*/ use HasFactory, Notifiable; protected function casts(): array { return [ 'email_verified_at' => 'datetime', 'password' => 'hashed', 'two_factor_secret' => 'encrypted', 'two_factor_confirmed_at' => 'datetime', 'must_change_password' => 'boolean', ]; } public function hasTwoFactorEnabled(): bool { return ! is_null($this->two_factor_confirmed_at) && ! is_null($this->two_factor_secret); } /** * Completed the security onboarding (rotated the seeded password + enrolled 2FA) — * the same gate EnsureSecurityOnboarded enforces before the panel is reachable. * Authorization (e.g. broadcast channels) must require this, not mere authentication. */ public function securityOnboarded(): bool { return ! $this->must_change_password && $this->hasTwoFactorEnabled(); } }