feat(auth): harden authentication and add configurable two-factor support

app/Http/Controllers/Auth/ForgotPasswordController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Auth\ForgotPasswordRequest;
+use App\Services\Auth\SecurityEventRecorder;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Support\Facades\Password;
 use Inertia\Inertia;
@@ -26,16 +27,20 @@ class ForgotPasswordController extends Controller
     /**
      * Handle an incoming password reset link request.
      */
-    public function store(ForgotPasswordRequest $request): RedirectResponse
-    {
-        $status = Password::sendResetLink(
+    public function store(
+        ForgotPasswordRequest $request,
+        SecurityEventRecorder $securityEvents
+    ): RedirectResponse {
+        Password::sendResetLink(
             $request->validated()
         );
+        $securityEvents->record('password_reset.requested', null, $request, [
+            'email_hash' => hash('sha256', strtolower($request->validated('email'))),
+        ]);
 
-        if ($status === Password::RESET_LINK_SENT) {
-            return back()->with('status', __($status));
-        }
-
-        return back()->withErrors(['email' => __($status)]);
+        return back()->with(
+            'status',
+            'If an account exists for that email address, a password reset link has been sent.'
+        );
     }
 }