fitness/app/Http/Controllers/Auth/VerifyEmailController.php

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Auth\Events\Verified;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class VerifyEmailController extends Controller
{
    /**
     * Mark the user's email address as verified.
     *
     * Deliberately not session-gated: the link is opened from an email
     * client, which may belong to a device/browser with no web session at
     * all (e.g. an account registered through the Android app). The signed
     * URL + hash-of-email check below is what proves identity here, not
     * Auth::user().
     */
    public function __invoke(Request $request, int $id, string $hash): RedirectResponse|\Illuminate\Http\JsonResponse
    {
        $user = User::findOrFail($id);

        if (!hash_equals(sha1($user->getEmailForVerification()), $hash)) {
            abort(403);
        }

        $alreadyVerified = $user->hasVerifiedEmail();

        if (!$alreadyVerified && $user->markEmailAsVerified()) {
            event(new Verified($user));
        }

        if ($request->wantsJson()) {
            return response()->json([
                'message' => $alreadyVerified ? 'Email already verified.' : 'Email verified.',
                'verified' => true,
            ]);
        }

        if (Auth::check() && Auth::id() === $user->id) {
            return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
        }

        return redirect()->route('login')->with('status', 'Email verified. You can now log in.');
    }
}