<?php namespace App\Http\Controllers; use App\Models\MfaChallenge; use App\Services\NotificationService; use Illuminate\Http\Request; use Illuminate\Support\Facades\Hash; class MfaController extends Controller {public function challenge(Request $r,NotificationService $n){$u=$r->user();$code=(string)random_int(100000,999999);MfaChallenge::where('user_id',$u->id)->whereNull('used_at')->delete();MfaChallenge::create(['user_id'=>$u->id,'code_hash'=>Hash::make($code),'expires_at'=>now()->addMinutes(10),'ip_address'=>$r->ip()]);$n->send($u,'SoftSuite login verification code','Your verification code is '.$code.'. It expires in 10 minutes.');return view('auth.mfa');}public function verify(Request $r){$d=$r->validate(['code'=>'required|digits:6']);$c=MfaChallenge::where('user_id',$r->user()->id)->whereNull('used_at')->latest()->firstOrFail();abort_if(now()->greaterThan($c->expires_at),422,'Verification code expired.');abort_if($c->attempts>=5,429,'Too many attempts.');$c->increment('attempts');abort_unless(Hash::check($d['code'],$c->code_hash),422,'Invalid verification code.');$c->update(['used_at'=>now()]);session(['mfa_verified'=>true]);$r->user()->update(['mfa_verified_at'=>now()]);return redirect()->route('dashboard');}}