oportunidades 4

bootstrap/app.php

@@ -4,12 +4,14 @@ use App\Http\Middleware\EnsureSimulationRecoveryCookie;
 use App\Http\Middleware\HandleAppearance;
 use App\Http\Middleware\HandleInertiaRequests;
 use App\Http\Middleware\PreserveFormFeedback;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Database\QueryException;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
 use Illuminate\Http\Middleware\AddLinkHeadersForPreloadedAssets;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -31,6 +33,28 @@ return Application::configure(basePath: dirname(__DIR__))
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
+        $exceptions->dontReportWhen(fn (Throwable $exception) => $exception instanceof DecryptException
+            && request()->isMethod('POST') && request()->is('two-factor-challenge'));
+        $exceptions->render(function (DecryptException $exception, Request $request) {
+            if (! $request->isMethod('POST') || ! $request->is('two-factor-challenge')) {
+                return null;
+            }
+            $reference = (string) Str::uuid();
+            Log::warning('Two-factor credential could not be decrypted; authentication refused.', [
+                'reference' => $reference, 'pending_user_id' => $request->session()->get('login.id'),
+            ]);
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+            $message = 'Não foi possível verificar a autenticação desta conta. Inicie sessão novamente ou contacte o suporte.';
+            if ($request->expectsJson()) {
+                $field = $request->filled('recovery_code') ? 'recovery_code' : 'code';
+
+                return response()->json(['message' => $message, 'errors' => [$field => [$message]], 'reference' => $reference], 422)
+                    ->header('Cache-Control', 'no-store');
+            }
+
+            return redirect()->route('login')->withErrors(['email' => $message])->header('Cache-Control', 'no-store');
+        });
         $exceptions->shouldRenderJsonWhen(
             fn (Request $request) => $request->is('api/*') || $request->expectsJson(),
         );