M3 Passwort-Reset und E-Mail-Verifikation ergänzen

- Auth-Token-Tabelle mit gehashten Single-Use-Tokens einführen - Passwort-Reset und E-Mail-Verifikation als Dev-Flow bauen - Token-Flow-Test, Smoke-Abdeckung und M3-Dokumentation aktualisieren
2026-07-13 19:26:58 +02:00
parent 19ff11c21a
commit 8ab4a8a9bb
15 changed files with 740 additions and 9 deletions
@@ -0,0 +1,120 @@
+<?php
+
+declare(strict_types=1);
+
+require __DIR__ . '/dev-db.php';
+require __DIR__ . '/../app/saas-auth.php';
+
+function password_email_check_assert(string $label, bool $condition, array &$failures, int &$passes): void
+{
+    if ($condition) {
+        $passes++;
+        echo "PASS {$label}\n";
+        return;
+    }
+
+    $failures[] = $label;
+    echo "FAIL {$label}\n";
+}
+
+function password_email_check_cleanup(PDO $pdo, string $slug, string $emailNorm): void
+{
+    $stmt = $pdo->prepare('SELECT id FROM tenants WHERE slug = ?');
+    $stmt->execute([$slug]);
+    $tenantId = $stmt->fetchColumn();
+
+    if ($tenantId !== false) {
+        $tenantId = (int)$tenantId;
+        $pdo->prepare('DELETE FROM participants WHERE tenant_id = ?')->execute([$tenantId]);
+        $pdo->prepare('DELETE FROM tenant_memberships WHERE tenant_id = ?')->execute([$tenantId]);
+        $pdo->prepare('DELETE FROM tenant_settings WHERE tenant_id = ?')->execute([$tenantId]);
+        $pdo->prepare('DELETE FROM tenants WHERE id = ?')->execute([$tenantId]);
+    }
+
+    $pdo->prepare('DELETE FROM users WHERE email_norm = ?')->execute([$emailNorm]);
+}
+
+$pdo = dev_pdo();
+dev_apply_schema($pdo);
+
+$slug = 'm3-password-email-check';
+$email = 'm3-password-email-check@test.local';
+$emailNorm = saas_email_norm($email);
+$password = 'M3-password-email-123';
+$newPassword = 'M3-password-email-456';
+$failures = [];
+$passes = 0;
+
+password_email_check_cleanup($pdo, $slug, $emailNorm);
+
+$registration = saas_register_tenant_owner($pdo, [
+    'tenant_name' => 'M3 Password Email Check',
+    'tenant_slug' => $slug,
+    'display_name' => 'M3 Password Email',
+    'email' => $email,
+    'password' => $password,
+    'password_confirm' => $password,
+]);
+
+password_email_check_assert('registration succeeds', $registration['ok'] === true, $failures, $passes);
+password_email_check_assert('registration returns verification token', !empty($registration['email_verification_token']), $failures, $passes);
+
+if ($registration['ok']) {
+    $userId = (int)$registration['identity']['user_id'];
+
+    $stmt = $pdo->prepare('SELECT email_verified_at FROM users WHERE id = ?');
+    $stmt->execute([$userId]);
+    password_email_check_assert('email starts unverified', $stmt->fetchColumn() === null, $failures, $passes);
+
+    $verification = saas_verify_email_token($pdo, (string)$registration['email_verification_token']);
+    password_email_check_assert('email verification succeeds', $verification['ok'] === true, $failures, $passes);
+
+    $stmt = $pdo->prepare('SELECT email_verified_at FROM users WHERE id = ?');
+    $stmt->execute([$userId]);
+    password_email_check_assert('email is verified', $stmt->fetchColumn() !== null, $failures, $passes);
+
+    $verificationAgain = saas_verify_email_token($pdo, (string)$registration['email_verification_token']);
+    password_email_check_assert('email verification token is single use', $verificationAgain['ok'] === false, $failures, $passes);
+
+    $resetRequest = saas_request_password_reset($pdo, $email, $slug);
+    password_email_check_assert('password reset request succeeds', $resetRequest['ok'] === true, $failures, $passes);
+    password_email_check_assert('password reset returns token', !empty($resetRequest['token']), $failures, $passes);
+
+    $reset = saas_reset_password_with_token(
+        $pdo,
+        (string)$resetRequest['token'],
+        $newPassword,
+        $newPassword
+    );
+    password_email_check_assert('password reset succeeds', $reset['ok'] === true, $failures, $passes);
+
+    $oldLogin = saas_authenticate($pdo, $email, $password, $slug);
+    password_email_check_assert('old password is rejected', $oldLogin['ok'] === false, $failures, $passes);
+
+    $newLogin = saas_authenticate($pdo, $email, $newPassword, $slug);
+    password_email_check_assert('new password works', $newLogin['ok'] === true, $failures, $passes);
+
+    $reuse = saas_reset_password_with_token(
+        $pdo,
+        (string)$resetRequest['token'],
+        'M3-password-email-789',
+        'M3-password-email-789'
+    );
+    password_email_check_assert('password reset token is single use', $reuse['ok'] === false, $failures, $passes);
+}
+
+$unknownRequest = saas_request_password_reset($pdo, 'unknown-password-email@test.local', $slug);
+password_email_check_assert('unknown reset request is generic success', $unknownRequest['ok'] === true, $failures, $passes);
+password_email_check_assert('unknown reset request has no token', empty($unknownRequest['token']), $failures, $passes);
+
+password_email_check_cleanup($pdo, $slug, $emailNorm);
+
+if ($failures !== []) {
+    echo "\nM3 password/email flow check failed with " . count($failures) . " failure(s):\n";
+    foreach ($failures as $failure) {
+        echo "- {$failure}\n";
+    }
+    exit(1);
+}
+
+echo "\nM3 password/email flow check passed with {$passes} assertions.\n";