feat(auth): harden authentication and add configurable two-factor support

app/Http/Controllers/Auth/SocialiteController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
 use App\Http\Controllers\Controller;
 use App\Models\SocialAccount;
 use App\Models\User;
+use App\Services\Auth\SecurityEventRecorder;
 use App\Services\Auth\TwoFactorChallenge;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -54,7 +55,8 @@ class SocialiteController extends Controller
     public function callback(
         Request $request,
         string $provider,
-        TwoFactorChallenge $twoFactor
+        TwoFactorChallenge $twoFactor,
+        SecurityEventRecorder $securityEvents
     ): RedirectResponse {
         if (! in_array($provider, $this->getEnabledProviders())) {
             abort(404, 'Provider not enabled');
@@ -74,7 +76,12 @@ class SocialiteController extends Controller
             ->first();
 
         if ($socialAccount) {
-            return $this->finishAuthentication($request, $socialAccount->user, $twoFactor);
+            return $this->finishAuthentication(
+                $request,
+                $socialAccount->user,
+                $twoFactor,
+                $securityEvents
+            );
         }
 
         // Check if a user with this email already exists
@@ -92,7 +99,12 @@ class SocialiteController extends Controller
                 'provider_id' => $socialUser->getId(),
             ]);
 
-            return $this->finishAuthentication($request, $existingUser, $twoFactor);
+            return $this->finishAuthentication(
+                $request,
+                $existingUser,
+                $twoFactor,
+                $securityEvents
+            );
         }
 
         // New user — check if registration is enabled
@@ -134,20 +146,33 @@ class SocialiteController extends Controller
             'provider_id' => $socialUser->getId(),
         ]);
 
-        return $this->finishAuthentication($request, $user, $twoFactor);
+        return $this->finishAuthentication($request, $user, $twoFactor, $securityEvents);
     }
 
     private function finishAuthentication(
         Request $request,
         User $user,
-        TwoFactorChallenge $twoFactor
+        TwoFactorChallenge $twoFactor,
+        SecurityEventRecorder $securityEvents
     ): RedirectResponse {
         if ($twoFactor->requiredFor($user)) {
+            $securityEvents->record('login.social_succeeded_pending_two_factor', $user, $request);
+
             return $twoFactor->begin($request, $user, remember: true);
         }
 
         Auth::login($user, remember: true);
         $request->session()->regenerate();
+        $securityEvents->record('login.social_succeeded', $user, $request);
+
+        if ($twoFactor->enrollmentRequiredFor($user)) {
+            $request->session()->put(
+                'url.intended',
+                config('auth-ui.redirects.login', '/')
+            );
+
+            return redirect()->route('two-factor.setup');
+        }
 
         return redirect()->intended(config('auth-ui.redirects.login', '/'));
     }