create-nevela 0.7.0 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nevela",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Create a new Nevela app: a Laravel API and a Next.js dashboard from one resource description.",
   "type": "module",
   "bin": {

package/template/laravel/src/Access/SampleUsers.php

@@ -57,10 +57,8 @@ final class SampleUsers
             if (Account::findByEmail($email)) {
                 continue;
             }
+            // Their addresses are made up, and nobody has proved one: they are not "verified".
             $attributes = ['name' => $name, 'email' => $email, 'password' => $hash];
-            if (Schema::hasColumn($table, 'email_verified_at')) {
-                $attributes['email_verified_at'] = now();
-            }
             if (Schema::hasColumn($table, 'active')) {
                 $attributes['active'] = $active;
             }

package/template/laravel/src/Console/UserCommand.php

@@ -18,6 +18,7 @@ final class UserCommand extends Command
         {--email= : The address they sign in with}
         {--password= : Their password. Leave out to be asked for it without it showing}
         {--role= : Their role: ADMIN, EDITOR, USER or one you have made. The first account is an ADMIN}
+        {--verified : Mark the email as verified. Only for an address you know is theirs}
         {--sample : Create the ten sample users instead: two editors and eight users}';
 
     protected $description = 'Create a user who can sign in to the dashboard';
@@ -68,7 +69,10 @@ final class UserCommand extends Command
 
         // forceFill: this is the operator creating an account, not a form to guard.
         $attributes = ['name' => $input['name'], 'email' => $input['email'], 'password' => Hash::make($input['password'])];
-        if (Schema::hasColumn($table, 'email_verified_at')) {
+        // "Verified" means the owner has proved the address is theirs, by a link or a code
+        // sent to it. Making an account here proves nothing of the kind, so it starts
+        // unverified unless whoever runs this says they know the address is right.
+        if ($this->option('verified') && Schema::hasColumn($table, 'email_verified_at')) {
             $attributes['email_verified_at'] = now();
         }
         $user = (new $model)->forceFill($attributes);

package/template/laravel/src/Http/Access/UsersController.php

@@ -117,10 +117,8 @@ final class UsersController
         if (Schema::hasColumn($user->getTable(), 'active')) {
             $attributes['active'] = (bool) ($input['active'] ?? true);
         }
-        if (Schema::hasColumn($user->getTable(), 'email_verified_at')) {
-            // Someone allowed to create users vouches for the address.
-            $attributes['email_verified_at'] = now();
-        }
+        // The address is as typed by whoever is adding them. It becomes "verified" when its
+        // owner proves it: from their Account page, or by signing in with an emailed link or code.
         $user->forceFill($attributes)->save();
         Access::assign($user, $roles->pluck('id')->all());
 

package/template/laravel/src/Nevela.php

@@ -21,7 +21,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.7.0';
+    public const VERSION = '0.7.1';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];

package/template/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nevela-web",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "private": true,
   "type": "module",
   "scripts": {