feat: harden identity and recovery operations

app/Http/Controllers/Auth/MicrosoftAuthController.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Domain\Identity\Exceptions\MicrosoftAuthenticationException;
+use App\Domain\Identity\Services\MicrosoftIdentityService;
+use App\Http\Controllers\Controller;
+use App\Integrations\Microsoft\MicrosoftOidcClient;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+final class MicrosoftAuthController extends Controller
+{
+    public function redirect(Request $request, MicrosoftOidcClient $client): RedirectResponse
+    {
+        try {
+            $authorization = $client->authorizationRequest();
+        } catch (MicrosoftAuthenticationException $exception) {
+            return $this->failure($request, $exception->getMessage());
+        }
+
+        $request->session()->put('microsoft_oidc', [
+            ...$authorization['flow'],
+            'intent' => 'login',
+            'user_id' => null,
+        ]);
+
+        return redirect()->away($authorization['url']);
+    }
+
+    public function callback(
+        Request $request,
+        MicrosoftOidcClient $client,
+        MicrosoftIdentityService $identities,
+    ): RedirectResponse {
+        $flow = $request->session()->pull('microsoft_oidc');
+
+        if (! is_array($flow)
+            || ! is_string($flow['state'] ?? null)
+            || ! is_string($flow['nonce'] ?? null)
+            || ! is_string($flow['code_verifier'] ?? null)
+            || ! in_array($flow['intent'] ?? null, ['login', 'link'], true)
+            || ! is_string($request->query('state'))
+            || ! hash_equals($flow['state'], $request->query('state'))
+            || ! is_int($flow['created_at'] ?? null)
+            || $flow['created_at'] < time() - 600) {
+            return $this->failure($request, 'O pedido de autenticação expirou ou não é válido.');
+        }
+
+        if ($request->filled('error')) {
+            return $this->failure($request, 'A autenticação Microsoft foi cancelada ou recusada.');
+        }
+
+        $code = $request->query('code');
+        if (! is_string($code) || $code === '') {
+            return $this->failure($request, 'O Microsoft Entra não devolveu o código de autenticação.');
+        }
+
+        try {
+            $claims = $client->authenticate($code, (string) $flow['code_verifier'], (string) $flow['nonce']);
+
+            if ($flow['intent'] === 'link') {
+                $user = $request->user();
+                if ($user === null || $user->id !== ($flow['user_id'] ?? null)) {
+                    throw new MicrosoftAuthenticationException('A sessão local mudou durante a associação da identidade.');
+                }
+
+                $identities->link($user, $claims, $request);
+
+                return redirect()->route('security.edit')->with('success', 'Identidade Microsoft associada com sucesso.');
+            }
+
+            $user = $identities->userForLogin($claims, $request);
+            Auth::login($user);
+            $request->session()->regenerate();
+
+            return redirect()->intended(route('dashboard', absolute: false));
+        } catch (MicrosoftAuthenticationException $exception) {
+            return $this->failure($request, $exception->getMessage());
+        } catch (Throwable $exception) {
+            Log::warning('Falha inesperada na autenticação Microsoft.', [
+                'exception' => $exception::class,
+            ]);
+
+            return $this->failure($request, 'Não foi possível concluir a autenticação Microsoft.');
+        }
+    }
+
+    private function failure(Request $request, string $message): RedirectResponse
+    {
+        return redirect()->route($request->user() === null ? 'login' : 'security.edit')->with('error', $message);
+    }
+}

app/Http/Controllers/HealthController.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Throwable;
+
+final class HealthController extends Controller
+{
+    public function live(): JsonResponse
+    {
+        return response()
+            ->json(['status' => 'ok'])
+            ->header('Cache-Control', 'no-store');
+    }
+
+    public function ready(): JsonResponse
+    {
+        try {
+            DB::select('select 1');
+
+            $key = 'health:'.bin2hex(random_bytes(12));
+            Cache::put($key, 'ok', 5);
+            $cacheReady = Cache::pull($key) === 'ok';
+
+            if (! $cacheReady) {
+                throw new \RuntimeException('Cache read/write check failed.');
+            }
+        } catch (Throwable $exception) {
+            report($exception);
+
+            return response()
+                ->json(['status' => 'not_ready'], 503)
+                ->header('Cache-Control', 'no-store');
+        }
+
+        return response()
+            ->json(['status' => 'ready'])
+            ->header('Cache-Control', 'no-store');
+    }
+}

app/Http/Controllers/Settings/MicrosoftIdentityController.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Controllers\Settings;
+
+use App\Domain\Identity\Exceptions\MicrosoftAuthenticationException;
+use App\Domain\Identity\Services\MicrosoftIdentityService;
+use App\Http\Controllers\Controller;
+use App\Integrations\Microsoft\MicrosoftOidcClient;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+final class MicrosoftIdentityController extends Controller
+{
+    public function redirect(Request $request, MicrosoftOidcClient $client): RedirectResponse
+    {
+        try {
+            $authorization = $client->authorizationRequest();
+        } catch (MicrosoftAuthenticationException $exception) {
+            return back()->with('error', $exception->getMessage());
+        }
+        $request->session()->put('microsoft_oidc', [
+            ...$authorization['flow'],
+            'intent' => 'link',
+            'user_id' => $request->user()->id,
+        ]);
+
+        return redirect()->away($authorization['url']);
+    }
+
+    public function destroy(Request $request, MicrosoftIdentityService $identities): RedirectResponse
+    {
+        $identities->unlink($request->user(), $request);
+
+        return back()->with('success', 'Associação à identidade Microsoft removida.');
+    }
+}

app/Http/Controllers/Settings/SecurityController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Settings;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Settings\PasswordUpdateRequest;
 use App\Http\Requests\Settings\TwoFactorAuthenticationRequest;
+use App\Integrations\Microsoft\MicrosoftOidcClient;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Validation\Rules\Password;
 use Inertia\Inertia;
@@ -16,8 +17,12 @@ class SecurityController extends Controller
     /**
      * Show the user's security settings page.
      */
-    public function edit(TwoFactorAuthenticationRequest $request): Response
+    public function edit(TwoFactorAuthenticationRequest $request, MicrosoftOidcClient $microsoft): Response
     {
+        $microsoftIdentity = $request->user()
+            ->externalIdentities()
+            ->where('provider', 'microsoft')
+            ->first();
         $props = [
             'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
             'canManagePasskeys' => Features::canManagePasskeys(),
@@ -38,6 +43,12 @@ class SecurityController extends Controller
                     ->all()
                 : [],
             'passwordRules' => Password::defaults()->toPasswordRulesString(),
+            'microsoft' => [
+                'enabled' => $microsoft->configured(),
+                'linked' => $microsoftIdentity !== null,
+                'email' => $microsoftIdentity?->provider_email,
+                'lastLoginAt' => $microsoftIdentity?->last_login_at?->toIso8601String(),
+            ],
         ];
 
         if (Features::canManageTwoFactorAuthentication()) {