Challenge 1: Trace a Breeze Login Flow — Possible Solution
====================================================================

// app/Http/Controllers/Auth/AuthenticatedSessionController.php
// (generated by php artisan breeze:install)

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Http\Requests\Auth\LoginRequest;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;

class AuthenticatedSessionController extends Controller
{
    public function store(LoginRequest $request): RedirectResponse
    {
        // 1. CREDENTIALS ARE VALIDATED here — but notice it's NOT inline
        //    $request->validate([...]) the way Course 1 covered; Breeze uses
        //    a dedicated LoginRequest (a FormRequest subclass, per Course 1
        //    Chapter 7) with its own authenticate() method that both
        //    validates the shape AND calls Auth::attempt() internally.
        $request->authenticate();

        // 2. THE SESSION IS REGENERATED here — immediately after a
        //    successful authentication attempt, before anything else happens.
        $request->session()->regenerate();

        return redirect()->intended(route('dashboard', absolute: false));
    }
}

// app/Http/Requests/Auth/LoginRequest.php — where Auth::attempt() actually lives

public function authenticate(): void
{
    $this->ensureIsNotRateLimited();

    if (! Auth::attempt($this->only('email', 'password'), $this->boolean('remember'))) {
        RateLimiter::hit($this->throttleKey());

        throw ValidationException::withMessages([
            'email' => trans('auth.failed'),
        ]);
    }

    RateLimiter::clear($this->throttleKey());
}

WHERE EACH STEP HAPPENS
--------------------------
- Credential validation: split across LoginRequest's rules() method (the
  shape check: email is required/valid, password is required) AND its
  custom authenticate() method (the actual attempt).
- Auth::attempt(...) call: inside LoginRequest::authenticate(), NOT
  inside the controller — Breeze pushes this logic into the request class
  itself, following the same FormRequest pattern from Course 1's
  Chapter 7, just extended with a custom method beyond the standard
  rules().
- Session regeneration: back in AuthenticatedSessionController::store(),
  immediately after $request->authenticate() returns successfully — this
  is the explicit line that plays the same session-fixation-prevention
  role Django's login() function handles automatically and invisibly.

WHY THIS WORKS
--------------
- This demonstrates the chapter's core point directly: nothing here is
  hidden framework internals. Every one of these classes and methods is a
  real, readable, editable file sitting in the project's own app/
  directory — tracing exactly where each step happens is possible
  precisely because Breeze generated ownable code rather than wrapping
  this behavior inside the framework the way Django does.
- The rate-limiting logic (RateLimiter::hit/clear) is a bonus discovery
  from actually reading the generated code — Breeze includes brute-force
  protection by default, directly relevant to the Auth & Session Security
  course's login-attack-defense chapter, without needing to be added
  separately.