presseportale/tests/Feature/Web/ReportFormTest.php

<?php

use App\Enums\LegalRequestType;
use App\Enums\Portal;
use App\Mail\LegalRequestReceived;
use App\Mail\LegalRequestSubmitted;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use Illuminate\Support\Facades\Mail;
use Tests\TestCase;

test('the standalone report forms render on every domain', function (string $way, string $heading) {
    /** @var TestCase $this */
    $this->get("https://presseecho.test/de/melden/{$way}")
        ->assertSuccessful()
        ->assertSeeText($heading)
        ->assertSee('name="reported_url"', false);

    $this->get("https://pressekonto.test/de/melden/{$way}")->assertSuccessful();
})->with([
    'rechtswidrig' => ['rechtswidrig', 'Rechtswidrige Inhalte melden'],
    'kontaktdaten' => ['kontaktdaten', 'Eigene Kontaktdaten entfernen lassen'],
]);

test('an illegal content report creates a request and confirms receipt with a reference', function () {
    /** @var TestCase $this */
    Mail::fake();

    $response = $this->from('https://businessportal24.test/de/melden/rechtswidrig')
        ->post('https://businessportal24.test/de/melden/rechtswidrig', [
            'reported_url' => 'https://businessportal24.com/de/press-release/irgendein-artikel',
            'requester_name' => 'Erika Musterfrau',
            'requester_email' => 'erika@example.com',
            'message' => 'Diese Mitteilung enthält nachweislich falsche Tatsachenbehauptungen über mich.',
            'truth_affirmed' => '1',
        ]);

    $response->assertRedirect('https://businessportal24.test/de/melden/rechtswidrig')
        ->assertSessionHas('report-status');

    $request = LegalRequest::query()->sole();
    expect($request->type)->toBe(LegalRequestType::Report);
    expect($request->requester_email)->toBe('erika@example.com');
    expect($request->requesterName())->toBe('Erika Musterfrau');
    expect($request->reportedUrl())->toBe('https://businessportal24.com/de/press-release/irgendein-artikel');
    expect($request->payload['truth_affirmed'])->toBeTrue();
    expect($request->portal)->toBe('businessportal24');
    expect(session('report-status'))->toContain($request->reference());

    // DSA Art. 16 Abs. 4: unverzügliche Eingangsbestätigung + interner Hinweis.
    Mail::assertQueued(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
    Mail::assertQueued(LegalRequestSubmitted::class);
});

test('a reported url matching a published release is linked to it', function () {
    /** @var TestCase $this */
    Mail::fake();

    $release = PressRelease::factory()
        ->published()
        ->forPortal(Portal::Businessportal24)
        ->create(['published_at' => now()->subDay()]);

    $this->post('https://businessportal24.test/de/melden/rechtswidrig', [
        'reported_url' => 'https://businessportal24.test/de/press-release/'.$release->slug,
        'requester_name' => 'Erika Musterfrau',
        'requester_email' => 'erika@example.com',
        'message' => 'Diese Mitteilung verletzt meine Markenrechte an mehreren Stellen.',
        'truth_affirmed' => '1',
    ]);

    expect(LegalRequest::query()->sole()->press_release_id)->toBe($release->id);
});

test('a reported url on a foreign host or the other portal is not linked to a release', function () {
    /** @var TestCase $this */
    Mail::fake();

    $release = PressRelease::factory()
        ->published()
        ->forPortal(Portal::Businessportal24)
        ->create(['published_at' => now()->subDay()]);

    // Fremde Domain mit passendem Pfad und die URL des anderen Portals: beide
    // gehören nicht zu dieser PM — die Meldung bleibt ohne PM-Bezug (F12).
    foreach (['https://example.com', 'https://presseecho.test'] as $base) {
        $this->post('https://businessportal24.test/de/melden/rechtswidrig', [
            'reported_url' => $base.'/de/press-release/'.$release->slug,
            'requester_name' => 'Erika Musterfrau',
            'requester_email' => 'erika@example.com',
            'message' => 'Diese Mitteilung verletzt meine Markenrechte an mehreren Stellen.',
            'truth_affirmed' => '1',
        ])->assertSessionHas('report-status');
    }

    expect(LegalRequest::query()->count())->toBe(2)
        ->and(LegalRequest::query()->whereNotNull('press_release_id')->count())->toBe(0)
        // Ohne PM-Bezug entscheidet der Host des Formulars über das Portal.
        ->and(LegalRequest::query()->pluck('portal')->unique()->all())->toBe(['businessportal24']);
});

test('the illegal content report requires the truthfulness affirmation and a valid url', function () {
    /** @var TestCase $this */
    Mail::fake();

    $this->from('https://businessportal24.test/de/melden/rechtswidrig')
        ->post('https://businessportal24.test/de/melden/rechtswidrig', [
            'reported_url' => 'keine-url',
            'requester_name' => 'Erika Musterfrau',
            'requester_email' => 'erika@example.com',
            'message' => 'Diese Mitteilung enthält falsche Tatsachenbehauptungen über mich.',
        ])
        ->assertSessionHasErrors(['reported_url', 'truth_affirmed']);

    expect(LegalRequest::query()->count())->toBe(0);
    Mail::assertNothingOutgoing();
});

test('the contact data removal form creates a dsgvo request without affirmation checkbox', function () {
    /** @var TestCase $this */
    Mail::fake();

    $this->post('https://presseecho.test/de/melden/kontaktdaten', [
        'reported_url' => 'https://presseecho.de/de/press-release/alter-artikel',
        'requester_name' => 'Max Mustermann',
        'requester_email' => 'max@example.com',
        'message' => 'Mein Name und meine Telefonnummer stehen im Pressekontakt dieser Mitteilung.',
    ])->assertSessionHas('report-status');

    $request = LegalRequest::query()->sole();
    expect($request->type)->toBe(LegalRequestType::Dsgvo);
    expect($request->portal)->toBe('presseecho');
    Mail::assertQueued(LegalRequestReceived::class);
});

test('a filled honeypot is silently discarded', function () {
    /** @var TestCase $this */
    Mail::fake();

    $this->post('https://businessportal24.test/de/melden/rechtswidrig', [
        'reported_url' => 'https://businessportal24.com/de/press-release/spam',
        'requester_name' => 'Bot',
        'requester_email' => 'bot@example.com',
        'message' => 'Automatisch generierter Inhalt mit ausreichend vielen Zeichen.',
        'truth_affirmed' => '1',
        'website' => 'https://spam.example.com',
    ])->assertSessionHas('report-status');

    expect(LegalRequest::query()->count())->toBe(0);
    Mail::assertNothingOutgoing();
});

test('an unknown form way responds 404', function () {
    /** @var TestCase $this */
    $this->get('https://businessportal24.test/de/melden/sonstiges')->assertNotFound();
});