Store session verification request data in redis

app/Exceptions/Handler.php

···
 
 namespace App\Exceptions;
 
-use App\Libraries\UserVerification;
+use App\Libraries\SessionVerification;
 use Auth;
 use Illuminate\Auth\Access\AuthorizationException as LaravelAuthorizationException;
 use Illuminate\Auth\AuthenticationException;
···
         }
 
         if ($e instanceof VerificationRequiredException) {
-            return $this->unverified();
+            return SessionVerification\Controller::initiate();
         }
 
         if ($e instanceof AuthenticationException) {
···
         }
 
         return ext_view('users.login', null, null, 401);
-    }
-
-    protected function unverified()
-    {
-        return UserVerification::fromCurrentRequest()->initiate();
     }
 
     private function reportWithSentry($e)

app/Http/Controllers/AccountController.php

···
 use App\Exceptions\ImageProcessorException;
 use App\Exceptions\ModelNotSavedException;
 use App\Libraries\Session\Store as SessionStore;
+use App\Libraries\SessionVerification;
 use App\Libraries\User\AvatarHelper;
 use App\Libraries\User\CountryChange;
 use App\Libraries\User\CountryChangeTarget;
-use App\Libraries\UserVerification;
-use App\Libraries\UserVerificationState;
 use App\Mail\UserEmailUpdated;
 use App\Mail\UserPasswordUpdated;
 use App\Models\GithubUser;
···
 
     public function verify()
     {
-        return UserVerification::fromCurrentRequest()->verify();
+        return SessionVerification\Controller::verify();
     }
 
     public function verifyLink()
     {
-        $state = UserVerificationState::fromVerifyLink(get_string(request('key')) ?? '');
-
-        if ($state === null) {
-            UserVerification::logAttempt('link', 'fail', 'incorrect_key');
-
-            return ext_view('accounts.verification_invalid', null, null, 404);
-        }
-
-        UserVerification::logAttempt('link', 'success');
-        $state->markVerified();
-
-        return ext_view('accounts.verification_completed');
+        return SessionVerification\Controller::verifyLink();
     }
 
     public function reissueCode()
     {
-        return UserVerification::fromCurrentRequest()->reissue();
+        return SessionVerification\Controller::reissue();
     }
 }

app/Http/Controllers/Controller.php

···
 use App;
 use App\Http\Middleware\VerifyUserAlways;
 use App\Libraries\LocaleMeta;
-use App\Libraries\UserVerificationState;
 use App\Models\Log;
 use Auth;
 use Carbon\Carbon;
···
     {
         cleanup_cookies();
 
-        $session = session();
+        $session = \Session::instance();
         $session->flush();
         $session->regenerateToken();
         $session->put('requires_verification', VerifyUserAlways::isRequired($user));
         Auth::login($user, $remember);
         if (config('osu.user.bypass_verification')) {
-            UserVerificationState::fromCurrentRequest()->markVerified();
+            $session->markVerified();
         }
         $session->migrate(true);
     }

app/Http/Middleware/SetSessionVerification.php

···
 namespace App\Http\Middleware;
 
 use App\Events\UserSessionEvent;
-use App\Libraries\UserVerificationState;
 use Closure;
 use Illuminate\Http\Request;
 
···
 {
     public function handle(Request $request, Closure $next)
     {
-        $user = auth()->user();
+        $user = \Auth::user();
         if ($user !== null) {
-            $isVerified = UserVerificationState::fromCurrentRequest()->isDone();
+            $session = \Session::instance();
+            $isVerified = $session->isVerified();
 
             if ($isVerified) {
                 $user->markSessionVerified();
             } else {
                 $isRequired = VerifyUserAlways::isRequired($user);
-                $session = session();
                 if ($session->get('requires_verification') !== $isRequired) {
                     $session->put('requires_verification', $isRequired);
                     $session->save();

app/Http/Middleware/VerifyUser.php

···
 
 namespace App\Http\Middleware;
 
-use App\Libraries\UserVerification;
+use App\Libraries\SessionVerification;
 use Closure;
 use Illuminate\Contracts\Auth\Guard as AuthGuard;
 use Illuminate\Http\Request;
···
             && !$this->alwaysSkipVerification()
             && $this->requiresVerification($request)
         ) {
-            return UserVerification::fromCurrentRequest()->initiate();
+            return SessionVerification\Controller::initiate();
         }
 
         return $next($request);

app/Interfaces/SessionVerificationInterface.php

···
+<?php
+
+// Copyright (c) ppy Pty Ltd <[e-mail]>. Licensed under the GNU Affero General Public License v3.0.
+// See the LICENCE file in the repository root for full licence text.
+
+declare(strict_types=1);
+
+namespace App\Interfaces;
+
+interface SessionVerificationInterface
+{
+    public static function findForVerification(string $id): ?static;
+
+    public function getKey();
+    public function isVerified(): bool;
+    public function markVerified(): void;
+}

app/Libraries/Session/Store.php

···
 namespace App\Libraries\Session;
 
 use App\Events\UserSessionEvent;
+use App\Interfaces\SessionVerificationInterface;
 use Illuminate\Redis\Connections\PhpRedisConnection;
+use Illuminate\Session\Store as BaseStore;
 use Illuminate\Support\Arr;
 use Jenssegers\Agent\Agent;
 
-class Store extends \Illuminate\Session\Store
+class Store extends BaseStore implements SessionVerificationInterface
 {
     private const PREFIX = 'sessions:';
 
···
             $redis->srem(self::listKey($userId), ...$ids, ...$idsForEvent);
             UserSessionEvent::newLogout($userId, $idsForEvent)->broadcast();
         }
+    }
+
+    public static function findForVerification(string $id): static
+    {
+        return static::findOrNew($id);
     }
 
     public static function findOrNew(?string $id = null): static
···
         static::batchDelete($this->userId(), [$this->getId()]);
     }
 
+    public function getKey(): string
+    {
+        return $this->getId();
+    }
+
     public function getKeyForEvent(): string
     {
         return self::keyForEvent($this->getId());
···
     {
         // Overridden to allow prefixed id
         return is_string($id);
+    }
+
+    public function isVerified(): bool
+    {
+        return $this->attributes['verified'] ?? false;
+    }
+
+    public function markVerified(): void
+    {
+        $this->attributes['verified'] = true;
+        $this->save();
     }
 
     /**

app/Libraries/SessionVerification/Controller.php

···
+<?php
+
+// Copyright (c) ppy Pty Ltd <[e-mail]>. Licensed under the GNU Affero General Public License v3.0.
+// See the LICENCE file in the repository root for full licence text.
+
+declare(strict_types=1);
+
+namespace App\Libraries\SessionVerification;
+
+use App\Exceptions\UserVerificationException;
+use App\Models\LoginAttempt;
+
+class Controller
+{
+    public static function initiate()
+    {
+        static $statusCode = 401;
+
+        app('route-section')->setError("{$statusCode}-verification");
+
+        $user = \Auth::user();
+        $email = $user->user_email;
+
+        $session = \Session::instance();
+        if (State::fromSession($session) === null) {
+            Helper::logAttempt('input', 'new');
+
+            Helper::issue($session, $user);
+        }
+
+        if (\Request::ajax()) {
+            return response([
+                'authentication' => 'verify',
+                'box' => view(
+                    'users._verify_box',
+                    compact('email')
+                )->render(),
+            ], $statusCode);
+        }
+
+        return ext_view('users.verify', compact('email'), null, $statusCode);
+    }
+
+    public static function reissue()
+    {
+        $session = \Session::instance();
+        if ($session->isVerified()) {
+            return response(null, 204);
+        }
+
+        Helper::issue($session, \Auth::user());
+
+        return response(['message' => osu_trans('user_verification.errors.reissued')], 200);
+    }
+
+    public static function verify()
+    {
+        $key = strtr(get_string(\Request::input('verification_key')) ?? '', [' ' => '']);
+        $user = \Auth::user();
+        $session = \Session::instance();
+        $state = State::fromSession($session);
+
+        try {
+            if ($state === null) {
+                throw new UserVerificationException('expired', true);
+            }
+            $state->verify($key);
+        } catch (UserVerificationException $e) {
+            Helper::logAttempt('input', 'fail', $e->reasonKey());
+
+            if ($e->reasonKey() === 'incorrect_key') {
+                LoginAttempt::logAttempt(\Request::getClientIp(), $user, 'verify-mismatch', $key);
+            }
+
+            if ($e->shouldReissue()) {
+                Helper::issue($session, $user);
+            }
+
+            return error_popup($e->getMessage());
+        }
+
+        Helper::logAttempt('input', 'success');
+        Helper::markVerified($session);
+
+        return response(null, 204);
+    }
+
+    public static function verifyLink()
+    {
+        $state = State::fromVerifyLink(get_string(\Request::input('key')) ?? '');
+
+        if ($state === null) {
+            Helper::logAttempt('link', 'fail', 'incorrect_key');
+
+            return ext_view('accounts.verification_invalid', null, null, 404);
+        }
+
+        $session = $state->findSession();
+        // Otherwise pretend everything is okay if session is missing
+        if ($session !== null) {
+            Helper::logAttempt('link', 'success');
+            Helper::markVerified($session);
+        }
+
+        return ext_view('accounts.verification_completed');
+    }
+}

app/Libraries/SessionVerification/Helper.php

···
+<?php
+
+// Copyright (c) ppy Pty Ltd <[e-mail]>. Licensed under the GNU Affero General Public License v3.0.
+// See the LICENCE file in the repository root for full licence text.
+
+declare(strict_types=1);
+
+namespace App\Libraries\SessionVerification;
+
+use App\Events\UserSessionEvent;
+use App\Interfaces\SessionVerificationInterface;
+use App\Mail\UserVerification as UserVerificationMail;
+use App\Models\LoginAttempt;
+use App\Models\User;
+
+class Helper
+{
+    public static function issue(SessionVerificationInterface $session, User $user): void
+    {
+        if (!is_valid_email_format($user->user_email)) {
+            return;
+        }
+
+        $state = State::create($session);
+        $keys = [
+            'link' => $state->linkKey,
+            'main' => $state->key,
+        ];
+
+        $request = \Request::instance();
+        LoginAttempt::logAttempt($request->getClientIp(), $user, 'verify');
+
+        $requestCountry = app('countries')->byCode(request_country($request) ?? '')?->name;
+
+        \Mail::to($user)
+            ->queue(new UserVerificationMail(
+                compact('keys', 'user', 'requestCountry')
+            ));
+    }
+
+    public static function logAttempt(string $source, string $type, string $reason = null): void
+    {
+        \Datadog::increment(
+            \Config::get('datadog-helper.prefix_web').'.verification.attempts',
+            1,
+            compact('reason', 'source', 'type')
+        );
+    }
+
+    public static function markVerified(SessionVerificationInterface $session)
+    {
+        $session->markVerified();
+        UserSessionEvent::newVerified($session->userId(), $session->getKeyForEvent())->broadcast();
+    }
+}

app/Libraries/SessionVerification/State.php

···
+<?php
+
+// Copyright (c) ppy Pty Ltd <[e-mail]>. Licensed under the GNU Affero General Public License v3.0.
+// See the LICENCE file in the repository root for full licence text.
+
+declare(strict_types=1);
+
+namespace App\Libraries\SessionVerification;
+
+use App\Exceptions\UserVerificationException;
+use App\Interfaces\SessionVerificationInterface;
+use App\Libraries\SignedRandomString;
+use Carbon\CarbonImmutable;
+
+class State
+{
+    private const KEY_VALID_DURATION = 5 * 3600;
+
+    public readonly \DateTimeInterface $expiresAt;
+    public readonly string $key;
+    public readonly string $linkKey;
+    public int $tries = 0;
+
+    private function __construct(
+        private readonly string $sessionClass,
+        private readonly string $sessionId,
+    ) {
+        // 1 byte = 8 bits = 2^8 = 16^2 = 2 hex characters
+        $this->key = bin2hex(random_bytes(\Config::get('osu.user.verification_key_length_hex') / 2));
+        $this->linkKey = SignedRandomString::create(32);
+        $this->expiresAt = CarbonImmutable::now()->addSeconds(static::KEY_VALID_DURATION);
+    }
+
+    public static function create(SessionVerificationInterface $session): static
+    {
+        $state = new static($session::class, $session->getKey());
+        $state->save(true);
+
+        return $state;
+    }
+
+    public static function fromSession(SessionVerificationInterface $session): ?static
+    {
+        return \Cache::get(static::cacheKey($session::class, $session->getKey()));
+    }
+
+    public static function fromVerifyLink(string $linkKey): ?static
+    {
+        if (!SignedRandomString::isValid($linkKey)) {
+            return null;
+        }
+
+        $cacheKey = \Cache::get(static::cacheLinkKey($linkKey));
+
+        return $cacheKey === null ? null : \Cache::get($cacheKey);
+    }
+
+    private static function cacheKey(string $class, string $id): string
+    {
+        return "session_verification:{$class}:{$id}";
+    }
+
+    private static function cacheLinkKey(string $linkKey): string
+    {
+        return "session_verification_link:{$linkKey}";
+    }
+
+    public function delete(): void
+    {
+        \Cache::delete(static::cacheKey($this->sessionClass, $this->sessionId));
+        \Cache::delete(static::cacheLinkKey($state->linkKey));
+    }
+
+    public function findSession(): ?SessionVerificationInterface
+    {
+        return $this->sessionClass::findForVerification($this->sessionId);
+    }
+
+    public function verify(string $inputKey): void
+    {
+        $this->tries++;
+
+        if ($this->expiresAt->isPast()) {
+            throw new UserVerificationException('expired', true);
+        }
+
+        if (!hash_equals($this->key, $inputKey)) {
+            if ($this->tries >= \Config::get('osu.user.verification_key_tries_limit')) {
+                throw new UserVerificationException('retries_exceeded', true);
+            } else {
+                $this->save(false);
+                throw new UserVerificationException('incorrect_key', false);
+            }
+        }
+    }
+
+    private function save(bool $saveLinkKey): void
+    {
+        $cacheKey = static::cacheKey($this->sessionClass, $this->sessionId);
+        \Cache::put($cacheKey, $this, $this->expiresAt);
+        if ($saveLinkKey) {
+            \Cache::put(static::cacheLinkKey($this->linkKey), $cacheKey, $this->expiresAt);
+        }
+    }
+}

app/Libraries/UserVerification.php

···
-<?php
-
-// Copyright (c) ppy Pty Ltd <[e-mail]>. Licensed under the GNU Affero General Public License v3.0.
-// See the LICENCE file in the repository root for full licence text.
-
-namespace App\Libraries;
-
-use App\Exceptions\UserVerificationException;
-use App\Mail\UserVerification as UserVerificationMail;
-use App\Models\Country;
-use App\Models\LoginAttempt;
-use Datadog;
-use Mail;
-
-class UserVerification
-{
-    private $request;
-    private $state;
-    private $user;
-
-    public static function fromCurrentRequest()
-    {
-        $request = request();
-        $attributes = $request->attributes;
-        $verification = $attributes->get('user_verification');
-
-        if ($verification === null) {
-            $verification = new static(
-                auth()->user(),
-                $request,
-                UserVerificationState::fromCurrentRequest()
-            );
-            $attributes->set('user_verification', $verification);
-        }
-
-        return $verification;
-    }
-
-    public static function logAttempt(string $source, string $type, string $reason = null): void
-    {
-        Datadog::increment(
-            config('datadog-helper.prefix_web').'.verification.attempts',
-            1,
-            compact('reason', 'source', 'type')
-        );
-    }
-
-    private function __construct($user, $request, $state)
-    {
-        $this->user = $user;
-        $this->request = $request;
-        $this->state = $state;
-    }
-
-    public function initiate()
-    {
-        $statusCode = 401;
-        app('route-section')->setError("{$statusCode}-verification");
-
-        // Workaround race condition causing $this->issue() to be called in parallel.
-        // Mainly observed when logging in as privileged user.
-        if ($this->request->ajax()) {
-            $routeData = app('route-section')->getOriginal();
-            if ($routeData['controller'] === 'notifications_controller' && $routeData['action'] === 'index') {
-                return response(['error' => 'verification'], $statusCode);
-            }
-        }
-
-        $email = $this->user->user_email;
-
-        if (!$this->state->issued()) {
-            static::logAttempt('input', 'new');
-
-            $this->issue();
-        }
-
-        if ($this->request->ajax()) {
-            return response([
-                'authentication' => 'verify',
-                'box' => view(
-                    'users._verify_box',
-                    compact('email')
-                )->render(),
-            ], $statusCode);
-        } else {
-            return ext_view('users.verify', compact('email'), null, $statusCode);
-        }
-    }
-
-    public function isDone()
-    {
-        return $this->state->isDone();
-    }
-
-    public function issue()
-    {
-        $user = $this->user;
-
-        if (!is_valid_email_format($user->user_email)) {
-            return;
-        }
-
-        $keys = $this->state->issue();
-
-        LoginAttempt::logAttempt($this->request->getClientIp(), $this->user, 'verify');
-
-        $requestCountry = Country
-            ::where('acronym', request_country($this->request))
-            ->pluck('name')
-            ->first();
-
-        Mail::to($user)
-            ->queue(new UserVerificationMail(
-                compact('keys', 'user', 'requestCountry')
-            ));
-    }
-
-    public function markVerified()
-    {
-        $this->state->markVerified();
-    }
-
-    public function markVerifiedAndRespond()
-    {
-        $this->markVerified();
-
-        return response([], 200);
-    }
-
-    public function reissue()
-    {
-        if ($this->state->isDone()) {
-            return $this->markVerifiedAndRespond();
-        }
-
-        $this->issue();
-
-        return response(['message' => osu_trans('user_verification.errors.reissued')], 200);
-    }
-
-    public function verify()
-    {
-        $key = str_replace(' ', '', $this->request->input('verification_key'));
-
-        try {
-            $this->state->verify($key);
-        } catch (UserVerificationException $e) {
-            static::logAttempt('input', 'fail', $e->reasonKey());
-
-            if ($e->reasonKey() === 'incorrect_key') {
-                LoginAttempt::logAttempt($this->request->getClientIp(), $this->user, 'verify-mismatch', $key);
-            }
-
-            if ($e->shouldReissue()) {
-                $this->issue();
-            }
-
-            return error_popup($e->getMessage());
-        }
-
-        static::logAttempt('input', 'success');
-
-        return $this->markVerifiedAndRespond();
-    }
-}

app/Libraries/UserVerificationState.php

···
-<?php
-
-// Copyright (c) ppy Pty Ltd <[e-mail]>. Licensed under the GNU Affero General Public License v3.0.
-// See the LICENCE file in the repository root for full licence text.
-
-namespace App\Libraries;
-
-use App\Events\UserSessionEvent;
-use App\Exceptions\UserVerificationException;
-use App\Libraries\Session\Store as SessionStore;
-use App\Models\User;
-
-class UserVerificationState
-{
-    private function __construct(private User $user, private SessionStore $session)
-    {
-    }
-
-    public static function fromCurrentRequest()
-    {
-        return new static(\Auth::user(), \Session::instance());
-    }
-
-    public static function fromVerifyLink($linkKey)
-    {
-        if (!SignedRandomString::isValid($linkKey)) {
-            return null;
-        }
-
-        $params = cache()->get("verification:{$linkKey}");
-
-        if ($params !== null) {
-            $state = static::load($params);
-
-            // As it's from verify link, make sure the state is waiting for verification.
-            if ($state->issued()) {
-                return $state;
-            }
-        }
-    }
-
-    public static function load($params)
-    {
-        return new static(
-            User::find($params['userId']),
-            SessionStore::findOrNew($params['sessionId']),
-        );
-    }
-
-    public function dump()
-    {
-        return [
-            'userId' => $this->user->getKey(),
-            'sessionId' => $this->session->getId(),
-        ];
-    }
-
-    public function issue()
-    {
-        $previousLinkKey = $this->session->get('verification_link_key');
-
-        if (present($previousLinkKey)) {
-            cache()->forget("verification:{$previousLinkKey}");
-        }
-
-        // 1 byte = 2^8 bits = 16^2 bits = 2 hex characters
-        $key = bin2hex(random_bytes(config('osu.user.verification_key_length_hex') / 2));
-        $linkKey = SignedRandomString::create(32);
-        $expires = now()->addHours(5);
-
-        $this->session->put('verification_key', $key);
-        $this->session->put('verification_link_key', $linkKey);
-        $this->session->put('verification_expire_date', $expires);
-        $this->session->put('verification_tries', 0);
-        $this->session->save();
-
-        cache()->put("verification:{$linkKey}", $this->dump(), $expires);
-
-        return [
-            'link' => $linkKey,
-            'main' => $key,
-        ];
-    }
-
-    public function issued()
-    {
-        return present($this->session->get('verification_key'));
-    }
-
-    public function isDone()
-    {
-        if ($this->user === null) {
-            return true;
-        }
-
-        if ($this->session->get('verified')) {
-            return true;
-        }
-
-        return false;
-    }
-
-    public function markVerified()
-    {
-        $this->session->forget('verification_expire_date');
-        $this->session->forget('verification_tries');
-        $this->session->forget('verification_key');
-        $this->session->put('verified', true);
-        $this->session->save();
-
-        UserSessionEvent::newVerified($this->user->getKey(), $this->session->getKeyForEvent())->broadcast();
-    }
-
-    public function verify($inputKey)
-    {
-        if ($this->isDone()) {
-            return;
-        }
-
-        $expireDate = $this->session->get('verification_expire_date');
-        $tries = $this->session->get('verification_tries');
-        $key = $this->session->get('verification_key');
-
-        if (!present($expireDate) || !present($tries) || !present($key)) {
-            throw new UserVerificationException('expired', true);
-        }
-
-        if ($expireDate->isPast()) {
-            throw new UserVerificationException('expired', true);
-        }
-
-        if ($tries > config('osu.user.verification_key_tries_limit')) {
-            throw new UserVerificationException('retries_exceeded', true);
-        }
-
-        if (!hash_equals($key, $inputKey)) {
-            $this->session->put('verification_tries', $tries + 1);
-            $this->session->save();
-
-            throw new UserVerificationException('incorrect_key', false);
-        }
-    }
-}

app/Providers/AdditionalDuskServiceProvider.php

···
 
 namespace App\Providers;
 
-use App\Libraries\UserVerification;
 use Illuminate\Support\ServiceProvider;
 use Route;
 
···
     public function boot()
     {
         Route::get('/_dusk/verify', function () {
-            return UserVerification::fromCurrentRequest()->markVerifiedAndRespond();
+            \Session::instance()->markVerified();
+
+            return response(null, 204);
         })->middleware('web');
     }
 }

tests/Libraries/UserVerificationTest.php tests/Libraries/SessionVerification/ControllerTest.php

···
 
 declare(strict_types=1);
 
-namespace Tests\Libraries;
+namespace Tests\Libraries\SessionVerification;
 
 use App\Libraries\Session\Store as SessionStore;
-use App\Libraries\UserVerification;
-use App\Libraries\UserVerificationState;
+use App\Libraries\SessionVerification;
 use App\Models\LoginAttempt;
 use App\Models\User;
 use Tests\TestCase;
 
-class UserVerificationTest extends TestCase
+class ControllerTest extends TestCase
 {
     public function testIssue()
     {
···
         $record = LoginAttempt::find('127.0.0.1');
 
         $this->assertTrue($record->containsUser($user, 'verify'));
-        $this->assertFalse(UserVerification::fromCurrentRequest()->isDone());
+        $this->assertFalse(\Session::isVerified());
     }
 
     public function testVerify()
     {
         $user = User::factory()->create();
+        $session = \Session::instance();
 
         $this
             ->be($user)
+            ->withPersistentSession($session)
             ->get(route('account.edit'))
             ->assertStatus(401)
             ->assertViewIs('users.verify');
 
-        $key = session()->get('verification_key');
+        $key = SessionVerification\State::fromSession($session)->key;
 
         $this
+            ->withPersistentSession($session)
             ->post(route('account.verify'), ['verification_key' => $key])
             ->assertSuccessful();
 
         $record = LoginAttempt::find('127.0.0.1');
 
         $this->assertFalse($record->containsUser($user, 'verify-mismatch:'));
-        $this->assertTrue(UserVerification::fromCurrentRequest()->isDone());
+        $this->assertTrue($session->isVerified());
     }
 
     public function testVerifyLink(): void
···
             ->assertStatus(401)
             ->assertViewIs('users.verify');
 
-        $linkKey = $session->get('verification_link_key');
+        $linkKey = SessionVerification\State::fromSession($session)->linkKey;
 
         $guestSession = SessionStore::findOrNew();
         $this
···
         $record = LoginAttempt::find('127.0.0.1');
 
         $this->assertFalse($record->containsUser($user, 'verify-mismatch:'));
-        $this->assertTrue(UserVerificationState::load(['userId' => $user->getKey(), 'sessionId' => $sessionId])->isDone());
+        $this->assertTrue(SessionStore::findOrNew($sessionId)->isVerified());
     }
 
     public function testVerifyLinkMismatch(): void
···
             ->get(route('account.verify', ['key' => 'invalid']))
             ->assertStatus(404);
 
-        $this->assertFalse(UserVerificationState::load(['userId' => $user->getKey(), 'sessionId' => $sessionId])->isDone());
+        $this->assertFalse(SessionStore::findOrNew($sessionId)->isVerified());
     }
 
     public function testVerifyMismatch()
     {
         $user = User::factory()->create();
+        $session = \Session::instance();
 
         $this
             ->be($user)
+            ->withPersistentSession($session)
             ->get(route('account.edit'))
             ->assertStatus(401)
             ->assertViewIs('users.verify');
···
         $this->assertFalse($record->containsUser($user, 'verify-mismatch:'));
 
         $this
+            ->withPersistentSession($session)
             ->post(route('account.verify'), ['verification_key' => 'invalid'])
             ->assertStatus(422);
 
         $record = LoginAttempt::find('127.0.0.1');
 
         $this->assertTrue($record->containsUser($user, 'verify-mismatch:'));
-        $this->assertFalse(UserVerification::fromCurrentRequest()->isDone());
+        $this->assertFalse($session->isVerified());
     }
 }