From f14b9a819d0dc88967a5610e383230a48932b8d5 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Sun, 3 May 2026 17:05:09 +0300
Subject: [PATCH 01/53] fix: editorconfig for blade files (4 spaces instead of
 2)

---
 .editorconfig | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.editorconfig b/.editorconfig
index b52cb6ba8..f81cc0d1e 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -21,16 +21,10 @@ indent_size = 2
 indent_size = 4
 
 [*.blade.php]
-indent_size = 2
+indent_size = 4
 
 [*.js]
 indent_size = 4
 
-[*.jsx]
-indent_size = 2
-
-[*.tsx]
-indent_size = 2
-
 [*.json]
 indent_size = 4

From a6c61e20f22064c3120f53513d9deaee7c01fdde Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Sun, 3 May 2026 17:05:39 +0300
Subject: [PATCH 02/53] refactor: tabbed profile page

---
 themes/default/views/profile/index.blade.php | 223 ++++++++++++-------
 1 file changed, 138 insertions(+), 85 deletions(-)

diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index c99db2acb..90fb336bf 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -44,19 +44,16 @@
                         @if (!empty($discord_client_id) && !empty($discord_client_secret))
                             <div class="p-2 m-2 alert alert-warning">
                                 <h5>
-                                    <i
-                                        class="icon fas fa-exclamation-circle"></i>{{ __('Required Discord verification!') }}
+                                    <i class="icon fas fa-exclamation-circle"></i>{{ __('Required Discord verification!') }}
                                 </h5>
                                 {{ __('You have not yet verified your discord account') }}
-                                <a class="text-primary"
-                                    href="{{ route('auth.redirect') }}">{{ __('Login with discord') }}</a> <br>
+                                <a class="text-primary" href="{{ route('auth.redirect') }}">{{ __('Login with discord') }}</a> <br>
                                 {{ __('Please contact support If you face any issues.') }}
                             </div>
                         @else
                             <div class="p-2 m-2 alert alert-danger">
                                 <h5>
-                                    <i
-                                        class="icon fas fa-exclamation-circle"></i>{{ __('Required Discord verification!') }}
+                                    <i class="icon fas fa-exclamation-circle"></i>{{ __('Required Discord verification!') }}
                                 </h5>
                                 {{ __('Due to system settings you are required to verify your discord account!') }} <br>
                                 {{ __('It looks like this hasnt been set-up correctly! Please contact support.') }}
@@ -101,16 +98,20 @@ class="mr-2 fa fa-coins"></i>{{ Currency::formatForDisplay($user->credits) }}</s
                                         </div>
 
                                         @if ($referral_enabled)
-                                            @can('user.referral')
-                                                <div class="mt-1">
-                                                    <span class="badge badge-success"><i class="mr-2 fa fa-user-check"></i>
+                                            <div class="mt-1">
+                                                @can('user.referral')
+                                                    <span class="badge badge-success">
+                                                        <i class="mr-2 fa fa-user-check"></i>
                                                         {{ __('Referral URL') }} :
-                                                        <span onclick="onClickCopy()" id="RefLink" style="cursor: pointer;">
-                                                            {{ route('register') }}?ref={{ $user->referral_code }}</span>
+                                                        <span onclick="onClickCopy()" id="RefLink" style="cursor: pointer;" data-url="{{ route('register') }}?ref={{ $user->referral_code }}">
+                                                            {{ route('register') }}?ref={{ $user->referral_code }}
+                                                        </span>
                                                     </span>
                                                 @else
-                                                    <span class="badge badge-warning"><i class="mr-2 fa fa-user-check"></i>
-                                                        {{ __('You can not see your Referral Code') }}</span>
+                                                    <span class="badge badge-warning">
+                                                        <i class="mr-2 fa fa-user-check"></i>
+                                                        {{ __('You can not see your Referral Code') }}
+                                                    </span>
                                                 @endcan
                                             </div>
                                         @endif
@@ -133,13 +134,20 @@ class='badge'>{{ $role->name }}</span>
                                     </div>
                                 </div>
                             </div>
-                            <ul class="nav nav-tabs">
-                                <li class="nav-item"><a href="javasript:void(0)"
-                                        class="active nav-link">{{ __('Settings') }}</a>
+                            <ul class="nav nav-tabs" id="profileTabs" role="tablist">
+                                <li class="nav-item">
+                                    <a class="nav-link active" id="account-tab" data-toggle="tab" href="#account" role="tab"
+                                        aria-controls="account" aria-selected="true">{{ __('Account Settings') }}</a>
+                                </li>
+                                <li class="nav-item">
+                                    <a class="nav-link" id="security-tab" data-toggle="tab" href="#security" role="tab"
+                                        aria-controls="security" aria-selected="false">{{ __('Security') }}</a>
                                 </li>
                             </ul>
-                            <div class="pt-3 tab-content">
-                                <div class="tab-pane active">
+                            <div class="pt-3 tab-content" id="profileTabsContent">
+                                <!-- Account Settings Tab -->
+                                <div class="tab-pane fade show active" id="account" role="tabpanel"
+                                    aria-labelledby="account-tab">
                                     <div class="row">
                                         <div class="col">
                                             <div class="row">
@@ -188,6 +196,62 @@ class="form-control @error('email') is-invalid @enderror"
                                             </div>
                                         </div>
                                     </div>
+                                    @if (!empty($discord_client_id) && !empty($discord_client_secret))
+                                        <div class="row">
+                                            <div class="mb-3 col-12">
+                                                <hr>
+                                                @if (is_null(Auth::user()->discordUser))
+                                                    <div class="verify-discord">
+                                                        <b>{{ __('Link your discord account!') }}</b>
+                                                        <div class="mb-3">
+                                                            @if ($credits_reward_after_verify_discord)
+                                                                <p>
+                                                                    {{ __('By verifying your discord account, you receive an extra :amount credits and increased Server amounts', ['amount' => Currency::formatForDisplay($credits_reward_after_verify_discord)]) }}
+                                                                </p>
+                                                            @endif
+                                                        </div>
+                                                        <a class="btn btn-light" href="{{ route('auth.redirect') }}">
+                                                            <i class="mr-2 fab fa-discord"></i>{{ __('Login with Discord') }}
+                                                        </a>
+                                                    </div>
+                                                @else
+                                                    <div class="verified-discord">
+                                                        <div class="pl-2 row">
+                                                            <div class="small-box bg-dark d-inline-block">
+                                                                <div class="d-flex justify-content-between">
+                                                                    <div class="p-3">
+                                                                        <h3>{{ $user->discordUser->username }}</h3>
+                                                                        <p class="mb-0">{{ $user->discordUser->email }}</p>
+                                                                        <p class="mb-0 text-muted text-sm">
+                                                                            {{ $user->discordUser->id }}</p>
+                                                                    </div>
+                                                                    <div class="p-3"><img width="100px" height="100px"
+                                                                            class="rounded-circle"
+                                                                            src="{{ $user->discordUser->getAvatar() }}"
+                                                                            alt="avatar"></div>
+                                                                </div>
+                                                                <div class="small-box-footer">
+                                                                    <a href="{{ route('auth.redirect') }}">
+                                                                        <i
+                                                                            class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
+                                                                    </a>
+                                                                </div>
+                                                            </div>
+                                                        </div>
+                                                    </div>
+                                                @endif
+                                            </div>
+                                        </div>
+                                    @endif
+                                    <div class="row">
+                                        <div class="col d-flex justify-content-end">
+                                            <button class="btn btn-primary" type="submit">{{ __('Save Changes') }}</button>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <!-- Security Tab -->
+                                <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
                                     <div class="row">
                                         <div class="mb-3 col-12 col-sm-6">
                                             <div class="mb-3"><b>{{ __('Change Password') }}</b></div>
@@ -240,64 +304,39 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
                                                 </div>
                                             </div>
                                         </div>
-                                        @if (!empty($discord_client_id) && !empty($discord_client_secret))
-                                            <div class="mb-3 col-12 col-sm-5 offset-sm-1">
-                                                @if (is_null(Auth::user()->discordUser))
-                                                    <b>{{ __('Link your discord account!') }}</b>
-                                                    <div class="verify-discord">
-                                                        <div class="mb-3">
-                                                            @if ($credits_reward_after_verify_discord)
-                                                                <p>
-                                                                    {{ __('By verifying your discord account, you receive an extra :amount credits and increased Server amounts', ['amount' => Currency::formatForDisplay($credits_reward_after_verify_discord)]) }}
-                                                                </p>
-                                                            @endif
-                                                        </div>
-                                                    </div>
-
-                                                    <a class="btn btn-light" href="{{ route('auth.redirect') }}">
-                                                        <i class="mr-2 fab fa-discord"></i>{{ __('Login with Discord') }}
-                                                    </a>
-                                                @else
-                                                    <div class="verified-discord">
-                                                        <div class="my-3 callout callout-info">
-                                                            <p>{{ __('You are verified!') }}</p>
-                                                        </div>
-                                                    </div>
-                                                    <div class="pl-2 row">
-                                                        <div class="small-box bg-dark">
-                                                            <div class="d-flex justify-content-between">
-                                                                <div class="p-3">
-                                                                    <h3>{{ $user->discordUser->username }}
-                                                                        <sup>{{ $user->discordUser->locale }}</sup>
-                                                                    </h3>
-                                                                    <p>{{ $user->discordUser->id }}
-                                                                    </p>
-                                                                </div>
-                                                                <div class="p-3"><img width="100px" height="100px"
-                                                                        class="rounded-circle"
-                                                                        src="{{ $user->discordUser->getAvatar() }}"
-                                                                        alt="avatar"></div>
-                                                            </div>
-                                                            <div class="small-box-footer">
-                                                                <a href="{{ route('auth.redirect') }}">
-                                                                    <i
-                                                                        class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
-                                                                </a>
-                                                            </div>
-                                                        </div>
-                                                    </div>
-                                                @endif
-
-                                            </div>
-                                        @endif
+                                        <div class="mb-3 col-12 col-sm-5 offset-sm-1">
+                                            {{-- <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div>
+                                            @if (!$user->two_factor_enabled)
+                                                <p>
+                                                    {{ __('Two-factor authentication adds an additional layer of security to your account by requiring more than just a password to log in.') }}
+                                                </p>
+                                                <button type="button" class="btn btn-success" data-toggle="modal"
+                                                    data-target="#enabletwofaModal" onclick="generate2FA()">
+                                                    {{ __('Enable 2FA') }}
+                                                </button>
+                                            @else
+                                                <div class="mb-3 callout callout-success">
+                                                    <h5><i class="fas fa-check-circle mr-2"></i>{{ __('2FA is enabled') }}
+                                                    </h5>
+                                                    <p>{{ __('Your account is protected with two-factor authentication.') }}
+                                                    </p>
+                                                </div>
+                                                <button type="button" class="btn btn-danger" data-toggle="modal"
+                                                    data-target="#disabletwofaModal">
+                                                    {{ __('Disable 2FA') }}
+                                                </button>
+                                                <button type="button" class="btn btn-info" data-toggle="modal"
+                                                    data-target="#downloadtwofaModal">
+                                                    <i class="fas fa-download mr-1"></i>{{ __('Recovery Codes') }}
+                                                </button>
+                                            @endif
+                                        </div> --}}
                                     </div>
                                     <div class="row">
                                         <div class="col d-flex justify-content-end">
-                                            <button class="btn btn-primary"
-                                                type="submit">{{ __('Save Changes') }}</button>
+                                            <button class="btn btn-primary" type="submit">{{ __('Save Changes') }}</button>
                                         </div>
                                     </div>
-
                                 </div>
                             </div>
                         </div>
@@ -314,6 +353,19 @@ class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
     </section>
     <!-- END CONTENT -->
     <script>
+        $(document).ready(function() {
+            // Check if there is a hash in the URL and show the corresponding tab
+            let hash = window.location.hash;
+            if (hash) {
+                $('.nav-tabs a[href="' + hash + '"]').tab('show');
+            }
+
+            // Update the URL hash when a tab is clicked
+            $('.nav-tabs a').on('shown.bs.tab', function(e) {
+                history.replaceState(null, null, e.target.hash);
+            });
+        });
+
         document.getElementById("confirmDeleteButton").onclick = async () => {
             const {
                 value: enterConfirm
@@ -322,31 +374,32 @@ class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
                 inputLabel: '{{ __('Are you sure you want to permanently delete your account and all of your servers?') }} \n Type "{{ __('Delete my account') }}" in the Box below',
                 inputPlaceholder: "{{ __('Delete my account') }}",
                 showCancelButton: true
-            })
+            });
+
             if (enterConfirm === "{{ __('Delete my account') }}") {
-                Swal.fire("{{ __('Account has been destroyed') }}", '', 'error')
                 $.ajax({
                     type: "POST",
                     url: "{{ route('profile.selfDestroyUser') }}",
-                    data: `{
-                        "confirmed": "yes",
-                      }`,
-                    success: function(result) {
-                        console.log(result);
+                    data: {
+                        "_token": "{{ csrf_token() }}",
+                        "confirmed": "yes"
                     },
-                    dataType: "json"
+                    success: function (result) {
+                        Swal.fire("{{ __('Account has been destroyed') }}", '', 'success').then(() => {
+                            location.reload();
+                        });
+                    },
+                    error: function (result) {
+                        Swal.fire("{{ __('Error') }}", (result.responseJSON && result.responseJSON.message) ? result.responseJSON.message : "{{ __('Something went wrong') }}", 'error');
+                    }
                 });
-                location.reload();
-
             } else {
-                Swal.fire("{{ __('Account was NOT deleted.') }}", '', 'info')
-
+                Swal.fire("{{ __('Account was NOT deleted.') }}", '', 'info');
             }
-
         }
 
         function onClickCopy() {
-            let textToCopy = document.getElementById('RefLink').innerText;
+            let textToCopy = document.getElementById('RefLink').getAttribute('data-url');
             if (navigator.clipboard) {
                 navigator.clipboard.writeText(textToCopy).then(() => {
                     Swal.fire({

From 8552e6959f59cd49e8bbfbbdc1b8dfbd13381205 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Sun, 3 May 2026 21:46:37 +0300
Subject: [PATCH 03/53] refactor: improve structure of profile page

---
 themes/default/views/profile/index.blade.php | 206 +++++++++----------
 1 file changed, 95 insertions(+), 111 deletions(-)

diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index 90fb336bf..ae7de670f 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -103,7 +103,8 @@ class="mr-2 fa fa-coins"></i>{{ Currency::formatForDisplay($user->credits) }}</s
                                                     <span class="badge badge-success">
                                                         <i class="mr-2 fa fa-user-check"></i>
                                                         {{ __('Referral URL') }} :
-                                                        <span onclick="onClickCopy()" id="RefLink" style="cursor: pointer;" data-url="{{ route('register') }}?ref={{ $user->referral_code }}">
+                                                        <span onclick="onClickCopy()" id="RefLink" style="cursor: pointer;"
+                                                            data-url="{{ route('register') }}?ref={{ $user->referral_code }}">
                                                             {{ route('register') }}?ref={{ $user->referral_code }}
                                                         </span>
                                                     </span>
@@ -149,100 +150,108 @@ class='badge'>{{ $role->name }}</span>
                                 <div class="tab-pane fade show active" id="account" role="tabpanel"
                                     aria-labelledby="account-tab">
                                     <div class="row">
-                                        <div class="col">
-                                            <div class="row">
-                                                <div class="col">
-                                                    @if ($errors->has('pterodactyl_error_message'))
-                                                        @foreach ($errors->get('pterodactyl_error_message') as $err)
-                                                            <span class="text-danger" role="alert">
-                                                                <small><strong>{{ $err }}</strong></small>
-                                                            </span>
-                                                        @endforeach
-                                                    @endif
-                                                    @if ($errors->has('pterodactyl_error_status'))
-                                                        @foreach ($errors->get('pterodactyl_error_status') as $err)
-                                                            <span class="text-danger" role="alert">
-                                                                <small><strong>{{ $err }}</strong></small>
-                                                            </span>
-                                                        @endforeach
-                                                    @endif
-                                                    <div class="form-group"><label>{{ __('Name') }}</label> <input
-                                                            class="form-control @error('name') is-invalid @enderror"
-                                                            type="text" name="name" placeholder="{{ $user->name }}"
-                                                            value="{{ $user->name }}">
 
-                                                        @error('name')
-                                                            <div class="invalid-feedback">
-                                                                {{ $message }}
-                                                            </div>
-                                                        @enderror
+                                    </div>
+                                    <div class="row">
+                                        <div class="mb-3 col-12 col-sm-6">
+                                            <div class="col">
+                                                <div class="row">
+                                                    <div class="col">
+                                                        @if ($errors->has('pterodactyl_error_message'))
+                                                            @foreach ($errors->get('pterodactyl_error_message') as $err)
+                                                                <span class="text-danger" role="alert">
+                                                                    <small><strong>{{ $err }}</strong></small>
+                                                                </span>
+                                                            @endforeach
+                                                        @endif
+                                                        @if ($errors->has('pterodactyl_error_status'))
+                                                            @foreach ($errors->get('pterodactyl_error_status') as $err)
+                                                                <span class="text-danger" role="alert">
+                                                                    <small><strong>{{ $err }}</strong></small>
+                                                                </span>
+                                                            @endforeach
+                                                        @endif
+                                                        <div class="form-group"><label>{{ __('Name') }}</label> <input
+                                                                class="form-control @error('name') is-invalid @enderror"
+                                                                type="text" name="name" placeholder="{{ $user->name }}"
+                                                                value="{{ $user->name }}">
+
+                                                            @error('name')
+                                                                <div class="invalid-feedback">
+                                                                    {{ $message }}
+                                                                </div>
+                                                            @enderror
+                                                        </div>
                                                     </div>
                                                 </div>
-                                            </div>
-                                            <div class="row">
-                                                <div class="col">
-                                                    <div class="form-group"><label>{{ __('Email') }}</label> <input
-                                                            class="form-control @error('email') is-invalid @enderror"
-                                                            type="text" placeholder="{{ $user->email }}" name="email"
-                                                            value="{{ $user->email }}">
+                                                <div class="row">
+                                                    <div class="col">
+                                                        <div class="form-group"><label>{{ __('Email') }}</label> <input
+                                                                class="form-control @error('email') is-invalid @enderror"
+                                                                type="text" placeholder="{{ $user->email }}" name="email"
+                                                                value="{{ $user->email }}">
 
-                                                        @error('email')
-                                                            <div class="invalid-feedback">
-                                                                {{ $message }}
-                                                            </div>
-                                                        @enderror
+                                                            @error('email')
+                                                                <div class="invalid-feedback">
+                                                                    {{ $message }}
+                                                                </div>
+                                                            @enderror
+                                                        </div>
                                                     </div>
                                                 </div>
                                             </div>
                                         </div>
-                                    </div>
-                                    @if (!empty($discord_client_id) && !empty($discord_client_secret))
-                                        <div class="row">
-                                            <div class="mb-3 col-12">
-                                                <hr>
-                                                @if (is_null(Auth::user()->discordUser))
-                                                    <div class="verify-discord">
-                                                        <b>{{ __('Link your discord account!') }}</b>
-                                                        <div class="mb-3">
-                                                            @if ($credits_reward_after_verify_discord)
-                                                                <p>
-                                                                    {{ __('By verifying your discord account, you receive an extra :amount credits and increased Server amounts', ['amount' => Currency::formatForDisplay($credits_reward_after_verify_discord)]) }}
-                                                                </p>
-                                                            @endif
-                                                        </div>
-                                                        <a class="btn btn-light" href="{{ route('auth.redirect') }}">
-                                                            <i class="mr-2 fab fa-discord"></i>{{ __('Login with Discord') }}
-                                                        </a>
-                                                    </div>
-                                                @else
-                                                    <div class="verified-discord">
-                                                        <div class="pl-2 row">
-                                                            <div class="small-box bg-dark d-inline-block">
-                                                                <div class="d-flex justify-content-between">
-                                                                    <div class="p-3">
-                                                                        <h3>{{ $user->discordUser->username }}</h3>
-                                                                        <p class="mb-0">{{ $user->discordUser->email }}</p>
-                                                                        <p class="mb-0 text-muted text-sm">
-                                                                            {{ $user->discordUser->id }}</p>
-                                                                    </div>
-                                                                    <div class="p-3"><img width="100px" height="100px"
-                                                                            class="rounded-circle"
-                                                                            src="{{ $user->discordUser->getAvatar() }}"
-                                                                            alt="avatar"></div>
+                                        <div class="mb-3 col-12 col-sm-5 offset-sm-1">
+                                            @if (!empty($discord_client_id) && !empty($discord_client_secret))
+                                                <div class="row">
+                                                    <div class="mb-3 col-12">
+                                                        @if (is_null(Auth::user()->discordUser))
+                                                            <div class="verify-discord">
+                                                                <b>{{ __('Link your discord account!') }}</b>
+                                                                <div class="mb-3">
+                                                                    @if ($credits_reward_after_verify_discord)
+                                                                        <p>
+                                                                            {{ __('By verifying your discord account, you receive an extra :amount credits and increased Server amounts', ['amount' => Currency::formatForDisplay($credits_reward_after_verify_discord)]) }}
+                                                                        </p>
+                                                                    @endif
                                                                 </div>
-                                                                <div class="small-box-footer">
-                                                                    <a href="{{ route('auth.redirect') }}">
-                                                                        <i
-                                                                            class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
-                                                                    </a>
+                                                                <a class="btn btn-light" href="{{ route('auth.redirect') }}">
+                                                                    <i
+                                                                        class="mr-2 fab fa-discord"></i>{{ __('Login with Discord') }}
+                                                                </a>
+                                                            </div>
+                                                        @else
+                                                            <div class="verified-discord">
+                                                                <div class="pl-2 row">
+                                                                    <div class="small-box bg-dark d-inline-block">
+                                                                        <div class="d-flex justify-content-between">
+                                                                            <div class="p-3">
+                                                                                <h3>{{ $user->discordUser->username }}</h3>
+                                                                                <p class="mb-0">{{ $user->discordUser->email }}</p>
+                                                                                <p class="mb-0 text-muted text-sm">
+                                                                                    {{ $user->discordUser->id }}
+                                                                                </p>
+                                                                            </div>
+                                                                            <div class="p-3"><img width="100px" height="100px"
+                                                                                    class="rounded-circle"
+                                                                                    src="{{ $user->discordUser->getAvatar() }}"
+                                                                                    alt="avatar"></div>
+                                                                        </div>
+                                                                        <div class="small-box-footer">
+                                                                            <a href="{{ route('auth.redirect') }}">
+                                                                                <i
+                                                                                    class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
+                                                                            </a>
+                                                                        </div>
+                                                                    </div>
                                                                 </div>
                                                             </div>
-                                                        </div>
+                                                        @endif
                                                     </div>
-                                                @endif
-                                            </div>
+                                                </div>
+                                            @endif
                                         </div>
-                                    @endif
+                                    </div>
                                     <div class="row">
                                         <div class="col d-flex justify-content-end">
                                             <button class="btn btn-primary" type="submit">{{ __('Save Changes') }}</button>
@@ -254,7 +263,6 @@ class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
                                 <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
                                     <div class="row">
                                         <div class="mb-3 col-12 col-sm-6">
-                                            <div class="mb-3"><b>{{ __('Change Password') }}</b></div>
                                             <div class="row">
                                                 <div class="col">
                                                     <div class="form-group">
@@ -305,32 +313,8 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
                                             </div>
                                         </div>
                                         <div class="mb-3 col-12 col-sm-5 offset-sm-1">
-                                            {{-- <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div>
-                                            @if (!$user->two_factor_enabled)
-                                                <p>
-                                                    {{ __('Two-factor authentication adds an additional layer of security to your account by requiring more than just a password to log in.') }}
-                                                </p>
-                                                <button type="button" class="btn btn-success" data-toggle="modal"
-                                                    data-target="#enabletwofaModal" onclick="generate2FA()">
-                                                    {{ __('Enable 2FA') }}
-                                                </button>
-                                            @else
-                                                <div class="mb-3 callout callout-success">
-                                                    <h5><i class="fas fa-check-circle mr-2"></i>{{ __('2FA is enabled') }}
-                                                    </h5>
-                                                    <p>{{ __('Your account is protected with two-factor authentication.') }}
-                                                    </p>
-                                                </div>
-                                                <button type="button" class="btn btn-danger" data-toggle="modal"
-                                                    data-target="#disabletwofaModal">
-                                                    {{ __('Disable 2FA') }}
-                                                </button>
-                                                <button type="button" class="btn btn-info" data-toggle="modal"
-                                                    data-target="#downloadtwofaModal">
-                                                    <i class="fas fa-download mr-1"></i>{{ __('Recovery Codes') }}
-                                                </button>
-                                            @endif
-                                        </div> --}}
+                                            {{-- <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div> --}}
+                                        </div>
                                     </div>
                                     <div class="row">
                                         <div class="col d-flex justify-content-end">
@@ -353,7 +337,7 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
     </section>
     <!-- END CONTENT -->
     <script>
-        $(document).ready(function() {
+        $(document).ready(function () {
             // Check if there is a hash in the URL and show the corresponding tab
             let hash = window.location.hash;
             if (hash) {
@@ -361,7 +345,7 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
             }
 
             // Update the URL hash when a tab is clicked
-            $('.nav-tabs a').on('shown.bs.tab', function(e) {
+            $('.nav-tabs a').on('shown.bs.tab', function (e) {
                 history.replaceState(null, null, e.target.hash);
             });
         });

From dbf055ca9cf11b5fc5f0ca632ba323f06b847914 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 02:58:27 +0300
Subject: [PATCH 04/53] feat: add two-factor database migrations and models

---
 app/Models/TwoFactorVerifiedToken.php         | 35 +++++++++++++++++++
 app/Models/User.php                           | 16 +++++++++
 app/Models/UserTwoFactorMethod.php            | 31 ++++++++++++++++
 ...2_create_user_two_factor_methods_table.php | 34 ++++++++++++++++++
 ...reate_two_factor_verified_tokens_table.php | 33 +++++++++++++++++
 5 files changed, 149 insertions(+)
 create mode 100644 app/Models/TwoFactorVerifiedToken.php
 create mode 100644 app/Models/UserTwoFactorMethod.php
 create mode 100644 database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php
 create mode 100644 database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php

diff --git a/app/Models/TwoFactorVerifiedToken.php b/app/Models/TwoFactorVerifiedToken.php
new file mode 100644
index 000000000..92f9974c3
--- /dev/null
+++ b/app/Models/TwoFactorVerifiedToken.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Prunable;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class TwoFactorVerifiedToken extends Model
+{
+    use HasFactory, Prunable;
+
+    protected $fillable = [
+        'user_id',
+        'token_hash',
+        'verified_at',
+        'expires_at',
+    ];
+
+    protected $casts = [
+        'verified_at' => 'datetime',
+        'expires_at' => 'datetime',
+    ];
+
+    public function prunable()
+    {
+        return static::where('expires_at', '<', now());
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}
diff --git a/app/Models/User.php b/app/Models/User.php
index 82a34a3b9..1c3aa6d5b 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -240,6 +240,22 @@ public function discordUser()
         return $this->hasOne(DiscordUser::class);
     }
 
+    /**
+     * @return HasMany
+     */
+    public function twoFactorMethods(): HasMany
+    {
+        return $this->hasMany(UserTwoFactorMethod::class);
+    }
+
+    /**
+     * @return HasMany
+     */
+    public function twoFactorVerifiedTokens(): HasMany
+    {
+        return $this->hasMany(TwoFactorVerifiedToken::class);
+    }
+
     public function sendEmailVerificationNotification()
     {
         try {
diff --git a/app/Models/UserTwoFactorMethod.php b/app/Models/UserTwoFactorMethod.php
new file mode 100644
index 000000000..9e36069b1
--- /dev/null
+++ b/app/Models/UserTwoFactorMethod.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class UserTwoFactorMethod extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'user_id',
+        'method',
+        'is_enabled',
+        'totp_secret',
+        'totp_recovery_codes',
+    ];
+
+    protected $casts = [
+        'is_enabled' => 'boolean',
+        'totp_secret' => 'encrypted',
+        'totp_recovery_codes' => 'encrypted:array',
+    ];
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}
diff --git a/database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php b/database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php
new file mode 100644
index 000000000..47878bf9c
--- /dev/null
+++ b/database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('user_two_factor_methods', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->onDelete('cascade');
+            $table->enum('method', ['totp']);
+            $table->boolean('is_enabled')->default(false);
+            $table->text('totp_secret')->nullable();
+            $table->text('totp_recovery_codes')->nullable();
+            $table->timestamps();
+
+            $table->unique(['user_id', 'method']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('user_two_factor_methods');
+    }
+};
diff --git a/database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php b/database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php
new file mode 100644
index 000000000..e798f972a
--- /dev/null
+++ b/database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('two_factor_verified_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->onDelete('cascade');
+            $table->string('token_hash', 100);
+            $table->timestamp('verified_at')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamps();
+
+            $table->index(['user_id', 'token_hash']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('two_factor_verified_tokens');
+    }
+};

From daf739ce3d43f969cb380a8df64538c7c4623248 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:00:58 +0300
Subject: [PATCH 05/53] feat: add two-factor service layer with TOTP and
 recovery code support

---
 .../TwoFactor/RecoveryCodeService.php         |  70 ++++
 app/Services/TwoFactor/TotpService.php        |  36 +++
 app/Services/TwoFactor/TwoFactorService.php   |  92 ++++++
 composer.json                                 |   2 +
 composer.lock                                 | 302 +++++++++++++++++-
 config/google2fa.php                          |  70 ++++
 6 files changed, 571 insertions(+), 1 deletion(-)
 create mode 100644 app/Services/TwoFactor/RecoveryCodeService.php
 create mode 100644 app/Services/TwoFactor/TotpService.php
 create mode 100644 app/Services/TwoFactor/TwoFactorService.php
 create mode 100644 config/google2fa.php

diff --git a/app/Services/TwoFactor/RecoveryCodeService.php b/app/Services/TwoFactor/RecoveryCodeService.php
new file mode 100644
index 000000000..c3bb78d97
--- /dev/null
+++ b/app/Services/TwoFactor/RecoveryCodeService.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Services\TwoFactor;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+class RecoveryCodeService
+{
+    /**
+     * Generate 8 plain-text recovery codes.
+     */
+    public function generate(): array
+    {
+        $codes = [];
+        for ($i = 0; $i < 8; $i++) {
+            $codes[] = strtoupper(Str::random(8));
+        }
+        return $codes;
+    }
+
+    /**
+     * Verify and burn a recovery code.
+     */
+    public function verify(User $user, string $code): bool
+    {
+        $cacheKey = "2fa.recovery_attempts.{$user->id}";
+        $attempts = Cache::get($cacheKey, 0);
+
+        if ($attempts >= 5) {
+            throw ValidationException::withMessages([
+                'code' => [__('Too many recovery code attempts. Please try again in 10 minutes.')],
+            ]);
+        }
+
+        $code = strtoupper(preg_replace('/\s+/', '', $code));
+        
+        $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+        if (!$method || !$method->totp_recovery_codes) {
+            return false;
+        }
+
+        $recoveryCodes = $method->totp_recovery_codes;
+        $isVerified = false;
+
+        foreach ($recoveryCodes as $index => $storedCode) {
+            // Using hash_equals for constant-time comparison of the plain codes
+            // (they are decrypted by the Eloquent cast)
+            if (hash_equals($storedCode, $code)) {
+                // Burn the code
+                unset($recoveryCodes[$index]);
+                $method->totp_recovery_codes = array_values($recoveryCodes);
+                $method->save();
+                $isVerified = true;
+                break;
+            }
+        }
+
+        if ($isVerified) {
+            Cache::forget($cacheKey);
+        } else {
+            Cache::put($cacheKey, $attempts + 1, now()->addMinutes(10));
+        }
+
+        return $isVerified;
+    }
+}
diff --git a/app/Services/TwoFactor/TotpService.php b/app/Services/TwoFactor/TotpService.php
new file mode 100644
index 000000000..91e825b77
--- /dev/null
+++ b/app/Services/TwoFactor/TotpService.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Services\TwoFactor;
+
+use PragmaRX\Google2FALaravel\Facade as Google2FA;
+
+class TotpService
+{
+    /**
+     * Generate a new 32-character Base32 secret key.
+     */
+    public function generateSecret(): string
+    {
+        return Google2FA::generateSecretKey(32);
+    }
+
+    /**
+     * Generate an inline SVG QR code.
+     */
+    public function getQrCodeSvg(string $email, string $secret): string
+    {
+        return Google2FA::getQRCodeInline(
+            config('app.name', 'CtrlPanel.gg'),
+            $email,
+            $secret
+        );
+    }
+
+    /**
+     * Verify a TOTP code.
+     */
+    public function verifyCode(string $secret, string $code): bool
+    {
+        return Google2FA::verifyKey($secret, $code);
+    }
+}
diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
new file mode 100644
index 000000000..6e2161e6c
--- /dev/null
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Services\TwoFactor;
+
+use App\Models\TwoFactorVerifiedToken;
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class TwoFactorService
+{
+    /**
+     * Get all enabled 2FA methods for the user.
+     */
+    public function enabledMethods(User $user): Collection
+    {
+        return $user->twoFactorMethods()
+            ->where('is_enabled', true)
+            ->get();
+    }
+
+    /**
+     * Mark the user as 2FA verified for the current session.
+     */
+    public function markVerified(Request $request, User $user): void
+    {
+        $request->session()->put('two_factor_verified', true);
+
+        // If remember_web cookie is present, store verification token in DB
+        $rememberToken = $user->getRememberToken();
+        if ($rememberToken) {
+            TwoFactorVerifiedToken::updateOrCreate(
+                [
+                    'user_id' => $user->id,
+                    'token_hash' => hash('sha256', $rememberToken),
+                ],
+                [
+                    'verified_at' => now(),
+                    'expires_at' => now()->addMinutes((int) config('session.lifetime')), // Matching session lifetime as a fallback or use Laravel's remember lifetime
+                ]
+            );
+        }
+    }
+
+    /**
+     * Check if the user is 2FA verified.
+     */
+    public function isVerified(Request $request, User $user): bool
+    {
+        // 1. Session check - always authoritative for the current session
+        if ($request->session()->get('two_factor_verified') === true) {
+            return true;
+        }
+
+        // 2. DB token check - ONLY for remember-me re-authentication
+        // We only trust the DB token if the user was authenticated via the remember cookie
+        if (Auth::viaRemember()) {
+            $rememberToken = $user->getRememberToken();
+            if ($rememberToken) {
+                $tokenHash = hash('sha256', $rememberToken);
+                $token = TwoFactorVerifiedToken::where('user_id', $user->id)
+                    ->where('token_hash', $tokenHash)
+                    ->where('expires_at', '>', now())
+                    ->first();
+
+                if ($token) {
+                    // Restore session key if DB token is valid
+                    $request->session()->put('two_factor_verified', true);
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Clear 2FA verification state.
+     */
+    public function clearVerified(Request $request, User $user): void
+    {
+        $request->session()->forget('two_factor_verified');
+
+        $rememberToken = $user->getRememberToken();
+        if ($rememberToken) {
+            TwoFactorVerifiedToken::where('user_id', $user->id)
+                ->where('token_hash', hash('sha256', $rememberToken))
+                ->delete();
+        }
+    }
+}
diff --git a/composer.json b/composer.json
index 8c1da4a51..b454e15a7 100644
--- a/composer.json
+++ b/composer.json
@@ -12,6 +12,7 @@
         "ext-curl": "*",
         "ext-intl": "*",
         "ext-mysqli": "*",
+        "bacon/bacon-qr-code": "^3.1",
         "biscolab/laravel-recaptcha": "^6.1",
         "coderflex/laravel-turnstile": "^2.1",
         "doctrine/dbal": "^4.0.4",
@@ -25,6 +26,7 @@
         "laraveldaily/laravel-invoices": "^4.0.0",
         "league/flysystem-aws-s3-v3": "^3.28.0",
         "paypal/paypal-checkout-sdk": "^1.0.2",
+        "pragmarx/google2fa-laravel": "^3.0",
         "predis/predis": "*",
         "qirolab/laravel-themer": "^2.3.3",
         "socialiteproviders/discord": "^4.1.2",
diff --git a/composer.lock b/composer.lock
index 272786788..8e9967ce8 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "78ae00759c4f49760320646be638b4fa",
+    "content-hash": "83dd86211865cbefc606ce4bb173e906",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -157,6 +157,61 @@
             },
             "time": "2026-02-03T19:16:42+00:00"
         },
+        {
+            "name": "bacon/bacon-qr-code",
+            "version": "v3.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Bacon/BaconQrCode.git",
+                "reference": "4da2233e72eeecd9be3b62e0dc2cc9ed8e2e31c2"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Bacon/BaconQrCode/zipball/4da2233e72eeecd9be3b62e0dc2cc9ed8e2e31c2",
+                "reference": "4da2233e72eeecd9be3b62e0dc2cc9ed8e2e31c2",
+                "shasum": ""
+            },
+            "require": {
+                "dasprid/enum": "^1.0.3",
+                "ext-iconv": "*",
+                "php": "^8.1"
+            },
+            "require-dev": {
+                "phly/keep-a-changelog": "^2.12",
+                "phpunit/phpunit": "^10.5.11 || ^11.0.4",
+                "spatie/phpunit-snapshot-assertions": "^5.1.5",
+                "spatie/pixelmatch-php": "^1.2.0",
+                "squizlabs/php_codesniffer": "^3.9"
+            },
+            "suggest": {
+                "ext-imagick": "to generate QR code images"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "BaconQrCode\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-2-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Ben Scholzen 'DASPRiD'",
+                    "email": "mail@dasprids.de",
+                    "homepage": "https://dasprids.de/",
+                    "role": "Developer"
+                }
+            ],
+            "description": "BaconQrCode is a QR code generator for PHP.",
+            "homepage": "https://github.com/Bacon/BaconQrCode",
+            "support": {
+                "issues": "https://github.com/Bacon/BaconQrCode/issues",
+                "source": "https://github.com/Bacon/BaconQrCode/tree/v3.1.1"
+            },
+            "time": "2026-04-05T21:06:35+00:00"
+        },
         {
             "name": "barryvdh/laravel-dompdf",
             "version": "v3.1.1",
@@ -509,6 +564,56 @@
             },
             "time": "2025-03-01T13:04:55+00:00"
         },
+        {
+            "name": "dasprid/enum",
+            "version": "1.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/DASPRiD/Enum.git",
+                "reference": "b5874fa9ed0043116c72162ec7f4fb50e02e7cce"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/DASPRiD/Enum/zipball/b5874fa9ed0043116c72162ec7f4fb50e02e7cce",
+                "reference": "b5874fa9ed0043116c72162ec7f4fb50e02e7cce",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.1 <9.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^7 || ^8 || ^9 || ^10 || ^11",
+                "squizlabs/php_codesniffer": "*"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "DASPRiD\\Enum\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-2-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Ben Scholzen 'DASPRiD'",
+                    "email": "mail@dasprids.de",
+                    "homepage": "https://dasprids.de/",
+                    "role": "Developer"
+                }
+            ],
+            "description": "PHP 7.1 enum implementation",
+            "keywords": [
+                "enum",
+                "map"
+            ],
+            "support": {
+                "issues": "https://github.com/DASPRiD/Enum/issues",
+                "source": "https://github.com/DASPRiD/Enum/tree/1.0.7"
+            },
+            "time": "2025-09-16T12:23:56+00:00"
+        },
         {
             "name": "dflydev/dot-access-data",
             "version": "v3.0.3",
@@ -4530,6 +4635,201 @@
             },
             "time": "2026-01-25T14:56:51+00:00"
         },
+        {
+            "name": "pragmarx/google2fa",
+            "version": "v8.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/google2fa.git",
+                "reference": "6f8d87ebd5afbf7790bde1ffc7579c7c705e0fad"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/6f8d87ebd5afbf7790bde1ffc7579c7c705e0fad",
+                "reference": "6f8d87ebd5afbf7790bde1ffc7579c7c705e0fad",
+                "shasum": ""
+            },
+            "require": {
+                "paragonie/constant_time_encoding": "^1.0|^2.0|^3.0",
+                "php": "^7.1|^8.0"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^1.9",
+                "phpunit/phpunit": "^7.5.15|^8.5|^9.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Google2FA\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "role": "Creator & Designer"
+                }
+            ],
+            "description": "A One Time Password Authentication package, compatible with Google Authenticator.",
+            "keywords": [
+                "2fa",
+                "Authentication",
+                "Two Factor Authentication",
+                "google2fa"
+            ],
+            "support": {
+                "issues": "https://github.com/antonioribeiro/google2fa/issues",
+                "source": "https://github.com/antonioribeiro/google2fa/tree/v8.0.3"
+            },
+            "time": "2024-09-05T11:56:40+00:00"
+        },
+        {
+            "name": "pragmarx/google2fa-laravel",
+            "version": "v3.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/google2fa-laravel.git",
+                "reference": "d885bb5bca8be03b226d040aa80250402760a67c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/google2fa-laravel/zipball/d885bb5bca8be03b226d040aa80250402760a67c",
+                "reference": "d885bb5bca8be03b226d040aa80250402760a67c",
+                "shasum": ""
+            },
+            "require": {
+                "laravel/framework": "^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0|^13.0",
+                "php": ">=7.0",
+                "pragmarx/google2fa-qrcode": "^1.0|^2.0|^3.0"
+            },
+            "require-dev": {
+                "bacon/bacon-qr-code": "^2.0",
+                "orchestra/testbench": "3.4.*|3.5.*|3.6.*|3.7.*|4.*|5.*|6.*|7.*|8.*|9.*|10.*|11.*",
+                "phpunit/phpunit": "~5|~6|~7|~8|~9|~10|~11|~12"
+            },
+            "suggest": {
+                "bacon/bacon-qr-code": "Required to generate inline QR Codes.",
+                "pragmarx/recovery": "Generate recovery codes."
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "aliases": {
+                        "Google2FA": "PragmaRX\\Google2FALaravel\\Facade"
+                    },
+                    "providers": [
+                        "PragmaRX\\Google2FALaravel\\ServiceProvider"
+                    ]
+                },
+                "component": "package",
+                "frameworks": [
+                    "Laravel"
+                ],
+                "branch-alias": {
+                    "dev-master": "0.2-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Google2FALaravel\\": "src/",
+                    "PragmaRX\\Google2FALaravel\\Tests\\": "tests/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "role": "Creator & Designer"
+                }
+            ],
+            "description": "A One Time Password Authentication package, compatible with Google Authenticator.",
+            "keywords": [
+                "Authentication",
+                "Two Factor Authentication",
+                "google2fa",
+                "laravel"
+            ],
+            "support": {
+                "issues": "https://github.com/antonioribeiro/google2fa-laravel/issues",
+                "source": "https://github.com/antonioribeiro/google2fa-laravel/tree/v3.0.1"
+            },
+            "time": "2026-03-17T20:54:53+00:00"
+        },
+        {
+            "name": "pragmarx/google2fa-qrcode",
+            "version": "v3.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/google2fa-qrcode.git",
+                "reference": "c23ebcc3a50de0d1566016a6dd1486e183bb78e1"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/google2fa-qrcode/zipball/c23ebcc3a50de0d1566016a6dd1486e183bb78e1",
+                "reference": "c23ebcc3a50de0d1566016a6dd1486e183bb78e1",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.1",
+                "pragmarx/google2fa": "^4.0|^5.0|^6.0|^7.0|^8.0"
+            },
+            "require-dev": {
+                "bacon/bacon-qr-code": "^2.0",
+                "chillerlan/php-qrcode": "^1.0|^2.0|^3.0|^4.0",
+                "khanamiryan/qrcode-detector-decoder": "^1.0",
+                "phpunit/phpunit": "~4|~5|~6|~7|~8|~9"
+            },
+            "suggest": {
+                "bacon/bacon-qr-code": "For QR Code generation, requires imagick",
+                "chillerlan/php-qrcode": "For QR Code generation"
+            },
+            "type": "library",
+            "extra": {
+                "component": "package",
+                "branch-alias": {
+                    "dev-master": "1.0-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Google2FAQRCode\\": "src/",
+                    "PragmaRX\\Google2FAQRCode\\Tests\\": "tests/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "role": "Creator & Designer"
+                }
+            ],
+            "description": "QR Code package for Google2FA",
+            "keywords": [
+                "2fa",
+                "Authentication",
+                "Two Factor Authentication",
+                "google2fa",
+                "qr code",
+                "qrcode"
+            ],
+            "support": {
+                "issues": "https://github.com/antonioribeiro/google2fa-qrcode/issues",
+                "source": "https://github.com/antonioribeiro/google2fa-qrcode/tree/v3.0.1"
+            },
+            "time": "2025-09-19T23:02:26+00:00"
+        },
         {
             "name": "predis/predis",
             "version": "v3.3.0",
diff --git a/config/google2fa.php b/config/google2fa.php
new file mode 100644
index 000000000..68a70a326
--- /dev/null
+++ b/config/google2fa.php
@@ -0,0 +1,70 @@
+<?php
+
+return [
+
+    /*
+     * Enable / disable Google2FA.
+     */
+    'enabled' => true,
+
+    /*
+     * Lifetime in minutes.
+     *
+     * In case you need your users to be asked for a one time password every time they log in
+     * (with "remember me" disabled), you can set this to 0 (zero).
+     */
+    'lifetime' => 0, // Should be 0 since we handle verification persistence ourselves
+
+    /*
+     * Keep alive.
+     *
+     * If this is true, every time a user access a page, the session lifetime is updated.
+     */
+    'keep_alive' => true,
+
+    /*
+     * Auth Guard.
+     */
+    'auth_guard' => 'web',
+
+    /*
+     * Session key.
+     */
+    'session_var' => 'google2fa',
+
+    /*
+     * One Time Password Field Name.
+     */
+    'otp_input' => 'one_time_password',
+
+    /*
+     * One Time Password Window.
+     */
+    'window' => 1,
+
+    /*
+     * Forbid old passwords.
+     */
+    'forbid_old_passwords' => true,
+
+    /*
+     * User's table column for google2fa secret.
+     */
+    'otp_secret_column' => 'google2fa_secret',
+
+    /*
+     * Guard route name.
+     */
+    'guard_route' => 'login.2fa.totp',
+
+    /*
+     * QR Code Image Backend.
+     */
+    'qr_image_backend' => \PragmaRX\Google2FALaravel\Support\Constants::QRCODE_IMAGE_BACKEND_SVG,
+
+    /*
+     * Secret Length.
+     */
+    'secret_length' => 32,
+
+];

From 42ed6234db6859db4039ead7fd544abda3cd8d12 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:07:13 +0300
Subject: [PATCH 06/53] feat: add two-factor middleware with impersonation
 bypass and register in Kernel

---
 app/Http/Kernel.php                           |  2 +
 .../Middleware/EnsureTwoFactorVerified.php    | 51 ++++++++++++++++
 app/Http/Middleware/RequireTwoFactor.php      | 59 +++++++++++++++++++
 3 files changed, 112 insertions(+)
 create mode 100644 app/Http/Middleware/EnsureTwoFactorVerified.php
 create mode 100644 app/Http/Middleware/RequireTwoFactor.php

diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 131548a35..11fa752b4 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -76,6 +76,8 @@ class Kernel extends HttpKernel
         'permission' => \Spatie\Permission\Middleware\PermissionMiddleware::class,
         'role_or_permission' => \Spatie\Permission\Middleware\RoleOrPermissionMiddleware::class,
         'canAccessDocsPage' => \App\Http\Middleware\CanAccessDocsPage::class,
+        'two_factor.required' => \App\Http\Middleware\RequireTwoFactor::class,
+        'two_factor.verified' => \App\Http\Middleware\EnsureTwoFactorVerified::class,
     ];
 
 }
diff --git a/app/Http/Middleware/EnsureTwoFactorVerified.php b/app/Http/Middleware/EnsureTwoFactorVerified.php
new file mode 100644
index 000000000..f566c64bc
--- /dev/null
+++ b/app/Http/Middleware/EnsureTwoFactorVerified.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\TwoFactor\TwoFactorService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureTwoFactorVerified
+{
+    protected $twoFactorService;
+
+    public function __construct(TwoFactorService $twoFactorService)
+    {
+        $this->twoFactorService = $twoFactorService;
+    }
+
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($request->session()->has('previousUser')) {
+            return $next($request);
+        }
+
+        $user = $request->user();
+
+        if (!$user) {
+            return $next($request);
+        }
+
+        // For settings protection, we only care if they have 2FA enabled AND verified.
+        // If they don't have it enabled, they can't be "verified" in the traditional sense,
+        // but we should probably let them access the settings to enable it.
+        //
+        // This middleware acts as a higher-level guard. If a user has 2FA active,
+        // we shouldn't let them touch sensitive settings
+        // (like viewing recovery codes or disabling 2FA) unless they've recently
+        // provided a valid code. This prevents session hijacking from compromising 2FA.
+
+        if ($this->twoFactorService->enabledMethods($user)->isNotEmpty() && !$this->twoFactorService->isVerified($request, $user)) {
+            return redirect()->route('login.2fa.challenge');
+        }
+
+        return $next($request);
+    }
+}
diff --git a/app/Http/Middleware/RequireTwoFactor.php b/app/Http/Middleware/RequireTwoFactor.php
new file mode 100644
index 000000000..62e12cb6b
--- /dev/null
+++ b/app/Http/Middleware/RequireTwoFactor.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\TwoFactor\TwoFactorService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class RequireTwoFactor
+{
+    protected $twoFactorService;
+
+    public function __construct(TwoFactorService $twoFactorService)
+    {
+        $this->twoFactorService = $twoFactorService;
+    }
+
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($request->session()->has('previousUser')) {
+            return $next($request);
+        }
+
+        $user = $request->user();
+
+        // if NOT authenticated > skip (outer auth middleware handles it)
+        if (!$user) {
+            return $next($request);
+        }
+
+        // if user has no enabled 2FA methods > pass through
+        if ($this->twoFactorService->enabledMethods($user)->isEmpty()) {
+            return $next($request);
+        }
+
+        // if verified > pass through
+        if ($this->twoFactorService->isVerified($request, $user)) {
+            return $next($request);
+        }
+
+        // Avoid infinite loop if we are already on a 2FA route
+        if ($request->is('login/2fa*') || $request->routeIs('login.2fa.*')) {
+            return $next($request);
+        }
+
+        // store intended URL in session
+        if ($request->isMethod('GET') && !$request->ajax()) {
+            $request->session()->put('url.intended', $request->fullUrl());
+        }
+
+        return redirect()->route('login.2fa.challenge');
+    }
+}

From 6f2458ecf5514ed02a8d1b6e2e75ee290c9f0e87 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:17:04 +0300
Subject: [PATCH 07/53] feat: integrate two-factor challenge into login and
 logout flow

---
 app/Http/Controllers/Auth/LoginController.php | 52 +++++++++++++++++++
 routes/web.php                                | 28 ++++++++--
 2 files changed, 77 insertions(+), 3 deletions(-)

diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 9662e5d70..51e388b6e 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -105,4 +105,56 @@ public function login(Request $request, GeneralSettings $general_settings)
 
         return $this->sendFailedLoginResponse($request);
     }
+
+    /**
+     * The user has been authenticated.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  mixed  $user
+     * @return mixed
+     */
+    protected function authenticated(Request $request, $user)
+    {
+        $twoFactorService = app(\App\Services\TwoFactor\TwoFactorService::class);
+        $methods = $twoFactorService->enabledMethods($user);
+
+        if ($methods->isNotEmpty()) {
+            // Redirect to 2FA challenge if the user has enabled methods but is not yet verified
+            // (this is typically the case immediately after a successful password login).
+            if (!$twoFactorService->isVerified($request, $user)) {
+                return redirect()->route('login.2fa.challenge');
+            }
+        }
+
+        return redirect()->intended($this->redirectPath());
+    }
+
+    /**
+     * Log the user out of the application.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     */
+    public function logout(Request $request)
+    {
+        $user = Auth::user();
+        if ($user) {
+            $twoFactorService = app(\App\Services\TwoFactor\TwoFactorService::class);
+            $twoFactorService->clearVerified($request, $user);
+        }
+
+        $this->guard()->logout();
+
+        $request->session()->invalidate();
+
+        $request->session()->regenerateToken();
+
+        if ($response = $this->loggedOut($request)) {
+            return $response;
+        }
+
+        return $request->wantsJson()
+            ? new \Illuminate\Http\JsonResponse([], 204)
+            : redirect('/');
+    }
 }
diff --git a/routes/web.php b/routes/web.php
index f3a8ae3b8..e264d7079 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,9 +1,11 @@
 <?php
 
 use App\Http\Controllers\Admin\ActivityLogController;
+use App\Http\Controllers\Auth\TwoFactor\Totp\TotpController;
+use App\Http\Controllers\Auth\TwoFactor\Totp\TotpSettingsController;
+use App\Http\Controllers\Auth\TwoFactor\TwoFactorController;
 use App\Http\Controllers\Admin\ApplicationApiController;
 use App\Http\Controllers\Admin\InvoiceController;
-use App\Http\Controllers\Admin\LegalController;
 use App\Http\Controllers\Admin\OverViewController;
 use App\Http\Controllers\Admin\PartnerController;
 use App\Http\Controllers\Admin\PaymentController;
@@ -28,7 +30,6 @@
 use App\Http\Controllers\StoreController;
 use App\Http\Controllers\TermsController;
 use App\Http\Controllers\TicketsController;
-use App\Http\Controllers\TranslationController;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Log;
@@ -53,7 +54,7 @@
 
 Route::get('/terms/{type}', [TermsController::class, 'index'])->name('terms');
 
-Route::middleware(['auth', 'checkSuspended'])->group(function () {
+Route::middleware(['auth', 'checkSuspended', 'two_factor.required'])->group(function () {
     //resend verification email
     Route::get('/email/verification-notification', function (Request $request) {
         $request->user()->sendEmailVerificationNotification();
@@ -61,6 +62,27 @@
         return back()->with('success', 'Verification link sent!');
     })->middleware(['auth', 'throttle:3,1'])->name('verification.send');
 
+    //2fa challenge
+    Route::middleware(['auth', 'two_factor.required'])
+        ->prefix('login/2fa')
+        ->name('login.2fa.')
+        ->group(function () {
+            Route::get('/', [TwoFactorController::class, 'showChallenge'])->name('challenge');
+            Route::get('/totp', [TotpController::class, 'showChallenge'])->name('totp');
+            Route::post('/totp', [TotpController::class, 'verify'])->name('totp.verify')->middleware('throttle:2fa.verify');
+        });
+
+    //2fa settings
+    Route::middleware(['auth', 'two_factor.verified'])
+        ->prefix('profile/security/2fa')
+        ->name('profile.2fa.')
+        ->group(function () {
+            Route::post('/totp/setup', [TotpSettingsController::class, 'setup'])->name('totp.setup')->middleware('throttle:2fa.setup');
+            Route::post('/totp/enable', [TotpSettingsController::class, 'enable'])->name('totp.enable')->middleware('throttle:2fa.enable');
+            Route::post('/totp/disable', [TotpSettingsController::class, 'disable'])->name('totp.disable')->middleware('throttle:2fa.verify');
+            Route::post('/totp/recovery-codes', [TotpSettingsController::class, 'showRecoveryCodes'])->name('totp.recovery-codes')->middleware('throttle:2fa.recovery-codes');
+        });
+
     //normal routes
     Route::get('notifications/readAll', [NotificationController::class, 'readAll'])->name('notifications.readAll');
     Route::resource('notifications', NotificationController::class);

From 0b122b54d99f0a3f1317b6cc57519a61b6fde285 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:17:14 +0300
Subject: [PATCH 08/53] feat: add TOTP challenge controller and view

---
 .../Auth/TwoFactor/Totp/TotpController.php    |  77 ++++++++++++
 .../Auth/TwoFactor/TwoFactorController.php    |  44 +++++++
 .../auth/two-factor/totp-challenge.blade.php  |  88 ++++++++++++++
 themes/default/views/layouts/app.blade.php    |  48 ++++----
 themes/default/views/layouts/main.blade.php   | 112 +++++++++---------
 5 files changed, 291 insertions(+), 78 deletions(-)
 create mode 100644 app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php
 create mode 100644 app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php
 create mode 100644 themes/default/views/auth/two-factor/totp-challenge.blade.php

diff --git a/app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php b/app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php
new file mode 100644
index 000000000..da2e1648e
--- /dev/null
+++ b/app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Http\Controllers\Auth\TwoFactor\Totp;
+
+use App\Http\Controllers\Auth\TwoFactor\TwoFactorController;
+use App\Services\TwoFactor\RecoveryCodeService;
+use App\Services\TwoFactor\TotpService;
+use App\Services\TwoFactor\TwoFactorService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\ValidationException;
+
+class TotpController extends TwoFactorController
+{
+    protected $totpService;
+    protected $recoveryCodeService;
+
+    public function __construct(
+        TwoFactorService $twoFactorService,
+        TotpService $totpService,
+        RecoveryCodeService $recoveryCodeService
+    ) {
+        parent::__construct($twoFactorService);
+        $this->totpService = $totpService;
+        $this->recoveryCodeService = $recoveryCodeService;
+    }
+
+    /**
+     * Show the TOTP challenge view.
+     */
+    public function showChallenge(Request $request)
+    {
+        $user = $request->user();
+
+        // Ensure user has TOTP enabled
+        if (!$user->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->exists()) {
+            return redirect()->route('login.2fa.challenge');
+        }
+
+        return view('auth.two-factor.totp-challenge');
+    }
+
+    /**
+     * Verify the TOTP or recovery code.
+     */
+    public function verify(Request $request)
+    {
+        $request->validate([
+            'code' => 'required|string',
+        ]);
+
+        $user = $request->user();
+        $code = preg_replace('/\s+/', '', $request->input('code'));
+
+        $isVerified = false;
+
+        if (strlen($code) === 6 && ctype_digit($code)) {
+            // TOTP path
+            $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+            if ($method && $method->totp_secret) {
+                $isVerified = $this->totpService->verifyCode($method->totp_secret, $code);
+            }
+        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
+            // Recovery code path
+            $isVerified = $this->recoveryCodeService->verify($user, $code);
+        }
+
+        if ($isVerified) {
+            $this->twoFactorService->markVerified($request, $user);
+            return redirect()->intended(route('home'));
+        }
+
+        throw ValidationException::withMessages([
+            'code' => [__('The provided two-factor authentication code was invalid.')],
+        ]);
+    }
+}
diff --git a/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php b/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php
new file mode 100644
index 000000000..630e5c952
--- /dev/null
+++ b/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Controllers\Auth\TwoFactor;
+
+use App\Http\Controllers\Controller;
+use App\Services\TwoFactor\TwoFactorService;
+use Illuminate\Http\Request;
+
+class TwoFactorController extends Controller
+{
+    protected $twoFactorService;
+
+    public function __construct(TwoFactorService $twoFactorService)
+    {
+        $this->twoFactorService = $twoFactorService;
+    }
+
+    /**
+     * Show the 2FA challenge method picker or redirect to the only enabled method.
+     */
+    public function showChallenge(Request $request)
+    {
+        $user = $request->user();
+        $methods = $this->twoFactorService->enabledMethods($user);
+
+        if ($methods->isEmpty()) {
+            return redirect()->intended(route('home'));
+        }
+
+        if ($methods->count() === 1) {
+            $method = $methods->first()->method;
+            return redirect()->route("login.2fa.{$method}");
+        }
+
+        // If we ever add more methods (like WebAuthn), we'll need a picker view here.
+        // For now, we just fallback to the first available method (usually TOTP).
+        $totp = $methods->firstWhere('method', 'totp');
+        if ($totp) {
+            return redirect()->route('login.2fa.totp');
+        }
+
+        return redirect()->intended(route('home'));
+    }
+}
diff --git a/themes/default/views/auth/two-factor/totp-challenge.blade.php b/themes/default/views/auth/two-factor/totp-challenge.blade.php
new file mode 100644
index 000000000..764aef3e0
--- /dev/null
+++ b/themes/default/views/auth/two-factor/totp-challenge.blade.php
@@ -0,0 +1,88 @@
+@extends('layouts.app')
+
+@section('content')
+  @php($website_settings = app(App\Settings\WebsiteSettings::class))
+  @php($suppressSweetAlert2 = true)
+
+  <body class="hold-transition dark-mode login-page">
+  <div class="login-box">
+    <div class="card card-outline card-primary">
+      <div class="text-center card-header">
+        <a href="{{ route('welcome') }}" class="mb-2 h1"><b
+            class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
+        @if ($website_settings->enable_login_logo)
+          <img
+            src="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}"
+            alt="{{ config('app.name', 'CtrlPanel.gg') }} Logo"
+            style="opacity: .8; max-width:100%; height: 150px; margin-top: 10px;">
+        @endif
+      </div>
+      <div class="pt-0 card-body">
+        <p class="login-box-msg">{{ __('Two-Factor Authentication') }}</p>
+
+        <p class="text-center small text-muted">
+            {{ __('Please enter your 6-digit TOTP code from your authenticator app or an 8-character recovery code.') }}
+        </p>
+
+        <form action="{{ route('login.2fa.totp.verify') }}" method="post">
+          @csrf
+
+          <div class="form-group">
+            <div class="mb-3 input-group">
+              <input type="text" name="code" id="code"
+                     class="form-control @error('code') is-invalid @enderror"
+                     placeholder="{{ __('Authentication Code') }}"
+                     autofocus
+                     autocomplete="one-time-code"
+                     inputmode="numeric">
+              <div class="input-group-append">
+                <div class="input-group-text">
+                  <span class="fas fa-lock"></span>
+                </div>
+              </div>
+            </div>
+            @error('code')
+              <span class="text-danger" role="alert">
+                <small><strong>{{ $message }}</strong></small>
+              </span>
+            @enderror
+          </div>
+
+          <div class="row">
+            <div class="col-12">
+              <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
+            </div>
+          </div>
+
+          <input type="hidden" name="_token" value="{{ csrf_token() }}">
+        </form>
+
+        <p class="mt-3 mb-1 text-center">
+            <a href="{{ route('logout') }}" onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
+                {{ __('Log out') }}
+            </a>
+        </p>
+
+        <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
+            @csrf
+        </form>
+      </div>
+    </div>
+  </div>
+
+  <div class="fixed-bottom ">
+    <div class="container text-center">
+      @if ($website_settings->show_imprint)
+        <a target="_blank" href="{{ route('terms', 'imprint') }}"><strong>{{ __('Imprint') }}</strong></a> |
+      @endif
+      @if ($website_settings->show_privacy)
+        <a target="_blank" href="{{ route('terms', 'privacy') }}"><strong>{{ __('Privacy') }}</strong></a>
+      @endif
+      @if ($website_settings->show_tos)
+        | <a target="_blank"
+             href="{{ route('terms', 'tos') }}"><strong>{{ __('Terms of Service') }}</strong></a>
+      @endif
+    </div>
+  </div>
+  </body>
+@endsection
diff --git a/themes/default/views/layouts/app.blade.php b/themes/default/views/layouts/app.blade.php
index 1eef69a22..4f36e703d 100644
--- a/themes/default/views/layouts/app.blade.php
+++ b/themes/default/views/layouts/app.blade.php
@@ -48,30 +48,32 @@
 <script src="https://cdn.jsdelivr.net/npm/sweetalert2@10.14.1/dist/sweetalert2.all.min.js"></script>
 
 <script>
-    @if (Session::has('error'))
-        Swal.fire({
-            icon: 'error',
-            title: 'Oops...',
-            html: '{{ Session::get('error') }}',
-        })
-    @endif
+    @if (!isset($suppressSweetAlert2))
+        @if (Session::has('error'))
+            Swal.fire({
+                icon: 'error',
+                title: 'Oops...',
+                html: '{{ Session::get('error') }}',
+            })
+        @endif
 
-    @if (Session::has('success'))
-        Swal.fire({
-            icon: 'success',
-            title: '{{ Session::get('success') }}',
-            position: 'top-end',
-            showConfirmButton: false,
-            background: '#343a40',
-            toast: true,
-            timer: 3000,
-            timerProgressBar: true,
-            didOpen: (toast) => {
-                toast.addEventListener('mouseenter', Swal.stopTimer)
-                toast.addEventListener('mouseleave', Swal.resumeTimer)
-                toast.addEventListener('click', () => Swal.close())
-            }
-        })
+        @if (Session::has('success'))
+            Swal.fire({
+                icon: 'success',
+                title: '{{ Session::get('success') }}',
+                position: 'top-end',
+                showConfirmButton: false,
+                background: '#343a40',
+                toast: true,
+                timer: 3000,
+                timerProgressBar: true,
+                didOpen: (toast) => {
+                    toast.addEventListener('mouseenter', Swal.stopTimer)
+                    toast.addEventListener('mouseleave', Swal.resumeTimer)
+                    toast.addEventListener('click', () => Swal.close())
+                }
+            })
+        @endif
     @endif
 </script>
 
diff --git a/themes/default/views/layouts/main.blade.php b/themes/default/views/layouts/main.blade.php
index 9826236bc..d7ce4fd14 100644
--- a/themes/default/views/layouts/main.blade.php
+++ b/themes/default/views/layouts/main.blade.php
@@ -537,61 +537,63 @@ class="nav-link @if (Request::routeIs('admin.activitylogs.*')) active @endif">
     })
 </script>
 <script>
-    @if (Session::has('error'))
-    Swal.fire({
-        icon: 'error',
-        title: 'Oops...',
-        html: '{{ Session::get('error') }}',
-    })
-    @endif
-    @if (Session::has('success'))
-    Swal.fire({
-        icon: 'success',
-        title: '{{ Session::get('success') }}',
-        position: 'top-end',
-        showConfirmButton: false,
-        background: '#343a40',
-        toast: true,
-        timer: 3000,
-        timerProgressBar: true,
-        didOpen: (toast) => {
-            toast.addEventListener('mouseenter', Swal.stopTimer)
-            toast.addEventListener('mouseleave', Swal.resumeTimer)
-            toast.addEventListener('click', () => Swal.close())
-        }
-    })
-    @endif
-    @if (Session::has('info'))
-    Swal.fire({
-        icon: 'info',
-        title: '{{ Session::get('info') }}',
-        position: 'top-end',
-        showConfirmButton: false,
-        background: '#343a40',
-        toast: true,
-        timer: 3000,
-        timerProgressBar: true,
-        didOpen: (toast) => {
-            toast.addEventListener('mouseenter', Swal.stopTimer)
-            toast.addEventListener('mouseleave', Swal.resumeTimer)
-        }
-    })
-    @endif
-    @if (Session::has('warning'))
-    Swal.fire({
-        icon: 'warning',
-        title: '{{ Session::get('warning') }}',
-        position: 'top-end',
-        showConfirmButton: false,
-        background: '#343a40',
-        toast: true,
-        timer: 3000,
-        timerProgressBar: true,
-        didOpen: (toast) => {
-            toast.addEventListener('mouseenter', Swal.stopTimer)
-            toast.addEventListener('mouseleave', Swal.resumeTimer)
-        }
-    })
+    @if (!isset($suppressSweetAlert2))
+        @if (Session::has('error'))
+        Swal.fire({
+            icon: 'error',
+            title: 'Oops...',
+            html: '{{ Session::get('error') }}',
+        })
+        @endif
+        @if (Session::has('success'))
+        Swal.fire({
+            icon: 'success',
+            title: '{{ Session::get('success') }}',
+            position: 'top-end',
+            showConfirmButton: false,
+            background: '#343a40',
+            toast: true,
+            timer: 3000,
+            timerProgressBar: true,
+            didOpen: (toast) => {
+                toast.addEventListener('mouseenter', Swal.stopTimer)
+                toast.addEventListener('mouseleave', Swal.resumeTimer)
+                toast.addEventListener('click', () => Swal.close())
+            }
+        })
+        @endif
+        @if (Session::has('info'))
+        Swal.fire({
+            icon: 'info',
+            title: '{{ Session::get('info') }}',
+            position: 'top-end',
+            showConfirmButton: false,
+            background: '#343a40',
+            toast: true,
+            timer: 3000,
+            timerProgressBar: true,
+            didOpen: (toast) => {
+                toast.addEventListener('mouseenter', Swal.stopTimer)
+                toast.addEventListener('mouseleave', Swal.resumeTimer)
+            }
+        })
+        @endif
+        @if (Session::has('warning'))
+        Swal.fire({
+            icon: 'warning',
+            title: '{{ Session::get('warning') }}',
+            position: 'top-end',
+            showConfirmButton: false,
+            background: '#343a40',
+            toast: true,
+            timer: 3000,
+            timerProgressBar: true,
+            didOpen: (toast) => {
+                toast.addEventListener('mouseenter', Swal.stopTimer)
+                toast.addEventListener('mouseleave', Swal.resumeTimer)
+            }
+        })
+        @endif
     @endif
 </script>
 </body>

From 9d4a890509c0729a5b92d0b1d9cf02ee67a26004 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:17:25 +0300
Subject: [PATCH 09/53] feat: add TOTP activation flow with QR setup and
 recovery code management

---
 .../TwoFactor/Totp/TotpSettingsController.php | 186 +++++++++++++++
 .../views/modals/totp-disable-modal.blade.php | 103 +++++++++
 .../views/modals/totp-setup-modal.blade.php   | 212 ++++++++++++++++++
 .../modals/totp-view-recovery-modal.blade.php | 149 ++++++++++++
 4 files changed, 650 insertions(+)
 create mode 100644 app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php
 create mode 100644 themes/default/views/modals/totp-disable-modal.blade.php
 create mode 100644 themes/default/views/modals/totp-setup-modal.blade.php
 create mode 100644 themes/default/views/modals/totp-view-recovery-modal.blade.php

diff --git a/app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php b/app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php
new file mode 100644
index 000000000..5d3bc3478
--- /dev/null
+++ b/app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php
@@ -0,0 +1,186 @@
+<?php
+
+namespace App\Http\Controllers\Auth\TwoFactor\Totp;
+
+use App\Http\Controllers\Controller;
+use App\Models\UserTwoFactorMethod;
+use App\Services\TwoFactor\RecoveryCodeService;
+use App\Services\TwoFactor\TotpService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\ValidationException;
+
+class TotpSettingsController extends Controller
+{
+    protected $totpService;
+    protected $recoveryCodeService;
+
+    public function __construct(
+        TotpService $totpService,
+        RecoveryCodeService $recoveryCodeService
+    ) {
+        $this->totpService = $totpService;
+        $this->recoveryCodeService = $recoveryCodeService;
+    }
+
+    /**
+     * Start the TOTP setup process.
+     */
+    public function setup(Request $request)
+    {
+        $user = $request->user();
+
+        // Discard any previous pending secret
+        $request->session()->forget('totp_pending_secret');
+
+        $secret = $this->totpService->generateSecret();
+        $request->session()->put('totp_pending_secret', $secret);
+
+        $qrSvg = $this->totpService->getQrCodeSvg($user->email, $secret);
+
+        // Format secret in groups of 4 for readability
+        $formattedSecret = implode(' ', str_split($secret, 4));
+
+        return response()->json([
+            'qr_svg' => $qrSvg,
+            'secret' => $formattedSecret,
+        ]);
+    }
+
+    /**
+     * Enable TOTP for the user.
+     */
+    public function enable(Request $request)
+    {
+        $request->validate([
+            'code' => 'required|string',
+            'password' => 'required|string',
+        ]);
+
+        $user = $request->user();
+        $pendingSecret = $request->session()->get('totp_pending_secret');
+
+        if (!$pendingSecret) {
+            return response()->json(['message' => __('Setup session expired. Please try again.')], 422);
+        }
+
+        if (!Hash::check($request->input('password'), $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => [__('The provided password does not match your current password.')],
+            ]);
+        }
+
+        if (!$this->totpService->verifyCode($pendingSecret, $request->input('code'))) {
+            throw ValidationException::withMessages([
+                'code' => [__('The provided two-factor authentication code was invalid.')],
+            ]);
+        }
+
+        // Persist TOTP method
+        $recoveryCodes = $this->recoveryCodeService->generate();
+
+        UserTwoFactorMethod::updateOrCreate(
+            ['user_id' => $user->id, 'method' => 'totp'],
+            [
+                'is_enabled' => true,
+                'totp_secret' => $pendingSecret,
+                'totp_recovery_codes' => $recoveryCodes,
+            ]
+        );
+
+        $request->session()->forget('totp_pending_secret');
+
+        // Mark as verified for current session
+        app(\App\Services\TwoFactor\TwoFactorService::class)->markVerified($request, $user);
+
+        return response()->json([
+            'recovery_codes' => $recoveryCodes,
+        ]);
+    }
+
+    /**
+     * Disable TOTP for the user.
+     */
+    public function disable(Request $request)
+    {
+        $request->validate([
+            'code' => 'required|string',
+            'password' => 'required|string',
+        ]);
+
+        $user = $request->user();
+
+        if (!Hash::check($request->input('password'), $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => [__('The provided password does not match your current password.')],
+            ]);
+        }
+
+        $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+        if (!$method) {
+            return response()->json(['message' => __('Two-factor authentication is not enabled.')], 422);
+        }
+
+        $code = preg_replace('/\s+/', '', $request->input('code'));
+        $isVerified = false;
+
+        if (strlen($code) === 6 && ctype_digit($code)) {
+            $isVerified = $this->totpService->verifyCode($method->totp_secret, $code);
+        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
+            $isVerified = $this->recoveryCodeService->verify($user, $code);
+        }
+
+        if (!$isVerified) {
+            throw ValidationException::withMessages([
+                'code' => [__('The provided two-factor authentication code was invalid.')],
+            ]);
+        }
+
+        $method->delete();
+
+        return response()->json(['message' => __('Two-factor authentication has been disabled.')]);
+    }
+
+    /**
+     * Show recovery codes.
+     */
+    public function showRecoveryCodes(Request $request)
+    {
+        $request->validate([
+            'code' => 'required|string',
+            'password' => 'required|string',
+        ]);
+
+        $user = $request->user();
+
+        if (!Hash::check($request->input('password'), $user->password)) {
+            throw ValidationException::withMessages([
+                'password' => [__('The provided password does not match your current password.')],
+            ]);
+        }
+
+        $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+        if (!$method) {
+            return response()->json(['message' => __('Two-factor authentication is not enabled.')], 422);
+        }
+
+        $code = preg_replace('/\s+/', '', $request->input('code'));
+        $isVerified = false;
+
+        if (strlen($code) === 6 && ctype_digit($code)) {
+            $isVerified = $this->totpService->verifyCode($method->totp_secret, $code);
+        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
+            $isVerified = $this->recoveryCodeService->verify($user, $code);
+        }
+
+        if (!$isVerified) {
+            throw ValidationException::withMessages([
+                'code' => [__('The provided two-factor authentication code was invalid.')],
+            ]);
+        }
+
+        return response()->json([
+            'recovery_codes' => $method->totp_recovery_codes,
+        ]);
+    }
+}
diff --git a/themes/default/views/modals/totp-disable-modal.blade.php b/themes/default/views/modals/totp-disable-modal.blade.php
new file mode 100644
index 000000000..db2b4c98f
--- /dev/null
+++ b/themes/default/views/modals/totp-disable-modal.blade.php
@@ -0,0 +1,103 @@
+<div class="modal fade" id="totpDisableModal" data-backdrop="static" data-keyboard="false" tabindex="-1" aria-hidden="true" x-data="totpDisable()">
+    <div class="modal-dialog">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h4 class="modal-title">{{ __('Disable Two-Factor Authentication') }}</h4>
+                <button type="button" class="close" @click="closeModal()" aria-label="Close">
+                    <span aria-hidden="true">&times;</span>
+                </button>
+            </div>
+
+            <div class="modal-body">
+                <p class="text-muted">{{ __('To disable two-factor authentication, please enter your current password and a 2FA code.') }}</p>
+                
+                <div class="form-group">
+                    <label>{{ __('Current Password') }}</label>
+                    <input type="password" x-model="password" class="form-control" :class="{'is-invalid': errors.password}" placeholder="••••••">
+                    <template x-if="errors.password">
+                        <span class="text-danger small" x-text="errors.password"></span>
+                    </template>
+                </div>
+
+                <div class="form-group">
+                    <label>{{ __('Authentication Code') }}</label>
+                    <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000" inputmode="numeric">
+                    <template x-if="errors.code">
+                        <span class="text-danger small" x-text="errors.code"></span>
+                    </template>
+                </div>
+            </div>
+
+            <div class="modal-footer">
+                <div class="w-100 d-flex justify-content-end">
+                    <button type="button" class="btn btn-danger" @click="disable()" :disabled="loading">
+                        <span x-show="!loading">{{ __('Disable 2FA') }}</span>
+                        <span x-show="loading"><i class="fas fa-spinner fa-spin"></i></span>
+                    </button>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+function totpDisable() {
+    return {
+        loading: false,
+        password: '',
+        code: '',
+        errors: {},
+
+        init() {
+            $('#totpDisableModal').on('show.bs.modal', () => {
+                this.reset();
+            });
+        },
+
+        reset() {
+            this.loading = false;
+            this.password = '';
+            this.code = '';
+            this.errors = {};
+        },
+
+        disable() {
+            this.loading = true;
+            this.errors = {};
+
+            $.post("{{ route('profile.2fa.totp.disable') }}", {
+                _token: "{{ csrf_token() }}",
+                password: this.password,
+                code: this.code
+            }).done(response => {
+                this.closeModal();
+                Swal.fire({
+                    icon: 'success',
+                    title: '{{ __('Success') }}',
+                    text: response.message,
+                    timer: 2000,
+                    showConfirmButton: false
+                }).then(() => {
+                    location.reload();
+                });
+            }).fail(xhr => {
+                if (xhr.status === 422) {
+                    this.errors = xhr.responseJSON.errors;
+                } else {
+                    Swal.fire({
+                        icon: 'error',
+                        title: 'Error',
+                        text: xhr.responseJSON?.message || 'Something went wrong'
+                    });
+                }
+            }).always(() => {
+                this.loading = false;
+            });
+        },
+
+        closeModal() {
+            $('#totpDisableModal').modal('hide');
+        }
+    }
+}
+</script>
diff --git a/themes/default/views/modals/totp-setup-modal.blade.php b/themes/default/views/modals/totp-setup-modal.blade.php
new file mode 100644
index 000000000..a3c622751
--- /dev/null
+++ b/themes/default/views/modals/totp-setup-modal.blade.php
@@ -0,0 +1,212 @@
+<div class="modal fade" id="totpSetupModal" data-backdrop="static" data-keyboard="false" tabindex="-1" aria-hidden="true" x-data="totpSetup()">
+    <div class="modal-dialog" :class="step === 'setup' ? 'modal-lg' : ''">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h4 class="modal-title" x-text="step === 'setup' ? '{{ __('Setup Two-Factor Authentication') }}' : '{{ __('Recovery Codes') }}'"></h4>
+                <button type="button" class="close" @click="closeModal()" aria-label="Close">
+                    <span aria-hidden="true">&times;</span>
+                </button>
+            </div>
+
+            <div class="modal-body">
+                <!-- Step 1: Scan QR & Verify -->
+                <template x-if="step === 'setup'">
+                    <div>
+                        <div class="row align-items-center">
+                            <div class="mb-4 mb-md-0 text-center col-md-5 d-flex flex-column align-items-center justify-content-center">
+                                <div class="p-2 bg-white d-inline-block rounded shadow-sm">
+                                    <div x-html="qrSvg"></div>
+                                </div>
+                                <div class="mt-3 text-muted small px-2">
+                                    {{ __('Scan this QR code with your authenticator app (e.g. Google Authenticator, Authy, Bitwarden).') }}
+                                </div>
+                            </div>
+                            <div class="col-md-7">
+                                <h5>{{ __('Manual Entry') }}</h5>
+                                <p class="text-muted small">
+                                    {{ __('If you cannot scan the QR code, enter this secret key into your app:') }}
+                                </p>
+                                <div class="form-group">
+                                    <code x-text="secret"></code>
+                                    <button class="btn btn-link text-secondary p-1 ml-2" type="button" @click="copySecret()" title="{{ __('Copy to clipboard') }}">
+                                        <i class="fas fa-copy"></i>
+                                    </button>
+                                </div>
+
+                                <hr>
+
+                                <div class="form-group">
+                                    <label>{{ __('Authentication Code') }}</label>
+                                    <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000" inputmode="numeric">
+                                    <template x-if="errors.code">
+                                        <span class="text-danger small" x-text="errors.code"></span>
+                                    </template>
+                                </div>
+
+                                <div class="form-group">
+                                    <label>{{ __('Current Password') }}</label>
+                                    <input type="password" x-model="password" class="form-control" :class="{'is-invalid': errors.password}" placeholder="••••••">
+                                    <template x-if="errors.password">
+                                        <span class="text-danger small" x-text="errors.password"></span>
+                                    </template>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </template>
+
+                <!-- Step 2: Recovery Codes -->
+                <template x-if="step === 'recovery'">
+                    <div class="text-center">
+                        <div class="mb-3 alert alert-warning small text-left">
+                            <i class="mr-2 fas fa-exclamation-triangle"></i>
+                            {{ __('Recovery codes are used to access your account if you lose your authenticator device. Store them safely!') }}
+                        </div>
+
+                        <div class="row mb-4">
+                            <template x-for="code in recoveryCodes" :key="code">
+                                <div class="col-6 py-2">
+                                    <code x-text="code"></code>
+                                </div>
+                            </template>
+                        </div>
+
+                        <div class="flex-wrap d-flex justify-content-center">
+                            <button class="mb-2 mr-2 btn btn-outline-info" @click="copyAllRecoveryCodes()">
+                                <i class="mr-2 fas fa-copy"></i>{{ __('Copy All') }}
+                            </button>
+                            <button class="mb-2 mr-2 btn btn-outline-success" @click="downloadRecoveryCodes()">
+                                <i class="mr-2 fas fa-download"></i>{{ __('Download .txt') }}
+                            </button>
+                        </div>
+                    </div>
+                </template>
+            </div>
+
+            <div class="modal-footer">
+                <template x-if="step === 'setup'">
+                    <div class="w-100 d-flex justify-content-end">
+                        <button type="button" class="btn btn-primary" @click="enableTotp()" :disabled="loading">
+                            <span x-show="!loading">{{ __('Activate') }}</span>
+                            <span x-show="loading"><i class="fas fa-spinner fa-spin"></i></span>
+                        </button>
+                    </div>
+                </template>
+                <template x-if="step === 'recovery'">
+                    <button type="button" class="btn btn-primary btn-block" @click="done()">{{ __('Done') }}</button>
+                </template>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+function totpSetup() {
+    return {
+        step: 'setup',
+        qrSvg: '',
+        secret: '',
+        code: '',
+        password: '',
+        recoveryCodes: [],
+        loading: false,
+        errors: {},
+
+        init() {
+            $('#totpSetupModal').on('show.bs.modal', () => {
+                this.reset();
+                this.fetchSetupData();
+            });
+        },
+
+        reset() {
+            this.step = 'setup';
+            this.qrSvg = '';
+            this.secret = '';
+            this.code = '';
+            this.password = '';
+            this.recoveryCodes = [];
+            this.loading = false;
+            this.errors = {};
+        },
+
+        fetchSetupData() {
+            $.post("{{ route('profile.2fa.totp.setup') }}", {
+                _token: "{{ csrf_token() }}"
+            }).done(response => {
+                this.qrSvg = response.qr_svg;
+                this.secret = response.secret;
+            }).fail(xhr => {
+                Swal.fire({
+                    icon: 'error',
+                    title: 'Error',
+                    text: xhr.responseJSON?.message || 'Something went wrong'
+                });
+                this.closeModal();
+            });
+        },
+
+        enableTotp() {
+            this.loading = true;
+            this.errors = {};
+
+            $.post("{{ route('profile.2fa.totp.enable') }}", {
+                _token: "{{ csrf_token() }}",
+                code: this.code,
+                password: this.password
+            }).done(response => {
+                this.recoveryCodes = response.recovery_codes;
+                this.step = 'recovery';
+            }).fail(xhr => {
+                if (xhr.status === 422) {
+                    this.errors = xhr.responseJSON.errors;
+                } else {
+                    Swal.fire({
+                        icon: 'error',
+                        title: 'Error',
+                        text: xhr.responseJSON?.message || 'Something went wrong'
+                    });
+                }
+            }).always(() => {
+                this.loading = false;
+            });
+        },
+
+        copySecret() {
+            const rawSecret = this.secret.replace(/\s/g, '');
+            navigator.clipboard.writeText(rawSecret).then(() => {
+                toastr.success("{{ __('Secret copied to clipboard') }}");
+            });
+        },
+
+        copyAllRecoveryCodes() {
+            const text = this.recoveryCodes.join("\n");
+            navigator.clipboard.writeText(text).then(() => {
+                toastr.success("{{ __('Recovery codes copied to clipboard') }}");
+            });
+        },
+
+        downloadRecoveryCodes() {
+            const text = this.recoveryCodes.join("\n");
+            const blob = new Blob([text], { type: 'text/plain' });
+            const url = window.URL.createObjectURL(blob);
+            const a = document.createElement('a');
+            a.href = url;
+            a.download = "{{ config('app.name', 'CtrlPanel.gg') }}-totp-backup-codes.txt";
+            document.body.appendChild(a);
+            a.click();
+            window.URL.revokeObjectURL(url);
+            document.body.removeChild(a);
+        },
+
+        closeModal() {
+            $('#totpSetupModal').modal('hide');
+        },
+
+        done() {
+            this.closeModal();
+            location.reload(); // Refresh to update the UI (toggle, etc.)
+        }
+    }
+}
+</script>
diff --git a/themes/default/views/modals/totp-view-recovery-modal.blade.php b/themes/default/views/modals/totp-view-recovery-modal.blade.php
new file mode 100644
index 000000000..75ba01aa2
--- /dev/null
+++ b/themes/default/views/modals/totp-view-recovery-modal.blade.php
@@ -0,0 +1,149 @@
+<div class="modal fade" id="totpViewRecoveryModal" data-backdrop="static" data-keyboard="false" tabindex="-1" aria-hidden="true" x-data="totpViewRecovery()">
+    <div class="modal-dialog">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h4 class="modal-title">{{ __('Recovery Codes') }}</h4>
+                <button type="button" class="close" @click="closeModal()" aria-label="Close">
+                    <span aria-hidden="true">&times;</span>
+                </button>
+            </div>
+
+            <div class="modal-body">
+                <template x-if="!verified">
+                    <div>
+                        <p class="text-muted">{{ __('To view your recovery codes, please enter your current password and a 2FA code.') }}</p>
+                        
+                        <div class="form-group">
+                            <label>{{ __('Current Password') }}</label>
+                            <input type="password" x-model="password" class="form-control" :class="{'is-invalid': errors.password}" placeholder="••••••">
+                            <template x-if="errors.password">
+                                <span class="text-danger small" x-text="errors.password"></span>
+                            </template>
+                        </div>
+
+                        <div class="form-group">
+                            <label>{{ __('Authentication Code') }}</label>
+                            <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000" inputmode="numeric">
+                            <template x-if="errors.code">
+                                <span class="text-danger small" x-text="errors.code"></span>
+                            </template>
+                        </div>
+                    </div>
+                </template>
+
+                <template x-if="verified">
+                    <div class="text-center">
+                        <div class="row mb-4">
+                            <template x-for="code in recoveryCodes" :key="code">
+                                <div class="col-6 py-2">
+                                    <code x-text="code"></code>
+                                </div>
+                            </template>
+                        </div>
+
+                        <div class="flex-wrap d-flex justify-content-center">
+                            <button class="mb-2 mr-2 btn btn-outline-info" @click="copyAllRecoveryCodes()">
+                                <i class="mr-2 fas fa-copy"></i>{{ __('Copy All') }}
+                            </button>
+                            <button class="mb-2 mr-2 btn btn-outline-success" @click="downloadRecoveryCodes()">
+                                <i class="mr-2 fas fa-download"></i>{{ __('Download .txt') }}
+                            </button>
+                        </div>
+                    </div>
+                </template>
+            </div>
+
+            <div class="modal-footer">
+                <template x-if="!verified">
+                    <div class="w-100 d-flex justify-content-end">
+                        <button type="button" class="btn btn-primary" @click="verify()" :disabled="loading">
+                            <span x-show="!loading">{{ __('View Codes') }}</span>
+                            <span x-show="loading"><i class="fas fa-spinner fa-spin"></i></span>
+                        </button>
+                    </div>
+                </template>
+                <template x-if="verified">
+                    <button type="button" class="btn btn-primary btn-block" @click="closeModal()">{{ __('Close') }}</button>
+                </template>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+function totpViewRecovery() {
+    return {
+        verified: false,
+        loading: false,
+        password: '',
+        code: '',
+        recoveryCodes: [],
+        errors: {},
+
+        init() {
+            $('#totpViewRecoveryModal').on('show.bs.modal', () => {
+                this.reset();
+            });
+        },
+
+        reset() {
+            this.verified = false;
+            this.loading = false;
+            this.password = '';
+            this.code = '';
+            this.recoveryCodes = [];
+            this.errors = {};
+        },
+
+        verify() {
+            this.loading = true;
+            this.errors = {};
+
+            $.post("{{ route('profile.2fa.totp.recovery-codes') }}", {
+                _token: "{{ csrf_token() }}",
+                password: this.password,
+                code: this.code
+            }).done(response => {
+                this.recoveryCodes = response.recovery_codes;
+                this.verified = true;
+            }).fail(xhr => {
+                if (xhr.status === 422) {
+                    this.errors = xhr.responseJSON.errors;
+                } else {
+                    Swal.fire({
+                        icon: 'error',
+                        title: 'Error',
+                        text: xhr.responseJSON?.message || 'Something went wrong'
+                    });
+                }
+            }).always(() => {
+                this.loading = false;
+            });
+        },
+
+        copyAllRecoveryCodes() {
+            const text = this.recoveryCodes.join("\n");
+            navigator.clipboard.writeText(text).then(() => {
+                toastr.success("{{ __('Recovery codes copied to clipboard') }}");
+            });
+        },
+
+        downloadRecoveryCodes() {
+            const text = this.recoveryCodes.join("\n");
+            const blob = new Blob([text], { type: 'text/plain' });
+            const url = window.URL.createObjectURL(blob);
+            const a = document.createElement('a');
+            a.href = url;
+            a.download = "{{ config('app.name', 'CtrlPanel.gg') }}-totp-backup-codes.txt";
+            document.body.appendChild(a);
+            a.click();
+            window.URL.revokeObjectURL(url);
+            document.body.removeChild(a);
+        },
+
+        closeModal() {
+            $('#totpViewRecoveryModal').modal('hide');
+        }
+    }
+}
+</script>

From 6a5692870449a2fe81db1841e5116fae51ff0faa Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:17:45 +0300
Subject: [PATCH 10/53] feat: add TOTP management UI to profile security tab

---
 themes/default/views/profile/index.blade.php | 68 +++++++++++++++++---
 1 file changed, 60 insertions(+), 8 deletions(-)

diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index ae7de670f..4541f7a92 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -22,7 +22,7 @@
     <!-- END CONTENT HEADER -->
 
     <!-- MAIN CONTENT -->
-    <section class="content">
+    <section class="content" x-data>
         <div class="container-fluid">
 
             <div class="row">
@@ -253,9 +253,6 @@ class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
                                         </div>
                                     </div>
                                     <div class="row">
-                                        <div class="col d-flex justify-content-end">
-                                            <button class="btn btn-primary" type="submit">{{ __('Save Changes') }}</button>
-                                        </div>
                                     </div>
                                 </div>
 
@@ -313,16 +310,60 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
                                             </div>
                                         </div>
                                         <div class="mb-3 col-12 col-sm-5 offset-sm-1">
-                                            {{-- <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div> --}}
+                                            <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div>
+
+                                            @php($totp = Auth::user()->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->first())
+                                            <div class="mb-3 card">
+                                                <div class="card-body">
+                                                    <div class="d-flex justify-content-between align-items-center">
+                                                        <div>
+                                                            <i class="mr-2 fas fa-mobile-alt fa-2x text-muted"></i>
+                                                            <div class="d-inline-block align-middle">
+                                                                <div class="font-weight-bold">{{ __('Authenticator App') }}</div>
+                                                                <div class="text-muted small">{{ __('Use an app to get codes') }}</div>
+                                                            </div>
+                                                        </div>
+                                                        <div>
+                                                            @if($totp)
+                                                                <span class="badge badge-success">{{ __('Enabled') }}</span>
+                                                            @else
+                                                                <span class="badge badge-secondary">{{ __('Disabled') }}</span>
+                                                            @endif
+                                                        </div>
+                                                    </div>
+
+                                                    <hr>
+
+                                                    <div class="d-flex justify-content-between align-items-center">
+                                                        <span>{{ __('Enable') }}</span>
+                                                        <div class="custom-control custom-switch">
+                                                            <input type="checkbox" class="custom-control-input" id="totpToggle"
+                                                                {{ $totp ? 'checked' : '' }}
+                                                                @click.prevent="window.dispatchEvent(new CustomEvent('totp-toggle-click', { detail: { enabled: {{ $totp ? 'true' : 'false' }} } }))">
+                                                            <label class="custom-control-label" for="totpToggle"></label>
+                                                        </div>
+                                                    </div>
+
+                                                    @if($totp)
+                                                        <div class="mt-3">
+                                                            <button type="button" class="btn btn-sm btn-outline-info" data-toggle="modal" data-target="#totpViewRecoveryModal">
+                                                                <i class="mr-2 fas fa-key"></i>{{ __('View Recovery Codes') }}
+                                                            </button>
+                                                        </div>
+                                                    @endif
+                                                </div>
+                                            </div>
                                         </div>
                                     </div>
                                     <div class="row">
-                                        <div class="col d-flex justify-content-end">
-                                            <button class="btn btn-primary" type="submit">{{ __('Save Changes') }}</button>
-                                        </div>
                                     </div>
                                 </div>
                             </div>
+                            <div class="mt-3 row">
+                                <div class="col d-flex justify-content-end">
+                                    <button class="btn btn-primary" type="submit">{{ __('Save Changes') }}</button>
+                                </div>
+                            </div>
                         </div>
                     </div>
                 </div>
@@ -334,9 +375,20 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
         <!-- END CUSTOM CONTENT -->
 
         </div>
+        @include('modals.totp-setup-modal')
+        @include('modals.totp-view-recovery-modal')
+        @include('modals.totp-disable-modal')
     </section>
     <!-- END CONTENT -->
     <script>
+        window.addEventListener('totp-toggle-click', (e) => {
+            if (e.detail.enabled) {
+                $('#totpDisableModal').modal('show');
+            } else {
+                $('#totpSetupModal').modal('show');
+            }
+        });
+
         $(document).ready(function () {
             // Check if there is a hash in the URL and show the corresponding tab
             let hash = window.location.hash;

From a5c639901c439fbcb876ceed65c599b0c0b40f0e Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Mon, 4 May 2026 03:18:49 +0300
Subject: [PATCH 11/53] feat: add rate limiting, token pruning, and security
 hardening

---
 app/Console/Kernel.php                 |  1 +
 app/Providers/RouteServiceProvider.php | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 54fefc1fd..6d10d90a0 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -33,6 +33,7 @@ protected function schedule(Schedule $schedule)
         $schedule->command('payments:open:clear')->daily();
         $schedule->command('coupons:delete')->hourly();
         $schedule->command('vouchers:delete')->hourly();
+        $schedule->command('model:prune')->daily();
 
         //log cronjob activity
         $schedule->call(function () {
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 668565eab..2a43414e2 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -52,5 +52,21 @@ protected function configureRateLimiting()
         RateLimiter::for('web', function (Request $request) {
             return Limit::perMinute(40)->by($request->user()?->id ?: $request->ip());
         });
+
+        RateLimiter::for('2fa.verify', function (Request $request) {
+            return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
+        });
+
+        RateLimiter::for('2fa.setup', function (Request $request) {
+            return Limit::perMinute(10)->by($request->user()?->id ?: $request->ip());
+        });
+
+        RateLimiter::for('2fa.enable', function (Request $request) {
+            return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
+        });
+
+        RateLimiter::for('2fa.recovery-codes', function (Request $request) {
+            return Limit::perMinute(30)->by($request->user()?->id ?: $request->ip());
+        });
     }
 }

From 00cebbab914e03fc289569aa12c428653eb2f8c8 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:04:24 +0300
Subject: [PATCH 12/53] feat: implement modular 2FA core infrastructure

---
 app/Classes/TwoFactorExtension.php            |  75 ++++++++++++
 .../Auth/TwoFactor/TwoFactorController.php    |  20 ++--
 .../TwoFactorExtensionController.php          | 109 ++++++++++++++++++
 app/Models/UserTwoFactorMethod.php            |  10 +-
 app/Services/TwoFactor/TwoFactorService.php   |  55 ++++++++-
 ...4_203516_create_two_factor_core_tables.php |  44 +++++++
 6 files changed, 289 insertions(+), 24 deletions(-)
 create mode 100644 app/Classes/TwoFactorExtension.php
 create mode 100644 app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php
 create mode 100644 database/migrations/2026_05_04_203516_create_two_factor_core_tables.php

diff --git a/app/Classes/TwoFactorExtension.php b/app/Classes/TwoFactorExtension.php
new file mode 100644
index 000000000..cd6233e0c
--- /dev/null
+++ b/app/Classes/TwoFactorExtension.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Classes;
+
+use App\Models\User;
+use Illuminate\Http\Request;
+
+abstract class TwoFactorExtension extends AbstractExtension
+{
+    /**
+     * Get the unique identifier for this 2FA method.
+     */
+    abstract public function getName(): string;
+
+    /**
+     * Get the display label for this 2FA method.
+     */
+    abstract public function getLabel(): string;
+
+    /**
+     * Get the FontAwesome icon for this 2FA method.
+     */
+    abstract public function getIcon(): string;
+
+    /**
+     * Get a short description for this 2FA method.
+     */
+    abstract public function getDescription(): string;
+
+    /**
+     * Check if this 2FA method is available for the given user.
+     */
+    public function isAvailable(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the view name for the settings card in the profile.
+     */
+    abstract public function getSettingsView(): string;
+
+    /**
+     * Get the view name for the login challenge.
+     */
+    abstract public function getChallengeView(): string;
+
+    /**
+     * Verify the 2FA challenge.
+     */
+    abstract public function verify(Request $request): bool;
+
+    /**
+     * Handle the setup logic (AJAX).
+     */
+    abstract public function setup(Request $request);
+
+    /**
+     * Handle the enable logic (AJAX).
+     */
+    abstract public function enable(Request $request);
+
+    /**
+     * Handle the disable logic (AJAX).
+     */
+    abstract public function disable(Request $request);
+
+    /**
+     * Get method-specific routes configuration if any.
+     */
+    public static function getConfig(): array
+    {
+        return [];
+    }
+}
diff --git a/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php b/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php
index 630e5c952..631d24757 100644
--- a/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php
+++ b/app/Http/Controllers/Auth/TwoFactor/TwoFactorController.php
@@ -21,24 +21,20 @@ public function __construct(TwoFactorService $twoFactorService)
     public function showChallenge(Request $request)
     {
         $user = $request->user();
-        $methods = $this->twoFactorService->enabledMethods($user);
+        $enabledMethods = $this->twoFactorService->enabledMethods($user);
 
-        if ($methods->isEmpty()) {
+        if ($enabledMethods->isEmpty()) {
             return redirect()->intended(route('home'));
         }
 
-        if ($methods->count() === 1) {
-            $method = $methods->first()->method;
-            return redirect()->route("login.2fa.{$method}");
+        if ($enabledMethods->count() === 1) {
+            $method = $enabledMethods->first()->method;
+            return redirect()->route('login.2fa.method', ['method' => $method]);
         }
 
-        // If we ever add more methods (like WebAuthn), we'll need a picker view here.
-        // For now, we just fallback to the first available method (usually TOTP).
-        $totp = $methods->firstWhere('method', 'totp');
-        if ($totp) {
-            return redirect()->route('login.2fa.totp');
-        }
+        // Multiple methods enabled: show picker
+        $methods = $enabledMethods->map(fn ($m) => $this->twoFactorService->getExtension($m->method))->filter();
 
-        return redirect()->intended(route('home'));
+        return view('auth.two-factor.picker', compact('methods'));
     }
 }
diff --git a/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php b/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php
new file mode 100644
index 000000000..c0e3adbad
--- /dev/null
+++ b/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php
@@ -0,0 +1,109 @@
+<?php
+
+namespace App\Http\Controllers\Auth\TwoFactor;
+
+use App\Http\Controllers\Controller;
+use App\Services\TwoFactor\TwoFactorService;
+use Illuminate\Http\Request;
+use Illuminate\Validation\ValidationException;
+
+class TwoFactorExtensionController extends Controller
+{
+    protected $twoFactorService;
+
+    public function __construct(TwoFactorService $twoFactorService)
+    {
+        $this->twoFactorService = $twoFactorService;
+    }
+
+    /**
+     * Show the 2FA challenge view for a specific method.
+     */
+    public function showChallenge(Request $request, string $method)
+    {
+        $extension = $this->twoFactorService->getExtension($method);
+
+        if (!$extension || !$this->twoFactorService->isMethodEnabled($request->user(), $method)) {
+            return redirect()->route('login.2fa.challenge');
+        }
+
+        return view($extension->getChallengeView());
+    }
+
+    /**
+     * Verify the 2FA challenge.
+     */
+    public function verify(Request $request, string $method)
+    {
+        $extension = $this->twoFactorService->getExtension($method);
+
+        if (!$extension || !$this->twoFactorService->isMethodEnabled($request->user(), $method)) {
+            abort(403);
+        }
+
+        if ($extension->verify($request)) {
+            $this->twoFactorService->markVerified($request, $request->user());
+            return redirect()->intended(route('home'));
+        }
+
+        throw ValidationException::withMessages([
+            'code' => [__('The provided two-factor authentication code was invalid.')],
+        ]);
+    }
+
+    /**
+     * Start the setup process for a 2FA method.
+     */
+    public function setup(Request $request, string $method)
+    {
+        $extension = $this->twoFactorService->getExtension($method);
+
+        if (!$extension || !$extension->isAvailable($request->user())) {
+            abort(403);
+        }
+
+        return $extension->setup($request);
+    }
+
+    /**
+     * Enable a 2FA method.
+     */
+    public function enable(Request $request, string $method)
+    {
+        $extension = $this->twoFactorService->getExtension($method);
+
+        if (!$extension || !$extension->isAvailable($request->user())) {
+            abort(403);
+        }
+
+        return $extension->enable($request);
+    }
+
+    /**
+     * Disable a 2FA method.
+     */
+    public function disable(Request $request, string $method)
+    {
+        $extension = $this->twoFactorService->getExtension($method);
+
+        if (!$extension || !$this->twoFactorService->isMethodEnabled($request->user(), $method)) {
+            abort(403);
+        }
+
+        return $extension->disable($request);
+    }
+
+    /**
+     * Method-specific custom actions (like showing recovery codes).
+     */
+    public function action(Request $request, string $method, string $action)
+    {
+        $extension = $this->twoFactorService->getExtension($method);
+
+        if (!$extension || !method_exists($extension, $action)) {
+            abort(404);
+        }
+
+        return $extension->{$action}($request);
+    }
+}
diff --git a/app/Models/UserTwoFactorMethod.php b/app/Models/UserTwoFactorMethod.php
index 9e36069b1..3eb70266c 100644
--- a/app/Models/UserTwoFactorMethod.php
+++ b/app/Models/UserTwoFactorMethod.php
@@ -10,18 +10,10 @@ class UserTwoFactorMethod extends Model
 {
     use HasFactory;
 
-    protected $fillable = [
-        'user_id',
-        'method',
-        'is_enabled',
-        'totp_secret',
-        'totp_recovery_codes',
-    ];
+    protected $guarded = [];
 
     protected $casts = [
         'is_enabled' => 'boolean',
-        'totp_secret' => 'encrypted',
-        'totp_recovery_codes' => 'encrypted:array',
     ];
 
     public function user(): BelongsTo
diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index 6e2161e6c..567c19544 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -2,6 +2,8 @@
 
 namespace App\Services\TwoFactor;
 
+use App\Classes\TwoFactorExtension;
+use App\Helpers\ExtensionHelper;
 use App\Models\TwoFactorVerifiedToken;
 use App\Models\User;
 use Illuminate\Http\Request;
@@ -10,6 +12,36 @@
 
 class TwoFactorService
 {
+    protected ?Collection $extensions = null;
+
+    /**
+     * Get all registered 2FA extensions.
+     */
+    public function getExtensions(): Collection
+    {
+        if ($this->extensions === null) {
+            $this->extensions = collect();
+            $classes = ExtensionHelper::getAllExtensionClassesByNamespace('TwoFactor');
+
+            foreach ($classes as $class) {
+                if (is_subclass_of($class, TwoFactorExtension::class)) {
+                    $extension = app($class);
+                    $this->extensions->put($extension->getName(), $extension);
+                }
+            }
+        }
+
+        return $this->extensions;
+    }
+
+    /**
+     * Get a specific 2FA extension by its name.
+     */
+    public function getExtension(string $name): ?TwoFactorExtension
+    {
+        return $this->getExtensions()->get($name);
+    }
+
     /**
      * Get all enabled 2FA methods for the user.
      */
@@ -20,6 +52,25 @@ public function enabledMethods(User $user): Collection
             ->get();
     }
 
+    /**
+     * Check if a specific 2FA method is enabled for the user.
+     */
+    public function isMethodEnabled(User $user, string $method): bool
+    {
+        return $user->twoFactorMethods()
+            ->where('method', $method)
+            ->where('is_enabled', true)
+            ->exists();
+    }
+
+    /**
+     * Get all available 2FA methods for the user (including those not yet enabled).
+     */
+    public function getAvailableMethodsForUser(User $user): Collection
+    {
+        return $this->getExtensions()->filter(fn (TwoFactorExtension $ext) => $ext->isAvailable($user));
+    }
+
     /**
      * Mark the user as 2FA verified for the current session.
      */
@@ -37,7 +88,7 @@ public function markVerified(Request $request, User $user): void
                 ],
                 [
                     'verified_at' => now(),
-                    'expires_at' => now()->addMinutes((int) config('session.lifetime')), // Matching session lifetime as a fallback or use Laravel's remember lifetime
+                    'expires_at' => now()->addMinutes((int) config('session.lifetime')),
                 ]
             );
         }
@@ -54,7 +105,6 @@ public function isVerified(Request $request, User $user): bool
         }
 
         // 2. DB token check - ONLY for remember-me re-authentication
-        // We only trust the DB token if the user was authenticated via the remember cookie
         if (Auth::viaRemember()) {
             $rememberToken = $user->getRememberToken();
             if ($rememberToken) {
@@ -65,7 +115,6 @@ public function isVerified(Request $request, User $user): bool
                     ->first();
 
                 if ($token) {
-                    // Restore session key if DB token is valid
                     $request->session()->put('two_factor_verified', true);
                     return true;
                 }
diff --git a/database/migrations/2026_05_04_203516_create_two_factor_core_tables.php b/database/migrations/2026_05_04_203516_create_two_factor_core_tables.php
new file mode 100644
index 000000000..341ff3c17
--- /dev/null
+++ b/database/migrations/2026_05_04_203516_create_two_factor_core_tables.php
@@ -0,0 +1,44 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('user_two_factor_methods', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->onDelete('cascade');
+            $table->string('method');
+            $table->boolean('is_enabled')->default(false);
+            $table->timestamps();
+
+            $table->unique(['user_id', 'method']);
+        });
+
+        Schema::create('two_factor_verified_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->onDelete('cascade');
+            $table->string('token_hash', 100);
+            $table->timestamp('verified_at')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamps();
+
+            $table->index(['user_id', 'token_hash']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('two_factor_verified_tokens');
+        Schema::dropIfExists('user_two_factor_methods');
+    }
+};

From a842db1115e6873102e09bd594926bb9cb07f562 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:04:47 +0300
Subject: [PATCH 13/53] feat: enhance ExtensionServiceProvider to auto-load 2FA
 assets

---
 app/Providers/ExtensionServiceProvider.php | 35 ++++++++++++++--------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/app/Providers/ExtensionServiceProvider.php b/app/Providers/ExtensionServiceProvider.php
index 29dce0a16..0057931b0 100644
--- a/app/Providers/ExtensionServiceProvider.php
+++ b/app/Providers/ExtensionServiceProvider.php
@@ -3,6 +3,7 @@
 namespace App\Providers;
 
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
 
 class ExtensionServiceProvider extends ServiceProvider
 {
@@ -24,23 +25,33 @@ public function boot(): void
             return;
         }
 
-        $extensionNamespaces = glob($extensionsBasePath . DIRECTORY_SEPARATOR . '*', GLOB_ONLYDIR) ?: [];
+        $namespaceDirectories = glob($extensionsBasePath . DIRECTORY_SEPARATOR . '*', GLOB_ONLYDIR) ?: [];
 
-        foreach ($extensionNamespaces as $extensionNamespace) {
-            $extensions = glob($extensionNamespace . DIRECTORY_SEPARATOR . '*', GLOB_ONLYDIR) ?: [];
-            foreach ($extensions as $extension) {
-                $routesFile = $extension . DIRECTORY_SEPARATOR . 'routes.php';
-                if (!is_file($routesFile)) {
-                    continue;
+        foreach ($namespaceDirectories as $namespaceDirectory) {
+            $namespaceName = basename($namespaceDirectory);
+            $extensionDirectories = glob($namespaceDirectory . DIRECTORY_SEPARATOR . '*', GLOB_ONLYDIR) ?: [];
+
+            foreach ($extensionDirectories as $extensionDirectory) {
+                $extensionName = basename($extensionDirectory);
+
+                // Load Routes
+                $routesFile = $extensionDirectory . DIRECTORY_SEPARATOR . 'routes.php';
+                if (is_file($routesFile)) {
+                    $this->loadRoutesFrom($routesFile);
                 }
 
-                $resolvedRoutesFile = realpath($routesFile);
-                $normalizedBasePath = rtrim($extensionsBasePath, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
-                if ($resolvedRoutesFile === false || !str_starts_with($resolvedRoutesFile, $normalizedBasePath)) {
-                    continue;
+                // Load Views
+                $viewsDirectory = $extensionDirectory . DIRECTORY_SEPARATOR . 'views';
+                if (is_dir($viewsDirectory)) {
+                    $viewNamespace = Str::lower($namespaceName . '_' . $extensionName);
+                    $this->loadViewsFrom($viewsDirectory, $viewNamespace);
                 }
 
-                $this->loadRoutesFrom($resolvedRoutesFile);
+                // Load Migrations
+                $migrationsDirectory = $extensionDirectory . DIRECTORY_SEPARATOR . 'migrations';
+                if (is_dir($migrationsDirectory)) {
+                    $this->loadMigrationsFrom($migrationsDirectory);
+                }
             }
         }
     }

From 069bd51e36ae21ff550e38f4f75dbffb9ece9442 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:05:02 +0300
Subject: [PATCH 14/53] refactor: move TOTP logic into modular extension

---
 .../TwoFactor/Totp}/RecoveryCodeService.php   |   7 +-
 .../TwoFactor/Totp/TotpExtension.php}         | 108 +++++++++++++-----
 .../TwoFactor/Totp}/TotpService.php           |   2 +-
 ...tp_columns_to_two_factor_methods_table.php |  13 +--
 .../auth/two-factor/totp-challenge.blade.php  |   4 +-
 .../views/modals/totp-disable-modal.blade.php |   2 +-
 .../views/modals/totp-setup-modal.blade.php   |   4 +-
 .../modals/totp-view-recovery-modal.blade.php |   2 +-
 .../Totp/views/profile_card.blade.php         |  59 ++++++++++
 .../Auth/TwoFactor/Totp/TotpController.php    |  77 -------------
 ...reate_two_factor_verified_tokens_table.php |  33 ------
 11 files changed, 152 insertions(+), 159 deletions(-)
 rename app/{Services/TwoFactor => Extensions/TwoFactor/Totp}/RecoveryCodeService.php (88%)
 rename app/{Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php => Extensions/TwoFactor/Totp/TotpExtension.php} (66%)
 rename app/{Services/TwoFactor => Extensions/TwoFactor/Totp}/TotpService.php (94%)
 rename database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php => app/Extensions/TwoFactor/Totp/migrations/2026_05_05_013258_add_totp_columns_to_two_factor_methods_table.php (52%)
 rename {themes/default => app/Extensions/TwoFactor/Totp}/views/auth/two-factor/totp-challenge.blade.php (95%)
 rename {themes/default => app/Extensions/TwoFactor/Totp}/views/modals/totp-disable-modal.blade.php (97%)
 rename {themes/default => app/Extensions/TwoFactor/Totp}/views/modals/totp-setup-modal.blade.php (98%)
 rename {themes/default => app/Extensions/TwoFactor/Totp}/views/modals/totp-view-recovery-modal.blade.php (98%)
 create mode 100644 app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
 delete mode 100644 app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php
 delete mode 100644 database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php

diff --git a/app/Services/TwoFactor/RecoveryCodeService.php b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
similarity index 88%
rename from app/Services/TwoFactor/RecoveryCodeService.php
rename to app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
index c3bb78d97..d06de2dcd 100644
--- a/app/Services/TwoFactor/RecoveryCodeService.php
+++ b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Services\TwoFactor;
+namespace App\Extensions\TwoFactor\Totp;
 
 use App\Models\User;
 use Illuminate\Support\Facades\Cache;
@@ -43,16 +43,15 @@ public function verify(User $user, string $code): bool
             return false;
         }
 
-        $recoveryCodes = $method->totp_recovery_codes;
+        $recoveryCodes = decrypt($method->totp_recovery_codes);
         $isVerified = false;
 
         foreach ($recoveryCodes as $index => $storedCode) {
             // Using hash_equals for constant-time comparison of the plain codes
-            // (they are decrypted by the Eloquent cast)
             if (hash_equals($storedCode, $code)) {
                 // Burn the code
                 unset($recoveryCodes[$index]);
-                $method->totp_recovery_codes = array_values($recoveryCodes);
+                $method->totp_recovery_codes = encrypt(array_values($recoveryCodes));
                 $method->save();
                 $isVerified = true;
                 break;
diff --git a/app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
similarity index 66%
rename from app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php
rename to app/Extensions/TwoFactor/Totp/TotpExtension.php
index 5d3bc3478..86b6a3e32 100644
--- a/app/Http/Controllers/Auth/TwoFactor/Totp/TotpSettingsController.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -1,31 +1,83 @@
 <?php
 
-namespace App\Http\Controllers\Auth\TwoFactor\Totp;
+namespace App\Extensions\TwoFactor\Totp;
 
-use App\Http\Controllers\Controller;
+use App\Classes\TwoFactorExtension;
+use App\Models\User;
 use App\Models\UserTwoFactorMethod;
-use App\Services\TwoFactor\RecoveryCodeService;
-use App\Services\TwoFactor\TotpService;
+use App\Services\TwoFactor\TwoFactorService;
+use App\Extensions\TwoFactor\Totp\TotpService;
+use App\Extensions\TwoFactor\Totp\RecoveryCodeService;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Validation\ValidationException;
 
-class TotpSettingsController extends Controller
+class TotpExtension extends TwoFactorExtension
 {
     protected $totpService;
     protected $recoveryCodeService;
+    protected $twoFactorService;
 
-    public function __construct(
-        TotpService $totpService,
-        RecoveryCodeService $recoveryCodeService
-    ) {
-        $this->totpService = $totpService;
-        $this->recoveryCodeService = $recoveryCodeService;
+    public function __construct()
+    {
+        $this->totpService = app(TotpService::class);
+        $this->recoveryCodeService = app(RecoveryCodeService::class);
+        $this->twoFactorService = app(TwoFactorService::class);
+    }
+
+    public function getName(): string
+    {
+        return 'totp';
+    }
+
+    public function getLabel(): string
+    {
+        return __('Authenticator App');
+    }
+
+    public function getIcon(): string
+    {
+        return 'fas fa-mobile-alt';
+    }
+
+    public function getDescription(): string
+    {
+        return __('Use an app to get codes');
+    }
+
+    public function getSettingsView(): string
+    {
+        return 'twofactor_totp::profile_card';
+    }
+
+    public function getChallengeView(): string
+    {
+        return 'twofactor_totp::auth.two-factor.totp-challenge';
+    }
+
+    public function verify(Request $request): bool
+    {
+        $request->validate([
+            'code' => 'required|string',
+        ]);
+
+        $user = $request->user();
+        $code = preg_replace('/\s+/', '', $request->input('code'));
+
+        if (strlen($code) === 6 && ctype_digit($code)) {
+            // TOTP path
+            $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+            if ($method && $method->totp_secret) {
+                return $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
+            }
+        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
+            // Recovery code path
+            return $this->recoveryCodeService->verify($user, $code);
+        }
+
+        return false;
     }
 
-    /**
-     * Start the TOTP setup process.
-     */
     public function setup(Request $request)
     {
         $user = $request->user();
@@ -47,9 +99,6 @@ public function setup(Request $request)
         ]);
     }
 
-    /**
-     * Enable TOTP for the user.
-     */
     public function enable(Request $request)
     {
         $request->validate([
@@ -83,24 +132,21 @@ public function enable(Request $request)
             ['user_id' => $user->id, 'method' => 'totp'],
             [
                 'is_enabled' => true,
-                'totp_secret' => $pendingSecret,
-                'totp_recovery_codes' => $recoveryCodes,
+                'totp_secret' => encrypt($pendingSecret),
+                'totp_recovery_codes' => encrypt($recoveryCodes),
             ]
         );
 
         $request->session()->forget('totp_pending_secret');
 
         // Mark as verified for current session
-        app(\App\Services\TwoFactor\TwoFactorService::class)->markVerified($request, $user);
+        $this->twoFactorService->markVerified($request, $user);
 
         return response()->json([
             'recovery_codes' => $recoveryCodes,
         ]);
     }
 
-    /**
-     * Disable TOTP for the user.
-     */
     public function disable(Request $request)
     {
         $request->validate([
@@ -125,7 +171,7 @@ public function disable(Request $request)
         $isVerified = false;
 
         if (strlen($code) === 6 && ctype_digit($code)) {
-            $isVerified = $this->totpService->verifyCode($method->totp_secret, $code);
+            $isVerified = $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
         } elseif (strlen($code) === 8 && ctype_alnum($code)) {
             $isVerified = $this->recoveryCodeService->verify($user, $code);
         }
@@ -141,9 +187,6 @@ public function disable(Request $request)
         return response()->json(['message' => __('Two-factor authentication has been disabled.')]);
     }
 
-    /**
-     * Show recovery codes.
-     */
     public function showRecoveryCodes(Request $request)
     {
         $request->validate([
@@ -168,7 +211,7 @@ public function showRecoveryCodes(Request $request)
         $isVerified = false;
 
         if (strlen($code) === 6 && ctype_digit($code)) {
-            $isVerified = $this->totpService->verifyCode($method->totp_secret, $code);
+            $isVerified = $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
         } elseif (strlen($code) === 8 && ctype_alnum($code)) {
             $isVerified = $this->recoveryCodeService->verify($user, $code);
         }
@@ -180,7 +223,14 @@ public function showRecoveryCodes(Request $request)
         }
 
         return response()->json([
-            'recovery_codes' => $method->totp_recovery_codes,
+            'recovery_codes' => decrypt($method->totp_recovery_codes),
         ]);
     }
+
+    public static function getConfig(): array
+    {
+        return [
+            'name' => 'TOTP',
+        ];
+    }
 }
diff --git a/app/Services/TwoFactor/TotpService.php b/app/Extensions/TwoFactor/Totp/TotpService.php
similarity index 94%
rename from app/Services/TwoFactor/TotpService.php
rename to app/Extensions/TwoFactor/Totp/TotpService.php
index 91e825b77..a89f1f5a8 100644
--- a/app/Services/TwoFactor/TotpService.php
+++ b/app/Extensions/TwoFactor/Totp/TotpService.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Services\TwoFactor;
+namespace App\Extensions\TwoFactor\Totp;
 
 use PragmaRX\Google2FALaravel\Facade as Google2FA;
 
diff --git a/database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php b/app/Extensions/TwoFactor/Totp/migrations/2026_05_05_013258_add_totp_columns_to_two_factor_methods_table.php
similarity index 52%
rename from database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php
rename to app/Extensions/TwoFactor/Totp/migrations/2026_05_05_013258_add_totp_columns_to_two_factor_methods_table.php
index 47878bf9c..1ec6137a0 100644
--- a/database/migrations/2026_05_03_231342_create_user_two_factor_methods_table.php
+++ b/app/Extensions/TwoFactor/Totp/migrations/2026_05_05_013258_add_totp_columns_to_two_factor_methods_table.php
@@ -11,16 +11,9 @@
      */
     public function up(): void
     {
-        Schema::create('user_two_factor_methods', function (Blueprint $table) {
-            $table->id();
-            $table->foreignId('user_id')->constrained()->onDelete('cascade');
-            $table->enum('method', ['totp']);
-            $table->boolean('is_enabled')->default(false);
+        Schema::table('user_two_factor_methods', function (Blueprint $table) {
             $table->text('totp_secret')->nullable();
             $table->text('totp_recovery_codes')->nullable();
-            $table->timestamps();
-
-            $table->unique(['user_id', 'method']);
         });
     }
 
@@ -29,6 +22,8 @@ public function up(): void
      */
     public function down(): void
     {
-        Schema::dropIfExists('user_two_factor_methods');
+        Schema::table('user_two_factor_methods', function (Blueprint $table) {
+            $table->dropColumn(['totp_secret', 'totp_recovery_codes']);
+        });
     }
 };
diff --git a/themes/default/views/auth/two-factor/totp-challenge.blade.php b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
similarity index 95%
rename from themes/default/views/auth/two-factor/totp-challenge.blade.php
rename to app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
index 764aef3e0..68d8ac5ef 100644
--- a/themes/default/views/auth/two-factor/totp-challenge.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
@@ -9,7 +9,7 @@
     <div class="card card-outline card-primary">
       <div class="text-center card-header">
         <a href="{{ route('welcome') }}" class="mb-2 h1"><b
-            class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
+            class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
         @if ($website_settings->enable_login_logo)
           <img
             src="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}"
@@ -24,7 +24,7 @@ class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
             {{ __('Please enter your 6-digit TOTP code from your authenticator app or an 8-character recovery code.') }}
         </p>
 
-        <form action="{{ route('login.2fa.totp.verify') }}" method="post">
+        <form action="{{ route('login.2fa.verify', ['method' => 'totp']) }}" method="post">
           @csrf
 
           <div class="form-group">
diff --git a/themes/default/views/modals/totp-disable-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php
similarity index 97%
rename from themes/default/views/modals/totp-disable-modal.blade.php
rename to app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php
index db2b4c98f..f87f0c8f0 100644
--- a/themes/default/views/modals/totp-disable-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php
@@ -65,7 +65,7 @@ function totpDisable() {
             this.loading = true;
             this.errors = {};
 
-            $.post("{{ route('profile.2fa.totp.disable') }}", {
+            $.post("{{ route('profile.2fa.disable', ['method' => 'totp']) }}", {
                 _token: "{{ csrf_token() }}",
                 password: this.password,
                 code: this.code
diff --git a/themes/default/views/modals/totp-setup-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
similarity index 98%
rename from themes/default/views/modals/totp-setup-modal.blade.php
rename to app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
index a3c622751..627481605 100644
--- a/themes/default/views/modals/totp-setup-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
@@ -131,7 +131,7 @@ function totpSetup() {
         },
 
         fetchSetupData() {
-            $.post("{{ route('profile.2fa.totp.setup') }}", {
+            $.post("{{ route('profile.2fa.setup', ['method' => 'totp']) }}", {
                 _token: "{{ csrf_token() }}"
             }).done(response => {
                 this.qrSvg = response.qr_svg;
@@ -150,7 +150,7 @@ function totpSetup() {
             this.loading = true;
             this.errors = {};
 
-            $.post("{{ route('profile.2fa.totp.enable') }}", {
+            $.post("{{ route('profile.2fa.enable', ['method' => 'totp']) }}", {
                 _token: "{{ csrf_token() }}",
                 code: this.code,
                 password: this.password
diff --git a/themes/default/views/modals/totp-view-recovery-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
similarity index 98%
rename from themes/default/views/modals/totp-view-recovery-modal.blade.php
rename to app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
index 75ba01aa2..351de06f7 100644
--- a/themes/default/views/modals/totp-view-recovery-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
@@ -99,7 +99,7 @@ function totpViewRecovery() {
             this.loading = true;
             this.errors = {};
 
-            $.post("{{ route('profile.2fa.totp.recovery-codes') }}", {
+            $.post("{{ route('profile.2fa.action', ['method' => 'totp', 'action' => 'showRecoveryCodes']) }}", {
                 _token: "{{ csrf_token() }}",
                 password: this.password,
                 code: this.code
diff --git a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
new file mode 100644
index 000000000..04aa6a2dc
--- /dev/null
+++ b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
@@ -0,0 +1,59 @@
+@php($totp = Auth::user()->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->first())
+<div class="mb-3 card">
+    <div class="card-body">
+        <div class="d-flex justify-content-between align-items-center">
+            <div>
+                <i class="mr-2 fas fa-mobile-alt fa-2x text-muted"></i>
+                <div class="d-inline-block align-middle">
+                    <div class="font-weight-bold">{{ __('Authenticator App') }}</div>
+                    <div class="text-muted small">{{ __('Use an app to get codes') }}</div>
+                </div>
+            </div>
+            <div>
+                @if($totp)
+                    <span class="badge badge-success">{{ __('Enabled') }}</span>
+                @else
+                    <span class="badge badge-secondary">{{ __('Disabled') }}</span>
+                @endif
+            </div>
+        </div>
+
+        <hr>
+
+        <div class="d-flex justify-content-between align-items-center">
+            <span>{{ __('Enable') }}</span>
+            <div class="custom-control custom-switch">
+                <input type="checkbox" class="custom-control-input" id="totpToggle"
+                    {{ $totp ? 'checked' : '' }}
+                    @click.prevent="window.dispatchEvent(new CustomEvent('totp-toggle-click', { detail: { enabled: {{ $totp ? 'true' : 'false' }} } }))">
+                <label class="custom-control-label" for="totpToggle"></label>
+            </div>
+        </div>
+
+        @if($totp)
+            <div class="mt-3">
+                <button type="button" class="btn btn-sm btn-outline-info" data-toggle="modal" data-target="#totpViewRecoveryModal">
+                    <i class="mr-2 fas fa-key"></i>{{ __('View Recovery Codes') }}
+                </button>
+            </div>
+        @endif
+    </div>
+</div>
+
+@push('modals')
+    @include('twofactor_totp::modals.totp-setup-modal')
+    @include('twofactor_totp::modals.totp-view-recovery-modal')
+    @include('twofactor_totp::modals.totp-disable-modal')
+@endpush
+
+@push('scripts')
+<script>
+    window.addEventListener('totp-toggle-click', (e) => {
+        if (e.detail.enabled) {
+            $('#totpDisableModal').modal('show');
+        } else {
+            $('#totpSetupModal').modal('show');
+        }
+    });
+</script>
+@endpush
diff --git a/app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php b/app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php
deleted file mode 100644
index da2e1648e..000000000
--- a/app/Http/Controllers/Auth/TwoFactor/Totp/TotpController.php
+++ /dev/null
@@ -1,77 +0,0 @@
-<?php
-
-namespace App\Http\Controllers\Auth\TwoFactor\Totp;
-
-use App\Http\Controllers\Auth\TwoFactor\TwoFactorController;
-use App\Services\TwoFactor\RecoveryCodeService;
-use App\Services\TwoFactor\TotpService;
-use App\Services\TwoFactor\TwoFactorService;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
-use Illuminate\Validation\ValidationException;
-
-class TotpController extends TwoFactorController
-{
-    protected $totpService;
-    protected $recoveryCodeService;
-
-    public function __construct(
-        TwoFactorService $twoFactorService,
-        TotpService $totpService,
-        RecoveryCodeService $recoveryCodeService
-    ) {
-        parent::__construct($twoFactorService);
-        $this->totpService = $totpService;
-        $this->recoveryCodeService = $recoveryCodeService;
-    }
-
-    /**
-     * Show the TOTP challenge view.
-     */
-    public function showChallenge(Request $request)
-    {
-        $user = $request->user();
-
-        // Ensure user has TOTP enabled
-        if (!$user->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->exists()) {
-            return redirect()->route('login.2fa.challenge');
-        }
-
-        return view('auth.two-factor.totp-challenge');
-    }
-
-    /**
-     * Verify the TOTP or recovery code.
-     */
-    public function verify(Request $request)
-    {
-        $request->validate([
-            'code' => 'required|string',
-        ]);
-
-        $user = $request->user();
-        $code = preg_replace('/\s+/', '', $request->input('code'));
-
-        $isVerified = false;
-
-        if (strlen($code) === 6 && ctype_digit($code)) {
-            // TOTP path
-            $method = $user->twoFactorMethods()->where('method', 'totp')->first();
-            if ($method && $method->totp_secret) {
-                $isVerified = $this->totpService->verifyCode($method->totp_secret, $code);
-            }
-        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
-            // Recovery code path
-            $isVerified = $this->recoveryCodeService->verify($user, $code);
-        }
-
-        if ($isVerified) {
-            $this->twoFactorService->markVerified($request, $user);
-            return redirect()->intended(route('home'));
-        }
-
-        throw ValidationException::withMessages([
-            'code' => [__('The provided two-factor authentication code was invalid.')],
-        ]);
-    }
-}
diff --git a/database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php b/database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php
deleted file mode 100644
index e798f972a..000000000
--- a/database/migrations/2026_05_03_231343_create_two_factor_verified_tokens_table.php
+++ /dev/null
@@ -1,33 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::create('two_factor_verified_tokens', function (Blueprint $table) {
-            $table->id();
-            $table->foreignId('user_id')->constrained()->onDelete('cascade');
-            $table->string('token_hash', 100);
-            $table->timestamp('verified_at')->nullable();
-            $table->timestamp('expires_at')->nullable();
-            $table->timestamps();
-
-            $table->index(['user_id', 'token_hash']);
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::dropIfExists('two_factor_verified_tokens');
-    }
-};

From c8326bb4fd349826508fbe8d18c7c897e9855a64 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:05:46 +0300
Subject: [PATCH 15/53] feat: implement dynamic 2FA picker and update UI/routes

---
 routes/web.php                                | 15 +++--
 .../views/auth/two-factor/picker.blade.php    | 48 ++++++++++++++++
 themes/default/views/layouts/app.blade.php    |  4 +-
 themes/default/views/layouts/main.blade.php   |  6 +-
 themes/default/views/profile/index.blade.php  | 56 ++-----------------
 5 files changed, 66 insertions(+), 63 deletions(-)
 create mode 100644 themes/default/views/auth/two-factor/picker.blade.php

diff --git a/routes/web.php b/routes/web.php
index e264d7079..300921765 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,9 +1,8 @@
 <?php
 
 use App\Http\Controllers\Admin\ActivityLogController;
-use App\Http\Controllers\Auth\TwoFactor\Totp\TotpController;
-use App\Http\Controllers\Auth\TwoFactor\Totp\TotpSettingsController;
 use App\Http\Controllers\Auth\TwoFactor\TwoFactorController;
+use App\Http\Controllers\Auth\TwoFactor\TwoFactorExtensionController;
 use App\Http\Controllers\Admin\ApplicationApiController;
 use App\Http\Controllers\Admin\InvoiceController;
 use App\Http\Controllers\Admin\OverViewController;
@@ -68,8 +67,8 @@
         ->name('login.2fa.')
         ->group(function () {
             Route::get('/', [TwoFactorController::class, 'showChallenge'])->name('challenge');
-            Route::get('/totp', [TotpController::class, 'showChallenge'])->name('totp');
-            Route::post('/totp', [TotpController::class, 'verify'])->name('totp.verify')->middleware('throttle:2fa.verify');
+            Route::get('/{method}', [TwoFactorExtensionController::class, 'showChallenge'])->name('method');
+            Route::post('/{method}', [TwoFactorExtensionController::class, 'verify'])->name('verify')->middleware('throttle:2fa.verify');
         });
 
     //2fa settings
@@ -77,10 +76,10 @@
         ->prefix('profile/security/2fa')
         ->name('profile.2fa.')
         ->group(function () {
-            Route::post('/totp/setup', [TotpSettingsController::class, 'setup'])->name('totp.setup')->middleware('throttle:2fa.setup');
-            Route::post('/totp/enable', [TotpSettingsController::class, 'enable'])->name('totp.enable')->middleware('throttle:2fa.enable');
-            Route::post('/totp/disable', [TotpSettingsController::class, 'disable'])->name('totp.disable')->middleware('throttle:2fa.verify');
-            Route::post('/totp/recovery-codes', [TotpSettingsController::class, 'showRecoveryCodes'])->name('totp.recovery-codes')->middleware('throttle:2fa.recovery-codes');
+            Route::post('/{method}/setup', [TwoFactorExtensionController::class, 'setup'])->name('setup')->middleware('throttle:2fa.setup');
+            Route::post('/{method}/enable', [TwoFactorExtensionController::class, 'enable'])->name('enable')->middleware('throttle:2fa.enable');
+            Route::post('/{method}/disable', [TwoFactorExtensionController::class, 'disable'])->name('disable')->middleware('throttle:2fa.verify');
+            Route::post('/{method}/{action}', [TwoFactorExtensionController::class, 'action'])->name('action')->middleware('throttle:2fa.recovery-codes');
         });
 
     //normal routes
diff --git a/themes/default/views/auth/two-factor/picker.blade.php b/themes/default/views/auth/two-factor/picker.blade.php
new file mode 100644
index 000000000..77d60c66e
--- /dev/null
+++ b/themes/default/views/auth/two-factor/picker.blade.php
@@ -0,0 +1,48 @@
+@extends('layouts.app')
+
+@section('content')
+  @php($website_settings = app(App\Settings\WebsiteSettings::class))
+  @php($suppressSweetAlert2 = true)
+
+  <body class="hold-transition dark-mode login-page">
+  <div class="login-box">
+    <div class="card card-outline card-primary">
+      <div class="text-center card-header">
+        <a href="{{ route('welcome') }}" class="h1"><b>{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
+      </div>
+      <div class="card-body login-card-body">
+        <p class="login-box-msg">{{ __('Two-Factor Authentication') }}</p>
+        <p class="text-center small text-muted">
+            {{ __('Select a verification method') }}
+        </p>
+
+        <div class="list-group mt-3">
+            @foreach($methods as $method)
+                <a href="{{ route('login.2fa.method', ['method' => $method->getName()]) }}" 
+                   class="list-group-item list-group-item-action d-flex align-items-center bg-dark border-secondary">
+                    <div class="mr-3">
+                        <i class="{{ $method->getIcon() }} fa-lg text-primary"></i>
+                    </div>
+                    <div>
+                        <div class="text-sm font-weight-bold">{{ $method->getLabel() }}</div>
+                        <div class="text-xs text-muted">{{ $method->getDescription() }}</div>
+                    </div>
+                </a>
+            @endforeach
+        </div>
+
+        <p class="mt-4 mb-1 text-center">
+            <a href="{{ route('logout') }}" 
+               onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
+                {{ __('Logout') }}
+            </a>
+        </p>
+
+        <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
+            @csrf
+        </form>
+      </div>
+    </div>
+  </div>
+  </body>
+@endsection
diff --git a/themes/default/views/layouts/app.blade.php b/themes/default/views/layouts/app.blade.php
index 4f36e703d..2fac44979 100644
--- a/themes/default/views/layouts/app.blade.php
+++ b/themes/default/views/layouts/app.blade.php
@@ -14,7 +14,7 @@
     <!-- CSRF Token -->
     <meta name="csrf-token" content="{{ csrf_token() }}">
 
-    <title>{{ config('app.name', 'Laravel') }}</title>
+    <title>{{ config('app.name', 'CtrlPanel.gg') }}</title>
     <link rel="icon"
         href="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('favicon.ico') ? asset('storage/favicon.ico') : asset('favicon.ico') }}"
         type="image/x-icon">
@@ -44,8 +44,10 @@
     @vite('themes/default/sass/app.scss')
 </head>
 @yield('content')
+@stack('modals')
 
 <script src="https://cdn.jsdelivr.net/npm/sweetalert2@10.14.1/dist/sweetalert2.all.min.js"></script>
+@stack('scripts')
 
 <script>
     @if (!isset($suppressSweetAlert2))
diff --git a/themes/default/views/layouts/main.blade.php b/themes/default/views/layouts/main.blade.php
index d7ce4fd14..13acb1523 100644
--- a/themes/default/views/layouts/main.blade.php
+++ b/themes/default/views/layouts/main.blade.php
@@ -16,7 +16,7 @@
     <meta
             content='{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}'
             property="og:image">
-    <title>{{ config('app.name', 'Laravel') }}</title>
+    <title>{{ config('app.name', 'CtrlPanel.gg') }}</title>
     <link rel="icon"
           href="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('favicon.ico') ? asset('storage/favicon.ico') : asset('favicon.ico') }}"
           type="image/x-icon">
@@ -169,7 +169,7 @@ class="{{ $link->icon }}"></i> {{ $link->title }}</a>
         <a href="{{ route('home') }}" class="brand-link">
             <img width="64" height="64"
                  src="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('icon.png') ? asset('storage/icon.png') : asset('images/ctrlpanel_logo.png') }}"
-                 alt="{{ config('app.name', 'Laravel') }} Logo" class="brand-image img-circle"
+                 alt="{{ config('app.name', 'CtrlPanel.gg') }} Logo" class="brand-image img-circle"
                  style="opacity: .8">
             <span class="brand-text font-weight-light">{{ config('app.name', 'CtrlPanel.gg') }}</span>
         </a>
@@ -455,6 +455,7 @@ class="nav-link @if (Request::routeIs('admin.activitylogs.*')) active @endif">
         @yield('content')
 
         @include('modals.redeem_voucher_modal')
+        @stack('modals')
     </div>
     <!-- /.content-wrapper -->
     <footer class="main-footer d-flex justify-content-between">
@@ -536,6 +537,7 @@ class="nav-link @if (Request::routeIs('admin.activitylogs.*')) active @endif">
         });
     })
 </script>
+@stack('scripts')
 <script>
     @if (!isset($suppressSweetAlert2))
         @if (Session::has('error'))
diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index 4541f7a92..c3a6c2ca6 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -312,47 +312,10 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
                                         <div class="mb-3 col-12 col-sm-5 offset-sm-1">
                                             <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div>
 
-                                            @php($totp = Auth::user()->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->first())
-                                            <div class="mb-3 card">
-                                                <div class="card-body">
-                                                    <div class="d-flex justify-content-between align-items-center">
-                                                        <div>
-                                                            <i class="mr-2 fas fa-mobile-alt fa-2x text-muted"></i>
-                                                            <div class="d-inline-block align-middle">
-                                                                <div class="font-weight-bold">{{ __('Authenticator App') }}</div>
-                                                                <div class="text-muted small">{{ __('Use an app to get codes') }}</div>
-                                                            </div>
-                                                        </div>
-                                                        <div>
-                                                            @if($totp)
-                                                                <span class="badge badge-success">{{ __('Enabled') }}</span>
-                                                            @else
-                                                                <span class="badge badge-secondary">{{ __('Disabled') }}</span>
-                                                            @endif
-                                                        </div>
-                                                    </div>
-
-                                                    <hr>
-
-                                                    <div class="d-flex justify-content-between align-items-center">
-                                                        <span>{{ __('Enable') }}</span>
-                                                        <div class="custom-control custom-switch">
-                                                            <input type="checkbox" class="custom-control-input" id="totpToggle"
-                                                                {{ $totp ? 'checked' : '' }}
-                                                                @click.prevent="window.dispatchEvent(new CustomEvent('totp-toggle-click', { detail: { enabled: {{ $totp ? 'true' : 'false' }} } }))">
-                                                            <label class="custom-control-label" for="totpToggle"></label>
-                                                        </div>
-                                                    </div>
-
-                                                    @if($totp)
-                                                        <div class="mt-3">
-                                                            <button type="button" class="btn btn-sm btn-outline-info" data-toggle="modal" data-target="#totpViewRecoveryModal">
-                                                                <i class="mr-2 fas fa-key"></i>{{ __('View Recovery Codes') }}
-                                                            </button>
-                                                        </div>
-                                                    @endif
-                                                </div>
-                                            </div>
+                                            @inject('twoFactorService', 'App\Services\TwoFactor\TwoFactorService')
+                                            @foreach($twoFactorService->getAvailableMethodsForUser(Auth::user()) as $method)
+                                                @include($method->getSettingsView(), ['method' => $method])
+                                            @endforeach
                                         </div>
                                     </div>
                                     <div class="row">
@@ -375,20 +338,9 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
         <!-- END CUSTOM CONTENT -->
 
         </div>
-        @include('modals.totp-setup-modal')
-        @include('modals.totp-view-recovery-modal')
-        @include('modals.totp-disable-modal')
     </section>
     <!-- END CONTENT -->
     <script>
-        window.addEventListener('totp-toggle-click', (e) => {
-            if (e.detail.enabled) {
-                $('#totpDisableModal').modal('show');
-            } else {
-                $('#totpSetupModal').modal('show');
-            }
-        });
-
         $(document).ready(function () {
             // Check if there is a hash in the URL and show the corresponding tab
             let hash = window.location.hash;

From d99aa4e2bcf7099e3d9ea8cd03df85861d0dacef Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:07:46 +0300
Subject: [PATCH 16/53] test: add Dummy 2FA extension for multi-method testing

---
 .../TwoFactor/Dummy/DummyExtension.php        | 71 +++++++++++++++++++
 .../auth/two-factor/dummy-challenge.blade.php | 28 ++++++++
 .../Dummy/views/profile_card.blade.php        | 52 ++++++++++++++
 3 files changed, 151 insertions(+)
 create mode 100644 app/Extensions/TwoFactor/Dummy/DummyExtension.php
 create mode 100644 app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php
 create mode 100644 app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php

diff --git a/app/Extensions/TwoFactor/Dummy/DummyExtension.php b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
new file mode 100644
index 000000000..b3d870bdc
--- /dev/null
+++ b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Extensions\TwoFactor\Dummy;
+
+use App\Classes\TwoFactorExtension;
+use App\Models\User;
+use App\Models\UserTwoFactorMethod;
+use Illuminate\Http\Request;
+
+class DummyExtension extends TwoFactorExtension
+{
+    public function getName(): string
+    {
+        return 'dummy';
+    }
+
+    public function getLabel(): string
+    {
+        return __('Dummy 2FA (Test)');
+    }
+
+    public function getIcon(): string
+    {
+        return 'fas fa-flask';
+    }
+
+    public function getDescription(): string
+    {
+        return __('A temporary method for testing modular 2FA.');
+    }
+
+    public function getSettingsView(): string
+    {
+        return 'twofactor_dummy::profile_card';
+    }
+
+    public function getChallengeView(): string
+    {
+        return 'twofactor_dummy::auth.two-factor.dummy-challenge';
+    }
+
+    public function verify(Request $request): bool
+    {
+        return $request->input('code') === '123456';
+    }
+
+    public function setup(Request $request)
+    {
+        return response()->json(['message' => 'Dummy setup ready. Use code 123456 to enable.']);
+    }
+
+    public function enable(Request $request)
+    {
+        if ($request->input('code') !== '123456') {
+             return response()->json(['errors' => ['code' => ['Use 123456']]], 422);
+        }
+
+        UserTwoFactorMethod::updateOrCreate(
+            ['user_id' => $request->user()->id, 'method' => 'dummy'],
+            ['is_enabled' => true]
+        );
+
+        return response()->json(['message' => 'Dummy 2FA enabled!']);
+    }
+
+    public function disable(Request $request)
+    {
+        $request->user()->twoFactorMethods()->where('method', 'dummy')->delete();
+        return response()->json(['message' => 'Dummy 2FA disabled.']);
+    }
+}
diff --git a/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php b/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php
new file mode 100644
index 000000000..b629407f0
--- /dev/null
+++ b/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php
@@ -0,0 +1,28 @@
+@extends('layouts.app')
+
+@section('content')
+  @php($website_settings = app(App\Settings\WebsiteSettings::class))
+  @php($suppressSweetAlert2 = true)
+
+  <body class="hold-transition dark-mode login-page">
+  <div class="login-box">
+    <div class="card card-outline card-primary">
+      <div class="text-center card-header">
+        <a href="{{ route('welcome') }}" class="mb-2 h1"><b class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
+      </div>
+      <div class="pt-0 card-body">
+        <p class="login-box-msg">{{ __('Dummy 2FA Challenge') }}</p>
+        <p class="text-center small text-muted">Enter 123456 to pass.</p>
+
+        <form action="{{ route('login.2fa.verify', ['method' => 'dummy']) }}" method="post">
+          @csrf
+          <div class="form-group">
+            <input type="text" name="code" class="form-control" placeholder="123456" autofocus>
+          </div>
+          <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
+        </form>
+      </div>
+    </div>
+  </div>
+  </body>
+@endsection
diff --git a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
new file mode 100644
index 000000000..70f584b22
--- /dev/null
+++ b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
@@ -0,0 +1,52 @@
+@php($dummy = Auth::user()->twoFactorMethods()->where('method', 'dummy')->where('is_enabled', true)->first())
+<div class="mb-3 card">
+    <div class="card-body">
+        <div class="d-flex justify-content-between align-items-center">
+            <div>
+                <i class="mr-2 fas fa-flask fa-2x text-muted"></i>
+                <div class="d-inline-block align-middle">
+                    <div class="font-weight-bold">{{ __('Dummy 2FA (Test)') }}</div>
+                    <div class="text-muted small">{{ __('Just enter 123456 to test') }}</div>
+                </div>
+            </div>
+            <div>
+                @if($dummy)
+                    <span class="badge badge-success">{{ __('Enabled') }}</span>
+                @else
+                    <span class="badge badge-secondary">{{ __('Disabled') }}</span>
+                @endif
+            </div>
+        </div>
+
+        <hr>
+
+        <div class="d-flex justify-content-between align-items-center">
+            <span>{{ __('Enable') }}</span>
+            <div class="custom-control custom-switch">
+                <input type="checkbox" class="custom-control-input" id="dummyToggle"
+                    {{ $dummy ? 'checked' : '' }}
+                    @click.prevent="toggleDummy()">
+                <label class="custom-control-label" for="dummyToggle"></label>
+            </div>
+        </div>
+    </div>
+</div>
+
+@push('scripts')
+<script>
+    function toggleDummy() {
+        const enabled = {{ $dummy ? 'true' : 'false' }};
+        if (enabled) {
+            $.post("{{ route('profile.2fa.disable', ['method' => 'dummy']) }}", { _token: "{{ csrf_token() }}" })
+             .done(() => location.reload());
+        } else {
+            const code = prompt("Enter 123456 to enable Dummy 2FA");
+            if (code) {
+                $.post("{{ route('profile.2fa.enable', ['method' => 'dummy']) }}", { _token: "{{ csrf_token() }}", code: code })
+                 .done(() => location.reload())
+                 .fail(xhr => alert(xhr.responseJSON.message || "Failed"));
+            }
+        }
+    }
+</script>
+@endpush

From 2085e18151aa5d8f2b8a2bc8f0e1399f04be76c7 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:08:48 +0300
Subject: [PATCH 17/53] style: standardize app name default to CtrlPanel.gg
 across the project

---
 app/Notifications/ReferralNotification.php           | 2 +-
 app/Notifications/ServerCreationError.php            | 2 +-
 app/Notifications/ServersSuspendedNotification.php   | 2 +-
 app/Notifications/ServersUnsuspendedNotification.php | 2 +-
 app/Notifications/WelcomeMessage.php                 | 2 +-
 themes/BlueInfinity/views/layouts/app.blade.php      | 2 +-
 themes/BlueInfinity/views/layouts/main.blade.php     | 4 ++--
 themes/default/views/auth/login.blade.php            | 2 +-
 themes/default/views/auth/passwords/email.blade.php  | 2 +-
 themes/default/views/auth/passwords/reset.blade.php  | 2 +-
 themes/default/views/auth/register.blade.php         | 2 +-
 themes/default/views/layouts/errors.blade.php        | 2 +-
 12 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/app/Notifications/ReferralNotification.php b/app/Notifications/ReferralNotification.php
index a760da84c..7d6325875 100644
--- a/app/Notifications/ReferralNotification.php
+++ b/app/Notifications/ReferralNotification.php
@@ -58,7 +58,7 @@ public function toArray($notifiable)
                 <p>You received '. Currency::formatForDisplay($this->reward) . ' ' . $this->credits_display_name . '</p>
                 <p>because ' . e($this->ref_user->name) . ' registered with your Referral-Code!</p>
                 <p>Thank you very much for supporting us!.</p>
-                <p>'.config('app.name', 'Laravel').'</p>
+                <p>'.config('app.name', 'CtrlPanel.gg').'</p>
             ',
         ];
     }
diff --git a/app/Notifications/ServerCreationError.php b/app/Notifications/ServerCreationError.php
index f575d7d37..4ed220763 100644
--- a/app/Notifications/ServerCreationError.php
+++ b/app/Notifications/ServerCreationError.php
@@ -53,7 +53,7 @@ public function toArray($notifiable)
                 <p>Hello <strong>{$userName}</strong>, An unexpected error has occurred...</p>
                 <p>There was a problem creating your server on our pterodactyl panel. There are likely no allocations or rooms left on the selected node. Please contact one of our support members through our discord server to get this resolved asap!</p>
                 <p>We thank you for your patience and our deepest apologies for this inconvenience.</p>
-                <p>".config('app.name', 'Laravel').'</p>
+                <p>".config('app.name', 'CtrlPanel.gg').'</p>
             ',
         ];
     }
diff --git a/app/Notifications/ServersSuspendedNotification.php b/app/Notifications/ServersSuspendedNotification.php
index 7b1f1a3e8..dee714ead 100644
--- a/app/Notifications/ServersSuspendedNotification.php
+++ b/app/Notifications/ServersSuspendedNotification.php
@@ -67,7 +67,7 @@ public function toArray($notifiable)
                 <h5>'.__('Your servers have been suspended!').'</h5>
                 <p>'.__('To automatically re-enable your server/s, you need to purchase more credits.').'</p>
                 <p>'.__('If you have any questions please let us know.').'</p>
-                <p>'.__('Regards').',<br />'.config('app.name', 'Laravel').'</p>
+                <p>'.__('Regards').',<br />'.config('app.name', 'CtrlPanel.gg').'</p>
             ',
         ];
     }
diff --git a/app/Notifications/ServersUnsuspendedNotification.php b/app/Notifications/ServersUnsuspendedNotification.php
index 8c0e35412..b1015c21c 100644
--- a/app/Notifications/ServersUnsuspendedNotification.php
+++ b/app/Notifications/ServersUnsuspendedNotification.php
@@ -59,7 +59,7 @@ public function toArray(object $notifiable): array
             'content' => '
                 <h5>'.__('Your servers have been unsuspended').'</h5>
                 <p>'.__('We appreciate your continued trust in our services. If you have any questions or need assistance, feel free to reach out to our support team.').'</p>
-                <p>'.__('Regards').',<br />'.config('app.name', 'Laravel').'</p>
+                <p>'.__('Regards').',<br />'.config('app.name', 'CtrlPanel.gg').'</p>
             '
         ];
     }
diff --git a/app/Notifications/WelcomeMessage.php b/app/Notifications/WelcomeMessage.php
index e01bf1350..1ff08c235 100644
--- a/app/Notifications/WelcomeMessage.php
+++ b/app/Notifications/WelcomeMessage.php
@@ -101,7 +101,7 @@ public function toArray($notifiable)
                 <h5>'.__('Information').'</h5>
                 <p>'.__('This dashboard can be used to create and delete servers').'.<br /> '.__('These servers can be used and managed on our pterodactyl panel').'.<br /> '.__('If you have any questions, please join our Discord server and #create-a-ticket').'.</p>
                 <p>'.__('We hope you can enjoy this hosting experience and if you have any suggestions please let us know').'!</p>
-                <p>'.__('Regards').',<br />'.config('app.name', 'Laravel').'</p>
+                <p>'.__('Regards').',<br />'.config('app.name', 'CtrlPanel.gg').'</p>
             ',
         ];
     }
diff --git a/themes/BlueInfinity/views/layouts/app.blade.php b/themes/BlueInfinity/views/layouts/app.blade.php
index e7ec0cac5..2ff61b334 100644
--- a/themes/BlueInfinity/views/layouts/app.blade.php
+++ b/themes/BlueInfinity/views/layouts/app.blade.php
@@ -14,7 +14,7 @@
   <!-- CSRF Token -->
   <meta name="csrf-token" content="{{ csrf_token() }}">
 
-  <title>{{ config('app.name', 'Laravel') }}</title>
+  <title>{{ config('app.name', 'CtrlPanel.gg') }}</title>
   <link rel="icon"
         href="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('favicon.ico') ? asset('storage/favicon.ico') : asset('favicon.ico') }}"
         type="image/x-icon">
diff --git a/themes/BlueInfinity/views/layouts/main.blade.php b/themes/BlueInfinity/views/layouts/main.blade.php
index b67fad1a1..ee3e70cfa 100644
--- a/themes/BlueInfinity/views/layouts/main.blade.php
+++ b/themes/BlueInfinity/views/layouts/main.blade.php
@@ -16,7 +16,7 @@
   <meta
     content='{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}'
     property="og:image">
-  <title>{{ config('app.name', 'Laravel') }}</title>
+  <title>{{ config('app.name', 'CtrlPanel.gg') }}</title>
   <link rel="icon"
         href="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('favicon.ico') ? asset('storage/favicon.ico') : asset('favicon.ico') }}"
         type="image/x-icon">
@@ -166,7 +166,7 @@ class="{{ $link->icon }}"></i> {{ $link->title }}</a>
     <a href="{{ route('home') }}" class="brand-link">
       <img width="64" height="64"
            src="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('icon.png') ? asset('storage/icon.png') : asset('images/ctrlpanel_logo.png') }}"
-           alt="{{ config('app.name', 'Laravel') }} Logo" class="brand-image img-circle"
+           alt="{{ config('app.name', 'CtrlPanel.gg') }} Logo" class="brand-image img-circle"
            style="opacity: .8">
       <span class="brand-text font-weight-light">{{ config('app.name', 'CtrlPanel.gg') }}</span>
     </a>
diff --git a/themes/default/views/auth/login.blade.php b/themes/default/views/auth/login.blade.php
index b55b8cd99..2a9b3adaf 100644
--- a/themes/default/views/auth/login.blade.php
+++ b/themes/default/views/auth/login.blade.php
@@ -8,7 +8,7 @@
     <div class="card card-outline card-primary">
       <div class="text-center card-header">
         <a href="{{ route('welcome') }}" class="mb-2 h1"><b
-            class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
+            class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
         @if ($website_settings->enable_login_logo)
           <img
             src="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}"
diff --git a/themes/default/views/auth/passwords/email.blade.php b/themes/default/views/auth/passwords/email.blade.php
index b2af62d9b..99b608a10 100644
--- a/themes/default/views/auth/passwords/email.blade.php
+++ b/themes/default/views/auth/passwords/email.blade.php
@@ -7,7 +7,7 @@
             <div class="card card-outline card-primary">
                 <div class="text-center card-header">
                     <a href="{{ route('welcome') }}" class="h1"><b
-                            class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
+                            class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
                 </div>
                 <div class="card-body">
                     @if (session('status'))
diff --git a/themes/default/views/auth/passwords/reset.blade.php b/themes/default/views/auth/passwords/reset.blade.php
index b76f90867..acf2b6495 100644
--- a/themes/default/views/auth/passwords/reset.blade.php
+++ b/themes/default/views/auth/passwords/reset.blade.php
@@ -7,7 +7,7 @@
             <div class="card card-outline card-primary">
                 <div class="text-center card-header">
                     <a href="{{ route('welcome') }}" class="h1"><b
-                            class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
+                            class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
                 </div>
                 <div class="card-body">
                     <p class="login-box-msg">
diff --git a/themes/default/views/auth/register.blade.php b/themes/default/views/auth/register.blade.php
index 9dd7b6665..a4ce14948 100644
--- a/themes/default/views/auth/register.blade.php
+++ b/themes/default/views/auth/register.blade.php
@@ -7,7 +7,7 @@
     <div class="card card-outline card-primary">
       <div class="text-center card-header">
         <a href="{{ route('welcome') }}" class="h1"><b
-            class="mr-1">{{ config('app.name', 'Laravel') }}</b></a>
+            class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
       </div>
       <div class="card-body">
         @if (!app(App\Settings\UserSettings::class)->creation_enabled)
diff --git a/themes/default/views/layouts/errors.blade.php b/themes/default/views/layouts/errors.blade.php
index 0858bfdbd..fac1ed064 100644
--- a/themes/default/views/layouts/errors.blade.php
+++ b/themes/default/views/layouts/errors.blade.php
@@ -13,7 +13,7 @@
   <meta
     content='{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}'
     property="og:image">
-  <title>{{ config('app.name', 'Laravel') }}</title>
+  <title>{{ config('app.name', 'CtrlPanel.gg') }}</title>
   <link rel="icon"
         href="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('favicon.ico') ? asset('storage/favicon.ico') : asset('favicon.ico') }}"
         type="image/x-icon">

From 632b3ef33465246ceacf2d4f7a8713049df4723d Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 16:57:46 +0300
Subject: [PATCH 18/53] fix: 2fa action route name and throttle

---
 app/Providers/RouteServiceProvider.php | 4 ++--
 routes/web.php                         | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 2a43414e2..54b027b11 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -65,8 +65,8 @@ protected function configureRateLimiting()
             return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
         });
 
-        RateLimiter::for('2fa.recovery-codes', function (Request $request) {
-            return Limit::perMinute(30)->by($request->user()?->id ?: $request->ip());
+        RateLimiter::for('2fa.action', function (Request $request) {
+            return Limit::perMinutes(5, 3)->by($request->user()?->id ?: $request->ip());
         });
     }
 }
diff --git a/routes/web.php b/routes/web.php
index 300921765..2c501b95d 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -79,7 +79,7 @@
             Route::post('/{method}/setup', [TwoFactorExtensionController::class, 'setup'])->name('setup')->middleware('throttle:2fa.setup');
             Route::post('/{method}/enable', [TwoFactorExtensionController::class, 'enable'])->name('enable')->middleware('throttle:2fa.enable');
             Route::post('/{method}/disable', [TwoFactorExtensionController::class, 'disable'])->name('disable')->middleware('throttle:2fa.verify');
-            Route::post('/{method}/{action}', [TwoFactorExtensionController::class, 'action'])->name('action')->middleware('throttle:2fa.recovery-codes');
+            Route::post('/{method}/{action}', [TwoFactorExtensionController::class, 'action'])->name('action')->middleware('throttle:2fa.action');
         });
 
     //normal routes

From 5cde50792174594478d4ad23a99791a108af3fc9 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 20:09:58 +0300
Subject: [PATCH 19/53] feat: improve views for 2FA and profile

---
 .../auth/two-factor/totp-challenge.blade.php  | 127 +++++++-----------
 .../views/modals/totp-setup-modal.blade.php   |   6 +-
 .../Totp/views/profile_card.blade.php         |  47 ++++---
 .../views/auth/two-factor/picker.blade.php    |  82 +++++------
 themes/default/views/profile/index.blade.php  |  87 ++++++------
 5 files changed, 169 insertions(+), 180 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
index 68d8ac5ef..fa9757628 100644
--- a/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
@@ -1,88 +1,65 @@
 @extends('layouts.app')
 
 @section('content')
-  @php($website_settings = app(App\Settings\WebsiteSettings::class))
-  @php($suppressSweetAlert2 = true)
+@php($suppressSweetAlert2 = true)
 
-  <body class="hold-transition dark-mode login-page">
-  <div class="login-box">
-    <div class="card card-outline card-primary">
-      <div class="text-center card-header">
-        <a href="{{ route('welcome') }}" class="mb-2 h1"><b
-            class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
-        @if ($website_settings->enable_login_logo)
-          <img
-            src="{{ \Illuminate\Support\Facades\Storage::disk('public')->exists('logo.png') ? asset('storage/logo.png') : asset('images/ctrlpanel_logo.png') }}"
-            alt="{{ config('app.name', 'CtrlPanel.gg') }} Logo"
-            style="opacity: .8; max-width:100%; height: 150px; margin-top: 10px;">
-        @endif
-      </div>
-      <div class="pt-0 card-body">
-        <p class="login-box-msg">{{ __('Two-Factor Authentication') }}</p>
-
-        <p class="text-center small text-muted">
-            {{ __('Please enter your 6-digit TOTP code from your authenticator app or an 8-character recovery code.') }}
-        </p>
+<body class="hold-transition dark-mode login-page">
+    <div class="login-box">
+        <div class="card card-outline card-primary">
+            <div class="text-center card-header">
+                <a href="{{ route('welcome') }}" class="mb-2 h1"><b
+                        class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
+            </div>
+            <div class="card-body">
+                <p class="login-box-msg">{{ __('Two-Factor Authentication') }}</p>
 
-        <form action="{{ route('login.2fa.verify', ['method' => 'totp']) }}" method="post">
-          @csrf
+                <p class="text-center small text-muted">
+                    {{ __('Please enter your 6-digit TOTP code from your authenticator app or an 8-character recovery code.') }}
+                </p>
 
-          <div class="form-group">
-            <div class="mb-3 input-group">
-              <input type="text" name="code" id="code"
-                     class="form-control @error('code') is-invalid @enderror"
-                     placeholder="{{ __('Authentication Code') }}"
-                     autofocus
-                     autocomplete="one-time-code"
-                     inputmode="numeric">
-              <div class="input-group-append">
-                <div class="input-group-text">
-                  <span class="fas fa-lock"></span>
-                </div>
-              </div>
-            </div>
-            @error('code')
-              <span class="text-danger" role="alert">
-                <small><strong>{{ $message }}</strong></small>
-              </span>
-            @enderror
-          </div>
+                <form action="{{ route('login.2fa.verify', ['method' => 'totp']) }}" method="post">
+                    @csrf
 
-          <div class="row">
-            <div class="col-12">
-              <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
-            </div>
-          </div>
+                    <div class="form-group">
+                        <div class="mb-3 input-group">
+                            <input type="text" name="code" id="code"
+                                class="form-control @error('code') is-invalid @enderror"
+                                placeholder="{{ __('Authentication Code') }}" autofocus autocomplete="one-time-code"
+                                inputmode="numeric">
+                            <div class="input-group-append">
+                                <div class="input-group-text">
+                                    <span class="fas fa-lock"></span>
+                                </div>
+                            </div>
+                        </div>
+                        @error('code')
+                            <span class="text-danger" role="alert">
+                                <small><strong>{{ $message }}</strong></small>
+                            </span>
+                        @enderror
+                    </div>
 
-          <input type="hidden" name="_token" value="{{ csrf_token() }}">
-        </form>
+                    <div class="row">
+                        <div class="col-12">
+                            <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
+                        </div>
+                    </div>
 
-        <p class="mt-3 mb-1 text-center">
-            <a href="{{ route('logout') }}" onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
-                {{ __('Log out') }}
-            </a>
-        </p>
+                    <input type="hidden" name="_token" value="{{ csrf_token() }}">
+                </form>
 
-        <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
-            @csrf
-        </form>
-      </div>
-    </div>
-  </div>
+                <p class="mt-3 mb-1 text-center">
+                    <a href="{{ route('logout') }}"
+                        onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
+                        {{ __('Logout') }}
+                    </a>
+                </p>
 
-  <div class="fixed-bottom ">
-    <div class="container text-center">
-      @if ($website_settings->show_imprint)
-        <a target="_blank" href="{{ route('terms', 'imprint') }}"><strong>{{ __('Imprint') }}</strong></a> |
-      @endif
-      @if ($website_settings->show_privacy)
-        <a target="_blank" href="{{ route('terms', 'privacy') }}"><strong>{{ __('Privacy') }}</strong></a>
-      @endif
-      @if ($website_settings->show_tos)
-        | <a target="_blank"
-             href="{{ route('terms', 'tos') }}"><strong>{{ __('Terms of Service') }}</strong></a>
-      @endif
+                <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
+                    @csrf
+                </form>
+            </div>
+        </div>
     </div>
-  </div>
-  </body>
+</body>
 @endsection
diff --git a/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
index 627481605..9f15191ce 100644
--- a/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
@@ -13,7 +13,7 @@
                 <template x-if="step === 'setup'">
                     <div>
                         <div class="row align-items-center">
-                            <div class="mb-4 mb-md-0 text-center col-md-5 d-flex flex-column align-items-center justify-content-center">
+                            <div class="mb-4 mb-md-0 text-center col-12 col-lg-5 d-flex flex-column align-items-center justify-content-center">
                                 <div class="p-2 bg-white d-inline-block rounded shadow-sm">
                                     <div x-html="qrSvg"></div>
                                 </div>
@@ -21,7 +21,7 @@
                                     {{ __('Scan this QR code with your authenticator app (e.g. Google Authenticator, Authy, Bitwarden).') }}
                                 </div>
                             </div>
-                            <div class="col-md-7">
+                            <div class="col-12 col-lg-7">
                                 <h5>{{ __('Manual Entry') }}</h5>
                                 <p class="text-muted small">
                                     {{ __('If you cannot scan the QR code, enter this secret key into your app:') }}
@@ -33,8 +33,6 @@
                                     </button>
                                 </div>
 
-                                <hr>
-
                                 <div class="form-group">
                                     <label>{{ __('Authentication Code') }}</label>
                                     <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000" inputmode="numeric">
diff --git a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
index 04aa6a2dc..735010a2c 100644
--- a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
@@ -1,15 +1,27 @@
 @php($totp = Auth::user()->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->first())
 <div class="mb-3 card">
     <div class="card-body">
-        <div class="d-flex justify-content-between align-items-center">
-            <div>
-                <i class="mr-2 fas fa-mobile-alt fa-2x text-muted"></i>
-                <div class="d-inline-block align-middle">
-                    <div class="font-weight-bold">{{ __('Authenticator App') }}</div>
-                    <div class="text-muted small">{{ __('Use an app to get codes') }}</div>
+        <div class="d-flex justify-content-between align-items-md-center">
+            <div class="d-flex flex-column flex-md-row align-items-start align-items-md-center w-100">
+                <!-- Mobile row -->
+                <div class="d-flex align-items-center justify-content-between w-100 d-md-none">
+                    <i class="{{ $method->getIcon() }} fa-2x text-muted"></i>
+
+                    @if($totp)
+                        <span class="badge badge-success">{{ __('Enabled') }}</span>
+                    @else
+                        <span class="badge badge-secondary">{{ __('Disabled') }}</span>
+                    @endif
+                </div>
+                <!-- Desktop icon and text -->
+                <i class="d-none d-md-inline-block mr-md-3 {{ $method->getIcon() }} fa-2x text-muted"></i>
+                <div class="mt-2 mt-md-0">
+                    <div class="font-weight-bold">{{ $method->getLabel() }}</div>
+                    <div class="text-muted small">{{ $method->getDescription() }}</div>
                 </div>
             </div>
-            <div>
+            <!-- Desktop icon -->
+            <div class="d-none d-md-block">
                 @if($totp)
                     <span class="badge badge-success">{{ __('Enabled') }}</span>
                 @else
@@ -23,8 +35,7 @@
         <div class="d-flex justify-content-between align-items-center">
             <span>{{ __('Enable') }}</span>
             <div class="custom-control custom-switch">
-                <input type="checkbox" class="custom-control-input" id="totpToggle"
-                    {{ $totp ? 'checked' : '' }}
+                <input type="checkbox" class="custom-control-input" id="totpToggle" {{ $totp ? 'checked' : '' }}
                     @click.prevent="window.dispatchEvent(new CustomEvent('totp-toggle-click', { detail: { enabled: {{ $totp ? 'true' : 'false' }} } }))">
                 <label class="custom-control-label" for="totpToggle"></label>
             </div>
@@ -47,13 +58,13 @@
 @endpush
 
 @push('scripts')
-<script>
-    window.addEventListener('totp-toggle-click', (e) => {
-        if (e.detail.enabled) {
-            $('#totpDisableModal').modal('show');
-        } else {
-            $('#totpSetupModal').modal('show');
-        }
-    });
-</script>
+    <script>
+        window.addEventListener('totp-toggle-click', (e) => {
+            if (e.detail.enabled) {
+                $('#totpDisableModal').modal('show');
+            } else {
+                $('#totpSetupModal').modal('show');
+            }
+        });
+    </script>
 @endpush
diff --git a/themes/default/views/auth/two-factor/picker.blade.php b/themes/default/views/auth/two-factor/picker.blade.php
index 77d60c66e..d51f5cf6b 100644
--- a/themes/default/views/auth/two-factor/picker.blade.php
+++ b/themes/default/views/auth/two-factor/picker.blade.php
@@ -1,48 +1,52 @@
 @extends('layouts.app')
 
 @section('content')
-  @php($website_settings = app(App\Settings\WebsiteSettings::class))
-  @php($suppressSweetAlert2 = true)
+@php($suppressSweetAlert2 = true)
 
-  <body class="hold-transition dark-mode login-page">
-  <div class="login-box">
-    <div class="card card-outline card-primary">
-      <div class="text-center card-header">
-        <a href="{{ route('welcome') }}" class="h1"><b>{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
-      </div>
-      <div class="card-body login-card-body">
-        <p class="login-box-msg">{{ __('Two-Factor Authentication') }}</p>
-        <p class="text-center small text-muted">
-            {{ __('Select a verification method') }}
-        </p>
+<body class="hold-transition dark-mode login-page">
+    <div class="login-box">
+        <div class="card card-outline card-primary">
+            <div class="text-center card-header">
+                <a href="{{ route('welcome') }}" class="h1"><b>{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
+            </div>
+            <div class="card-body login-card-body">
+                <p class="login-box-msg">{{ __('Two-Factor Authentication') }}</p>
+                <p class="text-center small text-muted">
+                    {{ __('Select a verification method') }}
+                </p>
 
-        <div class="list-group mt-3">
-            @foreach($methods as $method)
-                <a href="{{ route('login.2fa.method', ['method' => $method->getName()]) }}" 
-                   class="list-group-item list-group-item-action d-flex align-items-center bg-dark border-secondary">
-                    <div class="mr-3">
-                        <i class="{{ $method->getIcon() }} fa-lg text-primary"></i>
-                    </div>
-                    <div>
-                        <div class="text-sm font-weight-bold">{{ $method->getLabel() }}</div>
-                        <div class="text-xs text-muted">{{ $method->getDescription() }}</div>
-                    </div>
-                </a>
-            @endforeach
-        </div>
+                <div class="mt-3">
+                    @foreach($methods as $method)
+                        <a href="{{ route('login.2fa.method', ['method' => $method->getName()]) }}"
+                            class="d-flex align-items-center p-3 mb-2 bg-dark border border-secondary rounded text-decoration-none hover-shadow">
+                            <div class="mr-3">
+                                <i class="{{ $method->getIcon() }} fa-lg text-primary"></i>
+                            </div>
+
+                            <div class="flex-grow-1">
+                                <div class="text-sm font-weight-bold text-light">
+                                    {{ $method->getLabel() }}
+                                </div>
+                                <div class="text-xs text-muted">
+                                    {{ $method->getDescription() }}
+                                </div>
+                            </div>
+                        </a>
+                    @endforeach
+                </div>
 
-        <p class="mt-4 mb-1 text-center">
-            <a href="{{ route('logout') }}" 
-               onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
-                {{ __('Logout') }}
-            </a>
-        </p>
+                <p class="mt-4 mb-1 text-center">
+                    <a href="{{ route('logout') }}"
+                        onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
+                        {{ __('Logout') }}
+                    </a>
+                </p>
 
-        <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
-            @csrf
-        </form>
-      </div>
+                <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
+                    @csrf
+                </form>
+            </div>
+        </div>
     </div>
-  </div>
-  </body>
+</body>
 @endsection
diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index c3a6c2ca6..8180eec58 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -201,7 +201,7 @@ class="form-control @error('email') is-invalid @enderror"
                                                 </div>
                                             </div>
                                         </div>
-                                        <div class="mb-3 col-12 col-sm-5 offset-sm-1">
+                                        <div class="mb-3 col-12 col-sm-6">
                                             @if (!empty($discord_client_id) && !empty($discord_client_secret))
                                                 <div class="row">
                                                     <div class="mb-3 col-12">
@@ -252,64 +252,65 @@ class="mr-1 fab fa-discord"></i>{{ __('Re-Sync Discord') }}
                                             @endif
                                         </div>
                                     </div>
-                                    <div class="row">
-                                    </div>
                                 </div>
 
                                 <!-- Security Tab -->
                                 <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
                                     <div class="row">
                                         <div class="mb-3 col-12 col-sm-6">
-                                            <div class="row">
-                                                <div class="col">
-                                                    <div class="form-group">
-                                                        <label>{{ __('Current Password') }}</label>
-                                                        <input
-                                                            class="form-control @error('current_password') is-invalid @enderror"
-                                                            name="current_password" type="password" placeholder="••••••">
+                                            <div class="col">
+                                                <div class="row">
+                                                    <div class="col">
+                                                        <div class="form-group">
+                                                            <label>{{ __('Current Password') }}</label>
+                                                            <input
+                                                                class="form-control @error('current_password') is-invalid @enderror"
+                                                                name="current_password" type="password"
+                                                                placeholder="••••••">
 
-                                                        @error('current_password')
-                                                            <div class="invalid-feedback">
-                                                                {{ $message }}
-                                                            </div>
-                                                        @enderror
+                                                            @error('current_password')
+                                                                <div class="invalid-feedback">
+                                                                    {{ $message }}
+                                                                </div>
+                                                            @enderror
+                                                        </div>
                                                     </div>
                                                 </div>
-                                            </div>
-                                            <div class="row">
-                                                <div class="col">
-                                                    <div class="form-group"><label>{{ __('New Password') }}</label>
-                                                        <input
-                                                            class="form-control @error('new_password') is-invalid @enderror"
-                                                            name="new_password" type="password" placeholder="••••••">
+                                                <div class="row">
+                                                    <div class="col">
+                                                        <div class="form-group"><label>{{ __('New Password') }}</label>
+                                                            <input
+                                                                class="form-control @error('new_password') is-invalid @enderror"
+                                                                name="new_password" type="password" placeholder="••••••">
 
-                                                        @error('new_password')
-                                                            <div class="invalid-feedback">
-                                                                {{ $message }}
-                                                            </div>
-                                                        @enderror
+                                                            @error('new_password')
+                                                                <div class="invalid-feedback">
+                                                                    {{ $message }}
+                                                                </div>
+                                                            @enderror
+                                                        </div>
                                                     </div>
                                                 </div>
-                                            </div>
-                                            <div class="row">
-                                                <div class="col">
-                                                    <div class="form-group">
-                                                        <label>{{ __('Confirm Password') }}</span></label>
-                                                        <input
-                                                            class="form-control @error('new_password_confirmation') is-invalid @enderror"
-                                                            name="new_password_confirmation" type="password"
-                                                            placeholder="••••••">
+                                                <div class="row">
+                                                    <div class="col">
+                                                        <div class="form-group">
+                                                            <label>{{ __('Confirm Password') }}</span></label>
+                                                            <input
+                                                                class="form-control @error('new_password_confirmation') is-invalid @enderror"
+                                                                name="new_password_confirmation" type="password"
+                                                                placeholder="••••••">
 
-                                                        @error('new_password_confirmation')
-                                                            <div class="invalid-feedback">
-                                                                {{ $message }}
-                                                            </div>
-                                                        @enderror
+                                                            @error('new_password_confirmation')
+                                                                <div class="invalid-feedback">
+                                                                    {{ $message }}
+                                                                </div>
+                                                            @enderror
+                                                        </div>
                                                     </div>
                                                 </div>
                                             </div>
                                         </div>
-                                        <div class="mb-3 col-12 col-sm-5 offset-sm-1">
+                                        <div class="mb-3 col-12 col-sm-6">
                                             <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div>
 
                                             @inject('twoFactorService', 'App\Services\TwoFactor\TwoFactorService')
@@ -318,8 +319,6 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
                                             @endforeach
                                         </div>
                                     </div>
-                                    <div class="row">
-                                    </div>
                                 </div>
                             </div>
                             <div class="mt-3 row">

From 6c85aba9949597f1d572bde750c359477638c021 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Tue, 5 May 2026 20:10:43 +0300
Subject: [PATCH 20/53] feat: add theming guide for 2FA system

---
 app/Extensions/TwoFactor/THEMING.md | 58 +++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 app/Extensions/TwoFactor/THEMING.md

diff --git a/app/Extensions/TwoFactor/THEMING.md b/app/Extensions/TwoFactor/THEMING.md
new file mode 100644
index 000000000..de79c89ab
--- /dev/null
+++ b/app/Extensions/TwoFactor/THEMING.md
@@ -0,0 +1,58 @@
+## 2FA Views Override System
+
+One of the strongest aspects of the current implementation is how flexible view overriding is.
+By using Laravel’s standard `loadViewsFrom` mechanism with namespaces, any theme can override views of any 2FA extension.
+
+---
+
+### How It Works
+
+When an extension (for example, TOTP) calls:
+
+`view('twofactor_totp::profile_card')`
+
+Laravel (along with the theme system) resolves the view using the following priority:
+
+1. Active theme  
+   `themes/{theme}/views/vendor/twofactor_totp/profile_card.blade.php`
+
+2. Default extension view (fallback)  
+   `app/Extensions/TwoFactor/Totp/views/profile_card.blade.php`
+
+---
+
+### Examples for Theme Developers
+
+#### 1. Override the 2FA method picker screen
+
+Create the file:  
+`themes/{theme}/views/auth/two-factor/picker.blade.php`
+
+This view is not namespaced, so it behaves like a regular panel view.
+
+---
+
+#### 2. Override the TOTP profile card
+
+Create the file:  
+`themes/{theme}/views/vendor/twofactor_totp/profile_card.blade.php`
+
+---
+
+#### 3. Override the TOTP challenge screen (code input)
+
+Create the file:  
+`themes/{theme}/views/vendor/twofactor_totp/auth/two-factor/totp-challenge.blade.php`
+
+---
+
+### Notes for Developers
+
+In ExtensionServiceProvider, the view namespace is automatically generated using the pattern:
+
+`{namespace_folder}_{method_name}`
+
+Example:
+`twofactor_totp`
+
+This ensures that any new 2FA extension works out of the box with the same override system.

From d25fadbb5b40dd9d9bcc3204a3427757fc93de03 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 04:29:46 +0300
Subject: [PATCH 21/53] fix: dummy method profile card and login layout

---
 .../auth/two-factor/dummy-challenge.blade.php |  3 +-
 .../Dummy/views/profile_card.blade.php        | 35 +++++++++++++------
 .../Totp/views/profile_card.blade.php         |  2 +-
 3 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php b/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php
index b629407f0..ca3d5d826 100644
--- a/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php
+++ b/app/Extensions/TwoFactor/Dummy/views/auth/two-factor/dummy-challenge.blade.php
@@ -1,7 +1,6 @@
 @extends('layouts.app')
 
 @section('content')
-  @php($website_settings = app(App\Settings\WebsiteSettings::class))
   @php($suppressSweetAlert2 = true)
 
   <body class="hold-transition dark-mode login-page">
@@ -10,7 +9,7 @@
       <div class="text-center card-header">
         <a href="{{ route('welcome') }}" class="mb-2 h1"><b class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
       </div>
-      <div class="pt-0 card-body">
+      <div class="card-body">
         <p class="login-box-msg">{{ __('Dummy 2FA Challenge') }}</p>
         <p class="text-center small text-muted">Enter 123456 to pass.</p>
 
diff --git a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
index 70f584b22..d43e12585 100644
--- a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
@@ -1,15 +1,27 @@
 @php($dummy = Auth::user()->twoFactorMethods()->where('method', 'dummy')->where('is_enabled', true)->first())
 <div class="mb-3 card">
     <div class="card-body">
-        <div class="d-flex justify-content-between align-items-center">
-            <div>
-                <i class="mr-2 fas fa-flask fa-2x text-muted"></i>
-                <div class="d-inline-block align-middle">
-                    <div class="font-weight-bold">{{ __('Dummy 2FA (Test)') }}</div>
-                    <div class="text-muted small">{{ __('Just enter 123456 to test') }}</div>
+        <div class="d-flex justify-content-between align-items-md-center">
+            <div class="d-flex flex-column flex-md-row align-items-start align-items-md-center w-100">
+                <!-- Mobile row -->
+                <div class="d-flex align-items-center justify-content-between w-100 d-md-none">
+                    <i class="{{ $method->getIcon() }} fa-2x text-muted"></i>
+
+                    @if($dummy)
+                        <span class="badge badge-success">{{ __('Enabled') }}</span>
+                    @else
+                        <span class="badge badge-secondary">{{ __('Disabled') }}</span>
+                    @endif
+                </div>
+                <!-- Desktop icon and text -->
+                <i class="d-none d-md-inline-block mr-md-3 {{ $method->getIcon() }} fa-2x text-muted"></i>
+                <div class="mt-2 mt-md-0">
+                    <div class="font-weight-bold">{{ $method->getLabel() }}</div>
+                    <div class="text-muted small">{{ $method->getDescription() }}</div>
                 </div>
             </div>
-            <div>
+            <!-- Desktop badge -->
+            <div class="d-none d-md-block">
                 @if($dummy)
                     <span class="badge badge-success">{{ __('Enabled') }}</span>
                 @else
@@ -23,9 +35,12 @@
         <div class="d-flex justify-content-between align-items-center">
             <span>{{ __('Enable') }}</span>
             <div class="custom-control custom-switch">
-                <input type="checkbox" class="custom-control-input" id="dummyToggle"
-                    {{ $dummy ? 'checked' : '' }}
-                    @click.prevent="toggleDummy()">
+                <input type="checkbox"
+                       class="custom-control-input"
+                       id="dummyToggle"
+                       {{ $dummy ? 'checked' : '' }}
+                       @click.prevent="toggleDummy()">
+
                 <label class="custom-control-label" for="dummyToggle"></label>
             </div>
         </div>
diff --git a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
index 735010a2c..4cc3818b4 100644
--- a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
@@ -20,7 +20,7 @@
                     <div class="text-muted small">{{ $method->getDescription() }}</div>
                 </div>
             </div>
-            <!-- Desktop icon -->
+            <!-- Desktop badge -->
             <div class="d-none d-md-block">
                 @if($totp)
                     <span class="badge badge-success">{{ __('Enabled') }}</span>

From 2ab9241fb59d4b7553c0acd01c7631c0717d1a88 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 04:39:15 +0300
Subject: [PATCH 22/53] security: fix action whitelist and dummy method
 availability

---
 app/Classes/TwoFactorExtension.php                     | 10 ++++++++++
 app/Extensions/TwoFactor/Dummy/DummyExtension.php      |  5 +++++
 app/Extensions/TwoFactor/Totp/TotpExtension.php        |  5 +++++
 .../Auth/TwoFactor/TwoFactorExtensionController.php    |  4 ++++
 4 files changed, 24 insertions(+)

diff --git a/app/Classes/TwoFactorExtension.php b/app/Classes/TwoFactorExtension.php
index cd6233e0c..a5ccd4504 100644
--- a/app/Classes/TwoFactorExtension.php
+++ b/app/Classes/TwoFactorExtension.php
@@ -65,6 +65,16 @@ abstract public function enable(Request $request);
      */
     abstract public function disable(Request $request);
 
+    /**
+     * Get the list of allowed actions that can be called via the action route.
+     *
+     * @return array
+     */
+    public function getAllowedActions(): array
+    {
+        return [];
+    }
+
     /**
      * Get method-specific routes configuration if any.
      */
diff --git a/app/Extensions/TwoFactor/Dummy/DummyExtension.php b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
index b3d870bdc..27f0a9787 100644
--- a/app/Extensions/TwoFactor/Dummy/DummyExtension.php
+++ b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
@@ -29,6 +29,11 @@ public function getDescription(): string
         return __('A temporary method for testing modular 2FA.');
     }
 
+    public function isAvailable(User $user): bool
+    {
+        return app()->environment('local');
+    }
+
     public function getSettingsView(): string
     {
         return 'twofactor_dummy::profile_card';
diff --git a/app/Extensions/TwoFactor/Totp/TotpExtension.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
index 86b6a3e32..bc4d1aeac 100644
--- a/app/Extensions/TwoFactor/Totp/TotpExtension.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -227,6 +227,11 @@ public function showRecoveryCodes(Request $request)
         ]);
     }
 
+    public function getAllowedActions(): array
+    {
+        return ['showRecoveryCodes'];
+    }
+
     public static function getConfig(): array
     {
         return [
diff --git a/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php b/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php
index c0e3adbad..d1819a2dc 100644
--- a/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php
+++ b/app/Http/Controllers/Auth/TwoFactor/TwoFactorExtensionController.php
@@ -104,6 +104,10 @@ public function action(Request $request, string $method, string $action)
             abort(404);
         }
 
+        if (!in_array($action, $extension->getAllowedActions(), true)) {
+            abort(403);
+        }
+
         return $extension->{$action}($request);
     }
 }

From d7682902c22cebfe1b761d58ffa0cd2f4c4752ae Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 04:40:34 +0300
Subject: [PATCH 23/53] security: fix token expiration logic and path traversal
 in extensions

---
 app/Providers/ExtensionServiceProvider.php  | 6 +++++-
 app/Services/TwoFactor/TwoFactorService.php | 2 +-
 config/auth.php                             | 2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/app/Providers/ExtensionServiceProvider.php b/app/Providers/ExtensionServiceProvider.php
index 0057931b0..8aba288cc 100644
--- a/app/Providers/ExtensionServiceProvider.php
+++ b/app/Providers/ExtensionServiceProvider.php
@@ -37,7 +37,11 @@ public function boot(): void
                 // Load Routes
                 $routesFile = $extensionDirectory . DIRECTORY_SEPARATOR . 'routes.php';
                 if (is_file($routesFile)) {
-                    $this->loadRoutesFrom($routesFile);
+                    $resolvedPath = realpath($routesFile);
+                    $basePath = realpath($extensionsBasePath);
+                    if ($resolvedPath && $basePath && str_starts_with($resolvedPath, $basePath . DIRECTORY_SEPARATOR)) {
+                        $this->loadRoutesFrom($resolvedPath);
+                    }
                 }
 
                 // Load Views
diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index 567c19544..08b3e5f5a 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -88,7 +88,7 @@ public function markVerified(Request $request, User $user): void
                 ],
                 [
                     'verified_at' => now(),
-                    'expires_at' => now()->addMinutes((int) config('session.lifetime')),
+                    'expires_at' => now()->addDays((int) config('auth.two_factor_remember_days', 30)),
                 ]
             );
         }
diff --git a/config/auth.php b/config/auth.php
index 963c5ee73..0f37ef12f 100644
--- a/config/auth.php
+++ b/config/auth.php
@@ -114,4 +114,6 @@
 
     'password_timeout' => 10800,
 
+    'two_factor_remember_days' => 30,
+
 ];

From 4ff56500b33297072e2dbb7af32c389f184a7428 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 04:41:15 +0300
Subject: [PATCH 24/53] refactor: add route constraints and tighten model
 guarding

---
 app/Models/UserTwoFactorMethod.php |  2 +-
 routes/web.php                     | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/app/Models/UserTwoFactorMethod.php b/app/Models/UserTwoFactorMethod.php
index 3eb70266c..1ad9cf8e6 100644
--- a/app/Models/UserTwoFactorMethod.php
+++ b/app/Models/UserTwoFactorMethod.php
@@ -10,7 +10,7 @@ class UserTwoFactorMethod extends Model
 {
     use HasFactory;
 
-    protected $guarded = [];
+    protected $guarded = ['id'];
 
     protected $casts = [
         'is_enabled' => 'boolean',
diff --git a/routes/web.php b/routes/web.php
index 2c501b95d..01eb08ce2 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -67,8 +67,8 @@
         ->name('login.2fa.')
         ->group(function () {
             Route::get('/', [TwoFactorController::class, 'showChallenge'])->name('challenge');
-            Route::get('/{method}', [TwoFactorExtensionController::class, 'showChallenge'])->name('method');
-            Route::post('/{method}', [TwoFactorExtensionController::class, 'verify'])->name('verify')->middleware('throttle:2fa.verify');
+            Route::get('/{method}', [TwoFactorExtensionController::class, 'showChallenge'])->name('method')->where('method', '[a-z_]+');
+            Route::post('/{method}', [TwoFactorExtensionController::class, 'verify'])->name('verify')->middleware('throttle:2fa.verify')->where('method', '[a-z_]+');
         });
 
     //2fa settings
@@ -76,10 +76,10 @@
         ->prefix('profile/security/2fa')
         ->name('profile.2fa.')
         ->group(function () {
-            Route::post('/{method}/setup', [TwoFactorExtensionController::class, 'setup'])->name('setup')->middleware('throttle:2fa.setup');
-            Route::post('/{method}/enable', [TwoFactorExtensionController::class, 'enable'])->name('enable')->middleware('throttle:2fa.enable');
-            Route::post('/{method}/disable', [TwoFactorExtensionController::class, 'disable'])->name('disable')->middleware('throttle:2fa.verify');
-            Route::post('/{method}/{action}', [TwoFactorExtensionController::class, 'action'])->name('action')->middleware('throttle:2fa.action');
+            Route::post('/{method}/setup', [TwoFactorExtensionController::class, 'setup'])->name('setup')->middleware('throttle:2fa.setup')->where('method', '[a-z_]+');
+            Route::post('/{method}/enable', [TwoFactorExtensionController::class, 'enable'])->name('enable')->middleware('throttle:2fa.enable')->where('method', '[a-z_]+');
+            Route::post('/{method}/disable', [TwoFactorExtensionController::class, 'disable'])->name('disable')->middleware('throttle:2fa.verify')->where('method', '[a-z_]+');
+            Route::post('/{method}/{action}', [TwoFactorExtensionController::class, 'action'])->name('action')->middleware('throttle:2fa.action')->where(['method' => '[a-z_]+', 'action' => '[a-zA-Z_]+']);
         });
 
     //normal routes

From bb5a44164677ff38ac05d493b714368094bb6aaa Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 04:43:01 +0300
Subject: [PATCH 25/53] perf: fix N+1 in profile and cleanup redundant tokens

---
 .../TwoFactor/Dummy/views/profile_card.blade.php      |  2 +-
 .../views/auth/two-factor/totp-challenge.blade.php    | 11 ++++-------
 .../TwoFactor/Totp/views/profile_card.blade.php       |  2 +-
 app/Http/Controllers/ProfileController.php            |  4 +++-
 4 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
index d43e12585..a0dce56ab 100644
--- a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
@@ -1,4 +1,4 @@
-@php($dummy = Auth::user()->twoFactorMethods()->where('method', 'dummy')->where('is_enabled', true)->first())
+@php($dummy = Auth::user()->twoFactorMethods->where('method', 'dummy')->where('is_enabled', true)->first())
 <div class="mb-3 card">
     <div class="card-body">
         <div class="d-flex justify-content-between align-items-md-center">
diff --git a/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
index fa9757628..2a8fd1825 100644
--- a/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
@@ -40,14 +40,11 @@ class="form-control @error('code') is-invalid @enderror"
                     </div>
 
                     <div class="row">
-                        <div class="col-12">
-                            <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
-                        </div>
+                      <div class="col-12">
+                        <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
+                      </div>
                     </div>
-
-                    <input type="hidden" name="_token" value="{{ csrf_token() }}">
-                </form>
-
+                    </form>
                 <p class="mt-3 mb-1 text-center">
                     <a href="{{ route('logout') }}"
                         onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
diff --git a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
index 4cc3818b4..eccd4009a 100644
--- a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
@@ -1,4 +1,4 @@
-@php($totp = Auth::user()->twoFactorMethods()->where('method', 'totp')->where('is_enabled', true)->first())
+@php($totp = Auth::user()->twoFactorMethods->where('method', 'totp')->where('is_enabled', true)->first())
 <div class="mb-3 card">
     <div class="card-body">
         <div class="d-flex justify-content-between align-items-md-center">
diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index c68f2cd03..1a641875a 100644
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -27,9 +27,11 @@ public function __construct(PterodactylSettings $ptero_settings)
     /** Display a listing of the resource. */
     public function index(UserSettings $user_settings, DiscordSettings $discord_settings, ReferralSettings $referral_settings)
     {
+        $user = Auth::user();
+        $user->load('twoFactorMethods');
 
         return view('profile.index')->with([
-            'user' => Auth::user(),
+            'user' => $user,
             // raw numeric value for logical checks; formatting occurs in blades when needed
             'credits_reward_after_verify_discord' => $user_settings->credits_reward_after_verify_discord,
             'force_email_verification' => $user_settings->force_email_verification,

From 7547a81c5708493ee7ab2d214155d25a5f83af13 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 04:43:29 +0300
Subject: [PATCH 26/53] docs: clarify google2fa configuration

---
 config/google2fa.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/config/google2fa.php b/config/google2fa.php
index 68a70a326..2f4722107 100644
--- a/config/google2fa.php
+++ b/config/google2fa.php
@@ -49,6 +49,9 @@
 
     /*
      * User's table column for google2fa secret.
+     * Note: This column is NOT used by CtrlPanel.gg. We handle verification manually via
+     * Google2FA::verifyKey() using the 'totp_secret' column in the user_two_factor_methods table.
+     * The package's automatic middleware/auto-detection is not used.
      */
     'otp_secret_column' => 'google2fa_secret',
 

From c30773dad508e6b80c1c7dcecf9e9bcbcec4e1df Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 05:11:54 +0300
Subject: [PATCH 27/53] fix: extend 2fa token expiration time to match remember
 cookie

---
 app/Services/TwoFactor/TwoFactorService.php | 2 +-
 config/auth.php                             | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index 08b3e5f5a..d59e43600 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -88,7 +88,7 @@ public function markVerified(Request $request, User $user): void
                 ],
                 [
                     'verified_at' => now(),
-                    'expires_at' => now()->addDays((int) config('auth.two_factor_remember_days', 30)),
+                    'expires_at' => now()->addMinutes((int) config('auth.remember_cookie_minutes', 576000)),
                 ]
             );
         }
diff --git a/config/auth.php b/config/auth.php
index 0f37ef12f..9f0b77760 100644
--- a/config/auth.php
+++ b/config/auth.php
@@ -114,6 +114,5 @@
 
     'password_timeout' => 10800,
 
-    'two_factor_remember_days' => 30,
-
+    'two_factor_remember_days' => 60 * 24 * 400,
 ];

From 5afd8d281dd22d09897229e5fbd7c0a429a03263 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 21:34:11 +0300
Subject: [PATCH 28/53] fix: correct 2FA token lifetime config and persistence
 logic

---
 app/Services/TwoFactor/TwoFactorService.php | 8 ++++----
 config/auth.php                             | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index d59e43600..411da073d 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -79,16 +79,16 @@ public function markVerified(Request $request, User $user): void
         $request->session()->put('two_factor_verified', true);
 
         // If remember_web cookie is present, store verification token in DB
-        $rememberToken = $user->getRememberToken();
-        if ($rememberToken) {
+        $cookieName = Auth::guard('web')->getRecallerName();
+        if ($request->hasCookie($cookieName)) {
             TwoFactorVerifiedToken::updateOrCreate(
                 [
                     'user_id' => $user->id,
-                    'token_hash' => hash('sha256', $rememberToken),
+                    'token_hash' => hash('sha256', $user->getRememberToken()),
                 ],
                 [
                     'verified_at' => now(),
-                    'expires_at' => now()->addMinutes((int) config('auth.remember_cookie_minutes', 576000)),
+                    'expires_at' => now()->addMinutes((int) config('auth.two_factor_token_lifetime', 576000)),
                 ]
             );
         }
diff --git a/config/auth.php b/config/auth.php
index 9f0b77760..f08079ebb 100644
--- a/config/auth.php
+++ b/config/auth.php
@@ -114,5 +114,5 @@
 
     'password_timeout' => 10800,
 
-    'two_factor_remember_days' => 60 * 24 * 400,
+    'two_factor_token_lifetime' => 576000, // minutes (400 days)
 ];

From 85463cd5715b6e27f377ffbdcba3ac8c52903d44 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 21:45:32 +0300
Subject: [PATCH 29/53] style: optimize 2FA UI and refactor profile data
 injection

---
 .../views/auth/two-factor/totp-challenge.blade.php    | 11 +++++------
 app/Http/Controllers/ProfileController.php            |  3 +++
 themes/default/views/profile/index.blade.php          |  3 +--
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
index 2a8fd1825..37302d649 100644
--- a/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/auth/two-factor/totp-challenge.blade.php
@@ -24,8 +24,7 @@ class="mr-1">{{ config('app.name', 'CtrlPanel.gg') }}</b></a>
                         <div class="mb-3 input-group">
                             <input type="text" name="code" id="code"
                                 class="form-control @error('code') is-invalid @enderror"
-                                placeholder="{{ __('Authentication Code') }}" autofocus autocomplete="one-time-code"
-                                inputmode="numeric">
+                                placeholder="{{ __('Authentication Code') }}" autofocus autocomplete="one-time-code">
                             <div class="input-group-append">
                                 <div class="input-group-text">
                                     <span class="fas fa-lock"></span>
@@ -40,11 +39,11 @@ class="form-control @error('code') is-invalid @enderror"
                     </div>
 
                     <div class="row">
-                      <div class="col-12">
-                        <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
-                      </div>
+                        <div class="col-12">
+                            <button type="submit" class="btn btn-primary btn-block">{{ __('Verify') }}</button>
+                        </div>
                     </div>
-                    </form>
+                </form>
                 <p class="mt-3 mb-1 text-center">
                     <a href="{{ route('logout') }}"
                         onclick="event.preventDefault(); document.getElementById('logout-form').submit();">
diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index 1a641875a..8c419aaa4 100644
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -30,8 +30,11 @@ public function index(UserSettings $user_settings, DiscordSettings $discord_sett
         $user = Auth::user();
         $user->load('twoFactorMethods');
 
+        $availableMethods = app(\App\Services\TwoFactor\TwoFactorService::class)->getAvailableMethodsForUser($user);
+
         return view('profile.index')->with([
             'user' => $user,
+            'availableMethods' => $availableMethods,
             // raw numeric value for logical checks; formatting occurs in blades when needed
             'credits_reward_after_verify_discord' => $user_settings->credits_reward_after_verify_discord,
             'force_email_verification' => $user_settings->force_email_verification,
diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index 8180eec58..d007ed29f 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -313,8 +313,7 @@ class="form-control @error('new_password_confirmation') is-invalid @enderror"
                                         <div class="mb-3 col-12 col-sm-6">
                                             <div class="mb-3"><b>{{ __('Two-Factor Authentication') }}</b></div>
 
-                                            @inject('twoFactorService', 'App\Services\TwoFactor\TwoFactorService')
-                                            @foreach($twoFactorService->getAvailableMethodsForUser(Auth::user()) as $method)
+                                            @foreach($availableMethods as $method)
                                                 @include($method->getSettingsView(), ['method' => $method])
                                             @endforeach
                                         </div>

From 7cd96068a0f375d364b1d649e63dd72691385407 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 21:52:56 +0300
Subject: [PATCH 30/53] docs: add warnings and optimize recovery code
 verification logic

---
 app/Extensions/TwoFactor/Dummy/DummyExtension.php     |  5 +++++
 app/Extensions/TwoFactor/Totp/RecoveryCodeService.php | 10 ++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/app/Extensions/TwoFactor/Dummy/DummyExtension.php b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
index 27f0a9787..1749ce026 100644
--- a/app/Extensions/TwoFactor/Dummy/DummyExtension.php
+++ b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
@@ -68,6 +68,11 @@ public function enable(Request $request)
         return response()->json(['message' => 'Dummy 2FA enabled!']);
     }
 
+    /**
+     * NOTE: This is a dummy method for development only.
+     * In a production-ready extension, this method SHOULD require
+     * password or 2FA code verification before disabling.
+     */
     public function disable(Request $request)
     {
         $request->user()->twoFactorMethods()->where('method', 'dummy')->delete();
diff --git a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
index d06de2dcd..07e4bdb02 100644
--- a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
+++ b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
@@ -37,8 +37,14 @@ public function verify(User $user, string $code): bool
         }
 
         $code = strtoupper(preg_replace('/\s+/', '', $code));
-        
-        $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+
+        // Use pre-loaded collection if available to avoid N+1, otherwise query
+        $methods = $user->relationLoaded('twoFactorMethods')
+            ? $user->twoFactorMethods
+            : $user->twoFactorMethods();
+
+        $method = $methods->where('method', 'totp')->first();
+
         if (!$method || !$method->totp_recovery_codes) {
             return false;
         }

From 28b060b0faba1d9845d748b63f3eda282dbf97ab Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 6 May 2026 22:11:23 +0300
Subject: [PATCH 31/53] refactor: 2fa modals and profile views

---
 .../TwoFactor/Totp/views/modals/totp-disable-modal.blade.php  | 4 ++--
 .../Totp/views/modals/totp-view-recovery-modal.blade.php      | 4 ++--
 themes/default/views/profile/index.blade.php                  | 3 ---
 3 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php
index f87f0c8f0..0460911fb 100644
--- a/app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-disable-modal.blade.php
@@ -10,7 +10,7 @@
 
             <div class="modal-body">
                 <p class="text-muted">{{ __('To disable two-factor authentication, please enter your current password and a 2FA code.') }}</p>
-                
+
                 <div class="form-group">
                     <label>{{ __('Current Password') }}</label>
                     <input type="password" x-model="password" class="form-control" :class="{'is-invalid': errors.password}" placeholder="••••••">
@@ -21,7 +21,7 @@
 
                 <div class="form-group">
                     <label>{{ __('Authentication Code') }}</label>
-                    <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000" inputmode="numeric">
+                    <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000">
                     <template x-if="errors.code">
                         <span class="text-danger small" x-text="errors.code"></span>
                     </template>
diff --git a/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
index 351de06f7..c7dbd36a0 100644
--- a/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
@@ -12,7 +12,7 @@
                 <template x-if="!verified">
                     <div>
                         <p class="text-muted">{{ __('To view your recovery codes, please enter your current password and a 2FA code.') }}</p>
-                        
+
                         <div class="form-group">
                             <label>{{ __('Current Password') }}</label>
                             <input type="password" x-model="password" class="form-control" :class="{'is-invalid': errors.password}" placeholder="••••••">
@@ -23,7 +23,7 @@
 
                         <div class="form-group">
                             <label>{{ __('Authentication Code') }}</label>
-                            <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000" inputmode="numeric">
+                            <input type="text" x-model="code" class="form-control" :class="{'is-invalid': errors.code}" placeholder="000000">
                             <template x-if="errors.code">
                                 <span class="text-danger small" x-text="errors.code"></span>
                             </template>
diff --git a/themes/default/views/profile/index.blade.php b/themes/default/views/profile/index.blade.php
index d007ed29f..cab0edb34 100644
--- a/themes/default/views/profile/index.blade.php
+++ b/themes/default/views/profile/index.blade.php
@@ -149,9 +149,6 @@ class='badge'>{{ $role->name }}</span>
                                 <!-- Account Settings Tab -->
                                 <div class="tab-pane fade show active" id="account" role="tabpanel"
                                     aria-labelledby="account-tab">
-                                    <div class="row">
-
-                                    </div>
                                     <div class="row">
                                         <div class="mb-3 col-12 col-sm-6">
                                             <div class="col">

From 3afc51d6c1c20c83fc265d89be0f9bb834473200 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 00:32:16 +0300
Subject: [PATCH 32/53] refactor: use SweetAlert2 toasts instead of toastr for
 2FA

---
 .../views/modals/totp-setup-modal.blade.php   | 22 +++++++++++++++++--
 .../modals/totp-view-recovery-modal.blade.php | 11 +++++++++-
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
index 9f15191ce..a22238780 100644
--- a/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-setup-modal.blade.php
@@ -173,14 +173,32 @@ function totpSetup() {
         copySecret() {
             const rawSecret = this.secret.replace(/\s/g, '');
             navigator.clipboard.writeText(rawSecret).then(() => {
-                toastr.success("{{ __('Secret copied to clipboard') }}");
+                Swal.fire({
+                    icon: 'success',
+                    title: "{{ __('Secret copied to clipboard') }}",
+                    position: 'top-end',
+                    showConfirmButton: false,
+                    background: '#343a40',
+                    toast: true,
+                    timer: 3000,
+                    timerProgressBar: true
+                });
             });
         },
 
         copyAllRecoveryCodes() {
             const text = this.recoveryCodes.join("\n");
             navigator.clipboard.writeText(text).then(() => {
-                toastr.success("{{ __('Recovery codes copied to clipboard') }}");
+                Swal.fire({
+                    icon: 'success',
+                    title: "{{ __('Recovery codes copied to clipboard') }}",
+                    position: 'top-end',
+                    showConfirmButton: false,
+                    background: '#343a40',
+                    toast: true,
+                    timer: 3000,
+                    timerProgressBar: true
+                });
             });
         },
 
diff --git a/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php b/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
index c7dbd36a0..caba93801 100644
--- a/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/modals/totp-view-recovery-modal.blade.php
@@ -124,7 +124,16 @@ function totpViewRecovery() {
         copyAllRecoveryCodes() {
             const text = this.recoveryCodes.join("\n");
             navigator.clipboard.writeText(text).then(() => {
-                toastr.success("{{ __('Recovery codes copied to clipboard') }}");
+                Swal.fire({
+                    icon: 'success',
+                    title: "{{ __('Recovery codes copied to clipboard') }}",
+                    position: 'top-end',
+                    showConfirmButton: false,
+                    background: '#343a40',
+                    toast: true,
+                    timer: 3000,
+                    timerProgressBar: true
+                });
             });
         },
 

From 8a173ba2efd3d0b2589c70a8a1ff85ea60ec6254 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 00:54:09 +0300
Subject: [PATCH 33/53] refactor: use proper dependency injection for 2FA
 services across controllers and extensions

---
 app/Extensions/TwoFactor/Totp/TotpExtension.php |  8 ++++----
 app/Http/Controllers/Auth/LoginController.php   | 14 ++++++++------
 app/Http/Controllers/ProfileController.php      |  7 +++++--
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/TotpExtension.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
index bc4d1aeac..c662d7aff 100644
--- a/app/Extensions/TwoFactor/Totp/TotpExtension.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -18,11 +18,11 @@ class TotpExtension extends TwoFactorExtension
     protected $recoveryCodeService;
     protected $twoFactorService;
 
-    public function __construct()
+    public function __construct(TotpService $totpService, RecoveryCodeService $recoveryCodeService, TwoFactorService $twoFactorService)
     {
-        $this->totpService = app(TotpService::class);
-        $this->recoveryCodeService = app(RecoveryCodeService::class);
-        $this->twoFactorService = app(TwoFactorService::class);
+        $this->totpService = $totpService;
+        $this->recoveryCodeService = $recoveryCodeService;
+        $this->twoFactorService = $twoFactorService;
     }
 
     public function getName(): string
diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 6f370e50d..b5716553f 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -4,6 +4,7 @@
 
 use App\Http\Controllers\Controller;
 use App\Providers\RouteServiceProvider;
+use App\Services\TwoFactor\TwoFactorService;
 use App\Settings\GeneralSettings;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
 use Illuminate\Http\Request;
@@ -31,14 +32,17 @@ class LoginController extends Controller
      */
     protected $redirectTo = RouteServiceProvider::HOME;
 
+    protected $twoFactorService;
+
     /**
      * Create a new controller instance.
      *
      * @return void
      */
-    public function __construct()
+    public function __construct(TwoFactorService $twoFactorService)
     {
         $this->middleware('guest')->except('logout');
+        $this->twoFactorService = $twoFactorService;
     }
 
     /**
@@ -104,13 +108,12 @@ public function login(Request $request, GeneralSettings $general_settings)
      */
     protected function authenticated(Request $request, $user)
     {
-        $twoFactorService = app(\App\Services\TwoFactor\TwoFactorService::class);
-        $methods = $twoFactorService->enabledMethods($user);
+        $methods = $this->twoFactorService->enabledMethods($user);
 
         if ($methods->isNotEmpty()) {
             // Redirect to 2FA challenge if the user has enabled methods but is not yet verified
             // (this is typically the case immediately after a successful password login).
-            if (!$twoFactorService->isVerified($request, $user)) {
+            if (!$this->twoFactorService->isVerified($request, $user)) {
                 return redirect()->route('login.2fa.challenge');
             }
         }
@@ -128,8 +131,7 @@ public function logout(Request $request)
     {
         $user = Auth::user();
         if ($user) {
-            $twoFactorService = app(\App\Services\TwoFactor\TwoFactorService::class);
-            $twoFactorService->clearVerified($request, $user);
+            $this->twoFactorService->clearVerified($request, $user);
         }
 
         $this->guard()->logout();
diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index 8c419aaa4..60b0534a3 100644
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -4,6 +4,7 @@
 
 use App\Facades\Currency;
 use App\Models\User;
+use App\Services\TwoFactor\TwoFactorService;
 use App\Settings\UserSettings;
 use App\Settings\PterodactylSettings;
 use App\Classes\PterodactylClient;
@@ -18,10 +19,12 @@
 class ProfileController extends Controller
 {
     private $pterodactyl;
+    protected $twoFactorService;
 
-    public function __construct(PterodactylSettings $ptero_settings)
+    public function __construct(PterodactylSettings $ptero_settings, TwoFactorService $twoFactorService)
     {
         $this->pterodactyl = new PterodactylClient($ptero_settings);
+        $this->twoFactorService = $twoFactorService;
     }
 
     /** Display a listing of the resource. */
@@ -30,7 +33,7 @@ public function index(UserSettings $user_settings, DiscordSettings $discord_sett
         $user = Auth::user();
         $user->load('twoFactorMethods');
 
-        $availableMethods = app(\App\Services\TwoFactor\TwoFactorService::class)->getAvailableMethodsForUser($user);
+        $availableMethods = $this->twoFactorService->getAvailableMethodsForUser($user);
 
         return view('profile.index')->with([
             'user' => $user,

From 80a536d7b83b1ec2049915a079e41f681fe4ba71 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 00:58:33 +0300
Subject: [PATCH 34/53] style: remove useless coment

---
 app/Http/Middleware/EnsureTwoFactorVerified.php | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/app/Http/Middleware/EnsureTwoFactorVerified.php b/app/Http/Middleware/EnsureTwoFactorVerified.php
index f566c64bc..39cbccdaa 100644
--- a/app/Http/Middleware/EnsureTwoFactorVerified.php
+++ b/app/Http/Middleware/EnsureTwoFactorVerified.php
@@ -33,15 +33,6 @@ public function handle(Request $request, Closure $next): Response
             return $next($request);
         }
 
-        // For settings protection, we only care if they have 2FA enabled AND verified.
-        // If they don't have it enabled, they can't be "verified" in the traditional sense,
-        // but we should probably let them access the settings to enable it.
-        //
-        // This middleware acts as a higher-level guard. If a user has 2FA active,
-        // we shouldn't let them touch sensitive settings
-        // (like viewing recovery codes or disabling 2FA) unless they've recently
-        // provided a valid code. This prevents session hijacking from compromising 2FA.
-
         if ($this->twoFactorService->enabledMethods($user)->isNotEmpty() && !$this->twoFactorService->isVerified($request, $user)) {
             return redirect()->route('login.2fa.challenge');
         }

From ab407a58b0e9a613a27875b4259844b42a0bf299 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 01:23:40 +0300
Subject: [PATCH 35/53] fix: lower throttle limits for some 2fa routes

---
 app/Providers/RouteServiceProvider.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 54b027b11..74dcf1c5f 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -58,11 +58,11 @@ protected function configureRateLimiting()
         });
 
         RateLimiter::for('2fa.setup', function (Request $request) {
-            return Limit::perMinute(10)->by($request->user()?->id ?: $request->ip());
+            return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
         });
 
         RateLimiter::for('2fa.enable', function (Request $request) {
-            return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
+            return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
         });
 
         RateLimiter::for('2fa.action', function (Request $request) {

From 997bdd93324d2e556e971d2a31e1847dec0134fe Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 01:43:22 +0300
Subject: [PATCH 36/53] feat: add 2FA status badge to admin datatable and raw
 method names to user show page

---
 app/Http/Controllers/Admin/UserController.php | 22 ++++++++++++++++---
 .../default/views/admin/users/index.blade.php |  5 +++++
 .../default/views/admin/users/show.blade.php  | 20 ++++++++++++-----
 3 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/app/Http/Controllers/Admin/UserController.php b/app/Http/Controllers/Admin/UserController.php
index 51ca1f838..5689027e3 100644
--- a/app/Http/Controllers/Admin/UserController.php
+++ b/app/Http/Controllers/Admin/UserController.php
@@ -53,10 +53,12 @@ class UserController extends Controller
 
 
     private $pterodactyl;
+    protected $twoFactorService;
 
-    public function __construct(PterodactylSettings $ptero_settings)
+    public function __construct(PterodactylSettings $ptero_settings, \App\Services\TwoFactor\TwoFactorService $twoFactorService)
     {
         $this->pterodactyl = new PterodactylClient($ptero_settings);
+        $this->twoFactorService = $twoFactorService;
     }
 
     /**
@@ -88,6 +90,12 @@ public function show(User $user, LocaleSettings $locale_settings, GeneralSetting
     {
         $this->checkPermission(self::READ_PERMISSION);
 
+        $user->load('twoFactorMethods');
+        $enabled2faMethods = $user->twoFactorMethods
+            ->where('is_enabled', true)
+            ->pluck('method')
+            ->implode(' / ');
+
         $referralRecords = DB::table('user_referrals')->where('referral_id', '=', $user->id)->get();
         $allReferrals = [];
 
@@ -136,6 +144,7 @@ public function show(User $user, LocaleSettings $locale_settings, GeneralSetting
         return view('admin.users.show')->with([
             'user' => $user,
             'referrals' => $allReferrals,
+            'enabled2faMethods' => $enabled2faMethods,
             'locale_datatables' => $locale_settings->datatables,
             'credits_display_name' => $general_settings->credits_display_name
         ]);
@@ -485,7 +494,7 @@ public function dataTable(Request $request)
     {
         $this->checkPermission(self::READ_PERMISSION);
 
-        $query = User::with('discordUser')
+        $query = User::with('discordUser', 'twoFactorMethods')
             ->withCount('servers')
             ->leftJoin('model_has_roles', 'users.id', '=', 'model_has_roles.model_id')
             ->leftJoin('roles', 'model_has_roles.role_id', '=', 'roles.id')
@@ -502,6 +511,13 @@ public function dataTable(Request $request)
             ->addColumn('verified', function (User $user) {
                 return $user->getVerifiedStatus();
             })
+            ->addColumn('two_factor', function (User $user) {
+                $enabled = $user->twoFactorMethods->where('is_enabled', true)->isNotEmpty();
+                if ($enabled) {
+                    return '<span class="badge badge-success">' . __('Enabled') . '</span>';
+                }
+                return '<span class="badge badge-secondary">' . __('Disabled') . '</span>';
+            })
             ->addColumn('discordId', function (User $user) {
                 return $user->discordUser ? $user->discordUser->id : '';
             })
@@ -542,7 +558,7 @@ public function dataTable(Request $request)
                 return '<a class="text-info" target="_blank" href="' . $ptero_settings->panel_url . '/admin/users/view/' . $user->pterodactyl_id . '">' . e($user->name) . '</a>';
             })
             ->orderColumn('role', 'role_name $1')
-            ->rawColumns(['avatar', 'name', 'credits', 'role', 'usage',  'actions'])
+            ->rawColumns(['avatar', 'name', 'credits', 'role', 'usage', 'two_factor', 'actions'])
             ->make();
     }
 }
diff --git a/themes/default/views/admin/users/index.blade.php b/themes/default/views/admin/users/index.blade.php
index 29d8f7171..70db0cd6d 100644
--- a/themes/default/views/admin/users/index.blade.php
+++ b/themes/default/views/admin/users/index.blade.php
@@ -50,6 +50,7 @@ class="mr-1 fas fa-paper-plane"></i>{{ __('Notify') }}</a>
                             <th>{{__('Servers')}}</th>
                             <th>{{__('Referrals')}}</th>
                             <th>{{__('Verified')}}</th>
+                            <th>{{__('2FA')}}</th>
                             <th>{{__('Last seen')}}</th>
                             <th></th>
                         </tr>
@@ -129,6 +130,10 @@ function submitResult() {
                         data: 'verified',
                         sortable: false
                     },
+                    {
+                        data: 'two_factor',
+                        sortable: false
+                    },
                     {
                         data: 'last_seen',
                     },
diff --git a/themes/default/views/admin/users/show.blade.php b/themes/default/views/admin/users/show.blade.php
index 2b6d3f0e9..3cfe77136 100644
--- a/themes/default/views/admin/users/show.blade.php
+++ b/themes/default/views/admin/users/show.blade.php
@@ -183,7 +183,7 @@ class='badge'>{{ $role->name }}</span>
                                 </div>
                                 <div class="col-lg-8">
                                     <span style="max-width: 250px;" class="d-inline-block text-truncate">
-                                        {{ $user->ip }}
+                                        {{ is_null($user->ip) ? __('N/A') : $user->ip }}
                                     </span>
                                 </div>
                             </div>
@@ -208,7 +208,7 @@ class="mr-2 fas fa-coins"></i>{{ Currency::formatForDisplay($user->creditUsage()
                                 </div>
                                 <div class="col-lg-8">
                                     <span style="max-width: 250px;" class="d-inline-block text-truncate">
-                                        {{ $user->referredBy() != null ? $user->referredBy()->name : 'None' }}
+                                        {{  is_null($user->referredBy()) ? __('None') : $user->referredBy()->name }}
                                     </span>
                                 </div>
                             </div>
@@ -226,9 +226,6 @@ class="mr-2 fas fa-coins"></i>{{ Currency::formatForDisplay($user->creditUsage()
                             </div>
                         </div>
 
-                        <div class="col-lg-6">
-                        </div>
-
                         <div class="col-lg-6">
                             <div class="row">
                                 <div class="col-lg-4">
@@ -246,6 +243,19 @@ class="mr-2 fas fa-coins"></i>{{ Currency::formatForDisplay($user->creditUsage()
                             </div>
                         </div>
 
+                        <div class="col-lg-6">
+                            <div class="row">
+                                <div class="col-lg-4">
+                                    <label>{{ __('Enabled 2FA Methods') }}</label>
+                                </div>
+                                <div class="col-lg-8">
+                                    <span style="max-width: 250px;" class="d-inline-block text-truncate">
+                                        {{ is_null($enabled2faMethods) ? __('None') : $enabled2faMethods }}
+                                    </span>
+                                </div>
+                            </div>
+                        </div>
+
 
                     </div>
 

From 19e24e44bfdeed260a26bd69025aae8b38b381cb Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 01:52:42 +0300
Subject: [PATCH 37/53] feat: add cp:user:2fa:disable artisan command for 2FA
 recovery

---
 .../Commands/User/DisableTwoFactorCommand.php | 135 ++++++++++++++++++
 1 file changed, 135 insertions(+)
 create mode 100644 app/Console/Commands/User/DisableTwoFactorCommand.php

diff --git a/app/Console/Commands/User/DisableTwoFactorCommand.php b/app/Console/Commands/User/DisableTwoFactorCommand.php
new file mode 100644
index 000000000..ca3639457
--- /dev/null
+++ b/app/Console/Commands/User/DisableTwoFactorCommand.php
@@ -0,0 +1,135 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Models\User;
+use App\Models\UserTwoFactorMethod;
+use App\Services\TwoFactor\TwoFactorService;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\DB;
+
+class DisableTwoFactorCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'cp:user:2fa:disable {search? : The ID, Email, Username or Discord ID of the user}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Forcibly disable 2FA methods for a user';
+
+    protected $twoFactorService;
+
+    public function __construct(TwoFactorService $twoFactorService)
+    {
+        parent::__construct();
+        $this->twoFactorService = $twoFactorService;
+    }
+
+    /**
+     * Execute the console command.
+     */
+    public function handle()
+    {
+        $search = $this->argument('search');
+
+        if (!$search) {
+            $search = $this->ask('Please enter User ID, Email, Username or Discord ID');
+        }
+
+        if (!$search) {
+            $this->error('No search term provided.');
+            return 1;
+        }
+
+        $user = User::query()
+            ->where('id', $search)
+            ->orWhere('email', $search)
+            ->orWhere('name', $search)
+            ->orWhereHas('discordUser', function ($query) use ($search) {
+                $query->where('id', $search);
+            })
+            ->first();
+
+        if (!$user) {
+            $this->error("User not found with term: {$search}");
+            return 1;
+        }
+
+        $this->info("Found User: {$user->name} ({$user->email}) [ID: {$user->id}]");
+
+        $methods = $user->twoFactorMethods()->where('is_enabled', true)->get();
+
+        if ($methods->isEmpty()) {
+            $this->warn('This user does not have any 2FA methods enabled.');
+            return 0;
+        }
+
+        $choices = $methods->mapWithKeys(function ($m) {
+            $label = $this->twoFactorService->getExtension($m->method)?->getLabel() ?? ucfirst($m->method);
+            return [$m->method => "{$label} ({$m->method})"];
+        })->toArray();
+
+        $choices['all'] = 'Disable ALL methods';
+
+        $selected = $this->choice(
+            'Which 2FA methods do you want to disable?',
+            $choices,
+            null,
+            null,
+            true // Multiple selection
+        );
+
+        if (empty($selected)) {
+            $this->info('Nothing selected. Aborting.');
+            return 0;
+        }
+
+        if (in_array('Disable ALL methods', $selected) || in_array('all', $selected)) {
+            if ($this->confirm("Are you sure you want to disable ALL 2FA methods for {$user->name}?", true)) {
+                $user->twoFactorMethods()->delete();
+                $this->twoFactorService->clearVerified(request(), $user);
+                $this->success("Successfully disabled all 2FA methods for {$user->name}.");
+            }
+            return 0;
+        }
+
+        // Map back titles to keys if necessary (Laravel's choice with multiple can return values or keys depending on version/selection)
+        $methodKeys = [];
+        foreach ($selected as $choice) {
+            $key = array_search($choice, $choices);
+            if ($key !== false) {
+                $methodKeys[] = $key;
+            } else {
+                // If it already returned the key
+                if (isset($choices[$choice])) {
+                    $methodKeys[] = $choice;
+                }
+            }
+        }
+
+        if ($this->confirm("Disable selected methods: " . implode(', ', $methodKeys) . "?", true)) {
+            $user->twoFactorMethods()->whereIn('method', $methodKeys)->delete();
+            
+            // If we disabled everything, clear verified state
+            if ($user->twoFactorMethods()->where('is_enabled', true)->count() === 0) {
+                $this->twoFactorService->clearVerified(request(), $user);
+            }
+            
+            $this->success("Successfully disabled " . implode(', ', $methodKeys) . " for {$user->name}.");
+        }
+
+        return 0;
+    }
+
+    protected function success($message)
+    {
+        $this->output->writeln("<fg=green;options=bold> SUCCESS </> $message");
+    }
+}

From 606043cdf17a4119c97d5326fb7398de6941e18d Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 01:57:49 +0300
Subject: [PATCH 38/53] fix: make TwoFactorService CLI-safe by checking for
 active session

---
 app/Services/TwoFactor/TwoFactorService.php | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index 411da073d..be606a5cd 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -76,7 +76,9 @@ public function getAvailableMethodsForUser(User $user): Collection
      */
     public function markVerified(Request $request, User $user): void
     {
-        $request->session()->put('two_factor_verified', true);
+        if ($request->hasSession()) {
+            $request->session()->put('two_factor_verified', true);
+        }
 
         // If remember_web cookie is present, store verification token in DB
         $cookieName = Auth::guard('web')->getRecallerName();
@@ -100,7 +102,7 @@ public function markVerified(Request $request, User $user): void
     public function isVerified(Request $request, User $user): bool
     {
         // 1. Session check - always authoritative for the current session
-        if ($request->session()->get('two_factor_verified') === true) {
+        if ($request->hasSession() && $request->session()->get('two_factor_verified') === true) {
             return true;
         }
 
@@ -115,7 +117,9 @@ public function isVerified(Request $request, User $user): bool
                     ->first();
 
                 if ($token) {
-                    $request->session()->put('two_factor_verified', true);
+                    if ($request->hasSession()) {
+                        $request->session()->put('two_factor_verified', true);
+                    }
                     return true;
                 }
             }
@@ -129,7 +133,9 @@ public function isVerified(Request $request, User $user): bool
      */
     public function clearVerified(Request $request, User $user): void
     {
-        $request->session()->forget('two_factor_verified');
+        if ($request->hasSession()) {
+            $request->session()->forget('two_factor_verified');
+        }
 
         $rememberToken = $user->getRememberToken();
         if ($rememberToken) {

From 784b4e20892b33584fa09b462f374353cfbd3769 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 02:44:47 +0300
Subject: [PATCH 39/53] fix: display none if no 2fa methods activated

---
 themes/default/views/admin/users/show.blade.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/themes/default/views/admin/users/show.blade.php b/themes/default/views/admin/users/show.blade.php
index 3cfe77136..f91adc8c3 100644
--- a/themes/default/views/admin/users/show.blade.php
+++ b/themes/default/views/admin/users/show.blade.php
@@ -250,7 +250,7 @@ class="mr-2 fas fa-coins"></i>{{ Currency::formatForDisplay($user->creditUsage()
                                 </div>
                                 <div class="col-lg-8">
                                     <span style="max-width: 250px;" class="d-inline-block text-truncate">
-                                        {{ is_null($enabled2faMethods) ? __('None') : $enabled2faMethods }}
+                                        {{ empty($enabled2faMethods) ? __('None') : $enabled2faMethods }}
                                     </span>
                                 </div>
                             </div>

From 1738a2755b66ec5ad2bafcd1e9135142bf3b1fc4 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 7 May 2026 02:48:53 +0300
Subject: [PATCH 40/53] refactor: disable 2fa command

---
 .../Commands/{User => }/DisableTwoFactorCommand.php       | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)
 rename app/Console/Commands/{User => }/DisableTwoFactorCommand.php (96%)

diff --git a/app/Console/Commands/User/DisableTwoFactorCommand.php b/app/Console/Commands/DisableTwoFactorCommand.php
similarity index 96%
rename from app/Console/Commands/User/DisableTwoFactorCommand.php
rename to app/Console/Commands/DisableTwoFactorCommand.php
index ca3639457..15da728c5 100644
--- a/app/Console/Commands/User/DisableTwoFactorCommand.php
+++ b/app/Console/Commands/DisableTwoFactorCommand.php
@@ -1,12 +1,10 @@
 <?php
 
-namespace App\Console\Commands\User;
+namespace App\Console\Commands;
 
 use App\Models\User;
-use App\Models\UserTwoFactorMethod;
 use App\Services\TwoFactor\TwoFactorService;
 use Illuminate\Console\Command;
-use Illuminate\Support\Facades\DB;
 
 class DisableTwoFactorCommand extends Command
 {
@@ -116,12 +114,12 @@ public function handle()
 
         if ($this->confirm("Disable selected methods: " . implode(', ', $methodKeys) . "?", true)) {
             $user->twoFactorMethods()->whereIn('method', $methodKeys)->delete();
-            
+
             // If we disabled everything, clear verified state
             if ($user->twoFactorMethods()->where('is_enabled', true)->count() === 0) {
                 $this->twoFactorService->clearVerified(request(), $user);
             }
-            
+
             $this->success("Successfully disabled " . implode(', ', $methodKeys) . " for {$user->name}.");
         }
 

From b78e59264ede2101df0b256c8fae569e403a3d32 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 13 May 2026 00:33:31 +0300
Subject: [PATCH 41/53] refactor: remove unused TwoFactorService dependency
 from UserController

---
 app/Http/Controllers/Admin/UserController.php | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/app/Http/Controllers/Admin/UserController.php b/app/Http/Controllers/Admin/UserController.php
index 5689027e3..343abb587 100644
--- a/app/Http/Controllers/Admin/UserController.php
+++ b/app/Http/Controllers/Admin/UserController.php
@@ -53,12 +53,10 @@ class UserController extends Controller
 
 
     private $pterodactyl;
-    protected $twoFactorService;
 
-    public function __construct(PterodactylSettings $ptero_settings, \App\Services\TwoFactor\TwoFactorService $twoFactorService)
+    public function __construct(PterodactylSettings $ptero_settings)
     {
         $this->pterodactyl = new PterodactylClient($ptero_settings);
-        $this->twoFactorService = $twoFactorService;
     }
 
     /**

From 7e1b5a9a6c1699f5037b7f16396fb935807b5cb2 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 13 May 2026 00:37:37 +0300
Subject: [PATCH 42/53] security: restrict Dummy 2FA extension to local
 environment only

---
 .../TwoFactor/Dummy/DummyExtension.php        | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/app/Extensions/TwoFactor/Dummy/DummyExtension.php b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
index 1749ce026..32573e890 100644
--- a/app/Extensions/TwoFactor/Dummy/DummyExtension.php
+++ b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
@@ -36,26 +36,46 @@ public function isAvailable(User $user): bool
 
     public function getSettingsView(): string
     {
+        if (!app()->environment('local')) {
+            abort(403);
+        }
+
         return 'twofactor_dummy::profile_card';
     }
 
     public function getChallengeView(): string
     {
+        if (!app()->environment('local')) {
+            abort(403);
+        }
+
         return 'twofactor_dummy::auth.two-factor.dummy-challenge';
     }
 
     public function verify(Request $request): bool
     {
+        if (!app()->environment('local')) {
+            abort(403);
+        }
+
         return $request->input('code') === '123456';
     }
 
     public function setup(Request $request)
     {
+        if (!app()->environment('local')) {
+            abort(403);
+        }
+
         return response()->json(['message' => 'Dummy setup ready. Use code 123456 to enable.']);
     }
 
     public function enable(Request $request)
     {
+        if (!app()->environment('local')) {
+            abort(403);
+        }
+
         if ($request->input('code') !== '123456') {
              return response()->json(['errors' => ['code' => ['Use 123456']]], 422);
         }
@@ -75,6 +95,10 @@ public function enable(Request $request)
      */
     public function disable(Request $request)
     {
+        if (!app()->environment('local')) {
+            abort(403);
+        }
+
         $request->user()->twoFactorMethods()->where('method', 'dummy')->delete();
         return response()->json(['message' => 'Dummy 2FA disabled.']);
     }

From 5b215a9b5bdcfa2fb4907d322f8ac03537c6591e Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 13 May 2026 00:59:24 +0300
Subject: [PATCH 43/53] feat: implement dynamic, extension-aware 2FA rate
 limiting

---
 app/Classes/TwoFactorExtension.php     | 19 ++++++++++++++
 app/Providers/RouteServiceProvider.php | 36 ++++++++++++++++++++------
 routes/web.php                         |  2 +-
 3 files changed, 48 insertions(+), 9 deletions(-)

diff --git a/app/Classes/TwoFactorExtension.php b/app/Classes/TwoFactorExtension.php
index a5ccd4504..6a4fc22af 100644
--- a/app/Classes/TwoFactorExtension.php
+++ b/app/Classes/TwoFactorExtension.php
@@ -75,6 +75,25 @@ public function getAllowedActions(): array
         return [];
     }
 
+    /**
+     * Get the rate limit for a specific action.
+     * 
+     * @param string $action (setup, enable, disable, verify, action)
+     * @return array ['attempts' => int, 'minutes' => int]
+     */
+    public function getRateLimit(string $action): array
+    {
+        $defaults = [
+            'setup'   => ['attempts' => 3, 'minutes' => 1],
+            'enable'  => ['attempts' => 3, 'minutes' => 1],
+            'disable' => ['attempts' => 3, 'minutes' => 1],
+            'verify'  => ['attempts' => 5, 'minutes' => 1],
+            'action'  => ['attempts' => 3, 'minutes' => 5], // Default 3 per 5 mins for sensitive actions
+        ];
+
+        return $this->getConfig()['rate_limits'][$action] ?? $defaults[$action];
+    }
+
     /**
      * Get method-specific routes configuration if any.
      */
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 74dcf1c5f..cab2fc8d5 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -49,24 +49,44 @@ protected function configureRateLimiting()
         RateLimiter::for('api', function (Request $request) {
             return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
         });
-        RateLimiter::for('web', function (Request $request) {
-            return Limit::perMinute(40)->by($request->user()?->id ?: $request->ip());
-        });
-
         RateLimiter::for('2fa.verify', function (Request $request) {
-            return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
+            $method = $request->route('method');
+            $limit = app(\App\Services\TwoFactor\TwoFactorService::class)->getExtension($method)?->getRateLimit('verify')
+                     ?? ['attempts' => 5, 'minutes' => 1];
+
+            return Limit::perMinutes($limit['minutes'], $limit['attempts'])->by($request->user()?->id ?: $request->ip());
         });
 
         RateLimiter::for('2fa.setup', function (Request $request) {
-            return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
+            $method = $request->route('method');
+            $limit = app(\App\Services\TwoFactor\TwoFactorService::class)->getExtension($method)?->getRateLimit('setup')
+                     ?? ['attempts' => 3, 'minutes' => 1];
+
+            return Limit::perMinutes($limit['minutes'], $limit['attempts'])->by($request->user()?->id ?: $request->ip());
         });
 
         RateLimiter::for('2fa.enable', function (Request $request) {
-            return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
+            $method = $request->route('method');
+            $limit = app(\App\Services\TwoFactor\TwoFactorService::class)->getExtension($method)?->getRateLimit('enable')
+                     ?? ['attempts' => 3, 'minutes' => 1];
+
+            return Limit::perMinutes($limit['minutes'], $limit['attempts'])->by($request->user()?->id ?: $request->ip());
+        });
+
+        RateLimiter::for('2fa.disable', function (Request $request) {
+            $method = $request->route('method');
+            $limit = app(\App\Services\TwoFactor\TwoFactorService::class)->getExtension($method)?->getRateLimit('disable')
+                     ?? ['attempts' => 3, 'minutes' => 1];
+
+            return Limit::perMinutes($limit['minutes'], $limit['attempts'])->by($request->user()?->id ?: $request->ip());
         });
 
         RateLimiter::for('2fa.action', function (Request $request) {
-            return Limit::perMinutes(5, 3)->by($request->user()?->id ?: $request->ip());
+            $method = $request->route('method');
+            $limit = app(\App\Services\TwoFactor\TwoFactorService::class)->getExtension($method)?->getRateLimit('action')
+                     ?? ['attempts' => 3, 'minutes' => 5];
+
+            return Limit::perMinutes($limit['minutes'], $limit['attempts'])->by($request->user()?->id ?: $request->ip());
         });
     }
 }
diff --git a/routes/web.php b/routes/web.php
index deb656bec..075d19f4e 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -78,7 +78,7 @@
         ->group(function () {
             Route::post('/{method}/setup', [TwoFactorExtensionController::class, 'setup'])->name('setup')->middleware('throttle:2fa.setup')->where('method', '[a-z_]+');
             Route::post('/{method}/enable', [TwoFactorExtensionController::class, 'enable'])->name('enable')->middleware('throttle:2fa.enable')->where('method', '[a-z_]+');
-            Route::post('/{method}/disable', [TwoFactorExtensionController::class, 'disable'])->name('disable')->middleware('throttle:2fa.verify')->where('method', '[a-z_]+');
+            Route::post('/{method}/disable', [TwoFactorExtensionController::class, 'disable'])->name('disable')->middleware('throttle:2fa.disable')->where('method', '[a-z_]+');
             Route::post('/{method}/{action}', [TwoFactorExtensionController::class, 'action'])->name('action')->middleware('throttle:2fa.action')->where(['method' => '[a-z_]+', 'action' => '[a-zA-Z_]+']);
         });
 

From 6b166d6035bb0052d41baaa4d9cd8dde7e2562e5 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 13 May 2026 01:09:24 +0300
Subject: [PATCH 44/53] docs: complete 2FA modular system documentation with
 custom routes and full structure map

---
 app/Extensions/TwoFactor/README.md | 107 +++++++++++++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 app/Extensions/TwoFactor/README.md

diff --git a/app/Extensions/TwoFactor/README.md b/app/Extensions/TwoFactor/README.md
new file mode 100644
index 000000000..de0255831
--- /dev/null
+++ b/app/Extensions/TwoFactor/README.md
@@ -0,0 +1,107 @@
+# Modular Two-Factor Authentication (2FA) System
+
+CtrlPanel.gg features a fully modular 2FA system that allows developers to add new authentication methods (e.g., SMS, Email, WebAuthn) without modifying the core codebase. Each method is a self-contained extension.
+
+---
+
+## 1. Directory Structure
+
+Every 2FA extension resides in `app/Extensions/TwoFactor/{MethodName}/`.
+
+```text
+app/Extensions/TwoFactor/YourMethod/
+├── migrations/             # Database changes specific to this method
+├── views/                  # Blade templates (settings, challenges)
+│   ├── auth/two-factor/    # Recommended path for challenge views
+│   └── profile_card.blade.php
+├── YourMethodExtension.php # The main extension class
+├── routes.php              # (Optional) Custom routes for this method
+└── YourMethodService.php   # (Optional) Helper services
+```
+
+---
+
+## 2. The Extension Class
+
+Your main class must extend `App\Classes\TwoFactorExtension`.
+
+### Required Methods
+- `getName()`: Technical identifier (e.g., `totp`). Used in routes and namespaces.
+- `getLabel()`: User-friendly name (e.g., `Authenticator App`).
+- `getIcon()`: FontAwesome icon class (e.g., `fas fa-mobile-alt`).
+- `getDescription()`: Short description shown in the picker.
+- `getSettingsView()`: Name of the Blade view for the profile card.
+- `getChallengeView()`: Name of the Blade view for the login screen.
+- `verify(Request $request)`: Logic to validate the user's code/token.
+- `setup(Request $request)`: Initialization logic (e.g., generating a QR code).
+- `enable(Request $request)`: Final logic to enable the method for the user.
+- `disable(Request $request)`: Logic to remove the method from the user.
+
+---
+
+## 3. Advanced Features
+
+### Dynamic Rate Limiting
+You can control the load of your extension by overriding `getRateLimit(string $action)`. This prevents abuse, such as OTP spamming.
+
+```php
+public function getRateLimit(string $action): array
+{
+    if ($action === 'action') { // Custom actions like "Resend Email"
+        return ['attempts' => 1, 'minutes' => 5]; // 1 request every 5 minutes
+    }
+    return parent::getRateLimit($action);
+}
+```
+
+### Action Whitelisting
+To call custom methods on your extension via the universal route `POST /profile/security/2fa/{method}/{action}`, you must whitelist them in `getAllowedActions()`.
+
+```php
+public function getAllowedActions(): array
+{
+    return ['resendEmail', 'verifyCustomToken'];
+}
+```
+
+### Database & Migrations
+If your method needs custom columns (e.g., `phone_number`), create a migration in your extension's `migrations/` folder. It will be loaded automatically.
+**Note:** Use `Schema::table('user_two_factor_methods', ...)` to extend the core table.
+
+### Custom Routes
+If the standard `setup`, `enable`, `disable`, and `action` routes are not enough for your method, you can define your own routes in a `routes.php` file within your extension directory.
+
+The system will automatically load this file. It is recommended to use your extension's name as a prefix and apply the necessary middleware:
+
+```php
+// app/Extensions/TwoFactor/YourMethod/routes.php
+use Illuminate\Support\Facades\Route;
+
+Route::middleware(['web', 'auth', 'two_factor.verified'])->group(function () {
+    Route::post('profile/security/2fa/your-method/special-action', [YourController::class, 'handle'])
+        ->name('profile.2fa.your-method.special-action');
+});
+```
+
+---
+
+## 4. Theming & View Overrides
+
+The system uses Laravel’s `loadViewsFrom` with a dynamic namespace pattern: `twofactor_{method_name}`.
+
+### How It Works
+When you call `view('twofactor_totp::profile_card')`, the system searches in this order:
+1. **Active Theme**: `themes/{theme}/views/vendor/twofactor_totp/profile_card.blade.php`
+2. **Extension Default**: `app/Extensions/TwoFactor/Totp/views/profile_card.blade.php`
+
+### Common Override Paths
+- **Method Picker**: `themes/{theme}/views/auth/two-factor/picker.blade.php` (Core view)
+- **Method Card**: `themes/{theme}/views/vendor/twofactor_{method}/profile_card.blade.php`
+- **Method Challenge**: `themes/{theme}/views/vendor/twofactor_{method}/auth/two-factor/{method}-challenge.blade.php`
+
+---
+
+## 5. Security Best Practices
+1. **Environment Checks**: For development-only methods, use `app()->environment('local')` in `isAvailable()`.
+2. **Encryption**: Always `encrypt()` sensitive data (secrets, tokens) before saving to the database and `decrypt()` when retrieving.
+3. **Verification**: Always require a password check or a valid 2FA code in the `disable()` method.

From 22ef0dc51e85c710e1448fe889de446398ea72ac Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Wed, 13 May 2026 01:12:36 +0300
Subject: [PATCH 45/53] fix: restore accidentally removed web rate limiter

---
 app/Extensions/TwoFactor/THEMING.md    | 58 --------------------------
 app/Providers/RouteServiceProvider.php |  3 ++
 2 files changed, 3 insertions(+), 58 deletions(-)
 delete mode 100644 app/Extensions/TwoFactor/THEMING.md

diff --git a/app/Extensions/TwoFactor/THEMING.md b/app/Extensions/TwoFactor/THEMING.md
deleted file mode 100644
index de79c89ab..000000000
--- a/app/Extensions/TwoFactor/THEMING.md
+++ /dev/null
@@ -1,58 +0,0 @@
-## 2FA Views Override System
-
-One of the strongest aspects of the current implementation is how flexible view overriding is.
-By using Laravel’s standard `loadViewsFrom` mechanism with namespaces, any theme can override views of any 2FA extension.
-
----
-
-### How It Works
-
-When an extension (for example, TOTP) calls:
-
-`view('twofactor_totp::profile_card')`
-
-Laravel (along with the theme system) resolves the view using the following priority:
-
-1. Active theme  
-   `themes/{theme}/views/vendor/twofactor_totp/profile_card.blade.php`
-
-2. Default extension view (fallback)  
-   `app/Extensions/TwoFactor/Totp/views/profile_card.blade.php`
-
----
-
-### Examples for Theme Developers
-
-#### 1. Override the 2FA method picker screen
-
-Create the file:  
-`themes/{theme}/views/auth/two-factor/picker.blade.php`
-
-This view is not namespaced, so it behaves like a regular panel view.
-
----
-
-#### 2. Override the TOTP profile card
-
-Create the file:  
-`themes/{theme}/views/vendor/twofactor_totp/profile_card.blade.php`
-
----
-
-#### 3. Override the TOTP challenge screen (code input)
-
-Create the file:  
-`themes/{theme}/views/vendor/twofactor_totp/auth/two-factor/totp-challenge.blade.php`
-
----
-
-### Notes for Developers
-
-In ExtensionServiceProvider, the view namespace is automatically generated using the pattern:
-
-`{namespace_folder}_{method_name}`
-
-Example:
-`twofactor_totp`
-
-This ensures that any new 2FA extension works out of the box with the same override system.
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index cab2fc8d5..1839fc199 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -49,6 +49,9 @@ protected function configureRateLimiting()
         RateLimiter::for('api', function (Request $request) {
             return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
         });
+        RateLimiter::for('web', function (Request $request) {
+            return Limit::perMinute(40)->by($request->user()?->id ?: $request->ip());
+        });
         RateLimiter::for('2fa.verify', function (Request $request) {
             $method = $request->route('method');
             $limit = app(\App\Services\TwoFactor\TwoFactorService::class)->getExtension($method)?->getRateLimit('verify')

From 03c402c3575bcb1460de00b5dedb6100076d8910 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 13:10:14 +0300
Subject: [PATCH 46/53] refactor: optimize TwoFactor extension settings

---
 app/Classes/TwoFactorExtension.php            | 21 +++------------
 .../Commands/DisableTwoFactorCommand.php      |  2 +-
 .../TwoFactor/Dummy/DummyExtension.php        | 26 +++++++------------
 .../Dummy/views/profile_card.blade.php        |  8 +++---
 app/Extensions/TwoFactor/README.md            |  5 +---
 .../TwoFactor/Totp/TotpExtension.php          | 24 ++++++-----------
 .../Totp/views/profile_card.blade.php         |  8 +++---
 app/Services/TwoFactor/TwoFactorService.php   |  2 +-
 .../views/auth/two-factor/picker.blade.php    |  8 +++---
 9 files changed, 36 insertions(+), 68 deletions(-)

diff --git a/app/Classes/TwoFactorExtension.php b/app/Classes/TwoFactorExtension.php
index 6a4fc22af..27f1e7ae1 100644
--- a/app/Classes/TwoFactorExtension.php
+++ b/app/Classes/TwoFactorExtension.php
@@ -8,24 +8,11 @@
 abstract class TwoFactorExtension extends AbstractExtension
 {
     /**
-     * Get the unique identifier for this 2FA method.
-     */
-    abstract public function getName(): string;
-
-    /**
-     * Get the display label for this 2FA method.
-     */
-    abstract public function getLabel(): string;
-
-    /**
-     * Get the FontAwesome icon for this 2FA method.
-     */
-    abstract public function getIcon(): string;
-
-    /**
-     * Get a short description for this 2FA method.
+     * Get settings array or a specific setting by key.
+     *
+     * Expected keys in array: name, label, icon, description
      */
-    abstract public function getDescription(): string;
+    abstract public function getSettings(?string $key = null): mixed;
 
     /**
      * Check if this 2FA method is available for the given user.
diff --git a/app/Console/Commands/DisableTwoFactorCommand.php b/app/Console/Commands/DisableTwoFactorCommand.php
index 15da728c5..22ec44f60 100644
--- a/app/Console/Commands/DisableTwoFactorCommand.php
+++ b/app/Console/Commands/DisableTwoFactorCommand.php
@@ -70,7 +70,7 @@ public function handle()
         }
 
         $choices = $methods->mapWithKeys(function ($m) {
-            $label = $this->twoFactorService->getExtension($m->method)?->getLabel() ?? ucfirst($m->method);
+            $label = $this->twoFactorService->getExtension($m->method)?->getSettings('label') ?? ucfirst($m->method);
             return [$m->method => "{$label} ({$m->method})"];
         })->toArray();
 
diff --git a/app/Extensions/TwoFactor/Dummy/DummyExtension.php b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
index 32573e890..ef5259441 100644
--- a/app/Extensions/TwoFactor/Dummy/DummyExtension.php
+++ b/app/Extensions/TwoFactor/Dummy/DummyExtension.php
@@ -9,24 +9,16 @@
 
 class DummyExtension extends TwoFactorExtension
 {
-    public function getName(): string
+    public function getSettings(?string $key = null): mixed
     {
-        return 'dummy';
-    }
-
-    public function getLabel(): string
-    {
-        return __('Dummy 2FA (Test)');
-    }
-
-    public function getIcon(): string
-    {
-        return 'fas fa-flask';
-    }
-
-    public function getDescription(): string
-    {
-        return __('A temporary method for testing modular 2FA.');
+        $settings = [
+            'name' => 'dummy',
+            'label' => __('Dummy 2FA'),
+            'icon' => 'fas fa-flask',
+            'description' => __('A temporary non-production method for testing modular 2FA.'),
+        ];
+
+        return $key ? ($settings[$key] ?? null) : $settings;
     }
 
     public function isAvailable(User $user): bool
diff --git a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
index a0dce56ab..46f999016 100644
--- a/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Dummy/views/profile_card.blade.php
@@ -5,7 +5,7 @@
             <div class="d-flex flex-column flex-md-row align-items-start align-items-md-center w-100">
                 <!-- Mobile row -->
                 <div class="d-flex align-items-center justify-content-between w-100 d-md-none">
-                    <i class="{{ $method->getIcon() }} fa-2x text-muted"></i>
+                    <i class="{{ $method->getSettings('icon') }} fa-2x text-muted"></i>
 
                     @if($dummy)
                         <span class="badge badge-success">{{ __('Enabled') }}</span>
@@ -14,10 +14,10 @@
                     @endif
                 </div>
                 <!-- Desktop icon and text -->
-                <i class="d-none d-md-inline-block mr-md-3 {{ $method->getIcon() }} fa-2x text-muted"></i>
+                <i class="d-none d-md-inline-block mr-md-3 {{ $method->getSettings('icon') }} fa-2x text-muted"></i>
                 <div class="mt-2 mt-md-0">
-                    <div class="font-weight-bold">{{ $method->getLabel() }}</div>
-                    <div class="text-muted small">{{ $method->getDescription() }}</div>
+                    <div class="font-weight-bold">{{ $method->getSettings('label') }}</div>
+                    <div class="text-muted small">{{ $method->getSettings('description') }}</div>
                 </div>
             </div>
             <!-- Desktop badge -->
diff --git a/app/Extensions/TwoFactor/README.md b/app/Extensions/TwoFactor/README.md
index de0255831..c8d12c770 100644
--- a/app/Extensions/TwoFactor/README.md
+++ b/app/Extensions/TwoFactor/README.md
@@ -26,10 +26,7 @@ app/Extensions/TwoFactor/YourMethod/
 Your main class must extend `App\Classes\TwoFactorExtension`.
 
 ### Required Methods
-- `getName()`: Technical identifier (e.g., `totp`). Used in routes and namespaces.
-- `getLabel()`: User-friendly name (e.g., `Authenticator App`).
-- `getIcon()`: FontAwesome icon class (e.g., `fas fa-mobile-alt`).
-- `getDescription()`: Short description shown in the picker.
+- `getSettings(?string $key = null)`: Method configuration metadata array (contains `name`, `label`, `icon`, `description`) or a specific property if `$key` is passed.
 - `getSettingsView()`: Name of the Blade view for the profile card.
 - `getChallengeView()`: Name of the Blade view for the login screen.
 - `verify(Request $request)`: Logic to validate the user's code/token.
diff --git a/app/Extensions/TwoFactor/Totp/TotpExtension.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
index c662d7aff..9e9bbec17 100644
--- a/app/Extensions/TwoFactor/Totp/TotpExtension.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -25,24 +25,16 @@ public function __construct(TotpService $totpService, RecoveryCodeService $recov
         $this->twoFactorService = $twoFactorService;
     }
 
-    public function getName(): string
+    public function getSettings(?string $key = null): mixed
     {
-        return 'totp';
-    }
-
-    public function getLabel(): string
-    {
-        return __('Authenticator App');
-    }
-
-    public function getIcon(): string
-    {
-        return 'fas fa-mobile-alt';
-    }
+        $settings = [
+            'name' => 'totp',
+            'label' => __('Authenticator App'),
+            'icon' => 'fas fa-mobile-alt',
+            'description' => __('Use an app to get codes'),
+        ];
 
-    public function getDescription(): string
-    {
-        return __('Use an app to get codes');
+        return $key ? ($settings[$key] ?? null) : $settings;
     }
 
     public function getSettingsView(): string
diff --git a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
index eccd4009a..07517922d 100644
--- a/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
+++ b/app/Extensions/TwoFactor/Totp/views/profile_card.blade.php
@@ -5,7 +5,7 @@
             <div class="d-flex flex-column flex-md-row align-items-start align-items-md-center w-100">
                 <!-- Mobile row -->
                 <div class="d-flex align-items-center justify-content-between w-100 d-md-none">
-                    <i class="{{ $method->getIcon() }} fa-2x text-muted"></i>
+                    <i class="{{ $method->getSettings('icon') }} fa-2x text-muted"></i>
 
                     @if($totp)
                         <span class="badge badge-success">{{ __('Enabled') }}</span>
@@ -14,10 +14,10 @@
                     @endif
                 </div>
                 <!-- Desktop icon and text -->
-                <i class="d-none d-md-inline-block mr-md-3 {{ $method->getIcon() }} fa-2x text-muted"></i>
+                <i class="d-none d-md-inline-block mr-md-3 {{ $method->getSettings('icon') }} fa-2x text-muted"></i>
                 <div class="mt-2 mt-md-0">
-                    <div class="font-weight-bold">{{ $method->getLabel() }}</div>
-                    <div class="text-muted small">{{ $method->getDescription() }}</div>
+                    <div class="font-weight-bold">{{ $method->getSettings('label') }}</div>
+                    <div class="text-muted small">{{ $method->getSettings('description') }}</div>
                 </div>
             </div>
             <!-- Desktop badge -->
diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index be606a5cd..d5258b220 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -26,7 +26,7 @@ public function getExtensions(): Collection
             foreach ($classes as $class) {
                 if (is_subclass_of($class, TwoFactorExtension::class)) {
                     $extension = app($class);
-                    $this->extensions->put($extension->getName(), $extension);
+                    $this->extensions->put($extension->getSettings('name'), $extension);
                 }
             }
         }
diff --git a/themes/default/views/auth/two-factor/picker.blade.php b/themes/default/views/auth/two-factor/picker.blade.php
index d51f5cf6b..3a84d6991 100644
--- a/themes/default/views/auth/two-factor/picker.blade.php
+++ b/themes/default/views/auth/two-factor/picker.blade.php
@@ -17,18 +17,18 @@
 
                 <div class="mt-3">
                     @foreach($methods as $method)
-                        <a href="{{ route('login.2fa.method', ['method' => $method->getName()]) }}"
+                        <a href="{{ route('login.2fa.method', ['method' => $method->getSettings('name')]) }}"
                             class="d-flex align-items-center p-3 mb-2 bg-dark border border-secondary rounded text-decoration-none hover-shadow">
                             <div class="mr-3">
-                                <i class="{{ $method->getIcon() }} fa-lg text-primary"></i>
+                                <i class="{{ $method->getSettings('icon') }} fa-lg text-primary"></i>
                             </div>
 
                             <div class="flex-grow-1">
                                 <div class="text-sm font-weight-bold text-light">
-                                    {{ $method->getLabel() }}
+                                    {{ $method->getSettings('label') }}
                                 </div>
                                 <div class="text-xs text-muted">
-                                    {{ $method->getDescription() }}
+                                    {{ $method->getSettings('description') }}
                                 </div>
                             </div>
                         </a>

From d21413f0bdb308e4120acc399d84925820db0832 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 13:19:30 +0300
Subject: [PATCH 47/53] fix: linter critical errors

---
 app/Services/TwoFactor/TwoFactorService.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/Services/TwoFactor/TwoFactorService.php b/app/Services/TwoFactor/TwoFactorService.php
index d5258b220..03c818505 100644
--- a/app/Services/TwoFactor/TwoFactorService.php
+++ b/app/Services/TwoFactor/TwoFactorService.php
@@ -24,7 +24,8 @@ public function getExtensions(): Collection
             $classes = ExtensionHelper::getAllExtensionClassesByNamespace('TwoFactor');
 
             foreach ($classes as $class) {
-                if (is_subclass_of($class, TwoFactorExtension::class)) {
+                if (is_string($class) && class_exists($class) && is_subclass_of($class, TwoFactorExtension::class)) {
+                    /** @var TwoFactorExtension $extension */
                     $extension = app($class);
                     $this->extensions->put($extension->getSettings('name'), $extension);
                 }
@@ -81,7 +82,7 @@ public function markVerified(Request $request, User $user): void
         }
 
         // If remember_web cookie is present, store verification token in DB
-        $cookieName = Auth::guard('web')->getRecallerName();
+        $cookieName = Auth::getRecallerName();
         if ($request->hasCookie($cookieName)) {
             TwoFactorVerifiedToken::updateOrCreate(
                 [

From 26fd42f4fbeb44281315765fe94a3f17a91801e1 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 13:46:05 +0300
Subject: [PATCH 48/53] fix: avoid returning stale recovery codes after
 verification

---
 app/Extensions/TwoFactor/Totp/TotpExtension.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/Extensions/TwoFactor/Totp/TotpExtension.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
index 9e9bbec17..4a299576a 100644
--- a/app/Extensions/TwoFactor/Totp/TotpExtension.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -214,6 +214,8 @@ public function showRecoveryCodes(Request $request)
             ]);
         }
 
+        $method->refresh();
+
         return response()->json([
             'recovery_codes' => decrypt($method->totp_recovery_codes),
         ]);

From 51bafeb42ed77e5c1c69effb575099087337679c Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 13:55:24 +0300
Subject: [PATCH 49/53] refactor: reuse code verification logic across TOTP
 actions

---
 .../TwoFactor/Totp/TotpExtension.php          | 53 ++++++++-----------
 1 file changed, 21 insertions(+), 32 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/TotpExtension.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
index 4a299576a..9075bd65c 100644
--- a/app/Extensions/TwoFactor/Totp/TotpExtension.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -54,20 +54,12 @@ public function verify(Request $request): bool
         ]);
 
         $user = $request->user();
-        $code = preg_replace('/\s+/', '', $request->input('code'));
-
-        if (strlen($code) === 6 && ctype_digit($code)) {
-            // TOTP path
-            $method = $user->twoFactorMethods()->where('method', 'totp')->first();
-            if ($method && $method->totp_secret) {
-                return $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
-            }
-        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
-            // Recovery code path
-            return $this->recoveryCodeService->verify($user, $code);
+        $method = $user->twoFactorMethods()->where('method', 'totp')->first();
+        if (!$method) {
+            return false;
         }
 
-        return false;
+        return $this->verifyAnyCode($user, $method, $request->input('code'));
     }
 
     public function setup(Request $request)
@@ -159,16 +151,7 @@ public function disable(Request $request)
             return response()->json(['message' => __('Two-factor authentication is not enabled.')], 422);
         }
 
-        $code = preg_replace('/\s+/', '', $request->input('code'));
-        $isVerified = false;
-
-        if (strlen($code) === 6 && ctype_digit($code)) {
-            $isVerified = $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
-        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
-            $isVerified = $this->recoveryCodeService->verify($user, $code);
-        }
-
-        if (!$isVerified) {
+        if (!$this->verifyAnyCode($user, $method, $request->input('code'))) {
             throw ValidationException::withMessages([
                 'code' => [__('The provided two-factor authentication code was invalid.')],
             ]);
@@ -199,16 +182,7 @@ public function showRecoveryCodes(Request $request)
             return response()->json(['message' => __('Two-factor authentication is not enabled.')], 422);
         }
 
-        $code = preg_replace('/\s+/', '', $request->input('code'));
-        $isVerified = false;
-
-        if (strlen($code) === 6 && ctype_digit($code)) {
-            $isVerified = $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
-        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
-            $isVerified = $this->recoveryCodeService->verify($user, $code);
-        }
-
-        if (!$isVerified) {
+        if (!$this->verifyAnyCode($user, $method, $request->input('code'))) {
             throw ValidationException::withMessages([
                 'code' => [__('The provided two-factor authentication code was invalid.')],
             ]);
@@ -221,6 +195,21 @@ public function showRecoveryCodes(Request $request)
         ]);
     }
 
+    private function verifyAnyCode(User $user, UserTwoFactorMethod $method, string $rawCode): bool
+    {
+        $code = preg_replace('/\s+/', '', $rawCode);
+
+        if (strlen($code) === 6 && ctype_digit($code)) {
+            if ($method->totp_secret) {
+                return $this->totpService->verifyCode(decrypt($method->totp_secret), $code);
+            }
+        } elseif (strlen($code) === 8 && ctype_alnum($code)) {
+            return $this->recoveryCodeService->verify($user, $code);
+        }
+
+        return false;
+    }
+
     public function getAllowedActions(): array
     {
         return ['showRecoveryCodes'];

From 537fa8052b33ec5f87126175411e7a75f517e091 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 13:58:46 +0300
Subject: [PATCH 50/53] fix: handle missing rate limit configuration gracefully

---
 app/Classes/TwoFactorExtension.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/Classes/TwoFactorExtension.php b/app/Classes/TwoFactorExtension.php
index 27f1e7ae1..70d7a3348 100644
--- a/app/Classes/TwoFactorExtension.php
+++ b/app/Classes/TwoFactorExtension.php
@@ -64,7 +64,7 @@ public function getAllowedActions(): array
 
     /**
      * Get the rate limit for a specific action.
-     * 
+     *
      * @param string $action (setup, enable, disable, verify, action)
      * @return array ['attempts' => int, 'minutes' => int]
      */
@@ -78,7 +78,10 @@ public function getRateLimit(string $action): array
             'action'  => ['attempts' => 3, 'minutes' => 5], // Default 3 per 5 mins for sensitive actions
         ];
 
-        return $this->getConfig()['rate_limits'][$action] ?? $defaults[$action];
+        $config = static::getConfig();
+        $rateLimits = is_array($config) ? ($config['rate_limits'] ?? []) : [];
+
+        return $rateLimits[$action] ?? $defaults[$action];
     }
 
     /**

From a07c31edcc5009a6b7e84bff311a254087821b96 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 14:06:04 +0300
Subject: [PATCH 51/53] fix: unify recovery code throttling configuration

---
 app/Extensions/TwoFactor/Totp/RecoveryCodeService.php | 10 +++++++---
 app/Extensions/TwoFactor/Totp/TotpExtension.php       |  3 +++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
index 07e4bdb02..3b1fb2c49 100644
--- a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
+++ b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
@@ -27,12 +27,16 @@ public function generate(): array
      */
     public function verify(User $user, string $code): bool
     {
+        $limit = app(\App\Services\TwoFactor\TwoFactorService::class)
+            ->getExtension('totp')
+            ?->getRateLimit('recovery_code') ?? ['attempts' => 5, 'minutes' => 10];
+
         $cacheKey = "2fa.recovery_attempts.{$user->id}";
         $attempts = Cache::get($cacheKey, 0);
 
-        if ($attempts >= 5) {
+        if ($attempts >= $limit['attempts']) {
             throw ValidationException::withMessages([
-                'code' => [__('Too many recovery code attempts. Please try again in 10 minutes.')],
+                'code' => [__('Too many recovery code attempts. Please try again in :minutes minutes.', ['minutes' => $limit['minutes']])],
             ]);
         }
 
@@ -67,7 +71,7 @@ public function verify(User $user, string $code): bool
         if ($isVerified) {
             Cache::forget($cacheKey);
         } else {
-            Cache::put($cacheKey, $attempts + 1, now()->addMinutes(10));
+            Cache::put($cacheKey, $attempts + 1, now()->addMinutes($limit['minutes']));
         }
 
         return $isVerified;
diff --git a/app/Extensions/TwoFactor/Totp/TotpExtension.php b/app/Extensions/TwoFactor/Totp/TotpExtension.php
index 9075bd65c..a8ce37471 100644
--- a/app/Extensions/TwoFactor/Totp/TotpExtension.php
+++ b/app/Extensions/TwoFactor/Totp/TotpExtension.php
@@ -219,6 +219,9 @@ public static function getConfig(): array
     {
         return [
             'name' => 'TOTP',
+            'rate_limits' => [
+                'recovery_code' => ['attempts' => 5, 'minutes' => 10],
+            ],
         ];
     }
 }

From cae538dec5cb1870a6bde5f51939869ad4f99a25 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 14:07:30 +0300
Subject: [PATCH 52/53] refactor: remove redundant relationship loading check

---
 app/Extensions/TwoFactor/Totp/RecoveryCodeService.php | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
index 3b1fb2c49..6f95a2521 100644
--- a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
+++ b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
@@ -42,12 +42,7 @@ public function verify(User $user, string $code): bool
 
         $code = strtoupper(preg_replace('/\s+/', '', $code));
 
-        // Use pre-loaded collection if available to avoid N+1, otherwise query
-        $methods = $user->relationLoaded('twoFactorMethods')
-            ? $user->twoFactorMethods
-            : $user->twoFactorMethods();
-
-        $method = $methods->where('method', 'totp')->first();
+        $method = $user->twoFactorMethods->where('method', 'totp')->first();
 
         if (!$method || !$method->totp_recovery_codes) {
             return false;

From e0c2ad1a5a727ec262a0e5a57859692cf1bc9de7 Mon Sep 17 00:00:00 2001
From: MrWeez <arseniy@mrweez.dev>
Date: Thu, 30 Jul 2026 14:09:29 +0300
Subject: [PATCH 53/53] fix: prevent timing side channel in recovery code
 verification

---
 .../TwoFactor/Totp/RecoveryCodeService.php    | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
index 6f95a2521..491b0dde9 100644
--- a/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
+++ b/app/Extensions/TwoFactor/Totp/RecoveryCodeService.php
@@ -49,26 +49,26 @@ public function verify(User $user, string $code): bool
         }
 
         $recoveryCodes = decrypt($method->totp_recovery_codes);
-        $isVerified = false;
+        $matchedIndex = null;
 
         foreach ($recoveryCodes as $index => $storedCode) {
-            // Using hash_equals for constant-time comparison of the plain codes
+            // Using hash_equals for constant-time comparison across all codes
             if (hash_equals($storedCode, $code)) {
-                // Burn the code
-                unset($recoveryCodes[$index]);
-                $method->totp_recovery_codes = encrypt(array_values($recoveryCodes));
-                $method->save();
-                $isVerified = true;
-                break;
+                $matchedIndex = $index;
             }
         }
 
-        if ($isVerified) {
+        if ($matchedIndex !== null) {
+            // Burn the code
+            unset($recoveryCodes[$matchedIndex]);
+            $method->totp_recovery_codes = encrypt(array_values($recoveryCodes));
+            $method->save();
+
             Cache::forget($cacheKey);
-        } else {
-            Cache::put($cacheKey, $attempts + 1, now()->addMinutes($limit['minutes']));
+            return true;
         }
 
-        return $isVerified;
+        Cache::put($cacheKey, $attempts + 1, now()->addMinutes($limit['minutes']));
+        return false;
     }
 }