feat: add two-factor authentication support and related configurations

2026-07-24 12:59:10 +02:00
parent 54345e621c
commit 235d5f646c
27 changed files with 2608 additions and 374 deletions
--- a/app/Http/Controllers/Auth/TwoFactorSettingsController.php
+++ b/app/Http/Controllers/Auth/TwoFactorSettingsController.php
@@ -0,0 +1,168 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
+use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
+use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
+use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
+use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
+use Laravel\Fortify\Fortify;
+
+class TwoFactorSettingsController extends Controller
+{
+    /**
+     * Begin two-factor enrollment.
+     */
+    public function enable(Request $request, EnableTwoFactorAuthentication $enable): RedirectResponse
+    {
+        $this->ensureFeatureIsEnabled();
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if ($user->hasEnabledTwoFactorAuthentication()) {
+            return redirect()->route('profile.show');
+        }
+
+        $this->validatePasswordForPasswordUser($request, $user);
+        $enable($user, force: true);
+
+        return redirect()->route('profile.show')
+            ->with('success', 'Scan the QR code, then enter a code to finish enabling two-factor authentication.');
+    }
+
+    /**
+     * Confirm a newly configured authenticator.
+     */
+    public function confirm(
+        Request $request,
+        ConfirmTwoFactorAuthentication $confirm
+    ): RedirectResponse {
+        $this->ensureFeatureIsEnabled();
+
+        $validated = $request->validate([
+            'code' => ['required', 'string', 'regex:/^\d{6}$/'],
+        ]);
+
+        /** @var User $user */
+        $user = $request->user();
+        $confirm($user, $validated['code']);
+
+        return redirect()->route('profile.show')
+            ->with('success', 'Two-factor authentication is now enabled.')
+            ->with('recoveryCodes', $user->fresh()->recoveryCodes());
+    }
+
+    /**
+     * Disable two-factor authentication.
+     */
+    public function disable(
+        Request $request,
+        DisableTwoFactorAuthentication $disable
+    ): RedirectResponse {
+        $this->ensureFeatureIsEnabled();
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if ($user->hasEnabledTwoFactorAuthentication()) {
+            $this->validateSensitiveAction($request, $user);
+        }
+
+        $disable($user);
+
+        return redirect()->route('profile.show')
+            ->with('success', 'Two-factor authentication has been disabled.');
+    }
+
+    /**
+     * Reveal or regenerate recovery codes after re-authentication.
+     */
+    public function recoveryCodes(
+        Request $request,
+        GenerateNewRecoveryCodes $generate
+    ): RedirectResponse {
+        $this->ensureFeatureIsEnabled();
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if (! $user->hasEnabledTwoFactorAuthentication()) {
+            abort(409, 'Two-factor authentication is not enabled.');
+        }
+
+        $this->validateSensitiveAction($request, $user);
+
+        if ($request->boolean('regenerate')) {
+            $generate($user);
+            $user->refresh();
+        }
+
+        return redirect()->route('profile.show')
+            ->with('success', $request->boolean('regenerate')
+                ? 'New recovery codes have been generated. Previous codes no longer work.'
+                : 'Recovery codes revealed.')
+            ->with('recoveryCodes', $user->recoveryCodes());
+    }
+
+    private function ensureFeatureIsEnabled(): void
+    {
+        abort_unless(config('auth-ui.features.two_factor'), 404);
+    }
+
+    private function validatePasswordForPasswordUser(Request $request, User $user): void
+    {
+        if (! $user->hasPassword()) {
+            return;
+        }
+
+        $request->validate([
+            'password' => ['required', 'string', 'current_password:web'],
+        ]);
+    }
+
+    private function validateSensitiveAction(Request $request, User $user): void
+    {
+        if ($user->hasPassword()) {
+            $this->validatePasswordForPasswordUser($request, $user);
+
+            return;
+        }
+
+        $validated = $request->validate([
+            'code' => ['required', 'string'],
+        ]);
+
+        if (! $this->hasValidTwoFactorCredential($user, $validated['code'])) {
+            throw ValidationException::withMessages([
+                'code' => 'The provided authentication or recovery code was invalid.',
+            ]);
+        }
+    }
+
+    private function hasValidTwoFactorCredential(User $user, string $code): bool
+    {
+        $secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
+
+        if (app(TwoFactorAuthenticationProvider::class)->verify($secret, $code)) {
+            return true;
+        }
+
+        $recoveryCode = collect($user->recoveryCodes())
+            ->first(fn (string $recoveryCode) => hash_equals($recoveryCode, $code));
+
+        if (! $recoveryCode) {
+            return false;
+        }
+
+        $user->replaceRecoveryCode($recoveryCode);
+
+        return true;
+    }
+}