feat(auth): enhance password reset attempt handling with new reasons and update related services

app/Domains/Auth/Models/ResetPasswordAttempt.php

@@ -11,6 +11,12 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 #[Hidden(['codigo'])]
 class ResetPasswordAttempt extends Model
 {
+    public const REASON_MANUAL = 'manual';
+
+    public const REASON_ACCOUNT_LOCKED = 'account_locked';
+
+    public const REASON_STAFF_CREATED = 'staff_created';
+
     public const STATUS_PENDING = 'pending';
 
     public const STATUS_VALIDATED = 'validated';

app/Domains/Auth/Services/PasswordLoginService.php

@@ -4,9 +4,11 @@ namespace App\Domains\Auth\Services;
 
 use App\Domains\Auth\Exceptions\AccountLockedException;
 use App\Domains\Auth\Models\LoginAttempt;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Notification\Events\PasswordResetRequested;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
@@ -60,6 +62,8 @@ class PasswordLoginService
             $userAgent,
             RoleCode::AdminApp,
             true,
+            null,
+            PasswordResetRequested::CHANNEL_ADMINAPP,
         );
     }
 
@@ -84,6 +88,7 @@ class PasswordLoginService
             null,
             true,
             PermissionCode::ScanTickets->value,
+            PasswordResetRequested::CHANNEL_SCANNER,
         );
     }
 
@@ -96,6 +101,7 @@ class PasswordLoginService
         ?RoleCode $requiredRole = RoleCode::User,
         bool $requiresTenant = false,
         ?string $requiredPermission = null,
+        string $passwordResetChannel = PasswordResetRequested::CHANNEL_STOREFRONT,
     ): User {
         $normalizedEmail = mb_strtolower(trim($email));
         $now = CarbonImmutable::now();
@@ -111,6 +117,7 @@ class PasswordLoginService
             $requiredRole,
             $requiresTenant,
             $requiredPermission,
+            $passwordResetChannel,
         ): array {
             $user = User::query()
                 ->where('email', $normalizedEmail)
@@ -160,7 +167,12 @@ class PasswordLoginService
 
             if ($user === null || ! Hash::check($password, $user->password)) {
                 if ($user !== null && $attemptTenantCode !== null) {
-                    $this->registerFailure($user, $now, $attemptTenantCode);
+                    $this->registerFailure(
+                        $user,
+                        $now,
+                        $attemptTenantCode,
+                        $passwordResetChannel,
+                    );
                 }
 
                 $outcome = $user?->locked_until?->isFuture()
@@ -219,7 +231,12 @@ class PasswordLoginService
         return $result['user'];
     }
 
-    private function registerFailure(User $user, CarbonImmutable $now, string $tenantCode): void
+    private function registerFailure(
+        User $user,
+        CarbonImmutable $now,
+        string $tenantCode,
+        string $passwordResetChannel,
+    ): void
     {
         $windowMinutes = max(1, (int) config('login-security.attempt_window_minutes'));
         $maxAttempts = max(1, (int) config('login-security.max_attempts'));
@@ -243,18 +260,23 @@ class PasswordLoginService
 
         if ($attempts >= $maxAttempts && $previousAttempts < $maxAttempts) {
             try {
-                if ($user->rol_codigo === RoleCode::AdminApp->value) {
-                    $this->resetPasswordAttemptService->createForAdminAppEmail(
-                        $user->email,
-                        'account_locked',
-                    );
-                } else {
-                    $this->resetPasswordAttemptService->createForEmail(
+                match ($passwordResetChannel) {
+                    PasswordResetRequested::CHANNEL_ADMINAPP =>
+                        $this->resetPasswordAttemptService->createForAdminAppEmail(
+                            $user->email,
+                            ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+                        ),
+                    PasswordResetRequested::CHANNEL_SCANNER =>
+                        $this->resetPasswordAttemptService->createForScannerEmail(
+                            $user->email,
+                            ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+                        ),
+                    default => $this->resetPasswordAttemptService->createForEmail(
                         $user->email,
                         $tenantCode,
-                        'account_locked',
-                    );
-                }
+                        ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+                    ),
+                };
             } catch (\Throwable $e) {
                 Log::error('Failed to trigger reset password on account lock', [
                     'user_id' => $user->id,

app/Domains/Auth/Services/ResetPasswordAttemptService.php

@@ -12,7 +12,11 @@ use Throwable;
 
 class ResetPasswordAttemptService
 {
-    public function createForEmail(string $email, string $tenantCode, string $reason = 'manual'): void
+    public function createForEmail(
+        string $email,
+        string $tenantCode,
+        string $reason = ResetPasswordAttempt::REASON_MANUAL,
+    ): void
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
@@ -47,7 +51,10 @@ class ResetPasswordAttemptService
         );
     }
 
-    public function createForAdminAppEmail(string $email, string $reason = 'manual'): void
+    public function createForAdminAppEmail(
+        string $email,
+        string $reason = ResetPasswordAttempt::REASON_MANUAL,
+    ): void
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
@@ -93,7 +100,10 @@ class ResetPasswordAttemptService
         );
     }
 
-    public function createForScannerEmail(string $email, string $reason = 'manual'): void
+    public function createForScannerEmail(
+        string $email,
+        string $reason = ResetPasswordAttempt::REASON_MANUAL,
+    ): void
     {
         $emailFingerprint = $this->emailFingerprint($email);
 

app/Domains/Notification/Services/NotificationMailService.php

@@ -61,9 +61,16 @@ class NotificationMailService
             PasswordResetRequested::CHANNEL_SCANNER => $tenant->websiteType?->scanner_domain,
             default => $tenant->dominio,
         };
+        $recoveryQuery = ['email' => $attempt->user->email];
+        if (
+            $channel === PasswordResetRequested::CHANNEL_SCANNER
+            && $attempt->reason === ResetPasswordAttempt::REASON_STAFF_CREATED
+        ) {
+            $recoveryQuery['code'] = $attempt->codigo;
+        }
         $recoveryUrl = $recoveryDomain === null
             ? null
-            : 'https://'.$recoveryDomain.'/recuperar-contrasena/codigo?email='.urlencode($attempt->user->email);
+            : 'https://'.$recoveryDomain.'/recuperar-contrasena/codigo?'.http_build_query($recoveryQuery);
 
         $this->mailService
             ->forTenant($tenantCode)

app/Domains/Staff/Services/StaffService.php

@@ -2,7 +2,9 @@
 
 namespace App\Domains\Staff\Services;
 
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
+use App\Domains\Auth\Services\ResetPasswordAttemptService;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Tenant\Models\Tenant;
@@ -15,6 +17,10 @@ use Illuminate\Validation\ValidationException;
 
 class StaffService
 {
+    public function __construct(
+        private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+    ) {}
+
     /** @return Collection<int, User> */
     public function list(Tenant $tenant, ?string $search = null): Collection
     {
@@ -60,6 +66,10 @@ class StaffService
                 'tenant_codigo' => $tenant->codigo,
             ]);
             $staff->scanCategories()->sync($categoryIds);
+            $this->resetPasswordAttemptService->createForScannerEmail(
+                $staff->email,
+                ResetPasswordAttempt::REASON_STAFF_CREATED,
+            );
 
             return $staff->load('role', 'scanCategories');
         });