diff --git a/app/Filament/System/Pages/Auth/Login.php b/app/Filament/System/Pages/Auth/Login.php index 333cd25..f84af1d 100644 --- a/app/Filament/System/Pages/Auth/Login.php +++ b/app/Filament/System/Pages/Auth/Login.php @@ -14,6 +14,14 @@ class Login extends BaseLogin { + /** + * Filament's base login page uses Livewire-level rate limiting. We override it + * to enforce the System panel policy via Laravel's RateLimiter (SR-003). + */ + protected function rateLimit($maxAttempts, $decaySeconds = 60, $method = null, $component = null): void + { + } + public function authenticate(): ?LoginResponse { $data = $this->form->getState(); diff --git a/tests/Feature/System/Spec113/SystemLoginThrottleTest.php b/tests/Feature/System/Spec113/SystemLoginThrottleTest.php index e89680a..3516abb 100644 --- a/tests/Feature/System/Spec113/SystemLoginThrottleTest.php +++ b/tests/Feature/System/Spec113/SystemLoginThrottleTest.php @@ -30,6 +30,9 @@ ]); for ($i = 0; $i < 10; $i++) { + Filament::setCurrentPanel('system'); + Filament::bootCurrentPanel(); + Livewire::test(Login::class) ->set('data.email', $user->email) ->set('data.password', 'wrong-password') @@ -37,6 +40,9 @@ ->assertHasErrors(['data.email']); } + Filament::setCurrentPanel('system'); + Filament::bootCurrentPanel(); + Livewire::test(Login::class) ->set('data.email', $user->email) ->set('data.password', 'wrong-password') @@ -59,4 +65,3 @@ expect($latestAudit)->not->toBeNull(); expect($latestAudit->metadata['reason'] ?? null)->toBe('throttled'); }); -