portal-api/app/Http/Controllers/Api/Admin/Auth/AuthController.php

<?php

namespace App\Http\Controllers\Api\Admin\Auth;

use App\Http\Controllers\Controller;
use App\Http\Requests\UpdateProfileRequest;
use App\Http\Requests\UpdateAdminPasswordRequest;
use App\Http\Resources\Api\Admin\AdminUserResource;
use App\Services\Api\Admin\AdminRefreshTokenService;
use App\Services\ActivityLogger;
use App\Support\Auth\AdminLoginAlert;
use App\Support\Auth\AdminLoginLockout;
use Carbon\Carbon;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\ValidationException;
use Symfony\Component\HttpFoundation\Cookie;
use Tymon\JWTAuth\Facades\JWTAuth;

class AuthController extends Controller
{
    private const REMEMBER_TTL_SECONDS = 2592000;
    private const REFRESH_COOKIE = 'admin_refresh_token';
    private const REFRESH_COOKIE_PATH = '/api/v1/administrator';

    public function __construct(
        private readonly ActivityLogger $activityLogger,
        private readonly AdminRefreshTokenService $refreshTokens,
    ) {}

    public function login(Request $request): JsonResponse
    {
        $request->validate([
            'username' => 'required|string',
            'password' => 'required|string',
            'remember' => 'sometimes|boolean',
        ]);

        $ip = (string) $request->ip();

        if ($blockedUntil = AdminLoginLockout::blockedUntil($ip)) {
            return $this->blockedResponse($blockedUntil);
        }

        $guard = Auth::guard('admin');
        $remember = $request->boolean('remember');
        $credentials = $request->only('username', 'password');
        $token = $guard->attempt($credentials);

        if (!$token) {
            $block = AdminLoginLockout::recordFailure($ip, $request->string('username')->toString(), $request->userAgent());

            $this->activityLogger->log(
                event: 'login_failed',
                logName: 'auth',
                description: '[admin] Đăng nhập thất bại với username: ' . $request->username . ' từ IP ' . $ip,
            );

            if ($block->isBlocked()) {
                return $this->blockedResponse($block->blocked_until);
            }

            $remaining = AdminLoginLockout::remainingAttempts($block);

            return response()->json([
                'error'   => true,
                'message' => sprintf(
                    'Thông tin đăng nhập không chính xác. Còn %d lần thử trước khi IP bị chặn %d phút.',
                    $remaining,
                    AdminLoginLockout::BLOCK_MINUTES,
                ),
                'remaining_attempts' => $remaining,
            ], 401);
        }

        $user = Auth::guard('admin')->user();
        Auth::guard('admin')->getProvider()->rehashPasswordIfRequired($user, $request->only('password'));

        $this->activityLogger->logAuth('login', 'admin', $user->id, $user->username ?? $user->email);
        AdminLoginAlert::send($user, $ip, $request->userAgent());

        $data = [
            'token'      => $token,
            'token_type' => 'bearer',
            'expires_in' => config('jwt.ttl') * 60,
            'user'       => new AdminUserResource($user),
        ];

        if ($remember) {
            $refreshToken = $this->refreshTokens->create($user->id, now()->addDays(30));
            $data['refresh_expires_in'] = self::REMEMBER_TTL_SECONDS;
        }

        $response = response()->json([
            'error' => false,
            'data'  => $data,
        ]);

        return $remember
            ? $response->withCookie($this->refreshCookie($refreshToken, self::REMEMBER_TTL_SECONDS))
            : $response->withCookie($this->forgetRefreshCookie());
    }

    private function blockedResponse(\DateTimeInterface $blockedUntil): JsonResponse
    {
        $minutes = max(1, (int) ceil((Carbon::instance($blockedUntil)->getTimestamp() - now()->getTimestamp()) / 60));

        return response()->json([
            'error'         => true,
            'message'       => sprintf(
                'IP của bạn bị chặn đăng nhập do nhập sai quá %d lần. Thử lại sau %d phút hoặc liên hệ quản trị viên để gỡ chặn.',
                AdminLoginLockout::MAX_FAILURES,
                $minutes,
            ),
            'blocked_until' => Carbon::instance($blockedUntil)->toIso8601String(),
        ], 429);
    }

    public function me(): JsonResponse
    {
        $user = Auth::guard('admin')->user();

        return response()->json([
            'error' => false,
            'data'  => ['user' => new AdminUserResource($user)],
        ]);
    }

    public function updateProfile(UpdateProfileRequest $request): JsonResponse
    {
        $user = Auth::guard('admin')->user();

        $user->update($request->validated());

        return response()->json([
            'error'   => false,
            'message' => 'Cập nhật hồ sơ thành công.',
            'data'    => ['user' => new AdminUserResource($user->fresh())],
        ]);
    }

    public function updatePassword(UpdateAdminPasswordRequest $request): JsonResponse
    {
        $user = Auth::guard('admin')->user();

        $user->update([
            'password' => Hash::make($request->string('password')->toString()),
        ]);

        $this->activityLogger->logAuth(
            'password_changed',
            'admin',
            $user->id,
            $user->username ?? $user->email,
        );

        return response()->json([
            'error'   => false,
            'message' => 'Đổi mật khẩu thành công.',
        ]);
    }

    public function refresh(Request $request): JsonResponse
    {
        if (! $request->ajax()) {
            return response()->json([
                'error'   => true,
                'message' => 'Yêu cầu làm mới phiên không hợp lệ.',
            ], 403);
        }

        $request->validate([
            'refresh_token' => ['prohibited'],
        ]);

        $refreshToken = $request->cookie(self::REFRESH_COOKIE);
        if (! is_string($refreshToken) || $refreshToken === '') {
            return response()->json([
                'error'   => true,
                'message' => 'Phiên ghi nhớ đăng nhập không tồn tại.',
            ], 401)->withCookie($this->forgetRefreshCookie());
        }

        try {
            $result = $this->refreshTokens->rotate($refreshToken);
        } catch (ValidationException) {
            return response()->json([
                'error'   => true,
                'message' => 'Refresh token không hợp lệ hoặc đã hết hạn.',
            ], 401)->withCookie($this->forgetRefreshCookie());
        }

        return response()->json([
            'error' => false,
            'data'  => [
                'token'      => $result['token'],
                'token_type' => 'bearer',
                'expires_in' => config('jwt.ttl') * 60,
                'refresh_expires_in' => $result['refresh_expires_in'],
                'user'       => new AdminUserResource($result['user']),
            ],
        ])->withCookie($this->refreshCookie($result['refresh_token'], $result['refresh_expires_in']));
    }

    public function logout(): JsonResponse
    {
        $refreshToken = request()->cookie(self::REFRESH_COOKIE);
        if (is_string($refreshToken) && $refreshToken !== '') {
            $this->refreshTokens->revoke($refreshToken);
        }

        $user = Auth::guard('admin')->user();
        if ($user) {
            $this->activityLogger->logAuth('logout', 'admin', $user->id, $user->username ?? $user->email);
        }

        Auth::guard('admin')->logout();

        return response()->json([
            'error'   => false,
            'message' => 'Đã đăng xuất thành công.',
        ])->withCookie($this->forgetRefreshCookie());
    }

    private function refreshCookie(string $token, int $maxAgeSeconds): Cookie
    {
        return cookie(
            self::REFRESH_COOKIE,
            $token,
            (int) ceil($maxAgeSeconds / 60),
            self::REFRESH_COOKIE_PATH,
            null,
            true,
            true,
            false,
            app()->isLocal() ? 'none' : 'strict',
        );
    }

    private function forgetRefreshCookie(): Cookie
    {
        return cookie()->forget(self::REFRESH_COOKIE, self::REFRESH_COOKIE_PATH);
    }
}