action_auth 1.8.9 → 2.0.0

data/app/views/action_auth/webauthn_credential_authentications/new.html.erb

@@ -1,5 +1,11 @@
+<%= render "action_auth/shared/flash" %>
+
+<%= action_auth_webauthn_tags %>
+
 <h2 class="action-auth--text-center">Use a passkey to sign in</h2>
 
+<%= render "action_auth/shared/webauthn_error" %>
+
 <%= content_tag :div,
   id: "webauthn_credential_form",
   data: {
@@ -13,6 +19,6 @@
   </div>
 <% end %>
 
-<%= content_for :cancel_path do %>
-  <%= link_to "Cancel", action_auth.sign_in_path %>
-<% end %>
+<div class="action-auth--text-center">
+  <%= link_to "Cancel", sign_in_path %>
+</div>

data/app/views/action_auth/webauthn_credentials/new.html.erb

@@ -1,4 +1,11 @@
+<%= render "action_auth/shared/flash" %>
+
+<%= action_auth_webauthn_tags %>
+
 <h2 class="action-auth--text-center">Add a security key</h2>
+
+<%= render "action_auth/shared/webauthn_error" %>
+
 <%= form_with scope: :webauthn_credential,
               url: options_for_webauthn_credentials_path,
               id: "webauthn_credential_form",
@@ -20,6 +27,6 @@
   </div>
 <% end %>
 
-<%= content_for :cancel_path do %>
-  <%= link_to "Cancel", action_auth.sessions_path %>
-<% end %>
+<div class="action-auth--text-center">
+  <%= link_to "Cancel", sessions_path %>
+</div>

data/app/views/layouts/action_auth/application.html.erb

@@ -1,17 +1,12 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <title>Action Auth</title>
+  <title><%= content_for(:title).presence || "Action Auth" %></title>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
   <%= stylesheet_link_tag "action_auth/application", media: "all" %>
-  <%= javascript_include_tag "action_auth/application", "data-turbo-track": "reload", type: "module" %>
-  <% if ActionAuth.configuration.webauthn_enabled? %>
-    <%= tag :meta, name: :webauthn_auth_url, content: action_auth.webauthn_credential_authentications_url %>
-    <%= tag :meta, name: :webauthn_cred_url, content: action_auth.webauthn_credentials_url %>
-    <%= tag :meta, name: :webauthn_redirect_url, content: action_auth.sessions_url %>
-  <% end %>
+  <%= action_auth_webauthn_tags if action_auth_webauthn_screen? %>
 </head>
 <body class="bg-light">
   <div class="<%= defined?(@action_auth_wide) ? 'container-fluid' : 'container' %> bg-white border pb-3">

data/config/routes.rb

@@ -6,7 +6,7 @@ ActionAuth::Engine.routes.draw do
 
   namespace :identity do
     resource :email,              only: [:edit, :update]
-    resource :email_verification, only: [:show, :create]
+    resource :email_verification, only: [:show, :create, :update]
     resource :password_reset,     only: [:new, :edit, :create, :update]
   end
   resource  :password, only: [:edit, :update]
@@ -15,7 +15,7 @@ ActionAuth::Engine.routes.draw do
       resources :passkeys, only: [:new, :create]
     end
   end
-  resources :sessions, only: [:index, :show, :destroy]
+  resources :sessions, only: [:index, :destroy]
 
   if ActionAuth.configuration.allow_user_deletion?
     resource  :users, only: [:destroy]
@@ -31,7 +31,7 @@ ActionAuth::Engine.routes.draw do
 
   if ActionAuth.configuration.magic_link_enabled?
     namespace :magics do
-      resource :sign_ins, only: [:show]
+      resource :sign_ins, only: [:show, :create]
       resource :requests, only: [:new, :create]
     end
   end
@@ -42,4 +42,14 @@ ActionAuth::Engine.routes.draw do
       resource :requests, only: [:new, :create]
     end
   end
+
+  if ActionAuth.configuration.oauth_enabled?
+    # OmniAuth answers POST auth/:provider for every configured provider before
+    # the router sees it. This route names the path, and catches any other provider.
+    post  "auth/:provider",          to: "provider_callbacks#failure", as: :oauth_request
+    get   "auth/failure",            to: "provider_callbacks#failure", as: :oauth_failure
+    match "auth/:provider/callback", to: "provider_callbacks#create",  as: :oauth_callback, via: [:get, :post]
+
+    resources :connected_accounts, only: [:destroy]
+  end
 end

data/db/migrate/20261105120000_add_magic_link_used_at_to_users.rb

@@ -0,0 +1,5 @@
+class AddMagicLinkUsedAtToUsers < ActiveRecord::Migration[7.2]
+  def change
+    add_column :users, :magic_link_used_at, :datetime
+  end
+end

data/db/migrate/20261105130000_add_account_lockout_and_suspension_to_users.rb

@@ -0,0 +1,7 @@
+class AddAccountLockoutAndSuspensionToUsers < ActiveRecord::Migration[7.2]
+  def change
+    add_column :users, :failed_sign_in_attempts, :integer, null: false, default: 0
+    add_column :users, :account_locked_at, :datetime
+    add_column :users, :account_suspended_at, :datetime
+  end
+end

data/db/migrate/20261105130100_create_action_auth_connected_accounts.rb

@@ -0,0 +1,19 @@
+class CreateActionAuthConnectedAccounts < ActiveRecord::Migration[7.2]
+  def change
+    # Copied from the existing column, because an app's users.id isn't always a
+    # bigint, and a foreign key of another type is refused by some databases.
+    user_id_type = columns(:users).find { |column| column.name == "id" }.sql_type
+
+    create_table :action_auth_connected_accounts do |t|
+      # Cascades so that deleting a user works even if OAuth has since been turned off.
+      t.references :user, null: false, type: user_id_type, foreign_key: { on_delete: :cascade }
+      t.string :provider, null: false
+      t.string :uid, null: false
+      t.string :display_name
+
+      t.timestamps
+
+      t.index [:provider, :uid], unique: true
+    end
+  end
+end

data/lib/action_auth/configuration.rb

@@ -1,5 +1,20 @@
 module ActionAuth
   class Configuration
+    OAUTH_PROVIDER_LABELS = {
+      "facebook" => "Facebook",
+      "github" => "GitHub",
+      "google_oauth2" => "Google",
+      "twitter" => "Twitter",
+      "twitter2" => "X"
+    }.freeze
+
+    # One OmniAuth strategy and the arguments to start it with. The key is what
+    # OmniAuth calls it, and appears in its paths: auth/:key and auth/:key/callback.
+    OauthProvider = Struct.new(:strategy, :args, :options, :label) do
+      def key
+        (options[:name] || strategy).to_s
+      end
+    end
 
     attr_accessor :allow_user_deletion
     attr_accessor :default_from_email
@@ -15,8 +30,41 @@ module ActionAuth
     attr_accessor :password_complexity_check
     attr_accessor :session_timeout
 
+    # Temporarily stops password and SMS code sign in after too many failures in a
+    # row. A nil duration keeps the account locked until it's unlocked or the
+    # password is reset.
+    attr_accessor :account_lockout_enabled
+    attr_accessor :account_lockout_max_attempts
+    attr_accessor :account_lockout_duration
+
+    # Lets your app block an account from signing in at all, with
+    # user.suspend_account!. ActionAuth never suspends anyone by itself.
+    attr_accessor :account_suspension_enabled
+
+    # Sign in through other sites. Needs the omniauth gem and at least one
+    # config.oauth_provider. Must be set in an initializer, not in an
+    # after_initialize block, because the routes depend on it.
+    attr_accessor :oauth_enabled
+    attr_reader :oauth_providers
+
     attr_accessor :insert_cookie_domain
 
+    # The layout for ActionAuth's screens, e.g. "application". The default (nil)
+    # uses layouts/action_auth/application, which an app can also override by
+    # creating that file.
+    attr_accessor :layout
+
+    # The class ActionAuth's controllers inherit from, as a String. Set this to
+    # "ApplicationController" when a custom layout or view needs your app's
+    # helpers. Must be set in an initializer, not in an after_initialize block.
+    attr_accessor :parent_controller
+
+    # Where to send people after signing in and out. Either a path String or a
+    # Proc evaluated in the controller, e.g. -> { main_app.dashboard_path }.
+    # The default (nil) is your app's root path.
+    attr_accessor :after_sign_in_path
+    attr_accessor :after_sign_out_path
+
     def initialize
       @allow_user_deletion = true
       @default_from_email = Rails.application.config.action_mailer.default_options&.dig(:from) || "noreply@#{ENV['HOST'] || 'example.com'}"
@@ -32,7 +80,20 @@ module ActionAuth
       @webauthn_rp_name = Rails.application.class.to_s.deconstantize
       @session_timeout = 2.weeks
 
+      @account_lockout_enabled = true
+      @account_lockout_max_attempts = 10
+      @account_lockout_duration = 30.minutes
+      @account_suspension_enabled = true
+
+      @oauth_enabled = defined?(OmniAuth)
+      @oauth_providers = []
+
       @insert_cookie_domain = false
+
+      @layout = nil
+      @parent_controller = "ActionController::Base"
+      @after_sign_in_path = nil
+      @after_sign_out_path = nil
     end
 
     def allow_user_deletion?
@@ -51,11 +112,17 @@ module ActionAuth
       webauthn_enabled? && @passkey_only == true
     end
 
+    # The webauthn and pwned gems are optional, so these can only be on when the
+    # gem is actually loaded, whatever the initializer says.
     def webauthn_enabled?
+      return false unless defined?(WebAuthn)
+
       @webauthn_enabled.respond_to?(:call) ? @webauthn_enabled.call : @webauthn_enabled
     end
 
     def pwned_enabled?
+      return false unless defined?(Pwned)
+
       @pwned_enabled.respond_to?(:call) ? @pwned_enabled.call : @pwned_enabled
     end
 
@@ -63,5 +130,34 @@ module ActionAuth
       @password_complexity_check == true
     end
 
+    def account_lockout_enabled?
+      @account_lockout_enabled == true
+    end
+
+    def account_suspension_enabled?
+      @account_suspension_enabled == true
+    end
+
+    # Adds a provider. Takes the same arguments as OmniAuth's provider method,
+    # plus an optional label for the buttons:
+    #
+    #   config.oauth_provider :github, ENV["GITHUB_ID"], ENV["GITHUB_SECRET"], scope: "user:email"
+    def oauth_provider(strategy, *args, label: nil, **options)
+      provider = OauthProvider.new(strategy, args, options)
+      provider.label = label || OAUTH_PROVIDER_LABELS.fetch(provider.key) { provider.key.titleize }
+
+      @oauth_providers.reject! { |existing| existing.key == provider.key }
+      @oauth_providers << provider
+    end
+
+    # Having the gem isn't enough, since an app may use OmniAuth for something of
+    # its own. It takes a provider added here for ActionAuth to get involved.
+    def oauth_enabled?
+      return false unless defined?(OmniAuth)
+      return false if @oauth_providers.empty?
+
+      @oauth_enabled.respond_to?(:call) ? @oauth_enabled.call : @oauth_enabled
+    end
+
   end
 end

data/lib/action_auth/controllers/helpers.rb

@@ -3,9 +3,12 @@ module ActionAuth
     module Helpers
       extend ActiveSupport::Concern
 
+      ACCOUNT_SUSPENDED_MESSAGE = "This account has been suspended.".freeze
+
       included do
         before_action :set_current_request_details
         before_action :check_session_timeout
+        before_action :check_action_auth_suspension
 
         def current_user; Current.user; end
         helper_method :current_user
@@ -21,12 +24,19 @@ module ActionAuth
           redirect_to new_user_session_path
         end
         helper_method :authenticate_user!
+
+        # True inside ActionAuth's own controllers. Lets an app that uses
+        # config.parent_controller exempt them from its other filters:
+        #   before_action :require_subscription, unless: :action_auth_controller?
+        def action_auth_controller?; false; end
+        helper_method :action_auth_controller?
       end
 
       private
 
       def set_current_request_details
-        Current.session = Session.find_by(id: cookies.signed[:session_token])
+        session_token = cookies.signed[:session_token]
+        Current.session = Session.find_by(id: session_token) if session_token.present?
         Current.user_agent = request.user_agent
         Current.ip_address = request.ip
 
@@ -35,28 +45,51 @@ module ActionAuth
                               Current.session.user_agent != Current.user_agent)
           Rails.logger.warn "Session environment changed for user #{Current.user&.id}: IP or User-Agent mismatch"
           # Optional: Force re-authentication for suspicious activity
-          # cookies.delete(:session_token, secure: Rails.env.production?, same_site: :lax)
+          # delete_action_auth_session_cookie
           # Current.session = nil
         end
       end
 
       def check_session_timeout
-        return unless Current.session
-        return if Rails.env.test?
-
         timeout = ActionAuth.configuration.session_timeout
+        return unless Current.session && timeout
+
         if Current.session.updated_at < timeout.ago
-          Rails.logger.info "Session timed out for user #{Current.user&.id}"
+          Rails.logger.info "Session timed out for user #{Current.session.user_id}"
           Current.session.destroy
-          cookie_options = {}
-          cookie_options[:secure] = Rails.env.production? if Rails.env.production?
-          cookie_options[:same_site] = :lax unless Rails.env.test?
-          cookies.delete(:session_token, cookie_options)
+          Current.session = nil
+          delete_action_auth_session_cookie
           redirect_to new_user_session_path, alert: "Your session has expired. Please sign in again."
-        else
+        elsif Current.session.updated_at < 1.minute.ago
+          # Inactivity is tracked to the minute, so most requests don't need a write.
           Current.session.touch
         end
       end
+
+      # suspend_account! already ends the account's sessions. This catches the rest:
+      # a suspension set some other way, or a sign in that finished at the same moment.
+      def check_action_auth_suspension
+        return unless Current.session && User.account_suspension_available?
+        return unless Current.session.user.account_suspended?
+
+        Rails.logger.info "Ended a session of suspended user #{Current.session.user_id}"
+        Current.session.destroy
+        Current.session = nil
+        delete_action_auth_session_cookie
+        redirect_to new_user_session_path, alert: ACCOUNT_SUSPENDED_MESSAGE
+      end
+
+      def action_auth_session_cookie_options
+        options = { httponly: true, same_site: :lax }
+        options[:secure] = true if Rails.env.production? || request.ssl?
+        options[:domain] = :all if ActionAuth.configuration.insert_cookie_domain
+        options
+      end
+
+      # A cookie can only be deleted with the domain it was set with.
+      def delete_action_auth_session_cookie
+        cookies.delete(:session_token, action_auth_session_cookie_options)
+      end
     end
   end
 end

data/lib/action_auth/engine.rb

@@ -14,8 +14,34 @@ module ActionAuth
       ActiveSupport.on_load :action_controller_base do
         helper_method :user_sessions_path, :user_session_path, :new_user_session_path
         helper_method :new_user_registration_path
-        helper_method :edit_user_password_path
+        helper_method :edit_user_password_path, :user_password_path
       end
     end
+
+    # Propshaft picks up engine assets by itself; Sprockets needs to be told.
+    initializer 'action_auth.assets' do |app|
+      app.config.assets.precompile << "action_auth_manifest.js" if defined?(Sprockets::Rails)
+    end
+
+    # OmniAuth runs inside the engine, so its paths follow wherever the app mounts
+    # ActionAuth and the rest of the app never goes through it.
+    initializer 'action_auth.oauth', after: :load_config_initializers do
+      next unless ActionAuth.configuration.oauth_enabled?
+
+      OmniAuth.config.logger = Rails.logger
+
+      config.middleware.use(OmniAuth::Builder) do
+        ActionAuth.configuration.oauth_providers.each do |oauth|
+          provider(oauth.strategy, *oauth.args, **oauth.options)
+        end
+      end
+    end
+
+    # An app that keeps the generated, fully commented out initializer never
+    # calls ActionAuth.configure, but still gets WebAuthn routes if the gem is
+    # installed. Those need the origin set too.
+    config.after_initialize do
+      ActionAuth.configure_webauthn
+    end
   end
 end

data/lib/action_auth/routing/helpers.rb

@@ -17,6 +17,14 @@ module ActionAuth
         action_auth.sign_up_path
       end
 
+      def edit_user_password_path
+        action_auth.edit_password_path
+      end
+
+      def user_password_path
+        action_auth.password_path
+      end
+
       def edit_password_path
         action_auth.edit_password_path
       end

data/lib/action_auth/version.rb

@@ -1,3 +1,3 @@
 module ActionAuth
-  VERSION = "1.8.9"
+  VERSION = "2.0.0"
 end

data/lib/generators/action_auth/views/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Copies ActionAuth's views into app/views/action_auth so you can edit them.
+    With no arguments it copies everything. Pass scopes to copy only some.
+
+Examples:
+    bin/rails generate action_auth:views
+    bin/rails generate action_auth:views sessions registrations
+    bin/rails generate action_auth:views sessions --layout

data/lib/generators/action_auth/views/views_generator.rb

@@ -0,0 +1,59 @@
+require "rails/generators"
+
+module ActionAuth
+  module Generators
+    class ViewsGenerator < Rails::Generators::Base
+      SCOPES = %w[
+        sessions
+        registrations
+        passwords
+        identity
+        magics
+        sms_auths
+        webauthn_credentials
+        webauthn_credential_authentications
+        user_mailer
+        shared
+      ].freeze
+
+      source_root File.expand_path("../../../../app/views", __dir__)
+
+      desc "Copies ActionAuth's views into your app so you can change them."
+
+      argument :scopes, type: :array, default: [], banner: "scope scope ...",
+        desc: "Only copy these groups of views: #{SCOPES.join(', ')}"
+
+      class_option :layout, type: :boolean, default: false,
+        desc: "Also copy layouts/action_auth/application.html.erb"
+
+      def check_scopes
+        unknown = scopes - SCOPES
+        return if unknown.empty?
+
+        raise Thor::Error, "Unknown scope: #{unknown.join(', ')}. Choose from: #{SCOPES.join(', ')}"
+      end
+
+      def copy_views
+        (scopes.presence || SCOPES).each do |scope|
+          directory "action_auth/#{scope}", "app/views/action_auth/#{scope}"
+        end
+      end
+
+      def copy_layout
+        return unless options[:layout]
+
+        copy_file "layouts/action_auth/application.html.erb", "app/views/layouts/action_auth/application.html.erb"
+      end
+
+      def show_next_steps
+        say <<~MESSAGE
+
+          Your copies now take priority over the ones in the gem, but they also
+          won't pick up changes from future ActionAuth versions. Delete any you
+          didn't change so they keep following the gem.
+
+        MESSAGE
+      end
+    end
+  end
+end

data/lib/tasks/action_auth_tasks.rake

@@ -19,6 +19,23 @@ namespace :action_auth do
           #   config.webauthn_origin = "http://localhost:3000" # or "https://example.com"
           #   config.webauthn_rp_name = Rails.application.class.to_s.deconstantize
           #   config.insert_cookie_domain = false
+          #   config.password_complexity_check = true
+          #   config.session_timeout = 2.weeks
+          #
+          #   # Both are on by default. See the ActionAuth README.
+          #   config.account_lockout_enabled = true
+          #   config.account_lockout_max_attempts = 10
+          #   config.account_lockout_duration = 30.minutes
+          #   config.account_suspension_enabled = true
+          #
+          #   # Sign in through other sites. Needs the omniauth gems, see "OAuth" in the ActionAuth README.
+          #   config.oauth_provider :github, ENV["GITHUB_CLIENT_ID"], ENV["GITHUB_CLIENT_SECRET"], scope: "user:email"
+          #
+          #   # Customizing the screens. See "Customizing" in the ActionAuth README.
+          #   config.layout = "application"
+          #   config.parent_controller = "ApplicationController"
+          #   config.after_sign_in_path = "/dashboard" # or -> { main_app.dashboard_path }
+          #   config.after_sign_out_path = "/"
           # end
           #
           # Rails.application.config.after_initialize do
@@ -42,7 +59,8 @@ namespace :action_auth do
     routes_file_path = Rails.root.join('config', 'routes.rb')
     route_line = "mount ActionAuth::Engine => \"/action_auth\""
     routes_content = File.read(routes_file_path)
-    unless routes_content.include?(route_line)
+    # Any mount counts, however it's written. Mounting twice stops the app from booting.
+    unless routes_content.match?(/^[^#\n]*ActionAuth::Engine/)
       insert_after = "Rails.application.routes.draw do"
       new_routes_content = routes_content.sub(/(#{insert_after})/i, "\\1\n  #{route_line}\n")
       File.open(routes_file_path, 'w') do |file|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: action_auth
 version: !ruby/object:Gem::Version
-  version: 1.8.9
+  version: 2.0.0
 platform: ruby
 authors:
 - Dave Kimura
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
 - !ruby/object:Gem::Dependency
   name: bcrypt
   requirement: !ruby/object:Gem::Requirement
@@ -45,6 +45,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - MIT-LICENSE
 - README.md
 - Rakefile
@@ -52,12 +53,14 @@ files:
 - app/assets/javascripts/action_auth/application.js
 - app/assets/stylesheets/action_auth/application.css
 - app/controllers/action_auth/application_controller.rb
+- app/controllers/action_auth/connected_accounts_controller.rb
 - app/controllers/action_auth/identity/email_verifications_controller.rb
 - app/controllers/action_auth/identity/emails_controller.rb
 - app/controllers/action_auth/identity/password_resets_controller.rb
 - app/controllers/action_auth/magics/requests_controller.rb
 - app/controllers/action_auth/magics/sign_ins_controller.rb
 - app/controllers/action_auth/passwords_controller.rb
+- app/controllers/action_auth/provider_callbacks_controller.rb
 - app/controllers/action_auth/registrations_controller.rb
 - app/controllers/action_auth/sessions/passkeys_controller.rb
 - app/controllers/action_auth/sessions_controller.rb
@@ -71,24 +74,39 @@ files:
 - app/mailers/action_auth/application_mailer.rb
 - app/mailers/action_auth/user_mailer.rb
 - app/models/action_auth/application_record.rb
+- app/models/action_auth/connected_account.rb
 - app/models/action_auth/current.rb
 - app/models/action_auth/session.rb
 - app/models/action_auth/user.rb
 - app/models/action_auth/webauthn_credential.rb
+- app/views/action_auth/identity/email_verifications/show.html.erb
 - app/views/action_auth/identity/emails/edit.html.erb
 - app/views/action_auth/identity/password_resets/edit.html.erb
 - app/views/action_auth/identity/password_resets/new.html.erb
 - app/views/action_auth/magics/requests/new.html.erb
+- app/views/action_auth/magics/sign_ins/show.html.erb
 - app/views/action_auth/passwords/edit.html.erb
 - app/views/action_auth/registrations/new.html.erb
+- app/views/action_auth/sessions/_account.html.erb
+- app/views/action_auth/sessions/_connected_accounts.html.erb
+- app/views/action_auth/sessions/_security_keys.html.erb
+- app/views/action_auth/sessions/_sessions.html.erb
 - app/views/action_auth/sessions/index.html.erb
 - app/views/action_auth/sessions/new.html.erb
 - app/views/action_auth/sessions/passkeys/new.html.erb
+- app/views/action_auth/shared/_errors.html.erb
+- app/views/action_auth/shared/_flash.html.erb
+- app/views/action_auth/shared/_links.html.erb
+- app/views/action_auth/shared/_oauth_buttons.html.erb
+- app/views/action_auth/shared/_webauthn_error.html.erb
 - app/views/action_auth/sms_auths/requests/new.html.erb
 - app/views/action_auth/sms_auths/sign_ins/show.html.erb
+- app/views/action_auth/user_mailer/account_locked.html.erb
+- app/views/action_auth/user_mailer/account_locked.text.erb
 - app/views/action_auth/user_mailer/email_verification.html.erb
 - app/views/action_auth/user_mailer/email_verification.text.erb
 - app/views/action_auth/user_mailer/magic_link.html.erb
+- app/views/action_auth/user_mailer/magic_link.text.erb
 - app/views/action_auth/user_mailer/password_reset.html.erb
 - app/views/action_auth/user_mailer/password_reset.text.erb
 - app/views/action_auth/webauthn_credential_authentications/new.html.erb
@@ -103,12 +121,17 @@ files:
 - db/migrate/20240111142545_add_webauthn_id_to_users.rb
 - db/migrate/20240818032321_add_type_to_webauthn_credentials.rb
 - db/migrate/20241020172209_add_phone_number_to_users.rb
+- db/migrate/20261105120000_add_magic_link_used_at_to_users.rb
+- db/migrate/20261105130000_add_account_lockout_and_suspension_to_users.rb
+- db/migrate/20261105130100_create_action_auth_connected_accounts.rb
 - lib/action_auth.rb
 - lib/action_auth/configuration.rb
 - lib/action_auth/controllers/helpers.rb
 - lib/action_auth/engine.rb
 - lib/action_auth/routing/helpers.rb
 - lib/action_auth/version.rb
+- lib/generators/action_auth/views/USAGE
+- lib/generators/action_auth/views/views_generator.rb
 - lib/tasks/action_auth_tasks.rake
 homepage: https://www.github.com/kobaltz/action_auth
 licenses:
@@ -116,7 +139,7 @@ licenses:
 metadata:
   homepage_uri: https://www.github.com/kobaltz/action_auth
   source_code_uri: https://www.github.com/kobaltz/action_auth
-  changelog_uri: https://www.github.com/kobaltz/action_auth/CHANGELOG.md
+  changelog_uri: https://github.com/kobaltz/action_auth/blob/main/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -131,7 +154,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.4
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A simple Rails engine for authorization.
 test_files: []