[AIDAPP-949]: Magiclink login gets invalidated by emails scanners like Outlook protection (#889)

Enhance MagicLinkLoginController to handle HEAD requests, preventing link scanning bots

Author: payal-canyon

app-modules/authorization/src/Http/Controllers/MagicLinkLoginController.php

@@ -41,6 +41,7 @@
 use Filament\Facades\Filament;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Hash;
@@ -51,8 +52,13 @@ class MagicLinkLoginController
     /**
      * @throws Throwable
      */
-    public function __invoke(Request $request, LoginMagicLink $magicLink): RedirectResponse
+    public function __invoke(Request $request, LoginMagicLink $magicLink): RedirectResponse|Response
     {
+        if ($request->getMethod() === 'HEAD') {
+            // Protection against link scanning bots, like Microsoft Outlook.
+            return response()->noContent();
+        }
+
         abort_if(
             boolean: now()->greaterThanOrEqualTo($magicLink->created_at->addMinutes(15))
                 || $magicLink->used_at !== null,

app-modules/authorization/tests/Tenant/Feature/Http/Controllers/MagicLinkLoginControllerTest.php

@@ -44,6 +44,7 @@
 use function Pest\Laravel\assertAuthenticatedAs;
 use function Pest\Laravel\assertGuest;
 use function Pest\Laravel\get;
+use function Pest\Laravel\head;
 
 it('requires a valid signed URL ', function () {
     $code = Str::random();
@@ -204,3 +205,34 @@
 
     expect($magicLink->used_at)->not->toBeNull();
 });
+
+it('returns no content for HEAD requests to protect against link scanning bots', function () {
+    $code = Str::random();
+
+    $magicLink = LoginMagicLink::factory()->withCode($code)->create();
+
+    $url = URL::temporarySignedRoute(
+        name: 'magic-link.login',
+        expiration: now()->addMinutes(10)->toImmutable(),
+        parameters: [
+            'magicLink' => $magicLink->getKey(),
+            'payload' => urlencode(
+                Crypt::encrypt(
+                    [
+                        'code' => $code,
+                        'user_id' => $magicLink->user_id,
+                    ]
+                )
+            ),
+        ],
+    );
+
+    head($url)
+        ->assertNoContent();
+
+    $magicLink->refresh();
+
+    expect($magicLink->used_at)->toBeNull();
+
+    assertGuest(Filament::getPanel('admin')->getAuthGuard());
+});