Implemented e-mail confirmations

app/Http/Controllers/AccountController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 
 
 use App\Models\EmailConfirmation;
+use App\Models\User;
 use Hash;
 use Illuminate\Http\Request;
 use Illuminate\Validation\Rule;
@@ -22,34 +23,29 @@ class AccountController extends Controller
 
     public function storeAccount(Request $request)
     {
+        /** @var User $user */
+        $user = user();
+
         $input = $this->validate($request, [
             'name' => [
                 'required',
                 VALI_NAME,
-                Rule::unique('users')->ignoreModel(\user()),
+                Rule::unique('users')->ignoreModel($user),
             ],
             'email' => [
                 'required',
                 VALI_EMAIL,
-                Rule::unique('users')->ignoreModel(\user()),
+                Rule::unique('users')->ignoreModel($user),
             ],
             'new_password' => ['nullable', 'confirmed', VALI_PASSWORD],
         ]);
 
-        $user = user();
-
         if ($input->email != $user->email) {
-            $confirmation = EmailConfirmation::create([
-                'user_id' => $user->id,
-                'email' => $input->email,
-                'token' => Str::random(60),
-            ]);
+            $user->sendEmailConfirmationLink($input->email);
 
-            flash()->warning("New e-mail confirmation sent to $input->email.")->important();
+            flash()->warning("E-mail confirmation sent to $input->email.")->important();
 
-            // TODO send the e-mail
-
-            unset($input->email);
+            unset($input->email); // prevent updating the field in the model via fill
         }
 
         $user->fill($input->all());

app/Http/Controllers/Auth/ConfirmEmailController.php

@@ -0,0 +1,61 @@
+<?php
+
+
+namespace App\Http\Controllers\Auth;
+
+
+use App\Http\Controllers\Controller;
+use App\Models\EmailConfirmation;
+use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
+
+class ConfirmEmailController extends Controller
+{
+    public function resendConfirmation()
+    {
+        $user = user();
+        /** @var EmailConfirmation[]|Collection $ec */
+        $ec = $user->emailConfirmations()->valid()->get();
+        $email = '';
+
+        if ($ec->count() == 0) {
+            user()->sendEmailConfirmationLink($email = $user->email);
+        } else {
+            user()->sendEmailConfirmationLink($email = $ec[0]->email);
+        }
+
+        flash()->success("A new confirmation link was sent to your e-mail $email"); // not important, will fade
+
+        return back();
+    }
+
+    public function confirmEmailAndLogin(Request $request)
+    {
+        $input = $this->validate($request, [
+            'token' => 'string|required',
+        ]);
+
+        $ec = EmailConfirmation::where('token', $input->token)->valid()->first();
+        if (!$ec) abort(400, "Invalid or expired token.");
+
+        $u = $ec->user;
+        if (!$u) abort(400, "User account does not exist.");
+
+        if ($ec->email) $u->email = $ec->email;
+        $wasConfirmed = $u->confirmed;
+        $u->confirmed = true;
+        $u->save();
+        $ec->delete();
+
+        \Auth::login($u, true);
+
+        if ($wasConfirmed) {
+            // user just changed an e-mail
+            flash()->success("Your new e-mail $ec->email was confirmed!")->important();
+        } else {
+            flash()->success("Your e-mail $ec->email was confirmed, your account is now active!")->important();
+        }
+
+        return redirect(route('profile.view', $u->name));
+    }
+}

app/Http/Controllers/Auth/LoginController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
+use App\Models\EmailConfirmation;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
@@ -36,7 +37,7 @@ class LoginController extends Controller
      */
     public function __construct()
     {
-        $this->middleware('guest')->except('logout');
+        $this->middleware('guest')->except(['logout', 'confirmEmailAndLogin']);
     }
 
     public function username()

app/Http/Kernel.php

@@ -52,6 +52,7 @@ class Kernel extends HttpKernel
      * @var array
      */
     protected $routeMiddleware = [
+        'activated' => \App\Http\Middleware\ActivatedAccount::class,
         'auth' => \Illuminate\Auth\Middleware\Authenticate::class,
         'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
         'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,

app/Http/Middleware/ActivatedAccount.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class ActivatedAccount
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        if (guest() || !user()->confirmed) {
+            abort(403, "Only users with active accounts can do this.");
+        }
+
+        return $next($request);
+    }
+}