feat: fix verify email

tests/Feature/EmailVerificationTest.php

@@ -41,12 +41,32 @@ it('uses the custom account verification mailable', function () {
         ->assertSeeInHtml($user->name);
 });
 
+it('generates verification links with a relative signature', function () {
+    $user = User::factory()->unverified()->create();
+
+    $verificationUrl = (new VerifyEmail)->toMail($user)->verificationUrl;
+
+    expect($verificationUrl)->toContain('/api/auth/email/verify/')
+        ->and($verificationUrl)->toContain('signature=');
+
+    $urlParts = parse_url($verificationUrl);
+    $requestUrl = ($urlParts['path'] ?? '').'?'.($urlParts['query'] ?? '');
+
+    $this
+        ->withServerVariables(['HTTP_HOST' => 'different-host.test'])
+        ->getJson($requestUrl)
+        ->assertOk()
+        ->assertJsonPath('message', __('api.auth.verified'));
+
+    expect($user->fresh()->hasVerifiedEmail())->toBeTrue();
+});
+
 it('verifies a user from a signed email link', function () {
     $user = User::factory()->unverified()->create();
     $url = URL::temporarySignedRoute('verification.verify', now()->addMinutes(60), [
         'id' => $user->getKey(),
         'hash' => sha1($user->email),
-    ]);
+    ], absolute: false);
 
     $this->getJson($url)
         ->assertOk()
@@ -61,7 +81,7 @@ it('rejects signed verification links with an invalid hash', function () {
     $url = URL::temporarySignedRoute('verification.verify', now()->addMinutes(60), [
         'id' => $user->getKey(),
         'hash' => sha1('wrong-address@example.com'),
-    ]);
+    ], absolute: false);
 
     $this->getJson($url)->assertForbidden();