From 743e21c2d5f509638cb35ce55bf4d16f3d27e4d1 Mon Sep 17 00:00:00 2001
From: Derek Bourgeois <dbourgeois23@gmail.com>
Date: Tue, 24 Mar 2026 02:41:08 -0400
Subject: [PATCH 1/6] feat: add fortify authentication foundation

---
 AGENTS.md                                     |   1 +
 CLAUDE.md                                     |   1 +
 GEMINI.md                                     |   1 +
 README.md                                     |  15 +
 app/Actions/Fortify/CreateNewUser.php         |  43 +++
 .../Fortify/PasswordValidationRules.php       |  19 ++
 app/Actions/Fortify/ResetUserPassword.php     |  32 ++
 app/Actions/Fortify/UpdateUserPassword.php    |  35 +++
 .../Fortify/UpdateUserProfileInformation.php  |  61 ++++
 app/Providers/FortifyServiceProvider.php      |  54 ++++
 bootstrap/providers.php                       |   2 +
 composer.json                                 |   1 +
 composer.lock                                 | 291 +++++++++++++++++-
 config/fortify.php                            | 151 +++++++++
 ..._add_two_factor_columns_to_users_table.php |  42 +++
 .../views/auth/forgot-password.blade.php      |  35 +++
 resources/views/auth/layout.blade.php         |  98 ++++++
 resources/views/auth/login.blade.php          |  55 ++++
 resources/views/auth/register.blade.php       |  71 +++++
 resources/views/auth/reset-password.blade.php |  60 ++++
 .../components/desktop/profile-menu.blade.php |  10 +-
 resources/views/welcome.blade.php             |  12 +-
 routes/web.php                                |   2 +-
 tests/Feature/DesktopShellTest.php            |  17 +
 tests/Feature/FortifyAuthenticationTest.php   | 116 +++++++
 25 files changed, 1219 insertions(+), 6 deletions(-)
 create mode 100644 app/Actions/Fortify/CreateNewUser.php
 create mode 100644 app/Actions/Fortify/PasswordValidationRules.php
 create mode 100644 app/Actions/Fortify/ResetUserPassword.php
 create mode 100644 app/Actions/Fortify/UpdateUserPassword.php
 create mode 100644 app/Actions/Fortify/UpdateUserProfileInformation.php
 create mode 100644 app/Providers/FortifyServiceProvider.php
 create mode 100644 config/fortify.php
 create mode 100644 database/migrations/2026_03_24_063201_add_two_factor_columns_to_users_table.php
 create mode 100644 resources/views/auth/forgot-password.blade.php
 create mode 100644 resources/views/auth/layout.blade.php
 create mode 100644 resources/views/auth/login.blade.php
 create mode 100644 resources/views/auth/register.blade.php
 create mode 100644 resources/views/auth/reset-password.blade.php
 create mode 100644 tests/Feature/FortifyAuthenticationTest.php

diff --git a/AGENTS.md b/AGENTS.md
index 56d7dec..5e870a5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,6 +11,7 @@ This application is a Laravel application and its main Laravel ecosystems packag
 
 - php - 8.4
 - laravel/ai (AI) - v0
+- laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v13
 - laravel/pennant (PENNANT) - v1
 - laravel/prompts (PROMPTS) - v0
diff --git a/CLAUDE.md b/CLAUDE.md
index 56d7dec..5e870a5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -11,6 +11,7 @@ This application is a Laravel application and its main Laravel ecosystems packag
 
 - php - 8.4
 - laravel/ai (AI) - v0
+- laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v13
 - laravel/pennant (PENNANT) - v1
 - laravel/prompts (PROMPTS) - v0
diff --git a/GEMINI.md b/GEMINI.md
index 56d7dec..5e870a5 100644
--- a/GEMINI.md
+++ b/GEMINI.md
@@ -11,6 +11,7 @@ This application is a Laravel application and its main Laravel ecosystems packag
 
 - php - 8.4
 - laravel/ai (AI) - v0
+- laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v13
 - laravel/pennant (PENNANT) - v1
 - laravel/prompts (PROMPTS) - v0
diff --git a/README.md b/README.md
index f35aae9..3839d83 100644
--- a/README.md
+++ b/README.md
@@ -66,6 +66,21 @@ composer native:dev
 
 That path installs dependencies, prepares the Laravel app, bootstraps NativePHP, and starts the local desktop development loop.
 
+### Local Authentication
+
+Katra now uses Laravel Fortify for the first local authentication foundation.
+
+- Create a local account at `/register`, then sign in at `/login`.
+- The desktop shell route at `/` is now authentication-protected.
+- Password recovery is available through `/forgot-password`.
+- Make sure your local database migrations are current before you try the auth flow:
+
+```bash
+php artisan migrate --force
+```
+
+- If you are testing password reset locally and want to inspect the reset link without sending mail, use a local-safe mailer such as `MAIL_MAILER=log`.
+
 ### Configure AI Providers
 
 The Laravel AI SDK is installed and its conversation storage migrations are part of the application now.
diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php
new file mode 100644
index 0000000..ee2d712
--- /dev/null
+++ b/app/Actions/Fortify/CreateNewUser.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\CreatesNewUsers;
+
+class CreateNewUser implements CreatesNewUsers
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and create a newly registered user.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function create(array $input): User
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique(User::class),
+            ],
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        return User::create([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'password' => Hash::make($input['password']),
+        ]);
+    }
+}
diff --git a/app/Actions/Fortify/PasswordValidationRules.php b/app/Actions/Fortify/PasswordValidationRules.php
new file mode 100644
index 0000000..3678865
--- /dev/null
+++ b/app/Actions/Fortify/PasswordValidationRules.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use Illuminate\Contracts\Validation\Rule;
+use Illuminate\Validation\Rules\Password;
+
+trait PasswordValidationRules
+{
+    /**
+     * Get the validation rules used to validate passwords.
+     *
+     * @return array<int, Rule|array<mixed>|string>
+     */
+    protected function passwordRules(): array
+    {
+        return ['required', 'string', Password::default(), 'confirmed'];
+    }
+}
diff --git a/app/Actions/Fortify/ResetUserPassword.php b/app/Actions/Fortify/ResetUserPassword.php
new file mode 100644
index 0000000..667651f
--- /dev/null
+++ b/app/Actions/Fortify/ResetUserPassword.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\ResetsUserPasswords;
+
+class ResetUserPassword implements ResetsUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and reset the user's forgotten password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function reset(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}
diff --git a/app/Actions/Fortify/UpdateUserPassword.php b/app/Actions/Fortify/UpdateUserPassword.php
new file mode 100644
index 0000000..4a0306d
--- /dev/null
+++ b/app/Actions/Fortify/UpdateUserPassword.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserPasswords;
+
+class UpdateUserPassword implements UpdatesUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and update the user's password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'current_password' => ['required', 'string', 'current_password:web'],
+            'password' => $this->passwordRules(),
+        ], [
+            'current_password.current_password' => __('The provided password does not match your current password.'),
+        ])->validateWithBag('updatePassword');
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}
diff --git a/app/Actions/Fortify/UpdateUserProfileInformation.php b/app/Actions/Fortify/UpdateUserProfileInformation.php
new file mode 100644
index 0000000..62f58fa
--- /dev/null
+++ b/app/Actions/Fortify/UpdateUserProfileInformation.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserProfileInformation;
+
+class UpdateUserProfileInformation implements UpdatesUserProfileInformation
+{
+    /**
+     * Validate and update the given user's profile information.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users')->ignore($user->id),
+            ],
+        ])->validateWithBag('updateProfileInformation');
+
+        if ($input['email'] !== $user->email &&
+            $user instanceof MustVerifyEmail) {
+            $this->updateVerifiedUser($user, $input);
+        } else {
+            $user->forceFill([
+                'name' => $input['name'],
+                'email' => $input['email'],
+            ])->save();
+        }
+    }
+
+    /**
+     * Update the given verified user's profile information.
+     *
+     * @param  array<string, string>  $input
+     */
+    protected function updateVerifiedUser(User $user, array $input): void
+    {
+        $user->forceFill([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'email_verified_at' => null,
+        ])->save();
+
+        $user->sendEmailVerificationNotification();
+    }
+}
diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
new file mode 100644
index 0000000..edbc377
--- /dev/null
+++ b/app/Providers/FortifyServiceProvider.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Providers;
+
+use App\Actions\Fortify\CreateNewUser;
+use App\Actions\Fortify\ResetUserPassword;
+use App\Actions\Fortify\UpdateUserPassword;
+use App\Actions\Fortify\UpdateUserProfileInformation;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
+use Laravel\Fortify\Actions\RedirectIfTwoFactorAuthenticatable;
+use Laravel\Fortify\Fortify;
+
+class FortifyServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        Fortify::createUsersUsing(CreateNewUser::class);
+        Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
+        Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
+        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
+        Fortify::redirectUserForTwoFactorAuthenticationUsing(RedirectIfTwoFactorAuthenticatable::class);
+        Fortify::loginView(fn () => view('auth.login'));
+        Fortify::registerView(fn () => view('auth.register'));
+        Fortify::requestPasswordResetLinkView(fn () => view('auth.forgot-password'));
+        Fortify::resetPasswordView(fn (Request $request) => view('auth.reset-password', [
+            'request' => $request,
+        ]));
+
+        RateLimiter::for('login', function (Request $request) {
+            $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
+
+            return Limit::perMinute(5)->by($throttleKey);
+        });
+
+        RateLimiter::for('two-factor', function (Request $request) {
+            return Limit::perMinute(5)->by($request->session()->get('login.id'));
+        });
+    }
+}
diff --git a/bootstrap/providers.php b/bootstrap/providers.php
index fc94ae6..5ffd769 100644
--- a/bootstrap/providers.php
+++ b/bootstrap/providers.php
@@ -1,7 +1,9 @@
 <?php
 
 use App\Providers\AppServiceProvider;
+use App\Providers\FortifyServiceProvider;
 
 return [
     AppServiceProvider::class,
+    FortifyServiceProvider::class,
 ];
diff --git a/composer.json b/composer.json
index d2b8eef..53360c2 100644
--- a/composer.json
+++ b/composer.json
@@ -11,6 +11,7 @@
     "require": {
         "php": "^8.4",
         "laravel/ai": "^0.3.2",
+        "laravel/fortify": "^1.36",
         "laravel/framework": "^13.0",
         "laravel/pennant": "^1.0",
         "laravel/tinker": "^3.0",
diff --git a/composer.lock b/composer.lock
index 08e15be..ce585dc 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,8 +4,63 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "a334e1d5bb8705de1ccf4e713cb2520e",
+    "content-hash": "88cc1f927b6c0e8175532a2a535b0aea",
     "packages": [
+        {
+            "name": "bacon/bacon-qr-code",
+            "version": "v3.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Bacon/BaconQrCode.git",
+                "reference": "3feed0e212b8412cc5d2612706744789b0615824"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Bacon/BaconQrCode/zipball/3feed0e212b8412cc5d2612706744789b0615824",
+                "reference": "3feed0e212b8412cc5d2612706744789b0615824",
+                "shasum": ""
+            },
+            "require": {
+                "dasprid/enum": "^1.0.3",
+                "ext-iconv": "*",
+                "php": "^8.1"
+            },
+            "require-dev": {
+                "phly/keep-a-changelog": "^2.12",
+                "phpunit/phpunit": "^10.5.11 || ^11.0.4",
+                "spatie/phpunit-snapshot-assertions": "^5.1.5",
+                "spatie/pixelmatch-php": "^1.2.0",
+                "squizlabs/php_codesniffer": "^3.9"
+            },
+            "suggest": {
+                "ext-imagick": "to generate QR code images"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "BaconQrCode\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-2-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Ben Scholzen 'DASPRiD'",
+                    "email": "mail@dasprids.de",
+                    "homepage": "https://dasprids.de/",
+                    "role": "Developer"
+                }
+            ],
+            "description": "BaconQrCode is a QR code generator for PHP.",
+            "homepage": "https://github.com/Bacon/BaconQrCode",
+            "support": {
+                "issues": "https://github.com/Bacon/BaconQrCode/issues",
+                "source": "https://github.com/Bacon/BaconQrCode/tree/v3.0.4"
+            },
+            "time": "2026-03-16T01:01:30+00:00"
+        },
         {
             "name": "blade-ui-kit/blade-icons",
             "version": "1.9.0",
@@ -216,6 +271,56 @@
             ],
             "time": "2024-02-09T16:56:22+00:00"
         },
+        {
+            "name": "dasprid/enum",
+            "version": "1.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/DASPRiD/Enum.git",
+                "reference": "b5874fa9ed0043116c72162ec7f4fb50e02e7cce"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/DASPRiD/Enum/zipball/b5874fa9ed0043116c72162ec7f4fb50e02e7cce",
+                "reference": "b5874fa9ed0043116c72162ec7f4fb50e02e7cce",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.1 <9.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^7 || ^8 || ^9 || ^10 || ^11",
+                "squizlabs/php_codesniffer": "*"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "DASPRiD\\Enum\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-2-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Ben Scholzen 'DASPRiD'",
+                    "email": "mail@dasprids.de",
+                    "homepage": "https://dasprids.de/",
+                    "role": "Developer"
+                }
+            ],
+            "description": "PHP 7.1 enum implementation",
+            "keywords": [
+                "enum",
+                "map"
+            ],
+            "support": {
+                "issues": "https://github.com/DASPRiD/Enum/issues",
+                "source": "https://github.com/DASPRiD/Enum/tree/1.0.7"
+            },
+            "time": "2025-09-16T12:23:56+00:00"
+        },
         {
             "name": "dflydev/dot-access-data",
             "version": "v3.0.3",
@@ -1200,6 +1305,69 @@
             },
             "time": "2026-03-18T14:44:36+00:00"
         },
+        {
+            "name": "laravel/fortify",
+            "version": "v1.36.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/laravel/fortify.git",
+                "reference": "cad8bfeb63f6818f173d40090725c565c92651d4"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/laravel/fortify/zipball/cad8bfeb63f6818f173d40090725c565c92651d4",
+                "reference": "cad8bfeb63f6818f173d40090725c565c92651d4",
+                "shasum": ""
+            },
+            "require": {
+                "bacon/bacon-qr-code": "^3.0",
+                "ext-json": "*",
+                "illuminate/console": "^10.0|^11.0|^12.0|^13.0",
+                "illuminate/support": "^10.0|^11.0|^12.0|^13.0",
+                "php": "^8.1",
+                "pragmarx/google2fa": "^9.0"
+            },
+            "require-dev": {
+                "orchestra/testbench": "^8.36|^9.15|^10.8|^11.0",
+                "phpstan/phpstan": "^1.10"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "providers": [
+                        "Laravel\\Fortify\\FortifyServiceProvider"
+                    ]
+                },
+                "branch-alias": {
+                    "dev-master": "1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Laravel\\Fortify\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Taylor Otwell",
+                    "email": "taylor@laravel.com"
+                }
+            ],
+            "description": "Backend controllers and scaffolding for Laravel authentication.",
+            "keywords": [
+                "auth",
+                "laravel"
+            ],
+            "support": {
+                "issues": "https://github.com/laravel/fortify/issues",
+                "source": "https://github.com/laravel/fortify"
+            },
+            "time": "2026-03-10T19:59:49+00:00"
+        },
         {
             "name": "laravel/framework",
             "version": "v13.1.1",
@@ -2951,6 +3119,75 @@
             ],
             "time": "2026-02-16T23:10:27+00:00"
         },
+        {
+            "name": "paragonie/constant_time_encoding",
+            "version": "v3.1.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/paragonie/constant_time_encoding.git",
+                "reference": "d5b01a39b3415c2cd581d3bd3a3575c1ebbd8e77"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/paragonie/constant_time_encoding/zipball/d5b01a39b3415c2cd581d3bd3a3575c1ebbd8e77",
+                "reference": "d5b01a39b3415c2cd581d3bd3a3575c1ebbd8e77",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^8"
+            },
+            "require-dev": {
+                "infection/infection": "^0",
+                "nikic/php-fuzzer": "^0",
+                "phpunit/phpunit": "^9|^10|^11",
+                "vimeo/psalm": "^4|^5|^6"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "ParagonIE\\ConstantTime\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Paragon Initiative Enterprises",
+                    "email": "security@paragonie.com",
+                    "homepage": "https://paragonie.com",
+                    "role": "Maintainer"
+                },
+                {
+                    "name": "Steve 'Sc00bz' Thomas",
+                    "email": "steve@tobtu.com",
+                    "homepage": "https://www.tobtu.com",
+                    "role": "Original Developer"
+                }
+            ],
+            "description": "Constant-time Implementations of RFC 4648 Encoding (Base-64, Base-32, Base-16)",
+            "keywords": [
+                "base16",
+                "base32",
+                "base32_decode",
+                "base32_encode",
+                "base64",
+                "base64_decode",
+                "base64_encode",
+                "bin2hex",
+                "encoding",
+                "hex",
+                "hex2bin",
+                "rfc4648"
+            ],
+            "support": {
+                "email": "info@paragonie.com",
+                "issues": "https://github.com/paragonie/constant_time_encoding/issues",
+                "source": "https://github.com/paragonie/constant_time_encoding"
+            },
+            "time": "2025-09-24T15:06:41+00:00"
+        },
         {
             "name": "phpoption/phpoption",
             "version": "1.9.5",
@@ -3096,6 +3333,58 @@
             ],
             "time": "2023-01-30T09:18:47+00:00"
         },
+        {
+            "name": "pragmarx/google2fa",
+            "version": "v9.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/google2fa.git",
+                "reference": "e6bc62dd6ae83acc475f57912e27466019a1f2cf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/e6bc62dd6ae83acc475f57912e27466019a1f2cf",
+                "reference": "e6bc62dd6ae83acc475f57912e27466019a1f2cf",
+                "shasum": ""
+            },
+            "require": {
+                "paragonie/constant_time_encoding": "^1.0|^2.0|^3.0",
+                "php": "^7.1|^8.0"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^1.9",
+                "phpunit/phpunit": "^7.5.15|^8.5|^9.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Google2FA\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "role": "Creator & Designer"
+                }
+            ],
+            "description": "A One Time Password Authentication package, compatible with Google Authenticator.",
+            "keywords": [
+                "2fa",
+                "Authentication",
+                "Two Factor Authentication",
+                "google2fa"
+            ],
+            "support": {
+                "issues": "https://github.com/antonioribeiro/google2fa/issues",
+                "source": "https://github.com/antonioribeiro/google2fa/tree/v9.0.0"
+            },
+            "time": "2025-09-19T22:51:08+00:00"
+        },
         {
             "name": "prism-php/prism",
             "version": "v0.99.22",
diff --git a/config/fortify.php b/config/fortify.php
new file mode 100644
index 0000000..474fce2
--- /dev/null
+++ b/config/fortify.php
@@ -0,0 +1,151 @@
+<?php
+
+use Laravel\Fortify\Features;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Fortify Guard
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify which authentication guard Fortify will use while
+    | authenticating users. This value should correspond with one of your
+    | guards that is already present in your "auth" configuration file.
+    |
+    */
+
+    'guard' => 'web',
+
+    /*
+    |--------------------------------------------------------------------------
+    | Fortify Password Broker
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify which password broker Fortify can use when a user
+    | is resetting their password. This configured value should match one
+    | of your password brokers setup in your "auth" configuration file.
+    |
+    */
+
+    'passwords' => 'users',
+
+    /*
+    |--------------------------------------------------------------------------
+    | Username / Email
+    |--------------------------------------------------------------------------
+    |
+    | This value defines which model attribute should be considered as your
+    | application's "username" field. Typically, this might be the email
+    | address of the users but you are free to change this value here.
+    |
+    | Out of the box, Fortify expects forgot password and reset password
+    | requests to have a field named 'email'. If the application uses
+    | another name for the field you may define it below as needed.
+    |
+    */
+
+    'username' => 'email',
+
+    'email' => 'email',
+
+    /*
+    |--------------------------------------------------------------------------
+    | Lowercase Usernames
+    |--------------------------------------------------------------------------
+    |
+    | This value defines whether usernames should be lowercased before saving
+    | them in the database, as some database system string fields are case
+    | sensitive. You may disable this for your application if necessary.
+    |
+    */
+
+    'lowercase_usernames' => true,
+
+    /*
+    |--------------------------------------------------------------------------
+    | Home Path
+    |--------------------------------------------------------------------------
+    |
+    | Here you may configure the path where users will get redirected during
+    | authentication or password reset when the operations are successful
+    | and the user is authenticated. You are free to change this value.
+    |
+    */
+
+    'home' => '/',
+
+    /*
+    |--------------------------------------------------------------------------
+    | Fortify Routes Prefix / Subdomain
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify which prefix Fortify will assign to all the routes
+    | that it registers with the application. If necessary, you may change
+    | subdomain under which all of the Fortify routes will be available.
+    |
+    */
+
+    'prefix' => '',
+
+    'domain' => null,
+
+    /*
+    |--------------------------------------------------------------------------
+    | Fortify Routes Middleware
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify which middleware Fortify will assign to the routes
+    | that it registers with the application. If necessary, you may change
+    | these middleware but typically this provided default is preferred.
+    |
+    */
+
+    'middleware' => ['web'],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Rate Limiting
+    |--------------------------------------------------------------------------
+    |
+    | By default, Fortify will throttle logins to five requests per minute for
+    | every email and IP address combination. However, if you would like to
+    | specify a custom rate limiter to call then you may specify it here.
+    |
+    */
+
+    'limiters' => [
+        'login' => 'login',
+        'two-factor' => 'two-factor',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Register View Routes
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify if the routes returning views should be disabled as
+    | you may not need them when building your own application. This may be
+    | especially true if you're writing a custom single-page application.
+    |
+    */
+
+    'views' => true,
+
+    /*
+    |--------------------------------------------------------------------------
+    | Features
+    |--------------------------------------------------------------------------
+    |
+    | Some of the Fortify features are optional. You may disable the features
+    | by removing them from this array. You're free to only remove some of
+    | these features or you can even remove all of these if you need to.
+    |
+    */
+
+    'features' => [
+        Features::registration(),
+        Features::resetPasswords(),
+    ],
+
+];
diff --git a/database/migrations/2026_03_24_063201_add_two_factor_columns_to_users_table.php b/database/migrations/2026_03_24_063201_add_two_factor_columns_to_users_table.php
new file mode 100644
index 0000000..45739ef
--- /dev/null
+++ b/database/migrations/2026_03_24_063201_add_two_factor_columns_to_users_table.php
@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->text('two_factor_secret')
+                ->after('password')
+                ->nullable();
+
+            $table->text('two_factor_recovery_codes')
+                ->after('two_factor_secret')
+                ->nullable();
+
+            $table->timestamp('two_factor_confirmed_at')
+                ->after('two_factor_recovery_codes')
+                ->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn([
+                'two_factor_secret',
+                'two_factor_recovery_codes',
+                'two_factor_confirmed_at',
+            ]);
+        });
+    }
+};
diff --git a/resources/views/auth/forgot-password.blade.php b/resources/views/auth/forgot-password.blade.php
new file mode 100644
index 0000000..6331577
--- /dev/null
+++ b/resources/views/auth/forgot-password.blade.php
@@ -0,0 +1,35 @@
+@extends('auth.layout')
+
+@section('title', 'Reset your Katra password')
+@section('heading', 'Reset your password')
+@section('copy', 'Request a reset link for your local Katra account.')
+@section('panel_copy', 'We will send a password reset link to the email address tied to this local account.')
+
+@section('content')
+    <form method="POST" action="{{ route('password.email') }}" class="space-y-5">
+        @csrf
+
+        <div class="space-y-2">
+            <label for="email" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Email</label>
+            <input
+                id="email"
+                name="email"
+                type="email"
+                autocomplete="username"
+                required
+                autofocus
+                value="{{ old('email') }}"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+            Email reset link
+        </button>
+    </form>
+
+    <p class="shell-text-soft mt-6 text-sm">
+        Remembered your password?
+        <a href="{{ route('login') }}" class="shell-text-info font-medium hover:opacity-80">Back to sign in</a>
+    </p>
+@endsection
diff --git a/resources/views/auth/layout.blade.php b/resources/views/auth/layout.blade.php
new file mode 100644
index 0000000..d3eda29
--- /dev/null
+++ b/resources/views/auth/layout.blade.php
@@ -0,0 +1,98 @@
+<!DOCTYPE html>
+<html lang="{{ str_replace('_', '-', app()->getLocale()) }}">
+    <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+
+        <title>@yield('title', config('app.name', 'Katra'))</title>
+
+        <link rel="preconnect" href="https://fonts.bunny.net">
+        <link href="https://fonts.bunny.net/css?family=ibm-plex-mono:400,500|space-grotesk:400,500,700" rel="stylesheet" />
+
+        @if (file_exists(public_path('build/manifest.json')) || file_exists(public_path('hot')))
+            @vite(['resources/css/app.css', 'resources/js/app.js'])
+        @endif
+    </head>
+    <body class="shell-app min-h-screen antialiased">
+        <main class="grid min-h-screen lg:grid-cols-[minmax(0,1fr)_minmax(24rem,30rem)]">
+            <section class="shell-panel hidden min-h-screen flex-col justify-between px-8 py-8 lg:flex xl:px-12">
+                <div class="space-y-8">
+                    <div class="space-y-6">
+                        <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-9 w-auto" />
+                        <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-9 w-auto" />
+
+                        <div class="max-w-xl space-y-3">
+                            <p class="shell-text-info font-mono text-[11px] uppercase tracking-[0.16em]">Local authentication</p>
+                            <h1 class="shell-text text-4xl font-semibold tracking-[-0.04em]">
+                                @yield('heading')
+                            </h1>
+                            <p class="shell-text-soft text-base leading-7">
+                                @yield('copy')
+                            </p>
+                        </div>
+                    </div>
+
+                    <div class="grid gap-4 xl:grid-cols-2">
+                        <div class="shell-surface rounded-[28px] p-5">
+                            <p class="shell-text-faint font-mono text-[10px] uppercase tracking-[0.14em]">Secure by default</p>
+                            <p class="shell-text mt-3 text-sm leading-6">
+                                Session auth now belongs to the same Laravel foundation the rest of the app is built on.
+                            </p>
+                        </div>
+
+                        <div class="shell-surface rounded-[28px] p-5">
+                            <p class="shell-text-faint font-mono text-[10px] uppercase tracking-[0.14em]">Local-first account</p>
+                            <p class="shell-text mt-3 text-sm leading-6">
+                                Create a local account here first, then keep layering on remote connections and richer workspace controls.
+                            </p>
+                        </div>
+                    </div>
+                </div>
+
+                <p class="shell-text-faint font-mono text-[10px] uppercase tracking-[0.14em]">
+                    Katra desktop auth foundation
+                </p>
+            </section>
+
+            <section class="flex min-h-screen items-center justify-center px-5 py-8 sm:px-8">
+                <div class="w-full max-w-md space-y-5">
+                    <div class="space-y-4 lg:hidden">
+                        <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-8 w-auto" />
+                        <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-8 w-auto" />
+                        <div>
+                            <p class="shell-text-info font-mono text-[10px] uppercase tracking-[0.14em]">@yield('mobile_eyebrow', 'Authentication')</p>
+                            <h1 class="shell-text mt-2 text-3xl font-semibold tracking-[-0.04em]">@yield('heading')</h1>
+                            <p class="shell-text-soft mt-3 text-sm leading-6">@yield('copy')</p>
+                        </div>
+                    </div>
+
+                    <div class="shell-surface rounded-[32px] p-6 shadow-[var(--shell-shadow)] sm:p-8">
+                        @if (session('status'))
+                            <div class="mb-5 rounded-[18px] bg-[var(--shell-accent-soft)] px-4 py-3 text-sm text-[color:var(--shell-text)]">
+                                {{ session('status') }}
+                            </div>
+                        @endif
+
+                        @if ($errors->any())
+                            <div class="mb-5 rounded-[18px] bg-[var(--shell-danger-soft)] px-4 py-3 text-sm text-[color:var(--shell-text)]">
+                                <ul class="space-y-1">
+                                    @foreach ($errors->all() as $error)
+                                        <li>{{ $error }}</li>
+                                    @endforeach
+                                </ul>
+                            </div>
+                        @endif
+
+                        <div class="mb-6 hidden space-y-3 lg:block">
+                            <p class="shell-text-info font-mono text-[10px] uppercase tracking-[0.14em]">@yield('desktop_eyebrow', 'Authentication')</p>
+                            <h2 class="shell-text text-3xl font-semibold tracking-[-0.04em]">@yield('heading')</h2>
+                            <p class="shell-text-soft text-sm leading-6">@yield('panel_copy')</p>
+                        </div>
+
+                        @yield('content')
+                    </div>
+                </div>
+            </section>
+        </main>
+    </body>
+</html>
diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php
new file mode 100644
index 0000000..976bb94
--- /dev/null
+++ b/resources/views/auth/login.blade.php
@@ -0,0 +1,55 @@
+@extends('auth.layout')
+
+@section('title', 'Sign in to Katra')
+@section('heading', 'Sign in to Katra')
+@section('copy', 'Use your local Katra account to open the desktop workspace.')
+@section('panel_copy', 'Sign in with the local account for this instance. Password reset stays available if you need to recover access.')
+
+@section('content')
+    <form method="POST" action="{{ route('login') }}" class="space-y-5">
+        @csrf
+
+        <div class="space-y-2">
+            <label for="email" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Email</label>
+            <input
+                id="email"
+                name="email"
+                type="email"
+                autocomplete="username"
+                required
+                autofocus
+                value="{{ old('email') }}"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <div class="flex items-center justify-between gap-4">
+                <label for="password" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Password</label>
+                <a href="{{ route('password.request') }}" class="shell-text-info text-sm font-medium hover:opacity-80">Forgot password?</a>
+            </div>
+            <input
+                id="password"
+                name="password"
+                type="password"
+                autocomplete="current-password"
+                required
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <label class="shell-text-soft flex items-center gap-3 text-sm">
+            <input type="checkbox" name="remember" class="h-4 w-4 rounded border-none accent-[var(--shell-accent)]" />
+            <span>Keep me signed in</span>
+        </label>
+
+        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+            Sign in
+        </button>
+    </form>
+
+    <p class="shell-text-soft mt-6 text-sm">
+        Need a local account?
+        <a href="{{ route('register') }}" class="shell-text-info font-medium hover:opacity-80">Create one now</a>
+    </p>
+@endsection
diff --git a/resources/views/auth/register.blade.php b/resources/views/auth/register.blade.php
new file mode 100644
index 0000000..61b3a3c
--- /dev/null
+++ b/resources/views/auth/register.blade.php
@@ -0,0 +1,71 @@
+@extends('auth.layout')
+
+@section('title', 'Create your Katra account')
+@section('heading', 'Create your Katra account')
+@section('copy', 'Set up the local account that unlocks the Katra desktop workspace.')
+@section('panel_copy', 'This keeps the first auth step small and local while we prepare the broader connection and workspace model.')
+
+@section('content')
+    <form method="POST" action="{{ route('register') }}" class="space-y-5">
+        @csrf
+
+        <div class="space-y-2">
+            <label for="name" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Name</label>
+            <input
+                id="name"
+                name="name"
+                type="text"
+                autocomplete="name"
+                required
+                value="{{ old('name') }}"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="email" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Email</label>
+            <input
+                id="email"
+                name="email"
+                type="email"
+                autocomplete="username"
+                required
+                value="{{ old('email') }}"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="password" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Password</label>
+            <input
+                id="password"
+                name="password"
+                type="password"
+                autocomplete="new-password"
+                required
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="password_confirmation" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Confirm password</label>
+            <input
+                id="password_confirmation"
+                name="password_confirmation"
+                type="password"
+                autocomplete="new-password"
+                required
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+            Create account
+        </button>
+    </form>
+
+    <p class="shell-text-soft mt-6 text-sm">
+        Already have an account?
+        <a href="{{ route('login') }}" class="shell-text-info font-medium hover:opacity-80">Sign in instead</a>
+    </p>
+@endsection
diff --git a/resources/views/auth/reset-password.blade.php b/resources/views/auth/reset-password.blade.php
new file mode 100644
index 0000000..599fecd
--- /dev/null
+++ b/resources/views/auth/reset-password.blade.php
@@ -0,0 +1,60 @@
+@extends('auth.layout')
+
+@section('title', 'Choose a new Katra password')
+@section('heading', 'Choose a new password')
+@section('copy', 'Finish recovering your local Katra account.')
+@section('panel_copy', 'Set a new password for this account, then Fortify will send you straight back into Katra.')
+
+@section('content')
+    <form method="POST" action="{{ route('password.update') }}" class="space-y-5">
+        @csrf
+
+        <input type="hidden" name="token" value="{{ $request->route('token') }}" />
+
+        <div class="space-y-2">
+            <label for="email" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Email</label>
+            <input
+                id="email"
+                name="email"
+                type="email"
+                autocomplete="username"
+                required
+                value="{{ old('email', $request->email) }}"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="password" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">New password</label>
+            <input
+                id="password"
+                name="password"
+                type="password"
+                autocomplete="new-password"
+                required
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="password_confirmation" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Confirm password</label>
+            <input
+                id="password_confirmation"
+                name="password_confirmation"
+                type="password"
+                autocomplete="new-password"
+                required
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+            Reset password
+        </button>
+    </form>
+
+    <p class="shell-text-soft mt-6 text-sm">
+        Want to try signing in again?
+        <a href="{{ route('login') }}" class="shell-text-info font-medium hover:opacity-80">Back to sign in</a>
+    </p>
+@endsection
diff --git a/resources/views/components/desktop/profile-menu.blade.php b/resources/views/components/desktop/profile-menu.blade.php
index eefc340..a14e737 100644
--- a/resources/views/components/desktop/profile-menu.blade.php
+++ b/resources/views/components/desktop/profile-menu.blade.php
@@ -68,9 +68,13 @@
                 </div>
             </div>
 
-            <button type="button" class="shell-danger-button flex w-full items-center justify-center rounded-[18px] px-5 py-2.5 text-sm font-medium transition-colors">
-                <span>Log out</span>
-            </button>
+            <form method="POST" action="{{ route('logout') }}">
+                @csrf
+
+                <button type="submit" class="shell-danger-button flex w-full items-center justify-center rounded-[18px] px-5 py-2.5 text-sm font-medium transition-colors">
+                    <span>Log out</span>
+                </button>
+            </form>
         </div>
     </div>
 </details>
diff --git a/resources/views/welcome.blade.php b/resources/views/welcome.blade.php
index db4c4f0..83a89c1 100644
--- a/resources/views/welcome.blade.php
+++ b/resources/views/welcome.blade.php
@@ -81,6 +81,16 @@
                     ];
                 @endphp
                 <div data-desktop-shell class="relative h-full overflow-hidden">
+                    @php
+                        $viewer = request()->user();
+                        $viewerName = $viewer?->name ?? 'Derek Bourgeois';
+                        $viewerEmail = $viewer?->email ?? 'derek@katra.io';
+                        $viewerInitials = collect(explode(' ', $viewerName))
+                            ->filter()
+                            ->take(2)
+                            ->map(fn (string $segment): string => strtoupper(substr($segment, 0, 1)))
+                            ->implode('');
+                    @endphp
                     <div data-shell-grid class="grid h-full xl:grid-cols-[320px_minmax(0,1fr)]">
                     <aside data-sidebar class="shell-panel flex min-h-0 flex-col overflow-hidden px-4 py-3 transition-[opacity,transform] duration-200">
                         @php
@@ -159,7 +169,7 @@ class="shell-icon-button inline-flex h-7 w-7 items-center justify-center rounded
                             </div>
                         </div>
 
-                        <x-desktop.profile-menu name="Derek Bourgeois" email="derek@katra.io" initials="DB" />
+                        <x-desktop.profile-menu :name="$viewerName" :email="$viewerEmail" :initials="$viewerInitials" />
                     </aside>
 
                     <section class="shell-panel flex min-h-0 flex-col">
diff --git a/routes/web.php b/routes/web.php
index 8e01cc8..6b174d7 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -3,4 +3,4 @@
 use App\Http\Controllers\HomeController;
 use Illuminate\Support\Facades\Route;
 
-Route::get('/', HomeController::class)->name('home');
+Route::middleware('auth')->get('/', HomeController::class)->name('home');
diff --git a/tests/Feature/DesktopShellTest.php b/tests/Feature/DesktopShellTest.php
index 8be23f8..81ce659 100644
--- a/tests/Feature/DesktopShellTest.php
+++ b/tests/Feature/DesktopShellTest.php
@@ -1,5 +1,16 @@
 <?php
 
+use App\Models\User;
+
+function desktopShellUser(): User
+{
+    return User::factory()->make([
+        'id' => 1,
+        'name' => 'Derek Bourgeois',
+        'email' => 'derek@katra.io',
+    ]);
+}
+
 test('the desktop shell exposes the katra bootstrap screen', function () {
     config()->set('pennant.default', 'array');
     config()->set('surreal.autostart', false);
@@ -8,6 +19,8 @@
     config()->set('surreal.endpoint', 'ws://127.0.0.1:18999');
     config()->set('surreal.binary', 'surreal-missing-binary-for-desktop-shell-test');
 
+    $this->actingAs(desktopShellUser());
+
     $this->get('/')
         ->assertSuccessful()
         ->assertSee('Katra')
@@ -97,6 +110,8 @@
     config()->set('surreal.endpoint', 'ws://127.0.0.1:18999');
     config()->set('surreal.binary', 'surreal-missing-binary-for-desktop-shell-test');
 
+    $this->actingAs(desktopShellUser());
+
     $this->get('/')
         ->assertSuccessful()
         ->assertSee('Katra')
@@ -112,6 +127,8 @@
     config()->set('surreal.endpoint', 'ws://127.0.0.1:18999');
     config()->set('surreal.binary', 'surreal-missing-binary-for-desktop-shell-test');
 
+    $this->actingAs(desktopShellUser());
+
     $this->get('/?workspace=design-lab')
         ->assertSuccessful()
         ->assertSee('Design Lab')
diff --git a/tests/Feature/FortifyAuthenticationTest.php b/tests/Feature/FortifyAuthenticationTest.php
new file mode 100644
index 0000000..87e9b0f
--- /dev/null
+++ b/tests/Feature/FortifyAuthenticationTest.php
@@ -0,0 +1,116 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Auth\Notifications\ResetPassword;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Password;
+
+uses(RefreshDatabase::class);
+
+test('guests are redirected from the desktop shell to the login screen', function () {
+    $this->get(route('home'))
+        ->assertRedirect(route('login'));
+});
+
+test('the fortify auth screens render', function () {
+    $this->get(route('login'))
+        ->assertSuccessful()
+        ->assertSee('Sign in to Katra')
+        ->assertSee('Forgot password?');
+
+    $this->get(route('register'))
+        ->assertSuccessful()
+        ->assertSee('Create your Katra account');
+
+    $this->get(route('password.request'))
+        ->assertSuccessful()
+        ->assertSee('Reset your password');
+});
+
+test('a user can register for a local katra account', function () {
+    $this->post(route('register'), [
+        'name' => 'Derek Bourgeois',
+        'email' => 'derek@katra.io',
+        'password' => 'password',
+        'password_confirmation' => 'password',
+    ])->assertRedirect(route('home'));
+
+    $this->assertAuthenticated();
+
+    expect(User::query()->where('email', 'derek@katra.io')->exists())->toBeTrue();
+});
+
+test('a user can sign in with valid credentials', function () {
+    $user = User::factory()->create([
+        'email' => 'derek@katra.io',
+        'password' => 'password',
+    ]);
+
+    $this->post(route('login'), [
+        'email' => $user->email,
+        'password' => 'password',
+    ])->assertRedirect(route('home'));
+
+    $this->assertAuthenticatedAs($user);
+});
+
+test('a user cannot sign in with invalid credentials', function () {
+    $user = User::factory()->create([
+        'email' => 'derek@katra.io',
+        'password' => 'password',
+    ]);
+
+    $this->from(route('login'))
+        ->post(route('login'), [
+            'email' => $user->email,
+            'password' => 'not-the-right-password',
+        ])
+        ->assertRedirect(route('login'))
+        ->assertSessionHasErrors('email');
+
+    $this->assertGuest();
+});
+
+test('an authenticated user can log out from katra', function () {
+    $user = User::factory()->create();
+
+    $this->actingAs($user)
+        ->post(route('logout'))
+        ->assertRedirect('/');
+
+    $this->assertGuest();
+});
+
+test('a user can request a password reset link', function () {
+    Notification::fake();
+
+    $user = User::factory()->create([
+        'email' => 'derek@katra.io',
+    ]);
+
+    $this->post(route('password.email'), [
+        'email' => $user->email,
+    ])->assertSessionHas('status');
+
+    Notification::assertSentTo($user, ResetPassword::class);
+});
+
+test('a user can reset their password with a valid token', function () {
+    $user = User::factory()->create([
+        'email' => 'derek@katra.io',
+        'password' => 'password',
+    ]);
+
+    $token = Password::broker()->createToken($user);
+
+    $this->post(route('password.update'), [
+        'token' => $token,
+        'email' => $user->email,
+        'password' => 'new-password',
+        'password_confirmation' => 'new-password',
+    ])->assertSessionHasNoErrors();
+
+    expect(Hash::check('new-password', $user->fresh()->password))->toBeTrue();
+});

From 4659684b506e9fd3053a442fcec54edc6830b164 Mon Sep 17 00:00:00 2001
From: Derek Bourgeois <dbourgeois23@gmail.com>
Date: Tue, 24 Mar 2026 02:51:53 -0400
Subject: [PATCH 2/6] fix: neutralize fortify auth flow

---
 README.md                                     |  6 +-
 app/Actions/Fortify/CreateNewUser.php         |  7 +-
 .../Fortify/UpdateUserProfileInformation.php  | 11 ++-
 app/Models/User.php                           | 17 +++-
 database/factories/UserFactory.php            |  7 +-
 ...dd_profile_name_columns_to_users_table.php | 29 ++++++
 resources/views/auth/connect-server.blade.php | 61 ++++++++++++
 .../views/auth/forgot-password.blade.php      |  3 +-
 resources/views/auth/layout.blade.php         | 98 ++++++-------------
 resources/views/auth/login.blade.php          | 15 ++-
 resources/views/auth/register.blade.php       | 40 +++++---
 resources/views/auth/reset-password.blade.php |  3 +-
 routes/web.php                                |  2 +
 tests/Feature/DesktopUiFeatureFlagTest.php    | 17 ++++
 tests/Feature/ExampleTest.php                 |  7 +-
 tests/Feature/FortifyAuthenticationTest.php   | 24 ++++-
 16 files changed, 239 insertions(+), 108 deletions(-)
 create mode 100644 database/migrations/2026_03_24_064850_add_profile_name_columns_to_users_table.php
 create mode 100644 resources/views/auth/connect-server.blade.php

diff --git a/README.md b/README.md
index 3839d83..7e97057 100644
--- a/README.md
+++ b/README.md
@@ -66,11 +66,11 @@ composer native:dev
 
 That path installs dependencies, prepares the Laravel app, bootstraps NativePHP, and starts the local desktop development loop.
 
-### Local Authentication
+### Authentication
 
-Katra now uses Laravel Fortify for the first local authentication foundation.
+Katra now uses Laravel Fortify for the first authentication foundation.
 
-- Create a local account at `/register`, then sign in at `/login`.
+- Create an account at `/register`, then sign in at `/login`.
 - The desktop shell route at `/` is now authentication-protected.
 - Password recovery is available through `/forgot-password`.
 - Make sure your local database migrations are current before you try the auth flow:
diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php
index ee2d712..f9a8d69 100644
--- a/app/Actions/Fortify/CreateNewUser.php
+++ b/app/Actions/Fortify/CreateNewUser.php
@@ -23,7 +23,8 @@ class CreateNewUser implements CreatesNewUsers
     public function create(array $input): User
     {
         Validator::make($input, [
-            'name' => ['required', 'string', 'max:255'],
+            'first_name' => ['required', 'string', 'max:255'],
+            'last_name' => ['required', 'string', 'max:255'],
             'email' => [
                 'required',
                 'string',
@@ -35,7 +36,9 @@ public function create(array $input): User
         ])->validate();
 
         return User::create([
-            'name' => $input['name'],
+            'first_name' => $input['first_name'],
+            'last_name' => $input['last_name'],
+            'name' => trim($input['first_name'].' '.$input['last_name']),
             'email' => $input['email'],
             'password' => Hash::make($input['password']),
         ]);
diff --git a/app/Actions/Fortify/UpdateUserProfileInformation.php b/app/Actions/Fortify/UpdateUserProfileInformation.php
index 62f58fa..20c8263 100644
--- a/app/Actions/Fortify/UpdateUserProfileInformation.php
+++ b/app/Actions/Fortify/UpdateUserProfileInformation.php
@@ -21,7 +21,8 @@ class UpdateUserProfileInformation implements UpdatesUserProfileInformation
     public function update(User $user, array $input): void
     {
         Validator::make($input, [
-            'name' => ['required', 'string', 'max:255'],
+            'first_name' => ['required', 'string', 'max:255'],
+            'last_name' => ['required', 'string', 'max:255'],
 
             'email' => [
                 'required',
@@ -37,7 +38,9 @@ public function update(User $user, array $input): void
             $this->updateVerifiedUser($user, $input);
         } else {
             $user->forceFill([
-                'name' => $input['name'],
+                'first_name' => $input['first_name'],
+                'last_name' => $input['last_name'],
+                'name' => trim($input['first_name'].' '.$input['last_name']),
                 'email' => $input['email'],
             ])->save();
         }
@@ -51,7 +54,9 @@ public function update(User $user, array $input): void
     protected function updateVerifiedUser(User $user, array $input): void
     {
         $user->forceFill([
-            'name' => $input['name'],
+            'first_name' => $input['first_name'],
+            'last_name' => $input['last_name'],
+            'name' => trim($input['first_name'].' '.$input['last_name']),
             'email' => $input['email'],
             'email_verified_at' => null,
         ])->save();
diff --git a/app/Models/User.php b/app/Models/User.php
index f6ba1d2..34473d5 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -6,11 +6,12 @@
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
+use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 
-#[Fillable(['name', 'email', 'password'])]
+#[Fillable(['first_name', 'last_name', 'name', 'email', 'password'])]
 #[Hidden(['password', 'remember_token'])]
 class User extends Authenticatable
 {
@@ -29,4 +30,18 @@ protected function casts(): array
             'password' => 'hashed',
         ];
     }
+
+    protected function name(): Attribute
+    {
+        return Attribute::make(
+            get: function (?string $value, array $attributes): string {
+                $name = trim(implode(' ', array_filter([
+                    $attributes['first_name'] ?? null,
+                    $attributes['last_name'] ?? null,
+                ])));
+
+                return $name !== '' ? $name : ($value ?? '');
+            },
+        );
+    }
 }
diff --git a/database/factories/UserFactory.php b/database/factories/UserFactory.php
index c4ceb07..f9e63fb 100644
--- a/database/factories/UserFactory.php
+++ b/database/factories/UserFactory.php
@@ -24,8 +24,13 @@ class UserFactory extends Factory
      */
     public function definition(): array
     {
+        $firstName = fake()->firstName();
+        $lastName = fake()->lastName();
+
         return [
-            'name' => fake()->name(),
+            'first_name' => $firstName,
+            'last_name' => $lastName,
+            'name' => trim($firstName.' '.$lastName),
             'email' => fake()->unique()->safeEmail(),
             'email_verified_at' => now(),
             'password' => static::$password ??= Hash::make('password'),
diff --git a/database/migrations/2026_03_24_064850_add_profile_name_columns_to_users_table.php b/database/migrations/2026_03_24_064850_add_profile_name_columns_to_users_table.php
new file mode 100644
index 0000000..2637557
--- /dev/null
+++ b/database/migrations/2026_03_24_064850_add_profile_name_columns_to_users_table.php
@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->string('first_name')->nullable()->after('id');
+            $table->string('last_name')->nullable()->after('first_name');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn(['first_name', 'last_name']);
+        });
+    }
+};
diff --git a/resources/views/auth/connect-server.blade.php b/resources/views/auth/connect-server.blade.php
new file mode 100644
index 0000000..e1a2292
--- /dev/null
+++ b/resources/views/auth/connect-server.blade.php
@@ -0,0 +1,61 @@
+@extends('auth.layout')
+
+@section('title', 'Connect to a Katra server')
+@section('heading', 'Connect to a server')
+@section('copy', 'Use your server account when you want to sign in to a remote Katra instance.')
+@section('account_selector')
+    <div class="shell-panel grid grid-cols-2 gap-2 rounded-[18px] p-1.5">
+        <a href="{{ route('login') }}" class="shell-text-soft shell-hover-surface flex h-11 items-center justify-center rounded-[14px] text-sm font-medium transition-colors">
+            This instance
+        </a>
+        <a href="{{ route('server.connect') }}" class="shell-accent-chip flex h-11 items-center justify-center rounded-[14px] text-sm font-semibold">
+            Server
+        </a>
+    </div>
+@endsection
+
+@section('content')
+    <div class="space-y-5">
+        <div class="space-y-2">
+            <label for="server_url" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Server URL</label>
+            <input
+                id="server_url"
+                name="server_url"
+                type="url"
+                autocomplete="url"
+                placeholder="https://katra.example.com"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="email" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Email</label>
+            <input
+                id="email"
+                name="email"
+                type="email"
+                autocomplete="username"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <div class="space-y-2">
+            <label for="password" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Password</label>
+            <input
+                id="password"
+                name="password"
+                type="password"
+                autocomplete="current-password"
+                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+            />
+        </div>
+
+        <button type="button" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold opacity-80">
+            Continue
+        </button>
+
+        <p class="shell-text-soft text-sm leading-6">
+            Remote connection profiles are next. This view keeps the account choice visible now so the shared auth experience does not overfit the desktop-only path.
+        </p>
+    </div>
+@endsection
diff --git a/resources/views/auth/forgot-password.blade.php b/resources/views/auth/forgot-password.blade.php
index 6331577..cfc4cef 100644
--- a/resources/views/auth/forgot-password.blade.php
+++ b/resources/views/auth/forgot-password.blade.php
@@ -2,8 +2,7 @@
 
 @section('title', 'Reset your Katra password')
 @section('heading', 'Reset your password')
-@section('copy', 'Request a reset link for your local Katra account.')
-@section('panel_copy', 'We will send a password reset link to the email address tied to this local account.')
+@section('copy', 'Request a reset link for your Katra account.')
 
 @section('content')
     <form method="POST" action="{{ route('password.email') }}" class="space-y-5">
diff --git a/resources/views/auth/layout.blade.php b/resources/views/auth/layout.blade.php
index d3eda29..584ec7e 100644
--- a/resources/views/auth/layout.blade.php
+++ b/resources/views/auth/layout.blade.php
@@ -14,83 +14,43 @@
         @endif
     </head>
     <body class="shell-app min-h-screen antialiased">
-        <main class="grid min-h-screen lg:grid-cols-[minmax(0,1fr)_minmax(24rem,30rem)]">
-            <section class="shell-panel hidden min-h-screen flex-col justify-between px-8 py-8 lg:flex xl:px-12">
-                <div class="space-y-8">
-                    <div class="space-y-6">
-                        <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-9 w-auto" />
-                        <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-9 w-auto" />
+        <main class="flex min-h-screen items-center justify-center px-5 py-8 sm:px-8">
+            <section class="w-full max-w-lg space-y-5">
+                <div class="space-y-4">
+                    <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-8 w-auto" />
+                    <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-8 w-auto" />
+                </div>
 
-                        <div class="max-w-xl space-y-3">
-                            <p class="shell-text-info font-mono text-[11px] uppercase tracking-[0.16em]">Local authentication</p>
-                            <h1 class="shell-text text-4xl font-semibold tracking-[-0.04em]">
-                                @yield('heading')
-                            </h1>
-                            <p class="shell-text-soft text-base leading-7">
-                                @yield('copy')
-                            </p>
+                <div class="shell-surface rounded-[32px] p-6 shadow-[var(--shell-shadow)] sm:p-8">
+                    @hasSection('account_selector')
+                        <div class="mb-6">
+                            @yield('account_selector')
                         </div>
-                    </div>
+                    @endif
 
-                    <div class="grid gap-4 xl:grid-cols-2">
-                        <div class="shell-surface rounded-[28px] p-5">
-                            <p class="shell-text-faint font-mono text-[10px] uppercase tracking-[0.14em]">Secure by default</p>
-                            <p class="shell-text mt-3 text-sm leading-6">
-                                Session auth now belongs to the same Laravel foundation the rest of the app is built on.
-                            </p>
+                    @if (session('status'))
+                        <div class="mb-5 rounded-[18px] bg-[var(--shell-accent-soft)] px-4 py-3 text-sm text-[color:var(--shell-text)]">
+                            {{ session('status') }}
                         </div>
-
-                        <div class="shell-surface rounded-[28px] p-5">
-                            <p class="shell-text-faint font-mono text-[10px] uppercase tracking-[0.14em]">Local-first account</p>
-                            <p class="shell-text mt-3 text-sm leading-6">
-                                Create a local account here first, then keep layering on remote connections and richer workspace controls.
-                            </p>
+                    @endif
+
+                    @if ($errors->any())
+                        <div class="mb-5 rounded-[18px] bg-[var(--shell-danger-soft)] px-4 py-3 text-sm text-[color:var(--shell-text)]">
+                            <ul class="space-y-1">
+                                @foreach ($errors->all() as $error)
+                                    <li>{{ $error }}</li>
+                                @endforeach
+                            </ul>
                         </div>
-                    </div>
-                </div>
-
-                <p class="shell-text-faint font-mono text-[10px] uppercase tracking-[0.14em]">
-                    Katra desktop auth foundation
-                </p>
-            </section>
+                    @endif
 
-            <section class="flex min-h-screen items-center justify-center px-5 py-8 sm:px-8">
-                <div class="w-full max-w-md space-y-5">
-                    <div class="space-y-4 lg:hidden">
-                        <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-8 w-auto" />
-                        <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-8 w-auto" />
-                        <div>
-                            <p class="shell-text-info font-mono text-[10px] uppercase tracking-[0.14em]">@yield('mobile_eyebrow', 'Authentication')</p>
-                            <h1 class="shell-text mt-2 text-3xl font-semibold tracking-[-0.04em]">@yield('heading')</h1>
-                            <p class="shell-text-soft mt-3 text-sm leading-6">@yield('copy')</p>
-                        </div>
+                    <div class="mb-6 space-y-3">
+                        <p class="shell-text-info font-mono text-[10px] uppercase tracking-[0.14em]">@yield('eyebrow', 'Authentication')</p>
+                        <h1 class="shell-text text-3xl font-semibold tracking-[-0.04em]">@yield('heading')</h1>
+                        <p class="shell-text-soft text-sm leading-6">@yield('copy')</p>
                     </div>
 
-                    <div class="shell-surface rounded-[32px] p-6 shadow-[var(--shell-shadow)] sm:p-8">
-                        @if (session('status'))
-                            <div class="mb-5 rounded-[18px] bg-[var(--shell-accent-soft)] px-4 py-3 text-sm text-[color:var(--shell-text)]">
-                                {{ session('status') }}
-                            </div>
-                        @endif
-
-                        @if ($errors->any())
-                            <div class="mb-5 rounded-[18px] bg-[var(--shell-danger-soft)] px-4 py-3 text-sm text-[color:var(--shell-text)]">
-                                <ul class="space-y-1">
-                                    @foreach ($errors->all() as $error)
-                                        <li>{{ $error }}</li>
-                                    @endforeach
-                                </ul>
-                            </div>
-                        @endif
-
-                        <div class="mb-6 hidden space-y-3 lg:block">
-                            <p class="shell-text-info font-mono text-[10px] uppercase tracking-[0.14em]">@yield('desktop_eyebrow', 'Authentication')</p>
-                            <h2 class="shell-text text-3xl font-semibold tracking-[-0.04em]">@yield('heading')</h2>
-                            <p class="shell-text-soft text-sm leading-6">@yield('panel_copy')</p>
-                        </div>
-
-                        @yield('content')
-                    </div>
+                    @yield('content')
                 </div>
             </section>
         </main>
diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php
index 976bb94..3642fd6 100644
--- a/resources/views/auth/login.blade.php
+++ b/resources/views/auth/login.blade.php
@@ -2,8 +2,17 @@
 
 @section('title', 'Sign in to Katra')
 @section('heading', 'Sign in to Katra')
-@section('copy', 'Use your local Katra account to open the desktop workspace.')
-@section('panel_copy', 'Sign in with the local account for this instance. Password reset stays available if you need to recover access.')
+@section('copy', 'Choose how you want to sign in and continue into Katra.')
+@section('account_selector')
+    <div class="shell-panel grid grid-cols-2 gap-2 rounded-[18px] p-1.5">
+        <a href="{{ route('login') }}" class="shell-accent-chip flex h-11 items-center justify-center rounded-[14px] text-sm font-semibold">
+            This instance
+        </a>
+        <a href="{{ route('server.connect') }}" class="shell-text-soft shell-hover-surface flex h-11 items-center justify-center rounded-[14px] text-sm font-medium transition-colors">
+            Server
+        </a>
+    </div>
+@endsection
 
 @section('content')
     <form method="POST" action="{{ route('login') }}" class="space-y-5">
@@ -49,7 +58,7 @@ class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transpare
     </form>
 
     <p class="shell-text-soft mt-6 text-sm">
-        Need a local account?
+        Need an account?
         <a href="{{ route('register') }}" class="shell-text-info font-medium hover:opacity-80">Create one now</a>
     </p>
 @endsection
diff --git a/resources/views/auth/register.blade.php b/resources/views/auth/register.blade.php
index 61b3a3c..44ddd66 100644
--- a/resources/views/auth/register.blade.php
+++ b/resources/views/auth/register.blade.php
@@ -2,24 +2,38 @@
 
 @section('title', 'Create your Katra account')
 @section('heading', 'Create your Katra account')
-@section('copy', 'Set up the local account that unlocks the Katra desktop workspace.')
-@section('panel_copy', 'This keeps the first auth step small and local while we prepare the broader connection and workspace model.')
+@section('copy', 'Create an account for this instance and keep moving into the Katra workspace.')
 
 @section('content')
     <form method="POST" action="{{ route('register') }}" class="space-y-5">
         @csrf
 
-        <div class="space-y-2">
-            <label for="name" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Name</label>
-            <input
-                id="name"
-                name="name"
-                type="text"
-                autocomplete="name"
-                required
-                value="{{ old('name') }}"
-                class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
-            />
+        <div class="grid gap-5 sm:grid-cols-2">
+            <div class="space-y-2">
+                <label for="first_name" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">First name</label>
+                <input
+                    id="first_name"
+                    name="first_name"
+                    type="text"
+                    autocomplete="given-name"
+                    required
+                    value="{{ old('first_name') }}"
+                    class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+                />
+            </div>
+
+            <div class="space-y-2">
+                <label for="last_name" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Last name</label>
+                <input
+                    id="last_name"
+                    name="last_name"
+                    type="text"
+                    autocomplete="family-name"
+                    required
+                    value="{{ old('last_name') }}"
+                    class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transparent px-4 text-sm outline-none transition focus:border-[color:var(--shell-info)]"
+                />
+            </div>
         </div>
 
         <div class="space-y-2">
diff --git a/resources/views/auth/reset-password.blade.php b/resources/views/auth/reset-password.blade.php
index 599fecd..8b8c4a0 100644
--- a/resources/views/auth/reset-password.blade.php
+++ b/resources/views/auth/reset-password.blade.php
@@ -2,8 +2,7 @@
 
 @section('title', 'Choose a new Katra password')
 @section('heading', 'Choose a new password')
-@section('copy', 'Finish recovering your local Katra account.')
-@section('panel_copy', 'Set a new password for this account, then Fortify will send you straight back into Katra.')
+@section('copy', 'Finish recovering your Katra account.')
 
 @section('content')
     <form method="POST" action="{{ route('password.update') }}" class="space-y-5">
diff --git a/routes/web.php b/routes/web.php
index 6b174d7..78e3b22 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -3,4 +3,6 @@
 use App\Http\Controllers\HomeController;
 use Illuminate\Support\Facades\Route;
 
+Route::view('/connect-server', 'auth.connect-server')->name('server.connect');
+
 Route::middleware('auth')->get('/', HomeController::class)->name('home');
diff --git a/tests/Feature/DesktopUiFeatureFlagTest.php b/tests/Feature/DesktopUiFeatureFlagTest.php
index 375b0ae..f1ac718 100644
--- a/tests/Feature/DesktopUiFeatureFlagTest.php
+++ b/tests/Feature/DesktopUiFeatureFlagTest.php
@@ -6,6 +6,7 @@
 use App\Features\Desktop\MvpShell;
 use App\Features\Desktop\TaskSurfaces;
 use App\Features\Desktop\WorkspaceNavigation;
+use App\Models\User;
 use App\Support\Features\DesktopUi;
 use Laravel\Pennant\Attributes\Name;
 use Laravel\Pennant\Feature;
@@ -69,6 +70,14 @@
 
     Feature::for(DesktopUi::scope())->activate(WorkspaceNavigation::class);
 
+    $this->actingAs(User::factory()->make([
+        'id' => 1,
+        'first_name' => 'Derek',
+        'last_name' => 'Bourgeois',
+        'name' => 'Derek Bourgeois',
+        'email' => 'derek@katra.io',
+    ]));
+
     expect(DesktopUi::active(WorkspaceNavigation::class))->toBeTrue()
         ->and(DesktopUi::states()['ui.desktop.workspace-navigation'])->toBeTrue();
 
@@ -83,6 +92,14 @@
 
     Feature::for(DesktopUi::scope())->deactivate(MvpShell::class);
 
+    $this->actingAs(User::factory()->make([
+        'id' => 1,
+        'first_name' => 'Derek',
+        'last_name' => 'Bourgeois',
+        'name' => 'Derek Bourgeois',
+        'email' => 'derek@katra.io',
+    ]));
+
     $this->get('/')
         ->assertSuccessful()
         ->assertSee('The MVP workspace shell is currently hidden.')
diff --git a/tests/Feature/ExampleTest.php b/tests/Feature/ExampleTest.php
index 826289c..5a160d0 100644
--- a/tests/Feature/ExampleTest.php
+++ b/tests/Feature/ExampleTest.php
@@ -1,7 +1,6 @@
 <?php
 
-test('the application returns a successful response', function () {
-    $response = $this->get('/');
-
-    $response->assertSuccessful();
+test('guests are redirected to the login screen', function () {
+    $this->get('/')
+        ->assertRedirect(route('login'));
 });
diff --git a/tests/Feature/FortifyAuthenticationTest.php b/tests/Feature/FortifyAuthenticationTest.php
index 87e9b0f..0774145 100644
--- a/tests/Feature/FortifyAuthenticationTest.php
+++ b/tests/Feature/FortifyAuthenticationTest.php
@@ -18,20 +18,29 @@
     $this->get(route('login'))
         ->assertSuccessful()
         ->assertSee('Sign in to Katra')
-        ->assertSee('Forgot password?');
+        ->assertSee('Forgot password?')
+        ->assertSee('This instance')
+        ->assertSee('Server');
 
     $this->get(route('register'))
         ->assertSuccessful()
-        ->assertSee('Create your Katra account');
+        ->assertSee('Create your Katra account')
+        ->assertSee('First name')
+        ->assertSee('Last name');
 
     $this->get(route('password.request'))
         ->assertSuccessful()
         ->assertSee('Reset your password');
+
+    $this->get(route('server.connect'))
+        ->assertSuccessful()
+        ->assertSee('Connect to a server');
 });
 
-test('a user can register for a local katra account', function () {
+test('a user can register for a katra account', function () {
     $this->post(route('register'), [
-        'name' => 'Derek Bourgeois',
+        'first_name' => 'Derek',
+        'last_name' => 'Bourgeois',
         'email' => 'derek@katra.io',
         'password' => 'password',
         'password_confirmation' => 'password',
@@ -39,7 +48,12 @@
 
     $this->assertAuthenticated();
 
-    expect(User::query()->where('email', 'derek@katra.io')->exists())->toBeTrue();
+    $user = User::query()->where('email', 'derek@katra.io')->first();
+
+    expect($user)->not->toBeNull()
+        ->and($user?->first_name)->toBe('Derek')
+        ->and($user?->last_name)->toBe('Bourgeois')
+        ->and($user?->name)->toBe('Derek Bourgeois');
 });
 
 test('a user can sign in with valid credentials', function () {

From 2076e47f22192f44730896bf308b68398341457f Mon Sep 17 00:00:00 2001
From: Derek Bourgeois <dbourgeois23@gmail.com>
Date: Tue, 24 Mar 2026 03:01:25 -0400
Subject: [PATCH 3/6] fix: support surreal database cache auth flow

---
 .../Surreal/Query/SurrealQueryBuilder.php     |  49 +++++++
 .../Schema/SurrealSchemaConnection.php        | 113 +++++++++++++++-
 .../Surreal/SurrealQueryException.php         |  16 +++
 resources/views/auth/connect-server.blade.php |   6 +-
 .../views/auth/forgot-password.blade.php      |   6 +-
 resources/views/auth/layout.blade.php         |  14 +-
 resources/views/auth/login.blade.php          |   6 +-
 resources/views/auth/register.blade.php       |   6 +-
 resources/views/auth/reset-password.blade.php |   6 +-
 tests/Feature/DatabaseCacheOnSurrealTest.php  | 128 ++++++++++++++++++
 10 files changed, 325 insertions(+), 25 deletions(-)
 create mode 100644 tests/Feature/DatabaseCacheOnSurrealTest.php

diff --git a/app/Services/Surreal/Query/SurrealQueryBuilder.php b/app/Services/Surreal/Query/SurrealQueryBuilder.php
index 861e36e..15d3119 100644
--- a/app/Services/Surreal/Query/SurrealQueryBuilder.php
+++ b/app/Services/Surreal/Query/SurrealQueryBuilder.php
@@ -7,6 +7,7 @@
 use Illuminate\Database\Query\Builder;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
+use InvalidArgumentException;
 use RuntimeException;
 use stdClass;
 
@@ -53,6 +54,21 @@ public function insert(array $values): bool
         return true;
     }
 
+    public function insertOrIgnore(array $values): int
+    {
+        $records = $this->prepareInsertValues($values);
+        $inserted = 0;
+
+        foreach ($records as $record) {
+            $inserted += $this->surrealConnection()->insertOrIgnoreRecord(
+                table: (string) $this->from,
+                values: $record,
+            ) ? 1 : 0;
+        }
+
+        return $inserted;
+    }
+
     public function insertGetId(array $values, $sequence = null): int|string
     {
         return $this->surrealConnection()->insertRecordAndReturnId(
@@ -92,6 +108,39 @@ public function delete($id = null): int
         );
     }
 
+    public function upsert(array $values, array|string $uniqueBy, ?array $update = null): int
+    {
+        if ($uniqueBy === [] || $uniqueBy === '') {
+            throw new InvalidArgumentException('The unique columns must not be empty.');
+        }
+
+        $records = $this->prepareInsertValues($values);
+
+        if ($records === []) {
+            return 0;
+        }
+
+        $uniqueColumns = array_values(Arr::wrap($uniqueBy));
+
+        if ($update === []) {
+            return $this->insert($values) ? count($records) : 0;
+        }
+
+        $updateColumns = $update ?? array_keys($records[0]);
+        $affected = 0;
+
+        foreach ($records as $record) {
+            $affected += $this->surrealConnection()->upsertRecord(
+                table: (string) $this->from,
+                values: $record,
+                uniqueBy: $uniqueColumns,
+                updateColumns: array_values($updateColumns),
+            ) ? 1 : 0;
+        }
+
+        return $affected;
+    }
+
     public function exists(): bool
     {
         $query = clone $this;
diff --git a/app/Services/Surreal/Schema/SurrealSchemaConnection.php b/app/Services/Surreal/Schema/SurrealSchemaConnection.php
index a80e184..0fb84b2 100644
--- a/app/Services/Surreal/Schema/SurrealSchemaConnection.php
+++ b/app/Services/Surreal/Schema/SurrealSchemaConnection.php
@@ -6,6 +6,7 @@
 use App\Services\Surreal\SurrealCliClient;
 use App\Services\Surreal\SurrealConnection;
 use App\Services\Surreal\SurrealHttpClient;
+use App\Services\Surreal\SurrealQueryException;
 use App\Services\Surreal\SurrealRuntimeManager;
 use Carbon\CarbonImmutable;
 use Closure;
@@ -247,7 +248,7 @@ public function selectRecords(string $table, array $columns, array $wheres = [],
      */
     public function insertRecord(string $table, array $values): array
     {
-        $key = $values['id'] ?? $this->nextKey($table);
+        $key = $this->keyForInsert($table, $values);
 
         return $this->createRecord(
             table: $table,
@@ -258,7 +259,7 @@ public function insertRecord(string $table, array $values): array
 
     public function insertRecordAndReturnId(string $table, array $values, string $keyName = 'id'): int|string
     {
-        $key = $values[$keyName] ?? $this->nextKey($table);
+        $key = $values[$keyName] ?? $this->keyForInsert($table, $values);
 
         $this->createRecord(
             table: $table,
@@ -269,6 +270,65 @@ public function insertRecordAndReturnId(string $table, array $values, string $ke
         return $key;
     }
 
+    /**
+     * @param  array<string, mixed>  $values
+     */
+    public function insertOrIgnoreRecord(string $table, array $values): bool
+    {
+        try {
+            $this->insertRecord($table, $values);
+
+            return true;
+        } catch (SurrealQueryException $exception) {
+            if ($exception->isDuplicateRecord()) {
+                return false;
+            }
+
+            throw $exception;
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $values
+     * @param  list<string>  $uniqueBy
+     * @param  list<string>  $updateColumns
+     */
+    public function upsertRecord(string $table, array $values, array $uniqueBy, array $updateColumns): bool
+    {
+        $match = Arr::only($values, $uniqueBy);
+
+        if (count($match) !== count($uniqueBy)) {
+            throw new RuntimeException(sprintf(
+                'Unable to upsert into [%s] because one or more unique columns are missing from the payload.',
+                $table,
+            ));
+        }
+
+        $existingRecordId = $this->firstMatchingRecordId($table, $match);
+
+        if ($existingRecordId === null) {
+            $this->insertRecord($table, $values);
+
+            return true;
+        }
+
+        $updatePayload = Arr::only($values, $updateColumns);
+
+        if ($updatePayload === []) {
+            return true;
+        }
+
+        $this->updateRecords($table, $updatePayload, [[
+            'type' => 'Basic',
+            'column' => 'id',
+            'operator' => '=',
+            'value' => $existingRecordId,
+            'boolean' => 'and',
+        ]]);
+
+        return true;
+    }
+
     /**
      * @param  array<string, mixed>  $values
      * @param  array<int, array<string, mixed>>  $wheres
@@ -658,6 +718,53 @@ private function nextKey(string $table): int
         return (int) $result;
     }
 
+    /**
+     * @param  array<string, mixed>  $values
+     */
+    private function keyForInsert(string $table, array $values): int|string
+    {
+        if (array_key_exists('id', $values)) {
+            return $values['id'];
+        }
+
+        if (array_key_exists('key', $values) && is_scalar($values['key'])) {
+            return (string) $values['key'];
+        }
+
+        return $this->nextKey($table);
+    }
+
+    /**
+     * @param  array<string, mixed>  $values
+     */
+    private function firstMatchingRecordId(string $table, array $values): int|string|null
+    {
+        $wheres = array_map(
+            static fn (string $column, mixed $value): array => [
+                'type' => 'Basic',
+                'column' => $column,
+                'operator' => '=',
+                'value' => $value,
+                'boolean' => 'and',
+            ],
+            array_keys($values),
+            array_values($values),
+        );
+
+        $record = $this->selectRecords(
+            table: $table,
+            columns: ['id'],
+            wheres: $wheres,
+            limit: 1,
+        )[0] ?? null;
+
+        if (! is_array($record) || ! array_key_exists('id', $record)) {
+            return null;
+        }
+
+        return $record['id'];
+    }
+
     private function normalizeIdentifier(string $identifier): string
     {
         if (! preg_match('/^[A-Za-z0-9_]+$/', $identifier)) {
@@ -680,7 +787,7 @@ private function normalizeRecordIdentifier(string $table, mixed $value): string
             return $value;
         }
 
-        if (is_string($value) && preg_match('/^[A-Za-z0-9_-]+$/', $value)) {
+        if (is_string($value) && $value !== '') {
             return sprintf('%s:%s', $table, $value);
         }
 
diff --git a/app/Services/Surreal/SurrealQueryException.php b/app/Services/Surreal/SurrealQueryException.php
index 369d44d..c18cb48 100644
--- a/app/Services/Surreal/SurrealQueryException.php
+++ b/app/Services/Surreal/SurrealQueryException.php
@@ -33,4 +33,20 @@ public function isTableMissing(string $table): bool
 
         return false;
     }
+
+    public function isDuplicateRecord(): bool
+    {
+        if (is_string($this->codeName) && strcasecmp($this->codeName, 'DUPLICATE') === 0) {
+            return true;
+        }
+
+        if (! is_string($this->details)) {
+            return false;
+        }
+
+        $normalizedDetails = strtolower($this->details);
+
+        return str_contains($normalizedDetails, 'already exists')
+            || str_contains($normalizedDetails, 'duplicate');
+    }
 }
diff --git a/resources/views/auth/connect-server.blade.php b/resources/views/auth/connect-server.blade.php
index e1a2292..5ddd3c6 100644
--- a/resources/views/auth/connect-server.blade.php
+++ b/resources/views/auth/connect-server.blade.php
@@ -15,7 +15,7 @@
 @endsection
 
 @section('content')
-    <div class="space-y-5">
+    <div class="space-y-6">
         <div class="space-y-2">
             <label for="server_url" class="shell-text-faint block font-mono text-[10px] uppercase tracking-[0.14em]">Server URL</label>
             <input
@@ -50,11 +50,11 @@ class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transpare
             />
         </div>
 
-        <button type="button" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold opacity-80">
+        <button type="button" class="shell-accent-chip mt-2 flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold opacity-80">
             Continue
         </button>
 
-        <p class="shell-text-soft text-sm leading-6">
+        <p class="shell-text-soft mt-8 text-sm leading-6">
             Remote connection profiles are next. This view keeps the account choice visible now so the shared auth experience does not overfit the desktop-only path.
         </p>
     </div>
diff --git a/resources/views/auth/forgot-password.blade.php b/resources/views/auth/forgot-password.blade.php
index cfc4cef..3921e5d 100644
--- a/resources/views/auth/forgot-password.blade.php
+++ b/resources/views/auth/forgot-password.blade.php
@@ -5,7 +5,7 @@
 @section('copy', 'Request a reset link for your Katra account.')
 
 @section('content')
-    <form method="POST" action="{{ route('password.email') }}" class="space-y-5">
+    <form method="POST" action="{{ route('password.email') }}" class="space-y-6">
         @csrf
 
         <div class="space-y-2">
@@ -22,12 +22,12 @@ class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transpare
             />
         </div>
 
-        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+        <button type="submit" class="shell-accent-chip mt-2 flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
             Email reset link
         </button>
     </form>
 
-    <p class="shell-text-soft mt-6 text-sm">
+    <p class="shell-text-soft mt-8 text-sm">
         Remembered your password?
         <a href="{{ route('login') }}" class="shell-text-info font-medium hover:opacity-80">Back to sign in</a>
     </p>
diff --git a/resources/views/auth/layout.blade.php b/resources/views/auth/layout.blade.php
index 584ec7e..52c9562 100644
--- a/resources/views/auth/layout.blade.php
+++ b/resources/views/auth/layout.blade.php
@@ -15,15 +15,15 @@
     </head>
     <body class="shell-app min-h-screen antialiased">
         <main class="flex min-h-screen items-center justify-center px-5 py-8 sm:px-8">
-            <section class="w-full max-w-lg space-y-5">
-                <div class="space-y-4">
-                    <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-8 w-auto" />
-                    <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-8 w-auto" />
+            <section class="w-full max-w-lg space-y-7">
+                <div class="flex justify-center">
+                    <img src="{{ asset('katra-logo.svg') }}" alt="Katra" class="shell-logo-dark h-12 w-auto" />
+                    <img src="{{ asset('katra-logo-light.svg') }}" alt="Katra" class="shell-logo-light h-12 w-auto" />
                 </div>
 
-                <div class="shell-surface rounded-[32px] p-6 shadow-[var(--shell-shadow)] sm:p-8">
+                <div class="shell-surface rounded-[32px] p-7 shadow-[var(--shell-shadow)] sm:p-9">
                     @hasSection('account_selector')
-                        <div class="mb-6">
+                        <div class="mb-8">
                             @yield('account_selector')
                         </div>
                     @endif
@@ -44,7 +44,7 @@
                         </div>
                     @endif
 
-                    <div class="mb-6 space-y-3">
+                    <div class="mb-8 space-y-4">
                         <p class="shell-text-info font-mono text-[10px] uppercase tracking-[0.14em]">@yield('eyebrow', 'Authentication')</p>
                         <h1 class="shell-text text-3xl font-semibold tracking-[-0.04em]">@yield('heading')</h1>
                         <p class="shell-text-soft text-sm leading-6">@yield('copy')</p>
diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php
index 3642fd6..e9df1c6 100644
--- a/resources/views/auth/login.blade.php
+++ b/resources/views/auth/login.blade.php
@@ -15,7 +15,7 @@
 @endsection
 
 @section('content')
-    <form method="POST" action="{{ route('login') }}" class="space-y-5">
+    <form method="POST" action="{{ route('login') }}" class="space-y-6">
         @csrf
 
         <div class="space-y-2">
@@ -52,12 +52,12 @@ class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transpare
             <span>Keep me signed in</span>
         </label>
 
-        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+        <button type="submit" class="shell-accent-chip mt-2 flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
             Sign in
         </button>
     </form>
 
-    <p class="shell-text-soft mt-6 text-sm">
+    <p class="shell-text-soft mt-8 text-sm">
         Need an account?
         <a href="{{ route('register') }}" class="shell-text-info font-medium hover:opacity-80">Create one now</a>
     </p>
diff --git a/resources/views/auth/register.blade.php b/resources/views/auth/register.blade.php
index 44ddd66..52c6ef9 100644
--- a/resources/views/auth/register.blade.php
+++ b/resources/views/auth/register.blade.php
@@ -5,7 +5,7 @@
 @section('copy', 'Create an account for this instance and keep moving into the Katra workspace.')
 
 @section('content')
-    <form method="POST" action="{{ route('register') }}" class="space-y-5">
+    <form method="POST" action="{{ route('register') }}" class="space-y-6">
         @csrf
 
         <div class="grid gap-5 sm:grid-cols-2">
@@ -73,12 +73,12 @@ class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transpare
             />
         </div>
 
-        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+        <button type="submit" class="shell-accent-chip mt-2 flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
             Create account
         </button>
     </form>
 
-    <p class="shell-text-soft mt-6 text-sm">
+    <p class="shell-text-soft mt-8 text-sm">
         Already have an account?
         <a href="{{ route('login') }}" class="shell-text-info font-medium hover:opacity-80">Sign in instead</a>
     </p>
diff --git a/resources/views/auth/reset-password.blade.php b/resources/views/auth/reset-password.blade.php
index 8b8c4a0..295b300 100644
--- a/resources/views/auth/reset-password.blade.php
+++ b/resources/views/auth/reset-password.blade.php
@@ -5,7 +5,7 @@
 @section('copy', 'Finish recovering your Katra account.')
 
 @section('content')
-    <form method="POST" action="{{ route('password.update') }}" class="space-y-5">
+    <form method="POST" action="{{ route('password.update') }}" class="space-y-6">
         @csrf
 
         <input type="hidden" name="token" value="{{ $request->route('token') }}" />
@@ -47,12 +47,12 @@ class="shell-panel shell-text h-12 w-full rounded-[18px] border border-transpare
             />
         </div>
 
-        <button type="submit" class="shell-accent-chip flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
+        <button type="submit" class="shell-accent-chip mt-2 flex h-12 w-full items-center justify-center rounded-[18px] text-sm font-semibold transition hover:opacity-90">
             Reset password
         </button>
     </form>
 
-    <p class="shell-text-soft mt-6 text-sm">
+    <p class="shell-text-soft mt-8 text-sm">
         Want to try signing in again?
         <a href="{{ route('login') }}" class="shell-text-info font-medium hover:opacity-80">Back to sign in</a>
     </p>
diff --git a/tests/Feature/DatabaseCacheOnSurrealTest.php b/tests/Feature/DatabaseCacheOnSurrealTest.php
new file mode 100644
index 0000000..612fd77
--- /dev/null
+++ b/tests/Feature/DatabaseCacheOnSurrealTest.php
@@ -0,0 +1,128 @@
+<?php
+
+use App\Services\Surreal\SurrealCliClient;
+use App\Services\Surreal\SurrealConnection;
+use App\Services\Surreal\SurrealHttpClient;
+use App\Services\Surreal\SurrealRuntimeManager;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Str;
+use Symfony\Component\Process\Process;
+
+test('the database cache store works on the surreal connection', function () {
+    $client = app(SurrealCliClient::class);
+
+    if (! $client->isAvailable()) {
+        $this->markTestSkipped('The `surreal` CLI is not available in this environment.');
+    }
+
+    $storagePath = storage_path('app/surrealdb/database-cache-test-'.Str::uuid());
+    $originalDefaultConnection = config('database.default');
+    $originalMigrationConnection = config('database.migrations.connection');
+    $originalCacheStore = config('cache.default');
+    $originalCacheDatabaseConnection = config('cache.stores.database.connection');
+    $originalCacheLockConnection = config('cache.stores.database.lock_connection');
+
+    File::deleteDirectory($storagePath);
+    File::ensureDirectoryExists(dirname($storagePath));
+
+    try {
+        $server = retryStartingSurrealCacheServer($client, $storagePath);
+
+        config()->set('database.default', 'surreal');
+        config()->set('database.migrations.connection', null);
+        config()->set('surreal.host', '127.0.0.1');
+        config()->set('surreal.port', $server['port']);
+        config()->set('surreal.endpoint', $server['endpoint']);
+        config()->set('surreal.username', 'root');
+        config()->set('surreal.password', 'root');
+        config()->set('surreal.namespace', 'katra');
+        config()->set('surreal.database', 'database_cache_test');
+        config()->set('surreal.storage_engine', 'surrealkv');
+        config()->set('surreal.storage_path', $storagePath);
+        config()->set('surreal.runtime', 'local');
+        config()->set('surreal.autostart', false);
+        config()->set('cache.default', 'database');
+        config()->set('cache.stores.database.connection', 'surreal');
+        config()->set('cache.stores.database.lock_connection', 'surreal');
+
+        app()->forgetInstance(SurrealConnection::class);
+        app()->forgetInstance(SurrealRuntimeManager::class);
+        DB::purge('surreal');
+        Cache::forgetDriver('database');
+        app()->forgetInstance('cache');
+        app()->forgetInstance('cache.store');
+        app()->forgetInstance('migration.repository');
+        app()->forgetInstance('migrator');
+
+        expect(Artisan::call('migrate', [
+            '--force' => true,
+            '--realpath' => true,
+            '--path' => database_path('migrations/0001_01_01_000001_create_cache_table.php'),
+        ]))->toBe(0);
+
+        $store = Cache::store('database');
+
+        expect($store->add('login:127.0.0.1', 'first-hit', 60))->toBeTrue()
+            ->and($store->add('login:127.0.0.1', 'second-hit', 60))->toBeFalse()
+            ->and($store->get('login:127.0.0.1'))->toBe('first-hit');
+
+        expect($store->put('login:127.0.0.1', 'updated-hit', 60))->toBeTrue()
+            ->and($store->get('login:127.0.0.1'))->toBe('updated-hit');
+    } finally {
+        config()->set('database.default', $originalDefaultConnection);
+        config()->set('database.migrations.connection', $originalMigrationConnection);
+        config()->set('cache.default', $originalCacheStore);
+        config()->set('cache.stores.database.connection', $originalCacheDatabaseConnection);
+        config()->set('cache.stores.database.lock_connection', $originalCacheLockConnection);
+
+        app()->forgetInstance(SurrealConnection::class);
+        app()->forgetInstance(SurrealRuntimeManager::class);
+        DB::purge('surreal');
+        Cache::forgetDriver('database');
+        app()->forgetInstance('cache');
+        app()->forgetInstance('cache.store');
+        app()->forgetInstance('migration.repository');
+        app()->forgetInstance('migrator');
+
+        if (isset($server['process'])) {
+            $server['process']->stop(1);
+        }
+
+        File::deleteDirectory($storagePath);
+    }
+});
+
+/**
+ * @return array{endpoint: string, port: int, process: Process}
+ */
+function retryStartingSurrealCacheServer(SurrealCliClient $client, string $storagePath, int $attempts = 3): array
+{
+    $httpClient = app(SurrealHttpClient::class);
+
+    for ($attempt = 1; $attempt <= $attempts; $attempt++) {
+        $port = random_int(10240, 65535);
+        $endpoint = sprintf('ws://127.0.0.1:%d', $port);
+        $process = $client->startLocalServer(
+            bindAddress: sprintf('127.0.0.1:%d', $port),
+            datastorePath: $storagePath,
+            username: 'root',
+            password: 'root',
+            storageEngine: 'surrealkv',
+        );
+
+        if ($httpClient->waitUntilReady($endpoint)) {
+            return [
+                'endpoint' => $endpoint,
+                'port' => $port,
+                'process' => $process,
+            ];
+        }
+
+        $process->stop(1);
+    }
+
+    throw new RuntimeException('Unable to start the SurrealDB cache test runtime.');
+}

From b3287ad766cfef132d57e3659aba7363c80fe7d8 Mon Sep 17 00:00:00 2001
From: Derek Bourgeois <dbourgeois23@gmail.com>
Date: Tue, 24 Mar 2026 03:08:11 -0400
Subject: [PATCH 4/6] fix: stabilize fortify auth cache flow

---
 .env.example                                       |  1 +
 .../Surreal/Schema/SurrealSchemaConnection.php     |  8 +++++++-
 config/cache.php                                   | 14 ++++++++++++++
 tests/Feature/DatabaseCacheOnSurrealTest.php       |  3 +++
 tests/Feature/FortifyAuthenticationTest.php        | 10 ++++++++++
 5 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 26d7cac..cca73db 100644
--- a/.env.example
+++ b/.env.example
@@ -38,6 +38,7 @@ FILESYSTEM_DISK=local
 QUEUE_CONNECTION=database
 
 CACHE_STORE=database
+CACHE_LIMITER=file
 # CACHE_PREFIX=
 
 MEMCACHED_HOST=127.0.0.1
diff --git a/app/Services/Surreal/Schema/SurrealSchemaConnection.php b/app/Services/Surreal/Schema/SurrealSchemaConnection.php
index 0fb84b2..fd01e31 100644
--- a/app/Services/Surreal/Schema/SurrealSchemaConnection.php
+++ b/app/Services/Surreal/Schema/SurrealSchemaConnection.php
@@ -384,7 +384,13 @@ public function deleteRecords(string $table, array $wheres = [], ?int $limit = n
         $whereClause = $this->compileWhereClause($table, $wheres);
 
         if ($whereClause === null) {
-            throw new RuntimeException('Surreal deletes without a where clause are not supported by this driver yet.');
+            $query = sprintf(
+                'DELETE %s%s;',
+                $this->normalizeIdentifier($table),
+                $limit !== null ? ' LIMIT '.max(0, $limit) : '',
+            );
+
+            return count($this->normalizeRecordSet(Arr::get($this->runSurrealQuery($query), '0', []), $table));
         }
 
         $query = sprintf(
diff --git a/config/cache.php b/config/cache.php
index c68acdf..b31d488 100644
--- a/config/cache.php
+++ b/config/cache.php
@@ -17,6 +17,20 @@
 
     'default' => env('CACHE_STORE', 'database'),
 
+    /*
+    |--------------------------------------------------------------------------
+    | Rate Limiter Store
+    |--------------------------------------------------------------------------
+    |
+    | Authentication and other throttle middleware should use a cache store
+    | that supports Laravel's atomic limiter operations. The database cache
+    | driver assumes SQL transaction semantics, so Katra defaults limiters to
+    | the file store even when the main cache store is database-backed.
+    |
+    */
+
+    'limiter' => env('CACHE_LIMITER', 'file'),
+
     /*
     |--------------------------------------------------------------------------
     | Cache Stores
diff --git a/tests/Feature/DatabaseCacheOnSurrealTest.php b/tests/Feature/DatabaseCacheOnSurrealTest.php
index 612fd77..a343849 100644
--- a/tests/Feature/DatabaseCacheOnSurrealTest.php
+++ b/tests/Feature/DatabaseCacheOnSurrealTest.php
@@ -71,6 +71,9 @@
 
         expect($store->put('login:127.0.0.1', 'updated-hit', 60))->toBeTrue()
             ->and($store->get('login:127.0.0.1'))->toBe('updated-hit');
+
+        expect($store->flush())->toBeTrue()
+            ->and($store->get('login:127.0.0.1'))->toBeNull();
     } finally {
         config()->set('database.default', $originalDefaultConnection);
         config()->set('database.migrations.connection', $originalMigrationConnection);
diff --git a/tests/Feature/FortifyAuthenticationTest.php b/tests/Feature/FortifyAuthenticationTest.php
index 0774145..b75cfdf 100644
--- a/tests/Feature/FortifyAuthenticationTest.php
+++ b/tests/Feature/FortifyAuthenticationTest.php
@@ -2,6 +2,7 @@
 
 use App\Models\User;
 use Illuminate\Auth\Notifications\ResetPassword;
+use Illuminate\Cache\FileStore;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Notification;
@@ -37,6 +38,15 @@
         ->assertSee('Connect to a server');
 });
 
+test('the login rate limiter uses the file cache store', function () {
+    config([
+        'cache.default' => 'database',
+        'cache.limiter' => 'file',
+    ]);
+
+    expect(cache()->driver(config('cache.limiter'))->getStore())->toBeInstanceOf(FileStore::class);
+});
+
 test('a user can register for a katra account', function () {
     $this->post(route('register'), [
         'first_name' => 'Derek',

From f8c46278135c556d957979216c8500747db6a48b Mon Sep 17 00:00:00 2001
From: Derek Bourgeois <dbourgeois23@gmail.com>
Date: Tue, 24 Mar 2026 03:11:50 -0400
Subject: [PATCH 5/6] docs: simplify local auth migration step

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 7e97057..600fdcb 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ Katra now uses Laravel Fortify for the first authentication foundation.
 - Make sure your local database migrations are current before you try the auth flow:
 
 ```bash
-php artisan migrate --force
+php artisan migrate
 ```
 
 - If you are testing password reset locally and want to inspect the reset link without sending mail, use a local-safe mailer such as `MAIL_MAILER=log`.

From fdf1773ba1c2ae1cb0bf51a61e509725f8867a43 Mon Sep 17 00:00:00 2001
From: Derek Bourgeois <dbourgeois23@gmail.com>
Date: Tue, 24 Mar 2026 03:30:24 -0400
Subject: [PATCH 6/6] fix: tighten fortify review follow-ups

---
 .../Surreal/Query/SurrealQueryBuilder.php     |  2 +-
 .../Schema/SurrealSchemaConnection.php        | 32 +++++++++++++++++++
 tests/Feature/DesktopShellTest.php            |  2 ++
 tests/Unit/SurrealQueryBuilderTest.php        | 19 +++++++++++
 4 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/app/Services/Surreal/Query/SurrealQueryBuilder.php b/app/Services/Surreal/Query/SurrealQueryBuilder.php
index 15d3119..d6ac432 100644
--- a/app/Services/Surreal/Query/SurrealQueryBuilder.php
+++ b/app/Services/Surreal/Query/SurrealQueryBuilder.php
@@ -123,7 +123,7 @@ public function upsert(array $values, array|string $uniqueBy, ?array $update = n
         $uniqueColumns = array_values(Arr::wrap($uniqueBy));
 
         if ($update === []) {
-            return $this->insert($values) ? count($records) : 0;
+            return $this->insertOrIgnore($values);
         }
 
         $updateColumns = $update ?? array_keys($records[0]);
diff --git a/app/Services/Surreal/Schema/SurrealSchemaConnection.php b/app/Services/Surreal/Schema/SurrealSchemaConnection.php
index fd01e31..d1fd438 100644
--- a/app/Services/Surreal/Schema/SurrealSchemaConnection.php
+++ b/app/Services/Surreal/Schema/SurrealSchemaConnection.php
@@ -384,6 +384,21 @@ public function deleteRecords(string $table, array $wheres = [], ?int $limit = n
         $whereClause = $this->compileWhereClause($table, $wheres);
 
         if ($whereClause === null) {
+            if ($limit === null) {
+                $deletedRecords = $this->countRecords($table);
+
+                if ($deletedRecords === 0) {
+                    return 0;
+                }
+
+                $this->runSurrealQuery(sprintf(
+                    'DELETE %s RETURN NONE;',
+                    $this->normalizeIdentifier($table),
+                ));
+
+                return $deletedRecords;
+            }
+
             $query = sprintf(
                 'DELETE %s%s;',
                 $this->normalizeIdentifier($table),
@@ -403,6 +418,23 @@ public function deleteRecords(string $table, array $wheres = [], ?int $limit = n
         return count($this->normalizeRecordSet(Arr::get($this->runSurrealQuery($query), '0', []), $table));
     }
 
+    private function countRecords(string $table): int
+    {
+        $rows = $this->normalizeRecordSet(
+            Arr::get(
+                $this->runSurrealQuery(sprintf(
+                    'SELECT count() AS aggregate FROM %s GROUP ALL;',
+                    $this->normalizeIdentifier($table),
+                )),
+                '0',
+                [],
+            ),
+            columns: ['aggregate'],
+        );
+
+        return (int) ($rows[0]['aggregate'] ?? 0);
+    }
+
     protected function getDefaultSchemaGrammar(): SurrealSchemaGrammar
     {
         return new SurrealSchemaGrammar($this);
diff --git a/tests/Feature/DesktopShellTest.php b/tests/Feature/DesktopShellTest.php
index 81ce659..bc99811 100644
--- a/tests/Feature/DesktopShellTest.php
+++ b/tests/Feature/DesktopShellTest.php
@@ -6,6 +6,8 @@ function desktopShellUser(): User
 {
     return User::factory()->make([
         'id' => 1,
+        'first_name' => 'Derek',
+        'last_name' => 'Bourgeois',
         'name' => 'Derek Bourgeois',
         'email' => 'derek@katra.io',
     ]);
diff --git a/tests/Unit/SurrealQueryBuilderTest.php b/tests/Unit/SurrealQueryBuilderTest.php
index 18c8eff..e172eb6 100644
--- a/tests/Unit/SurrealQueryBuilderTest.php
+++ b/tests/Unit/SurrealQueryBuilderTest.php
@@ -5,6 +5,7 @@
 use Carbon\CarbonImmutable;
 use Illuminate\Database\Query\Expression;
 use Illuminate\Database\Query\Grammars\Grammar;
+use Illuminate\Database\Query\Processors\Processor;
 
 test('single-row inserts can contain array values without being treated as bulk inserts', function () {
     $builder = (new ReflectionClass(SurrealQueryBuilder::class))->newInstanceWithoutConstructor();
@@ -85,3 +86,21 @@
 
     expect($encoded)->toBe("d'2026-03-24T13:15:00+00:00'");
 });
+
+test('upsert with no update columns behaves like insert or ignore', function () {
+    $connection = Mockery::mock(SurrealSchemaConnection::class);
+    $grammar = (new ReflectionClass(Grammar::class))->newInstanceWithoutConstructor();
+    $processor = new Processor;
+
+    $connection->shouldReceive('insertOrIgnoreRecord')
+        ->once()
+        ->with('features', ['name' => 'ui.desktop.mvp-shell'])
+        ->andReturnTrue();
+
+    $builder = new SurrealQueryBuilder($connection, $grammar, $processor);
+    $builder->from('features');
+
+    expect($builder->upsert([
+        'name' => 'ui.desktop.mvp-shell',
+    ], ['name'], []))->toBe(1);
+});