From c128d75d8ec0c265a10062e6313500315622261f Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Thu, 18 Jun 2026 17:07:17 +0200
Subject: [PATCH 1/8] wip

---
 resources/js/Pages/Auth/Login.vue             | 33 ++--------
 resources/js/Pages/Auth/usePasskeyLogin.ts    | 34 ++++++++++
 src/Auth/TwoFactor/Sharp2faPasskeyHandler.php | 65 +++++++++++++++++++
 src/Config/SharpConfigBuilder.php             | 12 ++++
 src/SharpInternalServiceProvider.php          |  2 +
 5 files changed, 117 insertions(+), 29 deletions(-)
 create mode 100644 resources/js/Pages/Auth/usePasskeyLogin.ts
 create mode 100644 src/Auth/TwoFactor/Sharp2faPasskeyHandler.php

diff --git a/resources/js/Pages/Auth/Login.vue b/resources/js/Pages/Auth/Login.vue
index 3fa88e9b3..3155ef450 100644
--- a/resources/js/Pages/Auth/Login.vue
+++ b/resources/js/Pages/Auth/Login.vue
@@ -23,6 +23,7 @@
     } from "@simplewebauthn/browser";
     import { api } from "@/api/api";
     import { Separator } from "@/components/ui/separator";
+    import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
 
     const props = defineProps<{
         loginIsEmail: boolean,
@@ -42,37 +43,11 @@
         supports_passkeys: browserSupportsWebAuthn(),
     });
 
-    const passkeyForm = useForm({
-        remember: false,
-        start_authentication_response: '',
-    });
-
-    async function loginWithPasskey(autofill = false) {
-        try {
-            const response = await api.get(route('passkeys.authentication_options'), {
-                ignoreContentType: true,
-            });
-
-            const authenticationOptions = response.data;
-            const authenticationResponse = await startAuthentication({
-                optionsJSON: authenticationOptions,
-                useBrowserAutofill: autofill,
-            });
-
-            console.log(authenticationResponse);
-
-            passkeyForm.remember = form.remember;
-            passkeyForm.start_authentication_response = JSON.stringify(authenticationResponse);
-
-            passkeyForm.post(route('passkeys.login'));
-        } catch (error) {
-            console.error(error);
-        }
-    }
+    const { loginWithPasskey } = usePasskeyLogin();
 
     onMounted(async () => {
         if(config('sharp.auth.passkeys.enabled') && await browserSupportsWebAuthnAutofill()) {
-            await loginWithPasskey(true);
+            await loginWithPasskey({ autofill: true });
         }
     });
 </script>
@@ -161,7 +136,7 @@
                                 type="button"
                                 variant="outline"
                                 class="w-full"
-                                @click="loginWithPasskey()"
+                                @click="loginWithPasskey({ remember: form.remember })"
                             >
                                 {{ __('sharp::pages/auth/login.passkey_button') }}
                             </Button>
diff --git a/resources/js/Pages/Auth/usePasskeyLogin.ts b/resources/js/Pages/Auth/usePasskeyLogin.ts
new file mode 100644
index 000000000..bd1c1704e
--- /dev/null
+++ b/resources/js/Pages/Auth/usePasskeyLogin.ts
@@ -0,0 +1,34 @@
+import { useForm } from "@inertiajs/vue3";
+import { api } from "@/api/api";
+import { route } from "@/utils/url";
+import { startAuthentication } from "@simplewebauthn/browser";
+
+export function usePasskeyLogin() {
+    const passkeyForm = useForm({
+        remember: false,
+        start_authentication_response: '',
+    });
+
+    async function loginWithPasskey({ autofill = false, remember = false }) {
+        try {
+            const response = await api.get(route('passkeys.authentication_options'), {
+                ignoreContentType: true,
+            });
+
+            const authenticationOptions = response.data;
+            const authenticationResponse = await startAuthentication({
+                optionsJSON: authenticationOptions,
+                useBrowserAutofill: autofill,
+            });
+
+            passkeyForm.remember = remember;
+            passkeyForm.start_authentication_response = JSON.stringify(authenticationResponse);
+
+            passkeyForm.post(route('passkeys.login'));
+        } catch (error) {
+            console.error(error);
+        }
+    }
+
+    return { loginWithPasskey }
+}
diff --git a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
new file mode 100644
index 000000000..538d1ef72
--- /dev/null
+++ b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace Code16\Sharp\Auth\TwoFactor;
+
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Session;
+
+class Sharp2faPasskeyHandler implements Sharp2faHandler
+{
+    protected $user = null;
+
+    public function generateCode(bool $remember = false): void
+    {
+        Session::put(
+            $this->getSessionKey(),
+            [
+                'user_id' => $this->user->id,
+                'remember' => $remember,
+            ]
+        );
+    }
+
+    public function isExpectingLogin(): bool
+    {
+        return Session::has($this->getSessionKey());
+    }
+
+    public function setUser($user): self
+    {
+        $this->user = $user;
+
+        return $this;
+    }
+
+    public function isEnabledFor($user): bool
+    {
+        return true;
+    }
+
+    public function checkCode(string $code): bool
+    {
+        return $this->isExpectingLogin()
+            && Hash::check($code, Session::get($this->getSessionKey())['code']);
+    }
+
+    public function userId(): mixed
+    {
+        return Session::get($this->getSessionKey())['user_id'] ?? null;
+    }
+
+    public function remember(): bool
+    {
+        return Session::get($this->getSessionKey())['remember'] ?? false;
+    }
+
+    public function forgetCode(): void
+    {
+        Session::forget($this->getSessionKey());
+    }
+
+    protected function getSessionKey(): string
+    {
+        return 'sharp:2fa:prompt-passkey';
+    }
+}
diff --git a/src/Config/SharpConfigBuilder.php b/src/Config/SharpConfigBuilder.php
index 2a1141364..cfcece7b2 100644
--- a/src/Config/SharpConfigBuilder.php
+++ b/src/Config/SharpConfigBuilder.php
@@ -520,6 +520,18 @@ public function enable2faByTotp(): self
         return $this;
     }
 
+    public function enable2faByPasskey(): self
+    {
+        $this->config['auth']['2fa'] = [
+            'enabled' => true,
+            'handler' => 'passkey',
+        ];
+
+        $this->enablePasskeys();
+
+        return $this;
+    }
+
     public function enablePasskeys(bool $promptAfterLogin = true): self
     {
         $this->config['auth']['passkeys'] = [
diff --git a/src/SharpInternalServiceProvider.php b/src/SharpInternalServiceProvider.php
index 535f31268..f11244a8a 100644
--- a/src/SharpInternalServiceProvider.php
+++ b/src/SharpInternalServiceProvider.php
@@ -10,6 +10,7 @@
 use Code16\Sharp\Auth\TwoFactor\Sharp2faEloquentDefaultTotpHandler;
 use Code16\Sharp\Auth\TwoFactor\Sharp2faHandler;
 use Code16\Sharp\Auth\TwoFactor\Sharp2faNotificationHandler;
+use Code16\Sharp\Auth\TwoFactor\Sharp2faPasskeyHandler;
 use Code16\Sharp\Config\SharpConfigBuilder;
 use Code16\Sharp\Config\SharpLegacyConfigBuilder;
 use Code16\Sharp\Console\DashboardMakeCommand;
@@ -127,6 +128,7 @@ public function register()
             fn () => match (sharp()->config()->get('auth.2fa.handler')) {
                 'notification' => app(Sharp2faNotificationHandler::class),
                 'totp' => app(Sharp2faEloquentDefaultTotpHandler::class),
+                'passkey' => app(Sharp2faPasskeyHandler::class),
                 default => sharp()->config()->get('auth.2fa.handler'),
             }
         );

From 0d205a9e4fc6a3d963133e69b6304fa62f5d5f1a Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Mon, 6 Jul 2026 19:53:12 +0200
Subject: [PATCH 2/8] Refactor Passkey and Multi-Factor Authentication system
 integrations.

---
 resources/js/Pages/Auth/Login.vue             | 12 +--
 resources/js/Pages/Auth/Login2Fa.vue          | 37 ++++---
 resources/js/Pages/Auth/Passkeys/Create.vue   | 99 ++++++++-----------
 resources/js/Pages/Auth/usePasskeyLogin.ts    | 25 ++++-
 resources/js/Pages/Auth/usePasskeyRegister.ts | 41 ++++++++
 resources/js/types/generated.d.ts             |  2 +-
 .../Commands/UpdatePasskeyNameCommand.php     |  6 +-
 src/Auth/Passkeys/Entity/PasskeyList.php      | 21 ++--
 src/Auth/Passkeys/PasskeyEventSubscriber.php  | 17 ----
 src/Auth/Passkeys/PasskeyManager.php          | 41 ++++++++
 src/Auth/Passkeys/SpatiePasskeyManager.php    | 78 +++++++++++++++
 src/Auth/TwoFactor/MultiFactorManager.php     | 50 ++++++++++
 src/Auth/TwoFactor/Sharp2faHandler.php        |  4 +
 .../TwoFactor/Sharp2faNotificationHandler.php |  6 ++
 src/Auth/TwoFactor/Sharp2faPasskeyHandler.php |  6 ++
 src/Auth/TwoFactor/Sharp2faTotpHandler.php    |  6 ++
 src/Enums/MultiFactorMethod.php               | 10 ++
 .../Controllers/Auth/Login2faController.php   | 26 +++--
 src/Http/Controllers/Auth/LoginController.php | 16 ++-
 .../PasskeyAuthenticatedController.php        | 27 +++++
 .../Auth/Passkeys/PasskeyController.php       | 68 +------------
 .../Auth/Passkeys/SpatiePasskeyController.php | 73 ++++++++++++++
 .../SharpAuthenticateOrInMultiFactor.php      | 20 ++++
 src/SharpInternalServiceProvider.php          |  7 +-
 src/routes/auth/passkeys.php                  | 28 ++++--
 25 files changed, 513 insertions(+), 213 deletions(-)
 create mode 100644 resources/js/Pages/Auth/usePasskeyRegister.ts
 delete mode 100644 src/Auth/Passkeys/PasskeyEventSubscriber.php
 create mode 100644 src/Auth/Passkeys/PasskeyManager.php
 create mode 100644 src/Auth/Passkeys/SpatiePasskeyManager.php
 create mode 100644 src/Auth/TwoFactor/MultiFactorManager.php
 create mode 100644 src/Enums/MultiFactorMethod.php
 create mode 100644 src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
 create mode 100644 src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
 create mode 100644 src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php

diff --git a/resources/js/Pages/Auth/Login.vue b/resources/js/Pages/Auth/Login.vue
index 3155ef450..cf36e9494 100644
--- a/resources/js/Pages/Auth/Login.vue
+++ b/resources/js/Pages/Auth/Login.vue
@@ -15,13 +15,9 @@
     import { FormItem } from "@/components/ui/form";
     import { Check } from "lucide-vue-next";
     import TemplateRenderer from "@/components/TemplateRenderer.vue";
-    import { onMounted } from "vue";
     import {
-        startAuthentication,
         browserSupportsWebAuthn,
-        browserSupportsWebAuthnAutofill
     } from "@simplewebauthn/browser";
-    import { api } from "@/api/api";
     import { Separator } from "@/components/ui/separator";
     import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
 
@@ -43,12 +39,8 @@
         supports_passkeys: browserSupportsWebAuthn(),
     });
 
-    const { loginWithPasskey } = usePasskeyLogin();
-
-    onMounted(async () => {
-        if(config('sharp.auth.passkeys.enabled') && await browserSupportsWebAuthnAutofill()) {
-            await loginWithPasskey({ autofill: true });
-        }
+    const { loginWithPasskey } = usePasskeyLogin({
+        autofill: config('sharp.auth.passkeys.enabled'),
     });
 </script>
 
diff --git a/resources/js/Pages/Auth/Login2Fa.vue b/resources/js/Pages/Auth/Login2Fa.vue
index 447090b99..bb57e7980 100644
--- a/resources/js/Pages/Auth/Login2Fa.vue
+++ b/resources/js/Pages/Auth/Login2Fa.vue
@@ -10,14 +10,20 @@
     import { Label } from "@/components/ui/label";
     import { Input } from "@/components/ui/input";
     import { FormItem, FormMessage } from "@/components/ui/form";
+    import { TwoFactorMode } from "@/types";
+    import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
 
-    defineProps<{
-        helpText: string
+    const props = defineProps<{
+        helpText: string,
+        mode: TwoFactorMode,
+        passkeyError: string,
     }>();
 
     const form = useForm({
         code: '',
     });
+
+    const { loginWithPasskey } = usePasskeyLogin({ autofill: props.mode === 'passkey' });
 </script>
 
 <template>
@@ -26,15 +32,15 @@
             {{ __('sharp::pages/auth/login.title') }}
         </Title>
 
-        <template v-if="form.hasErrors">
+        <template v-if="form.hasErrors || passkeyError">
             <Alert class="mb-4" variant="destructive">
                 <AlertDescription>
-                    {{ Object.values(form.errors)[0] }}
+                    {{ Object.values(form.errors)[0] || passkeyError }}
                 </AlertDescription>
             </Alert>
         </template>
 
-        <form @submit.prevent="form.post(route('code16.sharp.login.2fa.post'))">
+        <form @submit.prevent="mode === 'passkey' ? loginWithPasskey({}) : form.post(route('code16.sharp.login.2fa.post'))">
             <AuthCard>
                 <template #title>
                     {{ __('sharp::pages/auth/login.title') }}
@@ -42,15 +48,22 @@
                 <template v-if="helpText" #description>
                     <div class="space-y-2" v-html="helpText"></div>
                 </template>
-                <FormItem>
-                    <Label for="code">
-                        {{ __('sharp::pages/auth/login.code_field') }}
-                    </Label>
-                    <Input type="text" id="code" v-model="form.code" />
-                </FormItem>
+                <template v-if="mode !== 'passkey'">
+                    <FormItem>
+                        <Label for="code">
+                            {{ __('sharp::pages/auth/login.code_field') }}
+                        </Label>
+                        <Input type="text" id="code" v-model="form.code" />
+                    </FormItem>
+                </template>
                 <template #footer>
                     <Button type="submit" class="w-full">
-                        {{ __('sharp::pages/auth/login.button') }}
+                        <template v-if="mode === 'passkey'">
+                            {{ __('sharp::pages/auth/login.passkey_button') }}
+                        </template>
+                        <template v-else>
+                            {{ __('sharp::pages/auth/login.button') }}
+                        </template>
                     </Button>
                 </template>
             </AuthCard>
diff --git a/resources/js/Pages/Auth/Passkeys/Create.vue b/resources/js/Pages/Auth/Passkeys/Create.vue
index 6526bc83f..6d2540df2 100644
--- a/resources/js/Pages/Auth/Passkeys/Create.vue
+++ b/resources/js/Pages/Auth/Passkeys/Create.vue
@@ -11,40 +11,15 @@
     import { startRegistration } from "@simplewebauthn/browser";
     import { api } from "@/api/api";
     import { Field, FieldDescription, FieldError, FieldGroup, FieldLabel } from "@/components/ui/field";
+    import { usePasskeyRegister } from "@/Pages/Auth/usePasskeyRegister";
 
-    const props = defineProps<{
+    defineProps<{
         prompt: boolean,
+        isMultiFactor: boolean,
         cancelUrl: string,
     }>();
 
-    const form = useForm({
-        name: '',
-        passkey: '',
-    });
-
-    async function submit() {
-        form.clearErrors();
-
-        try {
-            const optionsResponse = await api.post(route('code16.sharp.passkeys.validate'), {
-                name: form.name,
-            });
-
-            const registrationResponse = await startRegistration({
-                optionsJSON: optionsResponse.data.passkeyOptions,
-            });
-
-            form.passkey = JSON.stringify(registrationResponse);
-
-            form.post(route('code16.sharp.passkeys.store'));
-        } catch (error) {
-            if (error.response?.status === 422) {
-                form.setError({ name: error.response.data.errors?.name?.[0] });
-            } else {
-                console.error(error);
-            }
-        }
-    }
+    const { form, registerPasskey } = usePasskeyRegister();
 </script>
 
 <template>
@@ -53,7 +28,7 @@
             {{ __('sharp::pages/auth/passkeys.title') }}
         </Title>
 
-        <form @submit.prevent="submit">
+        <form @submit.prevent="registerPasskey()">
             <AuthCard>
                 <template #title>
                     {{ __('sharp::pages/auth/passkeys.title') }}
@@ -88,39 +63,45 @@
 
                 <template #footer>
                     <div class="grid gap-2 w-full">
-                        <Button type="submit" class="w-full" :disabled="form.processing">
-                            {{ prompt ? __('sharp::pages/auth/passkeys.prompt_version.button') : __('sharp::pages/auth/passkeys.account_version.button') }}
-                        </Button>
-
-                        <template v-if="prompt">
-                            <Button
-                                type="button"
-                                variant="outline"
-                                class="w-full"
-                                as="a"
-                                :href="route('code16.sharp.home')"
-                            >
-                                {{ __('sharp::pages/auth/passkeys.prompt_version.skip_prompt_button') }}
-                            </Button>
-                            <Button
-                                type="button"
-                                variant="ghost"
-                                class="w-full"
-                                @click="useForm({}).post(route('code16.sharp.passkeys.skip-prompt'))"
-                            >
-                                {{ __('sharp::pages/auth/passkeys.prompt_version.never_ask_again_button') }}
+                        <template v-if="isMultiFactor">
+                            <Button type="submit" class="w-full" :disabled="form.processing">
+                                {{ __('sharp::pages/auth/passkeys.prompt_version.button')  }}
                             </Button>
                         </template>
                         <template v-else>
-                            <Button
-                                type="button"
-                                variant="ghost"
-                                class="w-full"
-                                as="a"
-                                :href="cancelUrl"
-                            >
-                                {{ __('sharp::pages/auth/passkeys.account_version.cancel_button') }}
+                            <Button type="submit" class="w-full" :disabled="form.processing">
+                                {{ prompt ? __('sharp::pages/auth/passkeys.prompt_version.button') : __('sharp::pages/auth/passkeys.account_version.button') }}
                             </Button>
+                            <template v-if="prompt">
+                                <Button
+                                    type="button"
+                                    variant="outline"
+                                    class="w-full"
+                                    as="a"
+                                    :href="route('code16.sharp.home')"
+                                >
+                                    {{ __('sharp::pages/auth/passkeys.prompt_version.skip_prompt_button') }}
+                                </Button>
+                                <Button
+                                    type="button"
+                                    variant="ghost"
+                                    class="w-full"
+                                    @click="useForm({}).post(route('code16.sharp.passkeys.skip-prompt'))"
+                                >
+                                    {{ __('sharp::pages/auth/passkeys.prompt_version.never_ask_again_button') }}
+                                </Button>
+                            </template>
+                            <template v-else>
+                                <Button
+                                    type="button"
+                                    variant="ghost"
+                                    class="w-full"
+                                    as="a"
+                                    :href="cancelUrl"
+                                >
+                                    {{ __('sharp::pages/auth/passkeys.account_version.cancel_button') }}
+                                </Button>
+                            </template>
                         </template>
                     </div>
                 </template>
diff --git a/resources/js/Pages/Auth/usePasskeyLogin.ts b/resources/js/Pages/Auth/usePasskeyLogin.ts
index bd1c1704e..d56a34dc7 100644
--- a/resources/js/Pages/Auth/usePasskeyLogin.ts
+++ b/resources/js/Pages/Auth/usePasskeyLogin.ts
@@ -1,9 +1,18 @@
 import { useForm } from "@inertiajs/vue3";
 import { api } from "@/api/api";
 import { route } from "@/utils/url";
-import { startAuthentication } from "@simplewebauthn/browser";
+import { browserSupportsWebAuthnAutofill, startAuthentication } from "@simplewebauthn/browser";
+import { onMounted } from "vue";
 
-export function usePasskeyLogin() {
+type PasskeyLoginOptions = {
+    autofill?: boolean;
+}
+
+export function usePasskeyLogin(options: PasskeyLoginOptions) {
+    return useSpatiePasskeyLogin(options);
+}
+
+function useSpatiePasskeyLogin(options: PasskeyLoginOptions) {
     const passkeyForm = useForm({
         remember: false,
         start_authentication_response: '',
@@ -24,11 +33,21 @@ export function usePasskeyLogin() {
             passkeyForm.remember = remember;
             passkeyForm.start_authentication_response = JSON.stringify(authenticationResponse);
 
-            passkeyForm.post(route('passkeys.login'));
+            passkeyForm.post(route('passkeys.login'), {
+                headers: {
+                    'X-Sharp': '1',
+                },
+            });
         } catch (error) {
             console.error(error);
         }
     }
 
+    if(options.autofill && browserSupportsWebAuthnAutofill()) {
+        onMounted(() => {
+            loginWithPasskey({ autofill: true });
+        })
+    }
+
     return { loginWithPasskey }
 }
diff --git a/resources/js/Pages/Auth/usePasskeyRegister.ts b/resources/js/Pages/Auth/usePasskeyRegister.ts
new file mode 100644
index 000000000..13074bb15
--- /dev/null
+++ b/resources/js/Pages/Auth/usePasskeyRegister.ts
@@ -0,0 +1,41 @@
+import { useForm } from "@inertiajs/vue3";
+import { api } from "@/api/api";
+import { route } from "@/utils/url";
+import { startRegistration } from "@simplewebauthn/browser";
+
+export function usePasskeyRegister() {
+    return useSpatiePasskeyRegister();
+}
+
+function useSpatiePasskeyRegister() {
+    const form = useForm({
+        name: '',
+        passkey: '',
+    });
+
+    async function registerPasskey() {
+        form.clearErrors();
+
+        try {
+            const optionsResponse = await api.post(route('code16.sharp.passkeys.spatie.validate'), {
+                name: form.name,
+            });
+
+            const registrationResponse = await startRegistration({
+                optionsJSON: optionsResponse.data.passkeyOptions,
+            });
+
+            form.passkey = JSON.stringify(registrationResponse);
+
+            form.post(route('code16.sharp.passkeys.spatie.store'));
+        } catch (error: any) {
+            if (error.response?.status === 422) {
+                form.setError({ name: error.response.data.errors?.name?.[0] });
+            } else {
+                console.error(error);
+            }
+        }
+    }
+
+    return { form, registerPasskey }
+}
diff --git a/resources/js/types/generated.d.ts b/resources/js/types/generated.d.ts
index 35bb75464..af612352b 100644
--- a/resources/js/types/generated.d.ts
+++ b/resources/js/types/generated.d.ts
@@ -641,7 +641,6 @@ export type FormUploadFieldData = {
   type: "upload";
   imageCropRatio: [number, number];
   imageTransformable: boolean;
-  imageCompactThumbnail: boolean;
   imageTransformKeepOriginal: boolean | null;
   imageTransformableFileTypes: Array<string> | null;
   allowedExtensions: Array<string> | null;
@@ -984,6 +983,7 @@ export type ShowTextFieldData = {
   embeds: { [key: string]: EmbedData } | null;
   label: string | null;
 };
+export type TwoFactorMode = "notification" | "totp" | "passkey";
 export type UserData = {
   name: string | null;
   email: string | null;
diff --git a/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php b/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php
index 738a6f3ce..2f2001fc2 100644
--- a/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php
+++ b/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php
@@ -2,10 +2,10 @@
 
 namespace Code16\Sharp\Auth\Passkeys\Commands;
 
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
 use Code16\Sharp\EntityList\Commands\InstanceCommand;
 use Code16\Sharp\Form\Fields\SharpFormTextField;
 use Code16\Sharp\Utils\Fields\FieldsContainer;
-use Spatie\LaravelPasskeys\Models\Passkey;
 
 class UpdatePasskeyNameCommand extends InstanceCommand
 {
@@ -25,7 +25,7 @@ public function buildFormFields(FieldsContainer $formFields): void
     protected function initialData(mixed $instanceId): array
     {
         return [
-            'name' => Passkey::findOrFail($instanceId)->name,
+            'name' => app(PasskeyManager::class)->model()::findOrFail($instanceId)->name,
         ];
     }
 
@@ -35,7 +35,7 @@ public function execute(mixed $instanceId, array $data = []): array
             'name' => 'required',
         ]);
 
-        Passkey::findOrFail($instanceId)->update([
+        app(PasskeyManager::class)->model()::findOrFail($instanceId)->update([
             'name' => $data['name'],
         ]);
 
diff --git a/src/Auth/Passkeys/Entity/PasskeyList.php b/src/Auth/Passkeys/Entity/PasskeyList.php
index a90c418e3..f7b4f69eb 100644
--- a/src/Auth/Passkeys/Entity/PasskeyList.php
+++ b/src/Auth/Passkeys/Entity/PasskeyList.php
@@ -3,15 +3,14 @@
 namespace Code16\Sharp\Auth\Passkeys\Entity;
 
 use Code16\Sharp\Auth\Passkeys\Commands\UpdatePasskeyNameCommand;
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
 use Code16\Sharp\EntityList\Commands\EntityCommand;
 use Code16\Sharp\EntityList\Fields\EntityListBadgeField;
 use Code16\Sharp\EntityList\Fields\EntityListField;
 use Code16\Sharp\EntityList\Fields\EntityListFieldsContainer;
 use Code16\Sharp\EntityList\SharpEntityList;
-use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Support\Arrayable;
 use Illuminate\Database\Eloquent\Model;
-use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
 
 class PasskeyList extends SharpEntityList
 {
@@ -70,14 +69,16 @@ public function getInstanceCommands(): ?array
 
     public function delete(mixed $id): void
     {
-        $this->currentUser()->passKeys()->findOrFail($id)->delete();
+        app(PasskeyManager::class)->userPasskeys(auth()->user())->findOrFail($id)->delete();
     }
 
     public function getListData(): array|Arrayable
     {
+        $lastUsedPasskey = app(PasskeyManager::class)->getLastUsedPasskey();
+
         return $this
-            ->setCustomTransformer('usage', function ($value, Model $passkey) {
-                return $passkey->getKey() == request()->cookie('sharp_last_used_passkey')
+            ->setCustomTransformer('usage', function ($value, Model $passkey) use ($lastUsedPasskey) {
+                return $passkey->is($lastUsedPasskey)
                     ? trans('sharp::auth.passkeys.list.used_in_this_browser_badge')
                     : null;
             })
@@ -88,15 +89,7 @@ public function getListData(): array|Arrayable
                 return $passkey->created_at?->isoFormat('LLL');
             })
             ->transform(
-                $this->currentUser()->passkeys()->orderByDesc('created_at')->get()
+                app(PasskeyManager::class)->userPasskeys(auth()->user())->orderByDesc('created_at')->get()
             );
     }
-
-    protected function currentUser(): Authenticatable&HasPasskeys
-    {
-        /** @var Authenticatable&HasPasskeys $user */
-        $user = auth()->user();
-
-        return $user;
-    }
 }
diff --git a/src/Auth/Passkeys/PasskeyEventSubscriber.php b/src/Auth/Passkeys/PasskeyEventSubscriber.php
deleted file mode 100644
index 9ee0c4943..000000000
--- a/src/Auth/Passkeys/PasskeyEventSubscriber.php
+++ /dev/null
@@ -1,17 +0,0 @@
-<?php
-
-namespace Code16\Sharp\Auth\Passkeys;
-
-use Illuminate\Events\Dispatcher;
-use Illuminate\Support\Facades\Cookie;
-use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
-
-class PasskeyEventSubscriber
-{
-    public function subscribe(Dispatcher $events): void
-    {
-        $events->listen(PasskeyUsedToAuthenticateEvent::class, function (PasskeyUsedToAuthenticateEvent $event) {
-            Cookie::queue('sharp_last_used_passkey', $event->passkey->id, 576000);
-        });
-    }
-}
diff --git a/src/Auth/Passkeys/PasskeyManager.php b/src/Auth/Passkeys/PasskeyManager.php
new file mode 100644
index 000000000..30c360d41
--- /dev/null
+++ b/src/Auth/Passkeys/PasskeyManager.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Code16\Sharp\Auth\Passkeys;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Contracts\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Events\Dispatcher;
+
+/**
+ * @template TModel of Model
+ */
+interface PasskeyManager
+{
+    public function isEnabled(): bool;
+
+    /**
+     * @param  TModel  $passkey
+     */
+    public function setLastUsedPasskey(Model $passkey): void;
+
+    /**
+     * @return TModel|null
+     */
+    public function getLastUsedPasskey(): ?Model;
+
+    public function getErrorMessage(): ?string;
+
+    public function setRedirectUrl(): void;
+
+    public function userPasskeys(Authenticatable $user): Builder;
+
+    public function userHasPasskey(Authenticatable $user): bool;
+
+    /**
+     * @return class-string<TModel>
+     */
+    public function model(): string;
+
+    public function subscribe(Dispatcher $events): void;
+}
diff --git a/src/Auth/Passkeys/SpatiePasskeyManager.php b/src/Auth/Passkeys/SpatiePasskeyManager.php
new file mode 100644
index 000000000..1b8e01d9d
--- /dev/null
+++ b/src/Auth/Passkeys/SpatiePasskeyManager.php
@@ -0,0 +1,78 @@
+<?php
+
+namespace Code16\Sharp\Auth\Passkeys;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Contracts\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Support\Facades\Cookie;
+use Illuminate\Support\Facades\Redirect;
+use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
+use Spatie\LaravelPasskeys\Models\Passkey;
+use Spatie\LaravelPasskeys\Support\Config;
+
+/**
+ * @implements PasskeyManager<Passkey>
+ */
+class SpatiePasskeyManager implements PasskeyManager
+{
+    public function isEnabled(): bool
+    {
+        return sharp()->config()->get('auth.passkeys.enabled');
+    }
+
+    public function setLastUsedPasskey(Model $passkey): void
+    {
+        Cookie::queue('sharp_last_used_passkey', $passkey->getKey(), 576000);
+    }
+
+    public function getLastUsedPasskey(): ?Passkey
+    {
+        return $this->model()::find(Cookie::get('sharp_last_used_passkey'));
+    }
+
+    public function getErrorMessage(): ?string
+    {
+        return session('authenticatePasskey::message');
+    }
+
+    public function setRedirectUrl(): void
+    {
+        config()->set(
+            'passkeys.redirect_to_after_login',
+            route('code16.sharp.passkeys.authenticated', [
+                'intended_url' => Redirect::intended(
+                    route('code16.sharp.home', [
+                        'globalFilter' => sharp()->context()->globalFilterUrlSegmentValue(),
+                    ])
+                )->getTargetUrl(),
+            ])
+        );
+    }
+
+    public function userPasskeys(Authenticatable $user): Builder
+    {
+        return $user->passkeys();
+    }
+
+    public function userHasPasskey(Authenticatable $user): bool
+    {
+        return $user->passkeys()->exists();
+    }
+
+    public function model(): string
+    {
+        return Config::getPassKeyModel();
+    }
+
+    public function subscribe(Dispatcher $events): void
+    {
+        $events->listen(function (PasskeyUsedToAuthenticateEvent $event) {
+            if (request()->headers->has('X-Sharp')) {
+                $this->setLastUsedPasskey($event->passkey);
+                $this->setRedirectUrl();
+            }
+        });
+    }
+}
diff --git a/src/Auth/TwoFactor/MultiFactorManager.php b/src/Auth/TwoFactor/MultiFactorManager.php
new file mode 100644
index 000000000..de9472260
--- /dev/null
+++ b/src/Auth/TwoFactor/MultiFactorManager.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Code16\Sharp\Auth\TwoFactor;
+
+use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Support\Facades\Auth;
+
+class MultiFactorManager
+{
+    public function isEnabled(): bool
+    {
+        return sharp()->config()->get('auth.2fa.enabled');
+    }
+
+    public function currentMethod(): ?MultiFactorMethod
+    {
+        return $this->currentHandler()?->method();
+    }
+
+    public function currentHandler(): ?Sharp2faHandler
+    {
+        return app(Sharp2faHandler::class);
+    }
+
+    public function currentHandlerHelpText(): ?string
+    {
+        return method_exists($this->currentHandler(), 'formHelpText')
+            ? $this->currentHandler()->formHelpText()
+            : trans('sharp::auth.2fa.form_help_text');
+    }
+
+    public function isUsingPasskeyMethod(): bool
+    {
+        return $this->isEnabled()
+            && $this->currentMethod() === MultiFactorMethod::Passkey
+            && $this->currentHandler()->isExpectingLogin();
+    }
+
+    public function currentUser(): ?Authenticatable
+    {
+        $userId = $this->currentHandler()?->userId();
+
+        return $userId
+            ? Auth::guard(sharp()->config()->get('auth.guard'))
+                ->getProvider()
+                ->retrieveById($userId)
+            : null;
+    }
+}
diff --git a/src/Auth/TwoFactor/Sharp2faHandler.php b/src/Auth/TwoFactor/Sharp2faHandler.php
index 3903b3c81..031be9a5e 100644
--- a/src/Auth/TwoFactor/Sharp2faHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faHandler.php
@@ -2,6 +2,8 @@
 
 namespace Code16\Sharp\Auth\TwoFactor;
 
+use Code16\Sharp\Enums\MultiFactorMethod;
+
 interface Sharp2faHandler
 {
     public function generateCode(bool $remember = false): void;
@@ -19,4 +21,6 @@ public function userId(): mixed;
     public function setUser($user): self;
 
     public function remember(): bool;
+
+    public function method(): MultiFactorMethod;
 }
diff --git a/src/Auth/TwoFactor/Sharp2faNotificationHandler.php b/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
index 5a1d490e8..f1911cbea 100644
--- a/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
@@ -3,6 +3,7 @@
 namespace Code16\Sharp\Auth\TwoFactor;
 
 use Carbon\Carbon;
+use Code16\Sharp\Enums\MultiFactorMethod;
 use Illuminate\Notifications\Notification;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
@@ -81,4 +82,9 @@ protected function getSessionKey(): string
     {
         return 'sharp:2fa:code';
     }
+
+    public function method(): MultiFactorMethod
+    {
+        return MultiFactorMethod::Notification;
+    }
 }
diff --git a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
index 538d1ef72..4dd6d58a0 100644
--- a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Auth\TwoFactor;
 
+use Code16\Sharp\Enums\MultiFactorMethod;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
 
@@ -62,4 +63,9 @@ protected function getSessionKey(): string
     {
         return 'sharp:2fa:prompt-passkey';
     }
+
+    public function method(): MultiFactorMethod
+    {
+        return MultiFactorMethod::Passkey;
+    }
 }
diff --git a/src/Auth/TwoFactor/Sharp2faTotpHandler.php b/src/Auth/TwoFactor/Sharp2faTotpHandler.php
index 762b76b41..0234dc489 100644
--- a/src/Auth/TwoFactor/Sharp2faTotpHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faTotpHandler.php
@@ -3,6 +3,7 @@
 namespace Code16\Sharp\Auth\TwoFactor;
 
 use Code16\Sharp\Auth\TwoFactor\Engines\Sharp2faTotpEngine;
+use Code16\Sharp\Enums\MultiFactorMethod;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Session;
 use Illuminate\Support\Str;
@@ -74,6 +75,11 @@ protected function getSessionKey(): string
         return 'sharp:2fa:code';
     }
 
+    public function method(): MultiFactorMethod
+    {
+        return MultiFactorMethod::Totp;
+    }
+
     public function setUser($user): self
     {
         $this->user = $user;
diff --git a/src/Enums/MultiFactorMethod.php b/src/Enums/MultiFactorMethod.php
new file mode 100644
index 000000000..aea2955e7
--- /dev/null
+++ b/src/Enums/MultiFactorMethod.php
@@ -0,0 +1,10 @@
+<?php
+
+namespace Code16\Sharp\Enums;
+
+enum MultiFactorMethod: string
+{
+    case Notification = 'notification';
+    case Totp = 'totp';
+    case Passkey = 'passkey';
+}
diff --git a/src/Http/Controllers/Auth/Login2faController.php b/src/Http/Controllers/Auth/Login2faController.php
index 9495b99d4..d77131f45 100644
--- a/src/Http/Controllers/Auth/Login2faController.php
+++ b/src/Http/Controllers/Auth/Login2faController.php
@@ -2,33 +2,41 @@
 
 namespace Code16\Sharp\Http\Controllers\Auth;
 
-use Code16\Sharp\Auth\TwoFactor\Sharp2faHandler;
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Code16\Sharp\Enums\MultiFactorMethod;
 use Code16\Sharp\Http\Controllers\Auth\Requests\Login2faRequest;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
 use Inertia\Inertia;
 use Inertia\Response;
 
 class Login2faController extends Controller
 {
-    public function create(Sharp2faHandler $sharp2faService): RedirectResponse|Response
+    public function create(Request $request, MultiFactorManager $multiFactor, PasskeyManager $passkeys): RedirectResponse|Response
     {
-        if ($sharp2faService->isExpectingLogin()) {
-            $helpText = method_exists($sharp2faService, 'formHelpText')
-                ? $sharp2faService->formHelpText()
-                : trans('sharp::auth.2fa.form_help_text');
+        if ($multiFactor->currentHandler()?->isExpectingLogin()) {
+            $user = $multiFactor->currentUser();
+
+            if ($multiFactor->currentMethod() === MultiFactorMethod::Passkey
+                && ! $passkeys->userHasPasskey($user)) {
+                return redirect()->route('code16.sharp.passkeys.create');
+            }
 
             return Inertia::render('Auth/Login2Fa', [
-                'helpText' => $helpText,
+                'helpText' => $multiFactor->currentHandlerHelpText(),
+                'mode' => $multiFactor->currentMethod(),
+                'passkeyError' => $passkeys->getErrorMessage(),
             ]);
         }
 
         return redirect()->route('code16.sharp.login');
     }
 
-    public function store(Login2faRequest $request, Sharp2faHandler $sharp2faService): RedirectResponse
+    public function store(Login2faRequest $request, MultiFactorManager $twoFactor): RedirectResponse
     {
-        $request->authenticate($sharp2faService);
+        $request->authenticate($twoFactor->currentHandler());
         $request->session()->regenerate();
 
         return redirect()->intended(route('code16.sharp.home'));
diff --git a/src/Http/Controllers/Auth/LoginController.php b/src/Http/Controllers/Auth/LoginController.php
index 62390b255..6f13f92c4 100644
--- a/src/Http/Controllers/Auth/LoginController.php
+++ b/src/Http/Controllers/Auth/LoginController.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Http\Controllers\Auth;
 
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
 use Code16\Sharp\Exceptions\Auth\SharpAuthenticationNeeds2faException;
 use Code16\Sharp\Http\Controllers\Auth\Requests\LoginRequest;
 use Illuminate\Contracts\View\View;
@@ -15,15 +16,13 @@
 
 class LoginController extends Controller
 {
-    public function create(): RedirectResponse|Response
+    public function create(PasskeyManager $passkeys): RedirectResponse|Response
     {
         if ($loginPageUrl = sharp()->config()->get('auth.login_page_url')) {
             return redirect()->to($loginPageUrl);
         }
 
-        if (sharp()->config()->get('auth.passkeys.enabled')) {
-            session()->put('passkeys.redirect', route('code16.sharp.home'));
-
+        if ($passkeys->isEnabled()) {
             if (! Route::has('passkeys.login')) {
                 throw new \Exception('Passkeys routes are not defined. Add `Route::passkeys()` in your routes/web.php file.');
             }
@@ -38,11 +37,11 @@ public function create(): RedirectResponse|Response
                     ? $message->render()
                     : view('sharp::partials.login-form-message', ['message' => $message])->render()
                 : null,
-            'passkeyError' => session('authenticatePasskey::message'),
+            'passkeyError' => $passkeys->getErrorMessage(),
         ]);
     }
 
-    public function store(LoginRequest $request): RedirectResponse
+    public function store(LoginRequest $request, PasskeyManager $passkeys): RedirectResponse
     {
         try {
             $request->authenticate();
@@ -53,12 +52,11 @@ public function store(LoginRequest $request): RedirectResponse
 
         $request->session()->regenerate();
 
-        if (sharp()->config()->get('auth.passkeys.enabled')
+        if ($passkeys->isEnabled()
             && sharp()->config()->get('auth.passkeys.prompt_after_login')
             && ! $request->cookie('sharp_skip_passkey_prompt')
             && $request->boolean('supports_passkeys')
-            && method_exists($request->user(), 'passkeys')
-            && $request->user()->passkeys()->count() === 0
+            && ! $passkeys->userHasPasskey($request->user())
         ) {
             return redirect()->route('code16.sharp.passkeys.create', ['prompt' => true]);
         }
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
new file mode 100644
index 000000000..732420088
--- /dev/null
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
+
+class PasskeyAuthenticatedController extends Controller
+{
+    public function __invoke(Request $request, MultiFactorManager $multiFactor)
+    {
+        if ($multiFactor->isUsingPasskeyMethod()) {
+            if (! $request->user()->is($multiFactor->currentUser())) {
+                Auth::guard(sharp()->config()->get('auth.guard'))->logout();
+
+                return redirect()->route('code16.sharp.login.2fa')
+                    ->withErrors(['error' => 'The passkey does not belong to the current user.']);
+            }
+
+            $multiFactor->currentHandler()->forgetCode();
+        }
+
+        return redirect(request()->input('intended_url', route('code16.sharp.home')));
+    }
+}
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyController.php
index 3a633eea0..95749a4a2 100644
--- a/src/Http/Controllers/Auth/Passkeys/PasskeyController.php
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyController.php
@@ -2,82 +2,20 @@
 
 namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
 
-use Illuminate\Contracts\Auth\Authenticatable;
-use Illuminate\Http\JsonResponse;
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
-use Illuminate\Validation\ValidationException;
 use Inertia\Inertia;
 use Inertia\Response;
-use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
-use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
-use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
-use Spatie\LaravelPasskeys\Support\Config;
-use Throwable;
 
 class PasskeyController extends Controller
 {
-    public function create(Request $request): Response
+    public function create(Request $request, MultiFactorManager $multiFactor): Response
     {
         return Inertia::render('Auth/Passkeys/Create', [
             'prompt' => $request->boolean('prompt'),
+            'isMultiFactor' => $multiFactor->isUsingPasskeyMethod(),
             'cancelUrl' => redirect()->getIntendedUrl(),
         ]);
     }
-
-    public function validate(): JsonResponse
-    {
-        request()->validate([
-            'name' => 'required|string|max:255',
-        ]);
-
-        return response()->json([
-            'passkeyOptions' => json_decode($this->generatePasskeyOptions()),
-        ]);
-    }
-
-    public function store(Request $request)
-    {
-        $passkey = request()->input('passkey');
-        $storePasskeyAction = Config::getAction('store_passkey', StorePasskeyAction::class);
-
-        try {
-            $storePasskeyAction->execute(
-                $this->currentUser(),
-                $passkey, $this->previouslyGeneratedPasskeyOptions(),
-                request()->getHost(),
-                ['name' => request()->input('name')]
-            );
-        } catch (Throwable $e) {
-            throw ValidationException::withMessages([
-                'name' => __('passkeys::passkeys.error_something_went_wrong_generating_the_passkey'),
-            ])->errorBag('passkeyForm');
-        }
-
-        return redirect()->intended(route('code16.sharp.home'));
-    }
-
-    protected function currentUser(): Authenticatable&HasPasskeys
-    {
-        /** @var Authenticatable&HasPasskeys $user */
-        $user = auth()->user();
-
-        return $user;
-    }
-
-    protected function generatePasskeyOptions(): string
-    {
-        $generatePassKeyOptionsAction = Config::getAction('generate_passkey_register_options', GeneratePasskeyRegisterOptionsAction::class);
-
-        $options = $generatePassKeyOptionsAction->execute($this->currentUser());
-
-        session()->put('passkey-registration-options', $options);
-
-        return $options;
-    }
-
-    protected function previouslyGeneratedPasskeyOptions(): ?string
-    {
-        return session()->pull('passkey-registration-options');
-    }
 }
diff --git a/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php b/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
new file mode 100644
index 000000000..a08ca6a39
--- /dev/null
+++ b/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Validation\ValidationException;
+use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
+use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
+use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
+use Spatie\LaravelPasskeys\Support\Config;
+use Throwable;
+
+class SpatiePasskeyController extends Controller
+{
+    public function validate(): JsonResponse
+    {
+        request()->validate([
+            'name' => 'required|string|max:255',
+        ]);
+
+        return response()->json([
+            'passkeyOptions' => json_decode($this->generatePasskeyOptions()),
+        ]);
+    }
+
+    public function store(Request $request)
+    {
+        $passkey = request()->input('passkey');
+        $storePasskeyAction = Config::getAction('store_passkey', StorePasskeyAction::class);
+
+        try {
+            $storePasskeyAction->execute(
+                $this->currentUser(),
+                $passkey, $this->previouslyGeneratedPasskeyOptions(),
+                request()->getHost(),
+                ['name' => request()->input('name')]
+            );
+        } catch (Throwable $e) {
+            throw ValidationException::withMessages([
+                'name' => __('passkeys::passkeys.error_something_went_wrong_generating_the_passkey'),
+            ])->errorBag('passkeyForm');
+        }
+
+        return redirect()->intended(route('code16.sharp.home'));
+    }
+
+    protected function currentUser(): Authenticatable&HasPasskeys
+    {
+        return app(MultiFactorManager::class)->isUsingPasskeyMethod()
+            ? app(MultiFactorManager::class)->currentUser()
+            : auth()->user();
+    }
+
+    protected function generatePasskeyOptions(): string
+    {
+        $generatePassKeyOptionsAction = Config::getAction('generate_passkey_register_options', GeneratePasskeyRegisterOptionsAction::class);
+
+        $options = $generatePassKeyOptionsAction->execute($this->currentUser());
+
+        session()->put('passkey-registration-options', $options);
+
+        return $options;
+    }
+
+    protected function previouslyGeneratedPasskeyOptions(): ?string
+    {
+        return session()->pull('passkey-registration-options');
+    }
+}
diff --git a/src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php b/src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php
new file mode 100644
index 000000000..85753fbab
--- /dev/null
+++ b/src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Code16\Sharp\Http\Middleware;
+
+use Closure;
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+
+class SharpAuthenticateOrInMultiFactor extends SharpAuthenticate
+{
+    public function handle($request, Closure $next, ...$guards)
+    {
+        $multiFactor = app(MultiFactorManager::class);
+
+        if ($multiFactor->isEnabled() && $multiFactor->currentHandler()?->isExpectingLogin()) {
+            return $next($request);
+        }
+
+        return parent::handle($request, $next, ...$guards);
+    }
+}
diff --git a/src/SharpInternalServiceProvider.php b/src/SharpInternalServiceProvider.php
index 78b6e00b9..d116b504a 100644
--- a/src/SharpInternalServiceProvider.php
+++ b/src/SharpInternalServiceProvider.php
@@ -3,7 +3,8 @@
 namespace Code16\Sharp;
 
 use Code16\Sharp\Auth\Impersonate\SharpImpersonationHandler;
-use Code16\Sharp\Auth\Passkeys\PasskeyEventSubscriber;
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
+use Code16\Sharp\Auth\Passkeys\SpatiePasskeyManager;
 use Code16\Sharp\Auth\SharpAuthorizationManager;
 use Code16\Sharp\Auth\TwoFactor\Engines\GoogleTotpEngine;
 use Code16\Sharp\Auth\TwoFactor\Engines\Sharp2faTotpEngine;
@@ -90,7 +91,7 @@ public function boot()
 
         $this->configureOctane();
 
-        Event::subscribe(PasskeyEventSubscriber::class);
+        Event::subscribe(PasskeyManager::class);
     }
 
     public function register()
@@ -126,6 +127,8 @@ public function register()
                 : null;
         });
 
+        $this->app->bind(PasskeyManager::class, SpatiePasskeyManager::class);
+
         $this->app->register(InertiaServiceProvider::class);
 
         $this->app->rebinding('request', function ($app, $request) {
diff --git a/src/routes/auth/passkeys.php b/src/routes/auth/passkeys.php
index 41ded79c8..4582e4043 100644
--- a/src/routes/auth/passkeys.php
+++ b/src/routes/auth/passkeys.php
@@ -1,21 +1,31 @@
 <?php
 
+use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyAuthenticatedController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeySkipPromptController;
+use Code16\Sharp\Http\Controllers\Auth\Passkeys\SpatiePasskeyController;
+use Code16\Sharp\Http\Middleware\SharpAuthenticateOrInMultiFactor;
 use Illuminate\Support\Facades\Route;
 
-Route::middleware(['sharp_common', 'sharp_web', 'sharp_auth'])
+Route::middleware(['sharp_common', 'sharp_web'])
     ->prefix('/'.sharp()->config()->get('custom_url_segment'))
     ->group(function () {
-        Route::get('/passkeys/create', [PasskeyController::class, 'create'])
-            ->name('code16.sharp.passkeys.create');
+        Route::middleware([SharpAuthenticateOrInMultiFactor::class])->group(function () {
+            Route::get('/passkeys/create', [PasskeyController::class, 'create'])
+                ->name('code16.sharp.passkeys.create');
 
-        Route::post('/passkeys/validate', [PasskeyController::class, 'validate'])
-            ->name('code16.sharp.passkeys.validate');
+            Route::post('/spatie-passkeys/validate', [SpatiePasskeyController::class, 'validate'])
+                ->name('code16.sharp.passkeys.spatie.validate');
 
-        Route::post('/passkeys', [PasskeyController::class, 'store'])
-            ->name('code16.sharp.passkeys.store');
+            Route::post('/spatie-passkeys', [SpatiePasskeyController::class, 'store'])
+                ->name('code16.sharp.passkeys.spatie.store');
+        });
 
-        Route::post('/passkeys/skip-prompt', PasskeySkipPromptController::class)
-            ->name('code16.sharp.passkeys.skip-prompt');
+        Route::middleware(['sharp_auth'])->group(function () {
+            Route::post('/passkeys/skip-prompt', PasskeySkipPromptController::class)
+                ->name('code16.sharp.passkeys.skip-prompt');
+
+            Route::get('/passkeys/authenticated', PasskeyAuthenticatedController::class)
+                ->name('code16.sharp.passkeys.authenticated');
+        });
     });

From 873e54fcd0ac6ad65117cb1e2cfee6b9c0c58355 Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Tue, 7 Jul 2026 17:15:06 +0200
Subject: [PATCH 3/8] Fix 2fa tests

---
 tests/Fixtures/TestAuthGuard.php             | 21 +++++++++++----
 tests/Http/Auth/Login2faNotificationTest.php | 28 ++++----------------
 tests/Http/Auth/Login2faTotpTest.php         | 24 +++--------------
 tests/Pest.php                               | 21 ++++++++++++++-
 4 files changed, 45 insertions(+), 49 deletions(-)

diff --git a/tests/Fixtures/TestAuthGuard.php b/tests/Fixtures/TestAuthGuard.php
index 0634d5b63..c91bf204d 100644
--- a/tests/Fixtures/TestAuthGuard.php
+++ b/tests/Fixtures/TestAuthGuard.php
@@ -8,7 +8,8 @@
 
 class TestAuthGuard implements Guard, StatefulGuard
 {
-    private ?User $user = null;
+    private ?Authenticatable $user = null;
+    public bool $isOnce = false;
 
     public function check()
     {
@@ -27,7 +28,7 @@ public function user()
 
     public function id()
     {
-        return $this->hasUser() ? 1 : null;
+        return $this->user?->id;
     }
 
     public function validate(array $credentials = []) {}
@@ -45,7 +46,7 @@ public function hasUser()
     public function attempt(array $credentials = [], $remember = false)
     {
         if ($credentials['email'] === 'test@example.org' && $credentials['password'] === 'password') {
-            $this->login(new User(array_merge($credentials, ['shouldRemember' => $remember])));
+            $this->login(new User(['id' => 1, ...$credentials, 'shouldRemember' => $remember]));
 
             return true;
         }
@@ -56,7 +57,8 @@ public function attempt(array $credentials = [], $remember = false)
     public function once(array $credentials = [])
     {
         if ($credentials['email'] === 'test@example.org' && $credentials['password'] === 'password') {
-            $this->setUser(new User($credentials));
+            $this->setUser(new User(['id' => 1, ...$credentials]));
+            $this->isOnce = true;
 
             return true;
         }
@@ -69,7 +71,16 @@ public function login(Authenticatable $user, $remember = false)
         $this->setUser($user);
     }
 
-    public function loginUsingId($id, $remember = false) {}
+    public function loginUsingId($id, $remember = false)
+    {
+        if ($id === 1) {
+            $this->login($user = new User(['id' => 1, 'email' => 'test@example.org']));
+
+            return $user;
+        }
+
+        return false;
+    }
 
     public function onceUsingId($id) {}
 
diff --git a/tests/Http/Auth/Login2faNotificationTest.php b/tests/Http/Auth/Login2faNotificationTest.php
index bf01f6424..45e15e40f 100644
--- a/tests/Http/Auth/Login2faNotificationTest.php
+++ b/tests/Http/Auth/Login2faNotificationTest.php
@@ -4,7 +4,6 @@
 use Code16\Sharp\Auth\TwoFactor\Sharp2faNotificationHandler;
 use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
 use Code16\Sharp\Tests\Fixtures\TestAuthGuard;
-use Code16\Sharp\Tests\Fixtures\User;
 use Illuminate\Support\Facades\Notification;
 
 beforeEach(function () {
@@ -20,8 +19,7 @@
 it('redirects to 2fa code page after successful first step login', function () {
     Notification::fake();
 
-    $this->post(route('code16.sharp.login.post'), ['login' => 'test@example.org', 'password' => 'password'])
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 });
 
 it('does not redirect to 2fa code page after failed first step login', function () {
@@ -35,15 +33,9 @@
 it('sends to the user a 2fa notification after successful first step login', function () {
     Notification::fake();
 
-    $this->post(
-        route('code16.sharp.login.post'),
-        ['login' => 'test@example.org', 'password' => 'password']
-    );
+    postLoginFor2fa('test@example.org', 'password');
 
-    Notification::assertSentTo(
-        new User(['email' => 'test@example.org']),
-        Sharp2faDefaultNotification::class
-    );
+    Notification::assertSentTimes(Sharp2faDefaultNotification::class, 1);
 });
 
 it('logs in the user after successful 2fa code validation', function () {
@@ -59,12 +51,7 @@ protected function generateRandomCode(): int
         }
     );
 
-    $this
-        ->post(
-            route('code16.sharp.login.post'),
-            ['login' => 'test@example.org', 'password' => 'password']
-        )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 
     $this
         ->post(
@@ -79,12 +66,7 @@ protected function generateRandomCode(): int
 it('does not log in the user after invalid 2fa code validation', function () {
     Notification::fake();
 
-    $this
-        ->post(
-            route('code16.sharp.login.post'),
-            ['login' => 'test@example.org', 'password' => 'password']
-        )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 
     $this
         ->from(route('code16.sharp.login.2fa'))
diff --git a/tests/Http/Auth/Login2faTotpTest.php b/tests/Http/Auth/Login2faTotpTest.php
index b84573e00..a43d45288 100644
--- a/tests/Http/Auth/Login2faTotpTest.php
+++ b/tests/Http/Auth/Login2faTotpTest.php
@@ -73,8 +73,7 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('redirects to 2fa code page after successful first step login', function () {
-    $this->post(route('code16.sharp.login.post'), ['login' => 'test@example.org', 'password' => 'password'])
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 });
 
 it('does not redirect to 2fa code page after failed first step login', function () {
@@ -86,12 +85,7 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('logs in the user after successful 2fa code validation', function () {
-    $this
-        ->post(
-            route('code16.sharp.login.post'),
-            ['login' => 'test@example.org', 'password' => 'password']
-        )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 
     $this
         ->post(
@@ -104,12 +98,7 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('logs in the user after entering a valid recovery code', function () {
-    $this
-        ->post(
-            route('code16.sharp.login.post'),
-            ['login' => 'test@example.org', 'password' => 'password']
-        )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 
     $this
         ->post(
@@ -122,12 +111,7 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('does not log in the user after invalid 2fa code validation', function () {
-    $this
-        ->post(
-            route('code16.sharp.login.post'),
-            ['login' => 'test@example.org', 'password' => 'password']
-        )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
+    postLoginFor2fa('test@example.org', 'password');
 
     $this
         ->from(route('code16.sharp.login.2fa'))
diff --git a/tests/Pest.php b/tests/Pest.php
index 1b0b67082..3926e6a1d 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -1,12 +1,15 @@
 <?php
 
+use Code16\Sharp\Filters\GlobalFilters\GlobalFilters;
 use Code16\Sharp\Filters\GlobalRequiredFilter;
 use Code16\Sharp\Tests\Fixtures\User;
 use Code16\Sharp\Tests\TestCase;
 use Code16\Sharp\Utils\Entities\SharpEntityManager;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\URL;
 
 uses(TestCase::class)
     ->in(__DIR__);
@@ -15,7 +18,7 @@
     ->beforeEach(function () {
         // We add a default here to avoid putting this everywhere in unit tests
         // it's handled by middleware in a real request, but we don't want to test that here.
-        \Illuminate\Support\Facades\URL::defaults(['globalFilter' => \Code16\Sharp\Filters\GlobalFilters\GlobalFilters::$defaultKey]);
+        URL::defaults(['globalFilter' => GlobalFilters::$defaultKey]);
     })
     ->in(__DIR__);
 
@@ -85,6 +88,22 @@ function login(?User $user = null)
     );
 }
 
+function postLoginFor2fa($email, $password): void
+{
+    test()->post(
+        route('code16.sharp.login.post'),
+        ['login' => $email, 'password' => $password]
+    )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
+
+    /**
+     * We assume the configured sharp guard is @see \Code16\Sharp\Tests\Fixtures\TestAuthGuard
+     */
+    $guard = sharp()->config()->get('auth.guard');
+    expect(Auth::guard($guard)->isOnce)->toBeTrue();
+    Auth::guard($guard)->logout();
+}
+
 function fakeListFor(string $entityKeyOrClass, $fakeImplementation)
 {
     app(SharpEntityManager::class)

From 415ac41c9f52e35d036cbd8367c71f7bf2433b96 Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Tue, 7 Jul 2026 17:16:32 +0200
Subject: [PATCH 4/8] Improve handling of 2fa user

---
 ...arpDefaultEloquentImpersonationHandler.php |  3 ++-
 src/Auth/Passkeys/SpatiePasskeyManager.php    | 16 +++++++-------
 .../TwoFactor/Sharp2faNotificationHandler.php |  5 +++--
 src/Auth/TwoFactor/Sharp2faPasskeyHandler.php |  5 +++--
 src/Auth/TwoFactor/Sharp2faTotpHandler.php    |  7 ++++---
 ...ler.php => LoginMultiFactorController.php} |  8 +++----
 src/routes/auth/login.php                     |  8 ++++---
 tests/Http/Auth/PasskeysTest.php              | 21 ++++++++++++-------
 tests/TestCase.php                            |  2 ++
 9 files changed, 46 insertions(+), 29 deletions(-)
 rename src/Http/Controllers/Auth/{Login2faController.php => LoginMultiFactorController.php} (85%)

diff --git a/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php b/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php
index c7bfe6bf0..5902f5644 100644
--- a/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php
+++ b/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Auth\Impersonate;
 
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Support\Facades\Gate;
 
 class SharpDefaultEloquentImpersonationHandler extends SharpImpersonationHandler
@@ -20,7 +21,7 @@ public function getUsers(): array
                 Gate::has('viewSharp'),
                 fn ($users) => $users->filter(fn ($user) => Gate::forUser($user)->allows('viewSharp'))
             )
-            ->mapWithKeys(fn ($user) => [$user->id => $user->$loginAttribute])
+            ->mapWithKeys(fn (Authenticatable $user) => [$user->getAuthIdentifier() => $user->$loginAttribute])
             ->all();
     }
 }
diff --git a/src/Auth/Passkeys/SpatiePasskeyManager.php b/src/Auth/Passkeys/SpatiePasskeyManager.php
index 1b8e01d9d..3e12afddb 100644
--- a/src/Auth/Passkeys/SpatiePasskeyManager.php
+++ b/src/Auth/Passkeys/SpatiePasskeyManager.php
@@ -19,7 +19,7 @@ class SpatiePasskeyManager implements PasskeyManager
 {
     public function isEnabled(): bool
     {
-        return sharp()->config()->get('auth.passkeys.enabled');
+        return (bool) sharp()->config()->get('auth.passkeys.enabled');
     }
 
     public function setLastUsedPasskey(Model $passkey): void
@@ -39,14 +39,16 @@ public function getErrorMessage(): ?string
 
     public function setRedirectUrl(): void
     {
+        $intendedUrl = Redirect::intended(
+            route('code16.sharp.home', [
+                'globalFilter' => sharp()->context()->globalFilterUrlSegmentValue(),
+            ])
+        )->getTargetUrl();
+
         config()->set(
             'passkeys.redirect_to_after_login',
             route('code16.sharp.passkeys.authenticated', [
-                'intended_url' => Redirect::intended(
-                    route('code16.sharp.home', [
-                        'globalFilter' => sharp()->context()->globalFilterUrlSegmentValue(),
-                    ])
-                )->getTargetUrl(),
+                'intended_url' => $intendedUrl,
             ])
         );
     }
@@ -69,7 +71,7 @@ public function model(): string
     public function subscribe(Dispatcher $events): void
     {
         $events->listen(function (PasskeyUsedToAuthenticateEvent $event) {
-            if (request()->headers->has('X-Sharp')) {
+            if ($event->request->headers->has('X-Sharp')) {
                 $this->setLastUsedPasskey($event->passkey);
                 $this->setRedirectUrl();
             }
diff --git a/src/Auth/TwoFactor/Sharp2faNotificationHandler.php b/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
index f1911cbea..be9984703 100644
--- a/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
@@ -4,13 +4,14 @@
 
 use Carbon\Carbon;
 use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Notifications\Notification;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
 
 class Sharp2faNotificationHandler implements Sharp2faHandler
 {
-    protected $user = null;
+    protected ?Authenticatable $user = null;
 
     public function generateCode(bool $remember = false): void
     {
@@ -19,7 +20,7 @@ public function generateCode(bool $remember = false): void
         Session::put(
             $this->getSessionKey(),
             [
-                'user_id' => $this->user->id,
+                'user_id' => $this->user->getAuthIdentifier(),
                 'code' => Hash::make($code),
                 'remember' => $remember,
                 'expires_at' => now()->addMinutes(15)->format('Y-m-d H:i:s'),
diff --git a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
index 4dd6d58a0..0a3fc7f9c 100644
--- a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
@@ -3,19 +3,20 @@
 namespace Code16\Sharp\Auth\TwoFactor;
 
 use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
 
 class Sharp2faPasskeyHandler implements Sharp2faHandler
 {
-    protected $user = null;
+    protected ?Authenticatable $user = null;
 
     public function generateCode(bool $remember = false): void
     {
         Session::put(
             $this->getSessionKey(),
             [
-                'user_id' => $this->user->id,
+                'user_id' => $this->user->getAuthIdentifier(),
                 'remember' => $remember,
             ]
         );
diff --git a/src/Auth/TwoFactor/Sharp2faTotpHandler.php b/src/Auth/TwoFactor/Sharp2faTotpHandler.php
index 0234dc489..525938b9f 100644
--- a/src/Auth/TwoFactor/Sharp2faTotpHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faTotpHandler.php
@@ -4,13 +4,14 @@
 
 use Code16\Sharp\Auth\TwoFactor\Engines\Sharp2faTotpEngine;
 use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Session;
 use Illuminate\Support\Str;
 
 abstract class Sharp2faTotpHandler implements Sharp2faHandler
 {
-    protected $user = null;
+    protected ?Authenticatable $user = null;
 
     public function __construct(protected Sharp2faTotpEngine $engine) {}
 
@@ -19,7 +20,7 @@ public function generateCode(bool $remember = false): void
         Session::put(
             $this->getSessionKey(),
             [
-                'user_id' => $this->user->id,
+                'user_id' => $this->user->getAuthIdentifier(),
                 'remember' => $remember,
             ]
         );
@@ -46,7 +47,7 @@ public function checkCode(string $code): bool
 
     public function userId(): mixed
     {
-        return $this->user?->id ?? (Session::get($this->getSessionKey())['user_id'] ?? null);
+        return $this->user?->getAuthIdentifier() ?? (Session::get($this->getSessionKey())['user_id'] ?? null);
     }
 
     public function remember(): bool
diff --git a/src/Http/Controllers/Auth/Login2faController.php b/src/Http/Controllers/Auth/LoginMultiFactorController.php
similarity index 85%
rename from src/Http/Controllers/Auth/Login2faController.php
rename to src/Http/Controllers/Auth/LoginMultiFactorController.php
index d77131f45..1a218d046 100644
--- a/src/Http/Controllers/Auth/Login2faController.php
+++ b/src/Http/Controllers/Auth/LoginMultiFactorController.php
@@ -12,19 +12,19 @@
 use Inertia\Inertia;
 use Inertia\Response;
 
-class Login2faController extends Controller
+class LoginMultiFactorController extends Controller
 {
     public function create(Request $request, MultiFactorManager $multiFactor, PasskeyManager $passkeys): RedirectResponse|Response
     {
-        if ($multiFactor->currentHandler()?->isExpectingLogin()) {
-            $user = $multiFactor->currentUser();
+        $user = $multiFactor->currentUser();
 
+        if ($user && $multiFactor->currentHandler()?->isExpectingLogin()) {
             if ($multiFactor->currentMethod() === MultiFactorMethod::Passkey
                 && ! $passkeys->userHasPasskey($user)) {
                 return redirect()->route('code16.sharp.passkeys.create');
             }
 
-            return Inertia::render('Auth/Login2Fa', [
+            return Inertia::render('Auth/LoginMultiFactor', [
                 'helpText' => $multiFactor->currentHandlerHelpText(),
                 'mode' => $multiFactor->currentMethod(),
                 'passkeyError' => $passkeys->getErrorMessage(),
diff --git a/src/routes/auth/login.php b/src/routes/auth/login.php
index eef994290..a70dc4009 100644
--- a/src/routes/auth/login.php
+++ b/src/routes/auth/login.php
@@ -1,7 +1,7 @@
 <?php
 
-use Code16\Sharp\Http\Controllers\Auth\Login2faController;
 use Code16\Sharp\Http\Controllers\Auth\LoginController;
+use Code16\Sharp\Http\Controllers\Auth\LoginMultiFactorController;
 use Illuminate\Support\Facades\Route;
 
 Route::middleware(['sharp_common', 'sharp_web'])
@@ -15,10 +15,12 @@
             ->middleware('sharp_guest')
             ->name('code16.sharp.login.post');
 
-        Route::get('/login/2fa', [Login2faController::class, 'create'])
+        Route::get('/login/2fa', [LoginMultiFactorController::class, 'create'])
+            ->middleware('sharp_guest')
             ->name('code16.sharp.login.2fa');
 
-        Route::post('/login/2fa', [Login2faController::class, 'store'])
+        Route::post('/login/2fa', [LoginMultiFactorController::class, 'store'])
+            ->middleware('sharp_guest')
             ->name('code16.sharp.login.2fa.post');
 
         Route::post('/logout', [LoginController::class, 'destroy'])
diff --git a/tests/Http/Auth/PasskeysTest.php b/tests/Http/Auth/PasskeysTest.php
index b7151733d..e635921d2 100644
--- a/tests/Http/Auth/PasskeysTest.php
+++ b/tests/Http/Auth/PasskeysTest.php
@@ -14,6 +14,7 @@
 use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
 use Illuminate\Support\Facades\Cookie;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Validation\ValidationException;
 use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
@@ -26,6 +27,7 @@
 use Webauthn\PublicKeyCredentialCreationOptions;
 
 use function Orchestra\Testbench\Pest\defineEnvironment;
+use function Orchestra\Testbench\Pest\defineRoutes;
 
 pest()->use(LazilyRefreshDatabase::class);
 
@@ -33,6 +35,10 @@
     sharp()->config()->enablePasskeys();
 });
 
+defineRoutes(function () {
+    Route::passkeys();
+});
+
 beforeEach(function () {
     Schema::create('users', function (Blueprint $table) {
         $table->increments('id');
@@ -200,7 +206,8 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
     $user = createPasskeyTestUser();
     $passkey = createPasskey($user);
 
-    $request = \Mockery::mock(AuthenticateUsingPasskeysRequest::class);
+    $request = AuthenticateUsingPasskeysRequest::create(route('passkeys.login'));
+    $request->headers->set('X-Sharp', '1');
     $event = new PasskeyUsedToAuthenticateEvent($passkey, $request);
     app(Dispatcher::class)->dispatch($event);
 
@@ -261,10 +268,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 it('validates name on passkey validate endpoint', function () {
     loginPasskeyUser();
 
-    $this->postJson(route('code16.sharp.passkeys.validate'), ['name' => ''])
+    $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => ''])
         ->assertJsonValidationErrors('name');
 
-    $this->postJson(route('code16.sharp.passkeys.validate'), ['name' => str_repeat('a', 256)])
+    $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => str_repeat('a', 256)])
         ->assertJsonValidationErrors('name');
 });
 
@@ -275,13 +282,13 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
     // Configure a fake action that returns a JSON string
     config()->set('passkeys.actions.generate_passkey_register_options', FakeGeneratePasskeyRegisterOptionsAction::class);
 
-    $this->postJson(route('code16.sharp.passkeys.validate'), ['name' => 'My Key'])
+    $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => 'My Key'])
         ->assertOk()
         ->assertJsonStructure(['passkeyOptions']);
 });
 
 it('store endpoint requires authentication', function () {
-    $this->post(route('code16.sharp.passkeys.store'))
+    $this->post(route('code16.sharp.passkeys.spatie.store'))
         ->assertRedirect();
 });
 
@@ -292,7 +299,7 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
     // Put fake options in session as the controller expects them
     session()->put('passkey-registration-options', '{"fake":"options"}');
 
-    $this->postJson(route('code16.sharp.passkeys.store'), [
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'), [
         'passkey' => 'invalid-passkey-data',
         'name' => 'My Key',
     ])
@@ -334,7 +341,7 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
     FakeStorePasskeyAction::$mock = $mockAction;
     config()->set('passkeys.actions.store_passkey', FakeStorePasskeyAction::class);
 
-    $this->postJson(route('code16.sharp.passkeys.store'), [
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'), [
         'passkey' => $passkeyData,
         'name' => $passkeyName,
     ])
diff --git a/tests/TestCase.php b/tests/TestCase.php
index e14c026a7..85f59cdfd 100644
--- a/tests/TestCase.php
+++ b/tests/TestCase.php
@@ -9,6 +9,7 @@
 use Orchestra\Testbench\Pest\WithPest;
 use Orchestra\Testbench\TestCase as Orchestra;
 use Spatie\LaravelImageOptimizer\ImageOptimizerServiceProvider;
+use Spatie\LaravelPasskeys\LaravelPasskeysServiceProvider;
 
 class TestCase extends Orchestra
 {
@@ -28,6 +29,7 @@ protected function getPackageProviders($app): array
             ContentRendererServiceProvider::class,
             BladeIconsServiceProvider::class,
             ImageOptimizerServiceProvider::class,
+            LaravelPasskeysServiceProvider::class,
         ];
     }
 

From f3824af47bd8aacfbf8addf0bb6ae9c9987c9718 Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Tue, 7 Jul 2026 17:16:52 +0200
Subject: [PATCH 5/8] Allow no fields

---
 resources/js/Layouts/Auth/AuthCard.vue           |  6 +++++-
 .../Auth/{Login2Fa.vue => LoginMultiFactor.vue}  | 16 ++++++++++------
 2 files changed, 15 insertions(+), 7 deletions(-)
 rename resources/js/Pages/Auth/{Login2Fa.vue => LoginMultiFactor.vue} (84%)

diff --git a/resources/js/Layouts/Auth/AuthCard.vue b/resources/js/Layouts/Auth/AuthCard.vue
index 5fb1eff55..6a2aded66 100644
--- a/resources/js/Layouts/Auth/AuthCard.vue
+++ b/resources/js/Layouts/Auth/AuthCard.vue
@@ -1,6 +1,10 @@
 <script setup lang="ts">
     import { config } from "@/utils/config";
     import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card";
+
+    defineProps<{
+        empty?: boolean,
+    }>();
 </script>
 
 <template>
@@ -18,7 +22,7 @@
                 </CardDescription>
             </template>
         </CardHeader>
-        <CardContent>
+        <CardContent :class="empty ? 'p-0' : ''">
             <slot />
         </CardContent>
         <CardFooter>
diff --git a/resources/js/Pages/Auth/Login2Fa.vue b/resources/js/Pages/Auth/LoginMultiFactor.vue
similarity index 84%
rename from resources/js/Pages/Auth/Login2Fa.vue
rename to resources/js/Pages/Auth/LoginMultiFactor.vue
index bb57e7980..1c47c05c4 100644
--- a/resources/js/Pages/Auth/Login2Fa.vue
+++ b/resources/js/Pages/Auth/LoginMultiFactor.vue
@@ -10,13 +10,14 @@
     import { Label } from "@/components/ui/label";
     import { Input } from "@/components/ui/input";
     import { FormItem, FormMessage } from "@/components/ui/form";
-    import { TwoFactorMode } from "@/types";
+    import { TwoFactorMode, UserData } from "@/types";
     import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
 
     const props = defineProps<{
-        helpText: string,
         mode: TwoFactorMode,
+        helpText: string,
         passkeyError: string,
+        errors: Record<string, string>,
     }>();
 
     const form = useForm({
@@ -32,23 +33,26 @@
             {{ __('sharp::pages/auth/login.title') }}
         </Title>
 
-        <template v-if="form.hasErrors || passkeyError">
+        <template v-if="Object.keys(errors).length || passkeyError">
             <Alert class="mb-4" variant="destructive">
                 <AlertDescription>
-                    {{ Object.values(form.errors)[0] || passkeyError }}
+                    {{ Object.values(errors)[0] || passkeyError }}
                 </AlertDescription>
             </Alert>
         </template>
 
         <form @submit.prevent="mode === 'passkey' ? loginWithPasskey({}) : form.post(route('code16.sharp.login.2fa.post'))">
-            <AuthCard>
+            <AuthCard :empty="mode == 'passkey'">
                 <template #title>
                     {{ __('sharp::pages/auth/login.title') }}
                 </template>
                 <template v-if="helpText" #description>
                     <div class="space-y-2" v-html="helpText"></div>
                 </template>
-                <template v-if="mode !== 'passkey'">
+                <template v-if="mode == 'passkey'">
+                    <input class="sr-only" autocomplete="webauthn"></input>
+                </template>
+                <template v-else>
                     <FormItem>
                         <Label for="code">
                             {{ __('sharp::pages/auth/login.code_field') }}

From e50229625aceea6e39ffaae5a7ab8ed05b6118ab Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Tue, 7 Jul 2026 20:16:24 +0200
Subject: [PATCH 6/8] More cleanup

---
 resources/js/Pages/Auth/LoginMultiFactor.vue  | 22 +++++++-------
 .../js/components/ui/alert/AlertTitle.vue     |  2 +-
 resources/js/types/generated.d.ts             |  2 +-
 resources/js/types/routes.d.ts                |  8 +++--
 resources/lang/en/auth.php                    |  4 +++
 resources/lang/fr/auth.php                    |  4 +++
 src/Auth/TwoFactor/MultiFactorManager.php     | 22 +++++++++-----
 src/Auth/TwoFactor/Sharp2faPasskeyHandler.php | 11 +++++--
 .../Auth/LoginMultiFactorController.php       |  4 +--
 .../PasskeyAuthenticatedController.php        | 13 +++++++--
 .../Passkeys/PasskeyRegisteredController.php  | 29 +++++++++++++++++++
 .../Auth/Passkeys/SpatiePasskeyController.php |  8 +++--
 src/routes/auth/passkeys.php                  |  4 +++
 tests/Http/Auth/PasskeysTest.php              |  2 +-
 14 files changed, 99 insertions(+), 36 deletions(-)
 create mode 100644 src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php

diff --git a/resources/js/Pages/Auth/LoginMultiFactor.vue b/resources/js/Pages/Auth/LoginMultiFactor.vue
index 1c47c05c4..90ad05065 100644
--- a/resources/js/Pages/Auth/LoginMultiFactor.vue
+++ b/resources/js/Pages/Auth/LoginMultiFactor.vue
@@ -5,16 +5,16 @@
     import Title from "@/components/Title.vue";
     import { route } from "@/utils/url";
     import { Button } from "@/components/ui/button";
-    import { Alert, AlertDescription } from "@/components/ui/alert";
+    import { Alert, AlertTitle } from "@/components/ui/alert";
     import AuthCard from "@/Layouts/Auth/AuthCard.vue";
     import { Label } from "@/components/ui/label";
     import { Input } from "@/components/ui/input";
-    import { FormItem, FormMessage } from "@/components/ui/form";
-    import { TwoFactorMode, UserData } from "@/types";
+    import { FormItem } from "@/components/ui/form";
+    import { MultiFactorMethod } from "@/types";
     import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
 
     const props = defineProps<{
-        mode: TwoFactorMode,
+        method: MultiFactorMethod,
         helpText: string,
         passkeyError: string,
         errors: Record<string, string>,
@@ -24,7 +24,7 @@
         code: '',
     });
 
-    const { loginWithPasskey } = usePasskeyLogin({ autofill: props.mode === 'passkey' });
+    const { loginWithPasskey } = usePasskeyLogin({ autofill: props.method === 'passkey' });
 </script>
 
 <template>
@@ -35,21 +35,21 @@
 
         <template v-if="Object.keys(errors).length || passkeyError">
             <Alert class="mb-4" variant="destructive">
-                <AlertDescription>
+                <AlertTitle class="mb-0">
                     {{ Object.values(errors)[0] || passkeyError }}
-                </AlertDescription>
+                </AlertTitle>
             </Alert>
         </template>
 
-        <form @submit.prevent="mode === 'passkey' ? loginWithPasskey({}) : form.post(route('code16.sharp.login.2fa.post'))">
-            <AuthCard :empty="mode == 'passkey'">
+        <form @submit.prevent="method === 'passkey' ? loginWithPasskey({}) : form.post(route('code16.sharp.login.2fa.post'))">
+            <AuthCard :empty="method == 'passkey'">
                 <template #title>
                     {{ __('sharp::pages/auth/login.title') }}
                 </template>
                 <template v-if="helpText" #description>
                     <div class="space-y-2" v-html="helpText"></div>
                 </template>
-                <template v-if="mode == 'passkey'">
+                <template v-if="method == 'passkey'">
                     <input class="sr-only" autocomplete="webauthn"></input>
                 </template>
                 <template v-else>
@@ -62,7 +62,7 @@
                 </template>
                 <template #footer>
                     <Button type="submit" class="w-full">
-                        <template v-if="mode === 'passkey'">
+                        <template v-if="method === 'passkey'">
                             {{ __('sharp::pages/auth/login.passkey_button') }}
                         </template>
                         <template v-else>
diff --git a/resources/js/components/ui/alert/AlertTitle.vue b/resources/js/components/ui/alert/AlertTitle.vue
index 7b2f5f1b5..f228dd8e8 100644
--- a/resources/js/components/ui/alert/AlertTitle.vue
+++ b/resources/js/components/ui/alert/AlertTitle.vue
@@ -8,7 +8,7 @@ const props = defineProps<{
 </script>
 
 <template>
-  <h5 :class="cn('mb-1 font-medium leading-none tracking-tight', props.class)">
+  <h5 :class="cn('mb-1 font-medium leading-tight tracking-tight', props.class)">
     <slot />
   </h5>
 </template>
diff --git a/resources/js/types/generated.d.ts b/resources/js/types/generated.d.ts
index af612352b..01a62114b 100644
--- a/resources/js/types/generated.d.ts
+++ b/resources/js/types/generated.d.ts
@@ -747,6 +747,7 @@ export type MenuItemData = {
   isCollapsible: boolean;
   openInNewTab: boolean;
 };
+export type MultiFactorMethod = "notification" | "totp" | "passkey";
 export type NotificationData = {
   title: string;
   level: NotificationLevel;
@@ -983,7 +984,6 @@ export type ShowTextFieldData = {
   embeds: { [key: string]: EmbedData } | null;
   label: string | null;
 };
-export type TwoFactorMode = "notification" | "totp" | "passkey";
 export type UserData = {
   name: string | null;
   email: string | null;
diff --git a/resources/js/types/routes.d.ts b/resources/js/types/routes.d.ts
index 5ad19cb2d..4ae15a510 100644
--- a/resources/js/types/routes.d.ts
+++ b/resources/js/types/routes.d.ts
@@ -579,9 +579,11 @@ declare module 'ziggy-js' {
     ],
     "code16.sharp.password.reset.post": [],
     "code16.sharp.passkeys.create": [],
-    "code16.sharp.passkeys.validate": [],
-    "code16.sharp.passkeys.store": [],
-    "code16.sharp.passkeys.skip-prompt": []
+    "code16.sharp.passkeys.spatie.validate": [],
+    "code16.sharp.passkeys.spatie.store": [],
+    "code16.sharp.passkeys.registered": [],
+    "code16.sharp.passkeys.skip-prompt": [],
+    "code16.sharp.passkeys.authenticated": []
 }
 }
 export {};
diff --git a/resources/lang/en/auth.php b/resources/lang/en/auth.php
index acf794310..32a7de9be 100644
--- a/resources/lang/en/auth.php
+++ b/resources/lang/en/auth.php
@@ -27,6 +27,10 @@
                 ],
             ],
         ],
+        'passkey' => [
+            'form_help_text' => 'Please click on the button below to use one of your passkey for :email account.',
+            'mismatch_error' => 'The passkey used is linked to a different account.',
+        ],
     ],
     'passkeys' => [
         'entity_label' => 'Passkey',
diff --git a/resources/lang/fr/auth.php b/resources/lang/fr/auth.php
index 74b76b268..bdd17b089 100644
--- a/resources/lang/fr/auth.php
+++ b/resources/lang/fr/auth.php
@@ -27,6 +27,10 @@
                 ],
             ],
         ],
+        'passkey' => [
+            'form_help_text' => 'Veuillez cliquer sur le bouton ci-dessous pour utiliser une clé d’accès associé au compte :email',
+            'mismatch_error' => 'La clé d’accès utilisée est associée à un autre compte.',
+        ],
     ],
     'passkeys' => [
         'entity_label' => 'Clé d’accès',
diff --git a/src/Auth/TwoFactor/MultiFactorManager.php b/src/Auth/TwoFactor/MultiFactorManager.php
index de9472260..fc9b9142e 100644
--- a/src/Auth/TwoFactor/MultiFactorManager.php
+++ b/src/Auth/TwoFactor/MultiFactorManager.php
@@ -26,7 +26,7 @@ public function currentHandler(): ?Sharp2faHandler
     public function currentHandlerHelpText(): ?string
     {
         return method_exists($this->currentHandler(), 'formHelpText')
-            ? $this->currentHandler()->formHelpText()
+            ? $this->currentHandler()->setUser($this->pendingUser())->formHelpText()
             : trans('sharp::auth.2fa.form_help_text');
     }
 
@@ -37,14 +37,20 @@ public function isUsingPasskeyMethod(): bool
             && $this->currentHandler()->isExpectingLogin();
     }
 
-    public function currentUser(): ?Authenticatable
+    public function pendingUser(): ?Authenticatable
     {
-        $userId = $this->currentHandler()?->userId();
+        if ($userId = $this->currentHandler()?->userId()) {
+            return $this->findUser($userId);
+        }
 
-        return $userId
-            ? Auth::guard(sharp()->config()->get('auth.guard'))
-                ->getProvider()
-                ->retrieveById($userId)
-            : null;
+        return null;
+    }
+
+    protected function findUser($id): ?Authenticatable
+    {
+        return once(fn () => Auth::guard(sharp()->config()->get('auth.guard'))
+            ->getProvider()
+            ->retrieveById($id)
+        );
     }
 }
diff --git a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
index 0a3fc7f9c..0f78471dd 100644
--- a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
@@ -4,7 +4,6 @@
 
 use Code16\Sharp\Enums\MultiFactorMethod;
 use Illuminate\Contracts\Auth\Authenticatable;
-use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
 
 class Sharp2faPasskeyHandler implements Sharp2faHandler
@@ -41,8 +40,7 @@ public function isEnabledFor($user): bool
 
     public function checkCode(string $code): bool
     {
-        return $this->isExpectingLogin()
-            && Hash::check($code, Session::get($this->getSessionKey())['code']);
+        throw new \Exception('Passkey multi-factor is not based on code matching');
     }
 
     public function userId(): mixed
@@ -60,6 +58,13 @@ public function forgetCode(): void
         Session::forget($this->getSessionKey());
     }
 
+    public function formHelpText(): string
+    {
+        return trans('sharp::auth.2fa.passkey.form_help_text', [
+            'email' => $this->user->{sharp()->config()->get('auth.login_attribute')} ?? null,
+        ]);
+    }
+
     protected function getSessionKey(): string
     {
         return 'sharp:2fa:prompt-passkey';
diff --git a/src/Http/Controllers/Auth/LoginMultiFactorController.php b/src/Http/Controllers/Auth/LoginMultiFactorController.php
index 1a218d046..683cf02a2 100644
--- a/src/Http/Controllers/Auth/LoginMultiFactorController.php
+++ b/src/Http/Controllers/Auth/LoginMultiFactorController.php
@@ -16,7 +16,7 @@ class LoginMultiFactorController extends Controller
 {
     public function create(Request $request, MultiFactorManager $multiFactor, PasskeyManager $passkeys): RedirectResponse|Response
     {
-        $user = $multiFactor->currentUser();
+        $user = $multiFactor->pendingUser();
 
         if ($user && $multiFactor->currentHandler()?->isExpectingLogin()) {
             if ($multiFactor->currentMethod() === MultiFactorMethod::Passkey
@@ -26,7 +26,7 @@ public function create(Request $request, MultiFactorManager $multiFactor, Passke
 
             return Inertia::render('Auth/LoginMultiFactor', [
                 'helpText' => $multiFactor->currentHandlerHelpText(),
-                'mode' => $multiFactor->currentMethod(),
+                'method' => $multiFactor->currentMethod(),
                 'passkeyError' => $passkeys->getErrorMessage(),
             ]);
         }
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
index 732420088..768ffa4ff 100644
--- a/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
@@ -12,11 +12,18 @@ class PasskeyAuthenticatedController extends Controller
     public function __invoke(Request $request, MultiFactorManager $multiFactor)
     {
         if ($multiFactor->isUsingPasskeyMethod()) {
-            if (! $request->user()->is($multiFactor->currentUser())) {
+            $authId = Auth::guard(sharp()->config()->get('auth.guard'))->user()->getAuthIdentifier();
+            $pendingId = $multiFactor->pendingUser()?->getAuthIdentifier();
+
+            if ($authId !== $pendingId) {
                 Auth::guard(sharp()->config()->get('auth.guard'))->logout();
 
-                return redirect()->route('code16.sharp.login.2fa')
-                    ->withErrors(['error' => 'The passkey does not belong to the current user.']);
+                $request->session()->invalidate();
+                $request->session()->regenerateToken();
+
+                return redirect()->route('code16.sharp.login')
+                    ->with('status', __('sharp::auth.2fa.passkey.mismatch_error'))
+                    ->with('status_level', 'error');
             }
 
             $multiFactor->currentHandler()->forgetCode();
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php
new file mode 100644
index 000000000..9847387b3
--- /dev/null
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
+
+class PasskeyRegisteredController extends Controller
+{
+    public function __invoke(Request $request, MultiFactorManager $multiFactor)
+    {
+        if (! session()->has('registered_passkey')) {
+            return redirect()->route('code16.sharp.login');
+        }
+
+        if ($multiFactor->isUsingPasskeyMethod()) {
+            if ($user = $multiFactor->pendingUser()) {
+                Auth::guard(sharp()->config()->get('auth.guard'))->login($user);
+                $request->session()->regenerate();
+            }
+
+            $multiFactor->currentHandler()->forgetCode();
+        }
+
+        return redirect()->intended(route('code16.sharp.home'));
+    }
+}
diff --git a/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php b/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
index a08ca6a39..e3b472472 100644
--- a/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
+++ b/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
@@ -33,7 +33,7 @@ public function store(Request $request)
         $storePasskeyAction = Config::getAction('store_passkey', StorePasskeyAction::class);
 
         try {
-            $storePasskeyAction->execute(
+            $registeredPasskey = $storePasskeyAction->execute(
                 $this->currentUser(),
                 $passkey, $this->previouslyGeneratedPasskeyOptions(),
                 request()->getHost(),
@@ -45,13 +45,15 @@ public function store(Request $request)
             ])->errorBag('passkeyForm');
         }
 
-        return redirect()->intended(route('code16.sharp.home'));
+        return redirect()
+            ->route('code16.sharp.passkeys.registered')
+            ->with('registered_passkey', $registeredPasskey);
     }
 
     protected function currentUser(): Authenticatable&HasPasskeys
     {
         return app(MultiFactorManager::class)->isUsingPasskeyMethod()
-            ? app(MultiFactorManager::class)->currentUser()
+            ? app(MultiFactorManager::class)->pendingUser()
             : auth()->user();
     }
 
diff --git a/src/routes/auth/passkeys.php b/src/routes/auth/passkeys.php
index 4582e4043..3f982c7ee 100644
--- a/src/routes/auth/passkeys.php
+++ b/src/routes/auth/passkeys.php
@@ -2,6 +2,7 @@
 
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyAuthenticatedController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyController;
+use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyRegisteredController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeySkipPromptController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\SpatiePasskeyController;
 use Code16\Sharp\Http\Middleware\SharpAuthenticateOrInMultiFactor;
@@ -21,6 +22,9 @@
                 ->name('code16.sharp.passkeys.spatie.store');
         });
 
+        Route::get('/passkeys/registered', PasskeyRegisteredController::class)
+            ->name('code16.sharp.passkeys.registered');
+
         Route::middleware(['sharp_auth'])->group(function () {
             Route::post('/passkeys/skip-prompt', PasskeySkipPromptController::class)
                 ->name('code16.sharp.passkeys.skip-prompt');
diff --git a/tests/Http/Auth/PasskeysTest.php b/tests/Http/Auth/PasskeysTest.php
index e635921d2..80ef8dc7c 100644
--- a/tests/Http/Auth/PasskeysTest.php
+++ b/tests/Http/Auth/PasskeysTest.php
@@ -345,7 +345,7 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
         'passkey' => $passkeyData,
         'name' => $passkeyName,
     ])
-        ->assertRedirect(route('code16.sharp.home'));
+        ->assertRedirect(route('code16.sharp.passkeys.registered'));
 
     $mockAction->shouldHaveReceived('execute');
 });

From d6e5b2c1937e000ff004ca052eeffcb757bdd174 Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Wed, 8 Jul 2026 17:10:22 +0200
Subject: [PATCH 7/8] Add tests

---
 resources/js/Pages/Auth/LoginMultiFactor.vue  |   2 +-
 resources/js/Pages/Auth/usePasskeyLogin.ts    |   2 +-
 src/Auth/Passkeys/SpatiePasskeyManager.php    |   2 +-
 src/Auth/TwoFactor/MultiFactorManager.php     |  11 +-
 .../Auth/Requests/LoginRequest.php            |  14 +-
 tests/Fixtures/TestAuthGuard.php              |   5 +-
 ...st.php => MultiFactorNotificationTest.php} |  28 ++-
 tests/Http/Auth/MultiFactorPasskeyTest.php    | 222 ++++++++++++++++++
 ...faTotpTest.php => MultiFactorTotpTest.php} |  28 ++-
 tests/Http/Auth/PasskeysTest.php              |  34 +++
 tests/Pest.php                                |  17 --
 11 files changed, 326 insertions(+), 39 deletions(-)
 rename tests/Http/Auth/{Login2faNotificationTest.php => MultiFactorNotificationTest.php} (77%)
 create mode 100644 tests/Http/Auth/MultiFactorPasskeyTest.php
 rename tests/Http/Auth/{Login2faTotpTest.php => MultiFactorTotpTest.php} (83%)

diff --git a/resources/js/Pages/Auth/LoginMultiFactor.vue b/resources/js/Pages/Auth/LoginMultiFactor.vue
index 90ad05065..a3a79dffe 100644
--- a/resources/js/Pages/Auth/LoginMultiFactor.vue
+++ b/resources/js/Pages/Auth/LoginMultiFactor.vue
@@ -41,7 +41,7 @@
             </Alert>
         </template>
 
-        <form @submit.prevent="method === 'passkey' ? loginWithPasskey({}) : form.post(route('code16.sharp.login.2fa.post'))">
+        <form @submit.prevent="method === 'passkey' ? loginWithPasskey() : form.post(route('code16.sharp.login.2fa.post'))">
             <AuthCard :empty="method == 'passkey'">
                 <template #title>
                     {{ __('sharp::pages/auth/login.title') }}
diff --git a/resources/js/Pages/Auth/usePasskeyLogin.ts b/resources/js/Pages/Auth/usePasskeyLogin.ts
index d56a34dc7..af3713d2b 100644
--- a/resources/js/Pages/Auth/usePasskeyLogin.ts
+++ b/resources/js/Pages/Auth/usePasskeyLogin.ts
@@ -18,7 +18,7 @@ function useSpatiePasskeyLogin(options: PasskeyLoginOptions) {
         start_authentication_response: '',
     });
 
-    async function loginWithPasskey({ autofill = false, remember = false }) {
+    async function loginWithPasskey({ autofill = false, remember = false } = {}) {
         try {
             const response = await api.get(route('passkeys.authentication_options'), {
                 ignoreContentType: true,
diff --git a/src/Auth/Passkeys/SpatiePasskeyManager.php b/src/Auth/Passkeys/SpatiePasskeyManager.php
index 3e12afddb..39bba8a78 100644
--- a/src/Auth/Passkeys/SpatiePasskeyManager.php
+++ b/src/Auth/Passkeys/SpatiePasskeyManager.php
@@ -27,7 +27,7 @@ public function setLastUsedPasskey(Model $passkey): void
         Cookie::queue('sharp_last_used_passkey', $passkey->getKey(), 576000);
     }
 
-    public function getLastUsedPasskey(): ?Passkey
+    public function getLastUsedPasskey(): ?Model
     {
         return $this->model()::find(Cookie::get('sharp_last_used_passkey'));
     }
diff --git a/src/Auth/TwoFactor/MultiFactorManager.php b/src/Auth/TwoFactor/MultiFactorManager.php
index fc9b9142e..e3e0c7720 100644
--- a/src/Auth/TwoFactor/MultiFactorManager.php
+++ b/src/Auth/TwoFactor/MultiFactorManager.php
@@ -48,9 +48,12 @@ public function pendingUser(): ?Authenticatable
 
     protected function findUser($id): ?Authenticatable
     {
-        return once(fn () => Auth::guard(sharp()->config()->get('auth.guard'))
-            ->getProvider()
-            ->retrieveById($id)
-        );
+        return once(function () use ($id) {
+            $user = Auth::guard(sharp()->config()->get('auth.guard'))
+                ->onceUsingId($id);
+            Auth::forgetGuards();
+
+            return $user;
+        });
     }
 }
diff --git a/src/Http/Controllers/Auth/Requests/LoginRequest.php b/src/Http/Controllers/Auth/Requests/LoginRequest.php
index 03799296c..fac39f174 100644
--- a/src/Http/Controllers/Auth/Requests/LoginRequest.php
+++ b/src/Http/Controllers/Auth/Requests/LoginRequest.php
@@ -49,7 +49,6 @@ public function authenticate(): void
 
     private function attemptToLogin(bool $remember): bool
     {
-        $guard = $this->getGuard();
         $credentials = [
             sharp()->config()->get('auth.login_attribute') => $this->input('login'),
             sharp()->config()->get('auth.password_attribute') => $this->input('password'),
@@ -57,10 +56,13 @@ private function attemptToLogin(bool $remember): bool
 
         if (sharp()->config()->get('auth.2fa.enabled')) {
             // 2fa is globally configured, but we have to ensure that the user has 2fa enabled
-            if ($guard->once($credentials)) {
+            if ($this->guard()->once($credentials)) {
                 $handler = app(Sharp2faHandler::class);
-                if ($handler->isEnabledFor($guard->user())) {
-                    $handler->setUser($guard->user())->generateCode($remember);
+                $user = $this->guard()->user();
+                Auth::forgetGuards();
+
+                if ($handler->isEnabledFor($user)) {
+                    $handler->setUser($user)->generateCode($remember);
 
                     throw new SharpAuthenticationNeeds2faException();
                 }
@@ -69,7 +71,7 @@ private function attemptToLogin(bool $remember): bool
             }
         }
 
-        return $guard->attempt($credentials, $remember);
+        return $this->guard()->attempt($credentials, $remember);
     }
 
     private function ensureIsNotRateLimited(): void
@@ -102,7 +104,7 @@ private function throttleKey(): string
         return Str::transliterate(Str::lower($this->input('login')).'|'.$this->ip());
     }
 
-    private function getGuard(): StatefulGuard
+    private function guard(): StatefulGuard
     {
         return Auth::guard(sharp()->config()->get('auth.guard'));
     }
diff --git a/tests/Fixtures/TestAuthGuard.php b/tests/Fixtures/TestAuthGuard.php
index c91bf204d..dc82881c5 100644
--- a/tests/Fixtures/TestAuthGuard.php
+++ b/tests/Fixtures/TestAuthGuard.php
@@ -82,7 +82,10 @@ public function loginUsingId($id, $remember = false)
         return false;
     }
 
-    public function onceUsingId($id) {}
+    public function onceUsingId($id)
+    {
+        return $this->loginUsingId($id);
+    }
 
     public function viaRemember() {}
 
diff --git a/tests/Http/Auth/Login2faNotificationTest.php b/tests/Http/Auth/MultiFactorNotificationTest.php
similarity index 77%
rename from tests/Http/Auth/Login2faNotificationTest.php
rename to tests/Http/Auth/MultiFactorNotificationTest.php
index 45e15e40f..31a4ce0a8 100644
--- a/tests/Http/Auth/Login2faNotificationTest.php
+++ b/tests/Http/Auth/MultiFactorNotificationTest.php
@@ -19,7 +19,12 @@
 it('redirects to 2fa code page after successful first step login', function () {
     Notification::fake();
 
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 });
 
 it('does not redirect to 2fa code page after failed first step login', function () {
@@ -33,7 +38,12 @@
 it('sends to the user a 2fa notification after successful first step login', function () {
     Notification::fake();
 
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
     Notification::assertSentTimes(Sharp2faDefaultNotification::class, 1);
 });
@@ -51,7 +61,12 @@ protected function generateRandomCode(): int
         }
     );
 
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
     $this
         ->post(
@@ -66,7 +81,12 @@ protected function generateRandomCode(): int
 it('does not log in the user after invalid 2fa code validation', function () {
     Notification::fake();
 
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
     $this
         ->from(route('code16.sharp.login.2fa'))
diff --git a/tests/Http/Auth/MultiFactorPasskeyTest.php b/tests/Http/Auth/MultiFactorPasskeyTest.php
new file mode 100644
index 000000000..f8716a366
--- /dev/null
+++ b/tests/Http/Auth/MultiFactorPasskeyTest.php
@@ -0,0 +1,222 @@
+<?php
+
+namespace Code16\Sharp\Tests\Http\Auth;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Code16\Sharp\Tests\Fixtures\User;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Schema;
+use Spatie\LaravelPasskeys\Actions\FindPasskeyToAuthenticateAction;
+use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
+use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
+use Spatie\LaravelPasskeys\Http\Requests\AuthenticateUsingPasskeysRequest;
+use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
+use Spatie\LaravelPasskeys\Models\Concerns\InteractsWithPasskeys;
+use Spatie\LaravelPasskeys\Models\Passkey;
+
+use function Orchestra\Testbench\Pest\defineEnvironment;
+use function Orchestra\Testbench\Pest\defineRoutes;
+
+pest()->use(LazilyRefreshDatabase::class);
+
+defineEnvironment(function () {
+    sharp()->config()
+        ->enable2faByPasskey()
+        ->declareEntity(PersonEntity::class);
+});
+
+defineRoutes(function () {
+    Route::passkeys();
+});
+
+beforeEach(function () {
+    Schema::create('users', function (Blueprint $table) {
+        $table->increments('id');
+        $table->string('name')->nullable();
+        $table->string('email');
+        $table->string('password')->nullable();
+        $table->string('remember_token')->nullable();
+        $table->timestamps();
+    });
+
+    Schema::create('passkeys', function (Blueprint $table) {
+        $table->id();
+        $table->unsignedInteger('authenticatable_id');
+        $table->text('name');
+        $table->text('credential_id');
+        $table->json('data');
+        $table->timestamp('last_used_at')->nullable();
+        $table->timestamps();
+    });
+
+    config()->set('auth.providers.users.model', PasskeyMultifactorTestUser::class);
+    config()->set('passkeys.models.authenticatable', PasskeyMultifactorTestUser::class);
+    config()->set('passkeys.models.passkey', TestPasskey::class);
+});
+
+function createMultifactorUser(array $attributes = []): PasskeyMultifactorTestUser
+{
+    return PasskeyMultifactorTestUser::create(array_merge([
+        'email' => 'test@example.org',
+        'name' => 'Test',
+        'password' => bcrypt('password'),
+    ], $attributes));
+}
+
+function createPasskey(PasskeyMultifactorTestUser $user, array $attributes = []): TestPasskey
+{
+    $id = DB::table('passkeys')->insertGetId(array_merge([
+        'authenticatable_id' => $user->id,
+        'name' => 'My Passkey',
+        'credential_id' => 'test-credential-'.uniqid(),
+        'data' => json_encode(['test' => true]),
+        'last_used_at' => null,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ], $attributes));
+
+    return TestPasskey::find($id);
+}
+
+it('authenticates user directly when logging in with passkey', function () {
+    $user = createMultifactorUser();
+    $passkey = createPasskey($user);
+
+    FakeFindPasskeyToAuthenticateAction::$passkey = $passkey;
+
+    config()->set('passkeys.actions.find_passkey', FakeFindPasskeyToAuthenticateAction::class);
+    session()->put('passkey-authentication-options', 'test');
+
+    $this->post(route('passkeys.login'), ['start_authentication_response' => '{}'], headers: ['X-Sharp' => '1'])
+        ->assertSessionMissing('authenticatePasskey::message')
+        ->assertSessionHasNoErrors()
+        ->assertRedirect(route('code16.sharp.passkeys.authenticated', [
+            'intended_url' => route('code16.sharp.home'),
+        ]));
+
+    $this->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->check())->toBeTrue();
+    expect(auth()->user()->id)->toBe($user->id);
+});
+
+it('redirects to passkey creation when user has no passkey', function () {
+    $user = createMultifactorUser();
+
+    $this->post(
+        route('code16.sharp.login.post'),
+        ['login' => $user->email, 'password' => 'password']
+    )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
+
+    $this->get(route('code16.sharp.login.2fa'))
+        ->assertRedirect(route('code16.sharp.passkeys.create'));
+
+    expect(app(MultiFactorManager::class)->pendingUser()->id)->toBe($user->id);
+
+    config()->set('passkeys.actions.store_passkey', FakeStorePasskeyAction::class);
+
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'))
+        ->assertRedirect(route('code16.sharp.passkeys.registered'));
+
+    $this->get(route('code16.sharp.passkeys.registered'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->check())->toBeTrue();
+    expect(auth()->user()->id)->toBe($user->id);
+    expect(app(MultiFactorManager::class)->pendingUser())->toBeNull();
+});
+
+it('redirects to 2fa page when user has a passkey', function () {
+    $user = createMultifactorUser();
+    $passkey = createPasskey($user);
+
+    $this->post(route('code16.sharp.login.post'), [
+        'login' => $user->email,
+        'password' => 'password',
+    ])->assertRedirect(route('code16.sharp.login.2fa'));
+
+    $this->get(route('code16.sharp.login.2fa'))
+        ->assertOk();
+
+    $request = AuthenticateUsingPasskeysRequest::create(route('passkeys.login'));
+    $request->headers->set('X-Sharp', '1');
+    event(new PasskeyUsedToAuthenticateEvent($passkey, $request));
+
+    // Simulate entering passkey
+    $this->actingAs($user, 'web');
+    $this->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->check())->toBeTrue();
+});
+
+it('redirects to login with mismatch message when using another user passkey (test 4)', function () {
+    $userA = createMultifactorUser(['email' => 'userA@example.org']);
+    $userB = createMultifactorUser(['email' => 'userB@example.org']);
+    createPasskey($userA);
+    createPasskey($userB);
+
+    // User A starts login
+    $this->post(route('code16.sharp.login.post'), [
+        'login' => $userA->email,
+        'password' => 'password',
+    ])->assertRedirect(route('code16.sharp.login.2fa'));
+
+    // Simulate User B's passkey being used
+    $this->actingAs($userB, 'web');
+
+    $this->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.login'))
+        ->assertSessionHas('status', __('sharp::auth.2fa.passkey.mismatch_error'));
+
+    expect(auth()->check())->toBeFalse();
+});
+
+class FakeStorePasskeyAction extends StorePasskeyAction
+{
+    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
+    {
+        return new TestPasskey();
+    }
+}
+
+class FakeFindPasskeyToAuthenticateAction extends FindPasskeyToAuthenticateAction
+{
+    public static ?Passkey $passkey = null;
+
+    public function execute(string $publicKeyCredentialJson, string $passkeyOptionsJson): ?Passkey
+    {
+        return self::$passkey;
+    }
+}
+
+class TestPasskey extends Passkey
+{
+    protected $table = 'passkeys';
+}
+
+class PasskeyMultifactorTestUser extends User implements HasPasskeys
+{
+    use InteractsWithPasskeys;
+
+    protected $table = 'users';
+
+    public function getPasskeyName(): string
+    {
+        return $this->email;
+    }
+    public function getPasskeyId(): string
+    {
+        return (string) $this->id;
+    }
+    public function getPasskeyDisplayName(): string
+    {
+        return $this->name ?? $this->email;
+    }
+}
diff --git a/tests/Http/Auth/Login2faTotpTest.php b/tests/Http/Auth/MultiFactorTotpTest.php
similarity index 83%
rename from tests/Http/Auth/Login2faTotpTest.php
rename to tests/Http/Auth/MultiFactorTotpTest.php
index a43d45288..066aea961 100644
--- a/tests/Http/Auth/Login2faTotpTest.php
+++ b/tests/Http/Auth/MultiFactorTotpTest.php
@@ -73,7 +73,12 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('redirects to 2fa code page after successful first step login', function () {
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 });
 
 it('does not redirect to 2fa code page after failed first step login', function () {
@@ -85,7 +90,12 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('logs in the user after successful 2fa code validation', function () {
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
     $this
         ->post(
@@ -98,7 +108,12 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('logs in the user after entering a valid recovery code', function () {
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
     $this
         ->post(
@@ -111,7 +126,12 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('does not log in the user after invalid 2fa code validation', function () {
-    postLoginFor2fa('test@example.org', 'password');
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
     $this
         ->from(route('code16.sharp.login.2fa'))
diff --git a/tests/Http/Auth/PasskeysTest.php b/tests/Http/Auth/PasskeysTest.php
index 80ef8dc7c..b69205e5b 100644
--- a/tests/Http/Auth/PasskeysTest.php
+++ b/tests/Http/Auth/PasskeysTest.php
@@ -17,6 +17,7 @@
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Validation\ValidationException;
+use Spatie\LaravelPasskeys\Actions\FindPasskeyToAuthenticateAction;
 use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
 use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
 use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
@@ -199,6 +200,29 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
         ->toThrow(ValidationException::class);
 });
 
+it('authenticates user directly when logging in with passkey', function () {
+    $user = createPasskeyTestUser();
+    $passkey = createPasskey($user);
+
+    FakeFindPasskeyToAuthenticateAction::$passkey = $passkey;
+
+    config()->set('passkeys.actions.find_passkey', FakeFindPasskeyToAuthenticateAction::class);
+    session()->put('passkey-authentication-options', 'test');
+
+    $this->post(route('passkeys.login'), ['start_authentication_response' => '{}'], headers: ['X-Sharp' => '1'])
+        ->assertSessionMissing('authenticatePasskey::message')
+        ->assertSessionHasNoErrors()
+        ->assertRedirect(route('code16.sharp.passkeys.authenticated', [
+            'intended_url' => route('code16.sharp.home'),
+        ]));
+
+    $this->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->check())->toBeTrue();
+    expect(auth()->user()->id)->toBe($user->id);
+});
+
 // --- PasskeyEventSubscriber ---
 
 it('queues a cookie when passkey is used to authenticate', function () {
@@ -375,6 +399,16 @@ public function data(): Attribute
     }
 }
 
+class FakeFindPasskeyToAuthenticateAction extends FindPasskeyToAuthenticateAction
+{
+    public static ?Passkey $passkey = null;
+
+    public function execute(string $publicKeyCredentialJson, string $passkeyOptionsJson): ?Passkey
+    {
+        return self::$passkey;
+    }
+}
+
 class FakeGeneratePasskeyRegisterOptionsAction extends GeneratePasskeyRegisterOptionsAction
 {
     public function execute(HasPasskeys $authenticatable, bool $asJson = true): string|PublicKeyCredentialCreationOptions
diff --git a/tests/Pest.php b/tests/Pest.php
index 3926e6a1d..21b4ee5ee 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -7,7 +7,6 @@
 use Code16\Sharp\Utils\Entities\SharpEntityManager;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Http\UploadedFile;
-use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\URL;
 
@@ -88,22 +87,6 @@ function login(?User $user = null)
     );
 }
 
-function postLoginFor2fa($email, $password): void
-{
-    test()->post(
-        route('code16.sharp.login.post'),
-        ['login' => $email, 'password' => $password]
-    )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
-
-    /**
-     * We assume the configured sharp guard is @see \Code16\Sharp\Tests\Fixtures\TestAuthGuard
-     */
-    $guard = sharp()->config()->get('auth.guard');
-    expect(Auth::guard($guard)->isOnce)->toBeTrue();
-    Auth::guard($guard)->logout();
-}
-
 function fakeListFor(string $entityKeyOrClass, $fakeImplementation)
 {
     app(SharpEntityManager::class)

From 4d3197f9f2a5ec34b423f656fd629b5a24cf91b3 Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Thu, 9 Jul 2026 11:15:03 +0200
Subject: [PATCH 8/8] Fix import

---
 tests/Http/Auth/MultiFactorPasskeyTest.php    | 222 ------------------
 .../SpatiePasskeysMultiFactorTest.php         | 137 +++++++++++
 .../SpatiePasskeysTest.php}                   | 175 ++++----------
 tests/Http/Auth/SpatiePasskeys/helpers.php    |  95 ++++++++
 4 files changed, 274 insertions(+), 355 deletions(-)
 delete mode 100644 tests/Http/Auth/MultiFactorPasskeyTest.php
 create mode 100644 tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php
 rename tests/Http/Auth/{PasskeysTest.php => SpatiePasskeys/SpatiePasskeysTest.php} (71%)
 create mode 100644 tests/Http/Auth/SpatiePasskeys/helpers.php

diff --git a/tests/Http/Auth/MultiFactorPasskeyTest.php b/tests/Http/Auth/MultiFactorPasskeyTest.php
deleted file mode 100644
index f8716a366..000000000
--- a/tests/Http/Auth/MultiFactorPasskeyTest.php
+++ /dev/null
@@ -1,222 +0,0 @@
-<?php
-
-namespace Code16\Sharp\Tests\Http\Auth;
-
-use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
-use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
-use Code16\Sharp\Tests\Fixtures\User;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Route;
-use Illuminate\Support\Facades\Schema;
-use Spatie\LaravelPasskeys\Actions\FindPasskeyToAuthenticateAction;
-use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
-use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
-use Spatie\LaravelPasskeys\Http\Requests\AuthenticateUsingPasskeysRequest;
-use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
-use Spatie\LaravelPasskeys\Models\Concerns\InteractsWithPasskeys;
-use Spatie\LaravelPasskeys\Models\Passkey;
-
-use function Orchestra\Testbench\Pest\defineEnvironment;
-use function Orchestra\Testbench\Pest\defineRoutes;
-
-pest()->use(LazilyRefreshDatabase::class);
-
-defineEnvironment(function () {
-    sharp()->config()
-        ->enable2faByPasskey()
-        ->declareEntity(PersonEntity::class);
-});
-
-defineRoutes(function () {
-    Route::passkeys();
-});
-
-beforeEach(function () {
-    Schema::create('users', function (Blueprint $table) {
-        $table->increments('id');
-        $table->string('name')->nullable();
-        $table->string('email');
-        $table->string('password')->nullable();
-        $table->string('remember_token')->nullable();
-        $table->timestamps();
-    });
-
-    Schema::create('passkeys', function (Blueprint $table) {
-        $table->id();
-        $table->unsignedInteger('authenticatable_id');
-        $table->text('name');
-        $table->text('credential_id');
-        $table->json('data');
-        $table->timestamp('last_used_at')->nullable();
-        $table->timestamps();
-    });
-
-    config()->set('auth.providers.users.model', PasskeyMultifactorTestUser::class);
-    config()->set('passkeys.models.authenticatable', PasskeyMultifactorTestUser::class);
-    config()->set('passkeys.models.passkey', TestPasskey::class);
-});
-
-function createMultifactorUser(array $attributes = []): PasskeyMultifactorTestUser
-{
-    return PasskeyMultifactorTestUser::create(array_merge([
-        'email' => 'test@example.org',
-        'name' => 'Test',
-        'password' => bcrypt('password'),
-    ], $attributes));
-}
-
-function createPasskey(PasskeyMultifactorTestUser $user, array $attributes = []): TestPasskey
-{
-    $id = DB::table('passkeys')->insertGetId(array_merge([
-        'authenticatable_id' => $user->id,
-        'name' => 'My Passkey',
-        'credential_id' => 'test-credential-'.uniqid(),
-        'data' => json_encode(['test' => true]),
-        'last_used_at' => null,
-        'created_at' => now(),
-        'updated_at' => now(),
-    ], $attributes));
-
-    return TestPasskey::find($id);
-}
-
-it('authenticates user directly when logging in with passkey', function () {
-    $user = createMultifactorUser();
-    $passkey = createPasskey($user);
-
-    FakeFindPasskeyToAuthenticateAction::$passkey = $passkey;
-
-    config()->set('passkeys.actions.find_passkey', FakeFindPasskeyToAuthenticateAction::class);
-    session()->put('passkey-authentication-options', 'test');
-
-    $this->post(route('passkeys.login'), ['start_authentication_response' => '{}'], headers: ['X-Sharp' => '1'])
-        ->assertSessionMissing('authenticatePasskey::message')
-        ->assertSessionHasNoErrors()
-        ->assertRedirect(route('code16.sharp.passkeys.authenticated', [
-            'intended_url' => route('code16.sharp.home'),
-        ]));
-
-    $this->get(route('code16.sharp.passkeys.authenticated'))
-        ->assertRedirect(route('code16.sharp.home'));
-
-    expect(auth()->check())->toBeTrue();
-    expect(auth()->user()->id)->toBe($user->id);
-});
-
-it('redirects to passkey creation when user has no passkey', function () {
-    $user = createMultifactorUser();
-
-    $this->post(
-        route('code16.sharp.login.post'),
-        ['login' => $user->email, 'password' => 'password']
-    )
-        ->assertRedirect(route('code16.sharp.login.2fa'));
-
-    $this->get(route('code16.sharp.login.2fa'))
-        ->assertRedirect(route('code16.sharp.passkeys.create'));
-
-    expect(app(MultiFactorManager::class)->pendingUser()->id)->toBe($user->id);
-
-    config()->set('passkeys.actions.store_passkey', FakeStorePasskeyAction::class);
-
-    $this->postJson(route('code16.sharp.passkeys.spatie.store'))
-        ->assertRedirect(route('code16.sharp.passkeys.registered'));
-
-    $this->get(route('code16.sharp.passkeys.registered'))
-        ->assertRedirect(route('code16.sharp.home'));
-
-    expect(auth()->check())->toBeTrue();
-    expect(auth()->user()->id)->toBe($user->id);
-    expect(app(MultiFactorManager::class)->pendingUser())->toBeNull();
-});
-
-it('redirects to 2fa page when user has a passkey', function () {
-    $user = createMultifactorUser();
-    $passkey = createPasskey($user);
-
-    $this->post(route('code16.sharp.login.post'), [
-        'login' => $user->email,
-        'password' => 'password',
-    ])->assertRedirect(route('code16.sharp.login.2fa'));
-
-    $this->get(route('code16.sharp.login.2fa'))
-        ->assertOk();
-
-    $request = AuthenticateUsingPasskeysRequest::create(route('passkeys.login'));
-    $request->headers->set('X-Sharp', '1');
-    event(new PasskeyUsedToAuthenticateEvent($passkey, $request));
-
-    // Simulate entering passkey
-    $this->actingAs($user, 'web');
-    $this->get(route('code16.sharp.passkeys.authenticated'))
-        ->assertRedirect(route('code16.sharp.home'));
-
-    expect(auth()->check())->toBeTrue();
-});
-
-it('redirects to login with mismatch message when using another user passkey (test 4)', function () {
-    $userA = createMultifactorUser(['email' => 'userA@example.org']);
-    $userB = createMultifactorUser(['email' => 'userB@example.org']);
-    createPasskey($userA);
-    createPasskey($userB);
-
-    // User A starts login
-    $this->post(route('code16.sharp.login.post'), [
-        'login' => $userA->email,
-        'password' => 'password',
-    ])->assertRedirect(route('code16.sharp.login.2fa'));
-
-    // Simulate User B's passkey being used
-    $this->actingAs($userB, 'web');
-
-    $this->get(route('code16.sharp.passkeys.authenticated'))
-        ->assertRedirect(route('code16.sharp.login'))
-        ->assertSessionHas('status', __('sharp::auth.2fa.passkey.mismatch_error'));
-
-    expect(auth()->check())->toBeFalse();
-});
-
-class FakeStorePasskeyAction extends StorePasskeyAction
-{
-    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
-    {
-        return new TestPasskey();
-    }
-}
-
-class FakeFindPasskeyToAuthenticateAction extends FindPasskeyToAuthenticateAction
-{
-    public static ?Passkey $passkey = null;
-
-    public function execute(string $publicKeyCredentialJson, string $passkeyOptionsJson): ?Passkey
-    {
-        return self::$passkey;
-    }
-}
-
-class TestPasskey extends Passkey
-{
-    protected $table = 'passkeys';
-}
-
-class PasskeyMultifactorTestUser extends User implements HasPasskeys
-{
-    use InteractsWithPasskeys;
-
-    protected $table = 'users';
-
-    public function getPasskeyName(): string
-    {
-        return $this->email;
-    }
-    public function getPasskeyId(): string
-    {
-        return (string) $this->id;
-    }
-    public function getPasskeyDisplayName(): string
-    {
-        return $this->name ?? $this->email;
-    }
-}
diff --git a/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php
new file mode 100644
index 000000000..951ad9f5c
--- /dev/null
+++ b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php
@@ -0,0 +1,137 @@
+<?php
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Schema;
+use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
+use Spatie\LaravelPasskeys\Models\Passkey;
+
+use function Orchestra\Testbench\Pest\defineEnvironment;
+use function Orchestra\Testbench\Pest\defineRoutes;
+
+require_once __DIR__.'/helpers.php';
+
+pest()->use(LazilyRefreshDatabase::class);
+
+defineEnvironment(function () {
+    sharp()->config()
+        ->enable2faByPasskey()
+        ->declareEntity(PersonEntity::class);
+});
+
+defineRoutes(function () {
+    Route::passkeys();
+});
+
+beforeEach(function () {
+    Schema::create('users', function (Blueprint $table) {
+        $table->increments('id');
+        $table->string('name')->nullable();
+        $table->string('email');
+        $table->string('password')->nullable();
+        $table->string('remember_token')->nullable();
+        $table->timestamps();
+    });
+
+    Schema::create('passkeys', function (Blueprint $table) {
+        $table->id();
+        $table->unsignedInteger('authenticatable_id');
+        $table->text('name');
+        $table->text('credential_id');
+        $table->json('data');
+        $table->timestamp('last_used_at')->nullable();
+        $table->timestamps();
+    });
+
+    config()->set('auth.providers.users.model', PasskeyTestUser::class);
+    config()->set('passkeys.models.authenticatable', PasskeyTestUser::class);
+    config()->set('passkeys.models.passkey', TestPasskey::class);
+});
+
+it('authenticates user directly when logging in with passkey', function () {
+    $user = createPasskeyUser();
+    $passkey = createPasskey($user);
+
+    loginUsingSpatiePasskey($passkey);
+
+    test()->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->id())->toBe($user->id);
+});
+
+it('redirects to 2fa page when user has a passkey', function () {
+    $user = createPasskeyUser();
+    $passkey = createPasskey($user);
+
+    $this->post(route('code16.sharp.login.post'), [
+        'login' => $user->email,
+        'password' => 'password',
+    ])->assertRedirect(route('code16.sharp.login.2fa'));
+
+    $this->get(route('code16.sharp.login.2fa'))
+        ->assertOk();
+
+    loginUsingSpatiePasskey($passkey);
+
+    test()->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->id())->toBe($user->id);
+});
+
+it('redirects to login with mismatch message when using another user passkey (test 4)', function () {
+    $userA = createPasskeyUser(['email' => 'userA@example.org']);
+    $userB = createPasskeyUser(['email' => 'userB@example.org']);
+    createPasskey($userA);
+    $passkeyB = createPasskey($userB);
+
+    // User A starts login
+    $this->post(route('code16.sharp.login.post'), [
+        'login' => $userA->email,
+        'password' => 'password',
+    ])->assertRedirect(route('code16.sharp.login.2fa'));
+
+    loginUsingSpatiePasskey($passkeyB);
+
+    test()->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.login'))
+        ->assertSessionHas('status', __('sharp::auth.2fa.passkey.mismatch_error'));
+});
+
+it('redirects to passkey creation when user has no passkey', function () {
+    $user = createPasskeyUser();
+
+    $this->post(
+        route('code16.sharp.login.post'),
+        ['login' => $user->email, 'password' => 'password']
+    )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
+
+    $this->get(route('code16.sharp.login.2fa'))
+        ->assertRedirect(route('code16.sharp.passkeys.create'));
+
+    expect(app(MultiFactorManager::class)->pendingUser()->id)->toBe($user->id);
+
+    config()->set('passkeys.actions.store_passkey', FakeStorePasskeyActionForMultiFactor::class);
+
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'))
+        ->assertRedirect(route('code16.sharp.passkeys.registered'));
+
+    $this->get(route('code16.sharp.passkeys.registered'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->id())->toBe($user->id);
+    expect(app(MultiFactorManager::class)->pendingUser())->toBeNull();
+});
+
+class FakeStorePasskeyActionForMultiFactor extends StorePasskeyAction
+{
+    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
+    {
+        return new TestPasskey();
+    }
+}
diff --git a/tests/Http/Auth/PasskeysTest.php b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysTest.php
similarity index 71%
rename from tests/Http/Auth/PasskeysTest.php
rename to tests/Http/Auth/SpatiePasskeys/SpatiePasskeysTest.php
index b69205e5b..19d5144f0 100644
--- a/tests/Http/Auth/PasskeysTest.php
+++ b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysTest.php
@@ -1,6 +1,5 @@
 <?php
 
-namespace Code16\Sharp\Tests\Http\Auth;
 
 use Code16\Sharp\Auth\Passkeys\Commands\UpdatePasskeyNameCommand;
 use Code16\Sharp\Auth\Passkeys\Entity\PasskeyEntity;
@@ -30,6 +29,9 @@
 use function Orchestra\Testbench\Pest\defineEnvironment;
 use function Orchestra\Testbench\Pest\defineRoutes;
 
+
+require_once __DIR__.'/helpers.php';
+
 pest()->use(LazilyRefreshDatabase::class);
 
 defineEnvironment(function () {
@@ -68,43 +70,6 @@
         ->declareEntity(PersonEntity::class);
 });
 
-function createPasskeyTestUser(array $attributes = []): PasskeyTestUser
-{
-    return PasskeyTestUser::create(array_merge([
-        'email' => 'test@example.org',
-        'name' => 'Test',
-    ], $attributes));
-}
-
-function createPasskey(PasskeyTestUser $user, array $attributes = []): TestPasskey
-{
-    $attrs = array_merge([
-        'name' => 'My Passkey',
-        'credential_id' => 'test-credential-'.uniqid(),
-        'last_used_at' => null,
-    ], $attributes);
-
-    $id = DB::table('passkeys')->insertGetId([
-        'authenticatable_id' => $user->id,
-        'name' => $attrs['name'],
-        'credential_id' => $attrs['credential_id'],
-        'data' => json_encode(['test' => true]),
-        'last_used_at' => $attrs['last_used_at'],
-        'created_at' => $attrs['created_at'] ?? now(),
-        'updated_at' => now(),
-    ]);
-
-    return TestPasskey::find($id);
-}
-
-function loginPasskeyUser(?PasskeyTestUser $user = null)
-{
-    test()->actingAs(
-        $user ?: createPasskeyTestUser(),
-        sharp()->config()->get('auth.guard') ?: 'web'
-    );
-}
-
 // --- PasskeyEntity tests ---
 
 it('has correct prohibited actions', function () {
@@ -117,9 +82,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- PasskeyList data ---
 
 it('returns list data for authenticated user', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     createPasskey($user, ['name' => 'My Passkey', 'last_used_at' => now()->subDay()]);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $data = $list->getListData();
@@ -129,10 +94,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('does not return passkeys of other users', function () {
-    $user = createPasskeyTestUser();
-    $otherUser = createPasskeyTestUser(['email' => 'other@example.org']);
+    $user = createPasskeyUser();
+    $otherUser = createPasskeyUser(['email' => 'other@example.org']);
     createPasskey($otherUser, ['name' => 'Other Passkey']);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $data = $list->getListData();
@@ -141,9 +106,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('transforms last_used_at to human readable format', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     createPasskey($user, ['last_used_at' => now()->subHour()]);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $data = $list->getListData();
@@ -154,9 +119,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- PasskeyList delete ---
 
 it('deletes a passkey for the authenticated user', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $list->delete($passkey->id);
@@ -165,10 +130,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('cannot delete another user passkey', function () {
-    $user = createPasskeyTestUser();
-    $otherUser = createPasskeyTestUser(['email' => 'other@example.org']);
+    $user = createPasskeyUser();
+    $otherUser = createPasskeyUser(['email' => 'other@example.org']);
     $passkey = createPasskey($otherUser);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
 
@@ -179,9 +144,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- UpdatePasskeyNameCommand ---
 
 it('renames a passkey', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     $command = app(UpdatePasskeyNameCommand::class);
     $command->execute($passkey->id, ['name' => 'Renamed Passkey']);
@@ -190,9 +155,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('validates name is required when renaming', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     $command = app(UpdatePasskeyNameCommand::class);
 
@@ -201,20 +166,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('authenticates user directly when logging in with passkey', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
 
-    FakeFindPasskeyToAuthenticateAction::$passkey = $passkey;
-
-    config()->set('passkeys.actions.find_passkey', FakeFindPasskeyToAuthenticateAction::class);
-    session()->put('passkey-authentication-options', 'test');
-
-    $this->post(route('passkeys.login'), ['start_authentication_response' => '{}'], headers: ['X-Sharp' => '1'])
-        ->assertSessionMissing('authenticatePasskey::message')
-        ->assertSessionHasNoErrors()
-        ->assertRedirect(route('code16.sharp.passkeys.authenticated', [
-            'intended_url' => route('code16.sharp.home'),
-        ]));
+    loginUsingSpatiePasskey($passkey);
 
     $this->get(route('code16.sharp.passkeys.authenticated'))
         ->assertRedirect(route('code16.sharp.home'));
@@ -227,13 +182,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 
 it('queues a cookie when passkey is used to authenticate', function () {
     // here we expects the SharpInternalServiceProvider is booted
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
 
-    $request = AuthenticateUsingPasskeysRequest::create(route('passkeys.login'));
-    $request->headers->set('X-Sharp', '1');
-    $event = new PasskeyUsedToAuthenticateEvent($passkey, $request);
-    app(Dispatcher::class)->dispatch($event);
+    loginUsingSpatiePasskey($passkey);
 
     $queued = Cookie::getQueuedCookies();
     $names = array_map(fn ($c) => $c->getName(), $queued);
@@ -243,9 +195,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- Usage badge ---
 
 it('shows usage badge when passkey matches cookie', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     request()->cookies->set('sharp_last_used_passkey', (string) $passkey->id);
 
@@ -256,9 +208,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('does not show usage badge when passkey does not match cookie', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     request()->cookies->set('sharp_last_used_passkey', '99999');
 
@@ -271,14 +223,14 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- PasskeyController tests ---
 
 it('renders the passkey create page', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->get(route('code16.sharp.passkeys.create'))
         ->assertOk();
 });
 
 it('renders the passkey create page with prompt parameter', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->get(route('code16.sharp.passkeys.create', ['prompt' => 1]))
         ->assertOk();
@@ -290,7 +242,7 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('validates name on passkey validate endpoint', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => ''])
         ->assertJsonValidationErrors('name');
@@ -300,8 +252,8 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('returns passkey options on successful validate', function () {
-    $user = createPasskeyTestUser();
-    loginPasskeyUser($user);
+    $user = createPasskeyUser();
+    login($user);
 
     // Configure a fake action that returns a JSON string
     config()->set('passkeys.actions.generate_passkey_register_options', FakeGeneratePasskeyRegisterOptionsAction::class);
@@ -317,8 +269,8 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('store endpoint catches action errors and throws validation exception', function () {
-    $user = createPasskeyTestUser();
-    loginPasskeyUser($user);
+    $user = createPasskeyUser();
+    login($user);
 
     // Put fake options in session as the controller expects them
     session()->put('passkey-registration-options', '{"fake":"options"}');
@@ -331,18 +283,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
         ->assertJsonValidationErrors('name');
 });
 
-class FakeStorePasskeyAction extends StorePasskeyAction
-{
-    public static $mock;
-    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
-    {
-        return static::$mock->execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties);
-    }
-}
 
 it('store endpoint calls StorePasskeyAction with appropriate arguments', function () {
-    $user = createPasskeyTestUser();
-    loginPasskeyUser($user);
+    $user = createPasskeyUser();
+    login($user);
 
     $passkeyData = '{"id":"some-id","rawId":"some-raw-id","type":"public-key","response":{"attestationObject":"some-attestation","clientDataJSON":"some-client-data"}}';
     $passkeyOptions = '{"challenge":"some-challenge"}';
@@ -350,7 +294,7 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
 
     session()->put('passkey-registration-options', $passkeyOptions);
 
-    $mockAction = \Mockery::mock(Spatie\LaravelPasskeys\Actions\StorePasskeyAction::class);
+    $mockAction = \Mockery::mock(StorePasskeyAction::class);
     $mockAction->shouldReceive('execute')
         ->once()
         ->withArgs(function ($authenticatable, $passkeyJson, $optionsJson, $host, $additionalProperties) use ($user, $passkeyData, $passkeyOptions, $passkeyName) {
@@ -377,7 +321,7 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
 // --- PasskeySkipPromptController tests ---
 
 it('skip prompt redirects to home with cookie', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->post(route('code16.sharp.passkeys.skip-prompt'))
         ->assertRedirect(route('code16.sharp.home'))
@@ -386,26 +330,12 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
 
 // --- Fixtures ---
 
-class TestPasskey extends Passkey
-{
-    protected $table = 'passkeys';
-
-    public function data(): Attribute
-    {
-        return new Attribute(
-            get: fn ($value) => $value,
-            set: fn ($value) => ['data' => is_string($value) ? $value : json_encode($value)],
-        );
-    }
-}
-
-class FakeFindPasskeyToAuthenticateAction extends FindPasskeyToAuthenticateAction
+class FakeStorePasskeyAction extends StorePasskeyAction
 {
-    public static ?Passkey $passkey = null;
-
-    public function execute(string $publicKeyCredentialJson, string $passkeyOptionsJson): ?Passkey
+    public static $mock;
+    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
     {
-        return self::$passkey;
+        return static::$mock->execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties);
     }
 }
 
@@ -417,24 +347,3 @@ public function execute(HasPasskeys $authenticatable, bool $asJson = true): stri
     }
 }
 
-class PasskeyTestUser extends User implements HasPasskeys
-{
-    use InteractsWithPasskeys;
-
-    protected $table = 'users';
-
-    public function getPasskeyName(): string
-    {
-        return $this->email;
-    }
-
-    public function getPasskeyId(): string
-    {
-        return (string) $this->id;
-    }
-
-    public function getPasskeyDisplayName(): string
-    {
-        return $this->name ?? $this->email;
-    }
-}
diff --git a/tests/Http/Auth/SpatiePasskeys/helpers.php b/tests/Http/Auth/SpatiePasskeys/helpers.php
new file mode 100644
index 000000000..4e81a820c
--- /dev/null
+++ b/tests/Http/Auth/SpatiePasskeys/helpers.php
@@ -0,0 +1,95 @@
+<?php
+
+use Code16\Sharp\Tests\Fixtures\User;
+use Illuminate\Database\Eloquent\Casts\Attribute;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Spatie\LaravelPasskeys\Actions\FindPasskeyToAuthenticateAction;
+use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
+use Spatie\LaravelPasskeys\Models\Concerns\InteractsWithPasskeys;
+use Spatie\LaravelPasskeys\Models\Passkey;
+
+function loginUsingSpatiePasskey(Passkey $passkey): void
+{
+    FakeFindPasskeyToAuthenticateAction::$passkey = $passkey;
+
+    config()->set('passkeys.actions.find_passkey', FakeFindPasskeyToAuthenticateAction::class);
+    session()->put('passkey-authentication-options', 'test');
+
+    test()->post(route('passkeys.login'), ['start_authentication_response' => '{}'], headers: ['X-Sharp' => '1'])
+        ->assertSessionMissing('authenticatePasskey::message')
+        ->assertSessionHasNoErrors()
+        ->assertRedirect(route('code16.sharp.passkeys.authenticated', [
+            'intended_url' => route('code16.sharp.home'),
+        ]));
+}
+
+function createPasskey(PasskeyTestUser $user, array $attributes = []): TestPasskey
+{
+    $id = DB::table('passkeys')->insertGetId([
+        'authenticatable_id' => $user->id,
+        'name' => 'My Passkey',
+        'credential_id' => 'test-credential-'.uniqid(),
+        'data' => json_encode(['test' => true]),
+        'last_used_at' => null,
+        'created_at' => now(),
+        'updated_at' => now(),
+        ...$attributes,
+    ]);
+
+    return TestPasskey::find($id);
+}
+
+function createPasskeyUser(array $attributes = []): PasskeyTestUser
+{
+    return PasskeyTestUser::create(array_merge([
+        'email' => 'test@example.org',
+        'name' => 'Test',
+        'password' => Hash::make('password'),
+    ], $attributes));
+}
+
+class FakeFindPasskeyToAuthenticateAction extends FindPasskeyToAuthenticateAction
+{
+    public static ?Passkey $passkey = null;
+
+    public function execute(string $publicKeyCredentialJson, string $passkeyOptionsJson): ?Passkey
+    {
+        return self::$passkey;
+    }
+}
+
+class PasskeyTestUser extends User implements HasPasskeys
+{
+    use InteractsWithPasskeys;
+
+    protected $table = 'users';
+
+    public function getPasskeyName(): string
+    {
+        return $this->email;
+    }
+
+    public function getPasskeyId(): string
+    {
+        return (string) $this->id;
+    }
+
+    public function getPasskeyDisplayName(): string
+    {
+        return $this->name ?? $this->email;
+    }
+}
+
+class TestPasskey extends Passkey
+{
+    protected $table = 'passkeys';
+
+    public function data(): Attribute
+    {
+        return new Attribute(
+            get: fn ($value) => $value,
+            set: fn ($value) => ['data' => is_string($value) ? $value : json_encode($value)],
+        );
+    }
+}