latest

backend/app/Actions/Auth/VerifyTwoFactorAction.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Actions\Auth;
+
+use App\Models\User;
+use App\Services\TwoFactorService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Validation\ValidationException;
+
+class VerifyTwoFactorAction
+{
+    public function __construct(private readonly TwoFactorService $twoFactor) {}
+
+    public function execute(Request $request, string $challengeToken, string $code): User
+    {
+        $cacheKey = "2fa_challenge:{$challengeToken}";
+        $challenge = Cache::get($cacheKey);
+
+        if (! $challenge || $challenge['ip'] !== $request->ip()) {
+            throw ValidationException::withMessages([
+                'challenge_token' => 'This challenge has expired. Please log in again.',
+            ]);
+        }
+
+        if ($challenge['attempts'] >= 5) {
+            Cache::forget($cacheKey);
+
+            throw ValidationException::withMessages([
+                'code' => 'Too many failed attempts. Please log in again.',
+            ]);
+        }
+
+        $user = User::findOrFail($challenge['user_id']);
+
+        $valid = $this->twoFactor->verifyCode($user->two_factor_secret, $code)
+            || $this->twoFactor->redeemRecoveryCode($user, $code);
+
+        if (! $valid) {
+            $challenge['attempts']++;
+            Cache::put($cacheKey, $challenge, now()->addMinutes(5));
+
+            throw ValidationException::withMessages([
+                'code' => 'That code is invalid.',
+            ]);
+        }
+
+        Cache::forget($cacheKey);
+
+        Auth::login($user);
+        $request->session()->regenerate();
+
+        return $user;
+    }
+}