Filament TOTP two-factor authentication with recovery codes

<?php

namespace App\Providers\Filament;

use Filament\Auth\MultiFactor\App\AppAuthentication;
use Filament\Panel;
use Filament\PanelProvider;

class StudioPanelProvider extends PanelProvider
{
    public function panel(Panel $panel): Panel
    {
        return $panel
            ->id('studio')
            ->path('studio')
            ->login()
            ->profile() // gives users the page where they set 2FA up
            ->multiFactorAuthentication([
                AppAuthentication::make()
                    ->recoverable()          // one-time recovery codes
                    ->recoveryCodeCount(8)
                    ->codeWindow(4),         // tolerate a little clock drift
            ], isRequired: false);           // true forces every user to enrol
    }
}

<?php

namespace App\Models\Concerns;

/**
 * Add to the User model and implement the two Filament contracts:
 *   Filament\Auth\MultiFactor\App\Contracts\HasAppAuthentication
 *   Filament\Auth\MultiFactor\App\Contracts\HasAppAuthenticationRecovery
 * Also merge the casts() and hidden() entries shown below.
 */
trait HasTotpSecret
{
    // casts(): 'app_authentication_secret' => 'encrypted',
    //          'app_authentication_recovery_codes' => 'encrypted:array',
    // $hidden: add both columns.

    public function getAppAuthenticationSecret(): ?string
    {
        return $this->app_authentication_secret;
    }

    public function saveAppAuthenticationSecret(?string $secret): void
    {
        $this->app_authentication_secret = $secret;
        $this->save();
    }

    /** Label shown inside the authenticator app. */
    public function getAppAuthenticationHolderName(): string
    {
        return $this->name;
    }

    /** @return ?array<string> */
    public function getAppAuthenticationRecoveryCodes(): ?array
    {
        return $this->app_authentication_recovery_codes;
    }

    /** @param  ?array<string>  $codes */
    public function saveAppAuthenticationRecoveryCodes(?array $codes): void
    {
        $this->app_authentication_recovery_codes = $codes;
        $this->save();
    }
}

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::table('users', function (Blueprint $table) {
            // text, not string: encrypted payloads are longer than the plain value.
            $table->text('app_authentication_secret')->nullable();
            $table->text('app_authentication_recovery_codes')->nullable();
        });
    }

    public function down(): void
    {
        Schema::table('users', function (Blueprint $table) {
            $table->dropColumn(['app_authentication_secret', 'app_authentication_recovery_codes']);
        });
    }
};