Flycro/laravel-nuxt-ui-inertia-template
Template
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: add two-factor authentication support and related configurations

Browse Source
This commit is contained in:
Flycro
2026-07-24 12:59:10 +02:00
parent 54345e621c
commit 235d5f646c
27 changed files with 2608 additions and 374 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
app/Http/Controllers/Auth/LoginController.php
View File

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
use App\Http\Controllers\Controller;
use App\Http\Requests\Auth\LoginRequest;
use App\Models\User;
use App\Services\Auth\TwoFactorChallenge;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
@@ -25,26 +26,42 @@ class LoginController extends Controller
/**
* Handle an incoming authentication request.
*/
public function store(LoginRequest $request): RedirectResponse
public function store(LoginRequest $request, TwoFactorChallenge $twoFactor): RedirectResponse
{
$login = $request->validated('login');
$password = $request->validated('password');
$isEmail = filter_var($login, FILTER_VALIDATE_EMAIL);
$credentials = $isEmail
? ['email' => $login, 'password' => $password]
: ['email' => User::whereRaw('LOWER(username) = ?', [strtolower($login)])->value('email'), 'password' => $password];
$email = $isEmail
? $login
: User::whereRaw('LOWER(username) = ?', [strtolower($login)])->value('email');
$credentials = ['email' => $email, 'password' => $password];
$remember = config('auth-ui.features.remember_me')
? $request->boolean('remember')
: false;
if (! $credentials['email'] || ! Auth::attempt($credentials, $remember)) {
$provider = Auth::getProvider();
$user = $credentials['email']
? $provider->retrieveByCredentials($credentials)
: null;
if (! $user || ! $provider->validateCredentials($user, $credentials)) {
throw ValidationException::withMessages([
'login' => __('auth.failed'),
]);
}
if (config('hashing.rehash_on_login', true)
&& method_exists($provider, 'rehashPasswordIfRequired')) {
$provider->rehashPasswordIfRequired($user, $credentials);
}
if ($twoFactor->requiredFor($user)) {
return $twoFactor->begin($request, $user, $remember);
}
Auth::login($user, $remember);
$request->session()->regenerate();
return redirect()->intended(config('auth-ui.redirects.login', '/'));

33
app/Http/Controllers/Auth/SocialiteController.php
View File

@@ -5,7 +5,9 @@ namespace App\Http\Controllers\Auth;
use App\Http\Controllers\Controller;
use App\Models\SocialAccount;
use App\Models\User;
use App\Services\Auth\TwoFactorChallenge;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Str;
use Laravel\Socialite\Facades\Socialite;
@@ -49,8 +51,11 @@ class SocialiteController extends Controller
/**
* Obtain the user information from provider.
*/
public function callback(string $provider): RedirectResponse
{
public function callback(
Request $request,
string $provider,
TwoFactorChallenge $twoFactor
): RedirectResponse {
if (! in_array($provider, $this->getEnabledProviders())) {
abort(404, 'Provider not enabled');
}
@@ -69,10 +74,7 @@ class SocialiteController extends Controller
->first();
if ($socialAccount) {
Auth::login($socialAccount->user, remember: true);
request()->session()->regenerate();
return redirect()->intended(config('auth-ui.redirects.login', '/'));
return $this->finishAuthentication($request, $socialAccount->user, $twoFactor);
}
// Check if a user with this email already exists
@@ -90,10 +92,7 @@ class SocialiteController extends Controller
'provider_id' => $socialUser->getId(),
]);
Auth::login($existingUser, remember: true);
request()->session()->regenerate();
return redirect()->intended(config('auth-ui.redirects.login', '/'));
return $this->finishAuthentication($request, $existingUser, $twoFactor);
}
// New user — check if registration is enabled
@@ -135,8 +134,20 @@ class SocialiteController extends Controller
'provider_id' => $socialUser->getId(),
]);
return $this->finishAuthentication($request, $user, $twoFactor);
}
private function finishAuthentication(
Request $request,
User $user,
TwoFactorChallenge $twoFactor
): RedirectResponse {
if ($twoFactor->requiredFor($user)) {
return $twoFactor->begin($request, $user, remember: true);
}
Auth::login($user, remember: true);
request()->session()->regenerate();
$request->session()->regenerate();
return redirect()->intended(config('auth-ui.redirects.login', '/'));
}

72
app/Http/Controllers/Auth/TwoFactorChallengeController.php Normal file
View File

@@ -0,0 +1,72 @@
<?php
namespace App\Http\Controllers\Auth;
use App\Http\Controllers\Controller;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
use Illuminate\Validation\ValidationException;
use Inertia\Inertia;
use Inertia\Response;
use Laravel\Fortify\Events\TwoFactorAuthenticationFailed;
use Laravel\Fortify\Events\ValidTwoFactorAuthenticationCodeProvided;
use Laravel\Fortify\Http\Requests\TwoFactorLoginRequest;
class TwoFactorChallengeController extends Controller
{
/**
* Display the two-factor challenge.
*/
public function create(TwoFactorLoginRequest $request): Response|RedirectResponse
{
if (! config('auth-ui.features.two_factor') || ! $request->hasChallengedUser()) {
$this->clearChallenge($request);
return redirect()->route('login');
}
return Inertia::render('Auth/TwoFactorChallenge');
}
/**
* Complete the pending login using a TOTP or recovery code.
*/
public function store(TwoFactorLoginRequest $request): RedirectResponse
{
if (! config('auth-ui.features.two_factor') || ! $request->hasChallengedUser()) {
$this->clearChallenge($request);
return redirect()->route('login');
}
$user = $request->challengedUser();
if (! $user->hasEnabledTwoFactorAuthentication()) {
$this->clearChallenge($request);
return redirect()->route('login');
}
if ($recoveryCode = $request->validRecoveryCode()) {
$user->replaceRecoveryCode($recoveryCode);
} elseif (! $request->hasValidCode()) {
event(new TwoFactorAuthenticationFailed($user));
throw ValidationException::withMessages([
$request->filled('recovery_code') ? 'recovery_code' : 'code' => 'The provided authentication code was invalid.',
]);
}
event(new ValidTwoFactorAuthenticationCodeProvided($user));
Auth::login($user, $request->remember());
$request->session()->regenerate();
return redirect()->intended(config('auth-ui.redirects.login', '/dashboard'));
}
private function clearChallenge(TwoFactorLoginRequest $request): void
{
$request->session()->forget(['login.id', 'login.remember']);
}
}

168
app/Http/Controllers/Auth/TwoFactorSettingsController.php Normal file
View File

@@ -0,0 +1,168 @@
<?php
namespace App\Http\Controllers\Auth;
use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Validation\ValidationException;
use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
use Laravel\Fortify\Fortify;
class TwoFactorSettingsController extends Controller
{
/**
* Begin two-factor enrollment.
*/
public function enable(Request $request, EnableTwoFactorAuthentication $enable): RedirectResponse
{
$this->ensureFeatureIsEnabled();
/** @var User $user */
$user = $request->user();
if ($user->hasEnabledTwoFactorAuthentication()) {
return redirect()->route('profile.show');
}
$this->validatePasswordForPasswordUser($request, $user);
$enable($user, force: true);
return redirect()->route('profile.show')
->with('success', 'Scan the QR code, then enter a code to finish enabling two-factor authentication.');
}
/**
* Confirm a newly configured authenticator.
*/
public function confirm(
Request $request,
ConfirmTwoFactorAuthentication $confirm
): RedirectResponse {
$this->ensureFeatureIsEnabled();
$validated = $request->validate([
'code' => ['required', 'string', 'regex:/^\d{6}$/'],
]);
/** @var User $user */
$user = $request->user();
$confirm($user, $validated['code']);
return redirect()->route('profile.show')
->with('success', 'Two-factor authentication is now enabled.')
->with('recoveryCodes', $user->fresh()->recoveryCodes());
}
/**
* Disable two-factor authentication.
*/
public function disable(
Request $request,
DisableTwoFactorAuthentication $disable
): RedirectResponse {
$this->ensureFeatureIsEnabled();
/** @var User $user */
$user = $request->user();
if ($user->hasEnabledTwoFactorAuthentication()) {
$this->validateSensitiveAction($request, $user);
}
$disable($user);
return redirect()->route('profile.show')
->with('success', 'Two-factor authentication has been disabled.');
}
/**
* Reveal or regenerate recovery codes after re-authentication.
*/
public function recoveryCodes(
Request $request,
GenerateNewRecoveryCodes $generate
): RedirectResponse {
$this->ensureFeatureIsEnabled();
/** @var User $user */
$user = $request->user();
if (! $user->hasEnabledTwoFactorAuthentication()) {
abort(409, 'Two-factor authentication is not enabled.');
}
$this->validateSensitiveAction($request, $user);
if ($request->boolean('regenerate')) {
$generate($user);
$user->refresh();
}
return redirect()->route('profile.show')
->with('success', $request->boolean('regenerate')
? 'New recovery codes have been generated. Previous codes no longer work.'
: 'Recovery codes revealed.')
->with('recoveryCodes', $user->recoveryCodes());
}
private function ensureFeatureIsEnabled(): void
{
abort_unless(config('auth-ui.features.two_factor'), 404);
}
private function validatePasswordForPasswordUser(Request $request, User $user): void
{
if (! $user->hasPassword()) {
return;
}
$request->validate([
'password' => ['required', 'string', 'current_password:web'],
]);
}
private function validateSensitiveAction(Request $request, User $user): void
{
if ($user->hasPassword()) {
$this->validatePasswordForPasswordUser($request, $user);
return;
}
$validated = $request->validate([
'code' => ['required', 'string'],
]);
if (! $this->hasValidTwoFactorCredential($user, $validated['code'])) {
throw ValidationException::withMessages([
'code' => 'The provided authentication or recovery code was invalid.',
]);
}
}
private function hasValidTwoFactorCredential(User $user, string $code): bool
{
$secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
if (app(TwoFactorAuthenticationProvider::class)->verify($secret, $code)) {
return true;
}
$recoveryCode = collect($user->recoveryCodes())
->first(fn (string $recoveryCode) => hash_equals($recoveryCode, $code));
if (! $recoveryCode) {
return false;
}
$user->replaceRecoveryCode($recoveryCode);
return true;
}
}

40
app/Http/Controllers/ProfileController.php Normal file
View File

@@ -0,0 +1,40 @@
<?php
namespace App\Http\Controllers;
use App\Models\User;
use Illuminate\Http\Request;
use Inertia\Inertia;
use Inertia\Response;
use Laravel\Fortify\Fortify;
class ProfileController extends Controller
{
/**
* Display the authenticated user's profile and security settings.
*/
public function __invoke(Request $request): Response
{
/** @var User $user */
$user = $request->user();
$available = (bool) config('auth-ui.features.two_factor');
$pending = $available
&& filled($user->two_factor_secret)
&& ! $user->hasEnabledTwoFactorAuthentication();
return Inertia::render('Profile/Show', [
'twoFactor' => [
'available' => $available,
'enabled' => $available && $user->hasEnabledTwoFactorAuthentication(),
'pending' => $pending,
'requiresPassword' => $user->hasPassword(),
'qrCodeDataUri' => $pending
? 'data:image/svg+xml;base64,'.base64_encode($user->twoFactorQrCodeSvg())
: null,
'secretKey' => $pending
? Fortify::currentEncrypter()->decrypt($user->two_factor_secret)
: null,
],
]);
}
}

43
app/Http/Middleware/EnsureTwoFactorAuthenticationIsEnabled.php Normal file
View File

@@ -0,0 +1,43 @@
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class EnsureTwoFactorAuthenticationIsEnabled
{
/**
* Require authenticated users to finish two-factor enrollment when configured.
*/
public function handle(Request $request, Closure $next): Response
{
if (! config('auth-ui.features.two_factor')
|| ! config('auth-ui.features.two_factor_required')
|| ! $request->user()
|| $request->user()->hasEnabledTwoFactorAuthentication()
|| $this->isEnrollmentRoute($request)) {
return $next($request);
}
if ($request->expectsJson()) {
return response()->json([
'message' => 'Two-factor authentication setup is required.',
'setup_url' => route('profile.show'),
], 403);
}
return redirect()->route('profile.show')
->with('error', 'Two-factor authentication is required before you can continue.');
}
private function isEnrollmentRoute(Request $request): bool
{
return $request->routeIs([
'profile.*',
'logout',
'verification.*',
]);
}
}

1
app/Http/Middleware/HandleInertiaRequests.php
View File

@@ -45,6 +45,7 @@ class HandleInertiaRequests extends Middleware
'error' => fn () => $request->session()->get('error'),
'message' => fn () => $request->session()->get('message'),
'status' => fn () => $request->session()->get('status'),
'recoveryCodes' => fn () => $request->session()->get('recoveryCodes'),
],
'authConfig' => fn () => $this->getAuthConfig(),
];