From b6e0ec539c3ad71104c716effd783b27907f29ba Mon Sep 17 00:00:00 2001 From: Twyco Date: Thu, 8 Oct 2026 11:29:28 +0200 Subject: [PATCH] require 2fa if enabled --- app/Actions/Fortify/CreateNewUser.php | 5 ++-- app/Actions/Teams/AcceptTeamInvite.php | 12 +++++++--- app/Http/Controllers/TeamController.php | 24 ++++++++++++++++--- .../TeamInviteAcceptController.php | 4 ++-- resources/js/pages/auth/Register.vue | 1 + resources/js/pages/team/invite/Create.vue | 9 +++---- 6 files changed, 40 insertions(+), 15 deletions(-) diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php index 863a7c2..c2f1700 100644 --- a/app/Actions/Fortify/CreateNewUser.php +++ b/app/Actions/Fortify/CreateNewUser.php @@ -17,7 +17,7 @@ class CreateNewUser implements CreatesNewUsers use PasswordValidationRules, ProfileValidationRules; public function __construct( - private AcceptTeamInvite $acceptTeamInvite, + private readonly AcceptTeamInvite $acceptTeamInvite, ) {} /** @@ -59,8 +59,7 @@ class CreateNewUser implements CreatesNewUsers ]); if ($invite !== null) { - $invite->team->members()->attach($user); - $invite->delete(); + ($this->acceptTeamInvite)($invite, $user); } return $user; diff --git a/app/Actions/Teams/AcceptTeamInvite.php b/app/Actions/Teams/AcceptTeamInvite.php index b5b280e..c2e5984 100644 --- a/app/Actions/Teams/AcceptTeamInvite.php +++ b/app/Actions/Teams/AcceptTeamInvite.php @@ -5,15 +5,21 @@ namespace App\Actions\Teams; use App\Models\TeamInvite; use App\Models\User; use Illuminate\Support\Facades\DB; +use Illuminate\Validation\ValidationException; readonly class AcceptTeamInvite { - public function __invoke(TeamInvite $invite): void + public function __invoke(TeamInvite $invite, User $newUser): void { - abort_unless(auth()->user()->email === $invite->invited_email, 403); + abort_unless($newUser->email === $invite->invited_email, 403); $team = $invite->team; - $newUser = User::whereEmail($invite->invited_email)->firstOrFail(); + + if ($invite->team->require_2fa && ! $newUser->hasEnabledTwoFactorAuthentication()) { + throw ValidationException::withMessages([ + 'require_2fa' => 'Du musst 2FA einrichten, damit du dem Team beitreten kannst', + ]); + } try { DB::transaction(function () use ($team, $newUser, $invite) { diff --git a/app/Http/Controllers/TeamController.php b/app/Http/Controllers/TeamController.php index 311c8ab..02749c9 100644 --- a/app/Http/Controllers/TeamController.php +++ b/app/Http/Controllers/TeamController.php @@ -15,6 +15,7 @@ use Illuminate\Http\Request; use Illuminate\Support\Arr; use Illuminate\Support\Facades\DB; use Illuminate\Support\Str; +use Illuminate\Validation\ValidationException; use Inertia\Inertia; use Inertia\Response; @@ -50,10 +51,18 @@ class TeamController extends Controller */ public function store(StoreTeamRequest $request): RedirectResponse { + $validated = $request->validated(); + $user = $request->user(); + + if (Arr::get($validated, 'require_2fa', false) && ! $user->hasEnabledTwoFactorAuthentication()) { + throw ValidationException::withMessages([ + 'require_2fa' => 'Du musst 2FA einrichten, damit du 2FA aktivieren kannst!', + ]); + } try { - DB::transaction(function () use ($request): void { - $team = Team::create($request->validated()); - $team->members()->attach($request->user(), ['role' => TeamMemberRole::Owner]); + DB::transaction(function () use ($validated, $user): void { + $team = Team::create($validated); + $team->members()->attach($user, ['role' => TeamMemberRole::Owner]); }); } catch (\Exception $exception) { report($exception); @@ -87,6 +96,15 @@ class TeamController extends Controller */ public function update(UpdateTeamRequest $request, Team $team): RedirectResponse { + $validated = $request->validated(); + $user = $request->user(); + + if (Arr::get($validated, 'require_2fa', false) && ! $user->hasEnabledTwoFactorAuthentication()) { + throw ValidationException::withMessages([ + 'require_2fa' => 'Du musst 2FA einrichten, damit du 2FA aktivieren kannst!', + ]); + } + try { $team->update($request->validated()); } catch (\Exception $exception) { diff --git a/app/Http/Controllers/TeamInviteAcceptController.php b/app/Http/Controllers/TeamInviteAcceptController.php index 2764adb..5d5a30c 100644 --- a/app/Http/Controllers/TeamInviteAcceptController.php +++ b/app/Http/Controllers/TeamInviteAcceptController.php @@ -17,7 +17,7 @@ class TeamInviteAcceptController extends Controller $invite = TeamInvite::findByPlainToken($inviteToken)->first(); if ($invite) { - $accept($invite); + $accept($invite, $request->user()); return to_route('teams.index'); } @@ -32,7 +32,7 @@ class TeamInviteAcceptController extends Controller { $request->validated(); - $accept($request->teamInvite()); + $accept($request->teamInvite(), $request->user()); return to_route('teams.index'); } diff --git a/resources/js/pages/auth/Register.vue b/resources/js/pages/auth/Register.vue index c429acb..4bda1b8 100644 --- a/resources/js/pages/auth/Register.vue +++ b/resources/js/pages/auth/Register.vue @@ -102,6 +102,7 @@ defineOptions({ /> +