3dealer/app/Http/Controllers/Account/EmailController.php

<?php

namespace App\Http\Controllers\Account;

use App\Http\Controllers\Controller;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Illuminate\Validation\Rule;
use Illuminate\View\View;
use Modules\Core\Auth\Exceptions\OtpThrottledException;
use Modules\Core\Customer\Exceptions\EmailAlreadyTakenException;
use Modules\Core\Customer\Exceptions\InvalidEmailChangeCodeException;
use Modules\Core\Customer\Services\CustomerEmailChangeService;

/**
 * Changing the login email — a thin wrapper over boboko-core's
 * Customer\Services\CustomerEmailChangeService, which owns the actual
 * request/confirm mechanics, throttling, pending-change storage, and
 * mailables. This controller's own job is just the storefront's session-
 * scoped "which email did I just ask to switch to" UI state (so the
 * .code/.resend pages know which address to show/resend to) and
 * translating the service's exceptions into the flash-message flow the
 * views expect.
 */
class EmailController extends Controller
{
    private const SESSION_KEY = 'pending_email_change';

    public function edit(string $locale, Request $request): View
    {
        return view('account.email', ['user' => $request->user()]);
    }

    public function send(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
    {
        $user = $request->user();

        $request->merge(['email' => Str::lower(trim((string) $request->input('email')))]);

        $validated = $request->validate([
            'email' => [
                'required',
                'email',
                'max:255',
                Rule::notIn([$user->email]),
            ],
        ], [
            'email.not_in' => __('storefront.account.email_same'),
        ]);

        try {
            $emailChange->request($user, $validated['email']);
        } catch (EmailAlreadyTakenException) {
            return back()->withInput()->withErrors(['email' => __('storefront.account.email_taken')]);
        } catch (OtpThrottledException) {
            return back()->withInput()->withErrors(['email' => __('storefront.auth.too_many_codes')]);
        }

        $request->session()->put(self::SESSION_KEY, $validated['email']);

        return redirect()->route('account.email.code');
    }

    public function code(string $locale, Request $request): View|RedirectResponse
    {
        $pendingEmail = $request->session()->get(self::SESSION_KEY);

        if (! $pendingEmail) {
            return redirect()->route('account.email.edit');
        }

        return view('account.email-code', ['email' => $pendingEmail]);
    }

    public function resend(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
    {
        $pendingEmail = $request->session()->get(self::SESSION_KEY);

        if (! $pendingEmail) {
            return redirect()->route('account.email.edit');
        }

        try {
            $emailChange->request($request->user(), $pendingEmail);
        } catch (EmailAlreadyTakenException) {
            $request->session()->forget(self::SESSION_KEY);

            return redirect()->route('account.email.edit')
                ->withErrors(['email' => __('storefront.account.email_taken')]);
        } catch (OtpThrottledException) {
            return back()->withErrors(['code' => __('storefront.auth.too_many_codes')]);
        }

        return back()->with('status', __('storefront.auth.code_resent'));
    }

    public function verify(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
    {
        $pendingEmail = $request->session()->get(self::SESSION_KEY);

        if (! $pendingEmail) {
            return redirect()->route('account.email.edit');
        }

        $validated = $request->validate(['code' => ['required', 'digits:6']]);

        try {
            $emailChange->confirm($request->user(), $validated['code']);
        } catch (EmailAlreadyTakenException) {
            $request->session()->forget(self::SESSION_KEY);

            return redirect()->route('account.email.edit')
                ->withErrors(['email' => __('storefront.account.email_taken')]);
        } catch (InvalidEmailChangeCodeException) {
            return back()->withErrors(['code' => __('storefront.auth.invalid_code')]);
        }

        $request->session()->forget(self::SESSION_KEY);

        return redirect()->route('account')->with('status', __('storefront.account.email_changed'));
    }
}