Merge branch 'fix/correcciones_secundarias' into dev

app/Domains/Auth/Services/PasswordLoginService.php

@@ -9,10 +9,15 @@ use App\Domains\Authorization\Enums\RoleCode;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Validation\ValidationException;
 
 class PasswordLoginService
 {
+    public function __construct(
+        private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+    ) {}
+
     /**
      * @throws AccountLockedException
      * @throws ValidationException
@@ -118,7 +123,7 @@ class PasswordLoginService
 
             if ($user === null || ! Hash::check($password, $user->password)) {
                 if ($user !== null) {
-                    $this->registerFailure($user, $now);
+                    $this->registerFailure($user, $now, $tenantCode);
                 }
 
                 $outcome = $user?->locked_until?->isFuture()
@@ -177,7 +182,7 @@ class PasswordLoginService
         return $result['user'];
     }
 
-    private function registerFailure(User $user, CarbonImmutable $now): void
+    private function registerFailure(User $user, CarbonImmutable $now, string $tenantCode): void
     {
         $windowMinutes = max(1, (int) config('login-security.attempt_window_minutes'));
         $maxAttempts = max(1, (int) config('login-security.max_attempts'));
@@ -189,6 +194,8 @@ class PasswordLoginService
             ? $user->failed_login_attempts + 1
             : 1;
 
+        $previousAttempts = $user->failed_login_attempts;
+
         $user->forceFill([
             'failed_login_attempts' => $attempts,
             'last_failed_login_at' => $now,
@@ -196,6 +203,17 @@ class PasswordLoginService
                 ? $now->addMinutes($lockMinutes)
                 : null,
         ])->save();
+
+        if ($attempts >= $maxAttempts && $previousAttempts < $maxAttempts) {
+            try {
+                $this->resetPasswordAttemptService->createForEmail($user->email, $tenantCode, 'account_locked');
+            } catch (\Throwable $e) {
+                Log::error('Failed to trigger reset password on account lock', [
+                    'user_id' => $user->id,
+                    'exception' => $e
+                ]);
+            }
+        }
     }
 
     private function recordAttempt(