tbianchini/shopit-back
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): enhance password reset attempt handling with new reasons and update related services

Browse Source
This commit is contained in:
ncoronel
2026-08-13 16:49:19 -03:00
parent 630b49cad7
commit a4a4c9afbc
9 changed files with 149 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/Domains/Auth/Models/ResetPasswordAttempt.php
View File

@@ -11,6 +11,12 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
#[Hidden(['codigo'])]
class ResetPasswordAttempt extends Model
{
public const REASON_MANUAL = 'manual';
public const REASON_ACCOUNT_LOCKED = 'account_locked';
public const REASON_STAFF_CREATED = 'staff_created';
public const STATUS_PENDING = 'pending';
public const STATUS_VALIDATED = 'validated';

46
app/Domains/Auth/Services/PasswordLoginService.php
View File

@@ -4,9 +4,11 @@ namespace App\Domains\Auth\Services;
use App\Domains\Auth\Exceptions\AccountLockedException;
use App\Domains\Auth\Models\LoginAttempt;
use App\Domains\Auth\Models\ResetPasswordAttempt;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Notification\Events\PasswordResetRequested;
use Carbon\CarbonImmutable;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
@@ -60,6 +62,8 @@ class PasswordLoginService
$userAgent,
RoleCode::AdminApp,
true,
null,
PasswordResetRequested::CHANNEL_ADMINAPP,
);
}
@@ -84,6 +88,7 @@ class PasswordLoginService
null,
true,
PermissionCode::ScanTickets->value,
PasswordResetRequested::CHANNEL_SCANNER,
);
}
@@ -96,6 +101,7 @@ class PasswordLoginService
?RoleCode $requiredRole = RoleCode::User,
bool $requiresTenant = false,
?string $requiredPermission = null,
string $passwordResetChannel = PasswordResetRequested::CHANNEL_STOREFRONT,
): User {
$normalizedEmail = mb_strtolower(trim($email));
$now = CarbonImmutable::now();
@@ -111,6 +117,7 @@ class PasswordLoginService
$requiredRole,
$requiresTenant,
$requiredPermission,
$passwordResetChannel,
): array {
$user = User::query()
->where('email', $normalizedEmail)
@@ -160,7 +167,12 @@ class PasswordLoginService
if ($user === null || ! Hash::check($password, $user->password)) {
if ($user !== null && $attemptTenantCode !== null) {
$this->registerFailure($user, $now, $attemptTenantCode);
$this->registerFailure(
$user,
$now,
$attemptTenantCode,
$passwordResetChannel,
);
}
$outcome = $user?->locked_until?->isFuture()
@@ -219,7 +231,12 @@ class PasswordLoginService
return $result['user'];
}
private function registerFailure(User $user, CarbonImmutable $now, string $tenantCode): void
private function registerFailure(
User $user,
CarbonImmutable $now,
string $tenantCode,
string $passwordResetChannel,
): void
{
$windowMinutes = max(1, (int) config('login-security.attempt_window_minutes'));
$maxAttempts = max(1, (int) config('login-security.max_attempts'));
@@ -243,18 +260,23 @@ class PasswordLoginService
if ($attempts >= $maxAttempts && $previousAttempts < $maxAttempts) {
try {
if ($user->rol_codigo === RoleCode::AdminApp->value) {
$this->resetPasswordAttemptService->createForAdminAppEmail(
$user->email,
'account_locked',
);
} else {
$this->resetPasswordAttemptService->createForEmail(
match ($passwordResetChannel) {
PasswordResetRequested::CHANNEL_ADMINAPP =>
$this->resetPasswordAttemptService->createForAdminAppEmail(
$user->email,
ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
),
PasswordResetRequested::CHANNEL_SCANNER =>
$this->resetPasswordAttemptService->createForScannerEmail(
$user->email,
ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
),
default => $this->resetPasswordAttemptService->createForEmail(
$user->email,
$tenantCode,
'account_locked',
);
}
ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
),
};
} catch (\Throwable $e) {
Log::error('Failed to trigger reset password on account lock', [
'user_id' => $user->id,

16
app/Domains/Auth/Services/ResetPasswordAttemptService.php
View File

@@ -12,7 +12,11 @@ use Throwable;
class ResetPasswordAttemptService
{
public function createForEmail(string $email, string $tenantCode, string $reason = 'manual'): void
public function createForEmail(
string $email,
string $tenantCode,
string $reason = ResetPasswordAttempt::REASON_MANUAL,
): void
{
$emailFingerprint = $this->emailFingerprint($email);
@@ -47,7 +51,10 @@ class ResetPasswordAttemptService
);
}
public function createForAdminAppEmail(string $email, string $reason = 'manual'): void
public function createForAdminAppEmail(
string $email,
string $reason = ResetPasswordAttempt::REASON_MANUAL,
): void
{
$emailFingerprint = $this->emailFingerprint($email);
@@ -93,7 +100,10 @@ class ResetPasswordAttemptService
);
}
public function createForScannerEmail(string $email, string $reason = 'manual'): void
public function createForScannerEmail(
string $email,
string $reason = ResetPasswordAttempt::REASON_MANUAL,
): void
{
$emailFingerprint = $this->emailFingerprint($email);