progress

routes/auth.php

@@ -35,14 +35,18 @@ Route::middleware('guest')->group(function () {
         ->name('password.store');
 });
 
+// Not session-gated: this link is opened from an email client, which may not
+// carry the web session of whichever device/browser registered the account
+// (e.g. a user who signed up through the Android app). Identity is proven by
+// the signed URL + hash, same as the auth-gated version this replaced.
+Route::get('verify-email/{id}/{hash}', VerifyEmailController::class)
+    ->middleware(['signed', 'throttle:6,1'])
+    ->name('verification.verify');
+
 Route::middleware('auth')->group(function () {
     Route::get('verify-email', EmailVerificationPromptController::class)
         ->name('verification.notice');
 
-    Route::get('verify-email/{id}/{hash}', VerifyEmailController::class)
-        ->middleware(['signed', 'throttle:6,1'])
-        ->name('verification.verify');
-
     Route::post('email/verification-notification', [EmailVerificationNotificationController::class, 'store'])
         ->middleware('throttle:6,1')
         ->name('verification.send');