From cb8b906aa86b93bd4ab33e7225b2efded501a84d Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sun, 14 Jun 2026 16:55:01 +0200
Subject: [PATCH] feat(auth): forgot-password reset via 2FA or backup code

"Passwort vergessen?" on login -> a reset view that proves identity with a TOTP
or one-time backup code (no email needed), then sets a new password under the
min(12) mixedCase numbers policy. Rate-limited, generic messages (no account
enumeration), audited.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/Livewire/Auth/ForgotPassword.php          | 81 +++++++++++++++++++
 .../livewire/auth/forgot-password.blade.php   | 45 +++++++++++
 resources/views/livewire/auth/login.blade.php |  1 +
 routes/web.php                                |  1 +
 tests/Feature/ForgotPasswordTest.php          | 76 +++++++++++++++++
 5 files changed, 204 insertions(+)
 create mode 100644 app/Livewire/Auth/ForgotPassword.php
 create mode 100644 resources/views/livewire/auth/forgot-password.blade.php
 create mode 100644 tests/Feature/ForgotPasswordTest.php

diff --git a/app/Livewire/Auth/ForgotPassword.php b/app/Livewire/Auth/ForgotPassword.php
new file mode 100644
index 0000000..20f9fca
--- /dev/null
+++ b/app/Livewire/Auth/ForgotPassword.php
@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Livewire\Auth;
+
+use App\Models\AuditEvent;
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\Validation\ValidationException;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+use PragmaRX\Google2FAQRCode\Google2FA;
+
+#[Layout('layouts.auth')]
+class ForgotPassword extends Component
+{
+    public string $email = '';
+
+    public string $code = '';
+
+    public string $password = '';
+
+    public string $password_confirmation = '';
+
+    /** True when a real mailer is configured (then the email-link option is offered too). */
+    public function mailEnabled(): bool
+    {
+        return ! in_array(config('mail.default'), ['log', 'array', null], true);
+    }
+
+    /** Reset the password by proving 2FA possession (TOTP or a one-time backup code). */
+    public function resetPassword()
+    {
+        $this->validate([
+            'email' => ['required', 'email'],
+            'code' => ['required', 'string'],
+            'password' => ['required', 'confirmed', Password::min(12)->mixedCase()->numbers()],
+        ]);
+
+        $key = 'forgot:'.md5(strtolower($this->email).'|'.request()->ip());
+        if (RateLimiter::tooManyAttempts($key, 5)) {
+            throw ValidationException::withMessages([
+                'code' => __('auth.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]),
+            ]);
+        }
+
+        $user = User::where('email', $this->email)->first();
+        $clean = preg_replace('/\s+/', '', $this->code);
+
+        $ok = $user
+            && $user->hasTwoFactorEnabled()
+            && ((new Google2FA)->verifyKey($user->two_factor_secret, $clean) || $user->useRecoveryCode($this->code));
+
+        if (! $ok) {
+            RateLimiter::hit($key, 60);
+            // Generic message — never reveal whether the email exists.
+            throw ValidationException::withMessages(['code' => __('auth.reset_invalid')]);
+        }
+
+        RateLimiter::clear($key);
+        $user->forceFill(['password' => Hash::make($this->password), 'must_change_password' => false])->save();
+
+        AuditEvent::create([
+            'user_id' => $user->id,
+            'actor' => $user->name ?? 'system',
+            'action' => 'password.reset',
+            'target' => $user->email,
+            'ip' => request()->ip(),
+        ]);
+
+        session()->flash('status', __('auth.reset_done'));
+
+        return $this->redirect(route('login'), navigate: true);
+    }
+
+    public function render()
+    {
+        return view('livewire.auth.forgot-password')->title(__('auth.title_forgot'));
+    }
+}
diff --git a/resources/views/livewire/auth/forgot-password.blade.php b/resources/views/livewire/auth/forgot-password.blade.php
new file mode 100644
index 0000000..789c32e
--- /dev/null
+++ b/resources/views/livewire/auth/forgot-password.blade.php
@@ -0,0 +1,45 @@
+@php
+    $label = 'mb-1.5 block font-mono text-[11px] uppercase tracking-wider text-ink-3';
+    $field = 'h-11 w-full rounded-md border border-line bg-inset px-3 text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none';
+    $err = 'mt-1.5 flex items-center gap-1.5 font-mono text-[11px] text-offline';
+@endphp
+<div class="space-y-5">
+    <div>
+        <p class="font-mono text-[11px] uppercase tracking-[0.2em] text-accent-text">{{ __('auth.security') }}</p>
+        <h1 class="mt-1 font-display text-2xl font-semibold text-ink">{{ __('auth.forgot_heading') }}</h1>
+        <p class="mt-1.5 text-sm text-ink-2">{{ __('auth.forgot_subtitle') }}</p>
+    </div>
+
+    <form wire:submit="resetPassword" class="space-y-4">
+        <div>
+            <label for="email" class="{{ $label }}">{{ __('auth.email') }}</label>
+            <input wire:model="email" id="email" type="email" autocomplete="username" class="{{ $field }}" placeholder="admin@clusev.local" />
+            @error('email') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+        </div>
+        <div>
+            <label for="code" class="{{ $label }}">{{ __('auth.forgot_code') }}</label>
+            <input wire:model="code" id="code" type="text" inputmode="text" autocomplete="one-time-code" class="{{ $field }} font-mono" placeholder="123456 / xxxxxxxxxx-xxxxxxxxxx" />
+            @error('code') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+            <p class="mt-1.5 font-mono text-[11px] text-ink-4">{{ __('auth.forgot_code_hint') }}</p>
+        </div>
+        <div>
+            <label for="password" class="{{ $label }}">{{ __('auth.new_password') }}</label>
+            <input wire:model="password" id="password" type="password" autocomplete="new-password" class="{{ $field }}" placeholder="••••••••" />
+            @error('password') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+        </div>
+        <div>
+            <label for="password_confirmation" class="{{ $label }}">{{ __('auth.confirm_new_password') }}</label>
+            <input wire:model="password_confirmation" id="password_confirmation" type="password" autocomplete="new-password" class="{{ $field }}" placeholder="••••••••" />
+        </div>
+        <x-btn variant="primary" size="lg" type="submit" class="w-full" wire:loading.attr="disabled" wire:target="resetPassword">
+            <span wire:loading.remove wire:target="resetPassword">{{ __('auth.forgot_submit') }}</span>
+            <span wire:loading wire:target="resetPassword">{{ __('auth.saving') }}</span>
+        </x-btn>
+    </form>
+
+    @if ($this->mailEnabled())
+        <x-btn variant="secondary" class="w-full" wire:click="sendResetLink">{{ __('auth.forgot_send_email') }}</x-btn>
+    @endif
+
+    <a href="{{ route('login') }}" wire:navigate class="block text-center font-mono text-[11px] text-ink-3 transition-colors hover:text-ink-2">{{ __('auth.back_to_login') }}</a>
+</div>
diff --git a/resources/views/livewire/auth/login.blade.php b/resources/views/livewire/auth/login.blade.php
index ac8a847..4f89cc1 100644
--- a/resources/views/livewire/auth/login.blade.php
+++ b/resources/views/livewire/auth/login.blade.php
@@ -24,6 +24,7 @@
             <input wire:model="password" id="password" type="password" autocomplete="current-password"
                    class="{{ $field }}" placeholder="••••••••" />
             @error('password') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+            <a href="{{ route('password.request') }}" wire:navigate class="mt-1.5 block font-mono text-[11px] text-ink-3 transition-colors hover:text-accent-text">{{ __('auth.forgot_link') }}</a>
         </div>
 
         <label class="flex items-center gap-2 font-mono text-xs text-ink-2">
diff --git a/routes/web.php b/routes/web.php
index d2dae66..bb6b191 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -43,6 +43,7 @@ Route::get('/_caddy/ask', function (Request $request, DeploymentService $deploym
 
 Route::middleware('guest')->group(function () {
     Route::get('/login', Auth\Login::class)->name('login');
+    Route::get('/forgot-password', Auth\ForgotPassword::class)->name('password.request');
     Route::get('/two-factor-challenge', Auth\TwoFactorChallenge::class)->name('two-factor.challenge');
 });
 
diff --git a/tests/Feature/ForgotPasswordTest.php b/tests/Feature/ForgotPasswordTest.php
new file mode 100644
index 0000000..2dce51d
--- /dev/null
+++ b/tests/Feature/ForgotPasswordTest.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Livewire\Auth\ForgotPassword;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Livewire\Livewire;
+use PragmaRX\Google2FAQRCode\Google2FA;
+use Tests\TestCase;
+
+class ForgotPasswordTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function user(): User
+    {
+        return User::factory()->create([
+            'email' => 'admin@clusev.local',
+            'two_factor_secret' => (new Google2FA)->generateSecretKey(),
+            'two_factor_confirmed_at' => now(),
+        ]);
+    }
+
+    public function test_totp_resets_password(): void
+    {
+        $user = $this->user();
+        $otp = (new Google2FA)->getCurrentOtp($user->two_factor_secret);
+
+        Livewire::test(ForgotPassword::class)
+            ->set('email', $user->email)->set('code', $otp)
+            ->set('password', 'NewPassw0rd123')->set('password_confirmation', 'NewPassw0rd123')
+            ->call('resetPassword')->assertHasNoErrors();
+
+        $this->assertTrue(Hash::check('NewPassw0rd123', $user->fresh()->password));
+    }
+
+    public function test_backup_code_resets_and_is_consumed(): void
+    {
+        $user = $this->user();
+        $code = $user->replaceRecoveryCodes()[0];
+
+        Livewire::test(ForgotPassword::class)
+            ->set('email', $user->email)->set('code', $code)
+            ->set('password', 'NewPassw0rd123')->set('password_confirmation', 'NewPassw0rd123')
+            ->call('resetPassword')->assertHasNoErrors();
+
+        $this->assertTrue(Hash::check('NewPassw0rd123', $user->fresh()->password));
+        $this->assertFalse($user->fresh()->useRecoveryCode($code));
+    }
+
+    public function test_wrong_code_does_not_reset(): void
+    {
+        $user = $this->user();
+        $old = $user->password;
+
+        Livewire::test(ForgotPassword::class)
+            ->set('email', $user->email)->set('code', '000000')
+            ->set('password', 'NewPassw0rd123')->set('password_confirmation', 'NewPassw0rd123')
+            ->call('resetPassword')->assertHasErrors('code');
+
+        $this->assertSame($old, $user->fresh()->password);
+    }
+
+    public function test_weak_password_rejected(): void
+    {
+        $user = $this->user();
+        $otp = (new Google2FA)->getCurrentOtp($user->two_factor_secret);
+
+        Livewire::test(ForgotPassword::class)
+            ->set('email', $user->email)->set('code', $otp)
+            ->set('password', 'short')->set('password_confirmation', 'short')
+            ->call('resetPassword')->assertHasErrors('password');
+    }
+}