fix: remove nested transaction in enableTwoFactorAndGenerateCodes

enableTwoFactorAndGenerateCodes() wrapped enable2FA()/user persist in
one transaction() call while also calling generateRecoveryCodes(),
which opens its own. DoctrineTransactionService::transaction() closes
the entity manager and connection on failure, so an inner failure
could tear down the EM out from under the still-running outer
transaction. Extracted the shared code-generation logic into a
transaction-free regenerateCodesForUser(), so each public method now
opens exactly one transaction.

Author: romanetar

app/Services/Auth/RecoveryCodeService.php

@@ -57,24 +57,7 @@ public function regenerateRecoveryCodes(User $user, string $currentPassword): ar
      */
     public function generateRecoveryCodes(User $user): array
     {
-        $count = (int)config('auth.recovery_codes.count', 10);
-        $length = (int)config('auth.recovery_codes.length', 8);
-
-        $plaintext_codes = [];
-
-        $this->tx_service->transaction(function () use ($user, $count, $length, &$plaintext_codes) {
-            $this->repository->deleteAllForUser($user);
-
-            for ($i = 0; $i < $count; $i++) {
-                $plain = Rand::getString($length, self::CODE_CHARSET, true);
-                $plaintext_codes[] = $plain;
-
-                $code = new UserRecoveryCode();
-                $code->setUser($user);
-                $code->setCodeHash(Hash::make($plain));
-                $this->repository->add($code, false);
-            }
-        });
+        $codes = $this->tx_service->transaction(fn() => $this->regenerateCodesForUser($user));
 
         $this->audit_service->log(
             $user,
@@ -83,21 +66,34 @@ public function generateRecoveryCodes(User $user): array
             IPHelper::getUserIp()
         );
 
-        return array_map(static fn(string $code) => implode('-', str_split($code, 4)), $plaintext_codes);
+        return $codes;
     }
 
     /**
      * @inheritDoc
      */
     public function enableTwoFactorAndGenerateCodes(User $user, string $method): array
     {
+        // Everything must live in a single transaction() call: it opens/commits
+        // its own connection-level transaction and closes the entity manager on
+        // failure (see DoctrineTransactionService::transaction()), so nesting a
+        // second call inside it (e.g. by calling generateRecoveryCodes() here)
+        // would let an inner failure tear down the EM out from under this
+        // still-running outer transaction.
         $codes = $this->tx_service->transaction(function () use ($user, $method) {
             $user->enable2FA($method);
             $this->user_repository->add($user, false);
 
-            return $this->generateRecoveryCodes($user);
+            return $this->regenerateCodesForUser($user);
         });
 
+        $this->audit_service->log(
+            $user,
+            TwoFactorAuditLog::EventRecoveryCodesGenerated,
+            TwoFactorAuditLog::MethodRecovery,
+            IPHelper::getUserIp()
+        );
+
         $this->audit_service->log(
             $user,
             TwoFactorAuditLog::EventEnrollmentChanged,
@@ -108,6 +104,34 @@ public function enableTwoFactorAndGenerateCodes(User $user, string $method): arr
         return $codes;
     }
 
+    /**
+     * Invalidates every existing recovery code for the user and generates a
+     * fresh batch, within the caller's already-open transaction.
+     *
+     * @return string[] plaintext codes formatted as XXXX-XXXX
+     */
+    private function regenerateCodesForUser(User $user): array
+    {
+        $count = (int)config('auth.recovery_codes.count', 10);
+        $length = (int)config('auth.recovery_codes.length', 8);
+
+        $plaintext_codes = [];
+
+        $this->repository->deleteAllForUser($user);
+
+        for ($i = 0; $i < $count; $i++) {
+            $plain = Rand::getString($length, self::CODE_CHARSET, true);
+            $plaintext_codes[] = $plain;
+
+            $code = new UserRecoveryCode();
+            $code->setUser($user);
+            $code->setCodeHash(Hash::make($plain));
+            $this->repository->add($code, false);
+        }
+
+        return array_map(static fn(string $code) => implode('-', str_split($code, 4)), $plaintext_codes);
+    }
+
     /**
      * @inheritDoc
      */