[10.x] Allow password reset callback to modify the result

[GrahamCampbell]

The use case here is not allowing some users to reset their passwords. Allowing the callback to return a result enables this without having to do a bunch of jank. Example callback someone might use:

function (User $user, string $token): string {
    if ($user->isUsingSingleSignOn()) {
        return PasswordBroker::INVALID_USER;
    }

    $user->sendPasswordResetNotification($token);

    return PasswordBroker::RESET_LINK_SENT;
}

---

EDIT: failing tests are not related to this PR.

[gerardnll]

First of all, thanks for the contribution! I was just thinking about that situation today.

I'm wondering... wouldn't it be a more elegant way to accomplish this by allowing a more flexible way to get the user? For example, instead of expecting some credentials in an array like sendResetLink and reset functions do, to also be able to pass the User (or a CanResetPasswordContract instance) directly for when we have already checked somewhere else the conditions which we don't want to reset the user's password. Like:

$user = User::where('email', $request->validated('email'))
    ->active() // apply conditions.....
    ->first();

if (! $user) {
    // do not tell if we have or not the user in the DB
    return response()->json(['status' => 'ok', 'message' => 'If the email you entered exists in our database you will receive an email...']);
}

// Pass user to broker
$status = Password::sendResetLink($user);

if ($status === Password::RESET_LINK_SENT) {
    return response()->json(['status' => 'ok', 'message' => 'If the email you entered exists in our database you will receive an email...']);
} else {
    return response()->json(['status' => 'fail', 'message' => 'Something went wrong']);
}

I guess another way would be to call withQuery() for the EloquentUserProvider although this would apply globally for all auth queries.

Anyway, I just thought that having a token created and then returning an 'error' message was kind of weird.

I could help with a PR if Taylor sees this viable.