account pages: login, order history, order details, account details, wishlist

routes/web.php

@@ -1,5 +1,9 @@
 <?php
 
+use App\Http\Controllers\Account\AccountController;
+use App\Http\Controllers\Account\EmailController;
+use App\Http\Controllers\Account\OrderController;
+use App\Http\Controllers\Auth\LoginController;
 use App\Http\Controllers\CategoryController;
 use App\Http\Controllers\ContactController;
 use App\Http\Controllers\CustomFieldUploadController;
@@ -7,6 +11,7 @@
 use App\Http\Controllers\LegalPageController;
 use App\Http\Controllers\ProductController;
 use App\Http\Controllers\SearchController;
+use App\Http\Controllers\WishlistController;
 use Illuminate\Support\Facades\Route;
 
 // Bare `/` has no {locale} segment to prefix-match against, so it's declared outside
@@ -66,4 +71,61 @@
             'legal.cookies',
         );
 
+        // Passwordless login — also registration, see LoginController. POSTs are
+        // throttled per IP on top of the controller's own per-email limits.
+        Route::middleware('guest')->group(function () {
+            Route::get('/login', [LoginController::class, 'create'])->name('login');
+            Route::post('/login', [LoginController::class, 'send'])
+                ->middleware('throttle:10,1')
+                ->name('login.send');
+            Route::get('/login/code', [LoginController::class, 'code'])->name('login.code');
+            Route::post('/login/code', [LoginController::class, 'verify'])
+                ->middleware('throttle:10,1')
+                ->name('login.verify');
+            Route::post('/login/code/resend', [LoginController::class, 'resend'])
+                ->middleware('throttle:10,1')
+                ->name('login.resend');
+        });
+
+        Route::post('/logout', [LoginController::class, 'destroy'])
+            ->middleware('auth')
+            ->name('logout');
+
+        // Heart button: works for guests too (cookie), merged into the account
+        // on login — see App\Services\Wishlist.
+        Route::get('/wishlist', [WishlistController::class, 'guest'])->name('wishlist');
+        Route::post('/wishlist/{productId}', [WishlistController::class, 'toggle'])
+            ->whereNumber('productId')
+            ->middleware('throttle:60,1')
+            ->name('wishlist.toggle');
+
+        Route::middleware('auth')->prefix('/account')->group(function () {
+            Route::get('/', [AccountController::class, 'show'])->name('account');
+            Route::put('/', [AccountController::class, 'update'])->name('account.update');
+            Route::delete('/', [AccountController::class, 'destroy'])->name('account.destroy');
+
+            Route::get('/wishlist', [WishlistController::class, 'index'])->name('account.wishlist');
+
+            Route::get('/orders', [OrderController::class, 'index'])->name('account.orders');
+            // {orderId}, not {order}: a global `order` binding would resolve any
+            // order by id, skipping CustomerAccountService's ownership check.
+            Route::get('/orders/{orderId}', [OrderController::class, 'show'])
+                ->whereNumber('orderId')
+                ->name('account.orders.show');
+
+            // Changing the login email: verified by a code sent to the new
+            // address, see EmailController.
+            Route::get('/email', [EmailController::class, 'edit'])->name('account.email.edit');
+            Route::post('/email', [EmailController::class, 'send'])
+                ->middleware('throttle:10,1')
+                ->name('account.email.send');
+            Route::get('/email/code', [EmailController::class, 'code'])->name('account.email.code');
+            Route::post('/email/code', [EmailController::class, 'verify'])
+                ->middleware('throttle:10,1')
+                ->name('account.email.verify');
+            Route::post('/email/code/resend', [EmailController::class, 'resend'])
+                ->middleware('throttle:10,1')
+                ->name('account.email.resend');
+        });
+
     });