89 lines
2.5 KiB
PHP
89 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Auth;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Events\PasswordReset;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Facades\Password;
|
|
use Illuminate\Support\Str;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Attributes\Validate;
|
|
use Livewire\Component;
|
|
|
|
/**
|
|
* The other end of the link.
|
|
*
|
|
* The token is checked by Laravel's broker, not here: it holds the hash, the
|
|
* expiry and the single-use deletion, and re-implementing any of that is how a
|
|
* reset link ends up working twice.
|
|
*
|
|
* The user is NOT signed in afterwards. A reset link travels by email, and a
|
|
* mailbox somebody else can read would otherwise be a session somebody else
|
|
* gets. They type the new password once more on the sign-in page — which also
|
|
* proves the reset did what they think it did.
|
|
*/
|
|
#[Layout('layouts.portal')]
|
|
class ResetPassword extends Component
|
|
{
|
|
public string $token = '';
|
|
|
|
#[Validate('required|email|max:255')]
|
|
public string $email = '';
|
|
|
|
#[Validate('required|string|min:12|confirmed')]
|
|
public string $password = '';
|
|
|
|
public string $password_confirmation = '';
|
|
|
|
public bool $done = false;
|
|
|
|
public function mount(string $token): void
|
|
{
|
|
$this->token = $token;
|
|
$this->email = (string) request()->query('email', '');
|
|
}
|
|
|
|
/**
|
|
* NOT called reset(): Livewire\Component::reset() clears properties, and
|
|
* a component that redeclares it will not load at all.
|
|
*/
|
|
public function save(): void
|
|
{
|
|
$this->validate();
|
|
|
|
$status = Password::broker()->reset(
|
|
[
|
|
'email' => $this->email,
|
|
'password' => $this->password,
|
|
'password_confirmation' => $this->password_confirmation,
|
|
'token' => $this->token,
|
|
],
|
|
function (User $user, string $password) {
|
|
$user->forceFill([
|
|
'password' => Hash::make($password),
|
|
// Every existing session dies with it. Whoever knew the old
|
|
// password may still be signed in somewhere, and a reset
|
|
// that leaves them there has fixed nothing.
|
|
'remember_token' => Str::random(60),
|
|
])->save();
|
|
|
|
event(new PasswordReset($user));
|
|
},
|
|
);
|
|
|
|
if ($status !== Password::PASSWORD_RESET) {
|
|
$this->addError('email', __($status));
|
|
|
|
return;
|
|
}
|
|
|
|
$this->done = true;
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
return view('livewire.auth.reset-password');
|
|
}
|
|
}
|