add_auth 0.2.1

data/lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt

@@ -0,0 +1,45 @@
+class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
+  def change
+    # Rails 8.0 cannot reflect SQLite's FALSE literal emitted by Rails 8.1.
+    # Keep the additive schema readable by both supported Rails lines.
+    false_default = (connection.adapter_name == "SQLite") ? -> { "0" } : false
+    add_column :users, :webauthn_id, :string
+    add_index :users, :webauthn_id, unique: true
+    add_column :users, :add_auth_strict, :boolean, default: false_default, null: false
+    add_column :users, :add_auth_policy_version, :integer, default: 0, null: false
+    add_column :sessions, :authentication_policy_version, :integer, default: 0, null: false
+    add_column :sessions, :authentication_credential_id, :string
+    add_column :sessions, :authentication_uv, :boolean, default: false_default, null: false
+    create_table :add_auth_credentials do |t|
+      t.references :user, null: false, foreign_key: {on_delete: :cascade}
+      t.string :external_id, null: false
+      t.text :public_key, null: false
+      t.bigint :sign_count, default: 0, null: false
+      t.string :nickname, default: "Passkey", null: false, limit: 60
+      t.string :aaguid
+      t.json :transports
+      t.boolean :backup_eligible, default: false_default, null: false
+      t.boolean :backup_state, default: false_default, null: false
+      t.datetime :last_used_at
+      t.datetime :revoked_at
+      t.timestamps
+    end
+    add_index :add_auth_credentials, :external_id, unique: true
+    create_table :add_auth_ceremonies do |t|
+      t.string :digest, null: false
+      t.string :challenge, null: false
+      t.string :kind, null: false
+      t.string :browser_digest, null: false
+      t.string :configuration_digest, null: false
+      t.references :user, foreign_key: {on_delete: :cascade}
+      t.references :session, foreign_key: {on_delete: :cascade}
+      t.string :session_digest
+      t.string :authentication_purpose
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.timestamps
+    end
+    add_index :add_auth_ceremonies, :digest, unique: true
+    add_index :add_auth_ceremonies, :expires_at
+  end
+end

data/lib/generators/add_auth/passkeys/templates/add_auth_ceremony.rb

@@ -0,0 +1,4 @@
+class AddAuthCeremony < ApplicationRecord
+  belongs_to :user, optional: true
+  self.filter_attributes += [:digest, :challenge, :browser_digest, :session_digest, :public_key, :external_id]
+end

data/lib/generators/add_auth/passkeys/templates/add_auth_credential.rb

@@ -0,0 +1,4 @@
+class AddAuthCredential < ApplicationRecord
+  belongs_to :user
+  self.filter_attributes += [:digest, :challenge, :browser_digest, :session_digest, :public_key, :external_id]
+end

data/lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class SessionUpgradeGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      def shared_browser_runtime
+        unless File.read(File.join(destination_root, "config/routes.rb")).include?("add_auth/application.js")
+          route 'get "add_auth/application.js", to: "add_auth/assets#application"'
+        end
+      end
+
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def install_configuration
+        invoke "add_auth:install"
+      end
+
+      def migration
+        unless Dir[File.join(destination_root, "db/migrate/*_extend_sessions_for_add_auth.rb")].any?
+          migration_template "extend_sessions_for_add_auth.rb.tt", "db/migrate/extend_sessions_for_add_auth.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_elevation.rb")].any?
+          migration_template "add_add_auth_elevation.rb.tt", "db/migrate/add_add_auth_elevation.rb"
+        end
+      end
+
+      def assets_and_sign_in
+        source = File.read(File.join(destination_root, "config/routes.rb"))
+        {"add_auth.css" => "assets#stylesheet", "add_auth/turbo.js" => "assets#turbo",
+         "add_auth/boot.js" => "assets#boot", "add_auth/stimulus.js" => "assets#stimulus", "add_auth/challenge.js" => "assets#challenge",
+         "sign-in" => "sign_ins#new"}.each do |path, action|
+          route %(get "#{path}", to: "add_auth/#{action}") unless source.include?(%("#{path}"))
+        end
+        route 'post "sign-in/password", to: "add_auth/sign_ins#password"' unless source.include?('"sign-in/password"')
+      end
+
+      def hooks
+        path = "app/controllers/application_controller.rb"
+        source = File.read(File.join(destination_root, path))
+        unless source.include?("include Authentication")
+          raise Thor::Error, "Expected ApplicationController to include Authentication; integrate AddAuth::Rails::Authentication after it manually."
+        end
+        unless source.include?("include AddAuth::Rails::Authentication")
+          inject_into_file path, "\n  include AddAuth::Rails::Authentication", after: "include Authentication"
+        end
+        path = "app/models/user.rb"
+        unless File.read(File.join(destination_root, path)).include?("include AddAuth::Rails::UserLifecycle")
+          inject_into_file path, "  include AddAuth::Rails::UserLifecycle\n", after: /class User < [^\n]+\n/
+        end
+        path = "app/models/session.rb"
+        unless File.read(File.join(destination_root, path)).include?("self.filter_attributes")
+          inject_into_file path, "  self.filter_attributes += [:token_digest, :elevation_credential_id]\n", after: /class Session < [^\n]+\n/
+        end
+        path = "config/initializers/add_auth.rb"
+        unless File.read(File.join(destination_root, path)).include?('require "add_auth/rails/authentication"')
+          prepend_to_file path, %(require "add_auth/rails/authentication"\nrequire "add_auth/rails/user_lifecycle"\n)
+        end
+        gsub_file path, "# config.session.enabled = true", "config.session.enabled = true"
+        routes = File.join(destination_root, "config/routes.rb")
+        source = File.read(routes)
+        unless source.include?("# AddAuth session management")
+          route <<~ROUTES
+            # AddAuth session management
+            get "sessions/revoke-all", to: "add_auth/sessions#new_revoke_all"
+            post "sessions/revoke-all", to: "add_auth/sessions#revoke_all"
+            resources :security_sessions, path: "sessions", only: [:index, :destroy], controller: "add_auth/sessions"
+          ROUTES
+        end
+      end
+    end
+  end
+end

data/lib/generators/add_auth/session_upgrade/templates/add_add_auth_elevation.rb.tt

@@ -0,0 +1,12 @@
+class AddAddAuthElevation < ActiveRecord::Migration[8.0]
+  def change
+    # Rails 8.0 cannot reflect SQLite's FALSE literal emitted by Rails 8.1.
+    # Keep the additive schema readable by both supported Rails lines.
+    false_default = (connection.adapter_name == "SQLite") ? -> { "0" } : false
+    add_column :sessions, :elevated_at, :datetime
+    add_column :sessions, :elevated_with, :string
+    add_column :sessions, :elevation_purpose, :string
+    add_column :sessions, :elevation_credential_id, :string
+    add_column :sessions, :elevation_uv, :boolean, default: false_default, null: false
+  end
+end

data/lib/generators/add_auth/session_upgrade/templates/extend_sessions_for_add_auth.rb.tt

@@ -0,0 +1,14 @@
+class ExtendSessionsForAddAuth < ActiveRecord::Migration[8.0]
+  def change
+    add_column :sessions, :token_digest, :string, limit: 64
+    add_index :sessions, :token_digest, unique: true
+    add_column :sessions, :authenticated_with, :string
+    add_column :sessions, :authenticated_at, :datetime
+    add_column :sessions, :expires_at, :datetime
+    add_column :sessions, :last_seen_at, :datetime
+    add_column :sessions, :revoked_at, :datetime
+    add_index :sessions, [:user_id, :id], name: "index_add_auth_session_pages"
+    add_index :sessions, :expires_at
+    add_index :sessions, :revoked_at
+  end
+end

data/lib/generators/add_auth/step_up/step_up_generator.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class StepUpGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def dependencies
+        invoke "add_auth:email_link"
+      end
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_reauthentication.rb")].any?
+          migration_template "add_add_auth_reauthentication.rb.tt", "db/migrate/add_add_auth_reauthentication.rb"
+        end
+      end
+
+      def wiring
+        unless File.read(File.join(destination_root, "config/routes.rb")).include?("# AddAuth reauthentication")
+          route <<~ROUTES
+            # AddAuth reauthentication
+            get "reauthenticate", to: "add_auth/reauthentications#new"
+            post "reauthenticate/password", to: "add_auth/reauthentications#password"
+            post "reauthenticate/email", to: "add_auth/reauthentications#request_link"
+            get "reauthenticate/check-email", to: "add_auth/reauthentications#check_email"
+            get "reauthenticate/link", to: "add_auth/reauthentications#link"
+            post "reauthenticate/link", to: "add_auth/reauthentications#confirm"
+          ROUTES
+        end
+        initializer = "config/initializers/add_auth.rb"
+        unless File.read(File.join(destination_root, initializer)).include?("config.step_up.enabled = true")
+          append_to_file initializer, "\nAddAuth.configure do |config|\n  config.step_up.enabled = true\n  # Declare purpose methods and a fixed safe GET return_to before use.\nend\n"
+        end
+        say "Migrate and declare config.step_up.purposes. Use with_elevated_session around sensitive database mutations."
+      end
+    end
+  end
+end

data/lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt

@@ -0,0 +1,9 @@
+class AddAddAuthReauthentication < ActiveRecord::Migration[8.0]
+  def change
+    add_column :sessions, :elevation_version, :string
+    add_column :sessions, :elevation_expires_at, :datetime
+    add_reference :add_auth_sign_in_tokens, :session, foreign_key: {on_delete: :cascade}
+    add_column :add_auth_sign_in_tokens, :session_digest, :string
+    add_column :add_auth_sign_in_tokens, :authentication_purpose, :string
+  end
+end

data/lib/generators/add_auth/views/views_generator.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "generators/add_auth/ejection"
+
+module AddAuth
+  module Generators
+    class ViewsGenerator < ::Rails::Generators::Base
+      include Ejection
+
+      class_option :only, type: :string, default: "email_link"
+
+      def generate = eject(:views, only: options[:only])
+    end
+  end
+end

data/lib/tasks/add_auth.rake

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+namespace :add_auth do
+  desc "Check installed AddAuth authentication, delivery and maintenance wiring"
+  task doctor: :environment do
+    require "add_auth/rails/doctor"
+    doctor = AddAuth::Rails::Doctor.new
+    problems = doctor.call
+    Array(doctor.ejections).each do |entry|
+      puts "Customized: #{entry[:path]}" if entry[:customized]
+      puts entry[:diff] if entry[:diff]
+    end
+    puts problems.empty? ? "AddAuth configuration checks passed." : problems.join("\n")
+    abort "AddAuth configuration needs attention" if problems.any?
+  end
+
+  desc "Run bounded delivery recovery and retention; schedule at least every minute"
+  task deliver_pending: :environment do
+    require "add_auth/rails/stores/maintenance"
+    models = {}
+    models[:session] = ::Session if AddAuth.configuration.session.enabled && defined?(::Session)
+    models[:ceremony] = ::AddAuthCeremony if defined?(::AddAuthCeremony)
+    models[:email] = ::AddAuthSignInToken if defined?(::AddAuthSignInToken)
+    models[:notification] = ::AddAuthSecurityEvent if defined?(::AddAuthSecurityEvent)
+    stores = models.filter_map do |kind, model|
+      [kind, AddAuth::Rails::Stores::Maintenance.new(model: model, kind: kind)] if model.table_exists?
+    end.to_h
+    jobs = {email: AddAuth::EmailDeliveryJob, notification: AddAuth::SecurityNotificationJob}
+    enqueue = lambda do |kind, id|
+      raise AddAuth::Error, "maintenance enqueue failed" unless jobs.fetch(kind).perform_later(id)
+    end
+    ActiveSupport::Notifications.instrument("maintenance.add_auth") do |payload|
+      payload.merge!(AddAuth::Core::Maintenance.new(stores: stores,
+        options: AddAuth.configuration.maintenance, enqueue: enqueue).call)
+      AddAuth::Rails::Runtime.record_maintenance
+    end
+  end
+end

metadata

@@ -0,0 +1,361 @@
+--- !ruby/object:Gem::Specification
+name: add_auth
+version: !ruby/object:Gem::Version
+  version: 0.2.1
+platform: ruby
+authors:
+- Taimoor Qureshi
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: webauthn
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.4.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.4.3
+- !ruby/object:Gem::Dependency
+  name: public_suffix
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.0'
+- !ruby/object:Gem::Dependency
+  name: turbo-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: stimulus-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: bcrypt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.7
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.7
+- !ruby/object:Gem::Dependency
+  name: rspec-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: pg
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.6'
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: capybara
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.40'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.40'
+- !ruby/object:Gem::Dependency
+  name: selenium-webdriver
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.48'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.48'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.26'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.26'
+description: |
+  AddAuth extends the output of `bin/rails generate authentication` with the
+  credentials it does not cover: passkeys, email-link sign-in, purpose-bound
+  reauthentication and recovery. It adds hardened sessions, security mail and
+  challenge providers, with shared Turbo/HTML pages and permitted no-JavaScript
+  alternatives. It upgrades the generated User and Session models in place.
+  Documentation: https://addauthgem.com.
+email:
+- taimoorq@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CODE_OF_CONDUCT.md
+- LICENSE.txt
+- README.md
+- ROADMAP.md
+- SECURITY.md
+- app/controllers/add_auth/assets_controller.rb
+- app/controllers/add_auth/passkeys_controller.rb
+- app/controllers/add_auth/reauthentications_controller.rb
+- app/controllers/add_auth/recoveries_controller.rb
+- app/controllers/add_auth/sessions_controller.rb
+- app/controllers/add_auth/sign_ins_controller.rb
+- app/helpers/add_auth/sign_ins_helper.rb
+- app/javascript/controllers/.keep
+- app/jobs/add_auth/delivery_job.rb
+- app/jobs/add_auth/email_delivery_job.rb
+- app/jobs/add_auth/email_request_job.rb
+- app/jobs/add_auth/security_notification_job.rb
+- app/mailers/add_auth/security_mailer.rb
+- app/mailers/add_auth/sign_in_mailer.rb
+- app/models/concerns/.keep
+- app/views/.keep
+- app/views/add_auth/passkeys/_controls.html.erb
+- app/views/add_auth/passkeys/_list.html.erb
+- app/views/add_auth/reauthentications/_check_email.html.erb
+- app/views/add_auth/reauthentications/_confirmation.html.erb
+- app/views/add_auth/reauthentications/_different_browser.html.erb
+- app/views/add_auth/reauthentications/_form.html.erb
+- app/views/add_auth/reauthentications/_invalid_link.html.erb
+- app/views/add_auth/recoveries/_check_email.html.erb
+- app/views/add_auth/recoveries/_confirmation.html.erb
+- app/views/add_auth/recoveries/_form.html.erb
+- app/views/add_auth/recoveries/_invalid_link.html.erb
+- app/views/add_auth/security_mailer/notice.text.erb
+- app/views/add_auth/sessions/_list.html.erb
+- app/views/add_auth/sessions/_revoke_all.html.erb
+- app/views/add_auth/sessions/index.html.erb
+- app/views/add_auth/sign_in_mailer/link.text.erb
+- app/views/add_auth/sign_ins/_check_email.html.erb
+- app/views/add_auth/sign_ins/_confirmation.html.erb
+- app/views/add_auth/sign_ins/_different_browser.html.erb
+- app/views/add_auth/sign_ins/_form.html.erb
+- app/views/add_auth/sign_ins/_invalid_link.html.erb
+- app/views/add_auth/sign_ins/show.html.erb
+- app/views/layouts/add_auth/authentication.html.erb
+- lib/add_auth.rb
+- lib/add_auth/configuration.rb
+- lib/add_auth/core/access_policy.rb
+- lib/add_auth/core/browser_binding.rb
+- lib/add_auth/core/challenge/base.rb
+- lib/add_auth/core/challenge/http.rb
+- lib/add_auth/core/challenge/null.rb
+- lib/add_auth/core/challenge/recaptcha.rb
+- lib/add_auth/core/challenge/test.rb
+- lib/add_auth/core/challenge/turnstile.rb
+- lib/add_auth/core/delivery.rb
+- lib/add_auth/core/digest/base.rb
+- lib/add_auth/core/digest/hmac.rb
+- lib/add_auth/core/intake.rb
+- lib/add_auth/core/maintenance.rb
+- lib/add_auth/core/rate_limit.rb
+- lib/add_auth/core/security_events.rb
+- lib/add_auth/core/sessions.rb
+- lib/add_auth/core/step_up.rb
+- lib/add_auth/core/strategies/email_link.rb
+- lib/add_auth/core/strategies/passkey.rb
+- lib/add_auth/rails/authentication.rb
+- lib/add_auth/rails/authentication_pages.rb
+- lib/add_auth/rails/delivery_cipher.rb
+- lib/add_auth/rails/doctor.rb
+- lib/add_auth/rails/ejection.rb
+- lib/add_auth/rails/elevation.rb
+- lib/add_auth/rails/engine.rb
+- lib/add_auth/rails/password_entry.rb
+- lib/add_auth/rails/runtime.rb
+- lib/add_auth/rails/stores/account_lock.rb
+- lib/add_auth/rails/stores/delivery_state.rb
+- lib/add_auth/rails/stores/email_tokens.rb
+- lib/add_auth/rails/stores/maintenance.rb
+- lib/add_auth/rails/stores/passkeys.rb
+- lib/add_auth/rails/stores/security_events.rb
+- lib/add_auth/rails/stores/sessions.rb
+- lib/add_auth/rails/user_lifecycle.rb
+- lib/add_auth/result.rb
+- lib/add_auth/testing.rb
+- lib/add_auth/version.rb
+- lib/generators/add_auth/challenge/challenge_generator.rb
+- lib/generators/add_auth/challenge/templates/recaptcha.rb.tt
+- lib/generators/add_auth/challenge/templates/turnstile.rb.tt
+- lib/generators/add_auth/controllers/controllers_generator.rb
+- lib/generators/add_auth/ejection.rb
+- lib/generators/add_auth/email_link/email_link_generator.rb
+- lib/generators/add_auth/email_link/templates/add_add_auth_email_binding.rb.tt
+- lib/generators/add_auth/email_link/templates/add_add_auth_email_delivery.rb.tt
+- lib/generators/add_auth/email_link/templates/add_auth.css
+- lib/generators/add_auth/email_link/templates/add_auth_challenge.js
+- lib/generators/add_auth/email_tokens/email_tokens_generator.rb
+- lib/generators/add_auth/email_tokens/templates/add_auth_sign_in_token.rb
+- lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt
+- lib/generators/add_auth/install/install_generator.rb
+- lib/generators/add_auth/install/templates/initializer.rb
+- lib/generators/add_auth/javascript/javascript_generator.rb
+- lib/generators/add_auth/javascript/templates/application.js
+- lib/generators/add_auth/javascript/templates/codec.js
+- lib/generators/add_auth/javascript/templates/passkey.js
+- lib/generators/add_auth/mailer_views/mailer_views_generator.rb
+- lib/generators/add_auth/notifications/notifications_generator.rb
+- lib/generators/add_auth/notifications/templates/add_auth_security_event.rb
+- lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt
+- lib/generators/add_auth/passkeys/passkeys_generator.rb
+- lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt
+- lib/generators/add_auth/passkeys/templates/add_auth_ceremony.rb
+- lib/generators/add_auth/passkeys/templates/add_auth_credential.rb
+- lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb
+- lib/generators/add_auth/session_upgrade/templates/add_add_auth_elevation.rb.tt
+- lib/generators/add_auth/session_upgrade/templates/extend_sessions_for_add_auth.rb.tt
+- lib/generators/add_auth/step_up/step_up_generator.rb
+- lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt
+- lib/generators/add_auth/views/views_generator.rb
+- lib/tasks/add_auth.rake
+homepage: https://addauthgem.com
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://addauthgem.com
+  source_code_uri: https://github.com/taimoorq/add_auth/tree/master
+  changelog_uri: https://github.com/taimoorq/add_auth/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/taimoorq/add_auth/issues
+  documentation_uri: https://addauthgem.com
+  rubygems_mfa_required: 'true'
+  allowed_push_host: https://rubygems.org
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Passkeys, email sign-in and session hardening for Rails 8 authentication.
+test_files: []