# Two-Factor Authentication (2FA)

## Purpose

Pluscare supports **two-factor authentication (2FA)** to add an extra layer of security to user accounts.

## How it works

- **Enable/Disable:** Users can enable or disable 2FA at any time from their account settings.
- **Authenticator app:** 2FA uses **TOTP (Time-based One-Time Passwords)** generated by an authenticator app, such as **Google Authenticator** (or any compatible TOTP app).
- **Admin reset only:** If a user loses access to their authenticator device/codes, **only an administrator** can reset 2FA for that account.

### Sign-in flow

1. The user enables 2FA in their account settings and completes setup with an authenticator app.
2. During sign-in, the user must provide:
   - their password, and
   - a valid one-time code from the authenticator app.
3. The user can disable 2FA at any time from their account settings.
4. If recovery is needed, an admin can reset 2FA for the account.

## Key entities & DB

2FA state is stored on the user account. TOTP secrets are managed through the standard Laravel Fortify/Breeze 2FA flow.

## Technical flow

1. User enables 2FA → secret is generated and displayed as a QR code for the authenticator app.
2. User confirms setup with a valid TOTP code.
3. On subsequent logins, after password validation, a TOTP challenge is required.
4. Admin can reset 2FA for a locked-out user from the admin interface.

## Notes / edge cases

- Only administrators can reset 2FA for another user — there is no self-service recovery without the authenticator.
- Disabling 2FA takes effect immediately from account settings.

## Related documentation

- [Business Logic](../business-logic.md) — user roles (admin reset capability)