pixelfed/app/Http/Middleware/TwoFactorAuth.php

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class TwoFactorAuth
{
    /**
     * Handle an incoming request.
     *
     * @param  Request  $request
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if ($request->user()) {
            $user = $request->user();
            $enabled = (bool) $user->{'2fa_enabled'};
            if ($enabled !== false) {
                $checkpoint = 'i/auth/checkpoint';
                if ($request->session()->has('2fa.session.active') !== true && ! $request->is($checkpoint) && ! $request->is('logout')) {
                    return redirect('/i/auth/checkpoint');
                }
                if ($request->session()->has('2fa.attempts') && (int) $request->session()->get('2fa.attempts') > 3) {
                    $request->session()->pull('2fa.attempts');
                    Auth::logout();
                }
            }
        }

        return $next($request);
    }
}