feat(auth): harden authentication and add configurable two-factor support

app/Providers/AppServiceProvider.php

@@ -2,7 +2,14 @@
 
 namespace App\Providers;
 
+use Illuminate\Auth\Events\Login;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rules\Password;
 use Laravel\Fortify\Fortify;
 
 class AppServiceProvider extends ServiceProvider
@@ -22,6 +29,73 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        //
+        Event::listen(Login::class, function (Login $event): void {
+            if (request()->hasSession()) {
+                request()->session()->put([
+                    'auth.session_version' => (int) $event->user->auth_session_version,
+                    'auth.absolute_expires_at' => now()->timestamp
+                        + config('auth-ui.security.absolute_session_lifetime'),
+                ]);
+            }
+        });
+
+        Password::defaults(function (): Password {
+            return Password::min(15)->max(128);
+        });
+
+        RateLimiter::for('auth.login', function (Request $request): array {
+            $login = Str::lower((string) $request->input('login'));
+
+            return [
+                Limit::perMinute(20)->by('login-ip:'.$request->ip()),
+                Limit::perMinutes(10, 10)->by('login-account:'.hash('sha256', $login)),
+            ];
+        });
+
+        RateLimiter::for('auth.two-factor', function (Request $request): array {
+            $userKey = $request->user()?->getAuthIdentifier()
+                ?? $request->session()->get('login.id')
+                ?? 'guest';
+
+            return [
+                Limit::perMinute(20)->by('two-factor-ip:'.$request->ip()),
+                Limit::perMinutes(5, 5)->by('two-factor-account:'.$userKey),
+            ];
+        });
+
+        RateLimiter::for('auth.password-email', function (Request $request): array {
+            $email = Str::lower((string) $request->input('email'));
+
+            return [
+                Limit::perMinutes(15, 20)->by('password-email-ip:'.$request->ip()),
+                Limit::perMinutes(15, 3)->by('password-email-account:'.hash('sha256', $email)),
+            ];
+        });
+
+        RateLimiter::for('auth.password-reset', function (Request $request): array {
+            $email = Str::lower((string) $request->input('email'));
+
+            return [
+                Limit::perMinutes(15, 20)->by('password-reset-ip:'.$request->ip()),
+                Limit::perMinutes(15, 5)->by('password-reset-account:'.hash('sha256', $email)),
+            ];
+        });
+
+        RateLimiter::for('auth.register', fn (Request $request): array => [
+            Limit::perHour(20)->by('register-ip:'.$request->ip()),
+        ]);
+
+        RateLimiter::for('auth.social', fn (Request $request): array => [
+            Limit::perMinute(20)->by('social-ip:'.$request->ip()),
+        ]);
+
+        RateLimiter::for('auth.account', function (Request $request): array {
+            $userKey = $request->user()?->getAuthIdentifier() ?? 'guest';
+
+            return [
+                Limit::perMinute(20)->by('account-action-ip:'.$request->ip()),
+                Limit::perMinutes(5, 6)->by('account-action-user:'.$userKey),
+            ];
+        });
     }
 }