Дмитрий 518d71e81f feat(security): per-IP route-throttle на auth-эндпоинтах — P1 go-live ...

Именованные лимитеры auth-login/auth-2fa/auth-password (perMinute 20 by IP) в AppServiceProvider; throttle-middleware на login/forgot/reset/2fa-verify/recovery в web.php. Закрывает per-IP объёмный перебор. Pest tests/Feature/Auth 97/97 GREEN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-17 19:56:23 +03:00

..

AuthControllerTest.php

phase2(auth-backend): Sanctum SPA mode + AuthController + 13 Pest tests

2026-05-08 19:41:35 +03:00

AuthFlowIntegrationTest.php

style+fix(auth): pint formatting + nullsafe.neverNull fix + P1 plan DONE marker

2026-05-22 17:43:18 +03:00

AuthLogCoverageTest.php

style+fix(auth): pint formatting + nullsafe.neverNull fix + P1 plan DONE marker

2026-05-22 17:43:18 +03:00

AuthRouteThrottleTest.php

feat(security): per-IP route-throttle на auth-эндпоинтах — P1 go-live

2026-06-17 19:56:23 +03:00

ForgotPasswordTest.php

phase2(forgot-password): POST /api/auth/forgot + ForgotPasswordView интеграция

2026-05-08 21:10:28 +03:00

IpLockoutTest.php

phase2(ip-lockout): auth_log записи + 10 неудач/час с IP → 429 (ТЗ §22.4.4 п.2)

2026-05-09 04:07:17 +03:00

NotificationPreferencesTest.php

phase2(notifications-stage3): NotificationsTab schema-aligned + prefs API

2026-05-09 11:41:35 +03:00

RateLimitTest.php

phase2(rate-limit): login + 2FA verify (5/15min) + frontend lockout

2026-05-08 20:49:47 +03:00

RecoveryCodeTest.php

phase2(recovery-code): POST /api/auth/2fa/recovery-use + UseRecoveryCodeView

2026-05-09 03:43:58 +03:00

ResetPasswordTest.php

phase2(reset-password): POST /api/auth/reset-password + ResetPasswordView + DB timezone fix

2026-05-09 03:36:27 +03:00

SuspiciousLoginNotificationTest.php

phase2(suspicious-login): email при 3 неудачах login (ТЗ §22.4.4 п.3)

2026-05-09 04:10:58 +03:00

TwoFactorSetupTest.php

phase2(2fa-setup): wizard init+confirm+disable+regenerate в SettingsView/SecurityTab

2026-05-09 04:03:02 +03:00

TwoFactorTest.php

phase2(auth-2fa): TOTP-verify endpoint + TwoFactorView интеграция

2026-05-08 20:14:33 +03:00

UpdateProfileTest.php

test(auth): UpdateProfileTest — 422 coverage for empty last_name (review M1)

2026-05-15 21:30:13 +03:00