DONE: replace email verification by link instead of otp

be/Modules/Auth/Http/Controllers/EmailVerificationController.php

@@ -3,60 +3,66 @@
 namespace Modules\Auth\Http\Controllers;
 
 use App\Http\Controllers\Controller;
+use Illuminate\Auth\Events\Verified;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\URL;
 use Modules\Auth\Entities\User;
-use Modules\Auth\Services\AuthSessionService;
-use Modules\Auth\Services\EmailVerificationOtpService;
 
 class EmailVerificationController extends Controller
 {
-    public function __construct(
-        protected EmailVerificationOtpService $otpService,
-        protected AuthSessionService $authSession
-    ) {}
-
-    public function verify(Request $request): JsonResponse
+    public function verify(Request $request, string $id, string $hash): RedirectResponse
     {
-        $validated = $request->validate([
-            'email' => ['required', 'string', 'email'],
-            'otp' => ['required', 'string', 'digits:6'],
-        ]);
-
-        $user = User::where('email', $validated['email'])->first();
-
-        if (! $user) {
-            return response()->json([
-                'success' => false,
-                'message' => 'Kod OTP tidak sah.',
-            ], 422);
+        if (! URL::hasValidSignature($request)) {
+            return $this->redirectToFrontend('invalid');
         }
 
-        $this->otpService->verify($user, $validated['otp']);
+        $user = User::find($id);
 
-        $user->refresh();
+        if (! $user || ! hash_equals($hash, sha1($user->getEmailForVerification()))) {
+            return $this->redirectToFrontend('invalid');
+        }
 
-        return $this->authSession->createAuthResponse(
-            $user,
-            'E-mel anda telah berjaya disahkan. Akaun anda sedang menunggu pengaktifan daripada pentadbir sistem.'
-        );
+        if ($user->hasVerifiedEmail()) {
+            return $this->redirectToFrontend('already');
+        }
+
+        $user->markEmailAsVerified();
+
+        event(new Verified($user));
+
+        return $this->redirectToFrontend('success', $user);
     }
 
-    public function resend(Request $request): JsonResponse
+    public function send(Request $request): JsonResponse
     {
-        $validated = $request->validate([
-            'email' => ['required', 'string', 'email'],
-        ]);
+        $user = $request->user();
 
-        $user = User::where('email', $validated['email'])->first();
-
-        if ($user && ! $user->hasVerifiedEmail()) {
-            $this->otpService->send($user);
+        if ($user->hasVerifiedEmail()) {
+            return response()->json([
+                'success' => true,
+                'message' => 'E-mel anda telah disahkan.',
+            ]);
         }
 
+        $user->sendEmailVerificationNotification();
+
         return response()->json([
             'success' => true,
-            'message' => 'Jika e-mel wujud dan belum disahkan, kod OTP baharu telah dihantar.',
+            'message' => 'Pautan pengesahan e-mel telah dihantar.',
         ]);
     }
+
+    protected function redirectToFrontend(string $status, ?User $user = null): RedirectResponse
+    {
+        $baseUrl = rtrim(config('user.frontend_url'), '/');
+        $path = config('auth.verification.frontend_redirect_path', '/profile');
+
+        if ($user?->status === 'pending') {
+            $path = '/register?registered=success';
+        }
+
+        return redirect()->away("{$baseUrl}{$path}?verified={$status}");
+    }
 }