new funcionality

app/Http/Controllers/Auth/AuthController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Models\LoginEvent;
 use App\Models\User;
+use App\Support\TwoFactorVerification;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -73,33 +74,76 @@ class AuthController extends Controller
             'password' => ['required', 'string'],
         ]);
 
-        if (! Auth::attempt($credentials, $request->boolean('remember'))) {
+        // Auth::validate() (no attempt()): solo chequea credenciales, no
+        // loguea todavía — necesitamos poder frenar acá mismo si el usuario
+        // tiene 2FA activo, antes de que exista sesión autenticada.
+        if (! Auth::validate($credentials)) {
+            $this->recordFailedLogin($request);
+
             throw ValidationException::withMessages([
                 'email' => __('messages.invalid_credentials'),
             ]);
         }
 
-        if (! Auth::user()->is_active) {
-            Auth::logout();
+        $user = User::where('email', $credentials['email'])->first();
 
+        if (! $user->is_active) {
             throw ValidationException::withMessages([
                 'email' => __('messages.account_deactivated'),
             ]);
         }
 
-        if (Auth::user()->isPending()) {
-            Auth::logout();
-
+        if ($user->isPending()) {
             throw ValidationException::withMessages([
                 'email' => __('messages.account_pending_approval'),
             ]);
         }
 
+        if ($user->hasTwoFactorEnabled()) {
+            $request->session()->put('login.mfa_user_id', $user->id);
+            $request->session()->put('login.mfa_remember', $request->boolean('remember'));
+
+            return response()->json(['two_factor' => true]);
+        }
+
+        Auth::login($user, $request->boolean('remember'));
         $request->session()->regenerate();
-        $this->recordSessionLogin($request, Auth::user());
+        $this->recordSessionLogin($request, $user);
 
         return response()->json([
-            'user' => $this->present(Auth::user()),
+            'user' => $this->present($user),
+            'intended' => $request->session()->pull('url.intended'),
+        ]);
+    }
+
+    /**
+     * Segundo paso del login cuando el usuario tiene 2FA activo: recibe un
+     * código TOTP o de recuperación y, si es válido, recién ahí crea la sesión.
+     */
+    public function loginTwoFactor(Request $request)
+    {
+        $data = $request->validate([
+            'code' => ['required', 'string'],
+        ]);
+
+        $userId = $request->session()->get('login.mfa_user_id');
+        $user = $userId ? User::find($userId) : null;
+
+        if (! $user || ! TwoFactorVerification::verify($user, $data['code'])) {
+            throw ValidationException::withMessages([
+                'code' => __('messages.invalid_two_factor_code'),
+            ]);
+        }
+
+        $remember = $request->session()->pull('login.mfa_remember', false);
+        $request->session()->forget('login.mfa_user_id');
+
+        Auth::login($user, $remember);
+        $request->session()->regenerate();
+        $this->recordSessionLogin($request, $user);
+
+        return response()->json([
+            'user' => $this->present($user),
             'intended' => $request->session()->pull('url.intended'),
         ]);
     }
@@ -124,6 +168,23 @@ class AuthController extends Controller
             'user_id' => $user->id,
             'client_id' => null,
             'type' => 'session',
+            'outcome' => 'success',
+            'ip_address' => $request->ip(),
+            'user_agent' => $request->userAgent(),
+            'created_at' => now(),
+        ]);
+    }
+
+    // Solo credenciales inválidas (la señal relevante para detectar fuerza
+    // bruta) — cuenta desactivada o pendiente de aprobación no cuenta como
+    // "fallo" para esta métrica, son estados de cuenta, no intentos de ataque.
+    private function recordFailedLogin(Request $request): void
+    {
+        LoginEvent::create([
+            'user_id' => null,
+            'client_id' => null,
+            'type' => 'session',
+            'outcome' => 'failure',
             'ip_address' => $request->ip(),
             'user_agent' => $request->userAgent(),
             'created_at' => now(),
@@ -136,6 +197,7 @@ class AuthController extends Controller
             ...$user->toArray(),
             'roles' => $user->getRoleNames(),
             'permissions' => $user->getAllPermissions()->pluck('name'),
+            'two_factor_enabled' => $user->hasTwoFactorEnabled(),
         ];
     }
 }

app/Http/Controllers/Auth/PasswordResetController.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Models\User;
+use App\Support\UserSessions;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Validation\ValidationException;
+
+class PasswordResetController extends Controller
+{
+    /**
+     * Pide el link de restablecimiento. La respuesta es SIEMPRE la misma
+     * (exista o no una cuenta con ese email) — lo contrario permite
+     * enumerar cuentas registradas probando emails uno por uno.
+     */
+    public function forgotPassword(Request $request)
+    {
+        $request->validate(['email' => ['required', 'string', 'email']]);
+
+        Password::sendResetLink($request->only('email'));
+
+        return response()->json(['message' => __('messages.password_reset_link_sent')]);
+    }
+
+    /**
+     * Confirma el restablecimiento con el token del email. Si sale bien,
+     * cierra todas las sesiones OAuth activas de la cuenta — el motivo más
+     * común para resetear una contraseña es sospechar que se filtró, así
+     * que no tiene sentido dejar vigente lo que se emitió con la vieja.
+     */
+    public function resetPassword(Request $request)
+    {
+        $data = $request->validate([
+            'token' => ['required', 'string'],
+            'email' => ['required', 'string', 'email'],
+            'password' => ['required', 'string', 'min:8', 'confirmed'],
+        ]);
+
+        $status = Password::reset(
+            $data,
+            function (User $user, string $password) use ($request) {
+                $user->forceFill(['password' => Hash::make($password)])->save();
+
+                $revoked = UserSessions::revokeAll($user);
+
+                AuditLog::record($request, 'user.password_reset', 'user', $user->id, $user->email, [
+                    'sessions_revoked' => $revoked,
+                ]);
+            }
+        );
+
+        if ($status !== Password::PASSWORD_RESET) {
+            throw ValidationException::withMessages(['email' => __($status)]);
+        }
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/Auth/TwoFactorController.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+use PragmaRX\Google2FA\Google2FA;
+
+class TwoFactorController extends Controller
+{
+    /**
+     * Genera un secreto nuevo (pendiente de confirmar) y el QR para escanear.
+     * No queda "activo" hasta que se confirma con un código real (confirm()).
+     */
+    public function setup(Request $request)
+    {
+        $user = $request->user();
+
+        abort_if($user->hasTwoFactorEnabled(), 422, __('messages.two_factor_already_enabled'));
+
+        $google2fa = new Google2FA();
+        $secret = $google2fa->generateSecretKey();
+
+        $user->forceFill([
+            'two_factor_secret' => $secret,
+            'two_factor_recovery_codes' => null,
+            'two_factor_confirmed_at' => null,
+        ])->save();
+
+        return response()->json([
+            'secret' => $secret,
+            'otpauth_url' => $google2fa->getQRCodeUrl(config('app.name'), $user->email, $secret),
+        ]);
+    }
+
+    /**
+     * Confirma la activación con un código real de la app autenticadora.
+     * Recién acá se generan y devuelven los códigos de recuperación (una sola vez).
+     */
+    public function confirm(Request $request)
+    {
+        $data = $request->validate([
+            'code' => ['required', 'string'],
+        ]);
+
+        $user = $request->user();
+
+        abort_if(! $user->two_factor_secret, 422, __('messages.two_factor_not_pending'));
+
+        if (! (new Google2FA())->verifyKey($user->two_factor_secret, $data['code'])) {
+            throw ValidationException::withMessages([
+                'code' => __('messages.invalid_two_factor_code'),
+            ]);
+        }
+
+        $recoveryCodes = $this->generateRecoveryCodes();
+
+        $user->forceFill([
+            'two_factor_recovery_codes' => $recoveryCodes,
+            'two_factor_confirmed_at' => now(),
+        ])->save();
+
+        AuditLog::record($request, 'user.2fa_enabled', 'user', $user->id, $user->email);
+
+        return response()->json(['recovery_codes' => $recoveryCodes]);
+    }
+
+    public function disable(Request $request)
+    {
+        $data = $request->validate([
+            'password' => ['required', 'string'],
+        ]);
+
+        $user = $request->user();
+
+        if (! Hash::check($data['password'], $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => __('messages.invalid_password'),
+            ]);
+        }
+
+        $user->forceFill([
+            'two_factor_secret' => null,
+            'two_factor_recovery_codes' => null,
+            'two_factor_confirmed_at' => null,
+        ])->save();
+
+        AuditLog::record($request, 'user.2fa_disabled', 'user', $user->id, $user->email);
+
+        return response()->noContent();
+    }
+
+    /**
+     * Invalida los códigos de recuperación anteriores y genera un juego nuevo
+     * (una sola vez más, igual que en la confirmación inicial).
+     */
+    public function regenerateRecoveryCodes(Request $request)
+    {
+        $data = $request->validate([
+            'password' => ['required', 'string'],
+        ]);
+
+        $user = $request->user();
+
+        abort_unless($user->hasTwoFactorEnabled(), 422, __('messages.two_factor_not_enabled'));
+
+        if (! Hash::check($data['password'], $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => __('messages.invalid_password'),
+            ]);
+        }
+
+        $recoveryCodes = $this->generateRecoveryCodes();
+        $user->forceFill(['two_factor_recovery_codes' => $recoveryCodes])->save();
+
+        AuditLog::record($request, 'user.2fa_recovery_regenerated', 'user', $user->id, $user->email);
+
+        return response()->json(['recovery_codes' => $recoveryCodes]);
+    }
+
+    private function generateRecoveryCodes(): array
+    {
+        return collect(range(1, 8))
+            ->map(fn () => Str::upper(Str::random(4).'-'.Str::random(4)))
+            ->all();
+    }
+}