feat(auth): harden authentication and add configurable two-factor support

app/Http/Controllers/Auth/CompleteProfileController.php

@@ -5,6 +5,8 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Auth\CompleteProfileRequest;
 use App\Models\User;
+use App\Services\Auth\SecurityEventRecorder;
+use App\Services\Auth\TwoFactorChallenge;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -33,8 +35,11 @@ class CompleteProfileController extends Controller
     /**
      * Handle the complete profile request.
      */
-    public function store(CompleteProfileRequest $request): RedirectResponse
-    {
+    public function store(
+        CompleteProfileRequest $request,
+        TwoFactorChallenge $twoFactor,
+        SecurityEventRecorder $securityEvents
+    ): RedirectResponse {
         $socialiteUser = session('socialite_user');
         $validated = $request->validated();
 
@@ -58,6 +63,16 @@ class CompleteProfileController extends Controller
 
         Auth::login($user, remember: true);
         $request->session()->regenerate();
+        $securityEvents->record('login.social_succeeded', $user, $request);
+
+        if ($twoFactor->enrollmentRequiredFor($user)) {
+            $request->session()->put(
+                'url.intended',
+                config('auth-ui.redirects.login', '/')
+            );
+
+            return redirect()->route('two-factor.setup');
+        }
 
         return redirect()->intended(config('auth-ui.redirects.login', '/'));
     }