add_auth 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33de30a9b51e6aff4236af059703155e8eeed6692497df9657c2958d37d21536
-  data.tar.gz: a3dd63d2b854c69f4f17af73d067f7dc5b9c5fd3105ce9b45cd2d1aec8eb943f
+  metadata.gz: 5856e424011a6e4b49dabd271324aadd29862aad6e0dc5a8b5e06c6e1ea27186
+  data.tar.gz: 5169c854a4428c4daee558abb68208eae29a1f5ae98b91478c9e803ccb3383d4
 SHA512:
-  metadata.gz: ac89ed45158b07a68a94fba2c832781b1f5a38f732217f29992865dc0b0f532ae6e0e70f79c746b1a962f07cad4f7ec0cadff71485d79d1c569af07ef2c3887c
-  data.tar.gz: 99459566fa90408261c16d2cd3453c168e3800a913cdbe48b44ebc4b64dd13a2cddda3661097b01d12f39cc89415b395158fb0c50b6fa335412fa5544a91f022
+  metadata.gz: ee5a6a0df85d2719372eba860f0afb1030c3c1ccaf5644fd0ece45395e0f648bd689e0cb8b8b48a04ffa3fb5d066aab5aa8d4925ba502d0db26e8922c48302a9
+  data.tar.gz: 5b9bcc71dd3f72271dd140eb9b335cc93feb6222ec4a95e012afc2eaaa6f96945cd3ff7193e2fbfd816dc4e66bcaea293f9075ae9948931892952a4ba9b25b74

data/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.3.0 — 2026-09-09
+
+Optional account lifecycle, bounded Devise migration and native authentication.
+The standard Rails-generator installation remains supported; enable only the
+additional capabilities your host needs. The latest-0.x support policy continues.
+
+- Add read-only Devise inventory, additive account preparation, explicit legacy
+  password adoption and retired-source write fences. Preserve account IDs and
+  reject ambiguous identifier/credential conversions.
+- Add optional registration, confirmation/reconfirmation, reset, lock/unlock,
+  account changes and remembered sessions with shared Core policy and delivery.
+- Integrate maintained provider libraries without owning their registrations,
+  protocol exchange, unrelated routes or provider API credentials. Preserve
+  identity ownership and require independent enrollment confirmation.
+- Add opt-in finite native sessions, account-scoped revocation, S256-bound
+  single-use browser handoffs and optional nonce-bound Apple token verification.
+  Mobile duration settings are separate from browser settings; refresh-token
+  families are not part of this finite profile.
+- Verify generated/ejected pages with Turbo, ordinary JavaScript without Turbo
+  and permitted no-JS. Add populated migration, checkpoint, compatibility
+  rollback, provider and native integration fixtures.
+
+## 0.2.2 — 2026-09-08
+
+- Reject Solid Cache as an authentication rate-limit store: simultaneous first
+  increments can be lost. Runtime fails closed and doctor explains how to
+  configure a separate atomic store. Solid Queue and ordinary application
+  caching remain independent choices. No schema, cookie or job-format change.
+- Add checksum-pinned upgrades from the published 0.2.1 package to the candidate
+  and back, including persisted authority, pending delivery and customized
+  ejections; run this acceptance on every supported Ruby/Rails CI combination.
+- Verify Solid Queue with a separate queue database, demonstrate Solid Cache
+  counter unsuitability on PostgreSQL, and measure bounded maintenance.
+- Refresh immutable checkout action pins to 7.0.1 and add upgrade/compatibility
+  guidance. See the upgrade guide before changing a deployed bundle.
+
 ## 0.2.1 — 2026-09-07
 
 - Install release dependencies into RubyGems' normal gem path so the attestation

data/README.md

@@ -1,6 +1,6 @@
 # AddAuth
 
-**0.2.1:** password, email-link and passkey sign-in extend
+**0.3.0:** password, email-link and passkey sign-in extend
 Rails' generated authentication. AddAuth adds hardened sessions, verification
 for sensitive actions, passkey management and email recovery with an optional
 strict policy. Turnstile and reCAPTCHA integrations are available. See
@@ -9,6 +9,11 @@ strict policy. Turnstile and reCAPTCHA integrations are available. See
 AddAuth builds on top of Rails 8's built-in login system instead of
 replacing it -- it keeps using your existing `User` and `Session` models.
 
+Version 0.3.0 adds optional account lifecycle, bounded Devise migration,
+provider-library integration and finite Android/iOS sessions. See the
+[migration guide](https://addauthgem.com/migrating-from-devise/) before changing
+an existing Devise app; do not run the Rails generator over its custom files.
+
 Read the [documentation](https://addauthgem.com) for setup guides, configuration
 reference and troubleshooting.
 
@@ -18,18 +23,18 @@ Install the `add_auth` gem from RubyGems through your Rails app’s Gemfile,
 then enable password and email-link sign-in. Use Ruby 3.3+ and Rails 8.0+
 with Active Record, and run the commands below from your Rails app’s root.
 
-**Release availability:** these commands require the published `0.2.1` package.
+**Release availability:** these commands require the published `0.3.0` package.
 If it is not yet listed on [RubyGems](https://rubygems.org/gems/add_auth/versions),
 wait for publication; see [release status](https://addauthgem.com/release-status/).
 Start in your app’s development environment; use the deployment settings
 below before enabling sign-in for users.
 
 1. Keep `source "https://rubygems.org"` in your app’s Gemfile and add the
-   0.2 release line:
+   0.3 release line:
 
    ```ruby
    # Gemfile
-   gem "add_auth", "~> 0.2.1"
+   gem "add_auth", "~> 0.3.0"
    ```
 
    Bundler downloads the package from RubyGems and records the resolved
@@ -39,8 +44,8 @@ below before enabling sign-in for users.
    bundle install
    ```
 
-2. If your app doesn't already have Rails' built-in login system, add it
-   first:
+2. For a fresh app without an existing authentication system, generate
+   Rails' built-in login system:
 
    ```sh
    bin/rails generate authentication
@@ -101,12 +106,18 @@ generators again later -- they won't overwrite changes you've already made.
 AddAuth.configure do |config|
   config.base_url = "https://accounts.example.com"
   config.mail_from = "Accounts <sign-in@example.com>"
-  config.rate_limit_store = Rails.cache
+  config.rate_limit_store = ActiveSupport::Cache::RedisCacheStore.new(
+    url: ENV.fetch("AUTH_REDIS_URL"), namespace: "add_auth"
+  )
   # Only let certain accounts sign in, e.g. skip unconfirmed or banned users:
   # config.eligible = ->(user) { user.confirmed? && !user.disabled? }
 end
 ```
 
+For this example, add `gem "redis", "~> 5.4"` to the host Gemfile, run
+`bundle install`, and configure `AUTH_REDIS_URL` for every web/worker/scheduler
+process. Keep their namespace identical.
+
 Before real users touch this, make sure of three things:
 
 - **Email actually sends.** Configure Action Mailer's SMTP settings for
@@ -115,9 +126,11 @@ Before real users touch this, make sure of three things:
   background job, so use a real Active Job backend like Sidekiq or Solid
   Queue -- not Rails' default in-memory one, which forgets everything on
   deploy.
-- **Your cache is shared across servers**, e.g. Redis, Memcached or Solid
-  Cache -- not each server's own memory. Otherwise sign-in rate limits only
-  apply per-server instead of across your whole app.
+- **Abuse counters are shared and atomic**, including the first increment and
+  expiry under concurrent requests. RedisCacheStore has local acceptance. Solid
+  Cache is unsuitable: its absent-row increment can lose concurrent requests.
+  Keep application caching separate from `rate_limit_store`; local MemoryStore
+  is for a single-process trial. Other adapters require their own atomic/TTL proof.
 
 Then schedule this to run at least once a minute, however you run scheduled
 jobs (cron, `whenever`, your platform's scheduler):
@@ -478,6 +491,13 @@ Selenium in the host test bundle. AddAuth itself uses RSpec.
 
 ## Operations and rollback
 
+See the [persisted-host upgrade guide](https://addauthgem.com/upgrading/) and
+[integration boundaries](https://addauthgem.com/compatibility/) before changing
+a deployed bundle. The published 0.2.1 doctor cannot detect Solid Cache's
+concurrent-initialization race; 0.2.2 rejects that known
+incompatible adapter at runtime and reports a separate-store remedy in doctor.
+
+
 Run doctor after migrations and template upgrades. Expand schemas before enabling
 features; generators preserve existing sessions and credentials. Keep the new
 reader during rollback while browser-bound proofs or strict accounts exist.
@@ -518,14 +538,33 @@ or recovery procedures work in production.
 
 ## Scope
 
-AddAuth 0.2 implements password/email/passkey sign-in, session
-adoption and management, purpose-bound verification, passkey recovery and
-strict account policy, durable security mail, and challenge adapters. Account
-provisioning, address confirmation and password reset remain host responsibilities.
-Release acceptance uses local real-database, generated-host, browser and
-SMTP/queue/cache tests. Hosts verify their own live providers and supported
-physical devices before deployment. Recovery codes and AddAuth-owned password
-policy remain deferred.
+AddAuth 0.3 implements password/email/passkey sign-in, session adoption and
+management, purpose-bound verification, passkey recovery and strict account
+policy, durable security mail and challenge adapters. Optional account lifecycle
+adds registration, confirmation/reconfirmation, password reset, lock/unlock and
+account changes. Hosts retain account eligibility, resource authorization and
+provider registrations.
+
+## Optional integrations in 0.3.0
+
+Enable bounded [Devise migration](https://addauthgem.com/migrating-from-devise/),
+[account lifecycle](https://addauthgem.com/account-lifecycle/),
+[provider sign-in](https://addauthgem.com/omniauth/) and
+[Android/iOS sessions](https://addauthgem.com/mobile-authentication/) independently.
+Provider protocol handling stays with maintained libraries. Native sessions use
+finite expiry; the verified profile is 30 days absolute and 14 days idle, with
+fresh sign-in after expiry. Refresh-token families are not included.
+
+Migration evidence covers the documented Devise 5.0.4 source profiles, including
+integer and UUID accounts; it does not establish universal Devise-module parity.
+Preserve current credentials and revocations during cutover and compatible
+rollback. Follow the migration guide before removing Devise or retiring columns.
+
+Release acceptance uses local real-database, generated-host, browser,
+SMTP/queue/cache and native-consumer tests. Hosts verify their own live providers
+and supported physical devices before deployment. Recovery codes and multiple
+realms remain deferred. See [ROADMAP.md](ROADMAP.md) for scope and progress, and
+[CONTRIBUTING.md](CONTRIBUTING.md) for synthetic acceptance commands.
 
 ## Roadmap