feat(legal): electronic withdrawal function and remaining compliance fixes

Withdrawal function (§ 356a BGB, mandatory since 19 June 2026): - /vertrag-widerrufen: two-step flow "Vertrag widerrufen" -> "Widerruf bestätigen", no login, only name, order number and e-mail required. Prominent footer button on every page, prefilled link per order in the customer account. - /api/widerruf stores every declaration (matched to the order only if order number and e-mail fit), mails a receipt with the declaration and the exact time of receipt, notifies ADMIN_EMAIL. Same response for matching and non-matching orders (no enumeration), origin check and rate limit instead of a CAPTCHA that could block a statutory right. User input is HTML-escaped and stripped of line breaks in headers. - /admin/widerrufe lists declarations, open ones first, with an open-count badge and "mark as done". - Withdrawal notice gains the statutory sentence on the online function. Other fixes: - Newsletter stores confirmedAt as proof of consent (Art. 7(1) GDPR). - "Recently viewed" is only persisted with consent (§ 25(1) TDDDG); choosing "essential only" or withdrawing consent deletes it. The banner no longer promises audience-measurement cookies that do not exist. - Admin rejects an invalid company e-mail; an obfuscated stored value falls back to the configured address so the legal notice stays valid. - Privacy policy: Microsoft 365 as mail processor, log retention of at most 14 days, withdrawal-function processing, consent timestamps. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-26 11:14:02 +02:00
1 parent 4ab1a7edae
commit dcfad4e011
@@ -0,0 +1,124 @@
+import type { Locale } from "@/i18n/config";
+
+/**
+ * Elektronische Widerrufsfunktion (§ 356a BGB): Wortlaut der Erklaerung und
+ * der Eingangsbestaetigung. Bewusst an EINER Stelle statt in email-strings.ts:
+ * derselbe Wortlaut erscheint in der Mail an die Kundschaft, auf der
+ * Bestaetigungsseite und im Admin — die Eingangsbestaetigung muss genau das
+ * wiedergeben, was erklaert wurde (§ 356a Abs. 4 BGB).
+ */
+
+export interface WithdrawalDeclarationInput {
+  name: string;
+  orderNumber: string;
+  email: string;
+  message: string | null;
+}
+
+export interface WithdrawalReceiptEmail {
+  subject: string;
+  preheader: string;
+  /** Inhalt fuer den gemeinsamen Mail-Rahmen (emailLayout), bereits maskiert. */
+  bodyHtml: string;
+  text: string;
+}
+
+const TIME_ZONE = "Europe/Berlin";
+
+const STRINGS = {
+  de: {
+    declaration: (orderNumber: string) => `Hiermit widerrufe ich den Vertrag über die Bestellung ${orderNumber}.`,
+    name: "Name",
+    email: "E-Mail",
+    message: "Nachricht",
+    subject: (orderNumber: string) => `Eingangsbestätigung deines Widerrufs zu ${orderNumber}`,
+    heading: "Dein Widerruf ist bei uns eingegangen",
+    intro: "Hiermit bestätigen wir den Eingang deiner Widerrufserklärung, die du über unsere Widerrufsfunktion abgegeben hast. Sie lautet:",
+    receivedAt: "Eingegangen am",
+    next: "Bitte sende uns die Ware innerhalb von 14 Tagen zurück, sofern du sie bereits erhalten hast. Sobald die Ware bei uns ist oder du uns die Rücksendung nachgewiesen hast, erstatten wir dir den Kaufpreis. Diese Bestätigung dokumentiert den Eingang deiner Erklärung.",
+  },
+  en: {
+    declaration: (orderNumber: string) => `I hereby withdraw from the contract for order ${orderNumber}.`,
+    name: "Name",
+    email: "Email",
+    message: "Message",
+    subject: (orderNumber: string) => `Confirmation of receipt of your withdrawal for ${orderNumber}`,
+    heading: "We have received your withdrawal",
+    intro: "We hereby confirm receipt of the notice of withdrawal you submitted via our withdrawal function. It reads:",
+    receivedAt: "Received on",
+    next: "If you have already received the goods, please send them back to us within 14 days. We will refund the purchase price once the goods have arrived or you have shown proof of return. This confirmation documents the receipt of your notice.",
+  },
+} as const;
+
+function part(parts: Intl.DateTimeFormatPart[], type: Intl.DateTimeFormatPartTypes): string {
+  return parts.find((p) => p.type === type)?.value ?? "";
+}
+
+/** Zugangszeitpunkt in deutscher Ortszeit, sekundengenau und mit Zeitzone — er ist Beweismittel. */
+export function formatReceivedAt(date: Date, locale: Locale): string {
+  const time = new Intl.DateTimeFormat("de-DE", {
+    timeZone: TIME_ZONE,
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hourCycle: "h23",
+  }).format(date);
+  if (locale === "de") {
+    const day = new Intl.DateTimeFormat("de-DE", { timeZone: TIME_ZONE, day: "2-digit", month: "2-digit", year: "numeric" }).format(date);
+    const zone = part(new Intl.DateTimeFormat("de-DE", { timeZone: TIME_ZONE, timeZoneName: "short" }).formatToParts(date), "timeZoneName");
+    return `${day}, ${time} Uhr (${zone})`;
+  }
+  const day = new Intl.DateTimeFormat("en-GB", { timeZone: TIME_ZONE, day: "numeric", month: "long", year: "numeric" }).format(date);
+  const zone = part(new Intl.DateTimeFormat("en-GB", { timeZone: TIME_ZONE, timeZoneName: "short" }).formatToParts(date), "timeZoneName");
+  return `${day}, ${time} (${zone}, German time)`;
+}
+
+export function withdrawalDeclarationLines(input: WithdrawalDeclarationInput, locale: Locale): string[] {
+  const s = STRINGS[locale];
+  return [
+    s.declaration(input.orderNumber),
+    `${s.name}: ${input.name}`,
+    `${s.email}: ${input.email}`,
+    ...(input.message ? [`${s.message}: ${input.message}`] : []),
+  ];
+}
+
+export function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+/** Zeilenumbrueche im Betreff wuerden sonst als weitere Mail-Header gelesen (Header-Injection). */
+function singleLine(value: string): string {
+  return value.replace(/[\r\n]+/g, " ");
+}
+
+export function withdrawalReceiptEmailContent(
+  input: WithdrawalDeclarationInput,
+  receivedAt: Date,
+  locale: Locale
+): WithdrawalReceiptEmail {
+  const s = STRINGS[locale];
+  const lines = withdrawalDeclarationLines(input, locale);
+  const when = formatReceivedAt(receivedAt, locale);
+  const bodyHtml = `
+      <h1 style="font-size:20px;color:#24352B;margin:0 0 12px;">${s.heading}</h1>
+      <p style="margin:0 0 16px;line-height:1.5;">${s.intro}</p>
+      <div style="margin:0 0 16px;padding:16px;background-color:#F4EFE5;line-height:1.6;">
+        ${lines.map((line) => escapeHtml(line)).join("<br>")}
+      </div>
+      <p style="margin:0 0 16px;line-height:1.5;"><strong>${s.receivedAt}:</strong> ${escapeHtml(when)}</p>
+      <p style="margin:0;line-height:1.5;">${s.next}</p>
+    `;
+  const text = [s.heading, "", s.intro, "", ...lines, "", `${s.receivedAt}: ${when}`, "", s.next].join("\n");
+  return {
+    subject: singleLine(s.subject(input.orderNumber)),
+    preheader: escapeHtml(singleLine(`${s.receivedAt}: ${when}`)),
+    bodyHtml,
+    text,
+  };
+}