add_auth 0.2.1 → 0.3.0

data/app/controllers/add_auth/accounts_controller.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    layout "add_auth/authentication"
+    helper AddAuth::SignInsHelper
+    before_action :require_feature
+    before_action :private_response
+    before_action :require_add_auth_authentication, only: %i[edit_email change_email edit_password change_password confirm_deletion destroy]
+    protect_from_forgery with: :exception
+    rescue_from AddAuth::Error, "ActiveJob::EnqueueError", with: :service_unavailable
+
+    def new = page("register")
+    def check_email = page("check_email")
+
+    def create
+      admitted = intake(:register)
+      return intake_failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.accounts.register(identifier: admitted, password: params[:password], profile: registration_profile)
+      if result.success?
+        redirect_to "/account/check-email", status: :see_other
+      else
+        @error = "Check your email and choose a password that meets this application's requirements."
+        page("register", status: :unprocessable_entity)
+      end
+    end
+
+    def request_form
+      @purpose = purpose
+      page("request")
+    end
+
+    def request_proof
+      @purpose = purpose
+      admitted = intake(:account_request)
+      return intake_failure(admitted) if %i[challenge_rejected challenge_unavailable].include?(admitted)
+      Rails::Runtime.enqueue_account_request(identifier: admitted, purpose: @purpose) unless admitted.is_a?(Symbol)
+      redirect_to "/account/check-email", status: :see_other
+    end
+
+    def proof
+      @purpose = purpose
+      result = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+      page(result.success? ? "proof" : "invalid_proof")
+    end
+
+    def consume
+      @purpose = purpose
+      admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :account_consume)
+      return intake_failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password])
+      if result.success?
+        redirect_to "/sign-in", status: :see_other, notice: "Your account has been updated. Sign in to start a new session."
+      else
+        @error = "This request could not be completed. Check the password requirements or request a new link."
+        page("proof", status: :unprocessable_entity)
+      end
+    end
+
+    def edit_email = page("email")
+    def edit_password = page("password")
+    def confirm_deletion = page("delete")
+
+    def destroy
+      result = Rails::Runtime.accounts.delete_account(user: Current.user, session: Current.session)
+      if result.success?
+        terminate_session
+        redirect_to "/sign-in", status: :see_other, notice: "Your account was deleted."
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=delete_account", status: :see_other
+      else
+        @error = "Your account could not be deleted. Contact support if this continues."
+        page("delete", status: :unprocessable_entity)
+      end
+    end
+
+    def change_password
+      result = Rails::Runtime.accounts.change_password(user: Current.user, session: Current.session, password: params[:password])
+      if result.success?
+        terminate_session
+        redirect_to "/sign-in", status: :see_other, notice: "Your password was changed. Sign in with your new password."
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=change_password", status: :see_other
+      else
+        @error = "This password cannot be used. Check the password requirements and try again."
+        page("password", status: :unprocessable_entity)
+      end
+    end
+
+    def change_email
+      result = Rails::Runtime.accounts.change_email(user: Current.user, session: Current.session, identifier: params[:email_address])
+      if result.success?
+        redirect_to "/account/check-email", status: :see_other
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=change_email", status: :see_other
+      else
+        @error = "This email address cannot be used. Check it and try again."
+        page("email", status: :unprocessable_entity)
+      end
+    end
+
+    private
+
+    # Host controllers may override with an explicit Rails parameter allowlist.
+    # The default does not forward arbitrary account/role parameters.
+    def registration_profile = {}
+
+    def require_feature
+      head :not_found unless AddAuth.configuration.lifecycle.enabled
+    end
+
+    def purpose
+      Core::AccountLifecycle::PURPOSES.include?(params[:purpose]) ? params[:purpose] : "confirm"
+    end
+
+    def intake(action)
+      Rails::Runtime.intake.call(identifier: params[:email_address], ip: request.remote_ip, action: action, challenge_token: challenge_token)
+    end
+
+    def authentication_partial(partial) = "add_auth/accounts/#{partial}"
+
+    def service_unavailable
+      @error = "Account requests are temporarily unavailable. Please try again shortly."
+      response.set_header("Retry-After", "60")
+      page("unavailable", status: :service_unavailable)
+    end
+
+    def intake_failure(reason)
+      @error = "This request could not be verified. Please try again shortly."
+      status = {rate_limited: :too_many_requests, challenge_unavailable: :service_unavailable}.fetch(reason, :unprocessable_entity)
+      response.set_header("Retry-After", "300") if %i[too_many_requests service_unavailable].include?(status)
+      page("unavailable", status: status)
+    end
+  end
+end

data/app/controllers/add_auth/assets_controller.rb

@@ -20,7 +20,8 @@ module AddAuth
     end
 
     def boot
-      source = 'if (!window.Turbo) await import("/add_auth/turbo.js"); await import("/add_auth/challenge.js");'
+      source = Rails::Runtime.config.turbo_enabled ? 'if (!window.Turbo) await import("/add_auth/turbo.js");' : ""
+      source += ' await import("/add_auth/challenge.js");'
       source += ' await import("/add_auth/passkey.js");' if Rails::Runtime.config.passkeys.enabled
       render body: source, content_type: "text/javascript"
     end

data/app/controllers/add_auth/external_identities_controller.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class ExternalIdentitiesController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    before_action :private_response
+    before_action :require_feature
+    before_action :require_add_auth_authentication
+    protect_from_forgery with: :exception
+    helper AddAuth::SignInsHelper
+    layout "add_auth/authentication"
+    rescue_from AddAuth::Error, with: :unavailable
+
+    def index
+      load_identities
+      page("index")
+    end
+
+    def destroy
+      elevation = Rails::Runtime.sessions.with_elevation(user: Current.user, session: Current.session,
+        purpose: Core::ExternalIdentities::UNLINK, policy: Rails::Runtime.step_up_policy)
+      result = service.unlink(user: Current.user, session: Current.session, identity_id: params[:id], grant: elevation.credential)
+      if result.success?
+        redirect_to "/account/external-identities", status: :see_other
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=unlink_external_identity", status: :see_other
+      else
+        @error = (result.reason == :last_credential) ? "Add another usable sign-in method before removing this one." : "This sign-in method could not be changed. Try again."
+        load_identities
+        page("index", status: :unprocessable_entity)
+      end
+    end
+
+    private
+
+    def service = Rails::Runtime.external_identities
+
+    def require_feature
+      head :not_found unless Rails::Runtime.config.external_identities.enabled
+    end
+
+    def authentication_partial(partial) = "add_auth/external_identities/#{partial}"
+
+    def load_identities
+      @identities = ::AddAuthExternalIdentity.where(user_id: Current.user.id, revoked_at: nil).order(:linked_at)
+      @providers = Rails::Runtime.config.external_identities.providers
+    end
+
+    def unavailable
+      @error = "External sign-in is temporarily unavailable."
+      page("unavailable", status: :service_unavailable)
+    end
+  end
+end

data/app/controllers/add_auth/mobile_sessions_controller.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module AddAuth
+  # This transport never reads/writes browser cookies or invokes the host's
+  # browser Authentication concern. Hosts may map the same Core result to a
+  # versioned application DTO through Runtime.mobile_authentication.
+  class MobileSessionsController < ActionController::API
+    before_action :private_response
+    before_action :require_mobile_feature
+    before_action :require_native_feature, only: %i[apple_challenge apple apple_enroll]
+    before_action :require_mobile_session, except: %i[create exchange apple_challenge apple apple_enroll]
+    rescue_from AddAuth::Error, ActiveRecord::ActiveRecordError, with: :unavailable
+
+    def create
+      result = Rails::Runtime.mobile_authentication.password(identifier: params[:email_address], password: params[:password],
+        client_id: params[:client_id], ip: request.remote_ip, user_agent: request.user_agent, challenge_token: params[:challenge_token])
+      return failure(result.reason) unless result.success?
+      created(result)
+    end
+
+    def show
+      render json: {session_id: @mobile_session.id, user_id: @mobile_session.user_id, expires_at: @mobile_session.expires_at}
+    end
+
+    def exchange
+      admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :mobile_handoff)
+      return failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.mobile_handoffs.exchange(code: params[:code], state: params[:state],
+        code_verifier: params[:code_verifier], client_id: params[:client_id], ip: request.remote_ip, user_agent: request.user_agent)
+      return failure(result.reason) unless result.success?
+      created(result)
+    end
+
+    def apple_challenge
+      result = Rails::Runtime.native_apple.start(client_id: params[:client_id], ip: request.remote_ip, challenge_token: params[:challenge_token],
+        intent: params.fetch(:intent, "sign_in"))
+      return failure(result.reason) unless result.success?
+      challenge = result.credential
+      render json: {challenge_id: challenge.id, nonce: challenge.nonce, expires_at: challenge.expires_at}, status: :created
+    end
+
+    def apple
+      result = Rails::Runtime.native_apple.complete(client_id: params[:client_id], challenge_id: params[:challenge_id], nonce: params[:nonce],
+        identity_token: params[:identity_token], ip: request.remote_ip, user_agent: request.user_agent)
+      return failure(result.reason) unless result.success?
+      created(result)
+    end
+
+    def apple_enroll
+      result = Rails::Runtime.native_apple.enroll(client_id: params[:client_id], challenge_id: params[:challenge_id], nonce: params[:nonce],
+        identity_token: params[:identity_token], ip: request.remote_ip, identifier: params[:email_address])
+      return failure(result.reason) unless result.success?
+      render json: {status: "confirmation_required"}, status: :accepted
+    end
+
+    def index
+      page = Rails::Runtime.sessions.list_page(user: @mobile_user, current_session_id: @mobile_session.id, before: params[:before])
+      render json: {sessions: page.entries.map { |entry|
+        {id: entry.id, current: entry.current, transport: entry.transport, client_id: entry.client_id,
+         authenticated_with: entry.authenticated_with, last_seen_at: entry.last_seen_at, expires_at: entry.expires_at}
+      }, next_cursor: page.next_cursor}
+    end
+
+    def destroy
+      Rails::Runtime.sessions.revoke(session: @mobile_session)
+      head :no_content
+    end
+
+    def revoke
+      revoked = Rails::Runtime.sessions.revoke_one(user: @mobile_user, session: @mobile_session, session_id: params[:id])
+      head(revoked ? :no_content : :not_found)
+    end
+
+    def revoke_all
+      result = Rails::Runtime.revoke_all(user: @mobile_user, session: @mobile_session,
+        password: params[:password], ip: request.remote_ip, challenge_token: params[:challenge_token])
+      result.success? ? head(:no_content) : failure(result.reason)
+    end
+
+    private
+
+    def created(result)
+      render json: {token: result.grant.bearer, token_type: "Bearer", expires_at: result.session.expires_at,
+                    session_id: result.session.id, user_id: result.user.id}, status: :created
+    end
+
+    def require_mobile_session
+      require "add_auth/core/mobile_authentication"
+      bearer = Core::MobileAuthentication.bearer(request.authorization)
+      grant = Rails::Runtime.sessions.resume_mobile(bearer: bearer)
+      return failure(:invalid_credentials) unless grant
+      @mobile_session = grant.session
+      @mobile_user = grant.session.user
+    end
+
+    def require_mobile_feature
+      head :not_found unless Rails::Runtime.config.mobile.enabled
+    end
+
+    def require_native_feature
+      return unavailable unless Rails::Runtime.config.mobile.apple_providers.is_a?(Hash)
+      head :not_found if Rails::Runtime.config.mobile.apple_providers.empty?
+    end
+
+    def private_response
+      response.set_header("Cache-Control", "no-store")
+      response.set_header("Referrer-Policy", "no-referrer")
+      head :upgrade_required if ::Rails.env.production? && !request.ssl?
+    end
+
+    def failure(reason)
+      status = Core::MobileResponse.status(reason)
+      response.set_header("Retry-After", "300") if [429, 503].include?(status)
+      response.set_header("WWW-Authenticate", "Bearer") if status == 401
+      render json: {error: reason}, status: status
+    end
+
+    def unavailable = failure(:challenge_unavailable)
+  end
+end

data/app/controllers/add_auth/provider_sign_ins_controller.rb

@@ -0,0 +1,248 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/provider_libraries/apple_form_post_correlation"
+require "add_auth/rails/provider_libraries/omniauth"
+require "add_auth/rails/provider_libraries/omniauth_correlation"
+require "add_auth/rails/provider_libraries/request_protection"
+
+module AddAuth
+  # The protocol library has already verified the callback before this
+  # controller sees it. This controller only starts/consumes a Core
+  # transaction and maps its typed result to the normal Rails session/UI.
+  class ProviderSignInsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    before_action :private_response
+    before_action :load_provider
+    before_action :require_add_auth_authentication, unless: :anonymous_or_callback?
+    protect_from_forgery with: :exception, except: :callback
+    helper AddAuth::SignInsHelper
+    layout "add_auth/authentication"
+    rescue_from AddAuth::Error, with: :provider_unavailable
+
+    # This deliberately renders an ordinary confirmation form instead of
+    # redirecting to /auth/:provider: OmniAuth 2 accepts a CSRF-protected POST,
+    # and a 303 would turn that navigation into an unsafe GET. It is equally
+    # usable with Turbo, inside a frame, and with JavaScript disabled.
+    def enrollment
+      return head :not_found unless Rails::Runtime.config.lifecycle.enabled
+      page("enrollment")
+    end
+
+    def prepare
+      return head :not_found if mobile? && !Rails::Runtime.config.mobile.enabled
+      if enrollment?
+        return head :not_found unless Rails::Runtime.config.lifecycle.enabled
+        @enrollment_identifier = Rails::Runtime.intake.call(identifier: params[:email_address], ip: request.remote_ip,
+          action: :register, challenge_token: challenge_token)
+        return provider_intake_failure(@enrollment_identifier) if @enrollment_identifier.is_a?(Symbol)
+      else
+        admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: (params[:flow].to_s == "reauthenticate") ? :reauthenticate : :provider, challenge_token: challenge_token)
+        return provider_intake_failure(admitted) if admitted.is_a?(Symbol)
+      end
+      if params[:flow].to_s == "link"
+        elevation = Rails::Runtime.sessions.with_elevation(user: Current.user, session: Current.session,
+          purpose: Core::ExternalIdentities::LINK, policy: Rails::Runtime.step_up_policy)
+        return redirect_to "/reauthenticate?purpose=link_external_identity", status: :see_other unless elevation.success?
+      end
+      pending = service.begin_transaction(configuration_id: @provider.configuration.id,
+        browser_secret: browser_secret, **transaction_subject)
+      return provider_failure(pending.reason) unless pending.success?
+
+      if mobile?
+        accepted = Rails::Runtime.mobile_handoffs.begin_transaction(pending: pending.credential,
+          client_id: params[:client_id], callback: params[:callback], state: params[:state],
+          code_challenge: params[:code_challenge], code_challenge_method: params[:code_challenge_method])
+        unless accepted.success?
+          service.cancel(transaction: pending.credential.id, browser_secret: browser_secret)
+          return provider_failure(accepted.reason)
+        end
+      end
+
+      if enrollment? && !Rails::Runtime.provider_enrollment.write(pending: pending.credential,
+        identifier: @enrollment_identifier, profile: registration_profile)
+        service.cancel(transaction: pending.credential.id, browser_secret: browser_secret)
+        return provider_failure(:invalid_credentials)
+      end
+      remember_correlation!(pending.credential)
+      @provider_path = "/auth/#{@provider.middleware_name}"
+      @omniauth_csrf_parameter = Rails::ProviderLibraries::RequestProtection.parameter
+      @omniauth_csrf_token = Rails::ProviderLibraries::RequestProtection.token(session: request.env.fetch("rack.session"),
+        rails_token: -> { form_authenticity_token })
+      @heading = heading_for(pending.credential.purpose)
+      # This token-free URL posts to the host's existing OAuth middleware.
+      # Preserve its Rails origin check without sending a referrer off-site.
+      response.set_header("Referrer-Policy", "same-origin")
+      page("prepare")
+    end
+
+    # OmniAuth performs callback state/nonce/code validation. The correlation
+    # middleware has attached the opaque Core transaction only after its
+    # state check succeeds; no raw params, profile attributes, or tokens are
+    # accepted here. Apple's signed callback cookie supplies that same opaque
+    # data when its form_post cannot send the normal SameSite=Lax session.
+    def callback
+      correlation = request.env[correlation_env_key]
+      return provider_failure(:invalid_credentials) unless valid_correlation?(correlation)
+      return provider_failure(:invalid_credentials) unless correlation.fetch("configuration_id") == @provider.configuration.id
+
+      pending = service.pending(transaction: correlation.fetch("transaction"), browser_secret: correlation.fetch("browser_secret"))
+      return provider_failure(:invalid_credentials) unless pending && pending.configuration.equal?(@provider.configuration) &&
+        pending.purpose.to_s == correlation.fetch("purpose")
+
+      callback = Rails::ProviderLibraries::OmniAuth::CallbackResult.capture(env: request.env, provider: @provider.middleware_name)
+      evidence = pending.configuration.verify(server_result: callback, transaction: pending)
+      return provider_failure(:invalid_credentials) unless evidence
+
+      case pending.purpose
+      when Core::ExternalIdentities::MOBILE then finish_mobile(evidence)
+      when Core::ExternalIdentities::ENROLL then finish_enrollment(pending, evidence)
+      when :sign_in then finish_sign_in(evidence)
+      when Core::ExternalIdentities::LINK then finish_link(pending, evidence)
+      else finish_reauthentication(pending, evidence)
+      end
+    ensure
+      Rails::Runtime.provider_enrollment.erase(pending: pending) if pending&.purpose == Core::ExternalIdentities::ENROLL
+    end
+
+    private
+
+    def service = Rails::Runtime.external_identities
+
+    def load_provider
+      return head :not_found unless Rails::Runtime.config.external_identities.enabled
+
+      @provider = Rails::Runtime.config.external_identities.providers.find { |item| item.middleware_name == params[:provider].to_s }
+      head :not_found unless @provider
+    end
+
+    def sign_in? = params[:flow].to_s == "sign_in"
+    def mobile? = params[:flow].to_s == "mobile"
+
+    def enrollment? = params[:flow].to_s == "enroll"
+    def anonymous_or_callback? = sign_in? || enrollment? || mobile? || action_name == "callback"
+    def registration_profile = {}
+
+    def transaction_subject
+      return {purpose: Core::ExternalIdentities::MOBILE} if mobile?
+      return {purpose: Core::ExternalIdentities::ENROLL} if enrollment?
+      return {purpose: :sign_in} if sign_in?
+      return {user: Current.user, session: Current.session, purpose: Core::ExternalIdentities::LINK} if params[:flow].to_s == "link"
+
+      {user: Current.user, session: Current.session, purpose: params[:purpose].to_s}
+    end
+
+    def browser_secret
+      session[:add_auth_browser] ||= Rails::Runtime.browser_binding.generate
+    end
+
+    def remember_correlation!(pending)
+      if @provider.apple_form_post?
+        Rails::ProviderLibraries::AppleFormPostCorrelation.remember!(session: session, transaction: pending.id,
+          browser_secret: browser_secret, configuration_id: @provider.configuration.id, purpose: pending.purpose, remember: remember?)
+      else
+        Rails::ProviderLibraries::OmniAuthCorrelation.remember!(session: session, provider: @provider.middleware_name,
+          transaction: pending.id, browser_secret: browser_secret, configuration_id: @provider.configuration.id, purpose: pending.purpose, remember: remember?)
+      end
+    end
+
+    def correlation_env_key
+      @provider.apple_form_post? ? "add_auth.apple_correlation" : Rails::ProviderLibraries::OmniAuthCorrelation::ENV_KEY
+    end
+
+    def valid_correlation?(value)
+      value.is_a?(Hash) && %w[transaction browser_secret configuration_id purpose].all? do |key|
+        value[key].is_a?(String) && value[key].valid_encoding? && value[key].bytesize.between?(1, 2048)
+      end
+    end
+
+    def finish_enrollment(pending, evidence)
+      intake = Rails::Runtime.provider_enrollment.read(pending: pending)
+      return provider_failure(:invalid_credentials) unless intake
+      result = Rails::Runtime.accounts.register_external(evidence: evidence, **intake)
+      return provider_failure(result.reason) unless result.success?
+      redirect_to "/account/check-email", status: :see_other
+    end
+
+    def provider_intake_failure(reason)
+      status = {rate_limited: :too_many_requests, challenge_unavailable: :service_unavailable}.fetch(reason, :unprocessable_entity)
+      @error = "This request could not be verified. Please try again shortly."
+      response.set_header("Retry-After", "300") if %i[rate_limited challenge_unavailable].include?(reason)
+      page("failure", status: status)
+    end
+
+    def finish_sign_in(evidence)
+      result = service.sign_in(evidence: evidence, replacing: add_auth_replacement_session,
+        **add_auth_session_hints.merge(remember: correlation_remember?))
+      return provider_failure(result.reason) unless result.success?
+
+      destination = after_authentication_url
+      add_auth_accept(result.grant)
+      redirect_to destination, status: :see_other
+    end
+
+    def finish_mobile(evidence)
+      result = service.mobile_handoff(evidence: evidence, handoffs: Rails::Runtime.mobile_handoffs)
+      return provider_failure(result.reason) unless result.success?
+      handoff = result.credential
+      redirect_to "#{handoff.callback}?#{URI.encode_www_form(code: handoff.code, state: handoff.state)}", status: :see_other, allow_other_host: true
+    end
+
+    def finish_link(pending, evidence)
+      account, current = correlated_session(pending)
+      return provider_failure(:elevation_required) unless account && current
+
+      elevation = Rails::Runtime.sessions.with_elevation(user: account, session: current,
+        purpose: Core::ExternalIdentities::LINK, policy: Rails::Runtime.step_up_policy)
+      result = service.link(user: account, session: current, evidence: evidence, grant: elevation.credential)
+      return provider_failure(result.reason) unless result.success?
+
+      redirect_to "/account/external-identities", status: :see_other
+    end
+
+    def finish_reauthentication(pending, evidence)
+      account, current = correlated_session(pending)
+      return provider_failure(:elevation_required) unless account && current
+
+      result = service.reauthenticate(user: account, session: current, evidence: evidence)
+      return provider_failure(result.reason) unless result.success?
+
+      grant = Rails::Runtime.sessions.rotate_for_step_up(user: account, session: current, grant: result.credential)
+      return provider_failure(:elevation_required) unless grant
+
+      add_auth_accept(grant)
+      redirect_to Rails::Runtime.step_up_policy.return_to(pending.purpose), status: :see_other
+    end
+
+    # A form_post callback can correctly correlate an authenticated transaction
+    # while lacking the normal app cookie. Rehydrate only the exact session row
+    # recorded by Core; Core rechecks that row's digest and policy version under
+    # lock before link/reauthentication can mutate authority.
+    def correlated_session(pending)
+      account = ::User.find_by(id: pending.user_id)
+      current = account && ::Session.find_by(id: pending.session_id, user_id: account.id, token_digest: pending.session_digest)
+      [account, current]
+    end
+
+    def provider_failure(_reason)
+      @error = "We could not verify this provider sign-in. Please try again."
+      page("failure", status: :unprocessable_entity)
+    end
+
+    def provider_unavailable
+      @error = "Provider sign-in is temporarily unavailable. Please try again shortly."
+      page("failure", status: :service_unavailable)
+    end
+
+    def heading_for(purpose)
+      [:sign_in, Core::ExternalIdentities::ENROLL, Core::ExternalIdentities::MOBILE].include?(purpose) ? "Continue to #{@provider.label}" : "Confirm with #{@provider.label}"
+    end
+
+    def correlation_remember? = request.env[correlation_env_key].fetch("remember") == true
+
+    def remember? = sign_in? && params[:remember].to_s == "1"
+
+    def authentication_partial(partial) = "add_auth/provider_sign_ins/#{partial}"
+  end
+end

data/app/helpers/add_auth/sign_ins_helper.rb

@@ -14,6 +14,7 @@ module AddAuth
 
     def add_auth_challenge_form_data(action)
       data = {turbo_frame: "_top"}
+      data[:turbo] = false unless AddAuth.configuration.turbo_enabled
       return data unless AddAuth.configuration.challenge_on.include?(action)
       provider = AddAuth.configuration.challenge
       return data unless provider.site_key
@@ -23,7 +24,7 @@ module AddAuth
       else return data
       end
       data.merge(controller: "add-auth-challenge",
-        action: "submit->add-auth-challenge#submit add_auth:proof-used->add-auth-challenge#reset turbo:submit-end->add-auth-challenge#reset turbo:before-cache@document->add-auth-challenge#beforeCache",
+        action: "submit->add-auth-challenge#submit add_auth:proof-used->add-auth-challenge#reset turbo:submit-end->add-auth-challenge#reset turbo:before-cache@document->add-auth-challenge#beforeCache pagehide@window->add-auth-challenge#beforeCache pageshow@window->add-auth-challenge#restore",
         add_auth_challenge_provider_value: kind, add_auth_challenge_site_key_value: provider.site_key,
         add_auth_challenge_action_value: (provider.respond_to?(:expected_action) && provider.expected_action) || action,
         add_auth_challenge_script_url_value: provider.script_url)

data/app/jobs/add_auth/account_delivery_job.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountDeliveryJob < DeliveryJob
+    def perform(id)
+      record = ::AddAuthAccountToken.find_by(id: id)
+      return unless record
+      deliver(service: Rails::Runtime.accounts, record: record, mailer: AccountMailer) do |delivery|
+        AccountMailer.link(recipient: delivery.fetch(:recipient), purpose: delivery.fetch(:purpose),
+          url: Rails::Runtime.account_proof_url(delivery.fetch(:token), purpose: delivery.fetch(:purpose)))
+      end
+    end
+  end
+end

data/app/jobs/add_auth/account_request_job.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountRequestJob < ActiveJob::Base
+    self.log_arguments = false
+    retry_on StandardError, wait: :polynomially_longer, attempts: 8
+
+    def perform(encrypted_identifier)
+      payload = Rails::Runtime.decrypt_intake(encrypted_identifier)
+      if payload.is_a?(Hash)
+        Rails::Runtime.accounts.issue(identifier: payload["identifier"], purpose: payload["purpose"], request_id: job_id)
+      end
+      record = ::AddAuthAccountToken.find_by(request_id: job_id)
+      AccountDeliveryJob.perform_later(record.id) if record
+    end
+  end
+end

data/app/mailers/add_auth/account_mailer.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountMailer < SignInMailer
+    def link(recipient:, url:, purpose:)
+      @instruction = {"confirm" => "Confirm your email address", "reset_password" => "Choose a new password", "unlock" => "Unlock your account"}.fetch(purpose)
+      @url = url
+      mail(to: recipient, from: Rails::Runtime.config.mail_from, subject: @instruction,
+        content_type: "text/plain").extend(SignInMailer::DeliveryReceipt)
+    end
+  end
+end

data/app/views/add_auth/account_mailer/link.text.erb

@@ -0,0 +1,7 @@
+<%= @instruction %>
+
+Open this link, then use the button on the page to confirm your request:
+<%= @url %>
+
+This link expires in <%= AddAuth.configuration.lifecycle.proof_lifetime.to_i / 60 %> minutes and can be used once.
+If you did not request this message, you can ignore it.

data/app/views/add_auth/accounts/_check_email.html.erb

@@ -0,0 +1,5 @@
+<% content_for :title, "Check your email" %>
+<h1 id="add_auth-title">Check your email</h1>
+<p role="status">If this request is available for your account, we’ll send a link with the next step.</p>
+<p class="<%= add_auth_class(:muted) %>">Check your spam folder too. Only the latest link for this request will work.</p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_delete.html.erb

@@ -0,0 +1,6 @@
+<% content_for :title, "Delete your account" %>
+<h1 id="add_auth-title">Delete your account</h1>
+<p>Your account will be deleted and all sessions signed out. Verify it’s you, then return here to confirm.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= button_to "Delete my account", "/account", method: :delete, class: add_auth_class(:button), form: {data: {turbo_frame: "_top"}} %>
+<p><%= link_to "Keep my account", "/sessions" %></p>