bao/portal-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): lock admin login per account as well as per IP

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
baodev0
2026-10-22 22:40:44 +07:00
co-authored by Claude Opus 5.5
parent 7f41c27958
commit fc765ad007
5 changed files with 138 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Support/Auth/AdminLoginLockout.php
+39 -10
View File
@@ -9,19 +9,47 @@ class AdminLoginLockout
{
public const MAX_FAILURES = 4;
public const BLOCK_MINUTES = 20;
public const KIND_IP = 'ip';
public const KIND_ACCOUNT = 'account';
public static function blockedUntil(string $ip): ?\DateTimeInterface
public static function activeBlock(string $ip, string $username): ?AdminLoginBlock
{
$block = AdminLoginBlock::where('ip', $ip)->first();
return $block?->isBlocked() ? $block->blocked_until : null;
return AdminLoginBlock::active()
->where(fn ($query) => $query
->where(['kind' => self::KIND_IP, 'identifier' => $ip])
->orWhere(fn ($account) => $account->where(['kind' => self::KIND_ACCOUNT, 'identifier' => self::accountKey($username)])))
->orderByDesc('blocked_until')
->first();
}
public static function recordFailure(string $ip, string $username, ?string $userAgent): AdminLoginBlock
/**
* @return list<AdminLoginBlock> IP counter first, then the account counter when a username was given
*/
public static function recordFailure(string $ip, string $username, ?string $userAgent): array
{
return DB::transaction(function () use ($ip, $username, $userAgent) {
AdminLoginBlock::query()->insertOrIgnore(['ip' => $ip, 'created_at' => now(), 'updated_at' => now()]);
$block = AdminLoginBlock::where('ip', $ip)->lockForUpdate()->firstOrFail();
$blocks = [self::recordOne(self::KIND_IP, $ip, $ip, $username, $userAgent)];
if (self::accountKey($username) !== '') {
$blocks[] = self::recordOne(self::KIND_ACCOUNT, self::accountKey($username), $ip, $username, $userAgent);
}
return $blocks;
}
/**
* @param list<AdminLoginBlock> $blocks
*/
public static function remainingAttempts(array $blocks): int
{
return max(0, min(array_map(fn (AdminLoginBlock $block) => self::MAX_FAILURES + 1 - $block->failed_attempts, $blocks)));
}
private static function recordOne(string $kind, string $identifier, string $ip, string $username, ?string $userAgent): AdminLoginBlock
{
return DB::transaction(function () use ($kind, $identifier, $ip, $username, $userAgent) {
AdminLoginBlock::query()->insertOrIgnore([
'kind' => $kind, 'identifier' => $identifier, 'created_at' => now(), 'updated_at' => now(),
]);
$block = AdminLoginBlock::where(['kind' => $kind, 'identifier' => $identifier])->lockForUpdate()->firstOrFail();
$windowExpired = $block->last_failed_at === null
|| $block->last_failed_at->lt(now()->subMinutes(self::BLOCK_MINUTES));
@@ -30,6 +58,7 @@ class AdminLoginLockout
$block->update([
'failed_attempts' => $attempts,
'last_username' => mb_substr($username, 0, 191),
'last_ip' => $ip,
'user_agent' => $userAgent ? mb_substr($userAgent, 0, 500) : null,
'last_failed_at' => now(),
'blocked_until' => $attempts > self::MAX_FAILURES
@@ -41,8 +70,8 @@ class AdminLoginLockout
});
}
public static function remainingAttempts(AdminLoginBlock $block): int
private static function accountKey(string $username): string
{
return max(0, self::MAX_FAILURES + 1 - $block->failed_attempts);
return mb_strtolower(mb_substr(trim($username), 0, 191));
}
}