From 5ab665321f247653d833f5d04ed386e2af1d9fba Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Mon, 15 Jun 2026 18:36:31 +0200
Subject: [PATCH] fix(security): tighten recovery-download grant window (reject
 stale/non-int/future)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 routes/web.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/routes/web.php b/routes/web.php
index 56e9815..ea3f3c3 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -64,7 +64,9 @@ Route::middleware('auth')->group(function () {
         // unused grant cannot linger and be replayed later in the session. ->block() below
         // serializes racing reads of the grant.
         $grantedAt = session()->pull('2fa.download_grant');
-        abort_unless(is_int($grantedAt) && now()->timestamp - $grantedAt <= 600, 403);
+        $age = is_int($grantedAt) ? now()->timestamp - $grantedAt : null;
+        // Valid only within [now-600s, now]: rejects stale, non-timestamp, and future grants.
+        abort_unless($age !== null && $age >= 0 && $age <= 600, 403);
 
         $codes = AuthFacade::user()->recoveryCodes();