feat(auth): harden authentication and add configurable two-factor support

app/Http/Controllers/Auth/ResetPasswordController.php

@@ -4,9 +4,13 @@ namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Auth\ResetPasswordRequest;
+use App\Models\User;
+use App\Notifications\PasswordChangedNotification;
+use App\Services\Auth\SecurityEventRecorder;
 use Illuminate\Auth\Events\PasswordReset;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Password;
 use Illuminate\Support\Str;
 use Inertia\Inertia;
@@ -32,21 +36,39 @@ class ResetPasswordController extends Controller
     /**
      * Handle an incoming new password request.
      */
-    public function store(ResetPasswordRequest $request): RedirectResponse
-    {
+    public function store(
+        ResetPasswordRequest $request,
+        SecurityEventRecorder $securityEvents
+    ): RedirectResponse {
+        $resetUser = null;
         $status = Password::reset(
             $request->validated(),
-            function ($user, string $password): void {
+            function (User $user, string $password) use ($request, &$resetUser): void {
                 $user->forceFill([
                     'password' => $password,
                     'remember_token' => Str::random(60),
+                    'auth_session_version' => $user->auth_session_version + 1,
                 ])->save();
 
+                if (config('session.driver') === 'database') {
+                    DB::table(config('session.table'))
+                        ->where('user_id', $user->getKey())
+                        ->delete();
+                }
+
+                $user->notify(new PasswordChangedNotification(
+                    (string) $request->ip(),
+                    now()->toIso8601String()
+                ));
+                $resetUser = $user;
+
                 event(new PasswordReset($user));
             }
         );
 
         if ($status === Password::PASSWORD_RESET) {
+            $securityEvents->record('password_reset.completed', $resetUser, $request);
+
             return redirect()->route('login')->with('status', __($status));
         }