Product Decisions This Supports
- Admin-surface MFA decision. Nova is the highest-privilege surface in most Laravel deployments (staff, support, finance ops, tenant admins). This package lets you make TOTP enrollment mandatory for that surface without touching your customer-facing auth stack — a narrow, reversible security decision rather than a platform-wide identity project.
- Compliance and audit response. Closes a recurring finding in SOC 2 (logical access), ISO 27001 (A.9 access control), and most internal security policies: privileged back-office access must be multifactor. Useful evidence for "we enforce MFA on administrative systems."
- Nova 3 → Nova 4 upgrade unblocking. The explicit purpose of this fork. If 2FA is a security requirement in your environment, the Nova upgrade is gated on 2FA parity. This package is the cheapest way to keep the gate open; the alternative is delaying the upgrade or accepting a temporary control gap.
- Build vs. buy for a bounded feature. TOTP + QR provisioning + secret storage + login gate is roughly 1–3 engineer-days done well, plus ongoing ownership. That is small enough that "buy" (adopt) and "build" are genuinely close — the decision should hinge on maintenance appetite, not price.
- Roadmap sequencing: local MFA vs. SSO. If SSO/SAML/SCIM is on the roadmap within 2–4 quarters, treat this as an interim control: pick the option with the lowest switching cost and do not invest in customization. If SSO is not funded, this becomes the durable answer for admin access and deserves real ownership.
- Representative use cases: internal support/ops consoles, finance and payout administration, multi-tenant operator dashboards, and any Nova instance reachable from the public internet.
When to Consider This Package
Consider it when all of the following hold:
- You are on Laravel Nova 4 and need TOTP in the Nova login now; the upstream
carloscgo/nova-google2fa either does not support Nova 4 or is not an option for you.
- You accept that you, not the maintainer, own the code. Zero stars and zero dependents means no community, no downstream bug-finding, no support SLA, and a real chance the fork stops tracking upstream and Nova releases. Plan to pin the version, vendor the source, or fork it internally.
- The need is scoped to admin users, not customers, and your user count is small enough that enrollment friction is manageable.
- You do not yet have an identity provider (Okta, Entra ID, Google Workspace) governing admin access.
- You can absorb the security review cost of a low-signal dependency — read the source (it is small), confirm secret storage and recovery behavior, and verify it uses a maintained TOTP library.
Look elsewhere when:
- Upstream works for you. Prefer the original package; a fork with no dependents should be a last resort, not a default.
- You need WebAuthn/passkeys, hardware keys, or push — TOTP only is a weaker control against phishing.
- You require centralized identity: SSO/SAML, SCIM provisioning, conditional access, session policy. Nova-level 2FA is a patch over the absence of an IdP, not a substitute.
- You are in a regulated or enterprise context requiring a supported vendor, security questionnaire, CVE response commitments, or a named maintainer.
- You need capabilities the fork may not provide — recovery codes, device trust/"remember this device," per-role enforcement, admin reset flows. If any are missing, budget the build.
How to Pitch It (Stakeholders)
To executives: This is a small, low-cost addition that puts a second factor in front of our highest-privilege system — the admin panel. It addresses one of the most common audit findings at effectively zero license cost, and it can be delivered in days rather than the quarters an SSO program takes. The honest caveat: it is a community fork with no user base, so the real cost is that engineering owns it. We recommend adopting it as an interim control, pinning the version, and revisiting when SSO is funded.
To engineering: A Nova 4-compatible TOTP tool/field for the admin login. Integration is hours, not weeks: install, publish config/migrations, enforce enrollment, define an admin reset path. The trade-off is explicit — we take on a dependency with no maintainers, so read the source before merging (verify secret storage, recovery path, and that the underlying 2FA library is maintained), vendor or pin it, and add an owner and a review date. If we would rather not carry that, building the equivalent in-house is a small, well-understood piece of work — decide that now, not after the first Nova upgrade breaks it.