terms acceptance during login, checkout connection to user account and login process

app/Http/Controllers/Auth/LoginController.php

@@ -25,8 +25,19 @@
  */
 class LoginController extends Controller
 {
-    public function create(string $locale): View
+    /**
+     * `?redirect=/el/checkout` (e.g. from the checkout's login tab) becomes the
+     * intended URL that verify() returns to. Only a same-site path is accepted:
+     * no scheme, no protocol-relative `//host`, so it can't redirect off-site.
+     */
+    public function create(string $locale, Request $request): View
     {
+        $redirect = (string) $request->query('redirect', '');
+
+        if (preg_match('#^/(?![/\\\\])#', $redirect)) {
+            $request->session()->put('url.intended', url($redirect));
+        }
+
         return view('auth.login');
     }
 
@@ -38,6 +49,9 @@ public function send(string $locale, Request $request, UserOtpService $otp): Red
 
         $email = Str::lower(trim($validated['email']));
 
+        $userModel = config('auth.providers.users.model');
+        $isNewAccount = ! $userModel::where('email', $email)->exists();
+
         try {
             $otp->generateAndSend($email);
         } catch (OtpThrottledException) {
@@ -46,6 +60,16 @@ public function send(string $locale, Request $request, UserOtpService $otp): Red
             ]);
         }
 
+        // generateAndSend() just created the account: record that it happened
+        // under the login page's terms notice, and which versions it showed.
+        if ($isNewAccount) {
+            $userModel::where('email', $email)->update([
+                'terms_accepted_at' => now(),
+                'terms_version' => config('legal.terms_version'),
+                'privacy_policy_version' => config('legal.privacy_policy_version'),
+            ]);
+        }
+
         $request->session()->put('login.email', $email);
 
         return redirect()->route('login.code');