diff --git a/app/Http/Controllers/Api/Admin/Auth/AuthController.php b/app/Http/Controllers/Api/Admin/Auth/AuthController.php index 334fa6b..0828125 100644 --- a/app/Http/Controllers/Api/Admin/Auth/AuthController.php +++ b/app/Http/Controllers/Api/Admin/Auth/AuthController.php @@ -75,8 +75,6 @@ class AuthController extends Controller ], 401); } - AdminLoginLockout::clear($ip); - $user = Auth::guard('admin')->user(); Auth::guard('admin')->getProvider()->rehashPasswordIfRequired($user, $request->only('password')); diff --git a/app/Support/Auth/AdminLoginLockout.php b/app/Support/Auth/AdminLoginLockout.php index 765c54e..8ee19d0 100644 --- a/app/Support/Auth/AdminLoginLockout.php +++ b/app/Support/Auth/AdminLoginLockout.php @@ -45,9 +45,4 @@ class AdminLoginLockout { return max(0, self::MAX_FAILURES + 1 - $block->failed_attempts); } - - public static function clear(string $ip): void - { - AdminLoginBlock::where('ip', $ip)->delete(); - } } diff --git a/tests/Feature/Api/Admin/LoginThrottleTest.php b/tests/Feature/Api/Admin/LoginThrottleTest.php index e38ee6c..df2ba78 100644 --- a/tests/Feature/Api/Admin/LoginThrottleTest.php +++ b/tests/Feature/Api/Admin/LoginThrottleTest.php @@ -53,7 +53,21 @@ class LoginThrottleTest extends TestCase $this->travel(21)->minutes(); $this->login('staff', 'correct-password-123')->assertOk(); - $this->assertSame(0, AdminLoginBlock::count()); + } + + public function test_successful_login_does_not_reset_failures_of_the_ip(): void + { + $this->staff(); + User::factory()->create(['username' => 'victim', 'password' => Hash::make('victim-password-123')]); + + for ($i = 0; $i < 4; $i++) { + $this->login('victim', 'guess-' . $i)->assertUnauthorized(); + $this->login('staff', 'correct-password-123')->assertOk(); + $this->app['auth']->forgetGuards(); + } + + $this->login('victim', 'guess-final')->assertStatus(429); + $this->assertTrue(AdminLoginBlock::sole()->isBlocked()); } public function test_successful_login_alerts_configured_recipients(): void