feat: reset password

app/Http/Controllers/AuthController.php

@@ -3,11 +3,14 @@
 namespace App\Http\Controllers;
 
 use App\Http\Requests\EmailVerificationNotificationRequest;
+use App\Http\Requests\ForgotPasswordRequest;
 use App\Http\Requests\LoginRequest;
 use App\Http\Requests\RegisterRequest;
+use App\Http\Requests\ResetPasswordRequest;
 use App\Http\Requests\UpdateUserRequest;
 use App\Http\Resources\UserResource;
 use App\Models\User;
+use Illuminate\Auth\Events\PasswordReset;
 use Illuminate\Auth\Events\Verified;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -15,6 +18,7 @@ use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 use Illuminate\View\View;
@@ -123,6 +127,52 @@ class AuthController extends Controller
         ]);
     }
 
+    public function forgotPassword(ForgotPasswordRequest $request): JsonResponse
+    {
+        $email = strtolower($request->validated('email'));
+        $status = Password::sendResetLink(['email' => $email]);
+
+        if ($status === Password::RESET_THROTTLED) {
+            return response()->json([
+                'message' => __($status),
+            ], 429);
+        }
+
+        return response()->json([
+            'message' => __('api.auth.password_reset_link_sent'),
+        ]);
+    }
+
+    public function resetPassword(ResetPasswordRequest $request): JsonResponse
+    {
+        $data = $request->validated();
+        $data['email'] = strtolower($data['email']);
+
+        $status = Password::reset(
+            $data,
+            function (User $user, string $password): void {
+                $user->forceFill([
+                    'password' => Hash::make($password),
+                    'remember_token' => Str::random(60),
+                ])->save();
+
+                $user->tokens()->delete();
+
+                event(new PasswordReset($user));
+            }
+        );
+
+        if ($status !== Password::PASSWORD_RESET) {
+            return response()->json([
+                'message' => __($status),
+            ], 422);
+        }
+
+        return response()->json([
+            'message' => __('api.auth.password_reset'),
+        ]);
+    }
+
     public function logout(): JsonResponse
     {
         $request = request();

app/Http/Requests/ForgotPasswordRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ForgotPasswordRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'string', 'email', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/ResetPasswordRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ResetPasswordRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'string', 'email', 'max:255'],
+            'password' => ['required', 'string', 'min:8', 'confirmed'],
+            'token' => ['required', 'string'],
+        ];
+    }
+}

app/Providers/AppServiceProvider.php

@@ -5,6 +5,7 @@ namespace App\Providers;
 use App\Broadcasting\ExpoPushChannel;
 use App\Mail\VerifyAccount;
 use App\Models\User;
+use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Auth\Notifications\VerifyEmail;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Notification;
@@ -61,6 +62,16 @@ class AppServiceProvider extends ServiceProvider
                 ->to($notifiable->getEmailForVerification())
         );
 
+        ResetPassword::createUrlUsing(function (User $notifiable, string $token): string {
+            $passwordResetUrl = rtrim((string) config('services.mobile.password_reset_url'), '?&');
+            $query = http_build_query([
+                'email' => $notifiable->getEmailForPasswordReset(),
+                'token' => $token,
+            ], '', '&', PHP_QUERY_RFC3986);
+
+            return "{$passwordResetUrl}?{$query}";
+        });
+
         Gate::define('viewApiDocs', function ($user = null) {
             // Option A : Autoriser tout le monde (Attention : la doc sera publique hors local)
             return true;