Initial Commit

app/Actions/Fortify/CreateNewUser.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Concerns\PasswordValidationRules;
+use App\Concerns\ProfileValidationRules;
+use App\Models\User;
+use Illuminate\Support\Facades\Validator;
+use Laravel\Fortify\Contracts\CreatesNewUsers;
+
+class CreateNewUser implements CreatesNewUsers
+{
+    use PasswordValidationRules, ProfileValidationRules;
+
+    /**
+     * Validate and create a newly registered user.
+     *
+     * @param  array<string, string>  $input
+     */
+    public function create(array $input): User
+    {
+        Validator::make($input, [
+            ...$this->profileRules(),
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        return User::create([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'password' => $input['password'],
+        ]);
+    }
+}

app/Actions/Fortify/ResetUserPassword.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Concerns\PasswordValidationRules;
+use App\Models\User;
+use Illuminate\Support\Facades\Validator;
+use Laravel\Fortify\Contracts\ResetsUserPasswords;
+
+class ResetUserPassword implements ResetsUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and reset the user's forgotten password.
+     *
+     * @param  array<string, string>  $input
+     */
+    public function reset(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        $user->forceFill([
+            'password' => $input['password'],
+        ])->save();
+    }
+}

app/Concerns/PasswordValidationRules.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Concerns;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Validation\Rules\Password;
+
+trait PasswordValidationRules
+{
+    /**
+     * Get the validation rules used to validate passwords.
+     *
+     * @return array<int, Password|ValidationRule|array<mixed>|string>
+     */
+    protected function passwordRules(): array
+    {
+        return ['required', 'string', Password::default(), 'confirmed'];
+    }
+
+    /**
+     * Get the validation rules used to validate the current password.
+     *
+     * @return array<int, Password|ValidationRule|array<mixed>|string>
+     */
+    protected function currentPasswordRules(): array
+    {
+        return ['required', 'string', 'current_password'];
+    }
+}

app/Concerns/ProfileValidationRules.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Concerns;
+
+use App\Models\User;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Validation\Rule;
+
+trait ProfileValidationRules
+{
+    /**
+     * Get the validation rules used to validate user profiles.
+     *
+     * @return array<string, array<int, ValidationRule|array<mixed>|string>>
+     */
+    protected function profileRules(?int $userId = null): array
+    {
+        return [
+            'name' => $this->nameRules(),
+            'email' => $this->emailRules($userId),
+        ];
+    }
+
+    /**
+     * Get the validation rules used to validate user names.
+     *
+     * @return array<int, ValidationRule|array<mixed>|string>
+     */
+    protected function nameRules(): array
+    {
+        return ['required', 'string', 'max:255'];
+    }
+
+    /**
+     * Get the validation rules used to validate user emails.
+     *
+     * @return array<int, ValidationRule|array<mixed>|string>
+     */
+    protected function emailRules(?int $userId = null): array
+    {
+        return [
+            'required',
+            'string',
+            'email',
+            'max:255',
+            $userId === null
+                ? Rule::unique(User::class)
+                : Rule::unique(User::class)->ignore($userId),
+        ];
+    }
+}

app/Http/Controllers/Controller.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Http\Controllers;
+
+abstract class Controller
+{
+    //
+}

app/Http/Controllers/ImageProxyController.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Http;
+
+class ImageProxyController extends Controller
+{
+    public function show(Request $request)
+    {
+        $request->validate(['url' => 'required|url']);
+
+        $url = $request->query('url');
+
+        // Only allow proxying Instagram's own CDN domains, so this
+        // can't be abused as an open proxy for arbitrary URLs.
+        $host = parse_url($url, PHP_URL_HOST);
+        if (! $host || ! str_ends_with($host, 'fbcdn.net') && ! str_ends_with($host, 'cdninstagram.com')) {
+            abort(403);
+        }
+
+        $response = Http::withHeaders([
+            'User-Agent' => 'Mozilla/5.0',
+        ])->get($url);
+
+        if (! $response->successful()) {
+            abort(404);
+        }
+
+        return response($response->body())
+            ->header('Content-Type', $response->header('Content-Type'))
+            ->header('Cache-Control', 'public, max-age=3600');
+    }
+}

app/Http/Controllers/PostController.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Post;
+use Illuminate\Http\JsonResponse;
+
+class PostController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        $posts = Post::orderByDesc('taken_at')
+            ->limit(50)
+            ->get()
+            ->map(fn (Post $post) => [
+                'id' => $post->id,
+                'code' => $post->code,
+                'username' => $post->username,
+                'full_name' => $post->full_name,
+                'caption' => $post->caption,
+                'accessibility_caption' => $post->accessibility_caption,
+                'is_video' => $post->is_video,
+                'is_carousel' => $post->is_carousel,
+                'like_count' => $post->like_count,
+                'comment_count' => $post->comment_count,
+                'taken_at' => $post->taken_at,
+                'image_url' => $post->image_url,
+                'video_url' => $post->video_url,
+                'carousel_images' => $post->carousel_images,
+                'permalink' => $post->permalink,
+                'taken_at_date' => $post->taken_at_date->diffForHumans(),
+                'profile_pic_url' => $post->profile_pic_url,
+            ]);
+
+        return response()->json($posts);
+    }
+}

app/Http/Controllers/Settings/ProfileController.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Http\Controllers\Settings;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Settings\ProfileDeleteRequest;
+use App\Http\Requests\Settings\ProfileUpdateRequest;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class ProfileController extends Controller
+{
+    /**
+     * Show the user's profile settings page.
+     */
+    public function edit(Request $request): Response
+    {
+        return Inertia::render('settings/Profile', [
+            'mustVerifyEmail' => $request->user() instanceof MustVerifyEmail,
+            'status' => $request->session()->get('status'),
+        ]);
+    }
+
+    /**
+     * Update the user's profile information.
+     */
+    public function update(ProfileUpdateRequest $request): RedirectResponse
+    {
+        $request->user()->fill($request->validated());
+
+        if ($request->user()->isDirty('email')) {
+            $request->user()->email_verified_at = null;
+        }
+
+        $request->user()->save();
+
+        Inertia::flash('toast', ['type' => 'success', 'message' => __('Profile updated.')]);
+
+        return to_route('profile.edit');
+    }
+
+    /**
+     * Delete the user's profile.
+     */
+    public function destroy(ProfileDeleteRequest $request): RedirectResponse
+    {
+        $user = $request->user();
+
+        Auth::logout();
+
+        $user->delete();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect('/');
+    }
+}

app/Http/Controllers/Settings/SecurityController.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Http\Controllers\Settings;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Settings\PasswordUpdateRequest;
+use App\Http\Requests\Settings\TwoFactorAuthenticationRequest;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Validation\Rules\Password;
+use Inertia\Inertia;
+use Inertia\Response;
+use Laravel\Fortify\Features;
+
+class SecurityController extends Controller
+{
+    /**
+     * Show the user's security settings page.
+     */
+    public function edit(TwoFactorAuthenticationRequest $request): Response
+    {
+        $props = [
+            'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
+            'canManagePasskeys' => Features::canManagePasskeys(),
+            'passkeys' => Features::canManagePasskeys()
+                ? $request->user()
+                    ->passkeys()
+                    ->select(['id', 'name', 'credential', 'created_at', 'last_used_at'])
+                    ->latest()
+                    ->get()
+                    ->map(fn ($passkey) => [
+                        'id' => $passkey->id,
+                        'name' => $passkey->name,
+                        'authenticator' => $passkey->authenticator,
+                        'created_at_diff' => $passkey->created_at->diffForHumans(),
+                        'last_used_at_diff' => $passkey->last_used_at?->diffForHumans(),
+                    ])
+                    ->values()
+                    ->all()
+                : [],
+            'passwordRules' => Password::defaults()->toPasswordRulesString(),
+        ];
+
+        if (Features::canManageTwoFactorAuthentication()) {
+            $request->ensureStateIsValid();
+
+            $props['twoFactorEnabled'] = $request->user()->hasEnabledTwoFactorAuthentication();
+            $props['requiresConfirmation'] = Features::optionEnabled(Features::twoFactorAuthentication(), 'confirm');
+        }
+
+        return Inertia::render('settings/Security', $props);
+    }
+
+    /**
+     * Update the user's password.
+     */
+    public function update(PasswordUpdateRequest $request): RedirectResponse
+    {
+        $request->user()->update([
+            'password' => $request->password,
+        ]);
+
+        Inertia::flash('toast', ['type' => 'success', 'message' => __('Password updated.')]);
+
+        return back();
+    }
+}

app/Http/Controllers/StoryController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Story;
+use Illuminate\Http\JsonResponse;
+
+class StoryController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        $activeStories = Story::active()->get();
+
+        $grouped = $activeStories->groupBy('user_id')->map(function ($items) {
+            $first = $items->first();
+            return [
+                'username' => $first->username,
+                'profile_pic_url' => $first->profile_pic_url,
+                'is_unread' => $items->contains(fn ($item) => $item->viewed_at === null),
+                'muted' => $first->muted,
+                'soonest_expiring_at' => $items->min('expiring_at'),
+            ];
+        });
+
+        $sorted = $grouped
+            ->sortBy(fn ($s) => [$s['muted'] ? 1 : 0, $s['is_unread'] ? 0 : 1, $s['soonest_expiring_at']])
+            ->values()
+            ->map(fn ($s) => [
+                'username' => $s['username'],
+                'profile_pic_url' => $s['profile_pic_url'],
+                'is_unread' => $s['is_unread'],
+                'muted' => $s['muted'],
+            ]);
+        return response()->json($sorted);
+    }
+
+    public function show(string $username): JsonResponse
+    {
+        $items = Story::where('username', $username)->active()->orderBy('taken_at')->get();
+
+        if ($items->isEmpty()) {
+            return response()->json(['message' => 'No active story found.'], 404);
+        }
+
+        $firstUnread = $items->first(fn ($item) => $item->viewed_at === null);
+
+        $startIndex = $firstUnread
+            ? $items->search(fn ($item) => $item->id === $firstUnread->id)
+            : 0;
+
+        return response()->json([
+            'username' => $username,
+            'profile_pic_url' => $items->first()->profile_pic_url,
+            'start_index' => $startIndex,
+            'items' => $items->map(fn (Story $item) => [
+                'id' => $item->id,
+                'code' => $item->code,
+                'is_video' => $item->is_video,
+                'image_url' => $item->image_url,
+                'video_url' => $item->video_url,
+                'accessibility_caption' => $item->accessibility_caption,
+                'taken_at' => $item->taken_at,
+            ]),
+        ]);
+    }
+
+    public function markViewed(string $id): JsonResponse
+    {
+        Story::where('id', $id)->update(['viewed_at' => now()]);
+        return response()->json(['ok' => true]);
+    }
+}

app/Http/Middleware/HandleAppearance.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+class HandleAppearance
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        View::share('appearance', $request->cookie('appearance') ?? 'system');
+
+        return $next($request);
+    }
+}

app/Http/Middleware/HandleInertiaRequests.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Request;
+use Inertia\Middleware;
+
+class HandleInertiaRequests extends Middleware
+{
+    /**
+     * The root template that's loaded on the first page visit.
+     *
+     * @see https://inertiajs.com/server-side-setup#root-template
+     *
+     * @var string
+     */
+    protected $rootView = 'app';
+
+    /**
+     * Determines the current asset version.
+     *
+     * @see https://inertiajs.com/asset-versioning
+     */
+    public function version(Request $request): ?string
+    {
+        return parent::version($request);
+    }
+
+    /**
+     * Define the props that are shared by default.
+     *
+     * @see https://inertiajs.com/shared-data
+     *
+     * @return array<string, mixed>
+     */
+    public function share(Request $request): array
+    {
+        return [
+            ...parent::share($request),
+            'name' => config('app.name'),
+            'auth' => [
+                'user' => $request->user(),
+            ],
+            'sidebarOpen' => ! $request->hasCookie('sidebar_state') || $request->cookie('sidebar_state') === 'true',
+        ];
+    }
+}

app/Http/Requests/Settings/PasswordUpdateRequest.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Requests\Settings;
+
+use App\Concerns\PasswordValidationRules;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class PasswordUpdateRequest extends FormRequest
+{
+    use PasswordValidationRules;
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'current_password' => $this->currentPasswordRules(),
+            'password' => $this->passwordRules(),
+        ];
+    }
+}

app/Http/Requests/Settings/ProfileDeleteRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Requests\Settings;
+
+use App\Concerns\PasswordValidationRules;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ProfileDeleteRequest extends FormRequest
+{
+    use PasswordValidationRules;
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'password' => $this->currentPasswordRules(),
+        ];
+    }
+}

app/Http/Requests/Settings/ProfileUpdateRequest.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Requests\Settings;
+
+use App\Concerns\ProfileValidationRules;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ProfileUpdateRequest extends FormRequest
+{
+    use ProfileValidationRules;
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return $this->profileRules($this->user()->id);
+    }
+}

app/Http/Requests/Settings/TwoFactorAuthenticationRequest.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Requests\Settings;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Laravel\Fortify\InteractsWithTwoFactorState;
+
+class TwoFactorAuthenticationRequest extends FormRequest
+{
+    use InteractsWithTwoFactorState;
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [];
+    }
+}

app/Models/DirectMessage.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class DirectMessage extends Model
+{
+    protected $table = 'dm_messages';
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+    public $timestamps = false;
+
+    protected $fillable = [
+        'id', 'thread_id', 'user_id', 'username', 'full_name', 'item_type', 'text',
+        'media_url', 'is_video', 'timestamp', 'shared_url', 'shared_preview_image',
+        'shared_title', 'shared_caption', 'reactions', 'replied_to_id', 'replied_to_text',
+    ];
+
+    protected $casts = [
+        'is_video' => 'boolean',
+        'timestamp' => 'integer',
+        'reactions' => 'array',
+        'scraped_at' => 'datetime',
+    ];
+
+    public function thread(): BelongsTo
+    {
+        return $this->belongsTo(DirectThread::class, 'thread_id', 'thread_id');
+    }
+
+    public function repliedTo(): BelongsTo
+    {
+        return $this->belongsTo(self::class, 'replied_to_id', 'id');
+    }
+
+    public function getSentAtAttribute(): ?\Carbon\Carbon
+    {
+        return $this->timestamp
+            ? \Carbon\Carbon::createFromTimestampMs($this->timestamp)
+            : null;
+    }
+}

app/Models/DirectThread.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class DirectThread extends Model
+{
+    protected $table = 'dm_threads';
+    protected $primaryKey = 'thread_id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+    public $timestamps = false;
+
+    protected $fillable = [
+        'thread_id', 'thread_key', 'thread_title', 'is_group',
+        'participants', 'last_activity_at', 'muted',
+    ];
+
+    protected $casts = [
+        'participants' => 'array',
+        'is_group' => 'boolean',
+        'muted' => 'boolean',
+        'last_activity_at' => 'integer',
+        'scraped_at' => 'datetime',
+    ];
+
+    public function messages(): HasMany
+    {
+        return $this->hasMany(DirectMessage::class, 'thread_id', 'thread_id');
+    }
+
+    public function getLastActivityAtDateAttribute(): ?\Carbon\Carbon
+    {
+        return $this->last_activity_at
+            ? \Carbon\Carbon::createFromTimestampMs($this->last_activity_at)
+            : null;
+    }
+}

app/Models/Post.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Models;
+
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Casts\Attribute;
+use Illuminate\Database\Eloquent\Model;
+
+class Post extends Model
+{
+    protected $table = 'posts';
+
+    // Instagram's own post pk is the primary key, not auto-increment
+    protected $keyType = 'string';
+
+    public $incrementing = false;
+
+    // scraped_at is set by the DB default; created_at/updated_at don't apply
+    public $timestamps = false;
+
+    protected $fillable = [
+        'id',
+        'code',
+        'username',
+        'full_name',
+        'caption',
+        'accessibility_caption',
+        'is_video',
+        'is_carousel',
+        'like_count',
+        'comment_count',
+        'taken_at',
+        'image_url',
+        'video_url',
+        'carousel_images',
+        'scraped_at',
+        'profile_pic_url',
+    ];
+
+    protected $casts = [
+        'is_video' => 'boolean',
+        'is_carousel' => 'boolean',
+        'like_count' => 'integer',
+        'comment_count' => 'integer',
+        'taken_at' => 'integer',
+        'carousel_images' => 'array',
+        'scraped_at' => 'datetime',
+        'taken_at_date' => 'datetime',
+        'permalink' => 'string',
+    ];
+
+    protected $appends = [
+        'permalink',
+        'taken_at_date',
+    ];
+
+    /**
+     * Instagram's taken_at is a unix timestamp - convenience accessor
+     * for an actual Carbon instance.
+     */
+    protected function takenAtDate(): Attribute
+    {
+        return Attribute::make(
+            get: fn () => $this->taken_at ? Carbon::createFromTimestamp($this->taken_at) : null,
+        );
+    }
+
+    /**
+     * Convenience: the actual instagram.com URL for this post.
+     */
+    protected function permalink(): Attribute
+    {
+        return Attribute::make(
+            get: fn () => $this->code ? "https://www.instagram.com/p/{$this->code}/" : null,
+        );
+    }
+}

app/Models/Story.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class Story extends Model
+{
+    protected $table = 'stories';
+
+    protected $keyType = 'string';
+    public $incrementing = false;
+    public $timestamps = false;
+
+    protected $fillable = [
+        'id', 'user_id', 'username', 'profile_pic_url', 'code',
+        'is_video', 'taken_at', 'expiring_at', 'image_url', 'video_url',
+        'accessibility_caption',  'muted', 'scraped_at',
+        'viewed_at',
+    ];
+
+    protected $casts = [
+        'is_video' => 'boolean',
+        'taken_at' => 'integer',
+        'expiring_at' => 'integer',
+
+        'muted' => 'boolean',
+        'scraped_at' => 'datetime',
+        'viewed_at' => 'datetime',
+    ];
+
+    public function scopeActive($query)
+    {
+        return $query->where('expiring_at', '>', now()->timestamp);
+    }
+
+    public function getIsUnreadAttribute(): bool
+    {
+        return $this->viewed_at === null;
+    }
+}

app/Models/User.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Models;
+
+// use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Database\Factories\UserFactory;
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Attributes\Hidden;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\Notifiable;
+use Illuminate\Support\Carbon;
+use Laravel\Fortify\Contracts\PasskeyUser;
+use Laravel\Fortify\PasskeyAuthenticatable;
+use Laravel\Fortify\TwoFactorAuthenticatable;
+
+/**
+ * @property int $id
+ * @property string $name
+ * @property string $email
+ * @property Carbon|null $email_verified_at
+ * @property string $password
+ * @property string|null $two_factor_secret
+ * @property string|null $two_factor_recovery_codes
+ * @property Carbon|null $two_factor_confirmed_at
+ * @property string|null $remember_token
+ * @property Carbon|null $created_at
+ * @property Carbon|null $updated_at
+ */
+#[Fillable(['name', 'email', 'password'])]
+#[Hidden(['password', 'two_factor_secret', 'two_factor_recovery_codes', 'remember_token'])]
+class User extends Authenticatable implements PasskeyUser
+{
+    /** @use HasFactory<UserFactory> */
+    use HasFactory, Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;
+
+    /**
+     * Get the attributes that should be cast.
+     *
+     * @return array<string, string>
+     */
+    protected function casts(): array
+    {
+        return [
+            'email_verified_at' => 'datetime',
+            'password' => 'hashed',
+            'two_factor_confirmed_at' => 'datetime',
+        ];
+    }
+}

app/Providers/AppServiceProvider.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Providers;
+
+use Carbon\CarbonImmutable;
+use Illuminate\Support\Facades\Date;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\Validation\Rules\Password;
+
+class AppServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        $this->configureDefaults();
+    }
+
+    /**
+     * Configure default behaviors for production-ready applications.
+     */
+    protected function configureDefaults(): void
+    {
+        Date::use(CarbonImmutable::class);
+
+        DB::prohibitDestructiveCommands(
+            app()->isProduction(),
+        );
+
+        Password::defaults(fn (): ?Password => app()->isProduction()
+            ? Password::min(12)
+                ->mixedCase()
+                ->letters()
+                ->numbers()
+                ->symbols()
+                ->uncompromised()
+            : null,
+        );
+    }
+}

app/Providers/FortifyServiceProvider.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace App\Providers;
+
+use App\Actions\Fortify\CreateNewUser;
+use App\Actions\Fortify\ResetUserPassword;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rules\Password;
+use Inertia\Inertia;
+use Laravel\Fortify\Features;
+use Laravel\Fortify\Fortify;
+
+class FortifyServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        $this->configureActions();
+        $this->configureViews();
+        $this->configureRateLimiting();
+    }
+
+    /**
+     * Configure Fortify actions.
+     */
+    private function configureActions(): void
+    {
+        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
+        Fortify::createUsersUsing(CreateNewUser::class);
+    }
+
+    /**
+     * Configure Fortify views.
+     */
+    private function configureViews(): void
+    {
+        Fortify::loginView(fn (Request $request) => Inertia::render('auth/Login', [
+            'canResetPassword' => Features::enabled(Features::resetPasswords()),
+            'status' => $request->session()->get('status'),
+        ]));
+
+        Fortify::resetPasswordView(fn (Request $request) => Inertia::render('auth/ResetPassword', [
+            'email' => $request->email,
+            'token' => $request->route('token'),
+            'passwordRules' => Password::defaults()->toPasswordRulesString(),
+        ]));
+
+        Fortify::requestPasswordResetLinkView(fn (Request $request) => Inertia::render('auth/ForgotPassword', [
+            'status' => $request->session()->get('status'),
+        ]));
+
+        Fortify::verifyEmailView(fn (Request $request) => Inertia::render('auth/VerifyEmail', [
+            'status' => $request->session()->get('status'),
+        ]));
+
+        Fortify::registerView(fn () => Inertia::render('auth/Register', [
+            'passwordRules' => Password::defaults()->toPasswordRulesString(),
+        ]));
+
+        Fortify::twoFactorChallengeView(fn () => Inertia::render('auth/TwoFactorChallenge'));
+
+        Fortify::confirmPasswordView(fn () => Inertia::render('auth/ConfirmPassword'));
+    }
+
+    /**
+     * Configure rate limiting.
+     */
+    private function configureRateLimiting(): void
+    {
+        RateLimiter::for('two-factor', function (Request $request) {
+            return Limit::perMinute(5)->by($request->session()->get('login.id'));
+        });
+
+        RateLimiter::for('login', function (Request $request) {
+            $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
+
+            return Limit::perMinute(5)->by($throttleKey);
+        });
+
+        RateLimiter::for('passkeys', function (Request $request) {
+            return Limit::perMinute(10)->by(
+                ($request->input('credential.id') ?: $request->session()->getId()).'|'.$request->ip(),
+            );
+        });
+    }
+}