PHP - Safe Route - Optimized Graphs

I am using JWT for an API authentication and like them.  Previously, I would query both some GUID and the user's ID (which wasn't their PK but a unique key per GUID), but now I just include both the account and user's DB PK in the token.  Also, including something regarding the user's permissions, however, I still haven't bought into this approach as I don't know how to deal with changing permissions and still having some JWT with different permissions floating around.  I suppose I could save the JWT's timestamp in the DB, but that seems to eliminate the benefit of token expirations...  Sorry, back to the question at hand.

I now have a need to provide emails with a reduced subset of endpoints to either view some resource or update some status.  I don't want to make the user first go to some website and then include the JWT in the header, but instead just a single click action.  Problem is now I have their JWT which is effectively their password in some email which isn't ideal, and their is no way to ensure that the specific user was the individual that viewed the resource or performed some action.  Then I thought maybe I would make some common low access JWT and use the exact same GET routes as I would do so normally and create some new GET routes to emulate main application POST/PUT/PATCH routes.

Before going down that path, I would like to investigate other solutions.  Often single use tokens are used to reset passwords and other actions which should only performed once and this is not my need but maybe close.  I am thinking of creating a token that includes the actual resource path with URL parameters along with the HTTP method.  Since everything is in the token, I wouldn't need a typical REST path to identify the resource but would have a single endpoint to retrieve them.

I searched for related information and didn't find anything which makes me concerned I am going down a rabbit hole.  Any thoughts on how to implement this?  Thanks

RewriteEngine On
RewriteRule (.*) /var/www/html/site/controller.php [L,QSA]

<?php
    include( $_SERVER["REQUEST_URI"] );
?>

Hi y'all. First off, posting this here to hopefully avoid the noise that's happening in the Applications sub-forums, so mods please feel free to move if it's too inappropriate here.

Anyway, I'm currently doing a skills assessment for a potential new job in Laravel - if I wasn't using Laravel I would've been done hours ago, but one of the requirements is Laravel. Honestly, for the most part I dig it - it's pretty simple, despite it's reliance on magic. Anyway, I've written a couple API routes and when I visit them in the browser everything works exactly as expected and desired. However, when I run the pre-built test file, I get a Symfony\Component\HttpKernel\Exception\NotFoundHttpException for /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php.

The route as defined in api.php:

use App\Http\Controllers\User;

/**
 * I tried using a Resource Collection here - there's obviously something about those
 * that I'm missing, because it actively refused to do anything worthwhile. I'd pass in
 * UserModel::with('timelogs')->get() like I use in \App\Http\Controllers\User::getTotalSeconds(),
 * and it didn't care. Just printed out absolute garbage, no matter what I fed to it.
 */
Route::get('/user-timelogs', function(Request $request) {
    $u = new User;
    return $u->getTotalSeconds();
});

And the controller code:

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\User as UserModel;

class User extends Controller
    public function getTotalSeconds()
    {
        $users = UserModel::with('timelogs')->get();
        $ret = [];
        foreach($users as $user){
            array_push($ret, [
                'user_id' => $user->id,
                'seconds_logged' => $this->calculateTime($user->timelogs)
            ]);
        };
        return json_encode($ret);
    }

    private function calculateTime($logs)
    {
        $totalTime = 0;
        foreach($logs as $log){
            $totalTime += $log->seconds_logged;
        }
        return $totalTime;
    }
}

The model file for good measu

namespace App;

use Illuminate\Notifications\Notifiable;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name', 'email', 'password', 'id',
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password', 'remember_token',
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];

    public function timelogs()
    {
        return $this->hasMany('App\Timelog');
    }
}

Again, when I visit localhost/api/user-timelogs, the user IDs and correct total of seconds is right there. It's just in the test file that it's an issue. Anybody have any ideas?

<?php

    if (isset($_GET['nav'])) 
{
    if (strpos($_GET['nav'], "/")) 
{
    $direc = substr(str_replace('..', '', $_GET['nav']), 0, strpos($_GET['nav'], "/")) . "/";
    $file = substr(strrchr($_GET['nav'], "/"), 1);
    if (file_exists($direc.$file.".php")) 
{
    require($direc.$file.".php");
} else {
    require("error.php");
}
} else {
    if (file_exists(basename($_GET['nav']).".php")) 
{
    require(basename($_GET['nav']).".php");
} else {
    require("error.php");
}
}
} else {
    require("links.php");
}
?>

function hash_($input,$key) {

     $op=hash("whirlpool",hash("sha512",$key) . "$" . $input . "$" . hash("sha512",$key));