update rm deadcode

app/Http/Controllers/Api/Admin/Auth/AuthController.php

@@ -9,11 +9,15 @@ use App\Services\ActivityLogger;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
 use Tymon\JWTAuth\Facades\JWTAuth;
 use Tymon\JWTAuth\Exceptions\JWTException;
 
 class AuthController extends Controller
 {
+    private const LOGIN_MAX_ATTEMPTS = 5;
+    private const LOGIN_DECAY_SECONDS = 60;
+
     public function __construct(private readonly ActivityLogger $activityLogger) {}
 
     public function login(Request $request): JsonResponse
@@ -23,9 +27,20 @@ class AuthController extends Controller
             'password' => 'required|string',
         ]);
 
+        $throttleKey = 'admin-login:' . strtolower($request->string('username')->toString()) . '|' . $request->ip();
+
+        if (RateLimiter::tooManyAttempts($throttleKey, self::LOGIN_MAX_ATTEMPTS)) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Bạn đã đăng nhập sai quá nhiều lần. Vui lòng thử lại sau ít phút.',
+            ], 429);
+        }
+
         $token = Auth::guard('admin')->attempt($request->only('username', 'password'));
 
         if (!$token) {
+            RateLimiter::hit($throttleKey, self::LOGIN_DECAY_SECONDS);
+
             $this->activityLogger->log(
                 event: 'login_failed',
                 logName: 'auth',
@@ -37,6 +52,8 @@ class AuthController extends Controller
             ], 401);
         }
 
+        RateLimiter::clear($throttleKey);
+
         $user = Auth::guard('admin')->user();
 
         $this->activityLogger->logAuth('login', 'admin', $user->id, $user->username ?? $user->email);