feat(auth): harden authentication and add configurable two-factor support

app/Http/Controllers/Auth/LoginController.php

@@ -5,13 +5,17 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Auth\LoginRequest;
 use App\Models\User;
+use App\Services\Auth\SecurityEventRecorder;
 use App\Services\Auth\TwoFactorChallenge;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
 use Illuminate\Validation\ValidationException;
 use Inertia\Inertia;
 use Inertia\Response;
+use RuntimeException;
 
 class LoginController extends Controller
 {
@@ -26,8 +30,11 @@ class LoginController extends Controller
     /**
      * Handle an incoming authentication request.
      */
-    public function store(LoginRequest $request, TwoFactorChallenge $twoFactor): RedirectResponse
-    {
+    public function store(
+        LoginRequest $request,
+        TwoFactorChallenge $twoFactor,
+        SecurityEventRecorder $securityEvents
+    ): RedirectResponse {
         $login = $request->validated('login');
         $password = $request->validated('password');
 
@@ -46,7 +53,19 @@ class LoginController extends Controller
             ? $provider->retrieveByCredentials($credentials)
             : null;
 
-        if (! $user || ! $provider->validateCredentials($user, $credentials)) {
+        try {
+            $credentialsAreValid = $user
+                ? $provider->validateCredentials($user, $credentials)
+                : Hash::check($password, $this->dummyPasswordHash());
+        } catch (RuntimeException) {
+            $credentialsAreValid = false;
+        }
+
+        if (! $user || ! $credentialsAreValid) {
+            $securityEvents->record('login.password_failed', $user, $request, [
+                'login_hash' => hash('sha256', strtolower($login)),
+            ]);
+
             throw ValidationException::withMessages([
                 'login' => __('auth.failed'),
             ]);
@@ -58,11 +77,23 @@ class LoginController extends Controller
         }
 
         if ($twoFactor->requiredFor($user)) {
+            $securityEvents->record('login.password_succeeded_pending_two_factor', $user, $request);
+
             return $twoFactor->begin($request, $user, $remember);
         }
 
         Auth::login($user, $remember);
         $request->session()->regenerate();
+        $securityEvents->record('login.succeeded', $user, $request);
+
+        if ($twoFactor->enrollmentRequiredFor($user)) {
+            $request->session()->put(
+                'url.intended',
+                config('auth-ui.redirects.login', '/')
+            );
+
+            return redirect()->route('two-factor.setup');
+        }
 
         return redirect()->intended(config('auth-ui.redirects.login', '/'));
     }
@@ -72,6 +103,10 @@ class LoginController extends Controller
      */
     public function destroy(Request $request): RedirectResponse
     {
+        /** @var User|null $user */
+        $user = $request->user();
+        app(SecurityEventRecorder::class)->record('logout.succeeded', $user, $request);
+
         Auth::logout();
 
         $request->session()->invalidate();
@@ -79,4 +114,11 @@ class LoginController extends Controller
 
         return redirect(config('auth-ui.redirects.logout', '/'));
     }
+
+    private function dummyPasswordHash(): string
+    {
+        static $hash;
+
+        return $hash ??= Hash::make(Str::random(64));
+    }
 }