new funcionality

app/Http/Controllers/Auth/AuthController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Models\LoginEvent;
 use App\Models\User;
+use App\Support\TwoFactorVerification;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -73,33 +74,76 @@ class AuthController extends Controller
             'password' => ['required', 'string'],
         ]);
 
-        if (! Auth::attempt($credentials, $request->boolean('remember'))) {
+        // Auth::validate() (no attempt()): solo chequea credenciales, no
+        // loguea todavía — necesitamos poder frenar acá mismo si el usuario
+        // tiene 2FA activo, antes de que exista sesión autenticada.
+        if (! Auth::validate($credentials)) {
+            $this->recordFailedLogin($request);
+
             throw ValidationException::withMessages([
                 'email' => __('messages.invalid_credentials'),
             ]);
         }
 
-        if (! Auth::user()->is_active) {
-            Auth::logout();
+        $user = User::where('email', $credentials['email'])->first();
 
+        if (! $user->is_active) {
             throw ValidationException::withMessages([
                 'email' => __('messages.account_deactivated'),
             ]);
         }
 
-        if (Auth::user()->isPending()) {
-            Auth::logout();
-
+        if ($user->isPending()) {
             throw ValidationException::withMessages([
                 'email' => __('messages.account_pending_approval'),
             ]);
         }
 
+        if ($user->hasTwoFactorEnabled()) {
+            $request->session()->put('login.mfa_user_id', $user->id);
+            $request->session()->put('login.mfa_remember', $request->boolean('remember'));
+
+            return response()->json(['two_factor' => true]);
+        }
+
+        Auth::login($user, $request->boolean('remember'));
         $request->session()->regenerate();
-        $this->recordSessionLogin($request, Auth::user());
+        $this->recordSessionLogin($request, $user);
 
         return response()->json([
-            'user' => $this->present(Auth::user()),
+            'user' => $this->present($user),
+            'intended' => $request->session()->pull('url.intended'),
+        ]);
+    }
+
+    /**
+     * Segundo paso del login cuando el usuario tiene 2FA activo: recibe un
+     * código TOTP o de recuperación y, si es válido, recién ahí crea la sesión.
+     */
+    public function loginTwoFactor(Request $request)
+    {
+        $data = $request->validate([
+            'code' => ['required', 'string'],
+        ]);
+
+        $userId = $request->session()->get('login.mfa_user_id');
+        $user = $userId ? User::find($userId) : null;
+
+        if (! $user || ! TwoFactorVerification::verify($user, $data['code'])) {
+            throw ValidationException::withMessages([
+                'code' => __('messages.invalid_two_factor_code'),
+            ]);
+        }
+
+        $remember = $request->session()->pull('login.mfa_remember', false);
+        $request->session()->forget('login.mfa_user_id');
+
+        Auth::login($user, $remember);
+        $request->session()->regenerate();
+        $this->recordSessionLogin($request, $user);
+
+        return response()->json([
+            'user' => $this->present($user),
             'intended' => $request->session()->pull('url.intended'),
         ]);
     }
@@ -124,6 +168,23 @@ class AuthController extends Controller
             'user_id' => $user->id,
             'client_id' => null,
             'type' => 'session',
+            'outcome' => 'success',
+            'ip_address' => $request->ip(),
+            'user_agent' => $request->userAgent(),
+            'created_at' => now(),
+        ]);
+    }
+
+    // Solo credenciales inválidas (la señal relevante para detectar fuerza
+    // bruta) — cuenta desactivada o pendiente de aprobación no cuenta como
+    // "fallo" para esta métrica, son estados de cuenta, no intentos de ataque.
+    private function recordFailedLogin(Request $request): void
+    {
+        LoginEvent::create([
+            'user_id' => null,
+            'client_id' => null,
+            'type' => 'session',
+            'outcome' => 'failure',
             'ip_address' => $request->ip(),
             'user_agent' => $request->userAgent(),
             'created_at' => now(),
@@ -136,6 +197,7 @@ class AuthController extends Controller
             ...$user->toArray(),
             'roles' => $user->getRoleNames(),
             'permissions' => $user->getAllPermissions()->pluck('name'),
+            'two_factor_enabled' => $user->hasTwoFactorEnabled(),
         ];
     }
 }