125 lines
3.7 KiB
PHP
125 lines
3.7 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Auth;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Auth\LoginRequest;
|
|
use App\Models\User;
|
|
use App\Services\Auth\SecurityEventRecorder;
|
|
use App\Services\Auth\TwoFactorChallenge;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\ValidationException;
|
|
use Inertia\Inertia;
|
|
use Inertia\Response;
|
|
use RuntimeException;
|
|
|
|
class LoginController extends Controller
|
|
{
|
|
/**
|
|
* Display the login view.
|
|
*/
|
|
public function create(): Response
|
|
{
|
|
return Inertia::render('Auth/Login');
|
|
}
|
|
|
|
/**
|
|
* Handle an incoming authentication request.
|
|
*/
|
|
public function store(
|
|
LoginRequest $request,
|
|
TwoFactorChallenge $twoFactor,
|
|
SecurityEventRecorder $securityEvents
|
|
): RedirectResponse {
|
|
$login = $request->validated('login');
|
|
$password = $request->validated('password');
|
|
|
|
$isEmail = filter_var($login, FILTER_VALIDATE_EMAIL);
|
|
$email = $isEmail
|
|
? $login
|
|
: User::whereRaw('LOWER(username) = ?', [strtolower($login)])->value('email');
|
|
$credentials = ['email' => $email, 'password' => $password];
|
|
|
|
$remember = config('auth-ui.features.remember_me')
|
|
? $request->boolean('remember')
|
|
: false;
|
|
|
|
$provider = Auth::getProvider();
|
|
$user = $credentials['email']
|
|
? $provider->retrieveByCredentials($credentials)
|
|
: null;
|
|
|
|
try {
|
|
$credentialsAreValid = $user
|
|
? $provider->validateCredentials($user, $credentials)
|
|
: Hash::check($password, $this->dummyPasswordHash());
|
|
} catch (RuntimeException) {
|
|
$credentialsAreValid = false;
|
|
}
|
|
|
|
if (! $user || ! $credentialsAreValid) {
|
|
$securityEvents->record('login.password_failed', $user, $request, [
|
|
'login_hash' => hash('sha256', strtolower($login)),
|
|
]);
|
|
|
|
throw ValidationException::withMessages([
|
|
'login' => __('auth.failed'),
|
|
]);
|
|
}
|
|
|
|
if (config('hashing.rehash_on_login', true)
|
|
&& method_exists($provider, 'rehashPasswordIfRequired')) {
|
|
$provider->rehashPasswordIfRequired($user, $credentials);
|
|
}
|
|
|
|
if ($twoFactor->requiredFor($user)) {
|
|
$securityEvents->record('login.password_succeeded_pending_two_factor', $user, $request);
|
|
|
|
return $twoFactor->begin($request, $user, $remember);
|
|
}
|
|
|
|
Auth::login($user, $remember);
|
|
$request->session()->regenerate();
|
|
$securityEvents->record('login.succeeded', $user, $request);
|
|
|
|
if ($twoFactor->enrollmentRequiredFor($user)) {
|
|
$request->session()->put(
|
|
'url.intended',
|
|
config('auth-ui.redirects.login', '/')
|
|
);
|
|
|
|
return redirect()->route('two-factor.setup');
|
|
}
|
|
|
|
return redirect()->intended(config('auth-ui.redirects.login', '/'));
|
|
}
|
|
|
|
/**
|
|
* Destroy an authenticated session.
|
|
*/
|
|
public function destroy(Request $request): RedirectResponse
|
|
{
|
|
/** @var User|null $user */
|
|
$user = $request->user();
|
|
app(SecurityEventRecorder::class)->record('logout.succeeded', $user, $request);
|
|
|
|
Auth::logout();
|
|
|
|
$request->session()->invalidate();
|
|
$request->session()->regenerateToken();
|
|
|
|
return redirect(config('auth-ui.redirects.logout', '/'));
|
|
}
|
|
|
|
private function dummyPasswordHash(): string
|
|
{
|
|
static $hash;
|
|
|
|
return $hash ??= Hash::make(Str::random(64));
|
|
}
|
|
}
|