feat(auth): guests-only BlockBannedIp middleware + 403 page

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Http/Middleware/BlockBannedIp.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\BruteforceGuard;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Hard-blocks GUEST requests from a banned IP (403). Authenticated requests pass, so an
+ * operator already logged in is never cut off mid-session and can unban their own IP from
+ * the Anmeldeschutz tab. Appended to the web group so Auth::guest() resolves (the session
+ * middleware has run). request()->ip() is correct via the global trustProxies (prod).
+ */
+class BlockBannedIp
+{
+    public function __construct(private BruteforceGuard $guard) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($this->guard->enabled() && Auth::guest() && $this->guard->isBanned((string) $request->ip())) {
+            return response()->view('errors.blocked', [], 403);
+        }
+
+        return $next($request);
+    }
+}

bootstrap/app.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Middleware\BlockBannedIp;
 use App\Http\Middleware\PanelScheme;
 use App\Http\Middleware\SecurityHeaders;
 use App\Http\Middleware\SetLocale;
@@ -39,7 +40,7 @@ return Application::configure(basePath: dirname(__DIR__))
         // database session driver makes those sessions enumerable/revocable in Settings.
         $middleware->web(
             prepend: [PanelScheme::class],
-            append: [SetLocale::class, SecurityHeaders::class, AuthenticateSession::class],
+            append: [SetLocale::class, SecurityHeaders::class, AuthenticateSession::class, BlockBannedIp::class],
         );
     })
     ->withExceptions(function (Exceptions $exceptions): void {

lang/de/errors.php

@@ -23,4 +23,7 @@ return [
 
     '503_title' => 'Wartungsmodus',
     '503_body' => 'Clusev wird gerade gewartet. Bitte in Kürze erneut versuchen.',
+
+    'blocked_title' => 'Zugriff vorübergehend gesperrt',
+    'blocked_body' => 'Zu viele fehlgeschlagene Anmeldeversuche aus deinem Netzwerk. Bitte später erneut versuchen.',
 ];

lang/en/errors.php

@@ -23,4 +23,7 @@ return [
 
     '503_title' => 'Down for maintenance',
     '503_body' => 'Clusev is undergoing maintenance. Please check back shortly.',
+
+    'blocked_title' => 'Access temporarily blocked',
+    'blocked_body' => 'Too many failed sign-in attempts from your network. Please try again later.',
 ];

resources/views/errors/blocked.blade.php

@@ -0,0 +1,4 @@
+@extends('errors.layout', ['title' => __('errors.blocked_title')])
+@section('code', '403')
+@section('heading', __('errors.blocked_title'))
+@section('message', __('errors.blocked_body'))

tests/Feature/BlockBannedIpMiddlewareTest.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\BannedIp;
+use App\Models\Setting;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Tests\TestCase;
+
+class BlockBannedIpMiddlewareTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Cache::flush();
+    }
+
+    private function banned(string $ip = '203.0.113.5'): void
+    {
+        BannedIp::create(['ip' => $ip, 'banned_until' => now()->addHour(), 'attempts' => 10]);
+    }
+
+    public function test_guest_from_banned_ip_is_blocked_with_403(): void
+    {
+        $this->banned();
+        $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.5'])
+            ->get('/login')
+            ->assertStatus(403)
+            ->assertSee(__('errors.blocked_title'));
+    }
+
+    public function test_guest_from_clean_ip_passes(): void
+    {
+        $this->banned();
+        $this->withServerVariables(['REMOTE_ADDR' => '198.51.100.9'])->get('/login')->assertStatus(200);
+    }
+
+    public function test_authenticated_user_from_banned_ip_passes(): void
+    {
+        $this->banned();
+        $user = User::factory()->create(['must_change_password' => false]);
+        $this->actingAs($user)
+            ->withServerVariables(['REMOTE_ADDR' => '203.0.113.5'])
+            ->get('/')
+            ->assertSuccessful();
+    }
+
+    public function test_feature_disabled_lets_banned_ip_through(): void
+    {
+        Setting::put('bruteforce_enabled', '0');
+        $this->banned();
+        $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.5'])->get('/login')->assertStatus(200);
+    }
+}