UI: Authentication & Profile

The UI package includes a built-in auth/profile surface when seviaflow-ui.auth.enabled is true.

Auth Config

Routes

Current UI routes include login/logout, forgot password, reset password, profile, profile password, two-factor authentication and browser sessions. Full route details are in Routes.

Middleware Aliases

The UI service provider registers seviaflow.auth and seviaflow.guest middleware aliases. Default admin middleware values that use auth are normalized to SeviaFlow's auth middleware alias for the configured guard.

Two-factor authentication with Fortify

Install laravel/fortify:^1.30 in the host application. Fortify is optional for UI consumers. Its service provider must be registered, and the host user model must use Laravel\Fortify\TwoFactorAuthenticatable. Add nullable text columns two_factor_secret and two_factor_recovery_codes, plus a nullable timestamp two_factor_confirmed_at. Hide the two secret attributes from model serialization. Fortify encrypts their stored values; do not apply an additional Eloquent encrypted cast.

Configure the following feature in the host's config/fortify.php:

'features' => [
    \Laravel\Fortify\Features::twoFactorAuthentication(['confirm' => true]),
],

When SeviaFlow owns the login and profile surface, call \Laravel\Fortify\Fortify::ignoreRoutes() in the host provider's register() method. This keeps the Fortify backend without a competing set of login routes. If the host already owns authentication, keep its routes and verify that its login enforces 2FA too: SeviaFlow's login challenge does not add another factor to sessions created elsewhere.

1. Open /admin/profile/two-factor-authentication and enable setup using the current password.
2. Scan the QR code and confirm setup with a TOTP and the current password. Until confirmation, the profile shows setup as pending.
3. Save the recovery codes. Each works once; regeneration invalidates the previous set.
4. On the next login, enter the password and then a TOTP or recovery code. No panel session is created after the password alone.

The built-in login challenge expires after 300 seconds, configurable with auth.two_factor_login.challenge_timeout_seconds. A changed password or revoked panel access invalidates it. Invalid codes are throttled and are not flashed into the form. Fortify's replay protection remains active, so wait for the next authenticator code after confirming setup.

Regenerating recovery codes, cancelling pending setup and disabling 2FA require the current password; disabling also requires explicit confirmation. Missing backend or user-model support is reported as unavailable. Northstar contains the complete configuration, migration and database integration test.

Custom login adapters

The auth.two_factor_login.verify callback validates TOTP; consume_recovery_code must atomically consume a recovery code. A rejected TOTP can fall back to recovery. Custom twoFactorSecret() or getTwoFactorSecret() methods return a decrypted secret. Profile enrollment requires Fortify-compatible model methods and a registered backend.