add_auth 0.2.1

data/lib/generators/add_auth/email_link/email_link_generator.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class EmailLinkGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def dependencies
+        invoke "add_auth:session_upgrade"
+        invoke "add_auth:email_tokens"
+      end
+
+      def account_cleanup
+        path = "app/models/user.rb"
+        unless File.read(File.join(destination_root, path)).include?("has_many :add_auth_sign_in_tokens")
+          inject_into_file path, "  has_many :add_auth_sign_in_tokens, dependent: :delete_all\n", after: /class User < [^\n]+\n/
+        end
+      end
+
+      def outbox
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_email_delivery.rb")].any?
+          migration_template "add_add_auth_email_delivery.rb.tt", "db/migrate/add_add_auth_email_delivery.rb"
+        end
+      end
+
+      def browser_binding
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_email_binding.rb")].any?
+          migration_template "add_add_auth_email_binding.rb.tt", "db/migrate/add_add_auth_email_binding.rb"
+        end
+      end
+
+      def routes_and_styles
+        unless File.read(File.join(destination_root, "config/routes.rb")).include?("# AddAuth sign-in")
+          route <<~ROUTES
+            # AddAuth sign-in
+            post "sign-in/email", to: "add_auth/sign_ins#request_link"
+            get "sign-in/check-email", to: "add_auth/sign_ins#check_email"
+            get "sign-in/link", to: "add_auth/sign_ins#link"
+            post "sign-in/link", to: "add_auth/sign_ins#confirm"
+          ROUTES
+        end
+        unless File.read(File.join(destination_root, "config/routes.rb")).include?("add_auth/challenge.js")
+          route 'get "add_auth/challenge.js", to: "add_auth/assets#challenge"'
+        end
+        gsub_file "config/initializers/add_auth.rb", "# config.email_link.enabled = true", "config.email_link.enabled = true"
+        say "Review and migrate, configure base_url/mail_from, a durable queue, shared rate-limit cache and a recurring add_auth:deliver_pending sweep."
+      end
+    end
+  end
+end

data/lib/generators/add_auth/email_link/templates/add_add_auth_email_binding.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthEmailBinding < ActiveRecord::Migration[8.0]
+  def change
+    add_column :add_auth_sign_in_tokens, :browser_digest, :string
+  end
+end

data/lib/generators/add_auth/email_link/templates/add_add_auth_email_delivery.rb.tt

@@ -0,0 +1,10 @@
+class AddAddAuthEmailDelivery < ActiveRecord::Migration[8.0]
+  def change
+    add_column :add_auth_sign_in_tokens, :request_id, :string
+    add_index :add_auth_sign_in_tokens, :request_id, unique: true
+    add_column :add_auth_sign_in_tokens, :delivery_lease_key, :string
+    add_column :add_auth_sign_in_tokens, :delivery_lease_until, :datetime
+    add_column :add_auth_sign_in_tokens, :delivered_at, :datetime
+    add_index :add_auth_sign_in_tokens, [:delivered_at, :expires_at], name: "index_add_auth_pending_delivery"
+  end
+end

data/lib/generators/add_auth/email_link/templates/add_auth.css

@@ -0,0 +1,28 @@
+:where(.add_auth-body) {
+  --add_auth-canvas: #f4f5f3;
+  --add_auth-surface: #ffffff;
+  --add_auth-text: #202923;
+  --add_auth-muted: #505b53;
+  --add_auth-accent: #225e42;
+  --add_auth-border: #737d75;
+  --add_auth-focus: #1559a0;
+  margin: 0; padding: 2rem 1rem; background: var(--add_auth-canvas);
+  color: var(--add_auth-text); font: 1rem/1.6 system-ui, sans-serif;
+}
+:where(.add_auth-panel) { box-sizing: border-box; max-width: 28rem; margin: 4vh auto; padding: clamp(1.25rem, 5vw, 2.5rem); background: var(--add_auth-surface); border-top: 4px solid var(--add_auth-accent); }
+:where(.add_auth-panel h1) { font-size: 1.8rem; line-height: 1.2; margin-top: 0; }
+:where(.add_auth-field) { margin: 1.25rem 0; }
+:where(.add_auth-field label) { display: block; margin-bottom: .35rem; font-weight: 600; }
+:where(.add_auth-input) { box-sizing: border-box; width: 100%; min-height: 2.75rem; border: 1px solid var(--add_auth-border); border-radius: .25rem; padding: .6rem .75rem; background: var(--add_auth-surface); color: var(--add_auth-text); font: inherit; }
+:where(.add_auth-button) { box-sizing: border-box; white-space: normal; width: 100%; min-height: 2.75rem; border: 2px solid transparent; border-radius: .25rem; padding: .65rem .8rem; font: inherit; font-weight: 600; color: #ffffff; background: var(--add_auth-accent); cursor: pointer; }
+:where(.add_auth-button:hover) { text-decoration: underline; }
+:where(.add_auth-input:focus-visible, .add_auth-button:focus-visible, .add_auth-link:focus-visible) { outline: 3px solid var(--add_auth-focus); outline-offset: 3px; }
+:where(.add_auth-muted) { color: var(--add_auth-muted); }
+:where(.add_auth-link) { color: var(--add_auth-accent); text-underline-offset: .2em; }
+:where(.add_auth-notice) { padding: .75rem; border-left: 3px solid currentColor; }
+:where(.add_auth-divider) { border: 0; border-top: 1px solid var(--add_auth-border); margin: 2rem 0; }
+:where(.add_auth-session-list) { list-style: none; margin: 1.5rem 0 0; padding: 0; }
+:where(.add_auth-session) { display: flex; align-items: start; justify-content: space-between; gap: 1rem; padding: 1rem 0; border-top: 1px solid var(--add_auth-border); }
+:where(.add_auth-session p) { margin: .25rem 0 0; overflow-wrap: anywhere; }
+:where(.add_auth-session .add_auth-button) { width: auto; min-width: 7rem; }
+@media (forced-colors: active) { .add_auth-button { border-color: ButtonText; } }

data/lib/generators/add_auth/email_link/templates/add_auth_challenge.js

@@ -0,0 +1,129 @@
+import { Controller } from "/add_auth/stimulus.js"
+import { application } from "/add_auth/application.js"
+
+const scripts = new Map()
+function loadScript(url) {
+  if (!url) return Promise.resolve()
+  if (!scripts.has(url)) {
+    scripts.set(url, new Promise((resolve, reject) => {
+      const script = document.createElement("script")
+      const timer = setTimeout(() => { script.remove(); reject(new Error("unavailable")) }, 15000)
+      script.src = url
+      script.async = true
+      script.onload = () => { clearTimeout(timer); resolve() }
+      script.onerror = () => { clearTimeout(timer); script.remove(); reject(new Error("unavailable")) }
+      document.head.append(script)
+    }).catch(error => { scripts.delete(url); throw error }))
+  }
+  return scripts.get(url)
+}
+
+class ChallengeController extends Controller {
+  static targets = ["token", "widget", "status", "submit"]
+  static values = { provider: String, siteKey: String, action: String, scriptUrl: String }
+
+  connect() {
+    this.generation = (this.generation || 0) + 1
+    this.active = true
+    this.pending = false
+    this.allowSubmit = false
+    this.tokenTarget.value = ""
+    this.prepare()
+  }
+
+  async prepare() {
+    const generation = this.generation
+    this.setDisabled(true)
+    this.message("Verification is loading.")
+    try {
+      await loadScript(this.scriptUrlValue)
+      if (!this.current(generation)) return
+      this.provider = this.providerValue === "turnstile" ? window.turnstile : window.grecaptcha
+      if (!this.provider) throw new Error("unavailable")
+      if (this.providerValue === "recaptcha-v3") {
+        await new Promise((resolve, reject) => {
+          const timer = setTimeout(() => reject(new Error("unavailable")), 15000)
+          this.provider.ready(() => { clearTimeout(timer); resolve() })
+        })
+      } else {
+        this.widgetTarget.hidden = false
+        const options = {
+          sitekey: this.siteKeyValue,
+          callback: token => {
+            if (this.current(generation)) { this.tokenTarget.value = token; this.setDisabled(false); this.message("") }
+          },
+          "expired-callback": () => { if (this.current(generation)) { this.tokenTarget.value = ""; this.setDisabled(true) } },
+          "error-callback": () => { if (this.current(generation)) this.unavailable() }
+        }
+        if (this.providerValue === "turnstile") Object.assign(options, { action: this.actionValue, "response-field": false })
+        this.widgetId = this.provider.render(this.widgetTarget, options)
+      }
+      if (this.current(generation)) {
+        this.ready = true
+        if (this.providerValue === "recaptcha-v3") { this.setDisabled(false); this.message("") }
+      }
+    } catch (_) { if (this.current(generation)) this.unavailable() }
+  }
+
+  async submit(event) {
+    if (this.allowSubmit) { this.allowSubmit = false; return }
+    if (this.pending) { event.preventDefault(); event.stopImmediatePropagation(); return }
+    // Server-side verification remains authoritative when loading fails.
+    if (!this.ready || this.providerValue !== "recaptcha-v3") return
+    event.preventDefault()
+    event.stopImmediatePropagation()
+    const generation = this.generation
+    const submitter = event.submitter
+    this.pending = true
+    this.setDisabled(true)
+    try {
+      const token = await Promise.race([
+        this.provider.execute(this.siteKeyValue, { action: this.actionValue }),
+        new Promise((_, reject) => { this.executionTimer = setTimeout(() => reject(new Error("unavailable")), 15000) })
+      ])
+      if (!this.current(generation)) return
+      this.tokenTarget.value = typeof token === "string" ? token : ""
+      // Even an already-resolved provider promise must leave the original
+      // submit event before requestSubmit; browsers reject recursive submits.
+      await new Promise(resolve => setTimeout(resolve, 0))
+      if (!this.current(generation)) return
+      this.allowSubmit = true
+      this.setDisabled(false)
+      this.element.requestSubmit(submitter)
+    } catch (_) { if (this.current(generation)) this.unavailable() }
+    finally { clearTimeout(this.executionTimer); if (this.current(generation)) this.pending = false }
+  }
+
+  reset() {
+    this.tokenTarget.value = ""
+    this.allowSubmit = false
+    if (this.widgetId !== undefined && this.provider) {
+      this.setDisabled(true)
+      this.provider.reset(this.widgetId)
+    }
+  }
+
+  beforeCache() { this.teardown() }
+  disconnect() { this.teardown() }
+  teardown() {
+    this.active = false
+    this.generation = (this.generation || 0) + 1
+    clearTimeout(this.executionTimer)
+    this.tokenTarget.value = ""
+    this.setDisabled(false)
+    if (this.widgetId !== undefined && this.provider) {
+      if (this.providerValue === "turnstile") this.provider.remove(this.widgetId)
+      else this.provider.reset(this.widgetId)
+      this.widgetId = undefined
+      this.widgetTarget.replaceChildren()
+    }
+    this.ready = false
+  }
+
+  current(generation) { return this.active && this.element.isConnected && this.generation === generation }
+  setDisabled(value) { this.submitTargets.forEach(button => { button.disabled = value }) }
+  message(text) { this.statusTarget.textContent = text; this.statusTarget.hidden = !text }
+  unavailable() { this.ready = false; this.tokenTarget.value = ""; this.setDisabled(false); this.message("Verification is unavailable. Submit to check again or try shortly.") }
+}
+
+application.register("add-auth-challenge", ChallengeController)

data/lib/generators/add_auth/email_tokens/email_tokens_generator.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    # Internal persistence foundation only. Does not install sign-in routes.
+    class EmailTokensGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      def self.next_migration_number(dirname)
+        ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+      end
+
+      def create_token_model
+        unless File.file?(File.join(destination_root, "app/models/user.rb"))
+          raise Thor::Error, "Run the Rails authentication generator first."
+        end
+        return if File.exist?(File.join(destination_root, "app/models/add_auth_sign_in_token.rb"))
+
+        copy_file "add_auth_sign_in_token.rb", "app/models/add_auth_sign_in_token.rb"
+      end
+
+      def create_token_migration
+        return if Dir[File.join(destination_root, "db/migrate/*_create_add_auth_sign_in_tokens.rb")].any?
+
+        migration_template "create_add_auth_sign_in_tokens.rb.tt",
+          "db/migrate/create_add_auth_sign_in_tokens.rb"
+      end
+    end
+  end
+end

data/lib/generators/add_auth/email_tokens/templates/add_auth_sign_in_token.rb

@@ -0,0 +1,4 @@
+class AddAuthSignInToken < ApplicationRecord
+  belongs_to :user
+  self.filter_attributes += [:delivery_payload, :digest]
+end

data/lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt

@@ -0,0 +1,18 @@
+class CreateAddAuthSignInTokens < ActiveRecord::Migration[8.0]
+  def change
+    create_table :add_auth_sign_in_tokens do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :digest, limit: 64, null: false
+      t.string :identifier_digest, limit: 64, null: false
+      t.string :purpose, null: false, default: "sign_in"
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.datetime :revoked_at
+      t.text :delivery_payload
+      t.string :requested_ip_address
+      t.timestamps
+    end
+    add_index :add_auth_sign_in_tokens, :digest, unique: true
+    add_index :add_auth_sign_in_tokens, [:user_id, :purpose], name: "index_add_auth_email_tokens_on_user_and_purpose"
+  end
+end

data/lib/generators/add_auth/install/install_generator.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module AddAuth
+  module Generators
+    class InstallGenerator < ::Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+
+      def verify_host
+        %w[app/models/user.rb app/models/session.rb app/controllers/concerns/authentication.rb].each do |path|
+          raise Thor::Error, "Run the Rails authentication generator first (missing #{path})." unless File.file?(File.join(destination_root, path))
+        end
+      end
+
+      def configuration
+        copy_file "initializer.rb", "config/initializers/add_auth.rb" unless File.exist?(File.join(destination_root, "config/initializers/add_auth.rb"))
+      end
+
+      def report
+        say "AddAuth: host authentication files found. Install enables no features."
+        rails_command "add_auth:doctor", abort_on_failure: false
+        say "Run add_auth:session_upgrade or add_auth:email_link, review migrations, then run bin/rails add_auth:doctor."
+      end
+    end
+  end
+end

data/lib/generators/add_auth/install/templates/initializer.rb

@@ -0,0 +1,46 @@
+# AddAuth configuration. Feature generators enable only their own block.
+AddAuth.configure do |config|
+  # Set false for email/passkey-only sign-in. Existing Rails password entry
+  # routes remain guarded; the host owns password reset and account provisioning.
+  # config.passwords_enabled = true
+
+  # BEGIN add_auth session
+  # config.session.enabled = true
+  # END add_auth session
+  # config.session.lifetime = 12.hours
+  # config.session.idle_timeout = 30.minutes
+  # Legacy cookies are rejected by default. Opt into a finite bridge explicitly:
+  # config.session.legacy_bridge_until = Time.iso8601("2026-09-13T00:00:00Z")
+
+  # BEGIN add_auth email_link
+  # config.email_link.enabled = true
+  # END add_auth email_link
+  # config.email_link.token_lifetime = 20.minutes
+  # config.email_link.same_browser = false # true requires the requesting browser
+  # REQUIRED for email delivery: fixed, trusted origin; never derive it from Host.
+  # config.base_url = "https://your-app.example"
+  # config.mail_from = "Your app <sign-in@your-app.example>"
+  # Configure a durable Active Job adapter and schedule add_auth:deliver_pending.
+  # config.rate_limit_store = Rails.cache # shared, atomic increment in production
+  # Each maintenance pass handles at most this many rows per operation/model:
+  # config.maintenance.batch_size = 100 # 1..1000
+  # History is retained until the host chooses a retention period (seconds):
+  # config.maintenance.session_retention = 7.days
+  # config.maintenance.email_retention = 7.days
+  # config.maintenance.notification_retention = 30.days
+
+  # Apply the host's current confirmed/locked/disabled policy on every resume:
+  # config.eligible = ->(user) { user.confirmed? && !user.locked? && !user.disabled? }
+
+  # Styling: nil disables CSS; a local path uses your own compiled stylesheet.
+  # config.stylesheet = "/add_auth.css"
+  # config.css_classes = { input: "form-control", button: "btn btn-primary" }
+  # Eject editable templates with bin/rails generate add_auth:views.
+
+  # Enable optional features with add_auth:passkeys, add_auth:step_up,
+  # add_auth:notifications or add_auth:challenge. Install alone enables none.
+  # Passkey recovery needs a host-verified recovery address; strict accounts
+  # use another passkey or the host's support process, never email recovery.
+  # config.challenge = AddAuth::Core::Challenge::Null.new
+  # config.challenge_on = []
+end

data/lib/generators/add_auth/javascript/javascript_generator.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "generators/add_auth/ejection"
+
+module AddAuth
+  module Generators
+    class JavascriptGenerator < ::Rails::Generators::Base
+      include Ejection
+
+      def generate = eject(:javascript)
+    end
+  end
+end

data/lib/generators/add_auth/javascript/templates/application.js

@@ -0,0 +1,2 @@
+import { Application } from "/add_auth/stimulus.js"
+export const application = Application.start()

data/lib/generators/add_auth/javascript/templates/codec.js

@@ -0,0 +1,28 @@
+export function decode(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]*$/.test(value)) throw new TypeError("Invalid encoding")
+  const text = atob(value.replace(/-/g, "+").replace(/_/g, "/"))
+  return Uint8Array.from(text, character => character.charCodeAt(0))
+}
+export function encode(value) {
+  return btoa(Array.from(new Uint8Array(value), byte => String.fromCharCode(byte)).join("")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+}
+export function options(json, create) {
+  const native = create ? PublicKeyCredential.parseCreationOptionsFromJSON : PublicKeyCredential.parseRequestOptionsFromJSON
+  if (native) return native.call(PublicKeyCredential, json)
+  const value = { ...json, challenge: decode(json.challenge) }
+  if (create) value.user = { ...json.user, id: decode(json.user.id) }
+  for (const key of ["allowCredentials", "excludeCredentials"]) {
+    if (json[key]) value[key] = json[key].map(item => ({ ...item, id: decode(item.id) }))
+  }
+  return value
+}
+export function credential(value) {
+  if (value.toJSON) return value.toJSON()
+  const response = { clientDataJSON: encode(value.response.clientDataJSON) }
+  for (const key of ["attestationObject", "authenticatorData", "signature", "userHandle"]) {
+    if (value.response[key]) response[key] = encode(value.response[key])
+  }
+  if (value.response.getTransports) response.transports = value.response.getTransports()
+  return { id: value.id, rawId: encode(value.rawId), type: value.type, response,
+    clientExtensionResults: value.getClientExtensionResults(), authenticatorAttachment: value.authenticatorAttachment }
+}

data/lib/generators/add_auth/javascript/templates/passkey.js

@@ -0,0 +1,81 @@
+import { Controller } from "/add_auth/stimulus.js"
+import { application } from "/add_auth/application.js"
+import { options, credential } from "/add_auth/codec.js"
+
+export class PasskeyController extends Controller {
+  static targets = ["form", "controls", "unavailable", "status", "button"]
+  static values = { optionsUrl: String, finishUrl: String, mode: String, purpose: String, csrf: String, conditional: Boolean }
+  connect() {
+    this.generation = 0
+    this.active = true
+    if (!window.PublicKeyCredential || !navigator.credentials || !window.isSecureContext) return
+    this.controlsTarget.hidden = false
+    this.unavailableTarget.hidden = true
+    if (this.conditionalValue && PublicKeyCredential.isConditionalMediationAvailable) {
+      PublicKeyCredential.isConditionalMediationAvailable().then(available => {
+        if (available && this.active && !this.abort) this.run(true)
+      }).catch(() => {})
+    }
+  }
+  submit(event) {
+    if (event.defaultPrevented) return
+    event.preventDefault()
+    this.run(false)
+  }
+  otherSubmission(event) { if (event.target !== this.formTarget) this.stop() }
+  disconnect() { this.active = false; this.stop() }
+  beforeCache() { this.active = false; this.stop(); this.controlsTarget.hidden = true; this.unavailableTarget.hidden = false; this.message("") }
+  async run(conditional) {
+    this.stop()
+    const generation = this.generation
+    this.abort = new AbortController()
+    if (!conditional) { this.buttonTarget.disabled = true; this.message("Follow your browser’s passkey prompt.") }
+    try {
+      const challenge = new FormData(this.formTarget).get("challenge_token")
+      const start = await this.post(this.optionsUrlValue, { purpose: this.purposeValue || null, challenge_token: challenge }, this.abort.signal)
+      this.formTarget.dispatchEvent(new CustomEvent("add_auth:proof-used"))
+      if (!this.current(generation)) return
+      if (start.redirect) { this.navigate(start.redirect); return }
+      this.transaction = start.transaction
+      const create = this.modeValue === "create"
+      const request = { publicKey: options(start.publicKey, create), signal: this.abort.signal }
+      if (conditional) request.mediation = "conditional"
+      const proof = await navigator.credentials[create ? "create" : "get"](request)
+      if (!this.current(generation)) return
+      const result = await this.post(this.finishUrlValue, { transaction: this.transaction, credential: credential(proof) }, this.abort.signal)
+      if (!this.current(generation)) return
+      this.transaction = null
+      this.navigate(result.redirect)
+    } catch (error) {
+      if (this.current(generation) && error.name !== "AbortError") {
+        this.message(error.name === "NotAllowedError" ? "No change was made. Try again, use another passkey, or choose an allowed recovery method." : error.message)
+        if (!conditional) this.statusTarget.focus()
+      }
+    } finally {
+      if (this.current(generation)) { this.buttonTarget.disabled = false; this.stop() }
+    }
+  }
+  async post(path, body, signal) {
+    const response = await fetch(path, { method: "POST", credentials: "same-origin", signal,
+      headers: { "Content-Type": "application/json", "Accept": "application/json", "X-CSRF-Token": this.csrfValue }, body: JSON.stringify(body) })
+    const value = await response.json()
+    if (!response.ok && !value.redirect) throw new Error(value.error || "Verification is unavailable. Try again shortly.")
+    return value
+  }
+  stop() {
+    this.generation += 1
+    this.abort?.abort()
+    this.abort = null
+    if (this.transaction) {
+      fetch("/passkeys/cancel", { method: "POST", credentials: "same-origin", keepalive: true,
+        headers: { "Content-Type": "application/json", "X-CSRF-Token": this.csrfValue },
+        body: JSON.stringify({ transaction: this.transaction }) }).catch(() => {})
+      this.transaction = null
+    }
+    if (this.hasButtonTarget) this.buttonTarget.disabled = false
+  }
+  current(generation) { return this.active && this.element.isConnected && this.generation === generation }
+  message(text) { this.statusTarget.textContent = text; this.statusTarget.hidden = !text }
+  navigate(path) { if (path) window.Turbo ? window.Turbo.visit(path) : window.location.assign(path) }
+}
+application.register("add-auth-passkey", PasskeyController)

data/lib/generators/add_auth/mailer_views/mailer_views_generator.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "generators/add_auth/ejection"
+
+module AddAuth
+  module Generators
+    class MailerViewsGenerator < ::Rails::Generators::Base
+      include Ejection
+
+      def generate = eject(:mailer_views)
+    end
+  end
+end

data/lib/generators/add_auth/notifications/notifications_generator.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class NotificationsGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def dependencies = invoke("add_auth:session_upgrade")
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_create_add_auth_security_events.rb")].any?
+          migration_template "create_add_auth_security_events.rb.tt", "db/migrate/create_add_auth_security_events.rb"
+        end
+        copy_file "add_auth_security_event.rb", "app/models/add_auth_security_event.rb", skip: true
+      end
+
+      def configuration
+        path = "config/initializers/add_auth.rb"
+        unless File.read(File.join(destination_root, path)).include?("config.notifications.enabled = true")
+          append_to_file path, "\nAddAuth.configure do |config|\n  config.notifications.enabled = true\nend\n"
+        end
+        say "Migrate, configure mail_from and a durable queue, and schedule add_auth:deliver_pending every minute."
+      end
+    end
+  end
+end

data/lib/generators/add_auth/notifications/templates/add_auth_security_event.rb

@@ -0,0 +1,4 @@
+class AddAuthSecurityEvent < ApplicationRecord
+  belongs_to :user, optional: true
+  self.filter_attributes += [:delivery_payload, :digest, :delivery_lease_key]
+end

data/lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt

@@ -0,0 +1,18 @@
+class CreateAddAuthSecurityEvents < ActiveRecord::Migration[8.0]
+  def change
+    create_table :add_auth_security_events do |t|
+      t.references :user, foreign_key: {on_delete: :nullify}
+      t.string :kind, null: false
+      t.string :digest, null: false
+      t.text :delivery_payload
+      t.string :delivery_lease_key
+      t.datetime :delivery_lease_until
+      t.datetime :delivered_at
+      t.datetime :revoked_at
+      t.datetime :expires_at, null: false
+      t.timestamps
+    end
+    add_index :add_auth_security_events, :digest, unique: true
+    add_index :add_auth_security_events, :expires_at
+  end
+end

data/lib/generators/add_auth/passkeys/passkeys_generator.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class PasskeysGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def dependencies
+        invoke "add_auth:step_up"
+        invoke "add_auth:notifications"
+      end
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_passkeys.rb")].any?
+          migration_template "add_add_auth_passkeys.rb.tt", "db/migrate/add_add_auth_passkeys.rb"
+        end
+        %w[credential ceremony].each { |name| copy_file "add_auth_#{name}.rb", "app/models/add_auth_#{name}.rb", skip: true }
+      end
+
+      def wiring
+        unless File.read(File.join(destination_root, "config/routes.rb")).include?("# AddAuth passkeys")
+          route <<~ROUTES
+            # AddAuth passkeys
+            get "add_auth/passkey.js", to: "add_auth/assets#passkey"
+            get "add_auth/codec.js", to: "add_auth/assets#codec"
+            get "passkeys", to: "add_auth/passkeys#index"
+            post "passkeys/options", to: "add_auth/passkeys#registration_options"
+            post "passkeys", to: "add_auth/passkeys#register"
+            post "passkeys/sign-in/options", to: "add_auth/passkeys#authentication_options"
+            post "passkeys/sign-in", to: "add_auth/passkeys#authenticate"
+            post "passkeys/cancel", to: "add_auth/passkeys#cancel"
+            post "passkeys/policy", to: "add_auth/passkeys#change_policy"
+            patch "passkeys/:id", to: "add_auth/passkeys#rename"
+            delete "passkeys/:id", to: "add_auth/passkeys#remove"
+            post "reauthenticate/passkey/options", to: "add_auth/passkeys#reauthentication_options"
+            post "reauthenticate/passkey", to: "add_auth/passkeys#reauthenticate"
+            get "recover", to: "add_auth/recoveries#new"
+            post "recover/email", to: "add_auth/recoveries#request_link"
+            get "recover/check-email", to: "add_auth/recoveries#check_email"
+            get "recover/link", to: "add_auth/recoveries#link"
+            post "recover/link", to: "add_auth/recoveries#confirm"
+          ROUTES
+        end
+        path = "config/initializers/add_auth.rb"
+        unless File.read(File.join(destination_root, path)).include?("config.passkeys.enabled = true")
+          append_to_file path, <<~CONFIG
+
+            AddAuth.configure do |config|
+              config.passkeys.enabled = true
+              # REQUIRED: stable RP ID and exact deployment origins, never request Host.
+              # config.passkeys.rp_id = "example.com"
+              # config.passkeys.origins = ["https://app.example.com"]
+              # config.passkeys.name = "Your app"
+              # Shared anonymous ceremony budget per five minutes; positive integer.
+              # config.passkeys.anonymous_limit = 1000
+              # Schedule add_auth:deliver_pending every minute. Production doctor
+              # requires a completed cleanup within the last two minutes.
+              # REQUIRED for email replacement: a host-verified recovery address.
+              # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed? }
+              # REQUIRED before strict activation: your documented support route.
+              # config.support_url = "/support"
+            end
+          CONFIG
+        end
+        say "Review and migrate before enabling traffic. Configure RP/origins, trusted recovery and notifications; run add_auth:doctor."
+      end
+    end
+  end
+end