bert.hausmans
948687f27e
Three verification methods (TOTP authenticator, email code, backup codes), trusted device management with 30-day expiry, role-based enforcement for super_admin and org_admin, admin reset capability, and full test coverage (46 tests). Modifies login flow to support MFA challenge/response with temporary session tokens stored in cache. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
34 lines
898 B
PHP
34 lines
898 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Requests\Api\V1\Auth;
|
|
|
|
use App\Enums\MfaMethod;
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
use Illuminate\Validation\Rule;
|
|
|
|
final class MfaVerifyRequest extends FormRequest
|
|
{
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
public function rules(): array
|
|
{
|
|
return [
|
|
'mfa_session_token' => ['required', 'string'],
|
|
'code' => ['required', 'string'],
|
|
'method' => ['required', 'string', Rule::in([
|
|
MfaMethod::TOTP->value,
|
|
MfaMethod::EMAIL->value,
|
|
MfaMethod::BACKUP_CODE->value,
|
|
])],
|
|
'trust_device' => ['sometimes', 'boolean'],
|
|
'device_fingerprint' => ['required_if:trust_device,true', 'nullable', 'string'],
|
|
'device_name' => ['nullable', 'string', 'max:255'],
|
|
];
|
|
}
|
|
}
|