feat: harden identity and recovery operations

app/Domain/Identity/Models/ExternalIdentity.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Domain\Identity\Models;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Carbon;
+
+/**
+ * @property int $id
+ * @property int $user_id
+ * @property string $provider
+ * @property string $provider_subject
+ * @property string|null $tenant_id
+ * @property string $provider_email
+ * @property array<string, mixed>|null $claims
+ * @property Carbon|null $last_login_at
+ */
+class ExternalIdentity extends Model
+{
+    protected $fillable = [
+        'user_id',
+        'provider',
+        'provider_subject',
+        'tenant_id',
+        'provider_email',
+        'claims',
+        'last_login_at',
+    ];
+
+    /** @return BelongsTo<User, $this> */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'claims' => 'array',
+            'last_login_at' => 'datetime',
+        ];
+    }
+}