- How do I install oluomotoso/nova-google2fa in a Laravel Nova application?
- Install it with Composer, publish its configuration and migrations, then register the tool in your NovaServiceProvider using Nova::tools(). Run the migrations and confirm the published config matches your environment before enabling the login challenge. Because this is a fork with little public documentation, review the service provider and migration files rather than assuming standard defaults.
- Does this package add two-factor authentication to Laravel Nova logins or to application user accounts?
- It adds TOTP-based two-factor authentication to the Laravel Nova admin panel login flow, not to general application user accounts. End-user 2FA belongs in Fortify, Jetstream, or a similar application-level auth package. This scope distinction matters when planning security coverage across admin and customer identities.
- Which Laravel, PHP, and Nova versions does oluomotoso/nova-google2fa support?
- The evaluation context targets Laravel 9 or 10, Nova 4, and PHP 8.1 or 8.2, but you should verify the actual composer.json constraints before adopting it. The fork's stated reason for existing is Nova 4 compatibility, so Nova 3 is out of scope and Nova 5 support is not established. Run composer require early to surface conflicts with your pinned Laravel, PHP, and google2fa versions.
- Is oluomotoso/nova-google2fa a fork of carloscgo/nova-google2fa, and what exactly changed?
- Yes, it is described as a fork whose only claimed change is Nova 4 compatibility. The exact diff is not documented in the provided context, so the key review task is determining whether it is a small constraint bump or a broader reimplementation. Treat the diff as the product and inspect it before trusting the package in a security-critical login path.
- Are TOTP secrets encrypted at rest and are recovery codes hashed and single-use?
- The provided context does not document whether TOTP secrets are encrypted with Laravel's encrypter or stored plaintext, nor whether recovery codes are hashed and single-use. These are essential source-review questions because weak secret storage or reusable recovery codes undermine the entire second factor. Do not assume safe defaults; verify the migration columns, model casts, and recovery-code generation logic directly.
- How can I reset two-factor authentication for a Nova admin who is locked out?
- The context does not confirm a break-glass path such as an artisan command or Nova action for resetting 2FA. Before rollout, define an operational procedure, which may require clearing the stored secret or recovery state through a controlled database or console action. A missing break-glass path is a permanent lockout risk, so test the recovery process in staging with a real admin account.
- Is oluomotoso/nova-google2fa safe to use in production?
- The package has high technical risk because it has zero stars, zero dependents, no issue history, and no evidence of production use. It is also an unvalidated fork of a security-critical authentication feature, so provenance risk is concentrated in maintenance and source review rather than code volume alone. If adopted, vendor it, pin a commit SHA, run composer audit in CI, and patch gaps internally.
- How does this package handle TOTP replay, clock drift, and google2fa version constraints?
- The context does not specify the configured verification window, replay protection behavior, or exact google2fa version constraint. Newer pragmarx/google2fa releases require PHP 8.1 or newer and may conflict with older encrypter paths, so version resolution needs checking against your stack. Review the verification call and config values to confirm acceptable clock drift tolerance and replay handling.
- Can 2FA be enforced per user or role, and is there a remember-this-device cookie?
- Enforcement policy and remember-this-device behavior are not documented in the provided context, so inspect the tool config and any middleware for per-user or per-role options. If enforcement is optional, a misconfigured middleware could leave admin accounts without a second factor, and a long-lived remember cookie changes the threat model. Decide your policy before rollout and verify it with manual login tests.
- What alternatives should I consider before adopting nova-google2fa?
- Consider the upstream carloscgo/nova-google2fa package, a small self-owned Nova tool built directly on pragmarx/google2fa, or Fortify and Jetstream when the goal is end-user rather than Nova admin protection. A self-owned implementation removes fork risk and gives you control over recovery codes, break-glass procedures, and Nova 5 upgrades, though it costs roughly a week of in-house work. Price that option honestly before committing to an unvalidated fork.