action_auth 1.8.7 → 2.0.0

data/app/views/action_auth/identity/password_resets/edit.html.erb

@@ -1,17 +1,16 @@
+<%= render "action_auth/shared/flash" %>
+
 <h1>Reset your password</h1>
 
-<%= form_with(url: identity_password_reset_path, method: :patch) do |form| %>
-  <% if @user.errors.any? %>
-    <div style="color: red">
-      <h2><%= pluralize(@user.errors.count, "error") %> prohibited this user from being saved:</h2>
+<% unless @user.verified? %>
+  <p>
+    This email address hasn't been verified yet, so resetting the password will also verify it and disconnect any
+    connected accounts.
+  </p>
+<% end %>
 
-      <ul>
-        <% @user.errors.each do |error| %>
-          <li><%= error.full_message %></li>
-        <% end %>
-      </ul>
-    </div>
-  <% end %>
+<%= form_with(url: identity_password_reset_path, method: :patch) do |form| %>
+  <%= render "action_auth/shared/errors", record: @user %>
 
   <%= form.hidden_field :sid, value: params[:sid] %>
 

data/app/views/action_auth/identity/password_resets/new.html.erb

@@ -1,10 +1,11 @@
+<%= render "action_auth/shared/flash" %>
+
 <h1>Forgot your password?</h1>
-<p style="color: red"><%= alert %></p>
 
 <%= form_with(url: identity_password_reset_path) do |form| %>
   <div class="mb-3">
     <%= form.label :email, style: "display: block" %>
-    <%= form.email_field :email, required: true, autofocus: true %>
+    <%= form.email_field :email, required: true, autofocus: true, autocomplete: "email" %>
   </div>
 
   <div class="mb-3">
@@ -12,10 +13,4 @@
   </div>
 <% end %>
 
-<div class="mb-3">
-  <%= link_to "Sign In", sign_in_path %>
-  | <%= link_to "Sign Up", sign_up_path %>
-  <% if ActionAuth.configuration.verify_email_on_sign_in %>
-    | <%= link_to "Verify Email", identity_email_verification_path %>
-  <% end %>
-</div>
+<%= render "action_auth/shared/links" %>

data/app/views/action_auth/magics/requests/new.html.erb

@@ -1,26 +1,16 @@
+<%= render "action_auth/shared/flash" %>
+
 <h1>Request Magic Link</h1>
 
 <%= form_with(url: magics_requests_path) do |form| %>
   <div class="mb-3">
     <%= form.label :email, style: "display: block" %>
-    <%= form.email_field :email, required: true, autofocus: true, autocomplete: "email" %>
+    <%= form.email_field :email, value: params[:email], required: true, autofocus: true, autocomplete: "email" %>
   </div>
 
   <div class="mb-3">
     <%= form.submit "Request Magic Link", class: "btn btn-primary" %>
-    <span class="mx-3">or</span>
-    <%= link_to "Sign In", sign_in_path %>
-    <% if ActionAuth.configuration.passkey_only? %>
-      <span class="mx-3">or</span>
-      <%= link_to "Passkey", new_sessions_passkey_path %>
-    <% end %>
   </div>
 <% end %>
 
-<div class="mb-3">
-  <%= link_to "Sign Up", sign_up_path %> |
-  <%= link_to "Reset Password", new_identity_password_reset_path %>
-  <% if ActionAuth.configuration.verify_email_on_sign_in %>
-    | <%= link_to "Verify Email", identity_email_verification_path %>
-  <% end %>
-</div>
+<%= render "action_auth/shared/links" %>

data/app/views/action_auth/magics/sign_ins/show.html.erb

@@ -0,0 +1,18 @@
+<%= render "action_auth/shared/flash" %>
+
+<h1>Sign in</h1>
+
+<p>You're signing in as <strong><%= @user.email %></strong>. This link only works once.</p>
+
+<%# Worded for both people who see it, who look the same from here: someone who chose a
+    password before verifying, and someone who has never had one. It's said here rather
+    than after signing in, because the app's own page may not display flash messages. %>
+<% unless @user.verified? %>
+  <p>
+    This email address hasn't been verified yet, so signing in will also replace any password set on this account,
+    sign out its other devices and disconnect any connected accounts. You can choose a new password afterwards with
+    Reset Password.
+  </p>
+<% end %>
+
+<%= button_to "Sign in", magics_sign_ins_path, params: { token: params[:token] }, class: "btn btn-primary" %>

data/app/views/action_auth/passwords/edit.html.erb

@@ -1,43 +1,31 @@
-<p style="color: red"><%= alert %></p>
+<%= render "action_auth/shared/flash" %>
 
 <h1>Change your password</h1>
 
 <%= form_with(url: password_path, method: :patch) do |form| %>
-  <% if @user.errors.any? %>
-    <div style="color: red">
-      <h2><%= pluralize(@user.errors.count, "error") %> prohibited this user from being saved:</h2>
+  <%= render "action_auth/shared/errors", record: @user %>
 
-      <ul>
-        <% @user.errors.each do |error| %>
-          <li><%= error.full_message %></li>
-        <% end %>
-      </ul>
-    </div>
-  <% end %>
-
-  <div>
-    <%= form.label :password_challenge, style: "display: block" %>
+  <div class="mb-3">
+    <%= form.label :password_challenge, "Current password", style: "display: block" %>
     <%= form.password_field :password_challenge, required: true, autofocus: true, autocomplete: "current-password" %>
   </div>
 
-  <div>
+  <div class="mb-3">
     <%= form.label :password, "New password", style: "display: block" %>
     <%= form.password_field :password, required: true, autocomplete: "new-password" %>
     <div>12 characters minimum.</div>
   </div>
 
-  <div>
+  <div class="mb-3">
     <%= form.label :password_confirmation, "Confirm new password", style: "display: block" %>
     <%= form.password_field :password_confirmation, required: true, autocomplete: "new-password" %>
   </div>
 
-  <div>
-    <%= form.submit "Save changes" %>
+  <div class="mb-3">
+    <%= form.submit "Save changes", class: "btn btn-primary" %>
   </div>
 <% end %>
 
-<br>
-
 <div>
-  <%= link_to "Back", main_app.root_path %>
+  <%= link_to "Back", sessions_path %>
 </div>

data/app/views/action_auth/registrations/new.html.erb

@@ -1,17 +1,9 @@
+<%= render "action_auth/shared/flash" %>
+
 <h1>Sign up</h1>
 
 <%= form_with(url: sign_up_path) do |form| %>
-  <% if @user.errors.any? %>
-    <div style="color: red">
-      <h2><%= pluralize(@user.errors.count, "error") %> prohibited this user from being saved:</h2>
-
-      <ul>
-        <% @user.errors.each do |error| %>
-          <li><%= error.full_message %></li>
-        <% end %>
-      </ul>
-    </div>
-  <% end %>
+  <%= render "action_auth/shared/errors", record: @user %>
 
   <div class="mb-3">
     <%= form.label :email, style: "display: block" %>
@@ -34,19 +26,5 @@
   </div>
 <% end %>
 
-<div class="mb-3">
-  <%= link_to "Sign In", sign_in_path %> |
-  <% if ActionAuth.configuration.magic_link_enabled? %>
-    <%= link_to "Magic Link", new_magics_requests_path %> |
-  <% end %>
-  <% if ActionAuth.configuration.sms_auth_enabled? %>
-    <%= link_to "SMS Auth", new_sms_auths_requests_path %> |
-  <% end %>
-  <% if ActionAuth.configuration.passkey_only? %>
-    <%= link_to "Passkey", new_sessions_passkey_path %> |
-  <% end %>
-  <%= link_to "Reset Password", new_identity_password_reset_path %>
-  <% if ActionAuth.configuration.verify_email_on_sign_in %>
-    | <%= link_to "Verify Email", identity_email_verification_path %>
-  <% end %>
-</div>
+<%= render "action_auth/shared/oauth_buttons" %>
+<%= render "action_auth/shared/links" %>

data/app/views/action_auth/sessions/_account.html.erb

@@ -0,0 +1,30 @@
+<h2>Account</h2>
+<%# Both of these ask for the current password, which a placeholder account can't know. %>
+<% if ActionAuth::Current.user.password_usable? %>
+  <div class="mb-3">
+    <%= link_to "Change email", edit_identity_email_path %> |
+    <%= link_to "Change password", edit_password_path %>
+  </div>
+<% end %>
+
+<% if ActionAuth.configuration.allow_user_deletion? %>
+  <details class="mb-3">
+    <summary>Delete account</summary>
+    <p>This permanently deletes your account and signs you out everywhere. It can't be undone.</p>
+
+    <% if ActionAuth::Current.user.password_usable? %>
+      <%= form_with(url: users_path, method: :delete) do |form| %>
+        <div class="mb-3">
+          <%= form.label :password_challenge, "Current password", style: "display: block" %>
+          <%= form.password_field :password_challenge, required: true, autocomplete: "current-password" %>
+          <div>Don't know your password? <%= link_to "Reset it", new_identity_password_reset_path %> first.</div>
+        </div>
+
+        <%= form.submit "Permanently delete my account", class: "btn btn-danger" %>
+      <% end %>
+    <% else %>
+      <p>To confirm it's you, this only works within 10 minutes of signing in with <%= ActionAuth::Current.user.fresh_sign_in_method %>.</p>
+      <%= button_to "Permanently delete my account", users_path, method: :delete, class: "btn btn-danger" %>
+    <% end %>
+  </details>
+<% end %>

data/app/views/action_auth/sessions/_connected_accounts.html.erb

@@ -0,0 +1,32 @@
+<% connected_accounts = current_user.connected_accounts.order(:created_at).to_a %>
+
+<h2>Connected Accounts</h2>
+
+<% if connected_accounts.any? %>
+  <table class="action-auth--table">
+    <thead>
+      <tr>
+        <th>Provider</th>
+        <th>Account</th>
+        <th nowrap>Connected On</th>
+        <th nowrap></th>
+      </tr>
+    </thead>
+    <tbody>
+      <% connected_accounts.each do |connected_account| %>
+        <%= content_tag :tr, id: dom_id(connected_account) do %>
+          <td><%= connected_account.provider_label %></td>
+          <td><%= connected_account.display_name %></td>
+          <td nowrap><%= connected_account.created_at.strftime('%B %d, %Y') %></td>
+          <td nowrap><%= button_to "Disconnect", connected_account_path(connected_account), method: :delete, class: "btn btn-primary" %></td>
+        <% end %>
+      <% end %>
+    </tbody>
+  </table>
+<% end %>
+
+<% ActionAuth.configuration.oauth_providers.reject { |oauth| connected_accounts.any? { |account| account.provider == oauth.key } }.each do |oauth| %>
+  <div class="mb-3">
+    <%= button_to "Connect #{oauth.label}", oauth_request_path(oauth.key), form: { data: { turbo: false } }, class: "btn btn-primary" %>
+  </div>
+<% end %>

data/app/views/action_auth/sessions/_security_keys.html.erb

@@ -0,0 +1,32 @@
+<% if current_user.second_factor_enabled? %>
+  <h2>Your Security Keys</h2>
+  <table class="action-auth--table">
+    <thead>
+      <tr>
+        <th>Key</th>
+        <th>Type</th>
+        <th nowrap>Registered On</th>
+        <th nowrap></th>
+      </tr>
+    </thead>
+    <tbody>
+      <% current_user.webauthn_credentials.each do |credential| %>
+        <%= content_tag :tr, id: dom_id(credential) do %>
+          <td><%= credential.nickname %></td>
+          <td><%= credential.key_type %></td>
+          <td nowrap><%= credential.created_at.strftime('%B %d, %Y') %></td>
+          <td nowrap><%= button_to "Delete", credential, method: :delete, class: "btn btn-primary" %></td>
+        <% end %>
+      <% end %>
+    </tbody>
+  </table>
+
+  <div class="mb-3">
+    <%= link_to "Register new Security Key", new_webauthn_credential_path, class: "btn btn-primary" %>
+  </div>
+<% else %>
+  <h2>Enable Two-Factor Authentication</h2>
+  <div class="mb-3">
+    <%= link_to "Add a passkey", new_webauthn_credential_path, class: "btn btn-primary" %>
+  </div>
+<% end %>

data/app/views/action_auth/sessions/_sessions.html.erb

@@ -0,0 +1,28 @@
+<h2>Sessions</h2>
+<div id="sessions">
+  <table class="action-auth--table">
+    <thead>
+      <tr>
+        <th>User Agent</th>
+        <th nowrap>Ip Address</th>
+        <th nowrap>Created at</th>
+        <th nowrap></th>
+      </tr>
+    </thead>
+    <tbody>
+      <% sessions.each do |session| %>
+        <%= content_tag :tr, id: dom_id(session) do %>
+          <td>
+            <%= session.user_agent %>
+            <% if session == current_session %>
+              <strong>(this device)</strong>
+            <% end %>
+          </td>
+          <td nowrap><%= session.ip_address %></td>
+          <td><%= session.created_at %></td>
+          <td><%= button_to "Log out", session, method: :delete, class: "btn btn-primary" %></td>
+        <% end %>
+      <% end %>
+    </tbody>
+  </table>
+</div>

data/app/views/action_auth/sessions/index.html.erb

@@ -1,68 +1,16 @@
-<p style="color: green"><%= notice %></p>
+<%= render "action_auth/shared/flash" %>
 
-<h1>
-  Devices & Sessions
-</h1>
-<small><%= link_to "back to app", main_app.root_path %></small>
+<h1>Devices &amp; Sessions</h1>
+<small><%= link_to "back to app", after_sign_in_path %></small>
 
-<h2>Sessions</h2>
-<div id="sessions">
-  <table class="action-auth--table">
-    <thead>
-      <tr>
-        <th>User Agent</th>
-        <th nowrap>Ip Address</th>
-        <th nowrap>Created at</th>
-        <th nowrap></th>
-      </tr>
-    </thead>
-    <tbody>
-      <% @sessions.each do |session| %>
-        <%= content_tag :tr, id: dom_id(session) do %>
-          <td><%= session.user_agent %></td>
-          <td nowrap><%= session.ip_address %></td>
-          <td><%= session.created_at %></td>
-          <td><%= button_to "Log out", session, method: :delete, class: "btn btn-primary" %></td>
-        <% end %>
-      <% end %>
-    </tbody>
-  </table>
-</div>
+<%= render "action_auth/sessions/sessions", sessions: @sessions %>
 
 <% if ActionAuth.configuration.webauthn_enabled? %>
-  <% if current_user.second_factor_enabled? %>
-    <h3>Your Security Keys:</h3>
-    <table class="action-auth--table">
-      <thead>
-        <tr>
-          <th>Key</th>
-          <th>Type</th>
-          <th nowrap>Registered On</th>
-          <th nowrap></th>
-        </tr>
-      </thead>
-      <tbody>
-        <% current_user.webauthn_credentials.each do |credential| %>
-          <%= content_tag :tr, id: dom_id(credential) do %>
-            <td><%= credential.nickname %></td>
-            <td><%= credential.key_type %></td>
-            <td nowrap><%= credential.created_at.strftime('%B %d, %Y') %></td>
-            <td nowrap><%= button_to "Delete", credential, method: :delete, class: "btn btn-primary" %></td>
-          <% end %>
-        <% end %>
-      </tbody>
-    </table>
+  <%= render "action_auth/sessions/security_keys" %>
+<% end %>
 
-    <div>
-      <%= button_to("Register new Security Key",
-                    new_webauthn_credential_path,
-                    method: :get,
-                    class: "btn btn-primary") %>
-    </div>
-  <% else %>
-    <h2>Enable Two-Factor Authentication</h2>
-    <div class="">
-      <%= link_to "Add a passkey", new_webauthn_credential_path, class: "btn btn-primary" %>
-    </div>
-  <% end %>
+<% if ActionAuth.configuration.oauth_enabled? && ActionAuth::ConnectedAccount.table_exists? %>
+  <%= render "action_auth/sessions/connected_accounts" %>
 <% end %>
+
+<%= render "action_auth/sessions/account" %>

data/app/views/action_auth/sessions/new.html.erb

@@ -1,5 +1,4 @@
-<p style="color: green"><%= notice %></p>
-<p style="color: red"><%= alert %></p>
+<%= render "action_auth/shared/flash" %>
 
 <h1>Sign in</h1>
 
@@ -16,25 +15,8 @@
 
   <div class="mb-3">
     <%= form.submit "Sign in", class: "btn btn-primary" %>
-    <% if ActionAuth.configuration.magic_link_enabled? %>
-      <span class="mx-3">or</span>
-      <%= link_to "Magic Link", new_magics_requests_path %>
-    <% end %>
-    <% if ActionAuth.configuration.sms_auth_enabled? %>
-      <span class="mx-3">or</span>
-      <%= link_to "SMS Auth", new_sms_auths_requests_path %> |
-    <% end %>
-    <% if ActionAuth.configuration.passkey_only? %>
-      <span class="mx-3">or</span>
-      <%= link_to "Passkey", new_sessions_passkey_path %>
-    <% end %>
   </div>
 <% end %>
 
-<div class="mb-3">
-  <%= link_to "Sign Up", sign_up_path %> |
-  <%= link_to "Reset Password", new_identity_password_reset_path %>
-  <% if ActionAuth.configuration.verify_email_on_sign_in %>
-    | <%= link_to "Verify Email", identity_email_verification_path %>
-  <% end %>
-</div>
+<%= render "action_auth/shared/oauth_buttons" %>
+<%= render "action_auth/shared/links" %>

data/app/views/action_auth/sessions/passkeys/new.html.erb

@@ -1,5 +1,11 @@
+<%= render "action_auth/shared/flash" %>
+
+<%= action_auth_webauthn_tags %>
+<%= tag.meta name: "passkey_auth_url", content: sessions_passkeys_url %>
+
 <h2 class="action-auth--text-center">Use a passkey to sign in</h2>
-<%= tag :meta, name: :passkey_auth_url, content: action_auth.sessions_passkeys_url %>
+
+<%= render "action_auth/shared/webauthn_error" %>
 
 <%= content_tag :div,
   id: "webauthn_credential_form",
@@ -15,6 +21,6 @@
   </div>
 <% end %>
 
-<%= content_for :cancel_path do %>
-  <%= link_to "Cancel", action_auth.sign_in_path %>
-<% end %>
+<div class="action-auth--text-center">
+  <%= link_to "Cancel", sign_in_path %>
+</div>

data/app/views/action_auth/shared/_errors.html.erb

@@ -0,0 +1,10 @@
+<% if record&.errors&.any? %>
+  <div class="action-auth--errors" role="alert">
+    <h2><%= pluralize(record.errors.count, "error") %> prohibited this user from being saved:</h2>
+    <ul>
+      <% record.errors.each do |error| %>
+        <li><%= error.full_message %></li>
+      <% end %>
+    </ul>
+  </div>
+<% end %>

data/app/views/action_auth/shared/_flash.html.erb

@@ -0,0 +1,11 @@
+<%# Shown here rather than in the layout so that messages appear in any layout, and
+    removed once shown so that a layout which also displays flash doesn't repeat
+    them. To use your layout's own flash instead, make this partial empty. %>
+<% if notice.present? %>
+  <p class="action-auth--notice" role="status"><%= notice %></p>
+<% end %>
+<% if alert.present? %>
+  <p class="action-auth--alert" role="alert"><%= alert %></p>
+<% end %>
+<% flash.delete(:notice) %>
+<% flash.delete(:alert) %>

data/app/views/action_auth/shared/_links.html.erb

@@ -0,0 +1,3 @@
+<div class="mb-3 action-auth--links">
+  <%= safe_join(action_auth_links.map { |label, path| link_to(label, path) }, " | ") %>
+</div>

data/app/views/action_auth/shared/_oauth_buttons.html.erb

@@ -0,0 +1,5 @@
+<% action_auth_oauth_providers.each do |label, path| %>
+  <div class="mb-3">
+    <%= button_to "Continue with #{label}", path, form: { data: { turbo: false } }, class: "btn btn-primary" %>
+  </div>
+<% end %>

data/app/views/action_auth/shared/_webauthn_error.html.erb

@@ -0,0 +1 @@
+<p id="webauthn_error" class="action-auth--alert" role="alert" hidden></p>

data/app/views/action_auth/sms_auths/requests/new.html.erb

@@ -1,26 +1,16 @@
+<%= render "action_auth/shared/flash" %>
+
 <h1>Request SMS Code</h1>
 
 <%= form_with(url: sms_auths_requests_path) do |form| %>
   <div class="mb-3">
     <%= form.label :phone_number, style: "display: block" %>
-    <%= form.telephone_field :phone_number, required: true, autofocus: true, autocomplete: "mobile" %>
+    <%= form.telephone_field :phone_number, value: params[:phone_number], required: true, autofocus: true, autocomplete: "tel" %>
   </div>
 
   <div class="mb-3">
     <%= form.submit "Request SMS Code", class: "btn btn-primary" %>
-    <span class="mx-3">or</span>
-    <%= link_to "Sign In", sign_in_path %>
-    <% if ActionAuth.configuration.passkey_only? %>
-      <span class="mx-3">or</span>
-      <%= link_to "Passkey", new_sessions_passkey_path %>
-    <% end %>
   </div>
 <% end %>
 
-<div class="mb-3">
-  <%= link_to "Sign Up", sign_up_path %> |
-  <%= link_to "Reset Password", new_identity_password_reset_path %>
-  <% if ActionAuth.configuration.verify_email_on_sign_in %>
-    | <%= link_to "Verify Email", identity_email_verification_path %>
-  <% end %>
-</div>
+<%= render "action_auth/shared/links" %>

data/app/views/action_auth/sms_auths/sign_ins/show.html.erb

@@ -1,10 +1,11 @@
+<%= render "action_auth/shared/flash" %>
+
 <h1>Verify SMS Code</h1>
 
 <%= form_with(url: sms_auths_sign_ins_path) do |form| %>
-  <%= form.hidden_field :phone_number, value: cookies.signed[:sms_auth_phone_number] %>
   <div class="mb-3">
     <%= form.label :sms_code, style: "display: block" %>
-    <%= form.number_field :sms_code, required: true, autofocus: true, autocomplete: "one-time-code" %>
+    <%= form.text_field :sms_code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric" %>
   </div>
 
   <div class="mb-3">
@@ -12,3 +13,6 @@
   </div>
 <% end %>
 
+<div>
+  <%= link_to "Send a new code", new_sms_auths_requests_path %>
+</div>

data/app/views/action_auth/user_mailer/account_locked.html.erb

@@ -0,0 +1,17 @@
+<p>Hey there,</p>
+
+<p>
+  There have been too many failed attempts to sign in to <strong><%= @user.email %></strong>,
+  so we've locked sign in with a password<% if @duration %> for the next <%= distance_of_time_in_words(@duration) %><% end %>.
+</p>
+
+<p>
+  If that was you, you can get back in now by
+  <%= link_to "resetting your password", new_identity_password_reset_url %>.
+</p>
+
+<p>
+  If it wasn't, someone may be trying to guess your password. Those attempts failed,
+  and devices you're already signed in on aren't affected. Consider changing
+  your password if you use it anywhere else.
+</p>

data/app/views/action_auth/user_mailer/account_locked.text.erb

@@ -0,0 +1,12 @@
+Hey there,
+
+There have been too many failed attempts to sign in to <%= @user.email %>,
+so we've locked sign in with a password<% if @duration %> for the next <%= distance_of_time_in_words(@duration) %><% end %>.
+
+If that was you, you can get back in now by resetting your password:
+
+<%= new_identity_password_reset_url %>
+
+If it wasn't, someone may be trying to guess your password. Those attempts failed,
+and devices you're already signed in on aren't affected. Consider changing
+your password if you use it anywhere else.

data/app/views/action_auth/user_mailer/email_verification.html.erb

@@ -15,3 +15,8 @@
 <p>
   <%= link_to "Yes, use this email for my account", identity_email_verification_url(sid: @signed_id) %>
 </p>
+
+<p>
+  You'll be asked for your password. If you didn't sign up, you can safely ignore
+  this email and nothing will change.
+</p>

data/app/views/action_auth/user_mailer/email_verification.text.erb

@@ -7,3 +7,6 @@ that's where we'll email a reset link.
 You must click the link below to confirm that you received this email.
 
 <%= identity_email_verification_url(sid: @signed_id) %>
+
+You'll be asked for your password. If you didn't sign up, you can safely ignore
+this email and nothing will change.

data/app/views/action_auth/user_mailer/magic_link.html.erb

@@ -1,3 +1,7 @@
 <p>
   Use this <%= link_to "link", magics_sign_ins_url(token: @signed_id) %> to sign in.
 </p>
+
+<p>
+  It expires in 20 minutes and only works once. If you didn't request it you can safely ignore this email.
+</p>

data/app/views/action_auth/user_mailer/magic_link.text.erb

@@ -0,0 +1,5 @@
+Use this link to sign in:
+
+<%= magics_sign_ins_url(token: @signed_id) %>
+
+It expires in 20 minutes and only works once. If you didn't request it you can safely ignore this email.

data/app/views/action_auth/user_mailer/password_reset.text.erb

@@ -1,6 +1,6 @@
 Hey there,
 
-Can't remember your password for <strong><%= @user.email %></strong>?
+Can't remember your password for <%= @user.email %>?
 That's OK, it happens. Just hit the link below to set a new one.
 
 <%= edit_identity_password_reset_url(sid: @signed_id) %>