From 12b4633e0d7c71120618d272e5ec821286cc704f Mon Sep 17 00:00:00 2001
From: Gregor Vostrak <gregor@solidtime.io>
Date: Tue, 26 May 2026 14:03:30 +0200
Subject: [PATCH] update email address change info to use session based banners

---
 app/Http/Controllers/Web/UserController.php | 14 +++----
 tests/Feature/ProfileInformationTest.php    | 41 +++++++++++++++++++--
 2 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/app/Http/Controllers/Web/UserController.php b/app/Http/Controllers/Web/UserController.php
index e2e4750a..0b400985 100644
--- a/app/Http/Controllers/Web/UserController.php
+++ b/app/Http/Controllers/Web/UserController.php
@@ -36,10 +36,9 @@ class UserController extends Controller
             ->exists();
 
         if ($emailAlreadyInUse) {
-            return redirect(route('dashboard', [
-                'bannerStyle' => 'danger',
-                'bannerText' => __('The email address is already in use.'),
-            ]));
+            return redirect(route('dashboard'))
+                ->with('bannerStyle', 'danger')
+                ->with('bannerText', __('The email address is already in use.'));
         }
 
         $user->email = $email;
@@ -47,9 +46,8 @@ class UserController extends Controller
         $user->email_verified_at = Carbon::now();
         $user->save();
 
-        return redirect(route('dashboard', [
-            'bannerStyle' => 'success',
-            'bannerText' => __('Your email address has been updated successfully.'),
-        ]));
+        return redirect(route('dashboard'))
+            ->with('bannerStyle', 'success')
+            ->with('bannerText', __('Your email address has been updated successfully.'));
     }
 }
diff --git a/tests/Feature/ProfileInformationTest.php b/tests/Feature/ProfileInformationTest.php
index 5ce277f8..31ed18ca 100644
--- a/tests/Feature/ProfileInformationTest.php
+++ b/tests/Feature/ProfileInformationTest.php
@@ -108,10 +108,9 @@ class ProfileInformationTest extends TestCase
         $response = $this->get($verificationUrl);
 
         // Assert
-        $response->assertRedirect(route('dashboard', [
-            'bannerStyle' => 'success',
-            'bannerText' => 'Your email address has been updated successfully.',
-        ]));
+        $response->assertRedirect(route('dashboard'));
+        $response->assertSessionHas('bannerStyle', 'success');
+        $response->assertSessionHas('bannerText', 'Your email address has been updated successfully.');
         $user = $user->fresh();
         $this->assertEquals('new.email@example.com', $user->email);
         $this->assertNull($user->pending_email);
@@ -144,6 +143,40 @@ class ProfileInformationTest extends TestCase
         $this->assertEquals('new.email@example.com', $user->pending_email);
     }
 
+    public function test_pending_email_verification_redirects_with_danger_banner_when_email_already_in_use(): void
+    {
+        // Arrange
+        User::factory()->create([
+            'email' => 'taken@example.com',
+            'is_placeholder' => false,
+        ]);
+        $user = User::factory()->create([
+            'email' => 'current@example.com',
+            'pending_email' => 'taken@example.com',
+        ]);
+        $this->actingAs($user);
+        $verificationUrl = URL::temporarySignedRoute(
+            'users.verify-email-change',
+            now()->addMinutes(60),
+            [
+                'user' => $user->getKey(),
+                'email' => 'taken@example.com',
+            ],
+            false
+        );
+
+        // Act
+        $response = $this->get($verificationUrl);
+
+        // Assert
+        $response->assertRedirect(route('dashboard'));
+        $response->assertSessionHas('bannerStyle', 'danger');
+        $response->assertSessionHas('bannerText', 'The email address is already in use.');
+        $user = $user->fresh();
+        $this->assertEquals('current@example.com', $user->email);
+        $this->assertEquals('taken@example.com', $user->pending_email);
+    }
+
     public function test_stale_pending_email_verification_link_is_rejected(): void
     {
         // Arrange