Allow disabling panel 2FA, or swapping the 2FA delivery channel

[wychoong]

Panel login always goes through a second factor. Password is only the first step: TOTP if the staff member has an authenticator app, otherwise an emailed one-time code.

// packages/panel/src/Http/Controllers/Auth/AuthenticatedSessionController.php
// Every login is a two-step challenge — TOTP if the staff member has
// it configured, otherwise an emailed one-time code, so a second
// factor is always required one way or another.
if (! $appAuthentication->isEnabled($user)) {
    $emailTwoFactor->send($user);
}

return redirect()->route('panel.two-factor.challenge');

That is a reasonable default. For some installs it is a problem: local/staging without mail, stores that want password-only staff login, or clients who want the OTP on SMS / WhatsApp instead of email.

Today the email fallback is a Laravel notification hard-wired to mail:

// packages/panel/src/Notifications/TwoFactorEmailCode.php
public function via(object $notifiable): array
{
    return ['mail'];
}

There is no documented way to turn 2FA off, or to replace the channel.

Options I'd like considered

1. Disable 2FA

Config / env to skip the challenge and sign in on password only. Useful for local, CI, and stores that accept the risk. Could be global, or only when APP_ENV !== production.

2. Override the 2FA provider / channel

Keep the challenge, but let the host choose how the code is delivered:

• SMS
• WhatsApp
• any Laravel notification channel (vonage, whatsapp, a custom channel, etc.)

Authenticator-app TOTP can stay as-is. The missing piece is a first-class seam for the OTP fallback (notification class, via(), or a small TwoFactorChannel contract) instead of forking EmailTwoFactor / TwoFactorEmailCode.

Happy with either, or both: disable for stores that opt out, and a channel swap for stores that keep 2FA but don't want email.

Refs:

• https://github.com/lunarphp/lunar/blob/2.x/packages/panel/src/Http/Controllers/Auth/AuthenticatedSessionController.php
• https://github.com/lunarphp/lunar/blob/2.x/packages/panel/src/Notifications/TwoFactorEmailCode.php
• https://github.com/lunarphp/lunar/blob/2.x/packages/panel/src/Auth/EmailTwoFactor.php