Refine 2FA to enterprise-grade

app/Http/Controllers/SettingsController.php

@@ -8,6 +8,10 @@
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
+use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
+use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
+use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
 
 /**
  * User-facing account settings (profile, security, notification preferences).
@@ -32,9 +36,82 @@ public function security(Request $request)
     {
         return view('settings.security', [
             'tokens' => $request->user()->tokens()->latest()->get(),
+            // Recovery codes are shown once (right after confirming/regenerating,
+            // or after an explicit password-confirmed reveal) and hidden otherwise.
+            'revealRecoveryCodes' => (bool) $request->session()->get('reveal_recovery_codes'),
         ]);
     }
 
+    /**
+     * Begin two-factor enrolment. Requires the account password, then generates
+     * an unconfirmed secret; the user confirms it with a TOTP code afterwards.
+     */
+    public function enableTwoFactor(Request $request, EnableTwoFactorAuthentication $enable)
+    {
+        $request->validate(['current_password' => ['required', 'current_password']]);
+
+        $enable($request->user());
+
+        return redirect()->route('settings.security');
+    }
+
+    /**
+     * Finish enrolment by verifying a TOTP code. On success the fresh recovery
+     * codes are revealed once.
+     */
+    public function confirmTwoFactor(Request $request, ConfirmTwoFactorAuthentication $confirm)
+    {
+        $request->validate(['code' => ['required', 'string']]);
+
+        $confirm($request->user(), $request->input('code'));
+
+        return redirect()
+            ->route('settings.security')
+            ->with('status', 'two-factor-authentication-confirmed')
+            ->with('reveal_recovery_codes', true);
+    }
+
+    /**
+     * Regenerate the recovery codes (password-gated) and reveal the new set once.
+     */
+    public function regenerateRecoveryCodes(Request $request, GenerateNewRecoveryCodes $generate)
+    {
+        $request->validate(['current_password' => ['required', 'current_password']]);
+
+        $generate($request->user());
+
+        return redirect()
+            ->route('settings.security')
+            ->with('status', 'recovery-codes-generated')
+            ->with('reveal_recovery_codes', true);
+    }
+
+    /**
+     * Re-display the existing recovery codes once, behind a password check.
+     */
+    public function revealRecoveryCodes(Request $request)
+    {
+        $request->validate(['current_password' => ['required', 'current_password']]);
+
+        return redirect()
+            ->route('settings.security')
+            ->with('reveal_recovery_codes', true);
+    }
+
+    /**
+     * Disable two-factor authentication (password-gated).
+     */
+    public function disableTwoFactor(Request $request, DisableTwoFactorAuthentication $disable)
+    {
+        $request->validate(['current_password' => ['required', 'current_password']]);
+
+        $disable($request->user());
+
+        return redirect()
+            ->route('settings.security')
+            ->with('status', 'two-factor-authentication-disabled');
+    }
+
     public function storeToken(Request $request)
     {
         $request->validate([

app/Providers/AppServiceProvider.php

@@ -128,6 +128,11 @@ public function boot(): void
         // second-factor code (mirrors the login page styling).
         Fortify::twoFactorChallengeView(fn () => view('auth.two-factor-challenge'));
 
+        // Password confirmation screen. The 2FA UI confirms the password inline
+        // via SettingsController, but Fortify's built-in 2FA routes are gated by
+        // confirmPassword => true and redirect here if ever hit directly.
+        Fortify::confirmPasswordView(fn () => view('auth.confirm-password'));
+
         // Die Login-Pipeline von Fortify anpassen:
         // RedirectIfTwoFactorAuthenticatable diverts users with 2FA enabled to
         // the challenge screen before the password is accepted. The active

config/fortify.php

@@ -149,8 +149,12 @@
         Features::emailVerification(),
         Features::updateProfileInformation(),
         Features::updatePasswords(),
+        // 2FA management in the UI is handled by our own password-gated
+        // SettingsController routes. confirmPassword => true additionally guards
+        // Fortify's built-in 2FA routes (which we no longer link to) so a live
+        // session cannot hit them ungated.
         Features::twoFactorAuthentication([
-            'confirmPassword' => false,
+            'confirmPassword' => true,
         ]),
     ],
 ];

resources/views/auth/confirm-password.blade.php

@@ -0,0 +1,46 @@
+@extends('layouts.loginlayout')
+@section('title', 'Confirm Password')
+@section('content')
+
+<div class="card shadow-sm">
+    <div class="card-body p-4">
+        <div class="text-center mb-4">
+            <img src="{{ asset('img/yaams-logo-icon.svg') }}" alt="YAAMS Logo" height="60" class="mb-3">
+            <h1 class="h4 mb-2 fw-bold">Confirm your password</h1>
+            <p class="text-muted small mb-0">
+                This is a secure area. Please re-enter your password to continue.
+            </p>
+        </div>
+
+        <form action="{{ route('password.confirm.store') }}" method="post">
+            @csrf
+
+            <div class="mb-3">
+                <label for="password" class="form-label">Password</label>
+                <div class="input-group">
+                    <span class="input-group-text"><i class="bi bi-lock text-secondary"></i></span>
+                    <input type="password"
+                           id="password"
+                           name="password"
+                           class="form-control @error('password') is-invalid @enderror"
+                           autocomplete="current-password"
+                           autofocus
+                           required>
+                </div>
+                @error('password')
+                    <div class="invalid-feedback d-block mt-1">{{ $message }}</div>
+                @enderror
+            </div>
+
+            <button class="btn btn-primary w-100" type="submit">
+                <i class="bi bi-shield-check me-2"></i> Confirm
+            </button>
+        </form>
+    </div>
+</div>
+
+<div class="text-center mt-4">
+    <small class="text-muted">&copy; {{ date('Y') }} YAAMS Virtual Airline Management</small>
+</div>
+
+@endsection

resources/views/settings/_password_confirm_modal.blade.php

@@ -0,0 +1,37 @@
+{{--
+    Reusable password-confirmation modal for a sensitive action.
+    Expects: $id, $action, $method (POST|DELETE), $title, $body, $submitLabel, $submitClass
+--}}
+<div class="modal fade" id="{{ $id }}" tabindex="-1" aria-labelledby="{{ $id }}Label" aria-hidden="true">
+    <div class="modal-dialog">
+        <div class="modal-content">
+            <form action="{{ $action }}" method="post">
+                @csrf
+                @if ($method !== 'POST')
+                    @method($method)
+                @endif
+                <div class="modal-header">
+                    <h5 class="modal-title" id="{{ $id }}Label">{{ $title }}</h5>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                </div>
+                <div class="modal-body">
+                    <p class="text-muted">{{ $body }}</p>
+                    <label for="{{ $id }}_password" class="form-label">Current password</label>
+                    <div class="input-group">
+                        <span class="input-group-text"><i class="bi bi-key text-secondary"></i></span>
+                        <input type="password"
+                               id="{{ $id }}_password"
+                               name="current_password"
+                               class="form-control"
+                               autocomplete="current-password"
+                               required>
+                    </div>
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
+                    <button type="submit" class="btn {{ $submitClass }}">{{ $submitLabel }}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>