refactor: move 2FA enrollment orchestration into RecoveryCodeService

The transaction plus enable2FA + repository->add + code generation
lived in UserApiController, breaking the thin-controllers/fat-services
convention and diverging from the regenerateRecoveryCodes path, which
already delegates to the service. UserApiController::enableTwoFactor
now only validates input and calls
RecoveryCodeService::enableTwoFactorAndGenerateCodes.

Author: romanetar

app/Http/Controllers/Api/UserApiController.php

@@ -15,10 +15,8 @@
 use App\Http\Controllers\APICRUDController;
 use App\Http\Controllers\Traits\RequestProcessor;
 use App\Http\Controllers\UserValidationRulesFactory;
-use App\libs\Auth\Models\TwoFactorAuditLog;
 use App\ModelSerializers\SerializerRegistry;
 use App\Services\Auth\IRecoveryCodeService;
-use App\Services\Auth\ITwoFactorAuditService;
 use Auth\Repositories\IUserRepository;
 use Auth\User;
 use Exception;
@@ -31,8 +29,6 @@
 use models\exceptions\ValidationException;
 use OAuth2\Services\ITokenService;
 use OpenId\Services\IUserService;
-use Utils\Db\ITransactionService;
-use Utils\IPHelper;
 use Utils\Services\ILogService;
 
 /**
@@ -54,42 +50,26 @@ final class UserApiController extends APICRUDController
      */
     private $recovery_code_service;
 
-    /**
-     * @var ITransactionService
-     */
-    private $tx_service;
-
-    /**
-     * @var ITwoFactorAuditService
-     */
-    private $two_factor_audit_service;
-
     /**
      * UserApiController constructor.
      * @param IUserRepository $user_repository
      * @param ILogService $log_service
      * @param IUserService $user_service
      * @param ITokenService $token_service
      * @param IRecoveryCodeService $recovery_code_service
-     * @param ITransactionService $tx_service
-     * @param ITwoFactorAuditService $two_factor_audit_service
      */
     public function __construct
     (
         IUserRepository $user_repository,
         ILogService     $log_service,
         IUserService    $user_service,
         ITokenService   $token_service,
-        IRecoveryCodeService $recovery_code_service,
-        ITransactionService $tx_service,
-        ITwoFactorAuditService $two_factor_audit_service
+        IRecoveryCodeService $recovery_code_service
     )
     {
         parent::__construct($user_repository, $user_service, $log_service);
         $this->token_service = $token_service;
         $this->recovery_code_service = $recovery_code_service;
-        $this->tx_service = $tx_service;
-        $this->two_factor_audit_service = $two_factor_audit_service;
     }
 
     /**
@@ -306,19 +286,7 @@ public function enableTwoFactor()
                 return $this->error412(['method' => ['Two-factor authentication is already enabled. Use the regenerate recovery codes endpoint to rotate your codes.']]);
             }
 
-            $codes = $this->tx_service->transaction(function () use ($user, $method) {
-                $user->enable2FA($method);
-                $this->repository->add($user, false);
-
-                return $this->recovery_code_service->generateRecoveryCodes($user);
-            });
-
-            $this->two_factor_audit_service->log(
-                $user,
-                TwoFactorAuditLog::EventEnrollmentChanged,
-                $method,
-                IPHelper::getUserIp()
-            );
+            $codes = $this->recovery_code_service->enableTwoFactorAndGenerateCodes($user, $method);
 
             return $this->ok(['recovery_codes' => $codes]);
         });

app/Services/Auth/IRecoveryCodeService.php

@@ -44,6 +44,18 @@ public function regenerateRecoveryCodes(User $user, string $currentPassword): ar
      */
     public function generateRecoveryCodes(User $user): array;
 
+    /**
+     * Enrolls the user into the given 2FA method and generates the first batch
+     * of recovery codes for them, without requiring password confirmation.
+     * Intended for enrollment via an already-authenticated session.
+     *
+     * @param User $user
+     * @param string $method
+     * @return string[] plaintext codes formatted as XXXX-XXXX
+     * @throws ValidationException if $method is not a valid/enabled 2FA method
+     */
+    public function enableTwoFactorAndGenerateCodes(User $user, string $method): array;
+
     /**
      * @param User $user
      * @return int count of unused recovery codes

app/Services/Auth/RecoveryCodeService.php

@@ -16,6 +16,7 @@
 use App\libs\Auth\Models\TwoFactorAuditLog;
 use App\libs\Auth\Models\UserRecoveryCode;
 use Auth\Repositories\IUserRecoveryCodeRepository;
+use Auth\Repositories\IUserRepository;
 use Auth\User;
 use Illuminate\Support\Facades\Hash;
 use Laminas\Math\Rand;
@@ -33,6 +34,7 @@ final class RecoveryCodeService implements IRecoveryCodeService
 
     public function __construct(
         private readonly IUserRecoveryCodeRepository $repository,
+        private readonly IUserRepository $user_repository,
         private readonly ITransactionService $tx_service,
         private readonly ITwoFactorAuditService $audit_service,
     ) {
@@ -84,6 +86,28 @@ public function generateRecoveryCodes(User $user): array
         return array_map(static fn(string $code) => implode('-', str_split($code, 4)), $plaintext_codes);
     }
 
+    /**
+     * @inheritDoc
+     */
+    public function enableTwoFactorAndGenerateCodes(User $user, string $method): array
+    {
+        $codes = $this->tx_service->transaction(function () use ($user, $method) {
+            $user->enable2FA($method);
+            $this->user_repository->add($user, false);
+
+            return $this->generateRecoveryCodes($user);
+        });
+
+        $this->audit_service->log(
+            $user,
+            TwoFactorAuditLog::EventEnrollmentChanged,
+            $method,
+            IPHelper::getUserIp()
+        );
+
+        return $codes;
+    }
+
     /**
      * @inheritDoc
      */