93 lines
3.0 KiB
PHP
93 lines
3.0 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\TenantSetupToken;
|
|
use App\Models\Inquiry;
|
|
use App\Models\User;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Inertia\Inertia;
|
|
use Inertia\Response;
|
|
use Illuminate\Http\RedirectResponse;
|
|
|
|
class TenantSetupController extends Controller
|
|
{
|
|
/**
|
|
* Display the one-time admin setup form.
|
|
*/
|
|
public function showSetupForm(Request $request): Response|RedirectResponse
|
|
{
|
|
$rawToken = $request->query('token');
|
|
if (!$rawToken) {
|
|
return redirect()->route('login')->with('error', 'Invalid setup link.');
|
|
}
|
|
|
|
$tokenHash = hash('sha256', $rawToken);
|
|
$setupToken = TenantSetupToken::where('token_hash', $tokenHash)->first();
|
|
|
|
if (!$setupToken || $setupToken->isUsed() || $setupToken->isExpired()) {
|
|
return redirect()->route('login')->with('error', 'This setup link is invalid, used, or has expired.');
|
|
}
|
|
|
|
return Inertia::render('auth/setup-admin', [
|
|
'token' => $rawToken,
|
|
'email' => $setupToken->email,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Handle the password set request for admin setup.
|
|
*/
|
|
public function completeSetup(Request $request): RedirectResponse
|
|
{
|
|
// Rate-limit setup attempts
|
|
$throttleKey = 'tenant-setup:' . $request->ip();
|
|
if (RateLimiter::tooManyAttempts($throttleKey, 5)) {
|
|
return back()->withErrors(['password' => 'Too many setup attempts. Please try again later.']);
|
|
}
|
|
RateLimiter::hit($throttleKey, 60);
|
|
|
|
$request->validate([
|
|
'token' => 'required|string',
|
|
'password' => 'required|string|min:8|confirmed',
|
|
]);
|
|
|
|
$tokenHash = hash('sha256', $request->token);
|
|
$setupToken = TenantSetupToken::where('token_hash', $tokenHash)->first();
|
|
|
|
if (!$setupToken || $setupToken->isUsed() || $setupToken->isExpired()) {
|
|
return redirect()->route('login')->with('error', 'This setup link is invalid, used, or has expired.');
|
|
}
|
|
|
|
// Update admin user inside active tenant context or find by email
|
|
$user = User::where('email', $setupToken->email)->first();
|
|
if (!$user) {
|
|
return back()->withErrors(['password' => 'Administrator account not found.']);
|
|
}
|
|
|
|
$user->update([
|
|
'password' => Hash::make($request->password),
|
|
'status' => 'active',
|
|
'is_enable_login' => 1,
|
|
'email_verified_at' => now(),
|
|
]);
|
|
|
|
// Mark token as used
|
|
$setupToken->update([
|
|
'used_at' => now(),
|
|
]);
|
|
|
|
// Update inquiry status to activated if exists
|
|
$inquiry = Inquiry::on('sqlite')->where('email', $setupToken->email)->first();
|
|
if ($inquiry) {
|
|
$inquiry->update(['status' => 'activated']);
|
|
}
|
|
|
|
RateLimiter::clear($throttleKey);
|
|
|
|
return redirect()->route('login')->with('success', 'Your administrator account has been activated successfully! You may now log in.');
|
|
}
|
|
}
|