oportunidades 7

app/Providers/AppServiceProvider.php

@@ -43,13 +43,27 @@ class AppServiceProvider extends ServiceProvider
     {
         $this->configureDefaults();
 
+        // Fortify calls this response AFTER invalidating/regenerating the server session.
+        // Clear the client's encryption key too, so Back must reauthorize private pages.
+        $this->app->bind(\Laravel\Fortify\Contracts\LogoutResponse::class, function () {
+            return new class extends \Laravel\Fortify\Http\Responses\LogoutResponse
+            {
+                public function toResponse($request)
+                {
+                    \Inertia\Inertia::clearHistory();
+
+                    return parent::toResponse($request);
+                }
+            };
+        });
+
         Event::listen(ValidTwoFactorAuthenticationCodeProvided::class, function ($event): void {
-            if (app(PortalProfileAccess::class)->available()) {
-                session()->put(['portal.mfa_actor' => $event->user->id, 'portal.mfa_at' => time()]);
-            }
+            // The authenticated installers also operate before the optional profile schema exists.
+            // Record a completed Fortify challenge, never enrollment or a password-only login.
+            session()->put(['portal.mfa_actor' => $event->user->id, 'portal.mfa_at' => time()]);
         });
         Event::listen(Login::class, function ($event): void {
-            if (app(PortalProfileAccess::class)->available()) {
+            if (app(PortalProfileAccess::class)->governanceAvailable()) {
                 session()->put('portal.access_revision', (int) DB::table('users')->where('id', $event->user->id)->value('portal_access_revision'));
             }
         });