progress

app/Http/Controllers/Auth/VerifyEmailController.php

@@ -3,25 +3,48 @@
 namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
+use App\Models\User;
 use Illuminate\Auth\Events\Verified;
-use Illuminate\Foundation\Auth\EmailVerificationRequest;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
 
 class VerifyEmailController extends Controller
 {
     /**
-     * Mark the authenticated user's email address as verified.
+     * Mark the user's email address as verified.
+     *
+     * Deliberately not session-gated: the link is opened from an email
+     * client, which may belong to a device/browser with no web session at
+     * all (e.g. an account registered through the Android app). The signed
+     * URL + hash-of-email check below is what proves identity here, not
+     * Auth::user().
      */
-    public function __invoke(EmailVerificationRequest $request): RedirectResponse
+    public function __invoke(Request $request, int $id, string $hash): RedirectResponse|\Illuminate\Http\JsonResponse
     {
-        if ($request->user()->hasVerifiedEmail()) {
+        $user = User::findOrFail($id);
+
+        if (!hash_equals(sha1($user->getEmailForVerification()), $hash)) {
+            abort(403);
+        }
+
+        $alreadyVerified = $user->hasVerifiedEmail();
+
+        if (!$alreadyVerified && $user->markEmailAsVerified()) {
+            event(new Verified($user));
+        }
+
+        if ($request->wantsJson()) {
+            return response()->json([
+                'message' => $alreadyVerified ? 'Email already verified.' : 'Email verified.',
+                'verified' => true,
+            ]);
+        }
+
+        if (Auth::check() && Auth::id() === $user->id) {
             return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
         }
 
-        if ($request->user()->markEmailAsVerified()) {
-            event(new Verified($request->user()));
-        }
-
-        return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
+        return redirect()->route('login')->with('status', 'Email verified. You can now log in.');
     }
 }