[Bug]: ForceTwoFactor middleware triggered before Filament Authenticate authMiddleware

[Syourt]

What happened?

Not forced to set 2FA when using TwoFactorAuthPlugin::make()->forced().

How to reproduce the bug

Set TwoFactorAuthPlugin::make()->forced() in your panelprovider plugins array:

...
->plugins([
    TwoFactorAuthPlugin::make()->forced(),
])
...

Have authMiddlware set in your panelprovider:

...
->authMiddleware([
    Authenticate::class,
])
...

Repository

No response

Package Version

2.1.3

PHP Version

8.4

Laravel Version

11.44.1

Which operating systems does with happen with?

macOS

Notes

The authenticated user is not known when ForceTwoFactor middleware runs. This is solved by not using TwoFactorAuthPlugin::make()->forced() but just TwoFactorAuthPlugin::make() and manually registering the ForceTwoFactor middlware:

...
->middleware([
    ...
    ForceTwoFactor::class,
])
->authMiddleware([
    Authenticate::class,
])
...

Now the auth user is available in the ForceTwoFactor middleware and the logic works as expected.

[leonadarr]

Hi, just to add to this: I'm finding that when adding the middleware manually, it get's stuck in a loop on email-verification/prompt screen when verifying new accounts.

I had to resolve by adding another request pattern to the handle

public function handle(Request $request, Closure $next): mixed
    {
        $user = Filament::auth()->user();

        if ($request->is('*email-verification*') || $request->is('*two-factor') || $request->is('*logout')) {
            return $next($request);
        }
...

This might be worth double checking when you introduce a fix