### Install and configure auth-for-laravel

Source: https://github.com/roundly-consulting/auth-for-laravel/blob/main/README.md

Install the package, generate JWT keys, publish configuration and migrations, and run migrations. Requires PHP 8.4, Laravel 12 or 13, a cache store with atomic locks, and a mail transport.

```bash
composer require roundly-consulting/auth-for-laravel
php artisan jwt:generate-keys
php artisan authentication:install   # publishes config + migrations, prints the guard wiring
php artisan migrate
```

--------------------------------

### Attempt password login with Authentication guard

Source: https://github.com/roundly-consulting/auth-for-laravel/blob/main/README.md

Attempt a password login. Returns a token pair on success or a challenge resource when a second factor is due; continue with $guard->challenges()->complete(…) for the challenge flow.

```php
use RoundlyConsulting\Auth\DataTransferObjects\PasswordCredentials;
use RoundlyConsulting\Auth\Facades\Authentication;
use RoundlyConsulting\Auth\Http\Resources\ChallengeResource;
use RoundlyConsulting\Auth\Http\Resources\TokenPairResource;

$guard = Authentication::guard('users');

$result = $guard->attempt(
    new PasswordCredentials(identifier: $request->string('email')->toString(), password: $request->string('password')->toString()),
    $guard->contextFrom($request),
);

return $result->isAuthenticated()
    ? TokenPairResource::make($result->tokens)
    : ChallengeResource::make($result->challenge);   // continue with $guard->challenges()->complete(…)
```

--------------------------------

### Implement Account, HasPasskeys, and TwoFactorAuthenticatable on User model

Source: https://github.com/roundly-consulting/auth-for-laravel/blob/main/README.md

Apply the required contracts and traits to the guard's model to enable authentication, refresh tokens, two-factor, and passkeys. The casts method merges the package's cast definitions with your own.

```php
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use RoundlyConsulting\Auth\Concerns\HasAuthentication;
use RoundlyConsulting\Auth\Contracts\Account;
use RoundlyConsulting\Passkeys\Concerns\InteractsWithPasskeys;
use RoundlyConsulting\Passkeys\Contracts\HasPasskeys;
use RoundlyConsulting\RefreshTokens\Traits\HasRefreshTokens;
use RoundlyConsulting\TwoFactor\Concerns\HasTwoFactorAuthentication;
use RoundlyConsulting\TwoFactor\Contracts\TwoFactorAuthenticatable;

class User extends Authenticatable implements Account, HasPasskeys, TwoFactorAuthenticatable
{
    use HasAuthentication, HasRefreshTokens, HasTwoFactorAuthentication, InteractsWithPasskeys, Notifiable;

    protected function casts(): array
    {
        return [...$this->authenticationCasts(), ...$this->twoFactorCasts(), 'email_verified_at' => 'datetime'];
    }
}
```

--------------------------------

### Rotate refresh token and logout everywhere

Source: https://github.com/roundly-consulting/auth-for-laravel/blob/main/README.md

Rotate the refresh token (invalidating the old access token) or sign the account out of every device.

```php
$tokens = $guard->refresh($refreshToken, $guard->contextFrom($request));   // the old access token stops working

$guard->logoutEverywhere($user);
```