feat: harden identity and recovery operations

routes/settings.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Controllers\Settings\MicrosoftIdentityController;
 use App\Http\Controllers\Settings\ProfileController;
 use App\Http\Controllers\Settings\SecurityController;
 use Illuminate\Auth\Middleware\RequirePassword;
@@ -23,6 +24,14 @@ Route::middleware(['auth', 'verified'])->group(function () {
         ->middleware('throttle:6,1')
         ->name('user-password.update');
 
+    Route::delete('settings/microsoft-identity', [MicrosoftIdentityController::class, 'destroy'])
+        ->middleware(RequirePassword::class)
+        ->name('identity.microsoft.destroy');
+
+    Route::get('settings/microsoft-identity/redirect', [MicrosoftIdentityController::class, 'redirect'])
+        ->middleware([RequirePassword::class, 'throttle:10,1'])
+        ->name('identity.microsoft.redirect');
+
     Route::inertia('settings/appearance', 'settings/appearance')->name('appearance.edit');
 });
 

routes/web.php

@@ -7,8 +7,10 @@ use App\Http\Controllers\Admin\UserController;
 use App\Http\Controllers\ApprovalController;
 use App\Http\Controllers\AssetController;
 use App\Http\Controllers\AuditController;
+use App\Http\Controllers\Auth\MicrosoftAuthController;
 use App\Http\Controllers\DashboardController;
 use App\Http\Controllers\GlobalCalendarController;
+use App\Http\Controllers\HealthController;
 use App\Http\Controllers\NotificationController;
 use App\Http\Controllers\OperationController;
 use App\Http\Controllers\ReportController;
@@ -16,6 +18,15 @@ use App\Http\Controllers\ReservationController;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/', fn () => redirect()->route(auth()->check() ? 'dashboard' : 'login'))->name('home');
+Route::get('health/live', [HealthController::class, 'live'])->name('health.live');
+Route::get('health/ready', [HealthController::class, 'ready'])->name('health.ready');
+
+Route::middleware('throttle:10,1')->group(function () {
+    Route::get('auth/microsoft/redirect', [MicrosoftAuthController::class, 'redirect'])
+        ->middleware('guest')
+        ->name('auth.microsoft.redirect');
+    Route::get('auth/microsoft/callback', [MicrosoftAuthController::class, 'callback'])->name('auth.microsoft.callback');
+});
 
 Route::middleware(['auth', 'verified'])->group(function () {
     Route::get('dashboard', DashboardController::class)->name('dashboard');