laravel-nuxt-ui-inertia-template/app/Http/Controllers/Auth/TwoFactorSettingsController.php

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Validation\ValidationException;
use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
use Laravel\Fortify\Fortify;

class TwoFactorSettingsController extends Controller
{
    /**
     * Begin two-factor enrollment.
     */
    public function enable(Request $request, EnableTwoFactorAuthentication $enable): RedirectResponse
    {
        $this->ensureFeatureIsEnabled();

        /** @var User $user */
        $user = $request->user();

        if ($user->hasEnabledTwoFactorAuthentication()) {
            return redirect()->route('profile.show');
        }

        $this->validatePasswordForPasswordUser($request, $user);
        $enable($user, force: true);

        return redirect()->route('profile.show')
            ->with('success', 'Scan the QR code, then enter a code to finish enabling two-factor authentication.');
    }

    /**
     * Confirm a newly configured authenticator.
     */
    public function confirm(
        Request $request,
        ConfirmTwoFactorAuthentication $confirm
    ): RedirectResponse {
        $this->ensureFeatureIsEnabled();

        $validated = $request->validate([
            'code' => ['required', 'string', 'regex:/^\d{6}$/'],
        ]);

        /** @var User $user */
        $user = $request->user();
        $confirm($user, $validated['code']);

        return redirect()->route('profile.show')
            ->with('success', 'Two-factor authentication is now enabled.')
            ->with('recoveryCodes', $user->fresh()->recoveryCodes());
    }

    /**
     * Disable two-factor authentication.
     */
    public function disable(
        Request $request,
        DisableTwoFactorAuthentication $disable
    ): RedirectResponse {
        $this->ensureFeatureIsEnabled();

        /** @var User $user */
        $user = $request->user();

        if ($user->hasEnabledTwoFactorAuthentication()) {
            $this->validateSensitiveAction($request, $user);
        }

        $disable($user);

        return redirect()->route('profile.show')
            ->with('success', 'Two-factor authentication has been disabled.');
    }

    /**
     * Reveal or regenerate recovery codes after re-authentication.
     */
    public function recoveryCodes(
        Request $request,
        GenerateNewRecoveryCodes $generate
    ): RedirectResponse {
        $this->ensureFeatureIsEnabled();

        /** @var User $user */
        $user = $request->user();

        if (! $user->hasEnabledTwoFactorAuthentication()) {
            abort(409, 'Two-factor authentication is not enabled.');
        }

        $this->validateSensitiveAction($request, $user);

        if ($request->boolean('regenerate')) {
            $generate($user);
            $user->refresh();
        }

        return redirect()->route('profile.show')
            ->with('success', $request->boolean('regenerate')
                ? 'New recovery codes have been generated. Previous codes no longer work.'
                : 'Recovery codes revealed.')
            ->with('recoveryCodes', $user->recoveryCodes());
    }

    private function ensureFeatureIsEnabled(): void
    {
        abort_unless(config('auth-ui.features.two_factor'), 404);
    }

    private function validatePasswordForPasswordUser(Request $request, User $user): void
    {
        if (! $user->hasPassword()) {
            return;
        }

        $request->validate([
            'password' => ['required', 'string', 'current_password:web'],
        ]);
    }

    private function validateSensitiveAction(Request $request, User $user): void
    {
        if ($user->hasPassword()) {
            $this->validatePasswordForPasswordUser($request, $user);

            return;
        }

        $validated = $request->validate([
            'code' => ['required', 'string'],
        ]);

        if (! $this->hasValidTwoFactorCredential($user, $validated['code'])) {
            throw ValidationException::withMessages([
                'code' => 'The provided authentication or recovery code was invalid.',
            ]);
        }
    }

    private function hasValidTwoFactorCredential(User $user, string $code): bool
    {
        $secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);

        if (app(TwoFactorAuthenticationProvider::class)->verify($secret, $code)) {
            return true;
        }

        $recoveryCode = collect($user->recoveryCodes())
            ->first(fn (string $recoveryCode) => hash_equals($recoveryCode, $code));

        if (! $recoveryCode) {
            return false;
        }

        $user->replaceRecoveryCode($recoveryCode);

        return true;
    }
}