bert.hausmans
1028498705
- Add throttle middleware to login (5/min), portal/token-auth (10/min), volunteer-register (5/min), and invitation routes (10/min) - Set Sanctum token expiration to 7 days - Remove billing_status from UpdateOrganisationRequest (super_admin only) - Revoke all Sanctum tokens on password reset - Strengthen password rules: min 8 chars, mixed case, numbers - Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy) - Fix open redirect on all 3 login pages (validate ?to= starts with /) - Set APP_DEBUG=false in .env.example - Log failed login attempts with email, IP, user-agent - Log authorization failures (403) with user, IP, path, method - Harden mass assignment: remove user_id from Person, audit fields from ShiftAssignment, system fields from UserInvitation $fillable - Replace real DB records with factory make() in mail preview routes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
1.0 KiB
PHP
37 lines
1.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Api\V1;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Api\V1\LoginRequest;
|
|
use App\Http\Resources\Api\V1\UserResource;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\Log;
|
|
|
|
final class LoginController extends Controller
|
|
{
|
|
public function __invoke(LoginRequest $request): JsonResponse
|
|
{
|
|
if (!Auth::attempt($request->only('email', 'password'))) {
|
|
Log::warning('Failed login attempt', [
|
|
'email' => $request->validated('email'),
|
|
'ip' => $request->ip(),
|
|
'user_agent' => $request->userAgent(),
|
|
]);
|
|
|
|
return $this->unauthorized('Invalid credentials');
|
|
}
|
|
|
|
$user = Auth::user()->load(['organisations', 'roles']);
|
|
$token = $user->createToken('auth-token')->plainTextToken;
|
|
|
|
return $this->success([
|
|
'user' => new UserResource($user),
|
|
'token' => $token,
|
|
], 'Login successful');
|
|
}
|
|
}
|