82 lines
2.6 KiB
PHP
82 lines
2.6 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Auth;
|
|
|
|
use App\Models\AuditEvent;
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Validation\Rules\Password;
|
|
use Illuminate\Validation\ValidationException;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Component;
|
|
use PragmaRX\Google2FAQRCode\Google2FA;
|
|
|
|
#[Layout('layouts.auth')]
|
|
class ForgotPassword extends Component
|
|
{
|
|
public string $email = '';
|
|
|
|
public string $code = '';
|
|
|
|
public string $password = '';
|
|
|
|
public string $password_confirmation = '';
|
|
|
|
/** True when a real mailer is configured (then the email-link option is offered too). */
|
|
public function mailEnabled(): bool
|
|
{
|
|
return ! in_array(config('mail.default'), ['log', 'array', null], true);
|
|
}
|
|
|
|
/** Reset the password by proving 2FA possession (TOTP or a one-time backup code). */
|
|
public function resetPassword()
|
|
{
|
|
$this->validate([
|
|
'email' => ['required', 'email'],
|
|
'code' => ['required', 'string'],
|
|
'password' => ['required', 'confirmed', Password::min(12)->mixedCase()->numbers()],
|
|
]);
|
|
|
|
$key = 'forgot:'.md5(strtolower($this->email).'|'.request()->ip());
|
|
if (RateLimiter::tooManyAttempts($key, 5)) {
|
|
throw ValidationException::withMessages([
|
|
'code' => __('auth.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]),
|
|
]);
|
|
}
|
|
|
|
$user = User::where('email', $this->email)->first();
|
|
$clean = preg_replace('/\s+/', '', $this->code);
|
|
|
|
$ok = $user
|
|
&& $user->hasTwoFactorEnabled()
|
|
&& ((new Google2FA)->verifyKey($user->two_factor_secret, $clean) || $user->useRecoveryCode($this->code));
|
|
|
|
if (! $ok) {
|
|
RateLimiter::hit($key, 60);
|
|
// Generic message — never reveal whether the email exists.
|
|
throw ValidationException::withMessages(['code' => __('auth.reset_invalid')]);
|
|
}
|
|
|
|
RateLimiter::clear($key);
|
|
$user->forceFill(['password' => Hash::make($this->password), 'must_change_password' => false])->save();
|
|
|
|
AuditEvent::create([
|
|
'user_id' => $user->id,
|
|
'actor' => $user->name ?? 'system',
|
|
'action' => 'password.reset',
|
|
'target' => $user->email,
|
|
'ip' => request()->ip(),
|
|
]);
|
|
|
|
session()->flash('status', __('auth.reset_done'));
|
|
|
|
return $this->redirect(route('login'), navigate: true);
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
return view('livewire.auth.forgot-password')->title(__('auth.title_forgot'));
|
|
}
|
|
}
|