feat(auth): enhance password reset attempt handling with new reasons and update related services

tests/Feature/Auth/ScannerLoginControllerTest.php

@@ -3,13 +3,16 @@
 namespace Tests\Feature\Auth;
 
 use App\Domains\Auth\Models\LoginAttempt;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Permission;
 use App\Domains\Authorization\Models\Role;
+use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Hash;
 use Tests\TestCase;
 
@@ -113,4 +116,51 @@ class ScannerLoginControllerTest extends TestCase
             'outcome' => LoginAttempt::OUTCOME_INVALID_CREDENTIALS,
         ]);
     }
+
+    public function test_locking_a_scanner_sends_the_scanner_password_reset_flow(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+        config([
+            'login-security.max_attempts' => 3,
+            'login-security.rate_limit_per_minute' => 100,
+            'login-security.ip_rate_limit_per_minute' => 100,
+        ]);
+        $role = Role::query()->create([
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $role->permissions()->attach($permission->codigo);
+        $tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+        ]);
+        $user = User::factory()->create([
+            'email' => 'scanner@example.com',
+            'password' => Hash::make('correct-password'),
+            'rol_codigo' => $role->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        $payload = [
+            'email' => $user->email,
+            'password' => 'wrong-password',
+        ];
+
+        $this->postJson('/api/v1/scanner/login', $payload)->assertUnprocessable();
+        $this->postJson('/api/v1/scanner/login', $payload)->assertUnprocessable();
+        $this->postJson('/api/v1/scanner/login', $payload)->assertTooManyRequests();
+
+        $attempt = $user->resetPasswordAttempts()->sole();
+        $this->assertSame(ResetPasswordAttempt::REASON_ACCOUNT_LOCKED, $attempt->reason);
+        Event::assertDispatched(
+            PasswordResetRequested::class,
+            fn (PasswordResetRequested $event): bool => $event->attemptId === $attempt->id
+                && $event->tenantCode === $tenant->codigo
+                && $event->channel === PasswordResetRequested::CHANNEL_SCANNER,
+        );
+    }
 }

tests/Feature/Notification/NotificationMailServiceTest.php

@@ -116,6 +116,7 @@ class NotificationMailServiceTest extends TestCase
         $this->tenant->update(['website_type_code' => $websiteType->codigo]);
         $attempt = $this->user->resetPasswordAttempts()->create([
             'codigo' => '0123',
+            'reason' => ResetPasswordAttempt::REASON_STAFF_CREATED,
         ]);
 
         app(NotificationMailService::class)->sendPasswordResetCode(
@@ -127,10 +128,10 @@ class NotificationMailServiceTest extends TestCase
         Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
             $rendered = $mail->render();
 
-            return str_contains(
-                $rendered,
-                'https://scanner.mail.local/recuperar-contrasena/codigo?email=ada%40example.com',
-            );
+            return str_contains($rendered, 'https://scanner.mail.local/recuperar-contrasena/codigo')
+                && str_contains($rendered, 'email=ada%40example.com')
+                && str_contains($rendered, 'code=0123')
+                && str_contains($rendered, 'Crear mi');
         });
     }
 

tests/Feature/Staff/StaffControllerTest.php

@@ -2,13 +2,16 @@
 
 namespace Tests\Feature\Staff;
 
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Catalog\Models\Category;
+use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Models\WebsiteType;
 use Database\Seeders\AuthorizationSeeder;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
 use Laravel\Sanctum\Sanctum;
 use Tests\TestCase;
 
@@ -24,6 +27,7 @@ class StaffControllerTest extends TestCase
     {
         parent::setUp();
 
+        Event::fake([PasswordResetRequested::class]);
         $this->seed(AuthorizationSeeder::class);
         WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
         $this->tenant = Tenant::query()->create([
@@ -59,6 +63,16 @@ class StaffControllerTest extends TestCase
             'user_id' => $staffId,
             'categoria_id' => $firstCategory->id,
         ]);
+        $this->assertDatabaseHas('reset_password_attempts', [
+            'user_id' => $staffId,
+            'reason' => ResetPasswordAttempt::REASON_STAFF_CREATED,
+            'status' => ResetPasswordAttempt::STATUS_PENDING,
+        ]);
+        Event::assertDispatched(
+            PasswordResetRequested::class,
+            fn (PasswordResetRequested $event): bool => $event->tenantCode === $this->tenant->codigo
+                && $event->channel === PasswordResetRequested::CHANNEL_SCANNER,
+        );
 
         $this->getJson('/api/v1/adminapp/tenant/staff?search=ada')
             ->assertOk()