class PasswordRecoveryController extends Controller (View source)

Class PasswordRecoveryController.

Handles secure password recovery via email-based code validation. Implements rate limiting, expiration control, and session verification to ensure safe password reset flows.

Traits

AuthorizesRequests
DispatchesJobs
ValidatesRequests

Trait JsonResponseTrait.

Provides standardized and safe error logging with UTF-8 encoding, sensitive data masking, and controlled stack traces.

Constants

private EXPIRATION_MINUTES

private MAX_ATTEMPTS

private ATTEMPT_TTL_SECONDS

Properties

protected EmailService $emailService

Methods

JsonResponse
successResponse(array $data = [])

Return a 200 OK JSON response.

JsonResponse
createdResponse(array $data = [])

Return a 201 Created JSON response.

JsonResponse
acceptedResponse()

Return a 202 Accepted JSON response (request accepted for processing).

JsonResponse
noContentResponse()

Return a 204 No Content JSON response.

JsonResponse
resetContentResponse()

Return a 205 Reset Content JSON response.

JsonResponse
badRequestResponse(array $errors)

Return a 400 Bad Request JSON response.

JsonResponse
unauthorizedResponse(string $message = 'Não autorizado.')

Return a 401 Unauthorized JSON response.

JsonResponse
forbiddenResponse(string $message = 'Acesso negado.')

Return a 403 Forbidden JSON response.

JsonResponse
notFoundResponse(string $message = 'Recurso não encontrado.')

Return a 404 Not Found JSON response.

JsonResponse
conflictResponse(array $errors)

Return a 409 Conflict JSON response.

JsonResponse
validationErrorResponse(array $errors)

Return a 422 Unprocessable Entity JSON response for validation errors.

JsonResponse
tooManyRequestsResponse(string $message = 'Muitas requisições. Tente novamente mais tarde.')

Return a 429 Too Many Requests JSON response.

JsonResponse
internalErrorResponse(Throwable $e, string $message = 'Erro interno.')

Return a 500 Internal Server Error JSON response.

void
logError(string $message, Throwable $exception, array $context = [], string|null $channel = null)

Logs an error with consistent formatting and context.

array
sanitizeSensitiveData(array $data)

Masks common sensitive fields (e.g., passwords, tokens) in the given context array.

array
encodeStringsUtf8(array $data)

Recursively converts all string values to UTF-8.

string
getLimitedTrace(Throwable $exception, int $maxLines = 10)

Returns a string representation of the exception trace, limited to the given number of lines.

__construct(EmailService $emailService)

Initializes the controller with the email service dependency.

JsonResponse
sendCode(SendCodeRequest $request)

Sends a password recovery code to the user's email.

JsonResponse
resendCode(Request $request)

Resends a new recovery code using the stored session email.

JsonResponse
validateCode(ValidateCodeRequest $request)

Validates the recovery code and allows password reset if successful.

JsonResponse
resetPassword(ResetPasswordRequest $request)

Resets the user's password after successful code validation.

Details

protected JsonResponse successResponse(array $data = [])

Return a 200 OK JSON response.

Parameters

array $data

response payload

Return Value

JsonResponse

protected JsonResponse createdResponse(array $data = [])

Return a 201 Created JSON response.

Parameters

array $data

newly created resource data

Return Value

JsonResponse

protected JsonResponse acceptedResponse()

Return a 202 Accepted JSON response (request accepted for processing).

Return Value

JsonResponse

protected JsonResponse noContentResponse()

Return a 204 No Content JSON response.

Return Value

JsonResponse

protected JsonResponse resetContentResponse()

Return a 205 Reset Content JSON response.

Return Value

JsonResponse

protected JsonResponse badRequestResponse(array $errors)

Return a 400 Bad Request JSON response.

Parameters

array $errors

validation or request errors

Return Value

JsonResponse

protected JsonResponse unauthorizedResponse(string $message = 'Não autorizado.')

Return a 401 Unauthorized JSON response.

Parameters

string $message

optional error message

Return Value

JsonResponse

protected JsonResponse forbiddenResponse(string $message = 'Acesso negado.')

Return a 403 Forbidden JSON response.

Parameters

string $message

optional error message

Return Value

JsonResponse

protected JsonResponse notFoundResponse(string $message = 'Recurso não encontrado.')

Return a 404 Not Found JSON response.

Parameters

string $message

optional error message

Return Value

JsonResponse

protected JsonResponse conflictResponse(array $errors)

Return a 409 Conflict JSON response.

Parameters

array $errors

conflict details

Return Value

JsonResponse

protected JsonResponse validationErrorResponse(array $errors)

Return a 422 Unprocessable Entity JSON response for validation errors.

Parameters

array $errors

validation error details

Return Value

JsonResponse

protected JsonResponse tooManyRequestsResponse(string $message = 'Muitas requisições. Tente novamente mais tarde.')

Return a 429 Too Many Requests JSON response.

Parameters

string $message

optional rate limit message

Return Value

JsonResponse

protected JsonResponse internalErrorResponse(Throwable $e, string $message = 'Erro interno.')

Return a 500 Internal Server Error JSON response.

Logs the exception and returns a standardized JSON error message.

Parameters

Throwable $e

the thrown exception

string $message

optional user-friendly message

Return Value

JsonResponse

protected void logError(string $message, Throwable $exception, array $context = [], string|null $channel = null)

Logs an error with consistent formatting and context.

Parameters

string $message

descriptive error message

Throwable $exception

the thrown exception

array $context

additional context to include in the log

string|null $channel

Optional log channel (e.g., 'classes').

Return Value

void

protected array sanitizeSensitiveData(array $data)

Masks common sensitive fields (e.g., passwords, tokens) in the given context array.

Parameters

array $data

Return Value

array

protected array encodeStringsUtf8(array $data)

Recursively converts all string values to UTF-8.

Parameters

array $data

Return Value

array

protected string getLimitedTrace(Throwable $exception, int $maxLines = 10)

Returns a string representation of the exception trace, limited to the given number of lines.

Parameters

Throwable $exception
int $maxLines

Return Value

string

__construct(EmailService $emailService)

Initializes the controller with the email service dependency.

Parameters

EmailService $emailService

service responsible for sending recovery emails

JsonResponse sendCode(SendCodeRequest $request)

Sends a password recovery code to the user's email.

Starts a new recovery session.

Parameters

SendCodeRequest $request

validated request containing the user's email

Return Value

JsonResponse

redirects to the code input form or returns an error

Exceptions

ModelNotFoundException
RuntimeException

JsonResponse resendCode(Request $request)

Resends a new recovery code using the stored session email.

Parameters

Request $request

HTTP request containing the session data

Return Value

JsonResponse

success response or session error

JsonResponse validateCode(ValidateCodeRequest $request)

Validates the recovery code and allows password reset if successful.

Parameters

ValidateCodeRequest $request

validated request containing the recovery code

Return Value

JsonResponse

redirects to the password reset form or returns an error

JsonResponse resetPassword(ResetPasswordRequest $request)

Resets the user's password after successful code validation.

Parameters

ResetPasswordRequest $request

validated request containing the new password

Return Value

JsonResponse

redirects to the login route or returns an error