feat: harden identity and recovery operations

app/Http/Controllers/Settings/MicrosoftIdentityController.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Controllers\Settings;
+
+use App\Domain\Identity\Exceptions\MicrosoftAuthenticationException;
+use App\Domain\Identity\Services\MicrosoftIdentityService;
+use App\Http\Controllers\Controller;
+use App\Integrations\Microsoft\MicrosoftOidcClient;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+final class MicrosoftIdentityController extends Controller
+{
+    public function redirect(Request $request, MicrosoftOidcClient $client): RedirectResponse
+    {
+        try {
+            $authorization = $client->authorizationRequest();
+        } catch (MicrosoftAuthenticationException $exception) {
+            return back()->with('error', $exception->getMessage());
+        }
+        $request->session()->put('microsoft_oidc', [
+            ...$authorization['flow'],
+            'intent' => 'link',
+            'user_id' => $request->user()->id,
+        ]);
+
+        return redirect()->away($authorization['url']);
+    }
+
+    public function destroy(Request $request, MicrosoftIdentityService $identities): RedirectResponse
+    {
+        $identities->unlink($request->user(), $request);
+
+        return back()->with('success', 'Associação à identidade Microsoft removida.');
+    }
+}

app/Http/Controllers/Settings/SecurityController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Settings;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Settings\PasswordUpdateRequest;
 use App\Http\Requests\Settings\TwoFactorAuthenticationRequest;
+use App\Integrations\Microsoft\MicrosoftOidcClient;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Validation\Rules\Password;
 use Inertia\Inertia;
@@ -16,8 +17,12 @@ class SecurityController extends Controller
     /**
      * Show the user's security settings page.
      */
-    public function edit(TwoFactorAuthenticationRequest $request): Response
+    public function edit(TwoFactorAuthenticationRequest $request, MicrosoftOidcClient $microsoft): Response
     {
+        $microsoftIdentity = $request->user()
+            ->externalIdentities()
+            ->where('provider', 'microsoft')
+            ->first();
         $props = [
             'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
             'canManagePasskeys' => Features::canManagePasskeys(),
@@ -38,6 +43,12 @@ class SecurityController extends Controller
                     ->all()
                 : [],
             'passwordRules' => Password::defaults()->toPasswordRulesString(),
+            'microsoft' => [
+                'enabled' => $microsoft->configured(),
+                'linked' => $microsoftIdentity !== null,
+                'email' => $microsoftIdentity?->provider_email,
+                'lastLoginAt' => $microsoftIdentity?->last_login_at?->toIso8601String(),
+            ],
         ];
 
         if (Features::canManageTwoFactorAuthentication()) {