feat(auth): harden authentication and add configurable two-factor support

config/auth-ui.php

@@ -31,6 +31,12 @@ return [
         'two_factor_required' => env('AUTH_REQUIRE_TWO_FACTOR', false),
     ],
 
+    'security' => [
+        'log_channel' => env('AUTH_SECURITY_LOG_CHANNEL', env('LOG_CHANNEL', 'stack')),
+        'two_factor_challenge_timeout' => (int) env('AUTH_TWO_FACTOR_CHALLENGE_TIMEOUT', 300),
+        'absolute_session_lifetime' => (int) env('AUTH_ABSOLUTE_SESSION_LIFETIME', 28800),
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | Login Page Configuration

config/auth.php

@@ -1,5 +1,7 @@
 <?php
 
+use App\Models\User;
+
 return [
 
     /*
@@ -62,7 +64,7 @@ return [
     'providers' => [
         'users' => [
             'driver' => 'eloquent',
-            'model' => env('AUTH_MODEL', App\Models\User::class),
+            'model' => env('AUTH_MODEL', User::class),
         ],
 
         // 'users' => [

config/database.php

@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Support\Str;
+use Pdo\Mysql;
 
 return [
 
@@ -59,7 +60,7 @@ return [
             'strict' => true,
             'engine' => null,
             'options' => extension_loaded('pdo_mysql') ? array_filter([
-                (PHP_VERSION_ID >= 80500 ? \Pdo\Mysql::ATTR_SSL_CA : \PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
+                (PHP_VERSION_ID >= 80500 ? Mysql::ATTR_SSL_CA : PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
             ]) : [],
         ],
 
@@ -79,7 +80,7 @@ return [
             'strict' => true,
             'engine' => null,
             'options' => extension_loaded('pdo_mysql') ? array_filter([
-                (PHP_VERSION_ID >= 80500 ? \Pdo\Mysql::ATTR_SSL_CA : \PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
+                (PHP_VERSION_ID >= 80500 ? Mysql::ATTR_SSL_CA : PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
             ]) : [],
         ],
 

config/fortify.php

@@ -11,6 +11,8 @@ return [
         ? [
             Features::twoFactorAuthentication([
                 'confirm' => true,
+                'secret-length' => 32,
+                'window' => 0,
             ]),
         ]
         : [],

config/hashing.php

@@ -0,0 +1,30 @@
+<?php
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Password hashing
+    |--------------------------------------------------------------------------
+    |
+    | Argon2id is the only accepted password algorithm. Strict algorithm
+    | verification prevents hashes created with an unexpected algorithm from
+    | being accepted by this fresh application template.
+    |
+    */
+    'driver' => env('HASH_DRIVER', 'argon2id'),
+
+    'bcrypt' => [
+        'rounds' => env('BCRYPT_ROUNDS', 12),
+        'verify' => env('HASH_VERIFY', true),
+        'limit' => env('BCRYPT_LIMIT', null),
+    ],
+
+    'argon' => [
+        'memory' => env('ARGON_MEMORY', 65536),
+        'threads' => env('ARGON_THREADS', 1),
+        'time' => env('ARGON_TIME', 4),
+        'verify' => env('HASH_VERIFY', true),
+    ],
+
+    'rehash_on_login' => true,
+];

config/session.php

@@ -47,7 +47,9 @@ return [
     |
     */
 
-    'encrypt' => env('SESSION_ENCRYPT', false),
+    'encrypt' => env('APP_ENV') === 'production'
+        ? true
+        : env('SESSION_ENCRYPT', false),
 
     /*
     |--------------------------------------------------------------------------
@@ -169,7 +171,9 @@ return [
     |
     */
 
-    'secure' => env('SESSION_SECURE_COOKIE'),
+    'secure' => env('APP_ENV') === 'production'
+        ? true
+        : env('SESSION_SECURE_COOKIE', false),
 
     /*
     |--------------------------------------------------------------------------