extend User entity with displayname and email confirmation

Add display_name (unique) and email_confirmed_at columns plus
matching getters, DTO fields, repo methods (findByDisplayName,
update), and migration. Existing auth tests updated to construct
User with the new params.

backend/app/User/CreateUserDto.php

@@ -3,12 +3,15 @@
 namespace App\User;
 
 use App\Shared\ValueObject\EmailAddress;
+use DateTimeImmutable;
 
 readonly class CreateUserDto
 {
     public function __construct(
         public EmailAddress $email,
+        public string $displayName,
         public string $passwordHash,
         public bool $isAdmin,
+        public ?DateTimeImmutable $emailConfirmedAt,
     ) {}
 }

backend/app/User/EloquentUserRepository.php

@@ -3,6 +3,9 @@
 namespace App\User;
 
 use App\Shared\ValueObject\EmailAddress;
+use DateTimeImmutable;
+use DateTimeZone;
+use RuntimeException;
 
 class EloquentUserRepository implements UserRepository
 {
@@ -10,8 +13,10 @@ class EloquentUserRepository implements UserRepository
     {
         $model = UserModel::create([
             'email' => $dto->email->value(),
+            'display_name' => $dto->displayName,
             'password_hash' => $dto->passwordHash,
             'is_admin' => $dto->isAdmin,
+            'email_confirmed_at' => $dto->emailConfirmedAt,
         ]);
 
         return $this->toDomain($model);
@@ -31,13 +36,51 @@ class EloquentUserRepository implements UserRepository
         return $model === null ? null : $this->toDomain($model);
     }
 
+    public function findByDisplayName(string $displayName): ?User
+    {
+        $model = UserModel::where('display_name', $displayName)->first();
+
+        return $model === null ? null : $this->toDomain($model);
+    }
+
+    /**
+     * @throws RuntimeException
+     */
+    public function update(User $user): User
+    {
+        $model = UserModel::find($user->getId());
+        if ($model === null) {
+            throw new RuntimeException(
+                "User with id: {$user->getId()} does not exist"
+            );
+        }
+        $model->email = $user->getEmail()->value();
+        $model->display_name = $user->getDisplayName();
+        $model->password_hash = $user->getPasswordHash();
+        $model->is_admin = $user->isAdmin();
+        $model->email_confirmed_at = $user->getEmailConfirmedAt();
+        $model->save();
+
+        return $this->toDomain($model);
+    }
+
     private function toDomain(UserModel $model): User
     {
+        $confirmedAt = null;
+        if ($model->email_confirmed_at !== null) {
+            $confirmedAt = new DateTimeImmutable(
+                $model->email_confirmed_at->toDateTimeString(),
+                new DateTimeZone('UTC'),
+            );
+        }
+
         return new User(
             id: $model->id,
             email: new EmailAddress($model->email),
+            displayName: $model->display_name,
             passwordHash: $model->password_hash,
             isAdmin: $model->is_admin,
+            emailConfirmedAt: $confirmedAt,
         );
     }
 }

backend/app/User/User.php

@@ -3,14 +3,17 @@
 namespace App\User;
 
 use App\Shared\ValueObject\EmailAddress;
+use DateTimeImmutable;
 
 class User
 {
     public function __construct(
         private int $id,
         private EmailAddress $email,
+        private string $displayName,
         private string $passwordHash,
         private bool $isAdmin,
+        private ?DateTimeImmutable $emailConfirmedAt,
     ) {}
 
     public function getId(): int
@@ -23,6 +26,11 @@ class User
         return $this->email;
     }
 
+    public function getDisplayName(): string
+    {
+        return $this->displayName;
+    }
+
     public function getPasswordHash(): string
     {
         return $this->passwordHash;
@@ -32,4 +40,14 @@ class User
     {
         return $this->isAdmin;
     }
+
+    public function getEmailConfirmedAt(): ?DateTimeImmutable
+    {
+        return $this->emailConfirmedAt;
+    }
+
+    public function isEmailConfirmed(): bool
+    {
+        return $this->emailConfirmedAt !== null;
+    }
 }

backend/app/User/UserModel.php

@@ -2,21 +2,26 @@
 
 namespace App\User;
 
+use DateTimeImmutable;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * @property int $id
  * @property string $email
+ * @property string $display_name
  * @property string $password_hash
  * @property bool $is_admin
+ * @property ?DateTimeImmutable $email_confirmed_at
  *
  * @method static Builder<static>|UserModel newModelQuery()
  * @method static Builder<static>|UserModel newQuery()
  * @method static Builder<static>|UserModel query()
  * @method static Builder<static>|UserModel whereId($value)
  * @method static Builder<static>|UserModel whereEmail($value)
+ * @method static Builder<static>|UserModel whereDisplayName($value)
  * @method static Builder<static>|UserModel whereIsAdmin($value)
+ * @method static Builder<static>|UserModel whereEmailConfirmedAt($value)
  *
  * @mixin \Eloquent
  */
@@ -28,11 +33,14 @@ class UserModel extends Model
 
     protected $fillable = [
         'email',
+        'display_name',
         'password_hash',
         'is_admin',
+        'email_confirmed_at',
     ];
 
     protected $casts = [
         'is_admin' => 'boolean',
+        'email_confirmed_at' => 'immutable_datetime',
     ];
 }

backend/app/User/UserRepository.php

@@ -11,4 +11,8 @@ interface UserRepository
     public function find(int $id): ?User;
 
     public function findByEmail(EmailAddress $email): ?User;
+
+    public function findByDisplayName(string $displayName): ?User;
+
+    public function update(User $user): User;
 }

backend/database/migrations/2026_05_06_000000_create_users_table.php

@@ -11,8 +11,10 @@ return new class extends Migration
         Schema::create('users', function (Blueprint $table) {
             $table->id();
             $table->string('email')->unique();
+            $table->string('display_name')->unique();
             $table->string('password_hash');
             $table->boolean('is_admin')->default(false);
+            $table->dateTime('email_confirmed_at')->nullable();
         });
     }
 

backend/tests/Fakes/FakeUserRepository.php

@@ -6,6 +6,7 @@ use App\Shared\ValueObject\EmailAddress;
 use App\User\CreateUserDto;
 use App\User\User;
 use App\User\UserRepository;
+use RuntimeException;
 
 class FakeUserRepository implements UserRepository
 {
@@ -20,12 +21,14 @@ class FakeUserRepository implements UserRepository
         $user = new User(
             id: $id,
             email: $dto->email,
+            displayName: $dto->displayName,
             passwordHash: $dto->passwordHash,
             isAdmin: $dto->isAdmin,
+            emailConfirmedAt: $dto->emailConfirmedAt,
         );
         $this->existingUsers[$id] = $user;
 
-        return $user;
+        return $this->copy($user);
     }
 
     public function find(int $id): ?User
@@ -35,30 +38,59 @@ class FakeUserRepository implements UserRepository
             return null;
         }
 
-        return new User(
+        return $this->copy($user);
-            id: $user->getId(),
-            email: $user->getEmail(),
-            passwordHash: $user->getPasswordHash(),
-            isAdmin: $user->isAdmin(),
-        );
     }
 
     public function findByEmail(EmailAddress $email): ?User
     {
         foreach ($this->existingUsers as $user) {
             if ($user->getEmail()->equals($email)) {
-                return new User(
+                return $this->copy($user);
-                    id: $user->getId(),
-                    email: $user->getEmail(),
-                    passwordHash: $user->getPasswordHash(),
-                    isAdmin: $user->isAdmin(),
-                );
             }
         }
 
         return null;
     }
 
+    public function findByDisplayName(string $displayName): ?User
+    {
+        foreach ($this->existingUsers as $user) {
+            if ($user->getDisplayName() === $displayName) {
+                return $this->copy($user);
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * @throws RuntimeException
+     */
+    public function update(User $user): User
+    {
+        $id = $user->getId();
+        if (! isset($this->existingUsers[$id])) {
+            throw new RuntimeException(
+                "User with id: $id does not exist"
+            );
+        }
+        $this->existingUsers[$id] = $user;
+
+        return $this->copy($user);
+    }
+
+    private function copy(User $user): User
+    {
+        return new User(
+            id: $user->getId(),
+            email: $user->getEmail(),
+            displayName: $user->getDisplayName(),
+            passwordHash: $user->getPasswordHash(),
+            isAdmin: $user->isAdmin(),
+            emailConfirmedAt: $user->getEmailConfirmedAt(),
+        );
+    }
+
     private function getNextId(): int
     {
         return count($this->existingUsers) + 1;

backend/tests/Unit/Auth/Middleware/AuthMiddlewareTest.php

@@ -58,13 +58,15 @@ class AuthMiddlewareTest extends TestCase
         };
     }
 
-    private function makeUser(int $id = 7): User
+    private function makeUser(int $id): User
     {
         return new User(
             id: $id,
             email: new EmailAddress('user@example.com'),
+            displayName: 'user',
             passwordHash: 'hashed:irrelevant',
             isAdmin: false,
+            emailConfirmedAt: null,
         );
     }
 
@@ -100,7 +102,7 @@ class AuthMiddlewareTest extends TestCase
     {
         $this->sessionRepo->create(new CreateSessionDto(
             token: 'expired-token',
-            user: $this->makeUser(),
+            user: $this->makeUser(7),
             createdAt: $this->now->modify('-8 days'),
             expiresAt: $this->now->modify('-1 day'),
         ));

backend/tests/Unit/Auth/UseCases/CreateSessionTest.php

@@ -46,8 +46,10 @@ class CreateSessionTest extends TestCase
         return new User(
             id: 7,
             email: new EmailAddress('user@example.com'),
+            displayName: 'user',
             passwordHash: 'hashed:irrelevant',
             isAdmin: false,
+            emailConfirmedAt: null,
         );
     }
 

backend/tests/Unit/Auth/UseCases/LogoutTest.php

@@ -34,8 +34,10 @@ class LogoutTest extends TestCase
         $user = new User(
             id: 7,
             email: new EmailAddress('user@example.com'),
+            displayName: 'user',
             passwordHash: 'hashed:irrelevant',
             isAdmin: false,
+            emailConfirmedAt: null,
         );
         $this->sessionRepo->create(new CreateSessionDto(
             token: 'token-abc',