presseportale/config/auth.php

<?php

use App\Models\User;

return [

    /*
    |--------------------------------------------------------------------------
    | Authentication Defaults
    |--------------------------------------------------------------------------
    |
    | This option defines the default authentication "guard" and password
    | reset "broker" for your application. You may change these values
    | as required, but they're a perfect start for most applications.
    |
    */

    'defaults' => [
        'guard' => env('AUTH_GUARD', 'web'),
        'passwords' => env('AUTH_PASSWORD_BROKER', 'users'),
    ],

    /*
    |--------------------------------------------------------------------------
    | Authentication Guards
    |--------------------------------------------------------------------------
    |
    | Next, you may define every authentication guard for your application.
    | Of course, a great default configuration has been defined for you
    | which utilizes session storage plus the Eloquent user provider.
    |
    | All authentication guards have a user provider, which defines how the
    | users are actually retrieved out of your database or other storage
    | system used by the application. Typically, Eloquent is utilized.
    |
    | Supported: "session"
    |
    */

    'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | User Providers
    |--------------------------------------------------------------------------
    |
    | All authentication guards have a user provider, which defines how the
    | users are actually retrieved out of your database or other storage
    | system used by the application. Typically, Eloquent is utilized.
    |
    | If you have multiple user tables or models you may configure multiple
    | providers to represent the model / table. These providers may then
    | be assigned to any extra authentication guards you have defined.
    |
    | Supported: "database", "eloquent"
    |
    */

    'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => env('AUTH_MODEL', User::class),
        ],

        // 'users' => [
        //     'driver' => 'database',
        //     'table' => 'users',
        // ],
    ],

    /*
    |--------------------------------------------------------------------------
    | Resetting Passwords
    |--------------------------------------------------------------------------
    |
    | These configuration options specify the behavior of Laravel's password
    | reset functionality, including the table utilized for token storage
    | and the user provider that is invoked to actually retrieve users.
    |
    | The expiry time is the number of minutes that each reset token will be
    | considered valid. This security feature keeps tokens short-lived so
    | they have less time to be guessed. You may change this as needed.
    |
    | The throttle setting is the number of seconds a user must wait before
    | generating more password reset tokens. This prevents the user from
    | quickly generating a very large amount of password reset tokens.
    |
    */

    'passwords' => [
        'users' => [
            'provider' => 'users',
            'table' => env('AUTH_PASSWORD_RESET_TOKEN_TABLE', 'password_reset_tokens'),
            'expire' => 60,
            'throttle' => 60,
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | Password Confirmation Timeout
    |--------------------------------------------------------------------------
    |
    | Here you may define the amount of seconds before a password confirmation
    | window expires and users are asked to re-enter their password via the
    | confirmation screen. By default, the timeout lasts for three hours.
    |
    */

    'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),

    /*
    |--------------------------------------------------------------------------
    | Starke Anmeldung für Administratoren
    |--------------------------------------------------------------------------
    |
    | Super-Admins und Admins brauchen für den Admin-Bereich eine Session, die
    | mit Passkey oder Authenticator-Code bestätigt wurde (Entscheidung 5,
    | 07.10.2026, EnsureStrongAdminAuthentication). Abschalten nur als
    | Notfallschalter, z. B. wenn WebAuthn auf der Domain ausfällt. In der
    | Testsuite aus; die Tests der Funktion schalten sie gezielt ein.
    |
    */

    'require_strong_admin_authentication' => env('AUTH_REQUIRE_STRONG_ADMIN', true),

    /*
    |--------------------------------------------------------------------------
    | HTTP Basic Auth Gate (Staging-Schutz)
    |--------------------------------------------------------------------------
    |
    | Optionaler vorgelagerter Basic-Auth-Schutz für die gesamte Web-App
    | (z. B. Staging). Wird nur erzwungen, wenn aktiviert UND Zugangsdaten
    | gesetzt sind. Diese Werte über config() statt env() zu lesen stellt
    | sicher, dass der Schutz auch unter `config:cache` aktiv bleibt.
    |
    */

    'basic' => [
        'enabled' => env('BASIC_AUTH_ENABLED', true),
        'user' => env('BASIC_AUTH_USER'),
        'password' => env('BASIC_AUTH_PASSWORD'),
    ],

    /*
    |--------------------------------------------------------------------------
    | Bot-Registrierungen aufräumen (Spamschutz B4)
    |--------------------------------------------------------------------------
    |
    | `users:prune-bot-registrations` löscht über das Formular angelegte
    | Konten, die nach `after_days` weder bestätigt noch genutzt wurden.
    | Der tägliche Lauf ist aus, bis der Probelauf (--dry-run) auf Live
    | geprüft ist; Altkonten aus dem Legacy-Import sind nie betroffen.
    |
    */

    'prune_bot_registrations' => [
        'enabled' => (bool) env('USERS_PRUNE_BOT_REGISTRATIONS', false),
        'after_days' => 14,
    ],

];