot be booked at all', function () {
/** @var TestCase $this */
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Kurzer Titel der Mitteilung',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel')
->call('previewCorrection')
->assertSee('Zu umfangreich')
->call('openPaidChangeModal')
->assertHasErrors('correction');
expect(LegalRequest::query()->count())->toBe(0);
});
test('a legacy plain-text release is prefilled as paragraphs and counts as unchanged', function () {
/** @var TestCase $this */
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'text' => "Erster Absatz.\r\n\r\nZweiter Absatz mit Inhalt.",
]);
$component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection');
expect($component->get('correctionValues')['text'])->toContain('<p>Erster Absatz.</p>');
// Unverändert abschicken: die Plaintext→HTML-Wandlung darf nicht als
// inhaltliche Änderung zählen.
$component->call('previewCorrection')
->assertHasErrors('correction');
expect($pressRelease->fresh()->text)->toContain("Erster Absatz.\r\n");
});
test('the panel names the weekly limit and the brake message states it too', function () {
/** @var TestCase $this */
Queue::fake();
config()->set('legal.corrections_per_week', 1);
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Titel B1',
]);
$component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->assertSee('höchstens eine kostenlose Korrektur pro Woche')
->call('startCorrection')
->set('correctionValues.title', 'Titel B2')
->call('previewCorrection')
->call('applyCorrection')
->assertHasNoErrors();
$component
->call('startCorrection')
->set('correctionValues.title', 'Titel B3')
->call('previewCorrection')
->call('applyCorrection')
->assertHasErrors('correction')
->assertSee('das Limit ist bereits erreicht');
expect($pressRelease->fresh()->title)->toBe('Titel B2');
});
test('apply without preview is refused', function () {
/** @var TestCase $this */
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Original',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Origina')
->call('applyCorrection')
->assertHasErrors('correction');
expect($pressRelease->fresh()->title)->toBe('Original');
});