Alte Mail-Links aufs Admin-Panel leiten ins Ticketsystem (Antrag direkt geoeffnet)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/adminPanelGone.test.js

@@ -15,12 +15,13 @@ const { config } = await import('../server/config.js')
 const { startTestApp } = await import('./support/testApp.js')
 const { viewAsCookie } = await import('./support/fixtures.js')
 const { kundenansichtGuard } = await import('../server/middleware/kundenansichtGuard.js')
+const { default: legacyAdminRedirect } = await import('../server/routes/legacyAdminRedirect.js')
 
 // Hinter dem Waechter: eine Lese- und eine Schreib-Route, die selbst immer 200 liefern
 const probe = Router()
 probe.get('/', (_req, res) => res.json({ ok: true }))
 probe.post('/', (_req, res) => res.json({ ok: true }))
-const app = await startTestApp({ '/': kundenansichtGuard, '/api/projects': probe })
+const app = await startTestApp({ '/': kundenansichtGuard, '/api/projects': probe, '/admin.html': legacyAdminRedirect.admin, '/kalkulation.html': legacyAdminRedirect.kalkulation })
 after(() => Promise.all([app.close(), aw.close(), st.close()]))
 
 const root = new URL('..', import.meta.url).pathname
@@ -51,9 +52,14 @@ test('Admin-Panel und alte Admin-Schnittstellen sind weg', () => {
 })
 
 test('keine Verweise mehr auf admin.html, kalkulation.html oder /api/portal-admin in server/ und public/', () => {
+  // einzige Ausnahme: die Weiterleitung alter Mail-Links ins Ticketsystem (Modul und seine zwei Mounts)
+  const allowed = [path.join(root, 'server/routes/legacyAdminRedirect.js')]
+  const allowedLines = ["app.use('/admin.html', legacyAdminRedirect.admin)", "app.use('/kalkulation.html', legacyAdminRedirect.kalkulation)"]
   const hits = []
   for (const file of [...filesUnder(path.join(root, 'server')), ...filesUnder(path.join(root, 'public'))]) {
+    if (allowed.includes(file)) continue
     readFileSync(file, 'utf8').split('\n').forEach((line, i) => {
+      if (allowedLines.includes(line.trim())) return
       if (/admin\.html|kalkulation\.html|\/api\/portal-admin/.test(line)) hits.push(`${path.relative(root, file)}:${i + 1}`)
     })
   }
@@ -73,3 +79,18 @@ test('Alt-Ansicht ohne Kennung: Lesen und Schreiben 401 view_expired, Cookies ge
     assert.ok(clears(res, 'preview_session'), `${method}: Preview-Cookie geloescht`)
   }
 })
+
+test('alte Mail-Links (/admin.html, /kalkulation.html) leiten ins Ticketsystem, Antrag direkt geoeffnet', async () => {
+  const location = async (p) => {
+    const res = await fetch(`${app.url}${p}`, { redirect: 'manual' })
+    assert.equal(res.status, 302, p)
+    return res.headers.get('location')
+  }
+  assert.equal(await location('/admin.html?gutschrift=6f1c2d3e-aaaa-4bbb-8ccc-123456789abc'), 'https://ticket.webklar.com/customers/gutschriften?antrag=6f1c2d3e-aaaa-4bbb-8ccc-123456789abc')
+  assert.equal(await location('/admin.html'), 'https://ticket.webklar.com/customers')
+  assert.equal(await location('/admin.html?gutschrift=%3Cscript%3E'), 'https://ticket.webklar.com/customers')
+  assert.equal(await location('/kalkulation.html'), 'https://ticket.webklar.com/customers')
+  const index = readFileSync(path.join(root, 'server/index.js'), 'utf8')
+  assert.ok(index.includes("app.use('/admin.html', legacyAdminRedirect.admin)"), 'in server/index.js eingehaengt')
+  assert.ok(index.indexOf("app.use('/admin.html'") < index.indexOf('express.static(publicDir)'), 'vor den statischen Dateien')
+})