ensure admin has verified email address

sourcecode/hub/app/Http/Controllers/Admin/AdminsController.php

@@ -27,7 +27,9 @@ public function add(GrantAdminRequest $request): RedirectResponse
     {
         $email = $request->validated('email');
 
-        $user = User::where('email', $email)->firstOrFail();
+        $user = User::where('email', $email)
+            ->where('email_verified', true)
+            ->firstOrFail();
         $user->admin = true;
         $user->save();
 

sourcecode/hub/app/Http/Requests/GrantAdminRequest.php

@@ -4,19 +4,18 @@
 
 namespace App\Http\Requests;
 
-use App\Models\User;
+use App\Rules\VerifiedUserEmail;
 use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rule;
 
 class GrantAdminRequest extends FormRequest
 {
     /**
      * @return array<mixed>
      */
-    public function rules(): array
+    public function rules(VerifiedUserEmail $verifiedUserEmail): array
     {
         return [
-            'email' => ['required', 'email', Rule::exists(User::class, 'email')],
+            'email' => ['required', 'email', $verifiedUserEmail],
         ];
     }
 }

sourcecode/hub/app/Rules/VerifiedUserEmail.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Rules;
+
+use App\Models\User;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+/**
+ * Ensure an email belongs to a user with a verified email address.
+ */
+class VerifiedUserEmail implements ValidationRule
+{
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        $user = User::where('email', $value)->first();
+
+        if ($user === null) {
+            $fail('No user with that email address');
+
+            return;
+        }
+
+        if (!$user->email_verified) {
+            $fail('User does not have a verified email address');
+        }
+    }
+}

sourcecode/hub/tests/Browser/AdminTest.php

@@ -345,6 +345,39 @@ public function testAddsAdmins(): void
         );
     }
 
+    public function testEmailOfAddedAdminMustBelongToExistingUser(): void
+    {
+        User::factory()->withEmail('[email protected]')->admin()->create();
+
+        $this->browse(
+            fn(Browser $browser) => $browser
+                ->loginAs('[email protected]')
+                ->assertAuthenticated()
+                ->visit('/admin/admins')
+                ->type('email', '[email protected]')
+                ->press('Add')
+                ->assertDontSeeIn('main table', '[email protected]')
+                ->assertSeeIn('.invalid-feedback', 'No user with that email address')
+        );
+    }
+
+    public function testEmailOfAddedAdminMustBeVerified(): void
+    {
+        User::factory()->withEmail('[email protected]')->admin()->create();
+        User::factory()->withEmail('[email protected]', verified: false)->create();
+
+        $this->browse(
+            fn(Browser $browser) => $browser
+                ->loginAs('[email protected]')
+                ->assertAuthenticated()
+                ->visit('/admin/admins')
+                ->type('email', '[email protected]')
+                ->press('Add')
+                ->assertDontSeeIn('main table', '[email protected]')
+                ->assertSeeIn('.invalid-feedback', 'User does not have a verified email address')
+        );
+    }
+
     public function testRemovesAdmins(): void
     {
         User::factory()->withEmail('[email protected]')->admin()->create();