feat: using a more precise return

src/Authentication/Actions/EmailActivator.php

@@ -118,9 +118,7 @@ public function verify(IncomingRequest $request)
 
         // No match - let them try again.
         if (! $authenticator->checkAction($identity, $postedToken)) {
-            session()->setFlashdata('error', lang('Auth.invalidActivateToken'));
-
-            return $this->view(setting('Auth.views')['action_email_activate_show']);
+            return redirect()->back()->with('error', lang('Auth.invalidActivateToken'));
         }
 
         $user = $authenticator->getUser();

tests/Controllers/RegisterTest.php

@@ -1,4 +1,4 @@
 <?php
 
 declare(strict_types=1);
 
@@ -53,7 +53,7 @@
         Factories::injectMock('config', 'Validation', $config);
     }
 
     public function testRegisterActionSuccess(): void
     {
         $result = $this->withSession()->post('/register', [
             'username'         => 'JohnDoe',
@@ -91,7 +91,7 @@
         $this->assertTrue($user->active);
     }
 
     public function testRegisterActionSuccessWithNoEmailLogin(): void
     {
         /** @var Auth $config */
         $config = config('Auth');
@@ -183,7 +183,7 @@
         $this->assertCount(4, session('errors'));
     }
 
     public function testRegisterRedirectsToActionIfDefined(): void
     {
         // Ensure our action is defined
         $config                      = config('Auth');
@@ -207,7 +207,7 @@
         ]);
     }
 
     public function testRegisteredButNotActivatedAndLogin(): void
     {
         // Ensure our action is defined
         $config                      = config('Auth');
@@ -231,7 +231,7 @@
         $result->assertRedirectTo('/auth/a/show');
     }
 
     public function testRegisteredButNotActivatedAndRegisterAgain(): void
     {
         // Ensure our action is defined
         $config                      = config('Auth');
@@ -257,7 +257,7 @@
         $result->assertRedirectTo('/auth/a/show');
     }
 
     public function testRegisteredAndSessionExpiredAndLogin(): void
     {
         // Ensure our action is defined
         $config                      = config('Auth');
@@ -313,7 +313,7 @@
         $result->assertRedirectTo(config('Auth')->registerRedirect());
     }
 
     public function testRegisterActionWithBadEmailValue(): void
     {
         $result = $this->withSession()->post('/register', [
             'username'         => 'JohnDoe',
@@ -331,6 +331,35 @@
         );
     }
 
+    public function testRegisterActionRedirectsIfTokenNotMatch(): void
+    {
+        // Ensure our action is defined
+        $config                      = config('Auth');
+        $config->actions['register'] = EmailActivator::class;
+        Factories::injectMock('config', 'Auth', $config);
+
+        // Already registered but not yet activated and logged in.
+        $result = $this->post('/register', [
+            'email'            => 'foo@example.com',
+            'username'         => 'foo',
+            'password'         => 'abkdhflkjsdflkjasd;lkjf',
+            'password_confirm' => 'abkdhflkjsdflkjasd;lkjf',
+        ]);
+
+        // Should have been redirected to the action's page.
+        $result->assertRedirectTo('/auth/a/show');
+
+        // Attempted to send an invalid token.
+        $result = $this->withSession()->post('/auth/a/verify', [
+            'token' => 'invalid-token',
+        ]);
+
+        // Should have been redirected to the previous page.
+        $result->assertStatus(302);
+        $result->assertRedirect();
+        $result->assertSee(lang('Auth.invalidActivateToken'));
+    }
+
     protected function setupConfig(): void
     {
         $config             = config('Validation');