feat: popup quảng cáo, đặt lại mật khẩu bằng token 80 ký tự, 2FA email, vá lỗ hổng bảo mật

- Popup/banner quảng cáo cấu hình từ admin (loại, link, lịch hiển thị)
- Đặt lại mật khẩu: token 80 ký tự kèm check digit Luhn thay cho token+email lộ trong URL, chỉ lưu bản băm, một lần dùng, hết hạn 60 phút
- Xác thực 2 lớp qua email khi đăng nhập (mã 6 số, ghi nhớ thiết bị 90 ngày)
- ApiAuthCheck chặn ngay tài khoản bị khoá dù JWT còn hạn (trước đây dùng được tới hết TTL)
- Handler trả 404 thay vì 500 khi ModelNotFoundException không bọc HttpException
- Test ClientTamperingTest: xác nhận IDOR/giả mạo dữ liệu từ client đều bị chặn

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Http/Controllers/Api/Admin/Setting/PopupBannerController.php

@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\Admin\Setting;
+
+use App\Http\Controllers\Controller;
+use App\Models\PopupBanner;
+use App\Support\ClientMenu;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Validation\Rule;
+
+class PopupBannerController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => PopupBanner::orderBy('sort_order')->orderBy('id')->get(),
+            'types' => PopupBanner::TYPES,
+        ]);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $this->validated($request, true);
+        $data['image_path'] = $request->file('image')->store('popup-banners', PopupBanner::DISK);
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã thêm popup.',
+            'data'    => PopupBanner::create($data),
+        ], 201);
+    }
+
+    public function update(Request $request, int $id): JsonResponse
+    {
+        $popup = PopupBanner::findOrFail($id);
+        $data = $this->validated($request, false);
+        $oldImage = null;
+
+        if ($request->hasFile('image')) {
+            $oldImage = $popup->image_path;
+            $data['image_path'] = $request->file('image')->store('popup-banners', PopupBanner::DISK);
+        }
+
+        $popup->update($data);
+
+        if ($oldImage) {
+            Storage::disk(PopupBanner::DISK)->delete($oldImage);
+        }
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã cập nhật popup.',
+            'data'    => $popup->fresh(),
+        ]);
+    }
+
+    public function destroy(int $id): JsonResponse
+    {
+        $popup = PopupBanner::findOrFail($id);
+        $popup->delete();
+        Storage::disk(PopupBanner::DISK)->delete($popup->image_path);
+
+        return response()->json(['error' => false, 'message' => 'Đã xoá popup.']);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function validated(Request $request, bool $creating): array
+    {
+        $data = $request->validate([
+            'title'           => 'required|string|max:150',
+            'type'            => ['required', Rule::in(array_keys(PopupBanner::TYPES))],
+            'image'           => [$creating ? 'required' : 'nullable', 'file', 'mimes:jpg,jpeg,png,webp,gif', 'max:5120'],
+            'link_url'        => ['nullable', 'string', 'max:255', 'regex:' . ClientMenu::HREF_PATTERN],
+            'open_in_new_tab' => 'boolean',
+            'is_active'       => 'boolean',
+            'starts_at'       => 'nullable|date',
+            'ends_at'         => 'nullable|date|after_or_equal:starts_at',
+            'sort_order'      => 'integer|min:0|max:65535',
+        ]);
+        unset($data['image']);
+
+        return $data;
+    }
+}

app/Http/Controllers/Api/Client/ClientController.php

@@ -9,6 +9,7 @@ use App\Services\Api\Client\ClientAuthService;
 
 use App\Http\Controllers\Api\Client\Concerns\HandlesClientAuthentication;
 use App\Http\Controllers\Api\Client\Concerns\HandlesClientPasswordReset;
+use App\Http\Controllers\Api\Client\Concerns\HandlesClientTwoFactor;
 use App\Http\Controllers\Api\Client\Concerns\ManagesClientAccountSettings;
 use App\Http\Controllers\Api\Client\Concerns\ManagesClientProfile;
 /**
@@ -21,6 +22,7 @@ class ClientController extends Controller
 {
     use HandlesClientAuthentication;
     use HandlesClientPasswordReset;
+    use HandlesClientTwoFactor;
     use ManagesClientAccountSettings;
     use ManagesClientProfile;
 

app/Http/Controllers/Api/Client/Concerns/HandlesClientAuthentication.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Api\Client\Concerns;
 use App\Http\Requests\Api\Client\ClientAuthRequest;
 use App\Http\Requests\Api\Client\ClientRegisterRequest;
 use App\Http\Resources\Api\Client\ClientResource;
+use App\Services\Api\Client\ClientTwoFactorService;
 use Illuminate\Http\Request;
 
 trait HandlesClientAuthentication
@@ -43,10 +44,26 @@ trait HandlesClientAuthentication
      *     )
      * )
      */
-    public function login(ClientAuthRequest $request)
+    public function login(ClientAuthRequest $request, ClientTwoFactorService $twoFactor)
     {
-        $result = $this->authService->authenticateClient($request->validated());
+        $client = $this->authService->verifyCredentials($request->safe()->only(['email', 'password']));
 
+        if ($twoFactor->requiresChallenge($client, $request->input('device_token'))) {
+            return response()->json([
+                'error' => false,
+                'data'  => ['two_factor' => $twoFactor->startLoginChallenge($client)],
+            ]);
+        }
+
+        return $this->loginResponse($this->authService->issueTokens($client));
+    }
+
+    /**
+     * @param array{client: \App\Models\Customer, token: string, refresh_token: string} $result
+     * @param array<string, mixed> $extra
+     */
+    protected function loginResponse(array $result, array $extra = [])
+    {
         $client = $result['client'];
         $this->activityLogger->logAuth('login', 'customer', $client->id, $client->email);
 
@@ -57,6 +74,7 @@ trait HandlesClientAuthentication
                 'token'         => $result['token'],
                 'refresh_token' => $result['refresh_token'],
                 'expires_in'    => config('jwt.ttl', 60) * 60, // seconds
+                ...$extra,
             ],
         ]);
     }

app/Http/Controllers/Api/Client/Concerns/HandlesClientPasswordReset.php

@@ -3,7 +3,7 @@
 namespace App\Http\Controllers\Api\Client\Concerns;
 
 use App\Http\Requests\Api\Client\ClientChangePasswordRequest;
-use App\Models\Customer;
+use App\Support\PasswordResetToken;
 use Illuminate\Http\Request;
 use Illuminate\Validation\Rules\Password;
 
@@ -33,15 +33,28 @@ trait HandlesClientPasswordReset
         ]);
     }
 
+    public function showResetToken(string $token)
+    {
+        $customer = PasswordResetToken::findCustomer($token);
+
+        if (!$customer) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Link đặt lại mật khẩu không hợp lệ hoặc đã hết hạn.',
+            ], 404);
+        }
+
+        return response()->json(['error' => false, 'data' => ['email' => $customer->email]]);
+    }
+
     public function resetPassword(Request $request)
     {
         $data = $request->validate([
-            'email'    => ['required', 'email', 'max:255'],
-            'token'    => ['required', 'string', 'max:255'],
+            'token'    => ['required', 'string', 'size:' . PasswordResetToken::LENGTH],
             'password' => ['required', Password::min(10), 'confirmed'],
         ]);
 
-        $customer = $this->authService->resetPassword($data);
+        $customer = $this->authService->resetPassword($data['token'], $data['password']);
 
         $this->activityLogger->log(
             event: 'password_reset',

app/Http/Controllers/Api/Client/Concerns/HandlesClientTwoFactor.php

@@ -0,0 +1,109 @@
+<?php
+
+namespace App\Http\Controllers\Api\Client\Concerns;
+
+use App\Models\CustomerTrustedDevice;
+use App\Services\Api\Client\ClientTwoFactorService;
+use Illuminate\Http\Request;
+
+trait HandlesClientTwoFactor
+{
+    public function verifyLoginTwoFactor(Request $request, ClientTwoFactorService $twoFactor)
+    {
+        $data = $request->validate([
+            'challenge'       => ['required', 'string', 'size:64'],
+            'code'            => ['required', 'digits:6'],
+            'remember_device' => ['sometimes', 'boolean'],
+        ]);
+
+        $customer = $twoFactor->verifyLoginChallenge($data['challenge'], $data['code']);
+
+        $extra = [];
+        if ($request->boolean('remember_device')) {
+            $extra = [
+                'device_token'      => $twoFactor->rememberDevice($customer, $request->userAgent(), $request->ip()),
+                'device_expires_in' => ClientTwoFactorService::TRUSTED_DEVICE_DAYS * 86400,
+            ];
+        }
+
+        return $this->loginResponse($this->authService->issueTokens($customer), $extra);
+    }
+
+    public function resendLoginTwoFactor(Request $request, ClientTwoFactorService $twoFactor)
+    {
+        $data = $request->validate(['challenge' => ['required', 'string', 'size:64']]);
+
+        $twoFactor->resendLoginChallenge($data['challenge']);
+
+        return response()->json(['error' => false, 'message' => 'Đã gửi lại mã xác thực.']);
+    }
+
+    public function twoFactorStatus(ClientTwoFactorService $twoFactor)
+    {
+        $customer = auth('client')->user();
+
+        return response()->json([
+            'error' => false,
+            'data'  => [
+                'enabled' => (bool) $customer->two_factor_enabled,
+                'devices' => $twoFactor->devices($customer)->map(fn (CustomerTrustedDevice $device) => [
+                    'id'           => $device->id,
+                    'user_agent'   => $device->user_agent,
+                    'ip_address'   => $device->ip_address,
+                    'last_used_at' => $device->last_used_at?->toIso8601String(),
+                    'expires_at'   => $device->expires_at->toIso8601String(),
+                ]),
+            ],
+        ]);
+    }
+
+    public function sendTwoFactorSetupCode(ClientTwoFactorService $twoFactor)
+    {
+        $twoFactor->sendSetupCode(auth('client')->user());
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã gửi mã xác thực tới email của bạn.',
+            'data'    => ['resend_in' => ClientTwoFactorService::RESEND_COOLDOWN_SECONDS],
+        ]);
+    }
+
+    public function enableTwoFactor(Request $request, ClientTwoFactorService $twoFactor)
+    {
+        $data = $request->validate(['code' => ['required', 'digits:6']]);
+        $customer = auth('client')->user();
+
+        $twoFactor->enable($customer, $data['code']);
+        $this->activityLogger->log(
+            event: 'two_factor_enabled',
+            logName: 'Customer',
+            description: "Customer {$customer->email} bật xác thực 2 lớp",
+            subject: $customer,
+        );
+
+        return response()->json(['error' => false, 'message' => 'Đã bật xác thực 2 lớp.']);
+    }
+
+    public function disableTwoFactor(Request $request, ClientTwoFactorService $twoFactor)
+    {
+        $data = $request->validate(['password' => ['required', 'string']]);
+        $customer = auth('client')->user();
+
+        $twoFactor->disable($customer, $data['password']);
+        $this->activityLogger->log(
+            event: 'two_factor_disabled',
+            logName: 'Customer',
+            description: "Customer {$customer->email} tắt xác thực 2 lớp",
+            subject: $customer,
+        );
+
+        return response()->json(['error' => false, 'message' => 'Đã tắt xác thực 2 lớp.']);
+    }
+
+    public function revokeTrustedDevices(Request $request, ClientTwoFactorService $twoFactor)
+    {
+        $twoFactor->revokeDevices(auth('client')->user(), $request->integer('id') ?: null);
+
+        return response()->json(['error' => false, 'message' => 'Đã xoá thiết bị đã ghi nhớ.']);
+    }
+}

app/Http/Controllers/Api/Setting/SettingController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Api\Setting;
 
 use App\Http\Controllers\Controller;
+use App\Models\PopupBanner;
 use App\Models\Setting;
 use App\Support\ClientMenu;
 use App\Support\ClientQuickLinks;
@@ -80,4 +81,9 @@ class SettingController extends Controller
             'data'  => ClientQuickLinks::items(),
         ]);
     }
+
+    public function getPopups(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json(['error' => false, 'data' => PopupBanner::publicList()]);
+    }
 }