From 79164345d979c85a4d6c8e6db0179d41aaa3bdc8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?V=C3=ADctor=20Falc=C3=B3n?= <victoor89@gmail.com>
Date: Fri, 13 Feb 2026 07:36:54 +0100
Subject: [PATCH] Fix: Ensure demo account is always email-verified (#118)

## Summary
- Ensure `email_verified_at` is set when the demo account is created or
already exists but is unverified
- `email_verified_at` is not in the User model's `$fillable` array, so
set it directly on the model instead of via `create()`/`update()`

## Test plan
- [x] Added test that an existing unverified demo user gets verified on
`demo:reset`
- [x] Added assertion that newly created demo user has
`email_verified_at` set
- [x] All 3 demo reset tests pass
---
 app/Console/Commands/ResetDemoAccountCommand.php   | 11 ++++++++---
 .../Console/ResetDemoAccountCommandTest.php        | 14 ++++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/app/Console/Commands/ResetDemoAccountCommand.php b/app/Console/Commands/ResetDemoAccountCommand.php
index 15dd4875..d11996c4 100644
--- a/app/Console/Commands/ResetDemoAccountCommand.php
+++ b/app/Console/Commands/ResetDemoAccountCommand.php
@@ -90,20 +90,25 @@ class ResetDemoAccountCommand extends Command
         $user = User::where('email', $email)->first();
 
         if ($user) {
-            $user->update(['encryption_salt' => $salt]);
+            $user->encryption_salt = $salt;
+            $user->email_verified_at ??= now();
+            $user->save();
 
             return $user;
         }
 
-        return User::create([
+        $user = new User([
             'email' => $email,
             'name' => 'Demo User',
             'password' => $password,
-            'email_verified_at' => now(),
             'onboarded_at' => now(),
             'encryption_salt' => $salt,
             'currency_code' => 'USD',
         ]);
+        $user->email_verified_at = now();
+        $user->save();
+
+        return $user;
     }
 
     private function deleteExistingData(User $user): void
diff --git a/tests/Feature/Console/ResetDemoAccountCommandTest.php b/tests/Feature/Console/ResetDemoAccountCommandTest.php
index cace41c4..b83d2565 100644
--- a/tests/Feature/Console/ResetDemoAccountCommandTest.php
+++ b/tests/Feature/Console/ResetDemoAccountCommandTest.php
@@ -23,7 +23,21 @@ test('demo:reset creates demo user with basic data structure', function () {
 
     // Verify core data exists
     expect($user)->not->toBeNull();
+    expect($user->email_verified_at)->not->toBeNull();
     expect($user->accounts()->count())->toBe(6);
     expect($user->transactions()->count())->toBeGreaterThan(2000);
     expect($user->categories()->count())->toBe(63);
 })->group('slow');
+
+test('demo:reset verifies existing unverified demo user', function () {
+    User::factory()->create([
+        'email' => 'demo@whisper.money',
+        'email_verified_at' => null,
+    ]);
+
+    $this->artisan('demo:reset')->assertSuccessful();
+
+    $user = User::where('email', 'demo@whisper.money')->first();
+
+    expect($user->email_verified_at)->not->toBeNull();
+})->group('slow');