new funcionality

2026-07-27 17:20:02 +02:00
parent c2b5291a74
commit c5ce8a7a36
101 changed files with 6889 additions and 176 deletions
--- a/app/Http/Controllers/Auth/TwoFactorController.php
+++ b/app/Http/Controllers/Auth/TwoFactorController.php
@@ -0,0 +1,131 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+use PragmaRX\Google2FA\Google2FA;
+
+class TwoFactorController extends Controller
+{
+    /**
+     * Genera un secreto nuevo (pendiente de confirmar) y el QR para escanear.
+     * No queda "activo" hasta que se confirma con un código real (confirm()).
+     */
+    public function setup(Request $request)
+    {
+        $user = $request->user();
+
+        abort_if($user->hasTwoFactorEnabled(), 422, __('messages.two_factor_already_enabled'));
+
+        $google2fa = new Google2FA();
+        $secret = $google2fa->generateSecretKey();
+
+        $user->forceFill([
+            'two_factor_secret' => $secret,
+            'two_factor_recovery_codes' => null,
+            'two_factor_confirmed_at' => null,
+        ])->save();
+
+        return response()->json([
+            'secret' => $secret,
+            'otpauth_url' => $google2fa->getQRCodeUrl(config('app.name'), $user->email, $secret),
+        ]);
+    }
+
+    /**
+     * Confirma la activación con un código real de la app autenticadora.
+     * Recién acá se generan y devuelven los códigos de recuperación (una sola vez).
+     */
+    public function confirm(Request $request)
+    {
+        $data = $request->validate([
+            'code' => ['required', 'string'],
+        ]);
+
+        $user = $request->user();
+
+        abort_if(! $user->two_factor_secret, 422, __('messages.two_factor_not_pending'));
+
+        if (! (new Google2FA())->verifyKey($user->two_factor_secret, $data['code'])) {
+            throw ValidationException::withMessages([
+                'code' => __('messages.invalid_two_factor_code'),
+            ]);
+        }
+
+        $recoveryCodes = $this->generateRecoveryCodes();
+
+        $user->forceFill([
+            'two_factor_recovery_codes' => $recoveryCodes,
+            'two_factor_confirmed_at' => now(),
+        ])->save();
+
+        AuditLog::record($request, 'user.2fa_enabled', 'user', $user->id, $user->email);
+
+        return response()->json(['recovery_codes' => $recoveryCodes]);
+    }
+
+    public function disable(Request $request)
+    {
+        $data = $request->validate([
+            'password' => ['required', 'string'],
+        ]);
+
+        $user = $request->user();
+
+        if (! Hash::check($data['password'], $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => __('messages.invalid_password'),
+            ]);
+        }
+
+        $user->forceFill([
+            'two_factor_secret' => null,
+            'two_factor_recovery_codes' => null,
+            'two_factor_confirmed_at' => null,
+        ])->save();
+
+        AuditLog::record($request, 'user.2fa_disabled', 'user', $user->id, $user->email);
+
+        return response()->noContent();
+    }
+
+    /**
+     * Invalida los códigos de recuperación anteriores y genera un juego nuevo
+     * (una sola vez más, igual que en la confirmación inicial).
+     */
+    public function regenerateRecoveryCodes(Request $request)
+    {
+        $data = $request->validate([
+            'password' => ['required', 'string'],
+        ]);
+
+        $user = $request->user();
+
+        abort_unless($user->hasTwoFactorEnabled(), 422, __('messages.two_factor_not_enabled'));
+
+        if (! Hash::check($data['password'], $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => __('messages.invalid_password'),
+            ]);
+        }
+
+        $recoveryCodes = $this->generateRecoveryCodes();
+        $user->forceFill(['two_factor_recovery_codes' => $recoveryCodes])->save();
+
+        AuditLog::record($request, 'user.2fa_recovery_regenerated', 'user', $user->id, $user->email);
+
+        return response()->json(['recovery_codes' => $recoveryCodes]);
+    }
+
+    private function generateRecoveryCodes(): array
+    {
+        return collect(range(1, 8))
+            ->map(fn () => Str::upper(Str::random(4).'-'.Str::random(4)))
+            ->all();
+    }
+}