fix(auth): successful login no longer resets IP failure counter

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/Admin/Auth/AuthController.php

@@ -75,8 +75,6 @@ class AuthController extends Controller
             ], 401);
         }
 
-        AdminLoginLockout::clear($ip);
-
         $user = Auth::guard('admin')->user();
         Auth::guard('admin')->getProvider()->rehashPasswordIfRequired($user, $request->only('password'));
 

app/Support/Auth/AdminLoginLockout.php

@@ -45,9 +45,4 @@ class AdminLoginLockout
     {
         return max(0, self::MAX_FAILURES + 1 - $block->failed_attempts);
     }
-
-    public static function clear(string $ip): void
-    {
-        AdminLoginBlock::where('ip', $ip)->delete();
-    }
 }

tests/Feature/Api/Admin/LoginThrottleTest.php

@@ -53,7 +53,21 @@ class LoginThrottleTest extends TestCase
 
         $this->travel(21)->minutes();
         $this->login('staff', 'correct-password-123')->assertOk();
-        $this->assertSame(0, AdminLoginBlock::count());
+    }
+
+    public function test_successful_login_does_not_reset_failures_of_the_ip(): void
+    {
+        $this->staff();
+        User::factory()->create(['username' => 'victim', 'password' => Hash::make('victim-password-123')]);
+
+        for ($i = 0; $i < 4; $i++) {
+            $this->login('victim', 'guess-' . $i)->assertUnauthorized();
+            $this->login('staff', 'correct-password-123')->assertOk();
+            $this->app['auth']->forgetGuards();
+        }
+
+        $this->login('victim', 'guess-final')->assertStatus(429);
+        $this->assertTrue(AdminLoginBlock::sole()->isBlocked());
     }
 
     public function test_successful_login_alerts_configured_recipients(): void