[6.x] Frontend Two-Factor Authentication

[duncanmcclean]

This pull request introduces Antlers tags for building frontend two-factor authentication flows, allowing users to set up, challenge, and manage 2FA entirely outside the Control Panel.

Login Form

The existing {{ user:login_form }} tag now accepts two_factor_challenge_url and two_factor_setup_url parameters. These let you control where users are redirected when they need to verify a 2FA code or set up 2FA for the first time.

{{ user:login_form
    redirect="/dashboard"
    two_factor_challenge_url="/auth/two-factor-challenge"
    two_factor_setup_url="/auth/setup-2fa"
}}
    <input type="email" name="email" value="{{ old:email }}" />
    <input type="password" name="password" />
    <button type="submit">Log in</button>
{{ /user:login_form }}

The two_factor_setup_url value is encrypted to prevent tampering, since the user is only partially authenticated at that point.

2FA Challenge

After logging in, users with 2FA enabled are redirected to the challenge URL. The {{ user:two_factor_challenge_form }} tag renders a form for entering a TOTP code or recovery code.

{{ user:two_factor_challenge_form redirect="/dashboard" }}
    {{ if errors }}
        <div class="text-red-500">{{ errors }}{{ value }}{{ /errors }}</div>
    {{ /if }}

    <input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" />
    <button type="submit">Verify</button>
{{ /user:two_factor_challenge_form }}

If no redirect is specified, the redirect from the original login form carries through.

2FA Setup

The {{ user:two_factor_setup_form }} tag renders a QR code and secret key for users to scan with their authenticator app, along with a confirmation code input.

{{ user:two_factor_setup_form redirect="/account/recovery-codes" }}
    {{ if errors }}
        <div class="text-red-500">{{ errors }}{{ value }}{{ /errors }}</div>
    {{ /if }}

    <div>{{ qr_code }}</div>
    <p>Or enter manually: <code>{{ secret_key }}</code></p>

    <input type="text" name="code" inputmode="numeric" maxlength="6" />
    <button type="submit">Enable 2FA</button>
{{ /user:two_factor_setup_form }}

Recovery Codes & Disable 2FA

• {{ user:two_factor_recovery_codes }} — loops through the user's recovery codes ({{ code }})
• {{ user:two_factor_recovery_codes_download_url }} — outputs a URL to download codes as a text file
• {{ user:reset_two_factor_recovery_codes_form }} — renders a form to regenerate recovery codes
• {{ user:disable_two_factor_form }} — renders a form to disable 2FA, with a setup_url parameter for users whose roles enforce 2FA

The reset recovery codes and disable forms require an elevated session.

---

Docs PR: statamic/docs#1891

Closes statamic/ideas#1398