Cleanup code and extra files

app/Exceptions/Handler.php

@@ -1,81 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Exceptions;
-
-use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Http\Request;
-use Illuminate\Session\TokenMismatchException;
-use Spatie\Permission\Exceptions\UnauthorizedException;
-use Symfony\Component\HttpFoundation\Response;
-use Throwable;
-
-class Handler extends ExceptionHandler
-{
-    /**
-     * A list of the exception types that are not reported.
-     *
-     * @var array<int, class-string<Throwable>>
-     */
-    protected $dontReport = [
-        //
-    ];
-
-    /**
-     * A list of the inputs that are never flashed for validation exceptions.
-     *
-     * @var array<int, string>
-     */
-    protected $dontFlash = [
-        'password',
-        'password_confirmation',
-    ];
-
-    /**
-     * Catch errors with Sentry.
-     */
-    public function register(): void
-    {
-        $this->reportable(function (Throwable $e) {
-            if (app()->bound('sentry')) {
-                app('sentry')->captureException($e);
-            }
-        });
-    }
-
-    /**
-     * Report or log an exception.
-     *
-     *
-     * @return void
-     *
-     * @throws Throwable
-     */
-    public function report(Throwable $exception)
-    {
-        parent::report($exception);
-    }
-
-    /**
-     * @param  Request  $request
-     * @return RedirectResponse|Response
-     *
-     * @throws Throwable
-     */
-    public function render($request, Throwable $exception)
-    {
-        if ($exception instanceof UnauthorizedException) {
-            abort(401);
-        }
-        if ($exception instanceof TokenMismatchException) {
-            return redirect()
-                ->back()
-                ->withInput($request->except(['password', 'password_confirmation']))
-                ->with('error', 'The form has expired due to inactivity. Please refresh the page and try again');
-        }
-
-        return parent::render($request, $exception);
-    }
-}

app/Http/Middleware/CheckForMaintenanceMode.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode as Middleware;
-
-class CheckForMaintenanceMode extends Middleware
-{
-    /**
-     * The URIs that should be reachable while maintenance mode is enabled.
-     *
-     * @var array<int, string>
-     */
-    protected $except = [
-        //
-    ];
-}

app/Http/Middleware/EnsureAuthenticatedUsersAreVerified.php

@@ -1,37 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Closure;
-use Illuminate\Contracts\Auth\MustVerifyEmail;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-class EnsureAuthenticatedUsersAreVerified
-{
-    /**
-     * Handle an incoming request.
-     *
-     * @param  Closure(Request): Response  $next
-     */
-    public function handle(Request $request, Closure $next, ?string $redirectToRoute = null): Response
-    {
-        $user = $request->user();
-
-        if ($user === null) {
-            return $next($request);
-        }
-
-        if ($user instanceof MustVerifyEmail && ! $user->hasVerifiedEmail()) {
-            if ($request->expectsJson()) {
-                abort(403, 'Your email address is not verified.');
-            }
-
-            return redirect()->route($redirectToRoute ?? 'verification.notice');
-        }
-
-        return $next($request);
-    }
-}

app/Http/Middleware/SetUserTimezone.php

@@ -1,28 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-class SetUserTimezone
-{
-    /**
-     * Handle an incoming request.
-     *
-     * Note: We do NOT set the global timezone here because it would interfere
-     * with database operations and helper functions. Instead, the timezone
-     * conversion happens in the userDate() and userDateDiffForHumans() helpers.
-     *
-     * @param  Closure(Request): (Response)  $next
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        // Timezone conversion is handled by helper functions, not middleware
-        // This middleware is kept for future enhancements if needed
-        return $next($request);
-    }
-}

bootstrap/app.php

@@ -5,15 +5,14 @@ use App\Http\Middleware\ClearanceMiddleware;
 use App\Http\Middleware\ContentSecurityPolicy;
 use App\Http\Middleware\DegradeWhenRedisUnreachable;
 use App\Http\Middleware\EnforceSessionToken;
-use App\Http\Middleware\EnsureAuthenticatedUsersAreVerified;
 use App\Http\Middleware\ForceJsonOnAPI;
 use App\Http\Middleware\Google2FAMiddleware;
 use App\Http\Middleware\MeasureApiPerformance;
 use App\Http\Middleware\NoCacheForAuthenticatedUsers;
-use App\Http\Middleware\SetUserTimezone;
 use App\Http\Middleware\ThrottleApiRequestsByToken;
 use App\Http\Middleware\TrustedDevice2FAMiddleware;
 use App\Http\Middleware\TrustProxies as AppTrustProxies;
+use Illuminate\Auth\Middleware\EnsureEmailIsVerified;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
@@ -74,7 +73,6 @@ return Application::configure(basePath: dirname(__DIR__))
             EnforceSessionToken::class,
             TrustedDevice2FAMiddleware::class, // Add our new trusted device middleware
             ContentSecurityPolicy::class, // Add CSP middleware for security
-            SetUserTimezone::class, // Set user timezone
             NoCacheForAuthenticatedUsers::class, // Prevent Cloudflare/CDN caching of authenticated pages
         ]);
 
@@ -85,7 +83,7 @@ return Application::configure(basePath: dirname(__DIR__))
             'bindings' => SubstituteBindings::class,
             'clearance' => ClearanceMiddleware::class,
             'apiRateLimit' => ThrottleApiRequestsByToken::class,
-            'isVerified' => EnsureAuthenticatedUsersAreVerified::class,
+            'isVerified' => EnsureEmailIsVerified::class,
             'permission' => PermissionMiddleware::class,
             'role' => RoleMiddleware::class,
             'role_or_permission' => RoleOrPermissionMiddleware::class,

tests/Feature/AuthRedirectMiddlewareTest.php

@@ -5,7 +5,9 @@ declare(strict_types=1);
 namespace Tests\Feature;
 
 use Illuminate\Auth\GenericUser;
+use Illuminate\Auth\Middleware\EnsureEmailIsVerified;
 use Illuminate\Contracts\Console\Kernel;
+use Illuminate\Routing\Router;
 use Illuminate\Support\Facades\Cache;
 use PDO;
 use Tests\TestCase;
@@ -101,6 +103,13 @@ class AuthRedirectMiddlewareTest extends TestCase
             ->assertRedirect('/');
     }
 
+    public function test_is_verified_alias_uses_laravels_email_verification_middleware(): void
+    {
+        $middlewareAliases = app(Router::class)->getMiddleware();
+
+        $this->assertSame(EnsureEmailIsVerified::class, $middlewareAliases['isVerified'] ?? null);
+    }
+
     private function setEnvironmentValue(string $key, ?string $value): void
     {
         if ($value === null) {

tests/Unit/UserViewRequestInputTest.php

@@ -4,8 +4,12 @@ namespace Tests\Unit;
 
 use App\Http\Controllers\BasePageController;
 use App\Http\Controllers\SearchController;
+use Illuminate\Container\Container;
+use Illuminate\Contracts\Routing\UrlGenerator as UrlGeneratorContract;
 use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
 use Illuminate\Http\Request;
+use Illuminate\Routing\RouteCollection;
+use Illuminate\Routing\UrlGenerator;
 use PHPUnit\Framework\TestCase;
 use ReflectionClass;
 use Symfony\Component\HttpFoundation\Response;
@@ -71,6 +75,46 @@ class UserViewRequestInputTest extends TestCase
         $this->assertSame([-1], $method->invoke($controller, Request::create('/search', 'GET', ['searchadvcat' => ''])));
     }
 
+    public function test_local_return_url_accepts_local_targets_and_rejects_external_urls(): void
+    {
+        $originalContainer = Container::getInstance();
+        $container = new Container;
+        $container->instance(
+            UrlGeneratorContract::class,
+            new UrlGenerator(new RouteCollection, Request::create('https://nntmux.test')),
+        );
+        Container::setInstance($container);
+
+        try {
+            $controller = $this->controller();
+
+            $this->assertSame(
+                'https://nntmux.test/mymovies',
+                $controller->returnUrl(Request::create('https://nntmux.test/mymovies'), '/mymovies'),
+            );
+            $this->assertSame(
+                'https://nntmux.test/browse',
+                $controller->returnUrl(Request::create('https://nntmux.test/mymovies', 'GET', ['from' => '/browse']), '/mymovies'),
+            );
+            $this->assertSame(
+                'https://nntmux.test/browse?view=covers',
+                $controller->returnUrl(
+                    Request::create('https://nntmux.test/mymovies', 'GET', ['from' => 'https://nntmux.test/browse?view=covers']),
+                    '/mymovies',
+                ),
+            );
+            $this->assertSame(
+                'https://nntmux.test/mymovies',
+                $controller->returnUrl(
+                    Request::create('https://nntmux.test/mymovies', 'GET', ['from' => 'https://external.example/browse']),
+                    '/mymovies',
+                ),
+            );
+        } finally {
+            Container::setInstance($originalContainer);
+        }
+    }
+
     private function controller(): object
     {
         return new class extends BasePageController
@@ -112,6 +156,11 @@ class UserViewRequestInputTest extends TestCase
             {
                 return $this->paginationOffset($page, $perPage);
             }
+
+            public function returnUrl(Request $request, string $fallback): string
+            {
+                return $this->localReturnUrl($request, $fallback);
+            }
         };
     }
 }