add_auth 0.2.1 → 0.3.0

data/app/views/add_auth/accounts/_email.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Change your email" %>
+<h1 id="add_auth-title">Change your email</h1>
+<p class="<%= add_auth_class(:muted) %>">Your current email stays active until you confirm the new address. Confirmation signs out your existing sessions.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/email", data: {turbo_frame: "_top"} do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "New email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", value: (params[:email_address] if params[:email_address].is_a?(String)), class: add_auth_class(:input) %>
+  </div>
+  <%= form.submit "Send confirmation link", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Back to your sessions", "/sessions" %></p>

data/app/views/add_auth/accounts/_invalid_proof.html.erb

@@ -0,0 +1,5 @@
+<% content_for :title, "Request a new link" %>
+<h1 id="add_auth-title">Request a new link</h1>
+<p>This link is unavailable, expired, or already used. Request a new link to finish your account update.</p>
+<p><%= link_to "Request another link", "/account/requests/#{@purpose}" %></p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_password.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Change your password" %>
+<h1 id="add_auth-title">Change your password</h1>
+<p class="<%= add_auth_class(:muted) %>">Verify it’s you before changing your password. This signs out your existing sessions.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/password", data: {turbo_frame: "_top"} do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :password, "New password" %>
+    <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
+  </div>
+  <%= form.submit "Change password", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Back to your sessions", "/sessions" %></p>

data/app/views/add_auth/accounts/_proof.html.erb

@@ -0,0 +1,16 @@
+<% title = {"confirm" => "Confirm this email address", "reset_password" => "Choose a new password", "unlock" => "Unlock this account"}.fetch(@purpose) %>
+<% content_for :title, title %>
+<h1 id="add_auth-title"><%= title %></h1>
+<p class="<%= add_auth_class(:muted) %>">Use the button below to complete your request. You’ll sign in afterward.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/proofs/#{@purpose}", data: {turbo_frame: "_top"} do |form| %>
+  <%= form.hidden_field :token, value: (params[:token] if params[:token].is_a?(String)) %>
+  <% if @purpose == "reset_password" %>
+    <div class="<%= add_auth_class(:field) %>">
+      <%= form.label :password, "New password" %>
+      <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
+    </div>
+  <% end %>
+  <%= form.submit title, class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_register.html.erb

@@ -0,0 +1,17 @@
+<% content_for :title, "Create an account" %>
+<h1 id="add_auth-title">Create an account</h1>
+<p class="<%= add_auth_class(:muted) %>">We’ll email you a link to confirm your address before you sign in.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/sign-up", data: add_auth_challenge_form_data(:register) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", value: (params[:email_address] if params[:email_address].is_a?(String)), class: add_auth_class(:input) %>
+  </div>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :password, "New password" %>
+    <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :register %>
+  <%= form.submit "Create account", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Already have an account? Sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_request.html.erb

@@ -0,0 +1,14 @@
+<% title = {"confirm" => "Confirm your email", "reset_password" => "Reset your password", "unlock" => "Unlock your account"}.fetch(@purpose) %>
+<% content_for :title, title %>
+<h1 id="add_auth-title"><%= title %></h1>
+<p class="<%= add_auth_class(:muted) %>">Enter your account email address to request a secure link.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/requests/#{@purpose}", data: add_auth_challenge_form_data(:account_request) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", value: (params[:email_address] if params[:email_address].is_a?(String)), class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :account_request %>
+  <%= form.submit "Send account link", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_unavailable.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Try your request again</h1>
+<p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/external_identities/_index.html.erb

@@ -0,0 +1,22 @@
+<h1 id="add_auth-title">External sign-in methods</h1>
+<% if @error %><p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p><% end %>
+<p>Add another way to sign in. You’ll verify your account before linking or removing a provider.</p>
+<% @providers.each do |provider| %>
+  <%= form_with url: "/account/external-identities/providers/#{provider.middleware_name}", method: :post, data: add_auth_challenge_form_data(:provider).merge(turbo: false) do |form| %>
+    <%= add_auth_challenge_tag :provider, id: "link_#{provider.middleware_name}" %>
+    <%= form.submit "Link #{provider.label}", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+  <% end %>
+<% end %>
+<% @identities.each do |identity| %>
+  <% provider = @providers.find { |item| item.configuration.id == identity.provider_id } %>
+  <section id="external_identity_<%= identity.id %>">
+    <h2><%= provider&.label || "External provider" %></h2>
+    <p>Linked <%= identity.linked_at.strftime("%Y-%m-%d") %>.</p>
+    <details>
+      <summary>Remove this sign-in method</summary>
+      <p>Keep another usable sign-in method before removing this one.</p>
+      <%= button_to "Confirm removal", "/account/external-identities/#{identity.id}", method: :delete, form: {data: {turbo: false}} %>
+    </details>
+  </section>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/external_identities/_unavailable.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Try again shortly</h1>
+<p role="alert"><%= @error %></p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/passkeys/_controls.html.erb

@@ -1,15 +1,17 @@
 <div data-controller="add-auth-passkey"
+  data-add-auth-passkey-turbo-value="<%= AddAuth.configuration.turbo_enabled %>"
   data-add-auth-passkey-options-url-value="<%= options_url %>"
   data-add-auth-passkey-finish-url-value="<%= finish_url %>"
   data-add-auth-passkey-mode-value="<%= mode %>"
   data-add-auth-passkey-purpose-value="<%= local_assigns[:purpose] %>"
   data-add-auth-passkey-conditional-value="<%= local_assigns.fetch(:conditional, false) && !AddAuth.configuration.challenge_on.include?(action) %>"
   data-add-auth-passkey-csrf-value="<%= form_authenticity_token %>"
-  data-action="turbo:before-cache@document->add-auth-passkey#beforeCache submit@document->add-auth-passkey#otherSubmission">
+  data-action="turbo:before-cache@document->add-auth-passkey#beforeCache pagehide@window->add-auth-passkey#beforeCache pageshow@window->add-auth-passkey#restore submit@document->add-auth-passkey#otherSubmission">
   <p data-add-auth-passkey-target="unavailable">Passkeys need JavaScript and a compatible browser or device. Use another method allowed by your account policy if available.</p>
   <%= form_with url: options_url, data: add_auth_challenge_form_data(action).merge(add_auth_passkey_target: "form", action: [add_auth_challenge_form_data(action)[:action], "submit->add-auth-passkey#submit"].compact.join(" ")) do |form| %>
     <%= add_auth_challenge_tag action, id: "passkey_#{action}" %>
     <div hidden data-add-auth-passkey-target="controls">
+      <%= render "add_auth/sign_ins/remember", form: form, id: "passkey" if action == :sign_in %>
       <%= form.submit label, class: add_auth_class(:button), data: {add_auth_challenge_target: "submit", add_auth_passkey_target: "button"} %>
     </div>
   <% end %>

data/app/views/add_auth/provider_sign_ins/_enrollment.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Create an account" %>
+<h1 id="add_auth-title">Create an account with <%= @provider.label %></h1>
+<p>Enter your email, then continue to your provider. We’ll email you a separate confirmation link before you can sign in.</p>
+<%= form_with url: "/account/sign-up/providers/#{@provider.middleware_name}", method: :post, data: add_auth_challenge_form_data(:register).merge(turbo: false) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :register %>
+  <%= form.submit "Continue with #{@provider.label}", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Already have an account? Sign in", "/sign-in" %></p>

data/app/views/add_auth/provider_sign_ins/_failure.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Provider sign-in could not be completed</h1>
+<p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p>
+<p><%= link_to "Return to sign in", "/sign-in" %></p>

data/app/views/add_auth/provider_sign_ins/_prepare.html.erb

@@ -0,0 +1,7 @@
+<h1 id="add_auth-title"><%= @heading %></h1>
+<p class="<%= add_auth_class(:muted) %>">You will continue to <%= @provider.label %> to verify this request.</p>
+<%= form_with url: @provider_path, method: :post, authenticity_token: false, data: {turbo: false} do |form| %>
+  <%= hidden_field_tag @omniauth_csrf_parameter, @omniauth_csrf_token %>
+  <%= form.submit "Continue with #{@provider.label}", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Cancel", "/sign-in" %></p>

data/app/views/add_auth/reauthentications/_form.html.erb

@@ -19,6 +19,15 @@
     <%= form.submit "Email me a verification link", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
   <% end %>
 <% end %>
+<% if Array(@methods).include?(:external_identity) && AddAuth.configuration.external_identities.enabled %>
+  <% AddAuth.configuration.external_identities.providers.select(&:reauthentication?).each do |provider| %>
+    <%= form_with url: "/reauthenticate/providers/#{provider.middleware_name}", method: :post, data: add_auth_challenge_form_data(:reauthenticate).merge(turbo: false) do |form| %>
+      <%= form.hidden_field :purpose, value: @purpose %>
+      <%= add_auth_challenge_tag :reauthenticate, id: "verify_#{provider.middleware_name}" %>
+      <%= form.submit "Verify with #{provider.label}", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+    <% end %>
+  <% end %>
+<% end %>
 <% if Array(@methods).empty? %><p role="status">No permitted verification method is available here. Contact your account administrator for an allowed way to continue.</p><% end %>
 <p><%= link_to "Cancel", @rule&.return_to || "/", class: add_auth_class(:link) %></p>
 

data/app/views/add_auth/sessions/_list.html.erb

@@ -2,7 +2,7 @@
   <% @sessions.each do |session| %>
     <li class="add_auth-session" id="session_<%= session.id %>">
       <div>
-        <strong><%= session.current ? "This browser" : "Signed-in browser" %></strong>
+        <strong><%= session.transport == "mobile" ? "Signed-in mobile device (#{session.client_id})" : (session.current ? "This browser" : "Signed-in browser") %></strong>
         <p class="<%= add_auth_class(:muted) %>">
           <%= session.authenticated_with ? "Signed in with #{session.authenticated_with.tr("_", " ")}" : "Imported session" %>
           · <%= session.last_seen_at ? "Last active #{session.last_seen_at.strftime("%Y-%m-%d %H:%M UTC")}" : "Activity unknown" %>

data/app/views/add_auth/sessions/index.html.erb

@@ -8,5 +8,12 @@
   <h1 id="add_auth-title">Your sessions</h1>
   <p class="<%= add_auth_class(:muted) %>">Review browsers signed in to your account and revoke any you no longer use.</p>
   <p><%= link_to "Sign out everywhere", "/sessions/revoke-all", class: add_auth_class(:link) %></p>
+  <% if AddAuth.configuration.lifecycle.enabled %>
+    <p><%= link_to "Change email", "/account/email" %> · <%= link_to "Change password", "/account/password" %> · <%= link_to "Delete account", "/account/delete" %></p>
+  <% end %>
   <div id="add_auth-session-content"><%= render "add_auth/sessions/list" %></div>
 </main>
+
+<% if AddAuth.configuration.external_identities.enabled %>
+  <p><%= link_to "Manage sign-in providers", "/account/external-identities" %></p>
+<% end %>

data/app/views/add_auth/sign_ins/_confirmation.html.erb

@@ -4,6 +4,7 @@
 <%= form_with url: "/sign-in/link", data: {turbo_frame: "_top"} do |form| %>
   <%= form.hidden_field :token, value: params[:token] %>
   <%= form.hidden_field :switch_account, value: "1" %>
+  <%= render "add_auth/sign_ins/remember", form: form, id: "email" %>
   <%= form.submit "Sign in to this account", class: add_auth_class(:button) %>
 <% end %>
 <p><%= link_to "Cancel", "/sign-in", class: add_auth_class(:link) %></p>

data/app/views/add_auth/sign_ins/_form.html.erb

@@ -1,5 +1,8 @@
 <h1 id="add_auth-title">Sign in</h1>
 <p class="<%= add_auth_class(:muted) %>">Choose an available sign-in method.</p>
+<% if AddAuth.configuration.lifecycle.enabled %>
+  <p><%= link_to "Create an account", "/account/sign-up" %> · <%= link_to "Forgot your password?", "/account/requests/reset_password" %></p>
+<% end %>
 <% if @error %><p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p><% end %>
 <% if AddAuth.configuration.passwords_enabled %>
 <%= form_with url: "/sign-in/password", id: "add_auth-password-form", data: add_auth_challenge_form_data(:sign_in) do |form| %>
@@ -12,6 +15,7 @@
     <%= form.password_field :password, required: true, autocomplete: "current-password", class: add_auth_class(:input) %>
   </div>
   <%= add_auth_challenge_tag :sign_in %>
+  <%= render "add_auth/sign_ins/remember", form: form, id: "password" %>
   <%= form.submit "Sign in with password", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
 <% end %>
 <% end %>
@@ -32,3 +36,16 @@
   <%= render "add_auth/passkeys/controls", mode: "get", options_url: "/passkeys/sign-in/options", finish_url: "/passkeys/sign-in", label: "Sign in with a passkey", action: :sign_in, conditional: true %>
   <p><%= link_to "I can’t use my passkeys", "/recover" %></p>
 <% end %>
+<% if AddAuth.configuration.external_identities.enabled && AddAuth.configuration.external_identities.providers.any? %>
+  <hr class="<%= add_auth_class(:divider) %>">
+  <% AddAuth.configuration.external_identities.providers.each do |provider| %>
+    <%= form_with url: "/sign-in/providers/#{provider.middleware_name}", method: :post, data: add_auth_challenge_form_data(:provider).merge(turbo: false) do |form| %>
+      <%= render "add_auth/sign_ins/remember", form: form, id: "provider_#{provider.middleware_name}" %>
+      <%= add_auth_challenge_tag :provider, id: "provider_#{provider.middleware_name}" %>
+      <%= form.submit "Continue with #{provider.label}", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+    <% end %>
+    <% if AddAuth.configuration.lifecycle.enabled %>
+      <p><%= link_to "Create an account with #{provider.label}", "/account/sign-up/providers/#{provider.middleware_name}" %></p>
+    <% end %>
+  <% end %>
+<% end %>

data/app/views/add_auth/sign_ins/_remember.html.erb

@@ -0,0 +1,6 @@
+<% if AddAuth.configuration.lifecycle.enabled %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.check_box :remember, id: "#{id}_remember" %>
+    <%= form.label :remember, "Keep me signed in on this browser", for: "#{id}_remember" %>
+  </div>
+<% end %>

data/app/views/layouts/add_auth/authentication.html.erb

@@ -1,9 +1,9 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="en"<% unless AddAuth.configuration.turbo_enabled %> data-turbo="false"<% end %>>
   <head>
-    <title>Sign in</title>
+    <title><%= content_for?(:title) ? yield(:title) : "Sign in" %></title>
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta name="referrer" content="no-referrer">
+    <meta name="referrer" content="<%= response.headers["Referrer-Policy"] || "no-referrer" %>">
     <% turbo_exempts_page_from_cache %>
     <% turbo_page_requires_reload if request.headers["Turbo-Frame"].present? %>
     <%= yield :head %>
@@ -13,6 +13,7 @@
   </head>
   <body class="<%= add_auth_class(:body) %>">
     <main class="<%= add_auth_class(:panel) %>" aria-labelledby="add_auth-title">
+      <% if flash[:notice] %><p role="status" data-turbo-temporary><%= flash[:notice] %></p><% end %>
       <div id="add_auth-content"><%= yield %></div>
     </main>
   </body>

data/exe/add_auth-preflight

@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "json"
+require "optparse"
+require "add_auth/migration/static_inventory"
+
+options = {root: Dir.pwd}
+parser = OptionParser.new do |opts|
+  opts.banner = "Usage: add_auth-preflight [--root PATH] (static inspection; does not boot Rails)"
+  opts.on("--root PATH", "Host source directory") { |value| options[:root] = value }
+  opts.on("-h", "--help") {
+    puts opts
+    exit
+  }
+end
+begin
+  parser.parse!
+  raise OptionParser::InvalidArgument unless ARGV.empty?
+  report = AddAuth::Migration::StaticInventory.new(**options).call
+  puts JSON.pretty_generate(report)
+  exit(report.dig(:facts, :complete) ? 0 : 2)
+rescue OptionParser::ParseError, SystemCallError, ArgumentError
+  warn "Unable to inspect source. Supply a readable host directory with --root; see --help."
+  exit 2
+end

data/lib/add_auth/configuration.rb

@@ -1,24 +1,98 @@
 # frozen_string_literal: true
 
+require "add_auth/core/passwords/bcrypt_support"
+
 module AddAuth
   class Configuration
     attr_accessor :challenge, :challenge_on,
-      :digest_secret, :eligible, :stylesheet, :css_classes, :mail_from, :base_url, :rate_limit_store, :trusted_recovery_address, :support_url
+      :digest_secret, :eligible, :stylesheet, :css_classes, :mail_from, :base_url, :rate_limit_store, :trusted_recovery_address, :support_url, :legacy_password_verifier, :current_password_support
     attr_writer :session_token_digest, :sign_in_token_digest
 
     SessionOptions = Struct.new(:enabled, :lifetime, :idle_timeout, :legacy_bridge_until)
+    MobileOptions = Struct.new(:enabled, :lifetime, :idle_timeout, :clients, :callbacks, :apple_providers)
     EmailOptions = Struct.new(:enabled, :token_lifetime, :same_browser)
     StepUpOptions = Struct.new(:enabled, :purposes, :fresh_for, :strong_for)
     PasskeyOptions = Struct.new(:enabled, :rp_id, :origins, :name, :anonymous_limit)
     NotificationOptions = Struct.new(:enabled)
-    MaintenanceOptions = Struct.new(:batch_size, :session_retention, :email_retention, :notification_retention)
-    attr_accessor :passwords_enabled
-    attr_reader :maintenance, :notifications, :passkeys, :session, :email_link, :step_up, :challenge_when_unavailable
+    MaintenanceOptions = Struct.new(:batch_size, :session_retention, :email_retention, :notification_retention, :account_retention)
+    LifecycleOptions = Struct.new(:enabled, :password_policy, :eligible, :provision, :profile_attributes, :maximum_attempts, :unlock_in, :proof_lifetime, :remember_lifetime, :remember_idle_timeout, :deletion_allowed, :delete_account)
+    class ExternalProvider
+      attr_reader :id, :label, :middleware_name, :configuration, :apple_form_post, :reauthentication
+
+      def initialize(id:, label:, middleware_name:, configuration:, apple_form_post: false, reauthentication: false)
+        @id, @label, @middleware_name = [id, label, middleware_name].map { |value| text(value) }
+        raise ArgumentError, "external provider middleware name is invalid" unless middleware_name.match?(/\A[a-z][a-z0-9_]{0,63}\z/)
+        raise ArgumentError, "external provider configuration does not match its id" unless configuration.respond_to?(:id) && configuration.id == id
+        raise ArgumentError, "Apple form_post must be explicit" unless apple_form_post == true || apple_form_post == false
+
+        raise ArgumentError, "provider reauthentication must be explicit" unless [true, false].include?(reauthentication)
+        @reauthentication = reauthentication
+        @configuration, @apple_form_post = configuration, apple_form_post
+        freeze
+      end
+
+      def reauthentication? = reauthentication
+      def apple_form_post? = apple_form_post
+
+      private
+
+      def text(value)
+        raise ArgumentError, "external provider value is invalid" unless value.is_a?(String) && value.valid_encoding? &&
+          value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+
+        value.dup.freeze
+      end
+    end
+
+    class ExternalIdentityOptions
+      attr_accessor :enabled
+
+      def initialize
+        @enabled = false
+        @providers = []
+        @native_providers = {}
+      end
+
+      def register(**attributes)
+        provider = ExternalProvider.new(**attributes)
+        raise ArgumentError, "external provider id is already registered" if configurations.any? { |item| item.id == provider.id }
+        raise ArgumentError, "external provider middleware is already registered" if @providers.any? { |item| item.middleware_name == provider.middleware_name }
+
+        @providers << provider
+        provider
+      end
+
+      def provider(id)
+        @providers.find { |item| item.id == id.to_s }
+      end
+
+      def providers = @providers.dup.freeze
+
+      def register_native(configuration:)
+        raise ArgumentError, "a native provider configuration is required" unless configuration.is_a?(Core::ExternalIdentities::Configuration)
+        raise ArgumentError, "external provider id is already registered" if configurations.any? { |item| item.id == configuration.id }
+        @native_providers[configuration.id] = configuration
+      end
+
+      def native_provider(id) = @native_providers[id]
+      def configurations = (providers.map(&:configuration) + @native_providers.values).freeze
+    end
+
+    attr_accessor :passwords_enabled, :turbo_enabled
+    attr_reader :maintenance, :notifications, :passkeys, :session, :email_link, :step_up, :challenge_when_unavailable, :lifecycle, :external_identities, :mobile
 
     def initialize
       @passwords_enabled = true
+      @current_password_support = Core::Passwords::BcryptSupport.new
+      @turbo_enabled = true
+      @lifecycle = LifecycleOptions.new(enabled: false, password_policy: ->(password) { password.length >= 12 && password.bytesize <= 72 },
+        eligible: ->(_user) { true }, provision: ->(_user) {}, profile_attributes: ->(_profile) { {} }, maximum_attempts: 20, unlock_in: 3600, proof_lifetime: 3600,
+        remember_lifetime: 14 * 86_400, remember_idle_timeout: 7 * 86_400,
+        deletion_allowed: ->(_user) { true }, delete_account: ->(user) { user.destroy! })
       @session = SessionOptions.new(enabled: false, lifetime: 43_200, idle_timeout: 1800)
+      @mobile = MobileOptions.new(enabled: false, clients: [], callbacks: {}, apple_providers: {})
       @email_link = EmailOptions.new(enabled: false, token_lifetime: 1200, same_browser: false)
+      @external_identities = ExternalIdentityOptions.new
       @notifications = NotificationOptions.new(enabled: false)
       @maintenance = MaintenanceOptions.new(batch_size: 100)
       @passkeys = PasskeyOptions.new(enabled: false, origins: [], name: "Your account", anonymous_limit: 1000)

data/lib/add_auth/core/access_policy.rb

@@ -5,10 +5,11 @@ module AddAuth
     # Account policy survives feature toggles; disabling passkeys cannot restore
     # weaker access to an account that explicitly adopted strict policy.
     class AccessPolicy
-      def initialize(credentials:, passkeys_enabled:, email_enabled:, trusted_recovery_address:, password_enabled: true)
+      def initialize(credentials:, passkeys_enabled:, email_enabled:, trusted_recovery_address:, password_enabled: true, external_enabled: false, external_current: nil)
         @credentials, @passkeys_enabled, @email_enabled = credentials, passkeys_enabled, email_enabled
         @trusted_recovery_address = trusted_recovery_address
         @password_enabled = password_enabled
+        @external_enabled, @external_current = external_enabled == true, external_current
       end
 
       def strict?(user) = user.respond_to?(:add_auth_strict) && user.add_auth_strict == true
@@ -20,6 +21,7 @@ module AddAuth
         when :password then @password_enabled && user.respond_to?(:password_digest) && user.password_digest.is_a?(String) && !user.password_digest.empty?
         when :email_link then @email_enabled
         when :passkey then @passkeys_enabled
+        when :external_identity then @external_enabled
         else false
         end
       end
@@ -41,8 +43,16 @@ module AddAuth
         credential && credential.user_id == user.id && !credential.revoked_at
       end
 
+      def external_credential_current?(user:, id:, version:)
+        @external_enabled && @external_current && @external_current.call(user: user, id: id, version: version) == true
+      end
+
       def session_allowed?(user, row)
         return false if row.respond_to?(:authentication_policy_version) && row.authentication_policy_version != version(user)
+        if row.authenticated_with == "external_identity"
+          return false unless row.respond_to?(:authentication_external_id) &&
+            external_credential_current?(user: user, id: row.authentication_external_id, version: row.authentication_external_version)
+        end
         if row.authenticated_with == "passkey"
           return false unless row.authentication_uv && credential_current?(user: user, id: row.authentication_credential_id)
         end