feat(auth): block admin login IP after 4 failures for 20 min, email login alerts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-22 22:35:35 +07:00
parent fe68171aa7
commit e34362b9bd
16 changed files with 403 additions and 27 deletions
@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Support\Auth;
+
+use App\Models\AdminLoginBlock;
+use Illuminate\Support\Facades\DB;
+
+class AdminLoginLockout
+{
+    public const MAX_FAILURES = 4;
+    public const BLOCK_MINUTES = 20;
+
+    public static function blockedUntil(string $ip): ?\DateTimeInterface
+    {
+        $block = AdminLoginBlock::where('ip', $ip)->first();
+
+        return $block?->isBlocked() ? $block->blocked_until : null;
+    }
+
+    public static function recordFailure(string $ip, string $username, ?string $userAgent): AdminLoginBlock
+    {
+        return DB::transaction(function () use ($ip, $username, $userAgent) {
+            AdminLoginBlock::query()->insertOrIgnore(['ip' => $ip, 'created_at' => now(), 'updated_at' => now()]);
+            $block = AdminLoginBlock::where('ip', $ip)->lockForUpdate()->firstOrFail();
+
+            $windowExpired = $block->last_failed_at === null
+                || $block->last_failed_at->lt(now()->subMinutes(self::BLOCK_MINUTES));
+            $attempts = ($windowExpired && ! $block->isBlocked() ? 0 : $block->failed_attempts) + 1;
+
+            $block->update([
+                'failed_attempts' => $attempts,
+                'last_username'   => mb_substr($username, 0, 191),
+                'user_agent'      => $userAgent ? mb_substr($userAgent, 0, 500) : null,
+                'last_failed_at'  => now(),
+                'blocked_until'   => $attempts > self::MAX_FAILURES
+                    ? now()->addMinutes(self::BLOCK_MINUTES)
+                    : $block->blocked_until,
+            ]);
+
+            return $block;
+        });
+    }
+
+    public static function remainingAttempts(AdminLoginBlock $block): int
+    {
+        return max(0, self::MAX_FAILURES + 1 - $block->failed_attempts);
+    }
+
+    public static function clear(string $ip): void
+    {
+        AdminLoginBlock::where('ip', $ip)->delete();
+    }
+}