feat(auth): block admin login IP after 4 failures for 20 min, email login alerts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-22 22:35:35 +07:00
parent fe68171aa7
commit e34362b9bd
16 changed files with 403 additions and 27 deletions
@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Http\Controllers\Api\Admin\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\AdminLoginBlock;
+use App\Services\ActivityLogger;
+use App\Support\Auth\AdminLoginLockout;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class AdminLoginBlockController extends Controller
+{
+    public function __construct(private readonly ActivityLogger $activityLogger) {}
+
+    public function index(): JsonResponse
+    {
+        $blocks = AdminLoginBlock::where('blocked_until', '>', now())
+            ->orWhere('last_failed_at', '>', now()->subMinutes(AdminLoginLockout::BLOCK_MINUTES))
+            ->latest('last_failed_at')
+            ->get()
+            ->map(fn (AdminLoginBlock $block) => [
+                'id'              => $block->id,
+                'ip'              => $block->ip,
+                'failed_attempts' => $block->failed_attempts,
+                'last_username'   => $block->last_username,
+                'user_agent'      => $block->user_agent,
+                'last_failed_at'  => $block->last_failed_at,
+                'blocked_until'   => $block->isBlocked() ? $block->blocked_until : null,
+            ]);
+
+        return response()->json([
+            'error' => false,
+            'data'  => [
+                'items'         => $blocks,
+                'max_failures'  => AdminLoginLockout::MAX_FAILURES,
+                'block_minutes' => AdminLoginLockout::BLOCK_MINUTES,
+            ],
+        ]);
+    }
+
+    public function destroy(Request $request, int $id): JsonResponse
+    {
+        $block = AdminLoginBlock::findOrFail($id);
+        $block->delete();
+
+        $this->activityLogger->log(
+            event: 'login_unblocked',
+            logName: 'auth',
+            description: sprintf('[admin] %s gỡ chặn đăng nhập cho IP %s (tài khoản thử gần nhất: %s)', $request->user('admin')?->username, $block->ip, $block->last_username ?? '—'),
+        );
+
+        return response()->json(['error' => false, 'message' => 'Đã gỡ chặn IP ' . $block->ip]);
+    }
+}