feat(auth): add reason field to reset password attempts and enhance email notifications for account lock scenarios

app/Domains/Auth/Models/ResetPasswordAttempt.php

@@ -7,7 +7,7 @@ use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
-#[Fillable(['user_id', 'codigo', 'status'])]
+#[Fillable(['user_id', 'codigo', 'reason', 'status'])]
 #[Hidden(['codigo'])]
 class ResetPasswordAttempt extends Model
 {

app/Domains/Auth/Services/PasswordLoginService.php

@@ -8,10 +8,15 @@ use App\Domains\Auth\Models\User;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Validation\ValidationException;
 
 class PasswordLoginService
 {
+    public function __construct(
+        private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+    ) {}
+
     /**
      * @throws AccountLockedException
      * @throws ValidationException
@@ -67,7 +72,7 @@ class PasswordLoginService
 
             if ($user === null || ! Hash::check($password, $user->password)) {
                 if ($user !== null) {
-                    $this->registerFailure($user, $now);
+                    $this->registerFailure($user, $now, $tenantCode);
                 }
 
                 $outcome = $user?->locked_until?->isFuture()
@@ -126,7 +131,7 @@ class PasswordLoginService
         return $result['user'];
     }
 
-    private function registerFailure(User $user, CarbonImmutable $now): void
+    private function registerFailure(User $user, CarbonImmutable $now, string $tenantCode): void
     {
         $windowMinutes = max(1, (int) config('login-security.attempt_window_minutes'));
         $maxAttempts = max(1, (int) config('login-security.max_attempts'));
@@ -138,6 +143,8 @@ class PasswordLoginService
             ? $user->failed_login_attempts + 1
             : 1;
 
+        $previousAttempts = $user->failed_login_attempts;
+
         $user->forceFill([
             'failed_login_attempts' => $attempts,
             'last_failed_login_at' => $now,
@@ -145,6 +152,17 @@ class PasswordLoginService
                 ? $now->addMinutes($lockMinutes)
                 : null,
         ])->save();
+
+        if ($attempts >= $maxAttempts && $previousAttempts < $maxAttempts) {
+            try {
+                $this->resetPasswordAttemptService->createForEmail($user->email, $tenantCode, 'account_locked');
+            } catch (\Throwable $e) {
+                Log::error('Failed to trigger reset password on account lock', [
+                    'user_id' => $user->id,
+                    'exception' => $e
+                ]);
+            }
+        }
     }
 
     private function recordAttempt(

app/Domains/Auth/Services/ResetPasswordAttemptService.php

@@ -11,12 +11,12 @@ use Throwable;
 
 class ResetPasswordAttemptService
 {
-    public function createForEmail(string $email, string $tenantCode): void
+    public function createForEmail(string $email, string $tenantCode, string $reason = 'manual'): void
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
         try {
-            $attemptId = DB::transaction(function () use ($email, $emailFingerprint): ?int {
+            $attemptId = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?int {
                 $user = User::query()
                     ->where('email', $email)
                     ->lockForUpdate()
@@ -39,6 +39,7 @@ class ResetPasswordAttemptService
 
                 $attempt = $user->resetPasswordAttempts()->create([
                     'codigo' => $this->generateCode(),
+                    'reason' => $reason,
                     'status' => ResetPasswordAttempt::STATUS_PENDING,
                 ]);
 

app/Domains/Catalog/Models/Variant.php

@@ -79,20 +79,7 @@ class Variant extends Model
 
     public function getName(): string
     {
-        $name = $this->catalogItem->nombre;
-        $this->loadMissing('definitions.itemAttribute.attribute');
-        $definitions = $this->definitions
-            ->map(function (VariantDefinition $definition): ?string {
-                $attributeName = $definition->itemAttribute?->attribute?->nombre;
-
-                return $attributeName
-                    ? "{$attributeName}: {$definition->value}"
-                    : $definition->value;
-            })
-            ->filter()
-            ->implode(', ');
-
-        return $definitions === '' ? $name : "{$name} ({$definitions})";
+        return $this->catalogItem->nombre;
     }
 
     public function getMinimumUseDate(): ?CarbonInterface

database/migrations/2026_08_05_125427_add_reason_to_reset_password_attempts_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('reset_password_attempts', function (Blueprint $table): void {
+            $table->string('reason')->default('manual')->after('codigo');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('reset_password_attempts', function (Blueprint $table): void {
+            $table->dropColumn('reason');
+        });
+    }
+};

resources/views/mail/notifications/password-reset.blade.php

@@ -2,10 +2,16 @@
     Recuperá tu contraseña
 </h1>
 
+@if($attempt->reason === 'account_locked')
+<p>
+    Hola {{ $attempt->user->nombre_apellido }}, registramos varios intentos fallidos de inicio de sesión en tu cuenta. Por seguridad, hemos bloqueado el acceso temporalmente. Puedes utilizar este código para cambiar tu contraseña y desbloquearla inmediatamente.
+</p>
+@else
 <p>
     Hola {{ $attempt->user->nombre_apellido }}, recibimos una solicitud para restablecer
     la contraseña de tu cuenta.
 </p>
+@endif
 
 <p>Ingresá este código en {{ $tenant->nombre }}:</p>
 
@@ -15,6 +21,21 @@
     </span>
 </div>
 
+@php
+    $recoveryUrl = 'https://' . $tenant->dominio . '/recuperar-contrasena/codigo?email=' . urlencode($attempt->user->email);
+@endphp
+
+<div style="text-align: center; margin-bottom: 28px;">
+    <a href="{{ $recoveryUrl }}" 
+       style="display: inline-block; padding: 12px 24px; background-color: {{ $tenant->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
+        Ingresar código ahora
+    </a>
+</div>
+
 <p style="color: #64748b; font-size: 14px;">
+@if($attempt->reason === 'account_locked')
+    Si no fuiste vos, por favor desestimá y borrá este correo. Tu cuenta seguirá protegida.
+@else
     Si no solicitaste recuperar tu contraseña, podés ignorar este mensaje.
+@endif
 </p>

tests/Unit/Catalog/CatalogModelsTest.php

@@ -155,6 +155,28 @@ class CatalogModelsTest extends TestCase
         );
     }
 
+    public function test_event_date_identifies_a_variant_without_catalog_attributes(): void
+    {
+        $item = new CatalogItem;
+        $item->nombre = 'Entrada General';
+
+        $eventDate = new EventDate;
+        $eventDate->date = '2026-10-09';
+        $eventDate->time_start = '09:00:00';
+        $eventDate->time_end = '18:00:00';
+
+        $variant = new Variant;
+        $variant->minimum_use_date = Carbon::parse('2026-10-09 08:00:00');
+        $variant->maximum_use_date = Carbon::parse('2026-10-09 20:00:00');
+        $variant->setRelation('catalogItem', $item);
+        $variant->setRelation('eventDate', $eventDate);
+        $variant->setRelation('definitions', new EloquentCollection);
+
+        $this->assertSame('Entrada General', $variant->getName());
+        $this->assertSame('2026-10-09 09:00:00', $variant->getMinimumUseDate()->format('Y-m-d H:i:s'));
+        $this->assertSame('2026-10-09 18:00:00', $variant->getMaximumUseDate()->format('Y-m-d H:i:s'));
+    }
+
     public function test_inventory_maps_stock_without_a_polymorphic_owner(): void
     {
         $inventory = $this->trackedInventory(realStock: 10, reservedStock: 3);