Close the remaining fixable risks from the handover

[bernardhanna]

Second pass on the handover. The first PR fixed the risks that were safe to fix without a decision; this one closes the rest, including the items that were previously left for the incoming team.

Security and access

• The certificate backend was gated on one hardcoded personal email address, in a public repo, with no role granting access — a new super admin got a 403 and could not operate certificates at all. It now reads a comma-separated CERTIFICATE_ADMIN_EMAILS allowlist and fails closed, saying so in the 403. The profile dropdown link uses the same list rather than its own copy of the address.
• Any ambassador could reject any country's activities. EventController@reject called $this->authorize() inside a try with an empty catch, so the country check was defeated while the identical check on approve was enforced.
• users.approved was mass-assignable, so any future update($request->all()) could publish or hide a leading teacher. Now guarded. id deliberately stays assignable — the legacy placeholder user relies on mass-assigning 1000000.
• A hardcoded remember_token and a time-seeded password were used when creating that legacy user. Both are random now.

Correctness

• Rejecting from Nova told the organiser nothing — the action called reject() with no argument, writing an empty moderation message and emailing a rejection with no reason, while /pending and /review captured one. The action now requires a reason.
• Country was optional on the profile despite the form marking it required, and the error block beneath it was bound to a field name that does not exist, so the message could never appear.
• ResourceEditorRoleSeeder threw on any re-run — it used Role::create for a role the main seeder already creates.

Visibility and operations

• Leading teachers with no city were invisible on /community with nothing to tell them why. The map groups teachers by city_id and skips any group whose city has no coordinates, so they were present in the query and absent from the page. Their profile now warns them, and the admin list gains a City column and a Not set filter so someone can find and chase them. This is the most common support question about that page.
• Nothing alerted on a backed-up queue. queue:monitor was not scheduled and no QueueBusy listener existed, so a stalled worker in October was noticed by a human wondering why activities had stopped appearing. All three pieces are now in place, with the threshold in QUEUE_BUSY_THRESHOLD so a noisy alert can be tuned rather than switched off.

Tests

449 passing, up from 431 passing with 1 failing.

• CityFactory was still a pre-Laravel-8 closure factory, so App\City had no discoverable factory.
• UserRestoreServiceTest never disabled the support_gmail.dry_run guard, so it exercised the refusal rather than the restore.
• OnlineEventsWorkflowTest created its fixture at exactly the query's 15-day boundary. The two now() calls are milliseconds apart, so it failed whenever the clock ticked a second in between — roughly one run in four.
• Five files in tests/Feature/ lacked the Test.php suffix and had drifted against the factory API. Repaired and renamed, so they run.

GermanImports asserted three German cities that ImporterHelper no longer lists. Rather than change what Event::imported() matches, the test now iterates that helper so the list stays the single source of truth.

Docs

Chapter 12 is reorganised around what the incoming team must act on, and no longer lists problems that are fixed. What remains needs credentials we cannot use on their behalf. Adds chapter 14 on accounts, profiles, roles and moderation.

Also corrects a claim that was simply wrong: relocate and relocate:country are different commands, not a name collision resolving to one class.

Before merging

Two changes alter live behaviour and want a look on dev first:

1. Set CERTIFICATE_ADMIN_EMAILS in Forge for dev and live. It fails closed, so leaving it blank locks everyone out of the certificate backend.
2. Submit the contact form on dev. Turnstile verification is genuinely on for the first time; if the configured secret is stale, submissions will start failing.

Made with Cursor