feat: add two-factor authentication support and related configurations

app/Http/Controllers/Auth/LoginController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Auth\LoginRequest;
 use App\Models\User;
+use App\Services\Auth\TwoFactorChallenge;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -25,26 +26,42 @@ class LoginController extends Controller
     /**
      * Handle an incoming authentication request.
      */
-    public function store(LoginRequest $request): RedirectResponse
+    public function store(LoginRequest $request, TwoFactorChallenge $twoFactor): RedirectResponse
     {
         $login = $request->validated('login');
         $password = $request->validated('password');
 
         $isEmail = filter_var($login, FILTER_VALIDATE_EMAIL);
-        $credentials = $isEmail
-            ? ['email' => $login, 'password' => $password]
-            : ['email' => User::whereRaw('LOWER(username) = ?', [strtolower($login)])->value('email'), 'password' => $password];
+        $email = $isEmail
+            ? $login
+            : User::whereRaw('LOWER(username) = ?', [strtolower($login)])->value('email');
+        $credentials = ['email' => $email, 'password' => $password];
 
         $remember = config('auth-ui.features.remember_me')
             ? $request->boolean('remember')
             : false;
 
-        if (! $credentials['email'] || ! Auth::attempt($credentials, $remember)) {
+        $provider = Auth::getProvider();
+        $user = $credentials['email']
+            ? $provider->retrieveByCredentials($credentials)
+            : null;
+
+        if (! $user || ! $provider->validateCredentials($user, $credentials)) {
             throw ValidationException::withMessages([
                 'login' => __('auth.failed'),
             ]);
         }
 
+        if (config('hashing.rehash_on_login', true)
+            && method_exists($provider, 'rehashPasswordIfRequired')) {
+            $provider->rehashPasswordIfRequired($user, $credentials);
+        }
+
+        if ($twoFactor->requiredFor($user)) {
+            return $twoFactor->begin($request, $user, $remember);
+        }
+
+        Auth::login($user, $remember);
         $request->session()->regenerate();
 
         return redirect()->intended(config('auth-ui.redirects.login', '/'));

app/Http/Controllers/Auth/SocialiteController.php

@@ -5,7 +5,9 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Models\SocialAccount;
 use App\Models\User;
+use App\Services\Auth\TwoFactorChallenge;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Str;
 use Laravel\Socialite\Facades\Socialite;
@@ -49,8 +51,11 @@ class SocialiteController extends Controller
     /**
      * Obtain the user information from provider.
      */
-    public function callback(string $provider): RedirectResponse
-    {
+    public function callback(
+        Request $request,
+        string $provider,
+        TwoFactorChallenge $twoFactor
+    ): RedirectResponse {
         if (! in_array($provider, $this->getEnabledProviders())) {
             abort(404, 'Provider not enabled');
         }
@@ -69,10 +74,7 @@ class SocialiteController extends Controller
             ->first();
 
         if ($socialAccount) {
-            Auth::login($socialAccount->user, remember: true);
-            request()->session()->regenerate();
-
-            return redirect()->intended(config('auth-ui.redirects.login', '/'));
+            return $this->finishAuthentication($request, $socialAccount->user, $twoFactor);
         }
 
         // Check if a user with this email already exists
@@ -90,10 +92,7 @@ class SocialiteController extends Controller
                 'provider_id' => $socialUser->getId(),
             ]);
 
-            Auth::login($existingUser, remember: true);
-            request()->session()->regenerate();
-
-            return redirect()->intended(config('auth-ui.redirects.login', '/'));
+            return $this->finishAuthentication($request, $existingUser, $twoFactor);
         }
 
         // New user — check if registration is enabled
@@ -135,8 +134,20 @@ class SocialiteController extends Controller
             'provider_id' => $socialUser->getId(),
         ]);
 
+        return $this->finishAuthentication($request, $user, $twoFactor);
+    }
+
+    private function finishAuthentication(
+        Request $request,
+        User $user,
+        TwoFactorChallenge $twoFactor
+    ): RedirectResponse {
+        if ($twoFactor->requiredFor($user)) {
+            return $twoFactor->begin($request, $user, remember: true);
+        }
+
         Auth::login($user, remember: true);
-        request()->session()->regenerate();
+        $request->session()->regenerate();
 
         return redirect()->intended(config('auth-ui.redirects.login', '/'));
     }

app/Http/Controllers/Auth/TwoFactorChallengeController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Inertia\Response;
+use Laravel\Fortify\Events\TwoFactorAuthenticationFailed;
+use Laravel\Fortify\Events\ValidTwoFactorAuthenticationCodeProvided;
+use Laravel\Fortify\Http\Requests\TwoFactorLoginRequest;
+
+class TwoFactorChallengeController extends Controller
+{
+    /**
+     * Display the two-factor challenge.
+     */
+    public function create(TwoFactorLoginRequest $request): Response|RedirectResponse
+    {
+        if (! config('auth-ui.features.two_factor') || ! $request->hasChallengedUser()) {
+            $this->clearChallenge($request);
+
+            return redirect()->route('login');
+        }
+
+        return Inertia::render('Auth/TwoFactorChallenge');
+    }
+
+    /**
+     * Complete the pending login using a TOTP or recovery code.
+     */
+    public function store(TwoFactorLoginRequest $request): RedirectResponse
+    {
+        if (! config('auth-ui.features.two_factor') || ! $request->hasChallengedUser()) {
+            $this->clearChallenge($request);
+
+            return redirect()->route('login');
+        }
+
+        $user = $request->challengedUser();
+
+        if (! $user->hasEnabledTwoFactorAuthentication()) {
+            $this->clearChallenge($request);
+
+            return redirect()->route('login');
+        }
+
+        if ($recoveryCode = $request->validRecoveryCode()) {
+            $user->replaceRecoveryCode($recoveryCode);
+        } elseif (! $request->hasValidCode()) {
+            event(new TwoFactorAuthenticationFailed($user));
+
+            throw ValidationException::withMessages([
+                $request->filled('recovery_code') ? 'recovery_code' : 'code' => 'The provided authentication code was invalid.',
+            ]);
+        }
+
+        event(new ValidTwoFactorAuthenticationCodeProvided($user));
+
+        Auth::login($user, $request->remember());
+        $request->session()->regenerate();
+
+        return redirect()->intended(config('auth-ui.redirects.login', '/dashboard'));
+    }
+
+    private function clearChallenge(TwoFactorLoginRequest $request): void
+    {
+        $request->session()->forget(['login.id', 'login.remember']);
+    }
+}

app/Http/Controllers/Auth/TwoFactorSettingsController.php

@@ -0,0 +1,168 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
+use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
+use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
+use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
+use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
+use Laravel\Fortify\Fortify;
+
+class TwoFactorSettingsController extends Controller
+{
+    /**
+     * Begin two-factor enrollment.
+     */
+    public function enable(Request $request, EnableTwoFactorAuthentication $enable): RedirectResponse
+    {
+        $this->ensureFeatureIsEnabled();
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if ($user->hasEnabledTwoFactorAuthentication()) {
+            return redirect()->route('profile.show');
+        }
+
+        $this->validatePasswordForPasswordUser($request, $user);
+        $enable($user, force: true);
+
+        return redirect()->route('profile.show')
+            ->with('success', 'Scan the QR code, then enter a code to finish enabling two-factor authentication.');
+    }
+
+    /**
+     * Confirm a newly configured authenticator.
+     */
+    public function confirm(
+        Request $request,
+        ConfirmTwoFactorAuthentication $confirm
+    ): RedirectResponse {
+        $this->ensureFeatureIsEnabled();
+
+        $validated = $request->validate([
+            'code' => ['required', 'string', 'regex:/^\d{6}$/'],
+        ]);
+
+        /** @var User $user */
+        $user = $request->user();
+        $confirm($user, $validated['code']);
+
+        return redirect()->route('profile.show')
+            ->with('success', 'Two-factor authentication is now enabled.')
+            ->with('recoveryCodes', $user->fresh()->recoveryCodes());
+    }
+
+    /**
+     * Disable two-factor authentication.
+     */
+    public function disable(
+        Request $request,
+        DisableTwoFactorAuthentication $disable
+    ): RedirectResponse {
+        $this->ensureFeatureIsEnabled();
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if ($user->hasEnabledTwoFactorAuthentication()) {
+            $this->validateSensitiveAction($request, $user);
+        }
+
+        $disable($user);
+
+        return redirect()->route('profile.show')
+            ->with('success', 'Two-factor authentication has been disabled.');
+    }
+
+    /**
+     * Reveal or regenerate recovery codes after re-authentication.
+     */
+    public function recoveryCodes(
+        Request $request,
+        GenerateNewRecoveryCodes $generate
+    ): RedirectResponse {
+        $this->ensureFeatureIsEnabled();
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if (! $user->hasEnabledTwoFactorAuthentication()) {
+            abort(409, 'Two-factor authentication is not enabled.');
+        }
+
+        $this->validateSensitiveAction($request, $user);
+
+        if ($request->boolean('regenerate')) {
+            $generate($user);
+            $user->refresh();
+        }
+
+        return redirect()->route('profile.show')
+            ->with('success', $request->boolean('regenerate')
+                ? 'New recovery codes have been generated. Previous codes no longer work.'
+                : 'Recovery codes revealed.')
+            ->with('recoveryCodes', $user->recoveryCodes());
+    }
+
+    private function ensureFeatureIsEnabled(): void
+    {
+        abort_unless(config('auth-ui.features.two_factor'), 404);
+    }
+
+    private function validatePasswordForPasswordUser(Request $request, User $user): void
+    {
+        if (! $user->hasPassword()) {
+            return;
+        }
+
+        $request->validate([
+            'password' => ['required', 'string', 'current_password:web'],
+        ]);
+    }
+
+    private function validateSensitiveAction(Request $request, User $user): void
+    {
+        if ($user->hasPassword()) {
+            $this->validatePasswordForPasswordUser($request, $user);
+
+            return;
+        }
+
+        $validated = $request->validate([
+            'code' => ['required', 'string'],
+        ]);
+
+        if (! $this->hasValidTwoFactorCredential($user, $validated['code'])) {
+            throw ValidationException::withMessages([
+                'code' => 'The provided authentication or recovery code was invalid.',
+            ]);
+        }
+    }
+
+    private function hasValidTwoFactorCredential(User $user, string $code): bool
+    {
+        $secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
+
+        if (app(TwoFactorAuthenticationProvider::class)->verify($secret, $code)) {
+            return true;
+        }
+
+        $recoveryCode = collect($user->recoveryCodes())
+            ->first(fn (string $recoveryCode) => hash_equals($recoveryCode, $code));
+
+        if (! $recoveryCode) {
+            return false;
+        }
+
+        $user->replaceRecoveryCode($recoveryCode);
+
+        return true;
+    }
+}

app/Http/Controllers/ProfileController.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\User;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+use Laravel\Fortify\Fortify;
+
+class ProfileController extends Controller
+{
+    /**
+     * Display the authenticated user's profile and security settings.
+     */
+    public function __invoke(Request $request): Response
+    {
+        /** @var User $user */
+        $user = $request->user();
+        $available = (bool) config('auth-ui.features.two_factor');
+        $pending = $available
+            && filled($user->two_factor_secret)
+            && ! $user->hasEnabledTwoFactorAuthentication();
+
+        return Inertia::render('Profile/Show', [
+            'twoFactor' => [
+                'available' => $available,
+                'enabled' => $available && $user->hasEnabledTwoFactorAuthentication(),
+                'pending' => $pending,
+                'requiresPassword' => $user->hasPassword(),
+                'qrCodeDataUri' => $pending
+                    ? 'data:image/svg+xml;base64,'.base64_encode($user->twoFactorQrCodeSvg())
+                    : null,
+                'secretKey' => $pending
+                    ? Fortify::currentEncrypter()->decrypt($user->two_factor_secret)
+                    : null,
+            ],
+        ]);
+    }
+}