feat(auth): block admin login IP after 4 failures for 20 min, email login alerts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Support/Auth/AdminLoginAlert.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Support\Auth;
+
+use App\Mail\Admin\AdminLoginAlertMail;
+use App\Models\Setting;
+use App\Models\User;
+use App\Support\AutoEmailGate;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+
+class AdminLoginAlert
+{
+    public const SETTING_FIELD = 'admin_login_alert_emails';
+    public const DEFAULT_RECIPIENTS = ['web@tgs.com.vn'];
+
+    /**
+     * @return list<string>
+     */
+    public static function recipients(): array
+    {
+        $settings = (array) (json_decode(Setting::where('key', 'email_settings')->value('value') ?? '', true) ?? []);
+
+        return array_key_exists(self::SETTING_FIELD, $settings)
+            ? array_values(array_filter((array) $settings[self::SETTING_FIELD]))
+            : self::DEFAULT_RECIPIENTS;
+    }
+
+    public static function send(User $admin, string $ip, ?string $userAgent): void
+    {
+        $recipients = self::recipients();
+        if ($recipients === [] || ! AutoEmailGate::allows('admin_login_alert')) {
+            return;
+        }
+
+        try {
+            Mail::to($recipients)->queue(new AdminLoginAlertMail([
+                'admin_name'     => (string) ($admin->fullname ?: $admin->username),
+                'admin_username' => (string) ($admin->username ?? $admin->email),
+                'login_time'     => now()->format('d/m/Y H:i:s'),
+                'client_ip'      => $ip,
+                'user_agent'     => (string) ($userAgent ?: 'Không xác định'),
+            ]));
+        } catch (\Throwable $e) {
+            Log::warning('Không gửi được email thông báo đăng nhập admin', ['admin_id' => $admin->id, 'error' => $e->getMessage()]);
+        }
+    }
+}

app/Support/Auth/AdminLoginLockout.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Support\Auth;
+
+use App\Models\AdminLoginBlock;
+use Illuminate\Support\Facades\DB;
+
+class AdminLoginLockout
+{
+    public const MAX_FAILURES = 4;
+    public const BLOCK_MINUTES = 20;
+
+    public static function blockedUntil(string $ip): ?\DateTimeInterface
+    {
+        $block = AdminLoginBlock::where('ip', $ip)->first();
+
+        return $block?->isBlocked() ? $block->blocked_until : null;
+    }
+
+    public static function recordFailure(string $ip, string $username, ?string $userAgent): AdminLoginBlock
+    {
+        return DB::transaction(function () use ($ip, $username, $userAgent) {
+            AdminLoginBlock::query()->insertOrIgnore(['ip' => $ip, 'created_at' => now(), 'updated_at' => now()]);
+            $block = AdminLoginBlock::where('ip', $ip)->lockForUpdate()->firstOrFail();
+
+            $windowExpired = $block->last_failed_at === null
+                || $block->last_failed_at->lt(now()->subMinutes(self::BLOCK_MINUTES));
+            $attempts = ($windowExpired && ! $block->isBlocked() ? 0 : $block->failed_attempts) + 1;
+
+            $block->update([
+                'failed_attempts' => $attempts,
+                'last_username'   => mb_substr($username, 0, 191),
+                'user_agent'      => $userAgent ? mb_substr($userAgent, 0, 500) : null,
+                'last_failed_at'  => now(),
+                'blocked_until'   => $attempts > self::MAX_FAILURES
+                    ? now()->addMinutes(self::BLOCK_MINUTES)
+                    : $block->blocked_until,
+            ]);
+
+            return $block;
+        });
+    }
+
+    public static function remainingAttempts(AdminLoginBlock $block): int
+    {
+        return max(0, self::MAX_FAILURES + 1 - $block->failed_attempts);
+    }
+
+    public static function clear(string $ip): void
+    {
+        AdminLoginBlock::where('ip', $ip)->delete();
+    }
+}

app/Support/EmailScenarioRegistry.php

@@ -189,6 +189,10 @@ final class EmailScenarioRegistry
             'label' => '[Admin] Ticket hỗ trợ mới', 'category' => self::INTERNAL, 'group' => 'SUPPORT',
             'required_variables' => ['ticket_num'],
         ],
+        'admin_login_alert' => [
+            'label' => '[Admin] Có người đăng nhập trang quản trị', 'category' => self::INTERNAL, 'group' => 'SECURITY',
+            'required_variables' => ['admin_username', 'client_ip', 'login_time'],
+        ],
     ];
 
     public static function find(?string ...$identifiers): ?string