City10/app/Http/Controllers/Web/AuthController.php

<?php

namespace App\Http\Controllers\Web;

use App\Http\Controllers\Controller;
use App\Http\Requests\LoginRequest;
use App\Http\Requests\RegisterRequest;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\View\View;

/**
 * Web authentication controllers (session based).
 *
 * Complements the token-based API with a traditional server-rendered
 * login and registration flow including a math CAPTCHA.
 */
class AuthController extends Controller
{
    /**
     * Show the login form.
     */
    public function showLogin(): View
    {
        return view('auth.login', [
            'captcha' => self::makeCaptcha(),
        ]);
    }

    /**
     * Handle the login form submission.
     */
    public function login(LoginRequest $request): RedirectResponse
    {
        $credentials = $request->only('email', 'password');
        $remember = $request->boolean('remember');

        if (! Auth::attempt($credentials, $remember)) {
            return back()->withErrors([
                'email' => __('auth.failed'),
            ])->onlyInput('email');
        }

        $user = Auth::user();

        if ($user->status === User::STATUS_PENDING) {
            Auth::logout();
            $request->session()->invalidate();
            $request->session()->regenerateToken();

            return redirect()->route('login')->withErrors([
                'email' => __('auth.pending'),
            ]);
        }

        if ($user->status === User::STATUS_BANNED || ! $user->is_active) {
            Auth::logout();
            $request->session()->invalidate();
            $request->session()->regenerateToken();

            return redirect()->route('login')->withErrors([
                'email' => __('auth.disabled'),
            ]);
        }

        $user->forceFill(['last_login_at' => now()])->save();
        $request->session()->regenerate();

        // Seed the session locale from the user's stored preference so the
        // SetLocale middleware renders the UI in their chosen language.
        if (in_array($user->locale, ['pt_BR', 'en', 'es'], true)) {
            $request->session()->put('locale', $user->locale);
        }

        return redirect()->intended(route('dashboard'));
    }

    /**
     * Show the registration form.
     */
    public function showRegister(): View
    {
        return view('auth.register', [
            'captcha' => self::makeCaptcha(),
        ]);
    }

    /**
     * Handle the registration form submission.
     */
    public function register(RegisterRequest $request): RedirectResponse
    {
        $data = $request->validated();

        $user = User::create([
            'name' => $data['name'],
            'email' => $data['email'],
            'password' => $data['password'],
            'role' => User::ROLE_USER,
            'status' => User::STATUS_PENDING,
            'locale' => $data['locale'] ?? 'pt_BR',
            'is_active' => false,
        ]);

        Auth::login($user);
        $request->session()->regenerate();

        return redirect()->route('terms.accept');
    }

    /**
     * Log the user out of the web session.
     */
    public function logout(Request $request): RedirectResponse
    {
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        return redirect()->route('login');
    }

    /**
     * Build a fresh math CAPTCHA challenge.
     *
     * @return array{a: int, b: int, question: string}
     */
    private static function makeCaptcha(): array
    {
        $a = random_int(1, 9);
        $b = random_int(1, 9);

        session()->put('captcha_result', $a + $b);
        session()->put('captcha_expires_at', now()->addMinutes(10)->getTimestamp());

        return [
            'a' => $a,
            'b' => $b,
            'question' => sprintf('%d + %d = ?', $a, $b),
        ];
    }
}