202 lines
7.6 KiB
PHP
202 lines
7.6 KiB
PHP
<?php
|
|
|
|
use Laravel\Fortify\Features;
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Fortify Guard
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may specify which authentication guard Fortify will use while
|
|
| authenticating users. This value should correspond with one of your
|
|
| guards that is already present in your "auth" configuration file.
|
|
|
|
|
*/
|
|
|
|
'guard' => 'web',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Fortify Password Broker
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may specify which password broker Fortify can use when a user
|
|
| is resetting their password. This configured value should match one
|
|
| of your password brokers setup in your "auth" configuration file.
|
|
|
|
|
*/
|
|
|
|
'passwords' => 'users',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Username / Email
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This value defines which model attribute should be considered as your
|
|
| application's "username" field. Typically, this might be the email
|
|
| address of the users but you are free to change this value here.
|
|
|
|
|
| Out of the box, Fortify expects forgot password and reset password
|
|
| requests to have a field named 'email'. If the application uses
|
|
| another name for the field you may define it below as needed.
|
|
|
|
|
*/
|
|
|
|
'username' => 'email',
|
|
|
|
'email' => 'email',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Lowercase Usernames
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This value defines whether usernames should be lowercased before saving
|
|
| them in the database, as some database system string fields are case
|
|
| sensitive. You may disable this for your application if necessary.
|
|
|
|
|
*/
|
|
|
|
'lowercase_usernames' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Home Path
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may configure the path where users will get redirected during
|
|
| authentication or password reset when the operations are successful
|
|
| and the user is authenticated. You are free to change this value.
|
|
|
|
|
*/
|
|
|
|
'home' => '/dashboard',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Fortify Routes Prefix / Subdomain
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may specify which prefix Fortify will assign to all the routes
|
|
| that it registers with the application. If necessary, you may change
|
|
| subdomain under which all of the Fortify routes will be available.
|
|
|
|
|
*/
|
|
|
|
'prefix' => '',
|
|
|
|
'domain' => strtolower(trim((string) env('APP_HOST', ''))) ?: null,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Fortify Routes Middleware
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may specify which middleware Fortify will assign to the routes
|
|
| that it registers with the application. If necessary, you may change
|
|
| these middleware but typically this provided default is preferred.
|
|
|
|
|
*/
|
|
|
|
'middleware' => ['web'],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Rate Limiting
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| By default, Fortify will throttle logins to five requests per minute for
|
|
| every email and IP address combination. However, if you would like to
|
|
| specify a custom rate limiter to call then you may specify it here.
|
|
|
|
|
*/
|
|
|
|
'limiters' => [
|
|
'login' => 'login',
|
|
'two-factor' => 'two-factor',
|
|
'passkeys' => 'passkeys',
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Register View Routes
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may specify if the routes returning views should be disabled as
|
|
| you may not need them when building your own application. This may be
|
|
| especially true if you're writing a custom single-page application.
|
|
|
|
|
*/
|
|
|
|
// Pages are full-page class-based Livewire components mapped in routes/web.php
|
|
// (R1/R2); Fortify registers only its action (POST) routes, not view routes.
|
|
'views' => false,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Passkeys
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| These settings configure Fortify's passkey (WebAuthn) support. Passkeys
|
|
| allow users to sign in without needing to remember credentials since
|
|
| they use public-key cryptography - making them immune to breaches.
|
|
|
|
|
*/
|
|
|
|
'passkeys' => [
|
|
'relying_party_id' => parse_url(config('app.url'), PHP_URL_HOST),
|
|
'allowed_origins' => [config('app.url')],
|
|
'timeout' => 60000,
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Features
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Some of the Fortify features are optional. You may disable the features
|
|
| by removing them from this array. You're free to only remove some of
|
|
| these features or you can even remove all of these if you need to.
|
|
|
|
|
*/
|
|
|
|
'features' => [
|
|
// v1 customer portal: login + TOTP two-factor only. Public registration,
|
|
// password reset, profile/password management and passkeys are out of
|
|
// v1 scope (design handoff §2) — enable later as separate screens.
|
|
// Registration is exposed via an app route (routes/web.php) with a
|
|
// registration-scoped throttle instead of Fortify's unthrottled route.
|
|
// Features::registration(),
|
|
// Was off, which meant there was no forgot-password link, no page
|
|
// and no route: a customer who forgot their password was locked out
|
|
// of their own cloud until somebody opened a shell. The POST
|
|
// endpoints come from Fortify; the two GET pages are ours (R1/R2),
|
|
// registered in routes/web.php under Fortify's own route names.
|
|
Features::resetPasswords(),
|
|
// Double opt-in. An account whose address was never confirmed is an
|
|
// account that cannot be billed, cannot be told its server is down,
|
|
// and may not be its owner's address at all — anybody can type
|
|
// somebody else's into a registration form.
|
|
//
|
|
// The notice page is ours (routes/web.php): 'views' => false below, so
|
|
// Fortify registers the verify and resend actions and nothing that
|
|
// returns HTML.
|
|
Features::emailVerification(),
|
|
// Features::updateProfileInformation(),
|
|
// Everyone must be able to change their own password. It was off, so
|
|
// an account created with a generated password was stuck with it — and
|
|
// the only way to change one was a shell on the server.
|
|
Features::updatePasswords(),
|
|
Features::twoFactorAuthentication([
|
|
'confirm' => true,
|
|
'confirmPassword' => true,
|
|
// 'window' => 0,
|
|
]),
|
|
// Features::passkeys([...]),
|
|
],
|
|
|
|
];
|