Einwilligung, die tatsächlich zurückhält, und Pflichtseiten

Ein Hinweis, der nur fragt und sonst nichts ändert, ist Theater. Deshalb zwei
Hälften, und die zweite ist die wichtigere.

Die Frage: serverseitig gerendert, per Formular beantwortet, ohne JavaScript -
die öffentlichen Seiten laufen mit script-src 'none', und ein Banner mit
Skript wäre das eine, was diese Regel bricht. "Alle akzeptieren" und "Nur
notwendige" sind dieselbe Art Knopf, gleich groß, nebeneinander. Die
Entscheidung steht in einem eigenen Cookie: Fassung der Frage, gewährte
Gruppen, Zeitpunkt. Keine Kennung, kein Serverabgleich, ein halbes Jahr. Kein
CSRF-Token, absichtlich: die Anfrage ändert nichts auf dem Server, und ein
Token bräuchte für jeden Besucher eine Sitzung - genau das, was ein
Einwilligungshinweis vermeiden soll. Geprüft wird stattdessen das
Rücksprungziel.

Das Zurückhalten: der neue Block "Externer Inhalt" (Dokumentschema v14) lädt
ohne Einwilligung nichts - kein iframe, keine Adresse im Markup, frame-src
'none'. Der Platzhalter nennt den Anbieter; sein Knopf gewährt genau diese
Gruppe und nimmt die vorher gewährten mit. Erst danach kommt der Host in die
Sicherheitsrichtlinie, und nur dieser. Im Editor bleibt es immer ein
Platzhalter.

Datenschutz und Impressum sind keine Einstellung mehr: fehlen sie, warnt die
Verwaltung und legt sie auf Knopfdruck als Gerüst an, mit NOCH AUSZUFÜLLEN an
jeder Pflichtangabe. Den Text schreibt das CMS nicht - das ist eine rechtliche
Aussage über eine Firma. Verlinkt werden beide aus dem Template, nicht aus dem
Fußbereich: ein Pflichtlink, den man löschen kann, ist keiner.

Dazu der Fehler, den Umut im Screenshot gesehen hat: die Wortmarke stand als
Buchstabenkolonne in einem 60 Pixel breiten Kasten. .site-header war noch ein
Flexcontainer aus der Zeit des handgeschriebenen Markups und quetschte die
Sektion zusammen, und design.css band jede Designklasse an #main - wo Kopf-
und Fußbereich seit ADR 026 nicht mehr liegen. Beides behoben.

Neu im Ausbauplan: Statistik (serverseitige, wiedererkennungsfreie Zählung,
die deshalb keine Einwilligung braucht), Inhalte und Ladeverhalten prüfen
(Blättern überall, minimal laden, Ladebudget), Installer (Schritt für Schritt
im Browser, Migration inklusive).

245 PHP-Tests / 976 Assertions unter PHP 8.2.12 und 8.4.22. Der Browsertest
fand zwei Fehler von mir: grauer Text auf dunklem Fußbereich mit 2,24:1, und
das fixierte Banner verdeckte den Einwilligungsknopf am Seitenende.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/CmsTest.php

@@ -2,6 +2,7 @@
 
 namespace App\Tests;
 
+use App\Content\Consent;
 use App\Content\CustomCode;
 use App\Content\DemoContent;
 use App\Content\DocumentValidator;
@@ -1761,7 +1762,227 @@ final class CmsTest extends TestCase
         $code->assertScriptsUnchanged($added, $before);
     }
 
-    private function request(string $url, string $method = 'GET'): Response
+    /** Turns on the consent question and publishes a privacy page it can point to. */
+    private function askConsent(array $groups = ['external']): void
+    {
+        $this->publishedPage('datenschutz', 'Datenschutz');
+        $this->site->save([
+            'homePath' => 'home',
+            'consentBanner' => '1',
+            'consentGroups' => $groups,
+            'privacyPath' => 'datenschutz',
+        ]);
+    }
+
+    public function testALegalPathMustPointAtAPageThatExists(): void
+    {
+        foreach (['privacyPath', 'imprintPath'] as $key) {
+            try {
+                $this->site->save(['homePath' => 'home', $key => 'gibt-es-nicht']);
+                self::fail('Expected '.$key.' to be refused.');
+            } catch (InvalidPage) {
+            }
+            self::assertSame('', $this->site->load()[$key]);
+        }
+        // A page that exists is accepted and then linked on every page.
+        $this->publishedPage('datenschutz', 'Datenschutz');
+        $this->site->save(['homePath' => 'home', 'privacyPath' => 'datenschutz']);
+        self::assertSame('datenschutz', $this->site->load()['privacyPath']);
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', DemoContent::pages()['home'], 0), 1);
+        self::assertStringContainsString('<a href="/datenschutz">Datenschutz</a>', $this->request('/')->getContent());
+    }
+
+    public function testWithoutEmbedsThereIsNoConsentQuestion(): void
+    {
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', DemoContent::pages()['home'], 0), 1);
+        $html = $this->request('/')->getContent();
+        // Nothing is loaded from anywhere else, so there is nothing to ask about - and a banner
+        // without a reason is only in the way.
+        self::assertStringNotContainsString('consent-bar', $html);
+        self::assertStringNotContainsString('Einwilligung ändern', $html);
+        self::assertSame(404, $this->request('/einwilligung')->getStatusCode());
+    }
+
+    public function testTheQuestionAppearsUntilItIsAnsweredAndCanBeChangedAgain(): void
+    {
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', DemoContent::pages()['home'], 0), 1);
+        $this->askConsent();
+
+        $response = $this->request('/');
+        $html = $response->getContent();
+        self::assertStringContainsString('consent-bar', $html);
+        // Accepting and refusing are both buttons of the same form, so neither is hidden away.
+        self::assertStringContainsString('value="all"', $html);
+        self::assertStringContainsString('value="none"', $html);
+        self::assertStringContainsString('/datenschutz', $html);
+        // No script anywhere: the strict policy stays as it is.
+        self::assertStringContainsString("script-src 'none'", (string) $response->headers->get('Content-Security-Policy'));
+
+        $saved = $this->request('/einwilligung', 'POST', ['choice' => 'all', 'back' => '/']);
+        self::assertSame(302, $saved->getStatusCode());
+        self::assertSame('/', $saved->headers->get('Location'));
+        $cookie = $saved->headers->getCookies()[0];
+        self::assertSame(Consent::COOKIE, $cookie->getName());
+        self::assertTrue($cookie->isHttpOnly());
+        self::assertSame('lax', $cookie->getSameSite());
+        self::assertStringContainsString('external', (string) $cookie->getValue());
+
+        // With a decision in hand the banner is gone, but the way back to it is not.
+        $decided = $this->request('/', 'GET', [], [Consent::COOKIE => (string) $cookie->getValue()]);
+        self::assertStringNotContainsString('consent-bar', $decided->getContent());
+        self::assertStringContainsString('/einwilligung', $decided->getContent());
+        self::assertSame(200, $this->request('/einwilligung', 'GET', [], [Consent::COOKIE => (string) $cookie->getValue()])->getStatusCode());
+    }
+
+    /** @return iterable<string, array{string, bool}> */
+    public static function consentCookies(): iterable
+    {
+        yield 'granted' => ['1|external|'.time(), true];
+        yield 'refused' => ['1|<EMPTY>|'.time(), false];
+        yield 'other group only' => ['1|statistics|'.time(), false];
+        yield 'expired' => ['1|external|'.(time() - Consent::MAX_AGE - 60), false];
+        yield 'older question' => ['0|external|'.time(), false];
+        yield 'nonsense' => ['ganz-egal', false];
+        yield 'unknown group' => ['1|erfunden|'.time(), false];
+    }
+
+    #[DataProvider('consentCookies')]
+    public function testAnEmbedLoadsOnlyWithAValidDecisionForItsGroup(string $cookie, bool $expected): void
+    {
+        $document = DemoContent::starter('Mit Karte');
+        $document['schemaVersion'] = 14;
+        $document['blocks'][] = [
+            'id' => 'karte', 'type' => 'embed',
+            'props' => ['group' => 'external', 'title' => 'Anfahrt', 'provider' => 'OpenStreetMap', 'url' => 'https://karten.example/einbetten?ort=kant', 'hint' => '', 'height' => 400],
+        ];
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', $document, 0), 1);
+        $this->askConsent();
+
+        $response = $this->request('/', 'GET', [], [Consent::COOKIE => str_replace('<EMPTY>', '', $cookie)]);
+        $html = $response->getContent();
+        $policy = (string) $response->headers->get('Content-Security-Policy');
+        if ($expected) {
+            self::assertStringContainsString('<iframe src="https://karten.example/einbetten?ort=kant"', $html);
+            self::assertStringContainsString('title="Anfahrt"', $html);
+            self::assertStringContainsString('frame-src https://karten.example', $policy);
+        } else {
+            // Not a hidden iframe, not a lazy one: the address does not appear at all.
+            self::assertStringNotContainsString('<iframe', $html);
+            self::assertStringNotContainsString('karten.example/einbetten', $html);
+            self::assertStringContainsString('OpenStreetMap', $html, 'The placeholder names the provider.');
+            self::assertStringContainsString("frame-src 'none'", $policy);
+        }
+    }
+
+    public function testTheEmbedButtonGrantsOnlyItsOwnGroupAndKeepsWhatWasGrantedBefore(): void
+    {
+        $document = DemoContent::starter('Mit Karte');
+        $document['schemaVersion'] = 14;
+        $document['blocks'][] = [
+            'id' => 'karte', 'type' => 'embed',
+            'props' => ['group' => 'external', 'title' => 'Anfahrt', 'provider' => 'Karten', 'url' => 'https://karten.example/x', 'hint' => '', 'height' => 300],
+        ];
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', $document, 0), 1);
+        $this->askConsent(['external', 'statistics']);
+
+        // Statistics were granted earlier; loading the map must not take that away.
+        $before = '1|statistics|'.time();
+        $html = $this->request('/', 'GET', [], [Consent::COOKIE => $before])->getContent();
+        self::assertStringContainsString('name="groups[]" value="statistics"', $html);
+        self::assertStringContainsString('name="groups[]" value="external"', $html);
+
+        $saved = $this->request('/einwilligung', 'POST', ['choice' => 'some', 'groups' => ['statistics', 'external'], 'back' => '/']);
+        $value = (string) $saved->headers->getCookies()[0]->getValue();
+        self::assertStringContainsString('statistics', $value);
+        self::assertStringContainsString('external', $value);
+    }
+
+    public function testTheConsentFormNeverSendsAnyoneElsewhere(): void
+    {
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', DemoContent::pages()['home'], 0), 1);
+        $this->askConsent();
+        foreach (['https://fremd.example/', '//fremd.example/', 'fremd.example', ''] as $target) {
+            $response = $this->request('/einwilligung', 'POST', ['choice' => 'none', 'back' => $target]);
+            self::assertSame('/', $response->headers->get('Location'), $target);
+        }
+        // A local path is kept, so the decision returns to the page it was made on.
+        self::assertSame('/datenschutz', $this->request('/einwilligung', 'POST', ['choice' => 'none', 'back' => '/datenschutz'])->headers->get('Location'));
+    }
+
+    public function testSwitchingTheQuestionOffLetsTheEmbedLoadAgain(): void
+    {
+        $document = DemoContent::starter('Mit Karte');
+        $document['schemaVersion'] = 14;
+        $document['blocks'][] = [
+            'id' => 'karte', 'type' => 'embed',
+            'props' => ['group' => 'external', 'title' => 'Anfahrt', 'provider' => 'Karten', 'url' => 'https://karten.example/x', 'hint' => '', 'height' => 300],
+        ];
+        $this->pages->publish('page-1', $this->pages->saveDraft('page-1', $document, 0), 1);
+        // No question asked means nothing is withheld: otherwise turning the banner off would
+        // silently empty every page that embeds something.
+        $html = $this->request('/')->getContent();
+        self::assertStringContainsString('<iframe', $html);
+        self::assertStringNotContainsString('consent-bar', $html);
+    }
+
+    /** @return iterable<string, array{array<string, mixed>}> */
+    public static function refusedEmbeds(): iterable
+    {
+        yield 'http' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'http://karten.example/x', 'hint' => '', 'height' => 300]];
+        yield 'protocol relative' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => '//karten.example/x', 'hint' => '', 'height' => 300]];
+        yield 'javascript' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'javascript:alert(1)', 'hint' => '', 'height' => 300]];
+        yield 'data url' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'data:text/html,<script>alert(1)</script>', 'hint' => '', 'height' => 300]];
+        yield 'with a port' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'https://karten.example:8443/x', 'hint' => '', 'height' => 300]];
+        yield 'with credentials' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'https://nutzer:geheim@karten.example/x', 'hint' => '', 'height' => 300]];
+        yield 'host with a space' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'https://karten example/x', 'hint' => '', 'height' => 300]];
+        yield 'no title' => [['group' => 'external', 'title' => '', 'provider' => '', 'url' => 'https://karten.example/x', 'hint' => '', 'height' => 300]];
+        yield 'unknown group' => [['group' => 'erfunden', 'title' => 'X', 'provider' => '', 'url' => 'https://karten.example/x', 'hint' => '', 'height' => 300]];
+        yield 'height too small' => [['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'https://karten.example/x', 'hint' => '', 'height' => 10]];
+    }
+
+    #[DataProvider('refusedEmbeds')]
+    public function testRefusedEmbedsNeverReachADocument(array $props): void
+    {
+        $document = DemoContent::starter('Mit Karte');
+        $document['schemaVersion'] = 14;
+        $document['blocks'][] = ['id' => 'karte', 'type' => 'embed', 'props' => $props];
+        try {
+            $this->pages->saveDraft('page-1', $document, 0);
+            self::fail('Expected the embed to be refused: '.json_encode($props['url']));
+        } catch (InvalidDocument) {
+        }
+        self::assertSame(0, (int) $this->db->fetchOne('SELECT COUNT(*) FROM revision WHERE page_id = ?', ['page-1']));
+    }
+
+    public function testAnEmbedNeedsSchemaFourteen(): void
+    {
+        $document = DemoContent::starter('Zu alt');
+        $document['schemaVersion'] = 13;
+        $document['blocks'][] = [
+            'id' => 'karte', 'type' => 'embed',
+            'props' => ['group' => 'external', 'title' => 'X', 'provider' => '', 'url' => 'https://karten.example/x', 'hint' => '', 'height' => 300],
+        ];
+        $this->expectException(InvalidDocument::class);
+        $this->pages->saveDraft('page-1', $document, 0);
+    }
+
+    public function testAConsentBannerNeedsAPrivacyPageThatExists(): void
+    {
+        foreach ([
+            'without a privacy page' => ['consentBanner' => '1', 'consentGroups' => ['external'], 'privacyPath' => ''],
+            'pointing nowhere' => ['consentBanner' => '1', 'consentGroups' => ['external'], 'privacyPath' => 'gibt-es-nicht'],
+            'without a group' => ['consentBanner' => '1', 'consentGroups' => [], 'privacyPath' => 'datenschutz'],
+        ] as $case => $input) {
+            try {
+                $this->site->save([...$input, 'homePath' => 'home']);
+                self::fail('Expected '.$case.' to be refused.');
+            } catch (InvalidPage) {
+            }
+            self::assertFalse($this->site->load()['consentBanner'], $case);
+        }
+    }
+
+    private function request(string $url, string $method = 'GET', array $body = [], array $cookies = []): Response
     {
         $previous = [];
         foreach (['APP_SECRET' => 'test-only', 'DATABASE_URL' => 'sqlite:///'.str_replace('\\', '/', $this->path), 'SITE_ORIGIN' => 'https://cms.test', 'MEDIA_DIRECTORY' => $this->path.'-media'] as $key => $value) {
@@ -1770,7 +1991,7 @@ final class CmsTest extends TestCase
         }
         $kernel = new Kernel('test', false);
         try {
-            return $kernel->handle(Request::create($url, $method));
+            return $kernel->handle(Request::create($url, $method, $body, $cookies));
         } finally {
             $kernel->shutdown();
             foreach ($previous as $key => [$server, $env]) {

tests/EditorSecurityTest.php

@@ -558,6 +558,46 @@ final class EditorSecurityTest extends WebTestCase
         self::assertResponseRedirects('/admin/media?seite=2');
     }
 
+    public function testTheMandatoryLegalPagesAreCreatedPublishedAndLinkedEverywhere(): void
+    {
+        $client = $this->login('editor');
+        $crawler = $client->request('GET', '/admin/settings');
+        // As long as they are missing, the settings screen says so instead of hiding it.
+        self::assertCount(1, $crawler->filter('form[action="/admin/settings/rechtliches"]'));
+        self::assertStringContainsString('Pflichtseiten fehlen', $crawler->filter('.card-head')->first()->text());
+        $token = $crawler->filter('form[action="/admin/settings/rechtliches"] input[name="_csrf_token"]')->attr('value');
+
+        $client->request('POST', '/admin/settings/rechtliches', ['_csrf_token' => 'wrong']);
+        self::assertSame(0, (int) $this->db->fetchOne('SELECT COUNT(*) FROM page WHERE path IN (?, ?)', ['datenschutz', 'impressum']));
+
+        $client->request('POST', '/admin/settings/rechtliches', ['_csrf_token' => $token]);
+        self::assertResponseRedirects('/admin/settings');
+
+        // Both pages exist, are published, and the settings point at them.
+        foreach (['datenschutz' => 'Datenschutzerklärung', 'impressum' => 'Impressum'] as $path => $title) {
+            $row = $this->db->fetchAssociative('SELECT id, published_revision_id FROM page WHERE path = ?', [$path]);
+            self::assertNotFalse($row, $path);
+            self::assertNotNull($row['published_revision_id'], $path.' must be published: an unpublished imprint is no imprint.');
+            $client->request('GET', '/'.$path);
+            self::assertResponseIsSuccessful();
+            self::assertStringContainsString($title, $client->getResponse()->getContent());
+            // The skeleton says plainly that it is not finished.
+            self::assertStringContainsString('NOCH AUSZUFÜLLEN', $client->getResponse()->getContent());
+        }
+
+        // And they are linked from an ordinary page, without anyone editing the footer.
+        $client->request('GET', '/');
+        $content = $client->getResponse()->getContent();
+        self::assertStringContainsString('<a href="/datenschutz">Datenschutz</a>', $content);
+        self::assertStringContainsString('<a href="/impressum">Impressum</a>', $content);
+
+        // Running it twice keeps the existing pages: they may already carry the real text.
+        $before = $this->db->fetchOne('SELECT COUNT(*) FROM revision');
+        $client->request('POST', '/admin/settings/rechtliches', ['_csrf_token' => $token]);
+        self::assertSame($before, $this->db->fetchOne('SELECT COUNT(*) FROM revision'));
+        self::assertSame(2, (int) $this->db->fetchOne('SELECT COUNT(*) FROM page WHERE path IN (?, ?)', ['datenschutz', 'impressum']));
+    }
+
     public function testPasswordUpgradeRefreshesTheSessionUser(): void
     {
         $provider = new UserProvider($this->db);