Require a verified email address before the app opens

.env.example

@@ -51,10 +51,10 @@ REDIS_HOST=127.0.0.1
 REDIS_PASSWORD=null
 REDIS_PORT=6379
 
-MAIL_MAILER=log
+MAIL_MAILER=smtp
 MAIL_SCHEME=null
 MAIL_HOST=127.0.0.1
-MAIL_PORT=2525
+MAIL_PORT=1025
 MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_FROM_ADDRESS="hello@example.com"

app/Http/Controllers/DashboardRedirectController.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Responses\Concerns\RedirectsToCurrentOrganization;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class DashboardRedirectController extends Controller
+{
+    use RedirectsToCurrentOrganization;
+
+    /**
+     * Send someone at /dashboard to the dashboard they actually have.
+     *
+     * Every real dashboard lives under an organization, so the bare path
+     * cannot be one. It exists because config('fortify.home') is a fixed
+     * string that Fortify hands out on its own: an already verified user
+     * who opens the verification prompt, or asks for another verification
+     * mail, is redirected there and would otherwise land on a 404.
+     */
+    public function __invoke(Request $request): RedirectResponse
+    {
+        return redirect($this->redirectPathForCurrentOrganization($request, '/dashboard'));
+    }
+}

app/Models/User.php

@@ -2,9 +2,9 @@
 
 namespace App\Models;
 
-// use Illuminate\Contracts\Auth\MustVerifyEmail;
 use App\Concerns\HasOrganizations;
 use Database\Factories\UserFactory;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Collection;
@@ -36,7 +36,7 @@
  */
 #[Fillable(['name', 'email', 'password', 'current_organization_id'])]
 #[Hidden(['password', 'two_factor_secret', 'two_factor_recovery_codes', 'remember_token'])]
-class User extends Authenticatable implements PasskeyUser
+class User extends Authenticatable implements MustVerifyEmail, PasskeyUser
 {
     /** @use HasFactory<UserFactory> */
     use HasFactory, HasOrganizations, Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;

routes/settings.php

@@ -16,7 +16,7 @@
     Route::patch('settings/profile', [ProfileController::class, 'update'])->name('profile.update');
 });
 
-Route::middleware(['auth'])->group(function () {
+Route::middleware(['auth', 'verified'])->group(function () {
     Route::delete('settings/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');
 
     Route::get('settings/security', [SecurityController::class, 'edit'])

routes/web.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Http\Controllers\DashboardController;
+use App\Http\Controllers\DashboardRedirectController;
 use App\Http\Controllers\OnboardingController;
 use App\Http\Controllers\Organizations\OrganizationInvitationController;
 use App\Http\Controllers\Reports\OrderStatusController;
@@ -15,11 +16,17 @@
 Route::inertia('/', 'welcome')->name('home');
 
 Route::get('onboarding', OnboardingController::class)
-    ->middleware(['auth'])
+    ->middleware(['auth', 'verified'])
     ->name('onboarding');
 
+// Every real dashboard is under an organization. This is the bare path
+// Fortify redirects to from config('fortify.home').
+Route::get('dashboard', DashboardRedirectController::class)
+    ->middleware(['auth', 'verified'])
+    ->name('dashboard.redirect');
+
 Route::prefix('{current_organization}')
-    ->middleware(['auth', EnsureOrganizationMembership::class])
+    ->middleware(['auth', 'verified', EnsureOrganizationMembership::class])
     ->scopeBindings()
     ->group(function () {
         Route::get('dashboard', DashboardController::class)->name('dashboard');
@@ -45,10 +52,12 @@
     });
 
 Route::get('invitations', [OrganizationInvitationController::class, 'index'])
-    ->middleware(['auth'])
+    ->middleware(['auth', 'verified'])
     ->name('invitations.index');
 
-Route::middleware(['auth'])->group(function () {
+// Accepting an invitation joins an account to an organization that was
+// invited by email, so the address has to be proven before it is used.
+Route::middleware(['auth', 'verified'])->group(function () {
     Route::post('invitations/{invitation}/accept', [OrganizationInvitationController::class, 'accept'])->name('invitations.accept');
     Route::delete('invitations/{invitation}', [OrganizationInvitationController::class, 'decline'])->name('invitations.decline');
 });

tests/Browser/Auth/AuthenticationTest.php

@@ -2,6 +2,7 @@
 
 use App\Models\Organization;
 use App\Models\User;
+use Illuminate\Support\Facades\URL;
 
 test('a user signs in through the login form and lands on the dashboard of their organization', function () {
     $organization = Organization::factory()->create(['name' => 'Toys Online Group']);
@@ -34,3 +35,24 @@
 
     $this->assertGuest();
 });
+
+test('an unverified user is held at the verification prompt until they verify', function () {
+    $user = User::factory()->unverified()->create();
+
+    $this->actingAs($user);
+
+    visit(route('dashboard', $user->currentOrganization))
+        ->assertPathIs('/email/verify')
+        ->assertSee('Resend verification email')
+        ->assertNoJavaScriptErrors();
+
+    // The link the verification mail carries.
+    visit(URL::temporarySignedRoute('verification.verify', now()->addHour(), [
+        'id' => $user->id,
+        'hash' => sha1($user->email),
+    ]))
+        ->assertPathIs("/{$user->currentOrganization->slug}/dashboard")
+        ->assertNoJavaScriptErrors();
+
+    expect($user->fresh()->hasVerifiedEmail())->toBeTrue();
+});

tests/Feature/Auth/VerifiedAccessTest.php

@@ -0,0 +1,80 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Auth\Notifications\VerifyEmail;
+use Illuminate\Support\Facades\Notification;
+
+test('an unverified user is sent to the verification prompt', function (Closure $route) {
+    $user = User::factory()->unverified()->create();
+
+    $this
+        ->actingAs($user)
+        ->get($route($user))
+        ->assertRedirect(route('verification.notice'));
+})->with([
+    // The user's own organization, so this is the verification check
+    // answering and not the membership check behind it.
+    'dashboard' => [fn (User $user) => route('dashboard', $user->currentOrganization)],
+    'reports' => [fn (User $user) => route('reports.index', $user->currentOrganization)],
+    'onboarding' => [fn () => route('onboarding')],
+    'invitations' => [fn () => route('invitations.index')],
+    'appearance settings' => [fn () => route('appearance.edit')],
+    'organization list' => [fn () => route('organizations.index')],
+    'bare dashboard path' => [fn () => '/dashboard'],
+]);
+
+test('an unverified user can still reach the profile page to correct their address', function () {
+    $user = User::factory()->unverified()->create();
+
+    $this
+        ->actingAs($user)
+        ->get(route('profile.edit'))
+        ->assertOk();
+});
+
+test('a verified user reaches their own dashboard', function () {
+    $user = User::factory()->create();
+
+    $this
+        ->actingAs($user)
+        ->get(route('dashboard', $user->currentOrganization))
+        ->assertOk();
+});
+
+test('registering sends the verification mail and leaves the account unverified', function () {
+    Notification::fake();
+
+    $this->post(route('register.store'), [
+        'name' => 'Rita Hasler',
+        'email' => 'rita@example.com',
+        'password' => 'password-that-is-long-enough',
+        'password_confirmation' => 'password-that-is-long-enough',
+    ]);
+
+    $user = User::whereEmail('rita@example.com')->sole();
+
+    expect($user->hasVerifiedEmail())->toBeFalse();
+
+    Notification::assertSentTo(
+        $user,
+        VerifyEmail::class,
+    );
+});
+
+test('the bare dashboard path lands on the current organization', function () {
+    $user = User::factory()->create();
+
+    $this
+        ->actingAs($user)
+        ->get('/dashboard')
+        ->assertRedirect("/{$user->currentOrganization->slug}/dashboard");
+});
+
+test('the bare dashboard path sends a user with no organization to onboarding', function () {
+    $user = User::factory()->withoutOrganization()->create();
+
+    $this
+        ->actingAs($user)
+        ->get('/dashboard')
+        ->assertRedirect(route('onboarding', absolute: false));
+});