bao/portal-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): lock admin login per account as well as per IP

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
baodev0
2026-10-22 22:40:44 +07:00
co-authored by Claude Opus 5.5
parent 7f41c27958
commit fc765ad007
5 changed files with 138 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/Admin/Auth/AdminLoginBlockController.php
+10 -3
View File
@@ -21,7 +21,9 @@ class AdminLoginBlockController extends Controller
->get()
->map(fn (AdminLoginBlock $block) => [
'id' => $block->id,
'ip' => $block->ip,
'kind' => $block->kind,
'identifier' => $block->identifier,
'last_ip' => $block->last_ip,
'failed_attempts' => $block->failed_attempts,
'last_username' => $block->last_username,
'user_agent' => $block->user_agent,
@@ -47,9 +49,14 @@ class AdminLoginBlockController extends Controller
$this->activityLogger->log(
event: 'login_unblocked',
logName: 'auth',
description: sprintf('[admin] %s gỡ chặn đăng nhập cho IP %s (tài khoản thử gần nhất: %s)', $request->user('admin')?->username, $block->ip, $block->last_username ?? '—'),
description: sprintf('[admin] %s gỡ khoá đăng nhập %s %s', $request->user('admin')?->username, $this->label($block), $block->identifier),
);
return response()->json(['error' => false, 'message' => 'Đã gỡ chặn IP ' . $block->ip]);
return response()->json(['error' => false, 'message' => sprintf('Đã gỡ khoá %s %s', $this->label($block), $block->identifier)]);
}
private function label(AdminLoginBlock $block): string
{
return $block->kind === AdminLoginLockout::KIND_ACCOUNT ? 'tài khoản' : 'IP';
}
}
app/Http/Controllers/Api/Admin/Auth/AuthController.php
+17 -12
View File
@@ -7,10 +7,10 @@ use App\Http\Requests\UpdateProfileRequest;
use App\Http\Requests\UpdateAdminPasswordRequest;
use App\Http\Resources\Api\Admin\AdminUserResource;
use App\Services\Api\Admin\AdminRefreshTokenService;
use App\Models\AdminLoginBlock;
use App\Services\ActivityLogger;
use App\Support\Auth\AdminLoginAlert;
use App\Support\Auth\AdminLoginLockout;
use Carbon\Carbon;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
@@ -39,9 +39,10 @@ class AuthController extends Controller
]);
$ip = (string) $request->ip();
$username = $request->string('username')->toString();
if ($blockedUntil = AdminLoginLockout::blockedUntil($ip)) {
return $this->blockedResponse($blockedUntil);
if ($block = AdminLoginLockout::activeBlock($ip, $username)) {
return $this->blockedResponse($block);
}
$guard = Auth::guard('admin');
@@ -50,7 +51,7 @@ class AuthController extends Controller
$token = $guard->attempt($credentials);
if (!$token) {
$block = AdminLoginLockout::recordFailure($ip, $request->string('username')->toString(), $request->userAgent());
$blocks = AdminLoginLockout::recordFailure($ip, $username, $request->userAgent());
$this->activityLogger->log(
event: 'login_failed',
@@ -58,16 +59,18 @@ class AuthController extends Controller
description: '[admin] Đăng nhập thất bại với username: ' . $request->username . ' từ IP ' . $ip,
);
if ($block->isBlocked()) {
return $this->blockedResponse($block->blocked_until);
foreach ($blocks as $block) {
if ($block->isBlocked()) {
return $this->blockedResponse($block);
}
}
$remaining = AdminLoginLockout::remainingAttempts($block);
$remaining = AdminLoginLockout::remainingAttempts($blocks);
return response()->json([
'error' => true,
'message' => sprintf(
'Thông tin đăng nhập không chính xác. Còn %d lần thử trước khi IP bị chặn %d phút.',
'Thông tin đăng nhập không chính xác. Còn %d lần thử trước khi bị khoá %d phút.',
$remaining,
AdminLoginLockout::BLOCK_MINUTES,
),
@@ -103,18 +106,20 @@ class AuthController extends Controller
: $response->withCookie($this->forgetRefreshCookie());
}
private function blockedResponse(\DateTimeInterface $blockedUntil): JsonResponse
private function blockedResponse(AdminLoginBlock $block): JsonResponse
{
$minutes = max(1, (int) ceil((Carbon::instance($blockedUntil)->getTimestamp() - now()->getTimestamp()) / 60));
$minutes = max(1, (int) ceil(($block->blocked_until->getTimestamp() - now()->getTimestamp()) / 60));
$target = $block->kind === AdminLoginLockout::KIND_ACCOUNT ? 'Tài khoản này' : 'IP của bạn';
return response()->json([
'error' => true,
'message' => sprintf(
'IP của bạn bị chặn đăng nhập do nhập sai quá %d lần. Thử lại sau %d phút hoặc liên hệ quản trị viên để gỡ chặn.',
'%s bị khoá đăng nhập do nhập sai quá %d lần. Thử lại sau %d phút hoặc liên hệ quản trị viên để gỡ khoá.',
$target,
AdminLoginLockout::MAX_FAILURES,
$minutes,
),
'blocked_until' => Carbon::instance($blockedUntil)->toIso8601String(),
'blocked_until' => $block->blocked_until->toIso8601String(),
], 429);
}