aneurinandClaude Sonnet 5
f9b65cc4a7
Backend - New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail() (the default fallback), and log-to-file transports, selected by MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token and sends the link (APP_URL/verify-email?token=...). - Migration 005: email_verifications table + users.verification_email_sent_at. - Registration now emails a verification link (best effort — a send failure doesn't fail registration). - POST /api/auth/verify-email consumes a token and returns a session, so opening the link verifies the address (or applies a pending email change) and logs the user in. Single-use; distinct 400s for invalid/used/expired. - POST /api/email/verification resends; POST /api/email/change requests a deferred change (current password required; link goes to the new address; users.email only updates when that link is opened). Both throttled to once per 60s, returning 429 + retry_after. - GET /api/me and every session payload now include pending_email. Shared SessionPayload builds the user/session JSON for all entry points. Frontend - /verify-email view: posts the token, adopts the returned session, redirects. - /profile view: shows address + status, a resend button with a live cooldown (driven by retry_after / 429), and a change-email form (new address + current password) that surfaces the pending change. - Header shows a "verify email" badge linking to the profile. Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle, and deferred change; AuthTest folded into ApiTestCase, which now routes mail to a per-test log. Suite: 32 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
106 lines
2.8 KiB
PHP
106 lines
2.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Repository;
|
|
|
|
use PDO;
|
|
|
|
/**
|
|
* Data access for the `users` table. Rows are returned as associative arrays.
|
|
*
|
|
* @phpstan-type UserRow array{id: int, email: string, password_hash: string, email_verified_at: string|null, verification_email_sent_at: string|null, created_at: string, updated_at: string}
|
|
*/
|
|
final class UserRepository
|
|
{
|
|
public function __construct(private readonly PDO $pdo)
|
|
{
|
|
}
|
|
|
|
/**
|
|
* @return UserRow|null
|
|
*/
|
|
public function findByEmail(string $email): ?array
|
|
{
|
|
$stmt = $this->pdo->prepare('SELECT * FROM users WHERE email = :email');
|
|
$stmt->execute(['email' => $email]);
|
|
|
|
$row = $stmt->fetch();
|
|
|
|
return $row === false ? null : $this->cast($row);
|
|
}
|
|
|
|
/**
|
|
* @return UserRow|null
|
|
*/
|
|
public function findById(int $id): ?array
|
|
{
|
|
$stmt = $this->pdo->prepare('SELECT * FROM users WHERE id = :id');
|
|
$stmt->execute(['id' => $id]);
|
|
|
|
$row = $stmt->fetch();
|
|
|
|
return $row === false ? null : $this->cast($row);
|
|
}
|
|
|
|
/**
|
|
* @return UserRow
|
|
*/
|
|
public function create(string $email, string $passwordHash): array
|
|
{
|
|
$stmt = $this->pdo->prepare(
|
|
'INSERT INTO users (email, password_hash) VALUES (:email, :password_hash)'
|
|
);
|
|
$stmt->execute([
|
|
'email' => $email,
|
|
'password_hash' => $passwordHash,
|
|
]);
|
|
|
|
/** @var UserRow $user */
|
|
$user = $this->findById((int) $this->pdo->lastInsertId());
|
|
|
|
return $user;
|
|
}
|
|
|
|
public function markEmailVerified(int $id): void
|
|
{
|
|
$this->pdo->prepare(
|
|
"UPDATE users SET email_verified_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
|
|
updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
|
|
WHERE id = :id"
|
|
)->execute(['id' => $id]);
|
|
}
|
|
|
|
/**
|
|
* Apply a confirmed email change: set the address and mark it verified.
|
|
*/
|
|
public function updateEmail(int $id, string $email): void
|
|
{
|
|
$this->pdo->prepare(
|
|
"UPDATE users SET email = :email,
|
|
email_verified_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
|
|
updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
|
|
WHERE id = :id"
|
|
)->execute(['email' => $email, 'id' => $id]);
|
|
}
|
|
|
|
public function markVerificationEmailSent(int $id): void
|
|
{
|
|
$this->pdo->prepare(
|
|
"UPDATE users SET verification_email_sent_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now') WHERE id = :id"
|
|
)->execute(['id' => $id]);
|
|
}
|
|
|
|
/**
|
|
* @param array<string, mixed> $row
|
|
* @return UserRow
|
|
*/
|
|
private function cast(array $row): array
|
|
{
|
|
$row['id'] = (int) $row['id'];
|
|
|
|
/** @var UserRow $row */
|
|
return $row;
|
|
}
|
|
}
|