From 06aae0be9df497ebb45d8f4a9507008279e3e16e Mon Sep 17 00:00:00 2001
From: roble <renanroble@gmail.com>
Date: Mon, 27 Jul 2026 11:08:13 +0100
Subject: [PATCH 1/4] feat: update VerifyEmail components and controller for
 improved user messaging

---
 resources/js/react/pages/VerifyEmail.tsx      | 21 ++++++++++++-------
 resources/js/vue/pages/VerifyEmail.vue        | 17 ++++++++-------
 .../Controllers/VerifyEmailController.php     |  3 +++
 3 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/resources/js/react/pages/VerifyEmail.tsx b/resources/js/react/pages/VerifyEmail.tsx
index 4472df5..1e1dcb8 100644
--- a/resources/js/react/pages/VerifyEmail.tsx
+++ b/resources/js/react/pages/VerifyEmail.tsx
@@ -13,17 +13,22 @@ export default function VerifyEmail() {
     };
 
     return (
-        <AuthCardLayout
-            title={t('Email Verification')}
-            description={t(
-                "Thanks for signing up! Before getting started, could you verify your email address by clicking on the link we just emailed to you? If you didn't receive the email, we will gladly send you another.",
-            )}
-        >
+        <AuthCardLayout title={t('We are glad you signed up!')}>
             <form
                 onSubmit={handleSubmit}
-                className="min-w-sm space-y-3"
+                className="min-w-sm max-w-md space-y-3 text-center"
                 data-testid="verify-email-form"
             >
+                <p className="mb-3 leading-relaxed text-gray-600 dark:text-gray-400">
+                    {t(
+                        'Before getting started, could you verify your email address by clicking on the link we just emailed to you?',
+                    )}
+                </p>
+                <p className="mb-10 leading-relaxed text-gray-600 dark:text-gray-400">
+                    {t(
+                        'If you did not receive the email, you can click the button below to request another.',
+                    )}
+                </p>
                 <Button type="submit" className="w-full" disabled={processing}>
                     {t('Resend Verification Email')}
                 </Button>
@@ -33,7 +38,7 @@ export default function VerifyEmail() {
                         href={route('logout')}
                         method="post"
                         as="button"
-                        className="text-primary/70 cursor-pointer font-medium underline-offset-4 hover:underline"
+                        className="text-primary cursor-pointer font-medium underline-offset-4 hover:underline"
                         data-testid="logout-link"
                     >
                         {t('Log Out')}
diff --git a/resources/js/vue/pages/VerifyEmail.vue b/resources/js/vue/pages/VerifyEmail.vue
index 42ccf93..cab3e46 100644
--- a/resources/js/vue/pages/VerifyEmail.vue
+++ b/resources/js/vue/pages/VerifyEmail.vue
@@ -6,20 +6,21 @@ import AuthCardLayout from '../layouts/AuthCardLayout.vue';
 
 <template>
     <AuthCardLayout
-        :title="$t('Email Verification')"
-        :description="
-            $t(
-                'Thanks for signing up! Before getting started, could you verify your email address by clicking on the link we just emailed to you? If you didn\'t receive the email, we will gladly send you another.',
-            )
-        "
+        :title="$t('We are glad you signed up!')"
     >
         <Form
             :action="route('verification.send')"
             method="post"
-            class="min-w-sm space-y-3"
+            class="min-w-sm max-w-md space-y-3 text-center"
             data-testid="verify-email-form"
             disable-while-processing
         >
+        <p class="mb-3 leading-relaxed text-gray-600 dark:text-gray-400">
+            {{ $t('Before getting started, could you verify your email address by clicking on the link we just emailed to you?') }}
+        </p>
+        <p class="mb-10 leading-relaxed text-gray-600 dark:text-gray-400">
+            {{ $t('If you did not receive the email, you can click the button below to request another.') }}
+        </p>
             <Button type="submit" class="w-full">
                 {{ $t('Resend Verification Email') }}
             </Button>
@@ -31,7 +32,7 @@ import AuthCardLayout from '../layouts/AuthCardLayout.vue';
                     :href="route('logout')"
                     method="post"
                     as="button"
-                    class="text-primary/70 cursor-pointer font-medium underline-offset-4 hover:underline"
+                    class="text-primary cursor-pointer font-medium underline-offset-4 hover:underline"
                     data-testid="logout-link"
                 >
                     {{ $t('Log Out') }}
diff --git a/src/Http/Controllers/VerifyEmailController.php b/src/Http/Controllers/VerifyEmailController.php
index 3ec7095..ba2bdce 100644
--- a/src/Http/Controllers/VerifyEmailController.php
+++ b/src/Http/Controllers/VerifyEmailController.php
@@ -2,6 +2,7 @@
 
 namespace Modules\Auth\Http\Controllers;
 
+use App\Helpers\Toast;
 use App\Models\User;
 use Illuminate\Auth\Events\Verified;
 use Illuminate\Contracts\Auth\MustVerifyEmail;
@@ -25,6 +26,8 @@ public function __invoke(EmailVerificationRequest $request): RedirectResponse
 
         if ($user->markEmailAsVerified()) {
             event(new Verified($user));
+
+            Toast::success(__('Email verified'), __('Your email address has been confirmed.'));
         }
 
         return redirect()->intended(route('dashboard', absolute: false).'?verified=1');

From c54612e73b6cf7d29a1804a6f64f72af37e03fe9 Mon Sep 17 00:00:00 2001
From: roble <renanroble@gmail.com>
Date: Fri, 7 Aug 2026 17:25:16 +0100
Subject: [PATCH 2/4] feat: implement magic link authentication settings and
 refactor related components

---
 CLAUDE.md                                     |  12 +-
 config/config.php                             |  20 ----
 ...2026_07_30_160000_create_auth_settings.php |  12 ++
 resources/js/react/layouts/AuthCardLayout.tsx |  63 +++-------
 resources/js/react/pages/Register.tsx         |   2 +-
 resources/js/react/pages/VerifyEmail.tsx      |   2 +-
 resources/js/vue/app.ts                       |   2 +-
 resources/js/vue/layouts/AuthCardLayout.vue   |  70 +++--------
 resources/js/vue/pages/Register.vue           |   5 +-
 resources/js/vue/pages/VerifyEmail.vue        |  26 ++--
 src/Filament/Pages/AuthenticationSettings.php |  52 ++++++++
 src/Http/Controllers/MagicLinkController.php  |  10 +-
 .../Middleware/EnsureMagicLinkEnabled.php     |   5 +-
 src/Notifications/MagicLinkNotification.php   |   7 +-
 src/Providers/AuthServiceProvider.php         |   6 +-
 src/Settings/AuthSettings.php                 |  17 +++
 tests/Feature/AuthSettingsTest.php            |  20 ++++
 .../AuthenticationSettingsPageTest.php        | 112 ++++++++++++++++++
 tests/Feature/LoginTest.php                   |  14 +++
 tests/Feature/MagicLinkTest.php               |  50 +++++++-
 .../magic-link/magic-link.config.spec.ts      |  28 -----
 .../magic-link/magic-link.settings.spec.ts    |  52 ++++++++
 22 files changed, 414 insertions(+), 173 deletions(-)
 delete mode 100644 config/config.php
 create mode 100644 database/settings/2026_07_30_160000_create_auth_settings.php
 create mode 100644 src/Filament/Pages/AuthenticationSettings.php
 create mode 100644 src/Settings/AuthSettings.php
 create mode 100644 tests/Feature/AuthSettingsTest.php
 create mode 100644 tests/Feature/AuthenticationSettingsPageTest.php
 delete mode 100644 tests/e2e/tests/magic-link/magic-link.config.spec.ts
 create mode 100644 tests/e2e/tests/magic-link/magic-link.settings.spec.ts

diff --git a/CLAUDE.md b/CLAUDE.md
index 3eb07a7..1c4b260 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -12,9 +12,10 @@ Authentication, registration, magic link (passwordless), password reset, email v
 | Requests | `LoginRequest` (credential validation + rate limiting), `RegisterRequest` (password hashing in `passedValidation`) |
 | Exceptions | `AuthException` (credentials, throttle), `SocialiteException` (disconnect, account linking, provider validation) |
 | Listeners | `AssignUserRole` (Registered), `UpdateUserLastLogin` (Login), `Impersonation` (TakeImpersonation — session history) |
-| Notifications | `WelcomeNotification` (Registered), `MagicLinkNotification` (passwordless login link, 15-min expiry) |
+| Notifications | `WelcomeNotification` (Registered), `MagicLinkNotification` (passwordless login link with configured expiry) |
+| Settings | `AuthSettings` (`magic_link_enabled`, `magic_link_expiry`) |
 | Trait | `Sociable` — added to User model (socialAccounts relation, connected_providers, disconnect) |
-| Filament | `AuthPlugin`, `UserResource` (list, create, view, edit), `UserForm`, `UsersTable` |
+| Filament | `AuthPlugin`, `AuthenticationSettings`, `UserResource` (list, create, view, edit), `UserForm`, `UsersTable` |
 | Pages | `Login`, `Register`, `ForgotPassword`, `ResetPassword`, `VerifyEmail`, `MagicLink` |
 | Layout | `AuthCardLayout` — card with logo, status alerts, page transitions |
 | Component | `SocialiteProviders` — Google/GitHub buttons with divider |
@@ -60,10 +61,15 @@ Also prevents account takeover: linking a social ID already owned by another use
 Uses `lab404/laravel-impersonate` + `filament-impersonate`. Session stores history at `impersonation.recent_history` (max 4 user IDs). `ReimpersonateController` lets admins re-impersonate from recent list (max 3 shown in UI, filters deleted users and self). Stop via `filament-impersonate.leave` route.
 
 ### Magic Link Flow
-`MagicLinkController::store()` silently finds the user by email (no error on unknown email). If found: deletes existing tokens for that user, creates a new `MagicLinkToken` (token = SHA-256 hash of `Str::random(64)`, expires in 15 min), and sends `MagicLinkNotification` with the plain-token URL.
+`MagicLinkController::store()` silently finds the user by email (no error on unknown email). If found: deletes existing tokens for that user, creates a new `MagicLinkToken` (token = SHA-256 hash of `Str::random(64)`, expiry controlled by `AuthSettings`), and sends `MagicLinkNotification` with the plain-token URL.
 
 `MagicLinkController::authenticate()` hashes the incoming token, looks it up, calls `isValid()` (not expired + not used), logs in the user, marks the token used, and redirects to intended URL or dashboard.
 
+`AuthSettings` is auto-discovered from `src/Settings`, with defaults installed
+from `database/settings`. Magic links are enabled by default with a 15-minute
+expiry. Administrators manage both values through the `AuthenticationSettings`
+Filament page under the Settings navigation group.
+
 **Token storage:** Plain token only lives in the email link. DB stores `hash('sha256', $plainToken)`. This means even if the DB is compromised, tokens cannot be forged or replayed.
 
 ### Logout Action Handler
diff --git a/config/config.php b/config/config.php
deleted file mode 100644
index d1aaae6..0000000
--- a/config/config.php
+++ /dev/null
@@ -1,20 +0,0 @@
-<?php
-
-return [
-
-    /*
-    |--------------------------------------------------------------------------
-    | Magic Link Authentication
-    |--------------------------------------------------------------------------
-    |
-    | When enabled, users can log in without a password by requesting a
-    | one-time link sent to their email address.
-    |
-    */
-
-    'magic_link' => [
-        'enabled' => env('AUTH_MAGIC_LINK_ENABLED', true),
-        'expiry' => env('AUTH_MAGIC_LINK_EXPIRY', 15), // minutes
-    ],
-
-];
diff --git a/database/settings/2026_07_30_160000_create_auth_settings.php b/database/settings/2026_07_30_160000_create_auth_settings.php
new file mode 100644
index 0000000..b82be70
--- /dev/null
+++ b/database/settings/2026_07_30_160000_create_auth_settings.php
@@ -0,0 +1,12 @@
+<?php
+
+use Spatie\LaravelSettings\Migrations\SettingsMigration;
+
+return new class extends SettingsMigration
+{
+    public function up(): void
+    {
+        $this->migrator->add('auth.magic_link_enabled', true);
+        $this->migrator->add('auth.magic_link_expiry', 15);
+    }
+};
diff --git a/resources/js/react/layouts/AuthCardLayout.tsx b/resources/js/react/layouts/AuthCardLayout.tsx
index 132efc8..cf1c212 100644
--- a/resources/js/react/layouts/AuthCardLayout.tsx
+++ b/resources/js/react/layouts/AuthCardLayout.tsx
@@ -1,14 +1,4 @@
-import AlertMessage from '@/components/AlertMessage';
-import AppLogo from '@/components/AppLogo';
-import Footer from '@/components/Footer';
-import {
-    Card,
-    CardContent,
-    CardDescription,
-    CardHeader,
-    CardTitle,
-} from '@/components/ui/card';
-import { Head, Link, usePage } from '@inertiajs/react';
+import CardLayout from '@/layouts/CardLayout';
 import type { ReactNode } from 'react';
 
 interface AuthCardLayoutProps {
@@ -19,6 +9,13 @@ interface AuthCardLayoutProps {
     outside?: ReactNode;
 }
 
+/**
+ * The auth module's name for the shared centred-card layout.
+ *
+ * The presentation moved to core so that naming a workspace looks like signing up rather
+ * than like a different product. This wrapper stays so the module's pages keep their own
+ * vocabulary, and so anything auth-specific has an obvious home later.
+ */
 export default function AuthCardLayout({
     title,
     description,
@@ -26,42 +23,14 @@ export default function AuthCardLayout({
     children,
     outside,
 }: AuthCardLayoutProps) {
-    const page = usePage();
-    const status = page.props.status as string | undefined;
-    const error = page.props.error as string | undefined;
-
     return (
-        <div className="flex min-h-dvh flex-col items-center gap-6">
-            <div className="mt-6">
-                <Head title={title} />
-                <Link href={route('index')} className="mt-6 font-medium">
-                    <AppLogo size="md" showText={true} />
-                </Link>
-            </div>
-
-            <div className="flex w-full grow flex-col items-center">
-                <div className="w-full px-4 min-[450px]:w-auto min-[450px]:min-w-md min-[450px]:px-0">
-                    <Card className={cardClass}>
-                        <CardHeader className="px-8 text-center">
-                            <CardTitle className="text-2xl">{title}</CardTitle>
-                            <CardDescription>{description}</CardDescription>
-                        </CardHeader>
-                        <CardContent className="px-8">
-                            {status || error ? (
-                                <div data-testid="alert">
-                                    <AlertMessage
-                                        message={status || error}
-                                        variant={status ? 'success' : 'error'}
-                                    />
-                                </div>
-                            ) : null}
-                            {children}
-                        </CardContent>
-                    </Card>
-                </div>
-                {outside}
-            </div>
-            <Footer />
-        </div>
+        <CardLayout
+            title={title}
+            description={description}
+            cardClass={cardClass}
+            outside={outside}
+        >
+            {children}
+        </CardLayout>
     );
 }
diff --git a/resources/js/react/pages/Register.tsx b/resources/js/react/pages/Register.tsx
index 6612f6b..4971378 100644
--- a/resources/js/react/pages/Register.tsx
+++ b/resources/js/react/pages/Register.tsx
@@ -140,7 +140,7 @@ export default function Register() {
                     />
                     <FieldLabel
                         htmlFor="terms"
-                        className="text-sm font-normal leading-snug"
+                        className="text-sm leading-snug font-normal"
                     >
                         {t('I agree to the')}{' '}
                         <Link
diff --git a/resources/js/react/pages/VerifyEmail.tsx b/resources/js/react/pages/VerifyEmail.tsx
index 1e1dcb8..065805b 100644
--- a/resources/js/react/pages/VerifyEmail.tsx
+++ b/resources/js/react/pages/VerifyEmail.tsx
@@ -16,7 +16,7 @@ export default function VerifyEmail() {
         <AuthCardLayout title={t('We are glad you signed up!')}>
             <form
                 onSubmit={handleSubmit}
-                className="min-w-sm max-w-md space-y-3 text-center"
+                className="max-w-md min-w-sm space-y-3 text-center"
                 data-testid="verify-email-form"
             >
                 <p className="mb-3 leading-relaxed text-gray-600 dark:text-gray-400">
diff --git a/resources/js/vue/app.ts b/resources/js/vue/app.ts
index 14edbcc..ac952b9 100644
--- a/resources/js/vue/app.ts
+++ b/resources/js/vue/app.ts
@@ -2,9 +2,9 @@ import { useDialog } from '@/composables/useDialog';
 import { registerGlobalComponent } from '@/lib/globalComponents';
 import { registerAction, registerIcon } from '@/lib/navigation';
 import { router } from '@inertiajs/vue3';
+import { LogOut } from '@lucide/vue';
 import '@modules/auth/resources/css/style.css';
 import { trans } from 'laravel-vue-i18n';
-import { LogOut } from '@lucide/vue';
 import IconLogOut from '~icons/lucide/log-out';
 import ImpersonationAlert from './components/ImpersonationAlert.vue';
 
diff --git a/resources/js/vue/layouts/AuthCardLayout.vue b/resources/js/vue/layouts/AuthCardLayout.vue
index 8f1d4cf..5bf2ef8 100644
--- a/resources/js/vue/layouts/AuthCardLayout.vue
+++ b/resources/js/vue/layouts/AuthCardLayout.vue
@@ -1,18 +1,13 @@
 <script setup lang="ts">
-import {
-    Card,
-    CardContent,
-    CardDescription,
-    CardHeader,
-    CardTitle,
-} from '@/components/ui/card';
-
-import AlertMessage from '@/components/AlertMessage.vue';
-import AppLogo from '@/components/AppLogo.vue';
-import Footer from '@/components/Footer.vue';
-import PageTransition from '@/components/PageTransition.vue';
-import { Head, Link } from '@inertiajs/vue3';
+import CardLayout from '@/layouts/CardLayout.vue';
 
+/**
+ * The auth module's name for the shared centred-card layout.
+ *
+ * The presentation moved to core so that naming a workspace looks like signing up rather
+ * than like a different product. This wrapper stays so the module's pages keep their own
+ * vocabulary, and so anything auth-specific has an obvious home later.
+ */
 defineProps<{
     title?: string;
     description?: string;
@@ -21,46 +16,15 @@ defineProps<{
 </script>
 
 <template>
-    <div class="flex min-h-dvh flex-col items-center gap-6">
-        <div class="mt-6">
-            <Head :title="title" />
-            <Link :href="route('index')" class="mt-6 font-medium">
-                <AppLogo size="md" :showText="true" />
-            </Link>
-        </div>
+    <CardLayout
+        :title="title"
+        :description="description"
+        :card-class="cardClass"
+    >
+        <slot />
 
-        <div class="flex w-full grow flex-col items-center">
-            <div
-                class="w-full px-4 min-[450px]:w-auto min-[450px]:min-w-md min-[450px]:px-0"
-            >
-                <Card :class="cardClass">
-                    <CardHeader class="px-8 text-center">
-                        <CardTitle class="text-2xl">
-                            {{ title }}
-                        </CardTitle>
-                        <CardDescription>
-                            {{ description }}
-                        </CardDescription>
-                    </CardHeader>
-                    <CardContent class="px-8">
-                        <PageTransition>
-                            <AlertMessage
-                                :message="
-                                    $page.props.status || $page.props.error
-                                "
-                                :variant="
-                                    $page.props.status ? 'success' : 'error'
-                                "
-                                class="mt-4"
-                                data-testid="alert"
-                            />
-                            <slot />
-                        </PageTransition>
-                    </CardContent>
-                </Card>
-            </div>
+        <template #outside>
             <slot name="outside" />
-        </div>
-        <Footer class="mt-16 w-full pt-8" />
-    </div>
+        </template>
+    </CardLayout>
 </template>
diff --git a/resources/js/vue/pages/Register.vue b/resources/js/vue/pages/Register.vue
index 36eac09..547de3d 100644
--- a/resources/js/vue/pages/Register.vue
+++ b/resources/js/vue/pages/Register.vue
@@ -84,7 +84,10 @@ const canSubmit = computed(
                     :aria-invalid="!!termsError"
                     v-model="termsRef"
                 />
-                <FieldLabel for="terms" class="text-sm font-normal leading-snug">
+                <FieldLabel
+                    for="terms"
+                    class="text-sm leading-snug font-normal"
+                >
                     {{ $t('I agree to the') }}
                     <Link
                         :href="route('terms')"
diff --git a/resources/js/vue/pages/VerifyEmail.vue b/resources/js/vue/pages/VerifyEmail.vue
index cab3e46..b2a3a6f 100644
--- a/resources/js/vue/pages/VerifyEmail.vue
+++ b/resources/js/vue/pages/VerifyEmail.vue
@@ -5,22 +5,28 @@ import AuthCardLayout from '../layouts/AuthCardLayout.vue';
 </script>
 
 <template>
-    <AuthCardLayout
-        :title="$t('We are glad you signed up!')"
-    >
+    <AuthCardLayout :title="$t('We are glad you signed up!')">
         <Form
             :action="route('verification.send')"
             method="post"
-            class="min-w-sm max-w-md space-y-3 text-center"
+            class="max-w-md min-w-sm space-y-3 text-center"
             data-testid="verify-email-form"
             disable-while-processing
         >
-        <p class="mb-3 leading-relaxed text-gray-600 dark:text-gray-400">
-            {{ $t('Before getting started, could you verify your email address by clicking on the link we just emailed to you?') }}
-        </p>
-        <p class="mb-10 leading-relaxed text-gray-600 dark:text-gray-400">
-            {{ $t('If you did not receive the email, you can click the button below to request another.') }}
-        </p>
+            <p class="mb-3 leading-relaxed text-gray-600 dark:text-gray-400">
+                {{
+                    $t(
+                        'Before getting started, could you verify your email address by clicking on the link we just emailed to you?',
+                    )
+                }}
+            </p>
+            <p class="mb-10 leading-relaxed text-gray-600 dark:text-gray-400">
+                {{
+                    $t(
+                        'If you did not receive the email, you can click the button below to request another.',
+                    )
+                }}
+            </p>
             <Button type="submit" class="w-full">
                 {{ $t('Resend Verification Email') }}
             </Button>
diff --git a/src/Filament/Pages/AuthenticationSettings.php b/src/Filament/Pages/AuthenticationSettings.php
new file mode 100644
index 0000000..85ec582
--- /dev/null
+++ b/src/Filament/Pages/AuthenticationSettings.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Auth\Filament\Pages;
+
+use App\Filament\Pages\SettingsPage;
+use BackedEnum;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Modules\Auth\Settings\AuthSettings;
+
+class AuthenticationSettings extends SettingsPage
+{
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedKey;
+
+    protected static ?int $navigationSort = 2;
+
+    protected static string $settings = AuthSettings::class;
+
+
+    public static function getNavigationLabel(): string
+    {
+        return __('Authentication');
+    }
+
+    public function getTitle(): string
+    {
+        return __('Authentication Settings');
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema->columns(1)->components([
+            Section::make(__('Magic Link Authentication'))
+                ->description(__('Configure passwordless authentication by email.'))
+                ->icon(Heroicon::OutlinedKey)
+                ->schema([
+                    Toggle::make('magic_link_enabled')
+                        ->label(__('Enable magic link authentication')),
+                    TextInput::make('magic_link_expiry')
+                        ->label(__('Link expiry'))
+                        ->integer()
+                        ->required()
+                        ->minValue(1)
+                        ->suffix(__('minutes')),
+                ])
+                ->columns(1),
+        ]);
+    }
+}
diff --git a/src/Http/Controllers/MagicLinkController.php b/src/Http/Controllers/MagicLinkController.php
index 03c6ad8..2989b8b 100644
--- a/src/Http/Controllers/MagicLinkController.php
+++ b/src/Http/Controllers/MagicLinkController.php
@@ -15,9 +15,12 @@
 use Modules\Auth\Http\Middleware\EnsureMagicLinkEnabled;
 use Modules\Auth\Models\MagicLinkToken;
 use Modules\Auth\Notifications\MagicLinkNotification;
+use Modules\Auth\Settings\AuthSettings;
 
 class MagicLinkController extends Controller implements HasMiddleware
 {
+    public function __construct(private readonly AuthSettings $settings) {}
+
     public static function middleware(): array
     {
         return [
@@ -53,7 +56,7 @@ public function store(Request $request): RedirectResponse
                 ['user_id' => $user->id],
                 [
                     'token' => hash('sha256', $plainToken),
-                    'expires_at' => now()->addMinutes(config('auth.magic_link.expiry', 15)),
+                    'expires_at' => now()->addMinutes($this->settings->magic_link_expiry),
                     'used_at' => null,
                 ]
             );
@@ -64,7 +67,10 @@ public function store(Request $request): RedirectResponse
                 $url .= '?intended='.urlencode($request->session()->get('url.intended'));
             }
 
-            $user->notify(new MagicLinkNotification($url));
+            $user->notify(new MagicLinkNotification(
+                url: $url,
+                expiry: $this->settings->magic_link_expiry,
+            ));
         }
 
         return back()->with('status', __('auth::auth.magic-link-sent'));
diff --git a/src/Http/Middleware/EnsureMagicLinkEnabled.php b/src/Http/Middleware/EnsureMagicLinkEnabled.php
index 4ecf306..02fe6e2 100644
--- a/src/Http/Middleware/EnsureMagicLinkEnabled.php
+++ b/src/Http/Middleware/EnsureMagicLinkEnabled.php
@@ -4,12 +4,15 @@
 
 use Closure;
 use Illuminate\Http\Request;
+use Modules\Auth\Settings\AuthSettings;
 
 class EnsureMagicLinkEnabled
 {
+    public function __construct(private readonly AuthSettings $settings) {}
+
     public function handle(Request $request, Closure $next): mixed
     {
-        abort_unless(config('auth.magic_link.enabled', true), 404);
+        abort_unless($this->settings->magic_link_enabled, 404);
 
         return $next($request);
     }
diff --git a/src/Notifications/MagicLinkNotification.php b/src/Notifications/MagicLinkNotification.php
index 1fb2cba..a851db4 100644
--- a/src/Notifications/MagicLinkNotification.php
+++ b/src/Notifications/MagicLinkNotification.php
@@ -10,7 +10,10 @@ class MagicLinkNotification extends Notification
 {
     use Queueable;
 
-    public function __construct(public string $url) {}
+    public function __construct(
+        public string $url,
+        public int $expiry,
+    ) {}
 
     /**
      * Get the notification's delivery channels.
@@ -31,7 +34,7 @@ public function toMail(object $notifiable): MailMessage
             ->subject(__('Your magic login link for :app', ['app' => config('app.name')]))
             ->greeting(__('Hello :name,', ['name' => $notifiable->name]))
             ->line(__('Click the button below to log in. This link expires in :expiry and can only be used once.', [
-                'expiry' => trans_choice(':count minute|:count minutes', config('auth.magic_link.expiry', 15)),
+                'expiry' => trans_choice(':count minute|:count minutes', $this->expiry),
             ]))
             ->action(__('Log in'), $this->url)
             ->line(__('If you did not request this link, you can safely ignore this email.'));
diff --git a/src/Providers/AuthServiceProvider.php b/src/Providers/AuthServiceProvider.php
index 54f703b..e91e846 100644
--- a/src/Providers/AuthServiceProvider.php
+++ b/src/Providers/AuthServiceProvider.php
@@ -7,6 +7,7 @@
 use Filament\Facades\Filament;
 use Illuminate\Support\Facades\Auth;
 use Inertia\Inertia;
+use Modules\Auth\Settings\AuthSettings;
 use Spatie\Permission\Models\Role;
 use STS\FilamentImpersonate\ImpersonateManager;
 
@@ -19,7 +20,10 @@ protected function shareInertiaData(): void
     {
         Inertia::share('auth.user', fn () => Auth::user());
         Inertia::share('auth.last_social_provider', fn () => request()->cookie('last_social_provider'));
-        Inertia::share('auth.magic_link_enabled', fn () => config('auth.magic_link.enabled', true));
+        Inertia::share(
+            'auth.magic_link_enabled',
+            fn (): bool => $this->app->make(AuthSettings::class)->magic_link_enabled,
+        );
 
         Inertia::share('impersonation', function () {
             if (! $this->isUserImpersonated()) {
diff --git a/src/Settings/AuthSettings.php b/src/Settings/AuthSettings.php
new file mode 100644
index 0000000..974634c
--- /dev/null
+++ b/src/Settings/AuthSettings.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Auth\Settings;
+
+use Spatie\LaravelSettings\Settings;
+
+class AuthSettings extends Settings
+{
+    public bool $magic_link_enabled;
+
+    public int $magic_link_expiry;
+
+    public static function group(): string
+    {
+        return 'auth';
+    }
+}
diff --git a/tests/Feature/AuthSettingsTest.php b/tests/Feature/AuthSettingsTest.php
new file mode 100644
index 0000000..41f98fe
--- /dev/null
+++ b/tests/Feature/AuthSettingsTest.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Auth\Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Modules\Auth\Settings\AuthSettings;
+use Tests\TestCase;
+
+class AuthSettingsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_fresh_install_has_magic_link_defaults(): void
+    {
+        $settings = app(AuthSettings::class);
+
+        $this->assertTrue($settings->magic_link_enabled);
+        $this->assertSame(15, $settings->magic_link_expiry);
+    }
+}
diff --git a/tests/Feature/AuthenticationSettingsPageTest.php b/tests/Feature/AuthenticationSettingsPageTest.php
new file mode 100644
index 0000000..490c28e
--- /dev/null
+++ b/tests/Feature/AuthenticationSettingsPageTest.php
@@ -0,0 +1,112 @@
+<?php
+
+namespace Modules\Auth\Tests\Feature;
+
+use App\Enums\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+use Modules\Auth\Filament\Pages\AuthenticationSettings;
+use Modules\Auth\Settings\AuthSettings;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Tests\TestCase;
+
+class AuthenticationSettingsPageTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_administrator_can_load_authentication_settings_form(): void
+    {
+        $admin = User::factory()->create();
+        $admin->assignRole(Role::ADMIN);
+
+        $this->actingAs($admin);
+
+        $this->get(AuthenticationSettings::getUrl(panel: 'admin'))
+            ->assertOk();
+
+        Livewire::test(AuthenticationSettings::class)
+            ->assertFormSet([
+                'magic_link_enabled' => true,
+                'magic_link_expiry' => 15,
+            ]);
+    }
+
+    public function test_administrator_can_save_authentication_settings(): void
+    {
+        $admin = User::factory()->create();
+        $admin->assignRole(Role::ADMIN);
+
+        $this->actingAs($admin);
+
+        Livewire::test(AuthenticationSettings::class)
+            ->fillForm([
+                'magic_link_enabled' => false,
+                'magic_link_expiry' => 30,
+            ])
+            ->call('save')
+            ->assertHasNoFormErrors()
+            ->assertNotified();
+
+        $settings = new AuthSettings();
+
+        $this->assertFalse($settings->magic_link_enabled);
+        $this->assertSame(30, $settings->magic_link_expiry);
+    }
+
+    #[DataProvider('invalidExpiryProvider')]
+    public function test_invalid_expiry_does_not_change_authentication_settings(
+        mixed $expiry,
+        string $rule,
+    ): void {
+        $admin = User::factory()->create();
+        $admin->assignRole(Role::ADMIN);
+
+        $this->actingAs($admin);
+
+        Livewire::test(AuthenticationSettings::class)
+            ->fillForm([
+                'magic_link_enabled' => false,
+                'magic_link_expiry' => $expiry,
+            ])
+            ->call('save')
+            ->assertHasFormErrors(['magic_link_expiry' => $rule])
+            ->assertNotNotified();
+
+        $settings = new AuthSettings();
+
+        $this->assertTrue($settings->magic_link_enabled);
+        $this->assertSame(15, $settings->magic_link_expiry);
+    }
+
+    /**
+     * @return array<string, array{expiry: mixed, rule: string}>
+     */
+    public static function invalidExpiryProvider(): array
+    {
+        return [
+            'expiry is required' => [
+                'expiry' => null,
+                'rule' => 'required',
+            ],
+            'expiry must be an integer' => [
+                'expiry' => 'fifteen',
+                'rule' => 'integer',
+            ],
+            'expiry must be positive' => [
+                'expiry' => 0,
+                'rule' => 'min',
+            ],
+        ];
+    }
+
+    public function test_regular_user_cannot_access_authentication_settings_page(): void
+    {
+        $user = User::factory()->create();
+        $user->assignRole(Role::USER);
+
+        $this->actingAs($user)
+            ->get(AuthenticationSettings::getUrl(panel: 'admin'))
+            ->assertForbidden();
+    }
+}
diff --git a/tests/Feature/LoginTest.php b/tests/Feature/LoginTest.php
index 6574ea2..da90cbf 100644
--- a/tests/Feature/LoginTest.php
+++ b/tests/Feature/LoginTest.php
@@ -5,6 +5,8 @@
 use Illuminate\Auth\Events\Lockout;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Event;
+use Inertia\Testing\AssertableInertia;
+use Modules\Auth\Settings\AuthSettings;
 use Tests\TestCase;
 
 class LoginTest extends TestCase
@@ -18,6 +20,18 @@ public function test_login_page_renders_for_guests(): void
         $response->assertStatus(200);
     }
 
+    public function test_login_page_receives_magic_link_availability_from_auth_settings(): void
+    {
+        $settings = app(AuthSettings::class);
+        $settings->magic_link_enabled = false;
+        $settings->save();
+
+        $this->get(route('login'))
+            ->assertInertia(fn (AssertableInertia $page): AssertableInertia => $page
+                ->where('auth.magic_link_enabled', false)
+            );
+    }
+
     public function test_authenticated_user_is_redirected_from_login(): void
     {
         $user = $this->createUser();
diff --git a/tests/Feature/MagicLinkTest.php b/tests/Feature/MagicLinkTest.php
index d15b6c5..f5d3566 100644
--- a/tests/Feature/MagicLinkTest.php
+++ b/tests/Feature/MagicLinkTest.php
@@ -7,6 +7,7 @@
 use Illuminate\Support\Str;
 use Modules\Auth\Models\MagicLinkToken;
 use Modules\Auth\Notifications\MagicLinkNotification;
+use Modules\Auth\Settings\AuthSettings;
 use Tests\TestCase;
 
 class MagicLinkTest extends TestCase
@@ -155,6 +156,49 @@ public function test_old_tokens_are_deleted_when_new_one_is_requested(): void
         $this->assertDatabaseCount('magic_link_tokens', 1);
     }
 
+    public function test_auth_settings_control_magic_link_expiry(): void
+    {
+        Notification::fake();
+
+        $settings = app(AuthSettings::class);
+        $settings->magic_link_expiry = 30;
+        $settings->save();
+
+        $now = now()->startOfSecond();
+        $this->travelTo($now);
+
+        $user = $this->createUser();
+
+        $this->post(route('magic-link.store'), ['email' => $user->email]);
+
+        $token = MagicLinkToken::whereBelongsTo($user)->sole();
+
+        $this->assertTrue($token->expires_at->equalTo($now->copy()->addMinutes(30)));
+    }
+
+    public function test_magic_link_notification_uses_the_configured_expiry(): void
+    {
+        Notification::fake();
+
+        $settings = app(AuthSettings::class);
+        $settings->magic_link_expiry = 30;
+        $settings->save();
+
+        $user = $this->createUser();
+
+        $this->post(route('magic-link.store'), ['email' => $user->email]);
+
+        Notification::assertSentTo(
+            $user,
+            MagicLinkNotification::class,
+            fn (MagicLinkNotification $notification): bool => in_array(
+                'Click the button below to log in. This link expires in 30 minutes and can only be used once.',
+                $notification->toMail($user)->introLines,
+                true,
+            ),
+        );
+    }
+
     public function test_intended_redirect_is_accepted_for_same_host(): void
     {
         $user = $this->createUser();
@@ -193,9 +237,11 @@ public function test_open_redirect_is_rejected_for_external_url(): void
         $response->assertRedirect(route('dashboard'));
     }
 
-    public function test_magic_link_is_disabled_when_config_is_false(): void
+    public function test_magic_link_is_disabled_by_auth_settings(): void
     {
-        config(['auth.magic_link.enabled' => false]);
+        $settings = app(AuthSettings::class);
+        $settings->magic_link_enabled = false;
+        $settings->save();
 
         $this->get(route('magic-link.create'))->assertStatus(404);
         $this->post(route('magic-link.store'), ['email' => 'test@example.com'])->assertStatus(404);
diff --git a/tests/e2e/tests/magic-link/magic-link.config.spec.ts b/tests/e2e/tests/magic-link/magic-link.config.spec.ts
deleted file mode 100644
index 579818a..0000000
--- a/tests/e2e/tests/magic-link/magic-link.config.spec.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { test, expect } from '@e2e/fixtures';
-import { LoginPage } from '../../pages/LoginPage';
-
-test.describe('Magic Link Config', () => {
-    test('magic link page returns 404 when feature is disabled', async ({
-        page,
-        laravel,
-    }) => {
-        await laravel.config('auth.magic_link.enabled', false);
-
-        const response = await page.goto('/auth/magic-link');
-
-        expect(response?.status()).toBe(404);
-    });
-
-    test('magic link is hidden on login page when feature is disabled', async ({
-        page,
-        laravel,
-    }) => {
-        await laravel.config('auth.magic_link.enabled', false);
-
-        const loginPage = new LoginPage(page);
-        await loginPage.goto();
-        await loginPage.expectToBeVisible();
-
-        await expect(page.getByTestId('magic-link-login-link')).not.toBeVisible();
-    });
-});
diff --git a/tests/e2e/tests/magic-link/magic-link.settings.spec.ts b/tests/e2e/tests/magic-link/magic-link.settings.spec.ts
new file mode 100644
index 0000000..b7af6e1
--- /dev/null
+++ b/tests/e2e/tests/magic-link/magic-link.settings.spec.ts
@@ -0,0 +1,52 @@
+import { expect, test } from '@e2e/fixtures';
+import { LoginPage } from '../../pages/LoginPage';
+
+test.describe('Magic Link Settings', () => {
+    test.describe.configure({ mode: 'serial' });
+
+    test('magic link page returns 404 when feature is disabled', async ({
+        page,
+        laravel,
+    }) => {
+        await laravel.query('UPDATE settings SET payload = ? WHERE name = ?', [
+            'false',
+            'magic_link_enabled',
+        ]);
+
+        try {
+            const response = await page.goto('/auth/magic-link');
+
+            expect(response?.status()).toBe(404);
+        } finally {
+            await laravel.query(
+                'UPDATE settings SET payload = ? WHERE name = ?',
+                ['true', 'magic_link_enabled'],
+            );
+        }
+    });
+
+    test('magic link is hidden on login page when feature is disabled', async ({
+        page,
+        laravel,
+    }) => {
+        await laravel.query('UPDATE settings SET payload = ? WHERE name = ?', [
+            'false',
+            'magic_link_enabled',
+        ]);
+
+        try {
+            const loginPage = new LoginPage(page);
+            await loginPage.goto();
+            await loginPage.expectToBeVisible();
+
+            await expect(
+                page.getByTestId('magic-link-login-link'),
+            ).not.toBeVisible();
+        } finally {
+            await laravel.query(
+                'UPDATE settings SET payload = ? WHERE name = ?',
+                ['true', 'magic_link_enabled'],
+            );
+        }
+    });
+});

From 2ec68ce812d5127a05bb6aa3283907b3b269caa9 Mon Sep 17 00:00:00 2001
From: roble <renanroble@gmail.com>
Date: Sat, 8 Aug 2026 21:22:34 +0100
Subject: [PATCH 3/4] refactor: remove unused navigation group in AuthPlugin
 and adjust navigation sort for AuthenticationSettings and UserResource

---
 src/Filament/AuthPlugin.php                   | 9 ---------
 src/Filament/Pages/AuthenticationSettings.php | 2 +-
 src/Filament/Resources/Users/UserResource.php | 6 +++++-
 3 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/src/Filament/AuthPlugin.php b/src/Filament/AuthPlugin.php
index 4a71c3c..22d54d2 100644
--- a/src/Filament/AuthPlugin.php
+++ b/src/Filament/AuthPlugin.php
@@ -4,10 +4,8 @@
 
 use App\Filament\ModulePlugin;
 use Filament\Contracts\Plugin;
-use Filament\Navigation\NavigationGroup;
 use Filament\Panel;
 use Filament\Support\Facades\FilamentView;
-use Filament\Support\Icons\Heroicon;
 
 class AuthPlugin implements Plugin
 {
@@ -30,13 +28,6 @@ public static function getNavigationGroupSort(): int
 
     public function boot(Panel $panel): void
     {
-        $panel->navigationGroups([
-            NavigationGroup::make()
-                ->label(__('Authentication'))
-                ->icon(Heroicon::OutlinedShieldCheck)
-                ->collapsible(),
-        ]);
-
         FilamentView::spaUrlExceptions([config('filament-impersonate.redirect_to', '/')]);
     }
 }
diff --git a/src/Filament/Pages/AuthenticationSettings.php b/src/Filament/Pages/AuthenticationSettings.php
index 85ec582..b83dc7f 100644
--- a/src/Filament/Pages/AuthenticationSettings.php
+++ b/src/Filament/Pages/AuthenticationSettings.php
@@ -15,7 +15,7 @@ class AuthenticationSettings extends SettingsPage
 {
     protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedKey;
 
-    protected static ?int $navigationSort = 2;
+    protected static ?int $navigationSort = 1;
 
     protected static string $settings = AuthSettings::class;
 
diff --git a/src/Filament/Resources/Users/UserResource.php b/src/Filament/Resources/Users/UserResource.php
index 0b61c4b..f12dcd8 100644
--- a/src/Filament/Resources/Users/UserResource.php
+++ b/src/Filament/Resources/Users/UserResource.php
@@ -3,8 +3,10 @@
 namespace Modules\Auth\Filament\Resources\Users;
 
 use App\Models\User;
+use BackedEnum;
 use Filament\Resources\Resource;
 use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
 use Filament\Tables\Table;
 use Illuminate\Contracts\Support\Htmlable;
 use Illuminate\Database\Eloquent\Model;
@@ -20,7 +22,9 @@ class UserResource extends Resource
 {
     protected static ?string $model = User::class;
 
-    protected static ?int $navigationSort = 1;
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUsers;
+
+    protected static ?int $navigationSort = 100;
 
     public static function getNavigationGroup(): ?string
     {

From bbd8e3d79a25a031316dac0978a584b99dc594b9 Mon Sep 17 00:00:00 2001
From: roble <renanroble@gmail.com>
Date: Sat, 15 Aug 2026 16:18:04 +0100
Subject: [PATCH 4/4] refactor: remove redirectEndpoint from RegisterPage and
 update related tests for email verification

---
 tests/e2e/pages/RegisterPage.ts               |  2 -
 tests/e2e/tests/login/login.basic.spec.ts     | 17 ++++++-
 tests/e2e/tests/login/logout.basic.spec.ts    | 30 ++++++++----
 .../e2e/tests/register/register.basic.spec.ts | 13 +++++-
 tests/e2e/tests/sidebar.spec.ts               | 46 ++++++++++++++-----
 .../verify-email/verify-email.basic.spec.ts   |  4 +-
 6 files changed, 85 insertions(+), 27 deletions(-)

diff --git a/tests/e2e/pages/RegisterPage.ts b/tests/e2e/pages/RegisterPage.ts
index 9da6033..84126c1 100644
--- a/tests/e2e/pages/RegisterPage.ts
+++ b/tests/e2e/pages/RegisterPage.ts
@@ -15,7 +15,6 @@ export class RegisterPage {
     readonly termsCheckbox: Locator;
     readonly registerButton: Locator;
     readonly signupEndpoint: string;
-    readonly redirectEndpoint: string;
 
     /** Indicates if email verification is required after registration */
     readonly userMustVerifyEmail: boolean = false;
@@ -23,7 +22,6 @@ export class RegisterPage {
     constructor(page: Page) {
         this.page = page;
         this.signupEndpoint = '/auth/register';
-        this.redirectEndpoint = this.userMustVerifyEmail ? '/auth/verify-email' : '/dashboard';
         this.nameInput = page.getByTestId('name');
         this.emailInput = page.getByTestId('email');
         this.passwordInput = page.getByTestId('password');
diff --git a/tests/e2e/tests/login/login.basic.spec.ts b/tests/e2e/tests/login/login.basic.spec.ts
index e7412f3..5167fa2 100644
--- a/tests/e2e/tests/login/login.basic.spec.ts
+++ b/tests/e2e/tests/login/login.basic.spec.ts
@@ -1,4 +1,5 @@
 import { test, expect } from '@e2e/fixtures';
+import { expectAuthenticated } from '@e2e/helpers/auth';
 import { LoginPage } from '../../pages/LoginPage';
 
 test.describe.parallel('Login Basics', () => {
@@ -10,19 +11,26 @@ test.describe.parallel('Login Basics', () => {
         await loginPage.expectToBeVisible();
     });
 
+    // Not `toHaveURL('/dashboard')`: the post-login landing page depends on
+    // which modules are installed (e.g. tenancy redirects elsewhere), so the
+    // only thing this test can rely on is that login actually authenticated.
     async function expectSuccessfulLogin() {
-        await expect(loginPage.page).toHaveURL('/dashboard');
+        await expectAuthenticated(loginPage.page);
     }
 
     test('logs in with valid credentials and redirects to dashboard', async ({ credentials }) => {
         const user = credentials.admin;
+        const loginResponse = loginPage.waitForLoginResponse();
         await loginPage.login(user.email, user.password);
+        await loginResponse;
         await expectSuccessfulLogin();
     });
 
     test('logs in with remember me option', async ({ credentials }) => {
         const user = credentials.user;
+        const loginResponse = loginPage.waitForLoginResponse();
         await loginPage.login(user.email, user.password, true);
+        await loginResponse;
 
         await expect(loginPage.rememberCheckbox).toBeChecked();
         await expectSuccessfulLogin();
@@ -33,12 +41,15 @@ test.describe.parallel('Login Basics', () => {
         credentials,
     }) => {
         const user = credentials.user;
+        const loginResponse = loginPage.waitForLoginResponse();
         await loginPage.login(user.email, user.password);
+        await loginResponse;
         await expectSuccessfulLogin();
 
         await page.goto('/auth/login');
 
-        await expect(page).toHaveURL('/dashboard');
+        await expect(page).not.toHaveURL(/\/auth\/login/);
+        await expectAuthenticated(page);
     });
 
     test('toggles password visibility', async ({ credentials }) => {
@@ -59,7 +70,9 @@ test.describe.parallel('Login Basics', () => {
         await loginPage.emailInput.fill(user.email);
         await loginPage.passwordInput.fill(user.password);
 
+        const loginResponse = loginPage.waitForLoginResponse();
         await loginPage.passwordInput.press('Enter');
+        await loginResponse;
 
         await expectSuccessfulLogin();
     });
diff --git a/tests/e2e/tests/login/logout.basic.spec.ts b/tests/e2e/tests/login/logout.basic.spec.ts
index d9413a4..ef995f9 100644
--- a/tests/e2e/tests/login/logout.basic.spec.ts
+++ b/tests/e2e/tests/login/logout.basic.spec.ts
@@ -1,12 +1,24 @@
 import { test, expect } from '@e2e/fixtures';
+import { expectAuthenticated } from '@e2e/helpers/auth';
+import { isModuleInstalled } from '@e2e/helpers/modules';
+
+// These tests click through the dashboard user menu to log out, not just
+// prove login. Under tenancy, an authenticated visitor without a workspace
+// never reaches that chrome (see modules/tenancy/src/Http/Middleware/
+// EnsureWorkspace.php) — skip here, tenancy's own e2e suite covers logout
+// from inside a workspace.
+async function skipIfTenancyInstalled(laravel: Parameters<typeof isModuleInstalled>[0]) {
+    test.skip(await isModuleInstalled(laravel, 'tenancy'), 'dashboard chrome is covered by tenancy\'s own e2e suite when tenancy is installed');
+}
 
 test.describe.parallel('Logout Basics', () => {
-    test('logs out from user menu and redirects to login', async ({ page, credentials, loginAs }) => {
+    test('logs out from user menu and redirects to login', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         const user = credentials.user;
 
         await loginAs(user);
         await page.goto('/dashboard');
-        await expect(page).toHaveURL('/dashboard');
+        await expectAuthenticated(page);
 
         // Open user menu using the test ID
         const userMenuTrigger = page.getByTestId('user-menu-trigger');
@@ -32,12 +44,13 @@ test.describe.parallel('Logout Basics', () => {
         await expect(page).toHaveURL('/auth/login');
     });
 
-    test('clicking outside the logout dialog does not dismiss it', async ({ page, credentials, loginAs }) => {
+    test('clicking outside the logout dialog does not dismiss it', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         const user = credentials.user;
 
         await loginAs(user);
         await page.goto('/dashboard');
-        await expect(page).toHaveURL('/dashboard');
+        await expectAuthenticated(page);
 
         const userMenuTrigger = page.getByTestId('user-menu-trigger');
         await userMenuTrigger.click();
@@ -56,12 +69,13 @@ test.describe.parallel('Logout Basics', () => {
         await expect(confirmDialog).toBeVisible();
     });
 
-    test('cancelling logout dialog keeps user logged in', async ({ page, credentials, loginAs }) => {
+    test('cancelling logout dialog keeps user logged in', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         const user = credentials.user;
 
         await loginAs(user);
         await page.goto('/dashboard');
-        await expect(page).toHaveURL('/dashboard');
+        await expectAuthenticated(page);
 
         // Open user menu
         const userMenuTrigger = page.getByTestId('user-menu-trigger');
@@ -82,7 +96,7 @@ test.describe.parallel('Logout Basics', () => {
         // Dialog should be closed
         await expect(confirmDialog).not.toBeVisible();
 
-        // User should still be on dashboard
-        await expect(page).toHaveURL('/dashboard');
+        // User should still be logged in
+        await expectAuthenticated(page);
     });
 });
diff --git a/tests/e2e/tests/register/register.basic.spec.ts b/tests/e2e/tests/register/register.basic.spec.ts
index 956ab68..e97b838 100644
--- a/tests/e2e/tests/register/register.basic.spec.ts
+++ b/tests/e2e/tests/register/register.basic.spec.ts
@@ -1,4 +1,5 @@
 import { test, expect } from '@e2e/fixtures';
+import { expectAuthenticated } from '@e2e/helpers/auth';
 import { RegisterPage } from '../../pages/RegisterPage';
 import { faker } from '@faker-js/faker';
 
@@ -11,8 +12,16 @@ test.describe.parallel('Register Basics', () => {
         await registerPage.expectToBeVisible();
     });
 
+    // Not a hardcoded landing URL: where an authenticated-but-unverified user
+    // lands is stable (`/auth/verify-email`), but where a verified one lands
+    // depends on which modules are installed, so we only assert auth state.
     async function expectSuccessfulRegistration() {
-        await expect(registerPage.page).toHaveURL(registerPage.redirectEndpoint);
+        if (registerPage.userMustVerifyEmail) {
+            await expect(registerPage.page).toHaveURL('/auth/verify-email');
+            return;
+        }
+
+        await expectAuthenticated(registerPage.page);
     }
 
     function newUser() {
@@ -54,7 +63,9 @@ test.describe.parallel('Register Basics', () => {
         await registerPage.passwordInput.fill(user.password);
         await registerPage.termsCheckbox.check();
 
+        const registerResponse = registerPage.waitForLoginResponse();
         await registerPage.passwordInput.press('Enter');
+        await registerResponse;
 
         await expectSuccessfulRegistration();
     });
diff --git a/tests/e2e/tests/sidebar.spec.ts b/tests/e2e/tests/sidebar.spec.ts
index b01110b..f126fb8 100644
--- a/tests/e2e/tests/sidebar.spec.ts
+++ b/tests/e2e/tests/sidebar.spec.ts
@@ -1,15 +1,30 @@
 import { test, expect } from '@e2e/fixtures';
+import { expectAuthenticated } from '@e2e/helpers/auth';
+import { isModuleInstalled } from '@e2e/helpers/modules';
+
+// These tests exercise the dashboard sidebar/topbar chrome itself, not just
+// login. Under tenancy, an authenticated visitor is never left on `/dashboard`
+// (see modules/tenancy/src/Http/Middleware/EnsureWorkspace.php) — a
+// workspace-less test user is funnelled to a workspace picker/create form
+// instead, which doesn't have this chrome. Tenancy's own e2e suite covers
+// the equivalent UI inside a workspace, so skip here rather than assert on
+// UI this module doesn't control in that combination.
+async function skipIfTenancyInstalled(laravel: Parameters<typeof isModuleInstalled>[0]) {
+    test.skip(await isModuleInstalled(laravel, 'tenancy'), 'dashboard chrome is covered by tenancy\'s own e2e suite when tenancy is installed');
+}
 
 test.describe.parallel('Sidebar layout', () => {
-    test('renders tenant switcher in sidebar header', async ({ page, credentials, loginAs }) => {
+    test('renders tenant switcher in sidebar header', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
-        await expect(page).toHaveURL('/dashboard');
+        await expectAuthenticated(page);
 
         await expect(page.getByTestId('tenant-switcher')).toBeVisible();
     });
 
-    test('user dropdown contains language and theme selectors', async ({ page, credentials, loginAs }) => {
+    test('user dropdown contains language and theme selectors', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
 
@@ -19,7 +34,8 @@ test.describe.parallel('Sidebar layout', () => {
         await expect(page.getByTestId('theme-selector-trigger')).toBeVisible();
     });
 
-    test('language selector submenu opens', async ({ page, credentials, loginAs }) => {
+    test('language selector submenu opens', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
 
@@ -29,7 +45,8 @@ test.describe.parallel('Sidebar layout', () => {
         await expect(page.locator('[data-slot="dropdown-menu-sub-content"]')).toBeVisible();
     });
 
-    test('theme selector submenu opens', async ({ page, credentials, loginAs }) => {
+    test('theme selector submenu opens', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
 
@@ -41,10 +58,11 @@ test.describe.parallel('Sidebar layout', () => {
 });
 
 test.describe('Theme persistence', () => {
-    test('dark theme persists across navigation via cookie', async ({ page, credentials, loginAs }) => {
+    test('dark theme persists across navigation via cookie', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
-        await expect(page).toHaveURL(/dashboard/);
+        await expectAuthenticated(page);
 
         // Select dark via the UI — this writes localStorage + cookie
         await page.getByTestId('user-menu-trigger').click();
@@ -59,10 +77,11 @@ test.describe('Theme persistence', () => {
         await expect(page.locator('html')).toHaveClass(/dark/);
     });
 
-    test('light theme does not add dark class after navigation', async ({ page, credentials, loginAs }) => {
+    test('light theme does not add dark class after navigation', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
-        await expect(page).toHaveURL(/dashboard/);
+        await expectAuthenticated(page);
 
         // Select light via the UI
         await page.getByTestId('user-menu-trigger').click();
@@ -76,7 +95,8 @@ test.describe('Theme persistence', () => {
         await expect(page.locator('html')).not.toHaveClass(/dark/);
     });
 
-    test('system preference dark mode applied before hydration', async ({ page, credentials, loginAs }) => {
+    test('system preference dark mode applied before hydration', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await page.emulateMedia({ colorScheme: 'dark' });
         await loginAs(credentials.user);
         await page.goto('/dashboard');
@@ -84,7 +104,8 @@ test.describe('Theme persistence', () => {
         await expect(page.locator('html')).toHaveClass(/dark/);
     });
 
-    test('dark mode toggle writes to appearance localStorage key, not vueuse-dark', async ({ page, credentials, loginAs }) => {
+    test('dark mode toggle writes to appearance localStorage key, not vueuse-dark', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
 
@@ -100,7 +121,8 @@ test.describe('Theme persistence', () => {
         expect(wrongKey).toBeNull();
     });
 
-    test('dark mode toggle writes appearance cookie for server-side persistence', async ({ page, credentials, loginAs }) => {
+    test('dark mode toggle writes appearance cookie for server-side persistence', async ({ page, laravel, credentials, loginAs }) => {
+        await skipIfTenancyInstalled(laravel);
         await loginAs(credentials.user);
         await page.goto('/dashboard');
 
diff --git a/tests/e2e/tests/verify-email/verify-email.basic.spec.ts b/tests/e2e/tests/verify-email/verify-email.basic.spec.ts
index 2ee5b84..d22610b 100644
--- a/tests/e2e/tests/verify-email/verify-email.basic.spec.ts
+++ b/tests/e2e/tests/verify-email/verify-email.basic.spec.ts
@@ -31,11 +31,11 @@ test.describe.parallel('Verify Email Basics', () => {
         await registerPage.expectToBeVisible();
         await registerPage.register(user.name, user.email, user.password);
 
-        await verifyEmailPage.expectRedirectTo(registerPage.redirectEndpoint);
+        await verifyEmailPage.expectRedirectTo('/auth/verify-email');
         await verifyEmailPage.expectToBeVisible();
 
         await verifyEmailPage.page.goto('/dashboard');
 
-        await verifyEmailPage.expectRedirectTo(registerPage.redirectEndpoint);
+        await verifyEmailPage.expectRedirectTo('/auth/verify-email');
     });
 });