feat(auth): forgot-password reset via 2FA or backup code
"Passwort vergessen?" on login -> a reset view that proves identity with a TOTP or one-time backup code (no email needed), then sets a new password under the min(12) mixedCase numbers policy. Rate-limited, generic messages (no account enumeration), audited. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>feat/v1-foundation
boban
parent
764e1e5e53
commit
cb8b906aa8
|
|
@ -0,0 +1,81 @@
|
|||
<?php
|
||||
|
||||
namespace App\Livewire\Auth;
|
||||
|
||||
use App\Models\AuditEvent;
|
||||
use App\Models\User;
|
||||
use Illuminate\Support\Facades\Hash;
|
||||
use Illuminate\Support\Facades\RateLimiter;
|
||||
use Illuminate\Validation\Rules\Password;
|
||||
use Illuminate\Validation\ValidationException;
|
||||
use Livewire\Attributes\Layout;
|
||||
use Livewire\Component;
|
||||
use PragmaRX\Google2FAQRCode\Google2FA;
|
||||
|
||||
#[Layout('layouts.auth')]
|
||||
class ForgotPassword extends Component
|
||||
{
|
||||
public string $email = '';
|
||||
|
||||
public string $code = '';
|
||||
|
||||
public string $password = '';
|
||||
|
||||
public string $password_confirmation = '';
|
||||
|
||||
/** True when a real mailer is configured (then the email-link option is offered too). */
|
||||
public function mailEnabled(): bool
|
||||
{
|
||||
return ! in_array(config('mail.default'), ['log', 'array', null], true);
|
||||
}
|
||||
|
||||
/** Reset the password by proving 2FA possession (TOTP or a one-time backup code). */
|
||||
public function resetPassword()
|
||||
{
|
||||
$this->validate([
|
||||
'email' => ['required', 'email'],
|
||||
'code' => ['required', 'string'],
|
||||
'password' => ['required', 'confirmed', Password::min(12)->mixedCase()->numbers()],
|
||||
]);
|
||||
|
||||
$key = 'forgot:'.md5(strtolower($this->email).'|'.request()->ip());
|
||||
if (RateLimiter::tooManyAttempts($key, 5)) {
|
||||
throw ValidationException::withMessages([
|
||||
'code' => __('auth.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]),
|
||||
]);
|
||||
}
|
||||
|
||||
$user = User::where('email', $this->email)->first();
|
||||
$clean = preg_replace('/\s+/', '', $this->code);
|
||||
|
||||
$ok = $user
|
||||
&& $user->hasTwoFactorEnabled()
|
||||
&& ((new Google2FA)->verifyKey($user->two_factor_secret, $clean) || $user->useRecoveryCode($this->code));
|
||||
|
||||
if (! $ok) {
|
||||
RateLimiter::hit($key, 60);
|
||||
// Generic message — never reveal whether the email exists.
|
||||
throw ValidationException::withMessages(['code' => __('auth.reset_invalid')]);
|
||||
}
|
||||
|
||||
RateLimiter::clear($key);
|
||||
$user->forceFill(['password' => Hash::make($this->password), 'must_change_password' => false])->save();
|
||||
|
||||
AuditEvent::create([
|
||||
'user_id' => $user->id,
|
||||
'actor' => $user->name ?? 'system',
|
||||
'action' => 'password.reset',
|
||||
'target' => $user->email,
|
||||
'ip' => request()->ip(),
|
||||
]);
|
||||
|
||||
session()->flash('status', __('auth.reset_done'));
|
||||
|
||||
return $this->redirect(route('login'), navigate: true);
|
||||
}
|
||||
|
||||
public function render()
|
||||
{
|
||||
return view('livewire.auth.forgot-password')->title(__('auth.title_forgot'));
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
@php
|
||||
$label = 'mb-1.5 block font-mono text-[11px] uppercase tracking-wider text-ink-3';
|
||||
$field = 'h-11 w-full rounded-md border border-line bg-inset px-3 text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none';
|
||||
$err = 'mt-1.5 flex items-center gap-1.5 font-mono text-[11px] text-offline';
|
||||
@endphp
|
||||
<div class="space-y-5">
|
||||
<div>
|
||||
<p class="font-mono text-[11px] uppercase tracking-[0.2em] text-accent-text">{{ __('auth.security') }}</p>
|
||||
<h1 class="mt-1 font-display text-2xl font-semibold text-ink">{{ __('auth.forgot_heading') }}</h1>
|
||||
<p class="mt-1.5 text-sm text-ink-2">{{ __('auth.forgot_subtitle') }}</p>
|
||||
</div>
|
||||
|
||||
<form wire:submit="resetPassword" class="space-y-4">
|
||||
<div>
|
||||
<label for="email" class="{{ $label }}">{{ __('auth.email') }}</label>
|
||||
<input wire:model="email" id="email" type="email" autocomplete="username" class="{{ $field }}" placeholder="admin@clusev.local" />
|
||||
@error('email') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
|
||||
</div>
|
||||
<div>
|
||||
<label for="code" class="{{ $label }}">{{ __('auth.forgot_code') }}</label>
|
||||
<input wire:model="code" id="code" type="text" inputmode="text" autocomplete="one-time-code" class="{{ $field }} font-mono" placeholder="123456 / xxxxxxxxxx-xxxxxxxxxx" />
|
||||
@error('code') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
|
||||
<p class="mt-1.5 font-mono text-[11px] text-ink-4">{{ __('auth.forgot_code_hint') }}</p>
|
||||
</div>
|
||||
<div>
|
||||
<label for="password" class="{{ $label }}">{{ __('auth.new_password') }}</label>
|
||||
<input wire:model="password" id="password" type="password" autocomplete="new-password" class="{{ $field }}" placeholder="••••••••" />
|
||||
@error('password') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
|
||||
</div>
|
||||
<div>
|
||||
<label for="password_confirmation" class="{{ $label }}">{{ __('auth.confirm_new_password') }}</label>
|
||||
<input wire:model="password_confirmation" id="password_confirmation" type="password" autocomplete="new-password" class="{{ $field }}" placeholder="••••••••" />
|
||||
</div>
|
||||
<x-btn variant="primary" size="lg" type="submit" class="w-full" wire:loading.attr="disabled" wire:target="resetPassword">
|
||||
<span wire:loading.remove wire:target="resetPassword">{{ __('auth.forgot_submit') }}</span>
|
||||
<span wire:loading wire:target="resetPassword">{{ __('auth.saving') }}</span>
|
||||
</x-btn>
|
||||
</form>
|
||||
|
||||
@if ($this->mailEnabled())
|
||||
<x-btn variant="secondary" class="w-full" wire:click="sendResetLink">{{ __('auth.forgot_send_email') }}</x-btn>
|
||||
@endif
|
||||
|
||||
<a href="{{ route('login') }}" wire:navigate class="block text-center font-mono text-[11px] text-ink-3 transition-colors hover:text-ink-2">{{ __('auth.back_to_login') }}</a>
|
||||
</div>
|
||||
|
|
@ -24,6 +24,7 @@
|
|||
<input wire:model="password" id="password" type="password" autocomplete="current-password"
|
||||
class="{{ $field }}" placeholder="••••••••" />
|
||||
@error('password') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
|
||||
<a href="{{ route('password.request') }}" wire:navigate class="mt-1.5 block font-mono text-[11px] text-ink-3 transition-colors hover:text-accent-text">{{ __('auth.forgot_link') }}</a>
|
||||
</div>
|
||||
|
||||
<label class="flex items-center gap-2 font-mono text-xs text-ink-2">
|
||||
|
|
|
|||
|
|
@ -43,6 +43,7 @@ Route::get('/_caddy/ask', function (Request $request, DeploymentService $deploym
|
|||
|
||||
Route::middleware('guest')->group(function () {
|
||||
Route::get('/login', Auth\Login::class)->name('login');
|
||||
Route::get('/forgot-password', Auth\ForgotPassword::class)->name('password.request');
|
||||
Route::get('/two-factor-challenge', Auth\TwoFactorChallenge::class)->name('two-factor.challenge');
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,76 @@
|
|||
<?php
|
||||
|
||||
namespace Tests\Feature;
|
||||
|
||||
use App\Livewire\Auth\ForgotPassword;
|
||||
use App\Models\User;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Illuminate\Support\Facades\Hash;
|
||||
use Livewire\Livewire;
|
||||
use PragmaRX\Google2FAQRCode\Google2FA;
|
||||
use Tests\TestCase;
|
||||
|
||||
class ForgotPasswordTest extends TestCase
|
||||
{
|
||||
use RefreshDatabase;
|
||||
|
||||
private function user(): User
|
||||
{
|
||||
return User::factory()->create([
|
||||
'email' => 'admin@clusev.local',
|
||||
'two_factor_secret' => (new Google2FA)->generateSecretKey(),
|
||||
'two_factor_confirmed_at' => now(),
|
||||
]);
|
||||
}
|
||||
|
||||
public function test_totp_resets_password(): void
|
||||
{
|
||||
$user = $this->user();
|
||||
$otp = (new Google2FA)->getCurrentOtp($user->two_factor_secret);
|
||||
|
||||
Livewire::test(ForgotPassword::class)
|
||||
->set('email', $user->email)->set('code', $otp)
|
||||
->set('password', 'NewPassw0rd123')->set('password_confirmation', 'NewPassw0rd123')
|
||||
->call('resetPassword')->assertHasNoErrors();
|
||||
|
||||
$this->assertTrue(Hash::check('NewPassw0rd123', $user->fresh()->password));
|
||||
}
|
||||
|
||||
public function test_backup_code_resets_and_is_consumed(): void
|
||||
{
|
||||
$user = $this->user();
|
||||
$code = $user->replaceRecoveryCodes()[0];
|
||||
|
||||
Livewire::test(ForgotPassword::class)
|
||||
->set('email', $user->email)->set('code', $code)
|
||||
->set('password', 'NewPassw0rd123')->set('password_confirmation', 'NewPassw0rd123')
|
||||
->call('resetPassword')->assertHasNoErrors();
|
||||
|
||||
$this->assertTrue(Hash::check('NewPassw0rd123', $user->fresh()->password));
|
||||
$this->assertFalse($user->fresh()->useRecoveryCode($code));
|
||||
}
|
||||
|
||||
public function test_wrong_code_does_not_reset(): void
|
||||
{
|
||||
$user = $this->user();
|
||||
$old = $user->password;
|
||||
|
||||
Livewire::test(ForgotPassword::class)
|
||||
->set('email', $user->email)->set('code', '000000')
|
||||
->set('password', 'NewPassw0rd123')->set('password_confirmation', 'NewPassw0rd123')
|
||||
->call('resetPassword')->assertHasErrors('code');
|
||||
|
||||
$this->assertSame($old, $user->fresh()->password);
|
||||
}
|
||||
|
||||
public function test_weak_password_rejected(): void
|
||||
{
|
||||
$user = $this->user();
|
||||
$otp = (new Google2FA)->getCurrentOtp($user->two_factor_secret);
|
||||
|
||||
Livewire::test(ForgotPassword::class)
|
||||
->set('email', $user->email)->set('code', $otp)
|
||||
->set('password', 'short')->set('password_confirmation', 'short')
|
||||
->call('resetPassword')->assertHasErrors('password');
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue