feat: tg/ws/security/

app/Http/Controllers/Agent/AuthController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Agent;
 
 use App\Http\Controllers\Controller;
+use App\Models\SystemLog;
 use App\Models\User;
 use App\Services\AdminGoogle2fa;
 use App\Support\VisitorIp;
@@ -63,6 +64,12 @@ class AuthController extends Controller
 
         /** @var User|null $user */
         $user = User::query()->where('username', $credentials['username'])->first();
+        if ($user && $user->isLocked()) {
+            return response()->json([
+                'code' => 1,
+                'msg' => '账号已被封锁（连续输错密码 '.self::MAX_ATTEMPTS.' 次），请联系管理员解除',
+            ]);
+        }
         if ($user && ! $user->isEnabled()) {
             RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
 
@@ -75,6 +82,31 @@ class AuthController extends Controller
         )) {
             RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
 
+            if ($user) {
+                $justLocked = $user->recordFailedLogin(self::MAX_ATTEMPTS);
+                if ($justLocked) {
+                    SystemLog::record(
+                        $user,
+                        'agent',
+                        SystemLog::ACTION_AGENT_LOCKED,
+                        '代理「'.$user->username.'」连续输错密码 '.self::MAX_ATTEMPTS.' 次，账号被自动封锁',
+                        $request,
+                    );
+
+                    return response()->json([
+                        'code' => 1,
+                        'msg' => '密码连续输错 '.self::MAX_ATTEMPTS.' 次，账号已被封锁，请联系管理员解除',
+                    ]);
+                }
+                $remaining = self::MAX_ATTEMPTS - (int) $user->fresh()->login_attempts;
+                if ($remaining > 0) {
+                    return response()->json([
+                        'code' => 1,
+                        'msg' => '用户名或密码错误（剩余 '.$remaining.' 次尝试机会）',
+                    ]);
+                }
+            }
+
             return response()->json(['code' => 1, 'msg' => '用户名或密码错误']);
         }
 
@@ -96,6 +128,7 @@ class AuthController extends Controller
         }
 
         RateLimiter::clear($throttleKey);
+        $user->clearLoginAttempts();
         $request->session()->regenerate();
 
         return response()->json([