SEO, Weiterleitungen und strukturierte Daten (Arbeitspaket E)

Migration 20260912000800 ergänzt page.robots, page.og_media_id,
website.settings und die Tabelle redirect.

Alles Maschinenlesbare wird aus dem veröffentlichten Bestand
abgeleitet, nichts separat gepflegt: die Sitemap listet nur
veröffentlichte, indexierbare Seiten samt Beitragsübersicht und
Begriffsarchiven, und dieselbe Einstellung setzt auch das
noindex-Meta - beide Aussagen können nicht auseinanderlaufen.

Strukturierte Daten entstehen nur aus gepflegten Werten: ohne
Angaben wird kein leerer Organization-Block ausgegeben. JSON-LD ist
ein Datenblock, kein Skript, daher bleibt script-src 'none'
unberührt.

Weiterleitungen greifen vor dem 404, aber nach der Seitensuche: eine
vorhandene Seite gewinnt immer, sonst könnte ein alter Eintrag eine
neue Seite unerreichbar machen. Ketten werden abgewiesen. robots.txt
nimmt zusätzliche Zeilen nur nach festem Muster an, damit ein
Eintrag die Datei nicht umdeuten kann. llms.txt ist standardmäßig
aus.

Geprüft: 128 PHP-Tests / 507 Assertions unter PHP 8.2.12 und 8.4.22,
14 JavaScript-Modelltests, Lint/Format/Container. Dazu eine reine
Sichtprüfung im Browser auf einer lokalen Demoseite - weiterhin
keine axe- oder Lighthouse-Messung.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Controller/EditorController.php

@@ -31,9 +31,7 @@ final class EditorController extends AbstractController
         foreach ($pages as &$page) {
             $page['title'] = json_decode($page['document'] ?? '{}', true, 512, JSON_THROW_ON_ERROR)['title'] ?? $page['slug'];
             $page['depth'] = substr_count((string) $page['path'], '/');
-            if ('post' === $page['type']) {
-                $page['terms'] = $this->posts->namesFor($page['id']);
-            }
+            $page['terms'] = 'post' === $page['type'] ? $this->posts->namesFor($page['id']) : ['category' => '', 'tag' => ''];
         }
         unset($page);
 
@@ -88,6 +86,8 @@ final class EditorController extends AbstractController
                     'author' => $request->request->getString('author'),
                     'publishedAt' => $request->request->getString('publishedAt'),
                     'featuredMediaId' => $request->request->getString('featuredMediaId'),
+                    'ogMediaId' => $request->request->getString('ogMediaId'),
+                    'robots' => $request->request->getString('robots', 'index'),
                 ],
                 $terms($request->request->getString('categories')),
                 $terms($request->request->getString('tags')),

src/Controller/PageController.php

@@ -6,6 +6,8 @@ use App\Content\FormRepository;
 use App\Content\MenuRepository;
 use App\Content\PageRepository;
 use App\Content\PostRepository;
+use App\Content\RedirectRepository;
+use App\Content\SiteSettings;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -13,13 +15,13 @@ use Symfony\Component\Routing\Attribute\Route;
 
 final class PageController extends AbstractController
 {
-    public function __construct(private PageRepository $pages, private MenuRepository $menus, private PostRepository $posts, private FormRepository $forms, private string $secret, private string $siteOrigin)
+    public function __construct(private PageRepository $pages, private MenuRepository $menus, private PostRepository $posts, private FormRepository $forms, private RedirectRepository $redirects, private SiteSettings $settings, private string $secret, private string $siteOrigin)
     {
     }
 
     // A segment is a slug; up to four of them form the public path. The leading lookahead keeps
     // the CMS routes (/admin, /media, /assets) out of the catch-all, which matches before them.
-    private const PATH = '(?!admin(?:/|$)|media/|assets/|kategorie/|schlagwort/|beitraege(?:/|$)|feed\.xml$)[a-z0-9]+(?:-[a-z0-9]+)*(?:/[a-z0-9]+(?:-[a-z0-9]+)*){0,3}';
+    private const PATH = '(?!admin(?:/|$)|media/|assets/|kategorie/|schlagwort/|beitraege(?:/|$)|feed\.xml$|sitemap\.xml$|robots\.txt$|llms\.txt$)[a-z0-9]+(?:-[a-z0-9]+)*(?:/[a-z0-9]+(?:-[a-z0-9]+)*){0,3}';
 
     #[Route('/', name: 'home', methods: ['GET'])]
     #[Route('/{path}', name: 'page', requirements: ['path' => self::PATH], methods: ['GET'])]
@@ -31,7 +33,12 @@ final class PageController extends AbstractController
         }
         $page = $this->pages->findPublished($path);
         if (null === $page) {
-            $response = $this->render('not-found.html.twig', [], new Response(status: 404));
+            // An address that moved or was deliberately removed answers before the 404 does.
+            $redirect = $this->redirects->find($path);
+            if (null !== $redirect && 301 === $redirect['status']) {
+                return $this->shell($this->redirect('/'.$redirect['to'], 301));
+            }
+            $response = $this->render('not-found.html.twig', [], new Response(status: null !== $redirect ? 410 : 404));
         } else {
             $response = $this->render('page.html.twig', [
                 'page' => $page,
@@ -41,6 +48,8 @@ final class PageController extends AbstractController
                 'postMeta' => 'post' === $page['type'] ? $this->posts->termsFor($page['id']) : null,
                 'needsTabs' => $this->hasType($page['document'], 'tabs'),
                 'forms' => $this->formStates($page, $request->query->getString('gesendet')),
+                'breadcrumbs' => $this->breadcrumbs($page),
+                'structuredData' => $this->structuredData($page),
             ]);
         }
 
@@ -96,6 +105,79 @@ final class PageController extends AbstractController
         return $states;
     }
 
+    /**
+     * The trail from the home page down to this one, resolved from the stored hierarchy rather
+     * than from content, so it cannot claim a page that does not exist.
+     *
+     * @return list<array{name: string, href: string}>
+     */
+    private function breadcrumbs(array $page): array
+    {
+        if ('home' === $page['path']) {
+            return [];
+        }
+        $trail = [];
+        $prefix = '';
+        foreach (explode('/', (string) $page['path']) as $segment) {
+            $prefix = '' === $prefix ? $segment : $prefix.'/'.$segment;
+            $ancestor = $this->pages->findPublished($prefix);
+            if (null !== $ancestor) {
+                $trail[] = ['name' => $ancestor['document']['title'] ?? $prefix, 'href' => '/'.$prefix];
+            }
+        }
+
+        return $trail;
+    }
+
+    /**
+     * JSON-LD built from values that are visible on the page or maintained in the settings.
+     * Nothing is invented here; a field without a maintained value is left out.
+     *
+     * @return list<array>
+     */
+    private function structuredData(array $page): array
+    {
+        $origin = rtrim($this->siteOrigin, '/');
+        $blocks = [];
+        if ('home' === $page['path']) {
+            $organisation = $this->settings->organisation($this->settings->load(), $origin, (string) $page['website_name']);
+            if (null !== $organisation) {
+                $blocks[] = $organisation;
+            }
+        }
+        if ('post' === $page['type']) {
+            $article = [
+                '@context' => 'https://schema.org',
+                '@type' => 'Article',
+                'headline' => mb_substr((string) ($page['document']['title'] ?? ''), 0, 110),
+                'mainEntityOfPage' => $origin.'/'.$page['path'],
+            ];
+            foreach ([['description', $page['excerpt'] ?? $page['document']['description'] ?? ''], ['datePublished', $page['published_at'] ?? '']] as [$key, $value]) {
+                if ('' !== (string) $value && null !== $value) {
+                    $article[$key] = 'datePublished' === $key ? str_replace(' ', 'T', (string) $value).'Z' : (string) $value;
+                }
+            }
+            if (null !== ($page['author'] ?? null) && '' !== $page['author']) {
+                $article['author'] = ['@type' => 'Person', 'name' => $page['author']];
+            }
+            $blocks[] = $article;
+        }
+        $trail = $this->breadcrumbs($page);
+        if (count($trail) > 1) {
+            $blocks[] = [
+                '@context' => 'https://schema.org',
+                '@type' => 'BreadcrumbList',
+                'itemListElement' => array_map(
+                    static fn (int $index, array $item): array => ['@type' => 'ListItem', 'position' => $index + 1, 'name' => $item['name'], 'item' => $origin.$item['href']],
+                    array_keys($trail),
+                    $trail,
+                ),
+            ];
+        }
+
+        return $blocks;
+    }
+
     /** True when the stored document contains at least one block of that type. */
     private function hasType(array $document, string $type): bool
     {

src/Controller/SeoController.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Controller;
+
+use App\Content\PostRepository;
+use App\Content\SiteSettings;
+use Doctrine\DBAL\Connection;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+
+/**
+ * The machine readable surface of a site: sitemap, robots and the optional llms.txt. Everything
+ * here is derived from published content, never maintained separately, so it cannot drift apart
+ * from what a visitor actually sees.
+ */
+final class SeoController extends AbstractController
+{
+    public function __construct(
+        private Connection $db,
+        private SiteSettings $settings,
+        private PostRepository $posts,
+        private string $siteOrigin,
+    ) {
+    }
+
+    #[Route('/sitemap.xml', name: 'sitemap', methods: ['GET'])]
+    public function sitemap(): Response
+    {
+        $origin = rtrim($this->siteOrigin, '/');
+        $entries = [];
+        // Only published pages that are allowed to be indexed. A draft or a noindex page in the
+        // sitemap would ask a search engine to fetch something it must not list.
+        foreach ($this->db->fetchAllAssociative(
+            "SELECT p.path, p.type, p.published_at, r.created_at FROM page p JOIN revision r ON r.id = p.published_revision_id AND r.page_id = p.id WHERE p.website_id = ? AND p.robots = 'index' ORDER BY p.path",
+            ['default'],
+        ) as $row) {
+            $entries[] = [
+                'loc' => $origin.('home' === $row['path'] ? '/' : '/'.$row['path']),
+                'lastmod' => substr((string) ($row['published_at'] ?? $row['created_at']), 0, 10),
+            ];
+        }
+        // Archives exist only while they list something.
+        if ([] !== $this->posts->published(1, null, 1)['posts']) {
+            $entries[] = ['loc' => $origin.'/beitraege', 'lastmod' => null];
+        }
+        foreach ($this->db->fetchAllAssociative(
+            'SELECT DISTINCT t.kind, t.slug FROM term t JOIN page_term pt ON pt.term_id = t.id JOIN page p ON p.id = pt.page_id AND p.published_revision_id IS NOT NULL ORDER BY t.kind, t.slug',
+        ) as $row) {
+            $entries[] = ['loc' => $origin.'/'.PostRepository::ARCHIVE_PREFIX[$row['kind']].'/'.$row['slug'], 'lastmod' => null];
+        }
+
+        return $this->xml($this->renderView('seo/sitemap.xml.twig', ['entries' => $entries]));
+    }
+
+    #[Route('/robots.txt', name: 'robots', methods: ['GET'])]
+    public function robots(): Response
+    {
+        $settings = $this->settings->load();
+        $lines = ['User-agent: *', 'Disallow: /admin', 'Disallow: /formular/'];
+        if ('' !== $settings['robotsExtra']) {
+            $lines[] = $settings['robotsExtra'];
+        }
+        $lines[] = '';
+        $lines[] = 'Sitemap: '.rtrim($this->siteOrigin, '/').'/sitemap.xml';
+
+        return $this->text(implode("\n", $lines)."\n");
+    }
+
+    /**
+     * A machine readable summary of public content. Optional and switched off by default. It is
+     * no ranking factor and no requirement for any search product; it simply saves an agent the
+     * crawl. Only published, indexable pages appear.
+     */
+    #[Route('/llms.txt', name: 'llms', methods: ['GET'])]
+    public function llms(): Response
+    {
+        $settings = $this->settings->load();
+        if (!$settings['llmsTxt']) {
+            throw $this->createNotFoundException('llms.txt ist für diese Website nicht aktiviert.');
+        }
+        $origin = rtrim($this->siteOrigin, '/');
+        $name = (string) $this->db->fetchOne('SELECT name FROM website WHERE id = ?', ['default']);
+        $lines = ['# '.('' !== $settings['legalName'] ? $settings['legalName'] : $name), ''];
+        if ('' !== $settings['description']) {
+            $lines[] = '> '.$settings['description'];
+            $lines[] = '';
+        }
+        foreach (['page' => '## Seiten', 'post' => '## Beiträge'] as $type => $heading) {
+            $rows = $this->db->fetchAllAssociative(
+                "SELECT p.path, p.excerpt, r.document FROM page p JOIN revision r ON r.id = p.published_revision_id AND r.page_id = p.id WHERE p.website_id = ? AND p.robots = 'index' AND p.type = ? ORDER BY p.path",
+                ['default', $type],
+            );
+            if ([] === $rows) {
+                continue;
+            }
+            $lines[] = $heading;
+            foreach ($rows as $row) {
+                $document = json_decode($row['document'], true, 512, JSON_THROW_ON_ERROR);
+                $summary = trim((string) ($row['excerpt'] ?? $document['description'] ?? ''));
+                $lines[] = sprintf('- [%s](%s)%s', $document['title'] ?? $row['path'], $origin.('home' === $row['path'] ? '/' : '/'.$row['path']), '' === $summary ? '' : ': '.$summary);
+            }
+            $lines[] = '';
+        }
+
+        return $this->text(implode("\n", $lines));
+    }
+
+    private function text(string $body): Response
+    {
+        return $this->harden(new Response($body, 200, ['Content-Type' => 'text/plain; charset=UTF-8']));
+    }
+
+    private function xml(string $body): Response
+    {
+        return $this->harden(new Response($body, 200, ['Content-Type' => 'application/xml; charset=UTF-8']));
+    }
+
+    private function harden(Response $response): Response
+    {
+        $response->headers->set('X-Content-Type-Options', 'nosniff');
+        $response->headers->set('Cache-Control', 'no-store');
+
+        return $response;
+    }
+}

src/Controller/SettingsController.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Controller;
+
+use App\Content\RedirectRepository;
+use App\Content\SiteSettings;
+use App\Domain\InvalidPage;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+
+final class SettingsController extends AbstractController
+{
+    public function __construct(private SiteSettings $settings, private RedirectRepository $redirects)
+    {
+    }
+
+    #[Route('/admin/settings', name: 'admin_settings', methods: ['GET'])]
+    public function index(): Response
+    {
+        return $this->render('admin/settings.html.twig', [
+            'settings' => $this->settings->load(),
+            'redirects' => $this->redirects->all(),
+        ]);
+    }
+
+    #[Route('/admin/settings/company', name: 'admin_settings_save', methods: ['POST'])]
+    public function save(Request $request): Response
+    {
+        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        if (!$this->isCsrfTokenValid('settings', $request->request->getString('_csrf_token'))) {
+            return $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
+        }
+        try {
+            $this->settings->save($request->request->all());
+        } catch (InvalidPage $e) {
+            return $this->back($e->getMessage());
+        }
+
+        return $this->back('Die Unternehmensdaten wurden gespeichert.', 'success');
+    }
+
+    #[Route('/admin/settings/redirects', name: 'admin_redirect_save', methods: ['POST'])]
+    public function saveRedirect(Request $request): Response
+    {
+        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        if (!$this->isCsrfTokenValid('settings', $request->request->getString('_csrf_token'))) {
+            return $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
+        }
+        $remove = $request->request->getString('remove');
+        if ('' !== $remove) {
+            $this->redirects->delete($remove);
+
+            return $this->back('Die Weiterleitung wurde entfernt.', 'success');
+        }
+        try {
+            $this->redirects->save(
+                $request->request->getString('from'),
+                $request->request->getString('to'),
+                $request->request->getInt('status', 301),
+            );
+        } catch (InvalidPage $e) {
+            return $this->back($e->getMessage());
+        }
+
+        return $this->back('Die Weiterleitung wurde gespeichert.', 'success');
+    }
+
+    private function back(string $message, string $type = 'error'): Response
+    {
+        $this->addFlash($type, $message);
+
+        return $this->redirectToRoute('admin_settings');
+    }
+}