command:
/bin/zsh
-lc
git clean -f .playwright-mcp

cmd: git clean -f .playwright-mcp

aggregated_output:
Removing .playwright-mcp/console-2026-05-03T23-28-42-443Z.log
Removing .playwright-mcp/console-2026-05-04T03-37-18-830Z.log
Removing .playwright-mcp/console-2026-05-04T04-04-39-976Z.log
Removing .playwright-mcp/console-2026-05-04T04-05-07-157Z.log
Removing .playwright-mcp/page-2026-05-04T04-04-40-145Z.yml
Removing .playwright-mcp/page-2026-05-04T04-04-57-257Z.yml
Removing .playwright-mcp/page-2026-05-04T04-05-07-353Z.yml
Removing .playwright-mcp/page-2026-05-04T04-05-19-089Z.yml
Removing .playwright-mcp/page-2026-05-04T04-05-52-031Z.yml
Removing .playwright-mcp/page-2026-05-04T04-06-11-261Z.yml
Removing .playwright-mcp/page-2026-05-04T04-06-25-525Z.yml
Removing .playwright-mcp/page-2026-05-04T04-06-38-270Z.yml


output:
Chunk ID: fe5621
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 180
Output:
Removing .playwright-mcp/console-2026-05-03T23-28-42-443Z.log
Removing .playwright-mcp/console-2026-05-04T03-37-18-830Z.log
Removing .playwright-mcp/console-2026-05-04T04-04-39-976Z.log
Removing .playwright-mcp/console-2026-05-04T04-05-07-157Z.log
Removing .playwright-mcp/page-2026-05-04T04-04-40-145Z.yml
Removing .playwright-mcp/page-2026-05-04T04-04-57-257Z.yml
Removing .playwright-mcp/page-2026-05-04T04-05-07-353Z.yml
Removing .playwright-mcp/page-2026-05-04T04-05-19-089Z.yml
Removing .playwright-mcp/page-2026-05-04T04-05-52-031Z.yml
Removing .playwright-mcp/page-2026-05-04T04-06-11-261Z.yml
Removing .playwright-mcp/page-2026-05-04T04-06-25-525Z.yml
Removing .playwright-mcp/page-2026-05-04T04-06-38-270Z.yml


command:
/bin/zsh
-lc
git status --short

type: unknown

cmd: git status --short

aggregated_output:
 M app/Models/Store.php
 M app/Providers/AppServiceProvider.php
 M database/seeders/DatabaseSeeder.php
 M resources/views/layouts/app/sidebar.blade.php
 M routes/web.php
 M specs/progress.md
?? app/Enums/AppInstallationStatus.php
?? app/Enums/AppStatus.php
?? app/Enums/WebhookDeliveryStatus.php
?? app/Enums/WebhookEventType.php
?? app/Enums/WebhookSubscriptionStatus.php
?? app/Jobs/DeliverWebhook.php
?? app/Listeners/
?? app/Livewire/Admin/Apps/
?? app/Livewire/Admin/Developers/
?? app/Models/App.php
?? app/Models/AppInstallation.php
?? app/Models/OauthClient.php
?? app/Models/OauthToken.php
?? app/Models/WebhookDelivery.php
?? app/Models/WebhookSubscription.php
?? app/Services/WebhookService.php
?? database/factories/AppFactory.php
?? database/factories/AppInstallationFactory.php
?? database/factories/OauthClientFactory.php
?? database/factories/OauthTokenFactory.php
?? database/factories/WebhookDeliveryFactory.php
?? database/factories/WebhookSubscriptionFactory.php
?? database/migrations/2026_05_04_034556_create_apps_table.php
?? database/migrations/2026_05_04_034601_create_app_installations_table.php
?? database/migrations/2026_05_04_034606_create_oauth_clients_table.php
?? database/migrations/2026_05_04_034611_create_oauth_tokens_table.php
?? database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php
?? database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php
?? database/seeders/AppSeeder.php
?? resources/views/livewire/admin/apps/
?? resources/views/livewire/admin/developers/
?? tests/Feature/Admin/AppsDevelopersTest.php
?? tests/Feature/Webhooks/

status: completed


output:
Chunk ID: d28ffe
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 404
Output:
 M app/Models/Store.php
 M app/Providers/AppServiceProvider.php
 M database/seeders/DatabaseSeeder.php
 M resources/views/layouts/app/sidebar.blade.php
 M routes/web.php
 M specs/progress.md
?? app/Enums/AppInstallationStatus.php
?? app/Enums/AppStatus.php
?? app/Enums/WebhookDeliveryStatus.php
?? app/Enums/WebhookEventType.php
?? app/Enums/WebhookSubscriptionStatus.php
?? app/Jobs/DeliverWebhook.php
?? app/Listeners/
?? app/Livewire/Admin/Apps/
?? app/Livewire/Admin/Developers/
?? app/Models/App.php
?? app/Models/AppInstallation.php
?? app/Models/OauthClient.php
?? app/Models/OauthToken.php
?? app/Models/WebhookDelivery.php
?? app/Models/WebhookSubscription.php
?? app/Services/WebhookService.php
?? database/factories/AppFactory.php
?? database/factories/AppInstallationFactory.php
?? database/factories/OauthClientFactory.php
?? database/factories/OauthTokenFactory.php
?? database/factories/WebhookDeliveryFactory.php
?? database/factories/WebhookSubscriptionFactory.php
?? database/migrations/2026_05_04_034556_create_apps_table.php
?? database/migrations/2026_05_04_034601_create_app_installations_table.php
?? database/migrations/2026_05_04_034606_create_oauth_clients_table.php
?? database/migrations/2026_05_04_034611_create_oauth_tokens_table.php
?? database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php
?? database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php
?? database/seeders/AppSeeder.php
?? resources/views/livewire/admin/apps/
?? resources/views/livewire/admin/developers/
?? tests/Feature/Admin/AppsDevelopersTest.php
?? tests/Feature/Webhooks/


query: SELECT (SELECT COUNT(*) FROM apps) AS apps_count, (SELECT COUNT(*) FROM app_installations) AS app_installations_count, (SELECT COUNT(*) FROM oauth_clients) AS oauth_clients_count, (SELECT COUNT(*) FROM oauth_tokens) AS oauth_tokens_count, (SELECT COUNT(*) FROM webhook_subscriptions) AS webhook_subscriptions_count, (SELECT COUNT(*) FROM webhook_deliveries) AS webhook_deliveries_count, (SELECT COUNT(*) FROM jobs) AS queued_jobs_count


command:
/bin/zsh
-lc
git diff --check

cmd: git diff --check


output:
Chunk ID: b7614d
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


server: laravel-boost

tool: database-query

query: SELECT (SELECT COUNT(*) FROM apps) AS apps_count, (SELECT COUNT(*) FROM app_installations) AS app_installations_count, (SELECT COUNT(*) FROM oauth_clients) AS oauth_clients_count, (SELECT COUNT(*) FROM oauth_tokens) AS oauth_tokens_count, (SELECT COUNT(*) FROM webhook_subscriptions) AS webhook_subscriptions_count, (SELECT COUNT(*) FROM webhook_deliveries) AS webhook_deliveries_count, (SELECT COUNT(*) FROM jobs) AS queued_jobs_count

type: text


output:
Wall time: 0.3286 seconds
Output:
[{"type":"text","text":"[{\"apps_count\":2,\"app_installations_count\":4,\"oauth_clients_count\":4,\"oauth_tokens_count\":4,\"webhook_subscriptions_count\":8,\"webhook_deliveries_count\":0,\"queued_jobs_count\":0}]"}]


message: The working DB is back to clean seeded fixtures, with app/webhook counts as expected and no queued delivery jobs. I’m doing a final diff check, then I’ll commit the apps/webhooks slice.

phase: commentary


type: message

role: assistant

text: The working DB is back to clean seeded fixtures, with app/webhook counts as expected and no queued delivery jobs. I’m doing a final diff check, then I’ll commit the apps/webhooks slice.


command:
/bin/zsh
-lc
git diff --stat

cmd: git diff --stat

aggregated_output:
 app/Models/Store.php                          | 16 ++++++++++
 app/Providers/AppServiceProvider.php          | 33 ++++++++++++++++++++
 database/seeders/DatabaseSeeder.php           |  1 +
 resources/views/layouts/app/sidebar.blade.php |  8 +++++
 routes/web.php                                |  6 ++++
 specs/progress.md                             | 43 ++++++++++++++++++---------
 6 files changed, 93 insertions(+), 14 deletions(-)


output:
Chunk ID: c5abac
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 110
Output:
 app/Models/Store.php                          | 16 ++++++++++
 app/Providers/AppServiceProvider.php          | 33 ++++++++++++++++++++
 database/seeders/DatabaseSeeder.php           |  1 +
 resources/views/layouts/app/sidebar.blade.php |  8 +++++
 routes/web.php                                |  6 ++++
 specs/progress.md                             | 43 ++++++++++++++++++---------
 6 files changed, 93 insertions(+), 14 deletions(-)


cmd: git add app/Enums/AppInstallationStatus.php app/Enums/AppStatus.php app/Enums/WebhookDeliveryStatus.php app/Enums/WebhookEventType.php app/Enums/WebhookSubscriptionStatus.php app/Jobs/DeliverWebhook.php app/Listeners app/Livewire/Admin/Apps app/Livewire/Admin/Developers app/Models/App.php app/Models/AppInstallation.php app/Models/OauthClient.php app/Models/OauthToken.php app/Models/Store.php app/Models/WebhookDelivery.php app/Models/WebhookSubscription.php app/Providers/AppServiceProvider.php app/Services/WebhookService.php database/factories/AppFactory.php database/factories/AppInstallationFactory.php database/factories/OauthClientFactory.php database/factories/OauthTokenFactory.php database/factories/WebhookDeliveryFactory.php database/factories/WebhookSubscriptionFactory.php database/migrations/2026_05_04_034556_create_apps_table.php database/migrations/2026_05_04_034601_create_app_installations_table.php database/migrations/2026_05_04_034606_create_oauth_clients_table.php database/migrations/2026_05_04_034611_create_oauth_tokens_table.php database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php database/seeders/AppSeeder.php database/seeders/DatabaseSeeder.php resources/views/layouts/app/sidebar.blade.php resources/views/livewire/admin/apps resources/views/livewire/admin/developers routes/web.php specs/progress.md tests/Feature/Admin/AppsDevelopersTest.php tests/Feature/Webhooks


command: git add app/Enums/AppInstallationStatus.php app/Enums/AppStatus.php app/Enums/WebhookDeliveryStatus.php app/Enums/WebhookEventType.php app/Enums/WebhookSubscriptionStatus.php app/Jobs/DeliverWebhook.php app/Listeners app/Livewire/Admin/Apps app/Livewire/Admin/Developers app/Models/App.php app/Models/AppInstallation.php app/Models/OauthClient.php app/Models/OauthToken.php app/Models/Store.php app/Models/WebhookDelivery.php app/Models/WebhookSubscription.php app/Providers/AppServiceProvider.php app/Services/WebhookService.php database/factories/AppFactory.php database/factories/AppInstallationFactory.php database/factories/OauthClientFactory.php database/factories/OauthTokenFactory.php database/factories/WebhookDeliveryFactory.php database/factories/WebhookSubscriptionFactory.php database/migrations/2026_05_04_034556_create_apps_table.php database/migrations/2026_05_04_034601_create_app_installations_table.php database/migrations/2026_05_04_034606_create_oauth_clients_table.php database/migrations/2026_05_04_034611_create_oauth_tokens_table.php database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php database/seeders/AppSeeder.php database/seeders/DatabaseSeeder.php resources/views/layouts/app/sidebar.blade.php resources/views/livewire/admin/apps resources/views/livewire/admin/developers routes/web.php specs/progress.md tests/Feature/Admin/AppsDevelopersTest.php tests/Feature/Webhooks


output:
Chunk ID: 2b44ae
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


aggregated_output:
A  app/Enums/AppInstallationStatus.php
A  app/Enums/AppStatus.php
A  app/Enums/WebhookDeliveryStatus.php
A  app/Enums/WebhookEventType.php
A  app/Enums/WebhookSubscriptionStatus.php
A  app/Jobs/DeliverWebhook.php
A  app/Listeners/DispatchWebhooks.php
A  app/Livewire/Admin/Apps/Index.php
A  app/Livewire/Admin/Apps/Show.php
A  app/Livewire/Admin/Developers/Index.php
A  app/Models/App.php
A  app/Models/AppInstallation.php
A  app/Models/OauthClient.php
A  app/Models/OauthToken.php
M  app/Models/Store.php
A  app/Models/WebhookDelivery.php
A  app/Models/WebhookSubscription.php
M  app/Providers/AppServiceProvider.php
A  app/Services/WebhookService.php
A  database/factories/AppFactory.php
A  database/factories/AppInstallationFactory.php
A  database/factories/OauthClientFactory.php
A  database/factories/OauthTokenFactory.php
A  database/factories/WebhookDeliveryFactory.php
A  database/factories/WebhookSubscriptionFactory.php
A  database/migrations/2026_05_04_034556_create_apps_table.php
A  database/migrations/2026_05_04_034601_create_app_installations_table.php
A  database/migrations/2026_05_04_034606_create_oauth_clients_table.php
A  database/migrations/2026_05_04_034611_create_oauth_tokens_table.php
A  database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php
A  database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php
A  database/seeders/AppSeeder.php
M  database/seeders/DatabaseSeeder.php
M  resources/views/layouts/app/sidebar.blade.php
A  resources/views/livewire/admin/apps/index.blade.php
A  resources/views/livewire/admin/apps/show.blade.php
A  resources/views/livewire/admin/developers/index.blade.php
M  routes/web.php
M  specs/progress.md
A  tests/Feature/Admin/AppsDevelopersTest.php
A  tests/Feature/Webhooks/WebhookDeliveryTest.php
A  tests/Feature/Webhooks/WebhookSignatureTest.php


command:
/bin/zsh
-lc
git diff --cached --check

cmd: git diff --cached --check


command:
/bin/zsh
-lc
git diff --cached --stat

cmd: git diff --cached --stat

aggregated_output:
 app/Enums/AppInstallationStatus.php                |  28 +++
 app/Enums/AppStatus.php                            |  17 ++
 app/Enums/WebhookDeliveryStatus.php                |  28 +++
 app/Enums/WebhookEventType.php                     |  58 ++++++
 app/Enums/WebhookSubscriptionStatus.php            |  28 +++
 app/Jobs/DeliverWebhook.php                        |  91 +++++++++
 app/Listeners/DispatchWebhooks.php                 | 128 +++++++++++++
 app/Livewire/Admin/Apps/Index.php                  |  76 ++++++++
 app/Livewire/Admin/Apps/Show.php                   |  81 ++++++++
 app/Livewire/Admin/Developers/Index.php            | 207 +++++++++++++++++++++
 app/Models/App.php                                 |  59 ++++++
 app/Models/AppInstallation.php                     |  81 ++++++++
 app/Models/OauthClient.php                         |  51 +++++
 app/Models/OauthToken.php                          |  62 ++++++
 app/Models/Store.php                               |  16 ++
 app/Models/WebhookDelivery.php                     |  56 ++++++
 app/Models/WebhookSubscription.php                 |  74 ++++++++
 app/Providers/AppServiceProvider.php               |  33 ++++
 app/Services/WebhookService.php                    | 167 +++++++++++++++++
 database/factories/AppFactory.php                  |  26 +++
 database/factories/AppInstallationFactory.php      |  30 +++
 database/factories/OauthClientFactory.php          |  28 +++
 database/factories/OauthTokenFactory.php           |  34 ++++
 database/factories/WebhookDeliveryFactory.php      |  32 ++++
 database/factories/WebhookSubscriptionFactory.php  |  32 ++++
 .../2026_05_04_034556_create_apps_table.php        |  31 +++
 ...05_04_034601_create_app_installations_table.php |  35 ++++
 ...026_05_04_034606_create_oauth_clients_table.php |  32 ++++
 ...2026_05_04_034611_create_oauth_tokens_table.php |  37 ++++
 ...4_034616_create_webhook_subscriptions_table.php |  36 ++++
 ...5_04_034621_create_webhook_deliveries_table.php |  38 ++++
 database/seeders/AppSeeder.php                     | 106 +++++++++++
 database/seeders/DatabaseSeeder.php                |   1 +
 resources/views/layouts/app/sidebar.blade.php      |   8 +
 .../views/livewire/admin/apps/index.blade.php      |  64 +++++++
 resources/views/livewire/admin/apps/show.blade.php |  99 ++++++++++
 .../livewire/admin/developers/index.blade.php      | 159 ++++++++++++++++
 routes/web.php                                     |   6 +
 specs/progress.md                                  |  43 +++--
 tests/Feature/Admin/AppsDevelopersTest.php         |  88 +++++++++
 tests/Feature/Webhooks/WebhookDeliveryTest.php     | 124 ++++++++++++
 tests/Feature/Webhooks/WebhookSignatureTest.php    |  23 +++
 42 files changed, 2439 insertions(+), 14 deletions(-)


output:
Chunk ID: 0a8290
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 462
Output:
A  app/Enums/AppInstallationStatus.php
A  app/Enums/AppStatus.php
A  app/Enums/WebhookDeliveryStatus.php
A  app/Enums/WebhookEventType.php
A  app/Enums/WebhookSubscriptionStatus.php
A  app/Jobs/DeliverWebhook.php
A  app/Listeners/DispatchWebhooks.php
A  app/Livewire/Admin/Apps/Index.php
A  app/Livewire/Admin/Apps/Show.php
A  app/Livewire/Admin/Developers/Index.php
A  app/Models/App.php
A  app/Models/AppInstallation.php
A  app/Models/OauthClient.php
A  app/Models/OauthToken.php
M  app/Models/Store.php
A  app/Models/WebhookDelivery.php
A  app/Models/WebhookSubscription.php
M  app/Providers/AppServiceProvider.php
A  app/Services/WebhookService.php
A  database/factories/AppFactory.php
A  database/factories/AppInstallationFactory.php
A  database/factories/OauthClientFactory.php
A  database/factories/OauthTokenFactory.php
A  database/factories/WebhookDeliveryFactory.php
A  database/factories/WebhookSubscriptionFactory.php
A  database/migrations/2026_05_04_034556_create_apps_table.php
A  database/migrations/2026_05_04_034601_create_app_installations_table.php
A  database/migrations/2026_05_04_034606_create_oauth_clients_table.php
A  database/migrations/2026_05_04_034611_create_oauth_tokens_table.php
A  database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php
A  database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php
A  database/seeders/AppSeeder.php
M  database/seeders/DatabaseSeeder.php
M  resources/views/layouts/app/sidebar.blade.php
A  resources/views/livewire/admin/apps/index.blade.php
A  resources/views/livewire/admin/apps/show.blade.php
A  resources/views/livewire/admin/developers/index.blade.php
M  routes/web.php
M  specs/progress.md
A  tests/Feature/Admin/AppsDevelopersTest.php
A  tests/Feature/Webhooks/WebhookDeliveryTest.php
A  tests/Feature/Webhooks/WebhookSignatureTest.php


output:
Chunk ID: 9a33f0
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 698
Output:
 app/Enums/AppInstallationStatus.php                |  28 +++
 app/Enums/AppStatus.php                            |  17 ++
 app/Enums/WebhookDeliveryStatus.php                |  28 +++
 app/Enums/WebhookEventType.php                     |  58 ++++++
 app/Enums/WebhookSubscriptionStatus.php            |  28 +++
 app/Jobs/DeliverWebhook.php                        |  91 +++++++++
 app/Listeners/DispatchWebhooks.php                 | 128 +++++++++++++
 app/Livewire/Admin/Apps/Index.php                  |  76 ++++++++
 app/Livewire/Admin/Apps/Show.php                   |  81 ++++++++
 app/Livewire/Admin/Developers/Index.php            | 207 +++++++++++++++++++++
 app/Models/App.php                                 |  59 ++++++
 app/Models/AppInstallation.php                     |  81 ++++++++
 app/Models/OauthClient.php                         |  51 +++++
 app/Models/OauthToken.php                          |  62 ++++++
 app/Models/Store.php                               |  16 ++
 app/Models/WebhookDelivery.php                     |  56 ++++++
 app/Models/WebhookSubscription.php                 |  74 ++++++++
 app/Providers/AppServiceProvider.php               |  33 ++++
 app/Services/WebhookService.php                    | 167 +++++++++++++++++
 database/factories/AppFactory.php                  |  26 +++
 database/factories/AppInstallationFactory.php      |  30 +++
 database/factories/OauthClientFactory.php          |  28 +++
 database/factories/OauthTokenFactory.php           |  34 ++++
 database/factories/WebhookDeliveryFactory.php      |  32 ++++
 database/factories/WebhookSubscriptionFactory.php  |  32 ++++
 .../2026_05_04_034556_create_apps_table.php        |  31 +++
 ...05_04_034601_create_app_installations_table.php |  35 ++++
 ...026_05_04_034606_create_oauth_clients_table.php |  32 ++++
 ...2026_05_04_034611_create_oauth_tokens_table.php |  37 ++++
 ...4_034616_create_webhook_subscriptions_table.php |  36 ++++
 ...5_04_034621_create_webhook_deliveries_table.php |  38 ++++
 database/seeders/AppSeeder.php                     | 106 +++++++++++
 database/seeders/DatabaseSeeder.php                |   1 +
 resources/views/layouts/app/sidebar.blade.php      |   8 +
 .../views/livewire/admin/apps/index.blade.php      |  64 +++++++
 resources/views/livewire/admin/apps/show.blade.php |  99 ++++++++++
 .../livewire/admin/developers/index.blade.php      | 159 ++++++++++++++++
 routes/web.php                                     |   6 +
 specs/progress.md                                  |  43 +++--
 tests/Feature/Admin/AppsDevelopersTest.php         |  88 +++++++++
 tests/Feature/Webhooks/WebhookDeliveryTest.php     | 124 ++++++++++++
 tests/Feature/Webhooks/WebhookSignatureTest.php    |  23 +++
 42 files changed, 2439 insertions(+), 14 deletions(-)


output:
Chunk ID: 434e51
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


cmd: git commit -m "Add apps and webhook management"


command: git commit -m "Add apps and webhook management"

aggregated_output:
[2026-05-04-codex-5-5-goal 05cffb0d] Add apps and webhook management
 42 files changed, 2439 insertions(+), 14 deletions(-)
 create mode 100644 app/Enums/AppInstallationStatus.php
 create mode 100644 app/Enums/AppStatus.php
 create mode 100644 app/Enums/WebhookDeliveryStatus.php
 create mode 100644 app/Enums/WebhookEventType.php
 create mode 100644 app/Enums/WebhookSubscriptionStatus.php
 create mode 100644 app/Jobs/DeliverWebhook.php
 create mode 100644 app/Listeners/DispatchWebhooks.php
 create mode 100644 app/Livewire/Admin/Apps/Index.php
 create mode 100644 app/Livewire/Admin/Apps/Show.php
 create mode 100644 app/Livewire/Admin/Developers/Index.php
 create mode 100644 app/Models/App.php
 create mode 100644 app/Models/AppInstallation.php
 create mode 100644 app/Models/OauthClient.php
 create mode 100644 app/Models/OauthToken.php
 create mode 100644 app/Models/WebhookDelivery.php
 create mode 100644 app/Models/WebhookSubscription.php
 create mode 100644 app/Services/WebhookService.php
 create mode 100644 database/factories/AppFactory.php
 create mode 100644 database/factories/AppInstallationFactory.php
 create mode 100644 database/factories/OauthClientFactory.php
 create mode 100644 database/factories/OauthTokenFactory.php
 create mode 100644 database/factories/WebhookDeliveryFactory.php
 create mode 100644 database/factories/WebhookSubscriptionFactory.php
 create mode 100644 database/migrations/2026_05_04_034556_create_apps_table.php
 create mode 100644 database/migrations/2026_05_04_034601_create_app_installations_table.php
 create mode 100644 database/migrations/2026_05_04_034606_create_oauth_clients_table.php
 create mode 100644 database/migrations/2026_05_04_034611_create_oauth_tokens_table.php
 create mode 100644 database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php
 create mode 100644 database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php
 create mode 100644 database/seeders/AppSeeder.php
 create mode 100644 resources/views/livewire/admin/apps/index.blade.php
 create mode 100644 resources/views/livewire/admin/apps/show.blade.php
 create mode 100644 resources/views/livewire/admin/developers/index.blade.php
 create mode 100644 tests/Feature/Admin/AppsDevelopersTest.php
 create mode 100644 tests/Feature/Webhooks/WebhookDeliveryTest.php
 create mode 100644 tests/Feature/Webhooks/WebhookSignatureTest.php


output:
Chunk ID: c8198e
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 598
Output:
[2026-05-04-codex-5-5-goal 05cffb0d] Add apps and webhook management
 42 files changed, 2439 insertions(+), 14 deletions(-)
 create mode 100644 app/Enums/AppInstallationStatus.php
 create mode 100644 app/Enums/AppStatus.php
 create mode 100644 app/Enums/WebhookDeliveryStatus.php
 create mode 100644 app/Enums/WebhookEventType.php
 create mode 100644 app/Enums/WebhookSubscriptionStatus.php
 create mode 100644 app/Jobs/DeliverWebhook.php
 create mode 100644 app/Listeners/DispatchWebhooks.php
 create mode 100644 app/Livewire/Admin/Apps/Index.php
 create mode 100644 app/Livewire/Admin/Apps/Show.php
 create mode 100644 app/Livewire/Admin/Developers/Index.php
 create mode 100644 app/Models/App.php
 create mode 100644 app/Models/AppInstallation.php
 create mode 100644 app/Models/OauthClient.php
 create mode 100644 app/Models/OauthToken.php
 create mode 100644 app/Models/WebhookDelivery.php
 create mode 100644 app/Models/WebhookSubscription.php
 create mode 100644 app/Services/WebhookService.php
 create mode 100644 database/factories/AppFactory.php
 create mode 100644 database/factories/AppInstallationFactory.php
 create mode 100644 database/factories/OauthClientFactory.php
 create mode 100644 database/factories/OauthTokenFactory.php
 create mode 100644 database/factories/WebhookDeliveryFactory.php
 create mode 100644 database/factories/WebhookSubscriptionFactory.php
 create mode 100644 database/migrations/2026_05_04_034556_create_apps_table.php
 create mode 100644 database/migrations/2026_05_04_034601_create_app_installations_table.php
 create mode 100644 database/migrations/2026_05_04_034606_create_oauth_clients_table.php
 create mode 100644 database/migrations/2026_05_04_034611_create_oauth_tokens_table.php
 create mode 100644 database/migrations/2026_05_04_034616_create_webhook_subscriptions_table.php
 create mode 100644 database/migrations/2026_05_04_034621_create_webhook_deliveries_table.php
 create mode 100644 database/seeders/AppSeeder.php
 create mode 100644 resources/views/livewire/admin/apps/index.blade.php
 create mode 100644 resources/views/livewire/admin/apps/show.blade.php
 create mode 100644 resources/views/livewire/admin/developers/index.blade.php
 create mode 100644 tests/Feature/Admin/AppsDevelopersTest.php
 create mode 100644 tests/Feature/Webhooks/WebhookDeliveryTest.php
 create mode 100644 tests/Feature/Webhooks/WebhookSignatureTest.php


message: Apps/webhooks are committed as `05cffb0d`. I’m moving into the final audit gaps now; the highest-impact remaining spec gap is password reset/token auth, with customer/store scoping first because it affects actual account recovery paths.


text: Apps/webhooks are committed as `05cffb0d`. I’m moving into the final audit gaps now; the highest-impact remaining spec gap is password reset/token auth, with customer/store scoping first because it affects actual account recovery paths.


output:
Chunk ID: 49bce0
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


message: I’m activating the Fortify/auth, Laravel, Livewire/Flux, Tailwind, and Pest guidance for this next slice, then I’ll read the auth spec and existing password-reset code/tests before changing anything.


text: I’m activating the Fortify/auth, Laravel, Livewire/Flux, Tailwind, and Pest guidance for this next slice, then I’ll read the auth spec and existing password-reset code/tests before changing anything.


cmd: sed -n '1,220p' /Users/fabianwesner/Herd/shop/.agents/skills/developing-with-fortify/SKILL.md


packages: laravel/fortify laravel/framework livewire/livewire livewire/flux pestphp/pest

queries: password reset broker reset link Fortify actions

queries: password reset tokens custom broker provider


cmd: rg -n "password reset|forgot password|reset-password|customer_password_reset|PasswordReset|password_reset|broker|ResetPassword|forgot" specs app config routes resources tests database


cmd: sed -n '120,210p' specs/06-AUTH-AND-SECURITY.md


cmd: sed -n '1,220p' tests/Feature/Auth/PasswordResetTest.php


command: sed -n '1,220p' /Users/fabianwesner/Herd/shop/.agents/skills/developing-with-fortify/SKILL.md

SKILL.md

type: read

aggregated_output:
---
name: developing-with-fortify
description: Laravel Fortify headless authentication backend development. Activate when implementing authentication features including login, registration, password reset, email verification, two-factor authentication (2FA/TOTP), profile updates, headless auth, authentication scaffolding, or auth guards in Laravel applications.
---

# Laravel Fortify Development

Fortify is a headless authentication backend that provides authentication routes and controllers for Laravel applications.

## Documentation

Use `search-docs` for detailed Laravel Fortify patterns and documentation.

## Usage

- **Routes**: Use `list-routes` with `only_vendor: true` and `action: "Fortify"` to see all registered endpoints
- **Actions**: Check `app/Actions/Fortify/` for customizable business logic (user creation, password validation, etc.)
- **Config**: See `config/fortify.php` for all options including features, guards, rate limiters, and username field
- **Contracts**: Look in `Laravel\Fortify\Contracts\` for overridable response classes (`LoginResponse`, `LogoutResponse`, etc.)
- **Views**: All view callbacks are set in `FortifyServiceProvider::boot()` using `Fortify::loginView()`, `Fortify::registerView()`, etc.

## Available Features

Enable in `config/fortify.php` features array:

- `Features::registration()` - User registration
- `Features::resetPasswords()` - Password reset via email
- `Features::emailVerification()` - Requires User to implement `MustVerifyEmail`
- `Features::updateProfileInformation()` - Profile updates
- `Features::updatePasswords()` - Password changes
- `Features::twoFactorAuthentication()` - 2FA with QR codes and recovery codes

> Use `search-docs` for feature configuration options and customization patterns.

## Setup Workflows

### Two-Factor Authentication Setup

```
- [ ] Add TwoFactorAuthenticatable trait to User model
- [ ] Enable feature in config/fortify.php
- [ ] Run migrations for 2FA columns
- [ ] Set up view callbacks in FortifyServiceProvider
- [ ] Create 2FA management UI
- [ ] Test QR code and recovery codes
```

> Use `search-docs` for TOTP implementation and recovery code handling patterns.

### Email Verification Setup

```
- [ ] Enable emailVerification feature in config
- [ ] Implement MustVerifyEmail interface on User model
- [ ] Set up verifyEmailView callback
- [ ] Add verified middleware to protected routes
- [ ] Test verification email flow
```

> Use `search-docs` for MustVerifyEmail implementation patterns.

### Password Reset Setup

```
- [ ] Enable resetPasswords feature in config
- [ ] Set up requestPasswordResetLinkView callback
- [ ] Set up resetPasswordView callback
- [ ] Define password.reset named route (if views disabled)
- [ ] Test reset email and link flow
```

> Use `search-docs` for custom password reset flow patterns.

### SPA Authentication Setup

```
- [ ] Set 'views' => false in config/fortify.php
- [ ] Install and configure Laravel Sanctum
- [ ] Use 'web' guard in fortify config
- [ ] Set up CSRF token handling
- [ ] Test XHR authentication flows
```

> Use `search-docs` for integration and SPA authentication patterns.

## Best Practices

### Custom Authentication Logic

Override authentication behavior using `Fortify::authenticateUsing()` for custom user retrieval or `Fortify::authenticateThrough()` to customize the authentication pipeline. Override response contracts in `AppServiceProvider` for custom redirects.

### Registration Customization

Modify `app/Actions/Fortify/CreateNewUser.php` to customize user creation logic, validation rules, and additional fields.

### Rate Limiting

Configure via `fortify.limiters.login` in config. Default configuration throttles by username + IP combination.

## Key Endpoints

| Feature                | Method   | Endpoint                                    |
|------------------------|----------|---------------------------------------------|
| Login                  | POST     | `/login`                                    |
| Logout                 | POST     | `/logout`                                   |
| Register               | POST     | `/register`                                 |
| Password Reset Request | POST     | `/forgot-password`                          |
| Password Reset         | POST     | `/reset-password`                           |
| Email Verify Notice    | GET      | `/email/verify`                             |
| Resend Verification    | POST     | `/email/verification-notification`          |
| Password Confirm       | POST     | `/user/confirm-password`                    |
| Enable 2FA             | POST     | `/user/two-factor-authentication`           |
| Confirm 2FA            | POST     | `/user/confirmed-two-factor-authentication` |
| 2FA Challenge          | POST     | `/two-factor-challenge`                     |
| Get QR Code            | GET      | `/user/two-factor-qr-code`                  |
| Recovery Codes         | GET/POST | `/user/two-factor-recovery-codes`           |


output:
Chunk ID: c2ff3a
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 1256
Output:
---
name: developing-with-fortify
description: Laravel Fortify headless authentication backend development. Activate when implementing authentication features including login, registration, password reset, email verification, two-factor authentication (2FA/TOTP), profile updates, headless auth, authentication scaffolding, or auth guards in Laravel applications.
---

# Laravel Fortify Development

Fortify is a headless authentication backend that provides authentication routes and controllers for Laravel applications.

## Documentation

Use `search-docs` for detailed Laravel Fortify patterns and documentation.

## Usage

- **Routes**: Use `list-routes` with `only_vendor: true` and `action: "Fortify"` to see all registered endpoints
- **Actions**: Check `app/Actions/Fortify/` for customizable business logic (user creation, password validation, etc.)
- **Config**: See `config/fortify.php` for all options including features, guards, rate limiters, and username field
- **Contracts**: Look in `Laravel\Fortify\Contracts\` for overridable response classes (`LoginResponse`, `LogoutResponse`, etc.)
- **Views**: All view callbacks are set in `FortifyServiceProvider::boot()` using `Fortify::loginView()`, `Fortify::registerView()`, etc.

## Available Features

Enable in `config/fortify.php` features array:

- `Features::registration()` - User registration
- `Features::resetPasswords()` - Password reset via email
- `Features::emailVerification()` - Requires User to implement `MustVerifyEmail`
- `Features::updateProfileInformation()` - Profile updates
- `Features::updatePasswords()` - Password changes
- `Features::twoFactorAuthentication()` - 2FA with QR codes and recovery codes

> Use `search-docs` for feature configuration options and customization patterns.

## Setup Workflows

### Two-Factor Authentication Setup

```
- [ ] Add TwoFactorAuthenticatable trait to User model
- [ ] Enable feature in config/fortify.php
- [ ] Run migrations for 2FA columns
- [ ] Set up view callbacks in FortifyServiceProvider
- [ ] Create 2FA management UI
- [ ] Test QR code and recovery codes
```

> Use `search-docs` for TOTP implementation and recovery code handling patterns.

### Email Verification Setup

```
- [ ] Enable emailVerification feature in config
- [ ] Implement MustVerifyEmail interface on User model
- [ ] Set up verifyEmailView callback
- [ ] Add verified middleware to protected routes
- [ ] Test verification email flow
```

> Use `search-docs` for MustVerifyEmail implementation patterns.

### Password Reset Setup

```
- [ ] Enable resetPasswords feature in config
- [ ] Set up requestPasswordResetLinkView callback
- [ ] Set up resetPasswordView callback
- [ ] Define password.reset named route (if views disabled)
- [ ] Test reset email and link flow
```

> Use `search-docs` for custom password reset flow patterns.

### SPA Authentication Setup

```
- [ ] Set 'views' => false in config/fortify.php
- [ ] Install and configure Laravel Sanctum
- [ ] Use 'web' guard in fortify config
- [ ] Set up CSRF token handling
- [ ] Test XHR authentication flows
```

> Use `search-docs` for integration and SPA authentication patterns.

## Best Practices

### Custom Authentication Logic

Override authentication behavior using `Fortify::authenticateUsing()` for custom user retrieval or `Fortify::authenticateThrough()` to customize the authentication pipeline. Override response contracts in `AppServiceProvider` for custom redirects.

### Registration Customization

Modify `app/Actions/Fortify/CreateNewUser.php` to customize user creation logic, validation rules, and additional fields.

### Rate Limiting

Configure via `fortify.limiters.login` in config. Default configuration throttles by username + IP combination.

## Key Endpoints

| Feature                | Method   | Endpoint                                    |
|------------------------|----------|---------------------------------------------|
| Login                  | POST     | `/login`                                    |
| Logout                 | POST     | `/logout`                                   |
| Register               | POST     | `/register`                                 |
| Password Reset Request | POST     | `/forgot-password`                          |
| Password Reset         | POST     | `/reset-password`                           |
| Email Verify Notice    | GET      | `/email/verify`                             |
| Resend Verification    | POST     | `/email/verification-notification`          |
| Password Confirm       | POST     | `/user/confirm-password`                    |
| Enable 2FA             | POST     | `/user/two-factor-authentication`           |
| Confirm 2FA            | POST     | `/user/confirmed-two-factor-authentication` |
| 2FA Challenge          | POST     | `/two-factor-challenge`                     |
| Get QR Code            | GET      | `/user/two-factor-qr-code`                  |
| Recovery Codes         | GET/POST | `/user/two-factor-recovery-codes`           |


tool: search-docs

text:
# Search Results

## Passwords Routing Resetting the Password Handling the Form Submission
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

#### Handling the Form Submission

Of course, we need to define a route to actually handle the password reset form submission. This route will be responsible for validating the incoming request and updating the user's password in the database:

```php
use App\Models\User;
use Illuminate\Auth\Events\PasswordReset;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Str;

Route::post('/reset-password', function (Request $request) {
    $request->validate([
        'token' => 'required',
        'email' => 'required|email',
        'password' => 'required|min:8|confirmed',
    ]);

    $status = Password::reset(
        $request->only('email', 'password', 'password_confirmation', 'token'),
        function (User $user, string $password) {
            $user->forceFill([
                'password' => Hash::make($password)
            ])->setRememberToken(Str::random(60));

            $user->save();

            event(new PasswordReset($user));
        }
    );

    return $status === Password::PasswordReset
        ? redirect()->route('login')->with('status', __($status))
        : back()->withErrors(['email' => [__($status)]]);
})->middleware('guest')->name('password.update');
```

Before moving on, let's examine this route in more detail. First, the request's `token`, `email`, and `password` attributes are validated. Next, we will use Laravel's built-in "password broker" (via the `Password` facade) to validate the password reset request credentials.

If the token, email address, and password given to the password broker are valid, the closure passed to the `reset` method will be invoked. Within this closure, which receives the user instance and the plain-text password provided to the password reset form, we may update the user's password in the database.

The `reset` method returns a "status" slug. This status may be translated using Laravel's [localization](/docs/{{version}}/localization) helpers in order to display a user-friendly message to the user regarding the status of their request. The translation of the password reset status is determined by your application's `lang/{lang}/passwords.php` language file. An entry for each possible value of the status slug is located within the `passwords` language file. If your application does not contain a `lang` directory, you may create it using the `lang:publish` Artisan command.

Before moving on, you may be wondering how Laravel knows how to retrieve the user record from your application's database when calling the `Password` facade's `reset` method. The Laravel password broker utilizes your authentication system's "user providers" to retrieve database records. The user provider used by the password broker is configured within the `passwords` configuration array of your `config/auth.php` configuration file. To learn more about writing custom user providers, consult the [authentication documentation](/docs/{{version}}/authentication#adding-custom-user-providers).

---

## Passwords Routing Requesting the Password Reset Link
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

### Requesting the Password Reset Link

---

## Fortify Password Reset Resetting the Password
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

### Resetting the Password

To finish implementing our application's password reset functionality, we need to instruct Fortify how to return our "reset password" view.

All of Fortify's view rendering logic may be customized using the appropriate methods available via the `Laravel\Fortify\Fortify` class. Typically, you should call this method from the `boot` method of your application's `App\Providers\FortifyServiceProvider` class:

```php
use Laravel\Fortify\Fortify;
use Illuminate\Http\Request;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Fortify::resetPasswordView(function (Request $request) {
        return view('auth.reset-password', ['request' => $request]);
    });

    // ...
}
```

Fortify will take care of defining the route to display this view. Your `reset-password` template should include a form that makes a POST request to `/reset-password`.

The `/reset-password` endpoint expects a string `email` field, a `password` field, a `password_confirmation` field, and a hidden field named `token` that contains the value of `request()->route('token')`. The name of the "email" field / database column should match the `email` configuration value defined within your application's `fortify` configuration file.

---

## Fortify Password Confirmation
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

## Password Confirmation

While building your application, you may occasionally have actions that should require the user to confirm their password before the action is performed. Typically, these routes are protected by Laravel's built-in `password.confirm` middleware.

To begin implementing password confirmation functionality, we need to instruct Fortify how to return our application's "password confirmation" view. Remember, Fortify is a headless authentication library. If you would like a frontend implementation of Laravel's authentication features that are already completed for you, you should use an [application starter kit](/docs/{{version}}/starter-kits).

All of Fortify's view rendering logic may be customized using the appropriate methods available via the `Laravel\Fortify\Fortify` class. Typically, you should call this method from the `boot` method of your application's `App\Providers\FortifyServiceProvider` class:

```php
use Laravel\Fortify\Fortify;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Fortify::confirmPasswordView(function () {
        return view('auth.confirm-password');
    });

    // ...
}
```

Fortify will take care of defining the `/user/confirm-password` endpoint that returns this view. Your `confirm-password` template should include a form that makes a POST request to the `/user/confirm-password` endpoint. The `/user/confirm-password` endpoint expects a `password` field that contains the user's current password.

If the password matches the user's current password, Fortify will redirect the user to the route they were attempting to access. If the request was an XHR request, a 201 HTTP response will be returned.

If the request was not successful, the user will be redirected back to the confirm password screen and the validation errors will be available to you via the shared `$errors` Blade template variable. Or, in the case of an XHR request, the validation errors will be returned with a 422 HTTP response.

---

## Fortify Password Reset Customizing Password Resets
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

### Customizing Password Resets

The password reset process may be customized by modifying the `App\Actions\ResetUserPassword` action that was generated when you installed Laravel Fortify.

---

## Fortify Installation Disabling Views Disabling Views and Password Reset
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

#### Disabling Views and Password Reset

If you choose to disable Fortify's views and you will be implementing password reset features for your application, you should still define a route named `password.reset` that is responsible for displaying your application's "reset password" view. This is necessary because Laravel's `Illuminate\Auth\Notifications\ResetPassword` notification will generate the password reset URL via the `password.reset` named route.

---

## Passwords Routing Resetting the Password
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

### Resetting the Password

---

## Passwords Routing Resetting the Password The Password Reset Form
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

#### The Password Reset Form

Next, we will define the routes necessary to actually reset the password once the user clicks on the password reset link that has been emailed to them and provides a new password. First, let's define the route that will display the reset password form that is displayed when the user clicks the reset password link. This route will receive a `token` parameter that we will use later to verify the password reset request:

```php
Route::get('/reset-password/{token}', function (string $token) {
    return view('auth.reset-password', ['token' => $token]);
})->middleware('guest')->name('password.reset');
```

The view that is returned by this route should display a form containing an `email` field, a `password` field, a `password_confirmation` field, and a hidden `token` field, which should contain the value of the secret `$token` received by our route.

---

## Fortify Password Reset Resetting the Password
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

### Resetting the Password

To finish implementing our application's password reset functionality, we need to instruct Fortify how to return our "reset password" view.

All of Fortify's view rendering logic may be customized using the appropriate methods available via the `Laravel\Fortify\Fortify` class. Typically, you should call this method from the `boot` method of your application's `App\Providers\FortifyServiceProvider` class:

```php
use Laravel\Fortify\Fortify;
use Illuminate\Http\Request;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Fortify::resetPasswordView(function (Request $request) {
        return view('auth.reset-password', ['request' => $request]);
    });

    // ...
}
```

Fortify will take care of defining the route to display this view. Your `reset-password` template should include a form that makes a POST request to `/reset-password`.

The `/reset-password` endpoint expects a string `email` field, a `password` field, a `password_confirmation` field, and a hidden field named `token` that contains the value of `request()->route('token')`. The name of the "email" field / database column should match the `email` configuration value defined within your application's `fortify` configuration file.

---

## Passwords Routing Requesting the Password Reset Link Handling the Form Submission
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

#### Handling the Form Submission

Next, we will define a route that handles the form submission request from the "forgot password" view. This route will be responsible for validating the email address and sending the password reset request to the corresponding user:

```php
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Password;

Route::post('/forgot-password', function (Request $request) {
    $request->validate(['email' => 'required|email']);

    $status = Password::sendResetLink(
        $request->only('email')
    );

    return $status === Password::ResetLinkSent
        ? back()->with(['status' => __($status)])
        : back()->withErrors(['email' => __($status)]);
})->middleware('guest')->name('password.email');
```

Before moving on, let's examine this route in more detail. First, the request's `email` attribute is validated. Next, we will use Laravel's built-in "password broker" (via the `Password` facade) to send a password reset link to the user. The password broker will take care of retrieving the user by the given field (in this case, the email address) and sending the user a password reset link via Laravel's built-in [notification system](/docs/{{version}}/notifications).

The `sendResetLink` method returns a "status" slug. This status may be translated using Laravel's [localization](/docs/{{version}}/localization) helpers in order to display a user-friendly message to the user regarding the status of their request. The translation of the password reset status is determined by your application's `lang/{lang}/passwords.php` language file. An entry for each possible value of the status slug is located within the `passwords` language file.

> [!NOTE]
> By default, the Laravel application skeleton does not include the `lang` directory. If you would like to customize Laravel's language files, you may publish them via the `lang:publish` Artisan command.

You may be wondering how Laravel knows how to retrieve the user record from your application's database when calling the `Password` facade's `sendResetLink` method. The Laravel password broker utilizes your authentication system's "user providers" to retrieve database records. The user provider used by the password broker is configured within the `passwords` configuration array of your `config/auth.php` configuration file. To learn more about writing custom user providers, consult the [authentication documentation](/docs/{{version}}/authentication#adding-custom-user-providers).

> [!NOTE]
> When manually implementing password resets, you are required to define the contents of the views and routes yourself. If you would like scaffolding that includes all necessary authentication and verification logic, check out the [Laravel application starter kits](/docs/{{version}}/starter-kits).

---

## Fortify Installation Disabling Views Disabling Views and Password Reset
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

#### Disabling Views and Password Reset

If you choose to disable Fortify's views and you will be implementing password reset features for your application, you should still define a route named `password.reset` that is responsible for displaying your application's "reset password" view. This is necessary because Laravel's `Illuminate\Auth\Notifications\ResetPassword` notification will generate the password reset URL via the `password.reset` named route.

---

## Passwords
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

# Resetting Passwords

- [Introduction](#introduction)
    - [Configuration](#configuration)
    - [Driver Prerequisites](#driver-prerequisites)
    - [Model Preparation](#model-preparation)
    - [Configuring Trusted Hosts](#configuring-trusted-hosts)
- [Routing](#routing)
    - [Requesting the Password Reset Link](#requesting-the-password-reset-link)
    - [Resetting the Password](#resetting-the-password)
- [Deleting Expired Tokens](#deleting-expired-tokens)
- [Customization](#password-customization)

---

## Pest V4 Is Here Now With Browser Testing
Pest V4 Is Here Now With Browser Testing | pestphp/pest@4.x | Source: https://github.com/pestphp/docs/blob/4.x/pest-v4-is-here-now-with-browser-testing.md

---
title: Pest v4 Is Here — Now with Browser Testing
description: Today, we're thrilled to announce Pest v4 — our biggest release yet, featuring powerful new browser testing with parallel support and full Laravel integration.
---

> To get started with Pest v4's new features including browser testing, please refer to the upgrade guide: [Upgrade Guide →](/docs/upgrade-guide).

- [Browser Testing](#content-pest-v4-is-here-now-with-browser-testing)
- [Smoke Testing](#content-smoke-testing)
- [Visual Regression Testing](#content-visual-regression-testing)
- [Test Sharding](#content-test-sharding)
- [Type Coverage Is Much Faster](#content-type-coverage-is-much-faster)
- [Profanity Checking](#content-profanity-checking)
- [On Top of PHPUnit 12](#content-on-top-of-phpunit-12)

# Pest v4 Is Here — Now with Browser Testing

Today, we're thrilled to announce the release of **Pest v4**, bringing the biggest testing upgrade yet: powerful **[Browser Testing](/docs/browser-testing)**. Pest's new browser testing features let you run elegant, maintainable browser tests — with first-class support for Laravel's testing API and the ability to run tests in parallel. For the first time, this is browser testing that feels as good as writing unit tests.

Here is the creator of Pest, [Nuno Maduro](https://twitter.com/enunomaduro), demoing the new browser testing features in Pest v4 at Laracon US:

[![Pest v4](/assets/pest4_play.png)](https://youtu.be/f5gAgwwwwOI?si=LtPpySZe3tf8qMjz&t=52)

Here is an example of Browser Testing using [Laravel](https://laravel.com):

```php
it('may reset the password', function () {
    // access any laravel testing helpers...
    Notification::fake();

    // access to the database — using the RefreshDatabase trait (even sqlite in memory...)
    $this->actingAs(User::factory()->create());

    $page = visit('/sign-in') // visit on a real browser...
        ->on()->mobile() // or ->desktop(), ->tablet(), etc...
        ->inDarkMode(); // or ->inLightMode()

    $page->assertSee('Sign In')
         ->click('Forgot Password?')
         ->type('email', 'nuno@laravel.com')
         ->press('Send Reset Link')
         ->assertSee('We have emailed your password reset link!')
         ->assertNoJavascriptErrors(); // or ->assertNoConsoleLogs()

    Notification::assertSent(ResetPassword::class);
});
```

With Pest v4's browser testing, you can:
- Seamlessly use **Laravel features** like `Event::fake()`, `assertAuthenticated()`, and model factories
- Use `RefreshDatabase`, even with SQLite in-memory databases, to ensure a clean state for each test
- Test on **multiple browsers** (Chrome, Firefox, Safari)
- Test on **different devices** and viewports (like iPhone 14 Pro, tablets, or custom breakpoints)
- Switch **color schemes** (light/dark mode)
- Interact with the page (click, type, scroll, select, submit, drag-and-drop, touch gestures, etc.)
- Run **parallel browser tests** for dramatically faster suites
- Take **screenshots** or pause tests for debugging
- …all with the elegance of Pest syntax
- **Playwright-based** — modern, fast, and reliable

To get started with browser testing in Pest, you need to install the Pest Browser Plugin:

```bash
composer require pestphp/pest-plugin-browser --dev

npm install playwright@latest
npx playwright install
```

After, you may use the `visit()` function anywhere. Finally, running this test is as simple as executing `./vendor/bin/pest` in your terminal. Pest will handle the rest, launching a browser, navigating to the page, and performing the actions you specified.

## Smoke Testing

Smoke testing your application in real browsers has never been easier. With Pest v4, you can literally visit all your application pages, and ensure they don't throw any JavaScript errors, and they don't log any console errors.

```php
$routes = ['/', '/about', '/contact'];

visit($routes)->assertNoSmoke();

// assertNoSmoke() is a shorthand for:
// - assertNoJavascriptErrors()
// - assertNoConsoleLogs()
```

## Visual Regression Testing

Want to ensure your pages look exactly as expected over time? Pest v4 introduces visual regression testing with the `assertScreenshotMatches()` assertion. This allows you to take screenshots of your pages and compare them against baseline images, ensuring that your UI remains consistent across changes.

```php
$pages = visit(['/', '/about', '/contact']);

$pages->assertScreenshotMatches();
```

This is just a glimpse of what Browser Testing in Pest v4 can do. Find out more about the new features below, and check out the [Browser Testing documentation](/docs/browser-testing) for a complete guide on how to get started.

## Test Sharding

Pest v4 introduces **Test Sharding**, allowing you to split your test suite into smaller, manageable chunks. This is particularly useful for large applications (or when running browser tests) where running all tests at once can be time-consuming.

This feature is particularly useful on CI platforms, where on things like GitHub actions you can no longer scale vertical, but rather horizontally. This means you can run your tests in parallel across multiple machines, significantly speeding up your test suite execution.

To get started with Test Sharding, you can use the `--shard` option when running Pest:

```bash
# GitHub Workflow One
./vendor/bin/pest --shard=1/4

# GitHub Workflow Two
./vendor/bin/pest --shard=2/4

# GitHub Workflow Three
./vendor/bin/pest --shard=3/4

# GitHub Workflow Four
./vendor/bin/pest --shard=4/4
```

You may combine this with the `--parallel` option to run your tests in parallel, and this way trully maximize your test suite execution speed:

```bash
./vendor/bin/pest --shard=1/4 --parallel
```

Finally, to easily set up sharding your CI configuration, you just have to ensure each job in your CI configuration runs a different shard of your test suite. For example, in GitHub Actions, you can use the `matrix` strategy to define multiple jobs that run different shards:

```yaml
strategy:
  matrix:
    shard: [1, 2, 3, 4]

name: Tests (Shard ${{ matrix.shard }}/4)

steps:
  - name: Run tests
    run: pest --parallel --shard ${{ matrix.shard }}/4
```

## Type Coverage Is Much Faster

Remember the days when you had to wait for your type coverage to run? Not anymore! Pest v4 introduces a new type coverage engine that is significantly faster than previous versions.

Type coverage is 2x faster on the first run and instant on subsequent runs. This means you can quickly check your type coverage without waiting for long periods, making your development workflow much more efficient.

In addition, Type Coverage now supports **Sharding**. This means you can run type coverage with the `--shard` option, just like you do with your tests.

## Profanity Checking

Pest v4 introduces a new feature that allows you to check for profanity in your test code. This is particularly useful for maintaining a clean and professional codebase, especially in collaborative environments.

You can enable profanity checking by adding the `--profanity` option when running Pest:

```bash
./vendor/bin/pest --profanity
```

To start using Pest's Profanity plugin, you need to require the plugin via Composer.

```bash
composer require pestphp/pest-plugin-profanity --dev
```

After requiring the plugin, you may utilize the `--profanity` option to generate a report of your profanity.

```bash
./vendor/bin/pest --profanity
```

If any of your files contain profanity, they will be highlighted in red and displayed using their respective line
numbers and the profane word(s) that have been found.

As an example, `pr31(f*ck)` means that the word "fuck" was found on line 31.

To learn more about the Profanity plugin and how to configure it, check out the [Profanity documentation](/docs/profanity).

### Skip Locally or On CI

Pest v4 introduces the ability to conditionally skip tests based on the environment. You can use `skipLocally()` to skip tests when running locally, or `skipOnCi` to skip tests when running on a CI server.

```php
it('does not run locally', function () {
    // This test will be skipped when running locally
})->skipLocally();

it('does not run on CI', function () {
    // This test will be skipped when running on a CI server
})->skipOnCi();
```

### Miscellaneous Improvements

- You may now use `skipLocally()` or `skipOnCi` to conditionally skip tests based on the environment.
- The `not->toHaveSuspiciousCharacters()` arch expectation has been added to help you identify potential suspicious characters in your code. This arch expectation is now enabled by default on the `php` arch preset. This expectation requires the `intl` PHP extension.
- The expectation `toBeSlug` has been added to help you validate that a string is a valid slug.

### On Top of PHPUnit 12

Pest v4 is built on top of PHPUnit 12, which means you get all the latest features and improvements from PHPUnit. As such, be sure to check out the [PHPUnit 12 release announcement](https://phpunit.de/announcements/phpunit-12.html).

### Thanks To You, Pest v4 Is Here!

There's never been a better time to dive into testing and start using Pest. If you're ready to get started with Pest v4 right away, check out our [installation guide](/docs/installation) for step-by-step instructions. And if you're currently using an earlier version of Pest, we've got you covered with detailed upgrade instructions in our [upgrade guide](/docs/upgrade-guide).

Thank you for your continued support and feedback. We can't wait to see what you build with Pest v4!

---

Thank you for reading about Pest v4's new features! Want to get started with Pest? You can find the installation guide in the next section of the documentation: [Installation →](/docs/installation)

---

## Fortify Password Reset Resetting the Password Handling the Password Reset Response
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

#### Handling the Password Reset Response

If the password reset request was successful, Fortify will redirect back to the `/login` route so that the user can log in with their new password. In addition, a `status` session variable will be set so that you may display the successful status of the reset on your login screen:

```blade
@if (session('status'))
    <div class="mb-4 font-medium text-sm text-green-600">
        {{ session('status') }}
    </div>
@endif
```

If the request was an XHR request, a 200 HTTP response will be returned.

If the request was not successful, the user will be redirected back to the reset password screen and the validation errors will be available to you via the shared `$errors` [Blade template variable](/docs/{{version}}/validation#quick-displaying-the-validation-errors). Or, in the case of an XHR request, the validation errors will be returned with a 422 HTTP response.

---

## Fortify Password Reset Requesting a Password Reset Link
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

### Requesting a Password Reset Link

To begin implementing our application's password reset functionality, we need to instruct Fortify how to return our "forgot password" view. Remember, Fortify is a headless authentication library. If you would like a frontend implementation of Laravel's authentication features that are already completed for you, you should use an [application starter kit](/docs/{{version}}/starter-kits).

All of Fortify's view rendering logic may be customized using the appropriate methods available via the `Laravel\Fortify\Fortify` class. Typically, you should call this method from the `boot` method of your application's `App\Providers\FortifyServiceProvider` class:

```php
use Laravel\Fortify\Fortify;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Fortify::requestPasswordResetLinkView(function () {
        return view('auth.forgot-password');
    });

    // ...
}
```

Fortify will take care of defining the `/forgot-password` endpoint that returns this view. Your `forgot-password` template should include a form that makes a POST request to the `/forgot-password` endpoint.

The `/forgot-password` endpoint expects a string `email` field. The name of this field / database column should match the `email` configuration value within your application's `fortify` configuration file.

---

## Fortify Password Reset Requesting a Password Reset Link Handling the Password Reset Link Request Response
Fortify | laravel/fortify@latest | Source: https://github.com/laravel/docs/blob/13.x/fortify.md

#### Handling the Password Reset Link Request Response

If the password reset link request was successful, Fortify will redirect the user back to the `/forgot-password` endpoint and send an email to the user with a secure link they can use to reset their password. If the request was an XHR request, a 200 HTTP response will be returned.

After being redirected back to the `/forgot-password` endpoint after a successful request, the `status` session variable may be used to display the status of the password reset link request attempt.

The value of the `$status` session variable will match one of the translation strings defined within your application's `passwords` [language file](/docs/{{version}}/localization). If you would like to customize this value and have not published Laravel's language files, you may do so via the `lang:publish` Artisan command:

```html
@if (session('status'))
    <div class="mb-4 font-medium text-sm text-green-600">
        {{ session('status') }}
    </div>
@endif
```

If the request was not successful, the user will be redirected back to the request password reset link screen and the validation errors will be available to you via the shared `$errors` [Blade template variable](/docs/{{version}}/validation#quick-displaying-the-validation-errors). Or, in the case of an XHR request, the validation errors will be returned with a 422 HTTP response.

---

## Passport Password Grant Customizing the User Provider
Passport | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passport.md

### Customizing the User Provider

If your application uses more than one [authentication user provider](/docs/{{version}}/authentication#introduction), you may specify which user provider the password grant client uses by providing a `--provider` option when creating the client via the `artisan passport:client --password` command. The given provider name should match a valid provider defined in your application's `config/auth.php` configuration file. You can then [protect your route using middleware](#multiple-authentication-guards) to ensure that only users from the guard's specified provider are authorized.

---

## Fortify Password Reset Customizing Password Resets
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

### Customizing Password Resets

The password reset process may be customized by modifying the `App\Actions\ResetUserPassword` action that was generated when you installed Laravel Fortify.

---

## Fortify Password Reset Requesting a Password Reset Link
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

### Requesting a Password Reset Link

To begin implementing our application's password reset functionality, we need to instruct Fortify how to return our "forgot password" view. Remember, Fortify is a headless authentication library. If you would like a frontend implementation of Laravel's authentication features that are already completed for you, you should use an [application starter kit](/docs/{{version}}/starter-kits).

All of Fortify's view rendering logic may be customized using the appropriate methods available via the `Laravel\Fortify\Fortify` class. Typically, you should call this method from the `boot` method of your application's `App\Providers\FortifyServiceProvider` class:

```php
use Laravel\Fortify\Fortify;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Fortify::requestPasswordResetLinkView(function () {
        return view('auth.forgot-password');
    });

    // ...
}
```

Fortify will take care of defining the `/forgot-password` endpoint that returns this view. Your `forgot-password` template should include a form that makes a POST request to the `/forgot-password` endpoint.

The `/forgot-password` endpoint expects a string `email` field. The name of this field / database column should match the `email` configuration value within your application's `fortify` configuration file.

---

## Attribute On Example: Real-time notifications
Attribute On | livewire/livewire@4.x | Source: https://livewire.laravel.com/docs/4.x/attribute-on

## Example: Real-time notifications

Here's a practical example of a notification bell that listens for new notifications:

```php
<?php // resources/views/components/⚡notification-bell.blade.php

use Livewire\Attributes\On;
use Livewire\Component;

new class extends Component {
    public $unreadCount = 0;

    public function mount()
    {
        $this->unreadCount = auth()->user()->unreadNotifications()->count();
    }

    #[On('notification-sent')] // [tl! highlight]
    public function incrementCount()
    {
        $this->unreadCount++;
    }

    #[On('notifications-read')] // [tl! highlight]
    public function resetCount()
    {
        $this->unreadCount = 0;
    }
};
?>

<button class="relative">
    <svg><!-- Bell icon --></svg>
    @if($unreadCount > 0)
        <span class="absolute -top-1 -right-1 bg-red-500 text-white rounded-full px-2 py-1 text-xs">
            {{ $unreadCount }}
        </span>
    @endif
</button>
```

Other components can dispatch events to update the notification count:

```php
// From anywhere in your app
$this->dispatch('notification-sent');
```

---

## Fortify Password Reset Resetting the Password Handling the Password Reset Response
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

#### Handling the Password Reset Response

If the password reset request was successful, Fortify will redirect back to the `/login` route so that the user can log in with their new password. In addition, a `status` session variable will be set so that you may display the successful status of the reset on your login screen:

```blade
@if (session('status'))
    <div class="mb-4 font-medium text-sm text-green-600">
        {{ session('status') }}
    </div>
@endif
```

If the request was an XHR request, a 200 HTTP response will be returned.

If the request was not successful, the user will be redirected back to the reset password screen and the validation errors will be available to you via the shared `$errors` [Blade template variable](/docs/{{version}}/validation#quick-displaying-the-validation-errors). Or, in the case of an XHR request, the validation errors will be returned with a 422 HTTP response.

---

## Passwords Deleting Expired Tokens
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

## Deleting Expired Tokens

If you are using the `database` driver, password reset tokens that have expired will still be present within your database. However, you may easily delete these records using the `auth:clear-resets` Artisan command:

```shell
php artisan auth:clear-resets
```

If you would like to automate this process, consider adding the command to your application's [scheduler](/docs/{{version}}/scheduling):

```php
use Illuminate\Support\Facades\Schedule;

Schedule::command('auth:clear-resets')->everyFifteenMinutes();
```

---

## Telescope Available Watchers Notification Watcher
Telescope | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/telescope.md

### Notification Watcher

The notification watcher records all [notifications](/docs/{{version}}/notifications) sent by your application. If the notification triggers an email and you have the mail watcher enabled, the email will also be available for preview on the mail watcher screen.

---

## Passwords Routing Requesting the Password Reset Link The Password Reset Link Request Form
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

#### The Password Reset Link Request Form

First, we will define the routes that are needed to request password reset links. To get started, we will define a route that returns a view with the password reset link request form:

```php
Route::get('/forgot-password', function () {
    return view('auth.forgot-password');
})->middleware('guest')->name('password.request');
```

The view that is returned by this route should have a form containing an `email` field, which will allow the user to request a password reset link for a given email address.

---

## Validation Validating Passwords Defining Default Password Rules
Validation | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/validation.md

#### Defining Default Password Rules

You may find it convenient to specify the default validation rules for passwords in a single location of your application. You can easily accomplish this using the `Password::defaults` method, which accepts a closure. The closure given to the `defaults` method should return the default configuration of the Password rule. Typically, the `defaults` rule should be called within the `boot` method of one of your application's service providers:

```php
use Illuminate\Validation\Rules\Password;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Password::defaults(function () {
        $rule = Password::min(8);

        return $this->app->isProduction()
            ? $rule->mixedCase()->uncompromised()
            : $rule;
    });
}
```

Then, when you would like to apply the default rules to a particular password undergoing validation, you may invoke the `defaults` method with no arguments:

```php
'password' => ['required', Password::defaults()],
```

Occasionally, you may want to attach additional validation rules to your default password validation rules. You may use the `rules` method to accomplish this:

```php
use App\Rules\ZxcvbnRule;

Password::defaults(function () {
    $rule = Password::min(8)->rules([new ZxcvbnRule]);

    // ...
});
```

---

## Structure The App Directory The Notifications Directory
Structure | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/structure.md

### The Notifications Directory

This directory does not exist by default, but will be created for you if you execute the `make:notification` Artisan command. The `Notifications` directory contains all of the "transactional" [notifications](/docs/{{version}}/notifications) that are sent by your application, such as simple notifications about events that happen within your application. Laravel's notification feature abstracts sending notifications over a variety of drivers such as email, Slack, SMS, or stored in a database.

---

## Passwords Customization Reset Email Customization
Passwords | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/passwords.md

#### Reset Email Customization

You may easily modify the notification class used to send the password reset link to the user. To get started, override the `sendPasswordResetNotification` method on your `App\Models\User` model. Within this method, you may send the notification using any [notification class](/docs/{{version}}/notifications) of your own creation. The password reset `$token` is the first argument received by the method. You may use this `$token` to build the password reset URL of your choice and send your notification to the user:

```php
use App\Notifications\ResetPasswordNotification;

/**
 * Send a password reset notification to the user.
 *
 * @param  string  $token
 */
public function sendPasswordResetNotification($token): void
{
    $url = 'https://example.com/reset-password?token='.$token;

    $this->notify(new ResetPasswordNotification($url));
}
```

---

## Fortify Password Reset Requesting a Password Reset Link Handling the Password Reset Link Request Response
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

#### Handling the Password Reset Link Request Response

If the password reset link request was successful, Fortify will redirect the user back to the `/forgot-password` endpoint and send an email to the user with a secure link they can use to reset their password. If the request was an XHR request, a 200 HTTP response will be returned.

After being redirected back to the `/forgot-password` endpoint after a successful request, the `status` session variable may be used to display the status of the password reset link request attempt.

The value of the `$status` session variable will match one of the translation strings defined within your application's `passwords` [language file](/docs/{{version}}/localization). If you would like to customize this value and have not published Laravel's language files, you may do so via the `lang:publish` Artisan command:

```html
@if (session('status'))
    <div class="mb-4 font-medium text-sm text-green-600">
        {{ session('status') }}
    </div>
@endif
```

If the request was not successful, the user will be redirected back to the request password reset link screen and the validation errors will be available to you via the shared `$errors` [Blade template variable](/docs/{{version}}/validation#quick-displaying-the-validation-errors). Or, in the case of an XHR request, the validation errors will be returned with a 422 HTTP response.

---

## Prompts Notifications
Prompts | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/prompts.md

## Notifications

The `notify` function sends a native desktop notification from the terminal:

```php
use function Laravel\Prompts\notify;

notify('Build Complete', 'Deployed to production');
```

Notifications are supported on macOS (via `osascript`) and Linux (via `notify-send` with `kdialog` fallback).

On macOS, you may also include a `subtitle` and a `sound`:

```php
notify(
    title: 'Build Complete',
    body: 'Deployed to production',
    subtitle: 'staging-server',
    sound: 'Glass',
);
```

On Linux, you may provide a custom `icon`:

```php
notify(
    title: 'Build Complete',
    body: 'Deployed to production',
    icon: '/path/to/icon.png',
);
```

---

## Fortify Password Confirmation
Fortify | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/fortify.md

## Password Confirmation

While building your application, you may occasionally have actions that should require the user to confirm their password before the action is performed. Typically, these routes are protected by Laravel's built-in `password.confirm` middleware.

To begin implementing password confirmation functionality, we need to instruct Fortify how to return our application's "password confirmation" view. Remember, Fortify is a headless authentication library. If you would like a frontend implementation of Laravel's authentication features that are already completed for you, you should use an [application starter kit](/docs/{{version}}/starter-kits).

All of Fortify's view rendering logic may be customized using the appropriate methods available via the `Laravel\Fortify\Fortify` class. Typically, you should call this method from the `boot` method of your application's `App\Providers\FortifyServiceProvider` class:

```php
use Laravel\Fortify\Fortify;

/**
 * Bootstrap any application services.
 */
public function boot(): void
{
    Fortify::confirmPasswordView(function () {
        return view('auth.confirm-password');
    });

    // ...
}
```

Fortify will take care of defining the `/user/confirm-password` endpoint that returns this view. Your `confirm-password` template should include a form that makes a POST request to the `/user/confirm-password` endpoint. The `/user/confirm-password` endpoint expects a `password` field that contains the user's current password.

If the password matches the user's current password, Fortify will redirect the user to the route they were attempting to access. If the request was an XHR request, a 201 HTTP response will be returned.

If the request was not successful, the user will be redirected back to the confirm password screen and the validation errors will be available to you via the shared `$errors` Blade template variable. Or, in the case of an XHR request, the validation errors will be returned with a 422 HTTP response.

---

## Validation Validating Passwords
Validation | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/validation.md

## Validating Passwords

To ensure that passwords have an adequate level of complexity, you may use Laravel's `Password` rule object:

```php
use Illuminate\Support\Facades\Validator;
use Illuminate\Validation\Rules\Password;

$validator = Validator::make($request->all(), [
    'password' => ['required', 'confirmed', Password::min(8)],
]);
```

The `Password` rule object allows you to easily customize the password complexity requirements for your application, such as specifying that passwords require at least one letter, number, symbol, or characters with mixed casing:

```php
// Require at least 8 characters...
Password::min(8)

// Require at least one letter...
Password::min(8)->letters()

// Require at least one uppercase and one lowercase letter...
Password::min(8)->mixedCase()

// Require at least one number...
Password::min(8)->numbers()

// Require at least one symbol...
Password::min(8)->symbols()
```

In addition, you may ensure that a password has not been compromised in a public password data breach leak using the `uncompromised` method:

```php
Password::min(8)->uncompromised()
```

Internally, the `Password` rule object uses the [k-Anonymity](https://en.wikipedia.org/wiki/K-anonymity) model to determine if a password has been leaked via the [haveibeenpwned.com](https://haveibeenpwned.com) service without sacrificing the user's privacy or security.

By default, if a password appears at least once in a data leak, it will be considered compromised. You can customize this threshold using the first argument of the `uncompromised` method:

```php
// Ensure the password appears less than 3 times in the same data leak...
Password::min(8)->uncompromised(3);
```

Of course, you may chain all the methods in the examples above:

```php
Password::min(8)
    ->letters()
    ->mixedCase()
    ->numbers()
    ->symbols()
    ->uncompromised()
```

---

## Notifications Testing On-Demand Notifications
Notifications | laravel/framework@12.x | Source: https://github.com/laravel/docs/blob/12.x/notifications.md

#### On-Demand Notifications

If the code you are testing sends [on-demand notifications](#on-demand-notifications), you can test that the on-demand notification was sent via the `assertSentOnDemand` method:

```php
Notification::assertSentOnDemand(OrderShipped::class);
```

By passing a closure as the second argument to the `assertSentOnDemand` method, you may determine if an on-demand notification was sent to the correct "route" address:

```php
Notification::assertSentOnDemand(
    OrderShipped::class,
    function (OrderShipped $notification, array $channels, object $notifiable) use ($user) {
        return $notifiable->routes['mail'] === $user->email;
    }
);
```

_[Truncated]_