bao/portal-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: harden admin auth and ticket workflows

Browse Source 
- add rotating admin refresh tokens and password gates\n- expand ticket galleries, exports, and client resources\n- improve IP allocation auditing and dashboard data\n- enforce encrypted client access tokens on public routes
This commit is contained in:
baodev0
2026-10-16 17:00:55 +07:00
parent 0cdf224309
commit 0b08689ea4
52 changed files with 1421 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/Admin/Auth/AuthController.php
+95 -28
View File
@@ -6,27 +6,36 @@ use App\Http\Controllers\Controller;
use App\Http\Requests\UpdateProfileRequest;
use App\Http\Requests\UpdateAdminPasswordRequest;
use App\Http\Resources\Api\Admin\AdminUserResource;
use App\Services\Api\Admin\AdminRefreshTokenService;
use App\Services\ActivityLogger;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Validation\ValidationException;
use Symfony\Component\HttpFoundation\Cookie;
use Tymon\JWTAuth\Facades\JWTAuth;
use Tymon\JWTAuth\Exceptions\JWTException;
class AuthController extends Controller
{
private const LOGIN_MAX_ATTEMPTS = 5;
private const LOGIN_DECAY_SECONDS = 60;
private const REMEMBER_TTL_SECONDS = 2592000;
private const REFRESH_COOKIE = 'admin_refresh_token';
private const REFRESH_COOKIE_PATH = '/api/v1/administrator';
public function __construct(private readonly ActivityLogger $activityLogger) {}
public function __construct(
private readonly ActivityLogger $activityLogger,
private readonly AdminRefreshTokenService $refreshTokens,
) {}
public function login(Request $request): JsonResponse
{
$request->validate([
'username' => 'required|string',
'password' => 'required|string',
'remember' => 'sometimes|boolean',
]);
$throttleKey = 'admin-login:' . strtolower($request->string('username')->toString()) . '|' . $request->ip();
@@ -38,7 +47,10 @@ class AuthController extends Controller
], 429);
}
$token = Auth::guard('admin')->attempt($request->only('username', 'password'));
$guard = Auth::guard('admin');
$remember = $request->boolean('remember');
$credentials = $request->only('username', 'password');
$token = $guard->attempt($credentials);
if (!$token) {
RateLimiter::hit($throttleKey, self::LOGIN_DECAY_SECONDS);
@@ -61,15 +73,26 @@ class AuthController extends Controller
$this->activityLogger->logAuth('login', 'admin', $user->id, $user->username ?? $user->email);
return response()->json([
$data = [
'token' => $token,
'token_type' => 'bearer',
'expires_in' => config('jwt.ttl') * 60,
'user' => new AdminUserResource($user),
];
if ($remember) {
$refreshToken = $this->refreshTokens->create($user->id, now()->addDays(30));
$data['refresh_expires_in'] = self::REMEMBER_TTL_SECONDS;
}
$response = response()->json([
'error' => false,
'data' => [
'token' => $token,
'token_type' => 'bearer',
'expires_in' => config('jwt.ttl') * 60,
'user' => new AdminUserResource($user),
],
'data' => $data,
]);
return $remember
? $response->withCookie($this->refreshCookie($refreshToken, self::REMEMBER_TTL_SECONDS))
: $response->withCookie($this->forgetRefreshCookie());
}
public function me(): JsonResponse
@@ -116,31 +139,55 @@ class AuthController extends Controller
]);
}
public function refresh(): JsonResponse
public function refresh(Request $request): JsonResponse
{
try {
$newToken = JWTAuth::parseToken()->refresh();
$user = JWTAuth::setToken($newToken)->toUser();
return response()->json([
'error' => false,
'data' => [
'token' => $newToken,
'token_type' => 'bearer',
'expires_in' => config('jwt.ttl') * 60,
'user' => new AdminUserResource($user),
],
]);
} catch (JWTException) {
if (! $request->ajax()) {
return response()->json([
'error' => true,
'message' => 'Không thể làm mới phiên đăng nhập. Vui lòng đăng nhập lại.',
], 401);
'message' => 'Yêu cầu làm mới phiên không hợp lệ.',
], 403);
}
$request->validate([
'refresh_token' => ['prohibited'],
]);
$refreshToken = $request->cookie(self::REFRESH_COOKIE);
if (! is_string($refreshToken) || $refreshToken === '') {
return response()->json([
'error' => true,
'message' => 'Phiên ghi nhớ đăng nhập không tồn tại.',
], 401)->withCookie($this->forgetRefreshCookie());
}
try {
$result = $this->refreshTokens->rotate($refreshToken);
} catch (ValidationException) {
return response()->json([
'error' => true,
'message' => 'Refresh token không hợp lệ hoặc đã hết hạn.',
], 401)->withCookie($this->forgetRefreshCookie());
}
return response()->json([
'error' => false,
'data' => [
'token' => $result['token'],
'token_type' => 'bearer',
'expires_in' => config('jwt.ttl') * 60,
'refresh_expires_in' => $result['refresh_expires_in'],
'user' => new AdminUserResource($result['user']),
],
])->withCookie($this->refreshCookie($result['refresh_token'], $result['refresh_expires_in']));
}
public function logout(): JsonResponse
{
$refreshToken = request()->cookie(self::REFRESH_COOKIE);
if (is_string($refreshToken) && $refreshToken !== '') {
$this->refreshTokens->revoke($refreshToken);
}
$user = Auth::guard('admin')->user();
if ($user) {
$this->activityLogger->logAuth('logout', 'admin', $user->id, $user->username ?? $user->email);
@@ -151,6 +198,26 @@ class AuthController extends Controller
return response()->json([
'error' => false,
'message' => 'Đã đăng xuất thành công.',
]);
])->withCookie($this->forgetRefreshCookie());
}
private function refreshCookie(string $token, int $maxAgeSeconds): Cookie
{
return cookie(
self::REFRESH_COOKIE,
$token,
(int) ceil($maxAgeSeconds / 60),
self::REFRESH_COOKIE_PATH,
null,
true,
true,
false,
app()->isLocal() ? 'none' : 'strict',
);
}
private function forgetRefreshCookie(): Cookie
{
return cookie()->forget(self::REFRESH_COOKIE, self::REFRESH_COOKIE_PATH);
}
}