add_auth 0.2.1

data/app/controllers/add_auth/sessions_controller.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class SessionsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    rescue_from AddAuth::Error, with: :service_unavailable
+    helper AddAuth::SignInsHelper
+    before_action :require_add_auth_authentication
+    before_action :private_response
+    protect_from_forgery with: :exception
+    layout "application"
+
+    def index
+      @session_page = Rails::Runtime.sessions.list_page(user: Current.user,
+        current_session_id: Current.session.id, before: params[:before])
+      @sessions = @session_page.entries
+      respond_to do |format|
+        format.html { render "add_auth/sessions/index" }
+        format.turbo_stream do
+          render turbo_stream: turbo_stream.update("add_auth-session-content", partial: "add_auth/sessions/list")
+        end
+      end
+    end
+
+    def destroy
+      target_id = params[:id].to_s
+      if target_id.match?(/\A[1-9]\d*\z/) && target_id.to_i == Current.session.id
+        terminate_session
+        return redirect_to Rails::Runtime.sign_in_path, status: :see_other
+      end
+
+      revoked = Rails::Runtime.sessions.revoke_one(user: Current.user, session: Current.session, session_id: target_id)
+      return head :not_found unless revoked
+
+      redirect_to security_sessions_path, status: :see_other
+    end
+
+    def new_revoke_all
+      @elevated = Rails::Runtime.sessions.with_elevation(user: Current.user, session: Current.session,
+        purpose: :sign_out_everywhere, policy: Rails::Runtime.step_up_policy).success?
+      @password_available = Rails::Runtime.access_policy.methods_for(Current.user).include?(:password)
+      page("revoke_all")
+    end
+
+    def revoke_all
+      authorization = Rails::Runtime.revoke_all(user: Current.user, session: Current.session,
+        password: params[:password], ip: request.remote_ip, challenge_token: challenge_token)
+      return intake_failure(authorization.reason) unless authorization.success?
+
+      terminate_session
+      redirect_to Rails::Runtime.sign_in_path, status: :see_other
+    end
+
+    private
+
+    def authentication_partial(_partial)
+      @password_available = Rails::Runtime.access_policy.methods_for(Current.user).include?(:password)
+      "add_auth/sessions/revoke_all"
+    end
+  end
+end

data/app/controllers/add_auth/sign_ins_controller.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class SignInsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    layout "add_auth/authentication"
+    helper AddAuth::SignInsHelper
+    before_action :private_response
+    protect_from_forgery with: :exception
+    rescue_from AddAuth::Error, "ActiveJob::EnqueueError", with: :service_unavailable
+
+    def new
+      page("form")
+    end
+
+    def password = add_auth_password_sign_in
+
+    def request_link
+      return head :not_found unless Core::Intake.email_available?(Rails::Runtime.config)
+      intake = Rails::Runtime.intake.call(identifier: params[:email_address], ip: request.remote_ip,
+        action: :email_link, challenge_token: challenge_token)
+      return intake_failure(intake) if %i[challenge_rejected challenge_unavailable].include?(intake)
+      unless intake.is_a?(Symbol)
+        session[:add_auth_browser] ||= Rails::Runtime.browser_binding.generate
+        Rails::Runtime.enqueue_email(intake, browser_secret: session[:add_auth_browser])
+      end
+      redirect_to "/sign-in/check-email", status: :see_other
+    end
+
+    def check_email
+      return head :not_found unless Core::Intake.email_available?(Rails::Runtime.config)
+      page("check_email")
+    end
+
+    def link
+      return head :not_found unless Core::Intake.email_available?(Rails::Runtime.config)
+      @preview = Rails::Runtime.email.preview(token: params[:token], browser_secret: session[:add_auth_browser])
+      # GET does not resume/upgrade an existing session or consume this link.
+      page(Rails::Runtime.email.confirmation_page(@preview))
+    end
+
+    def confirm
+      return head :not_found unless Core::Intake.email_available?(Rails::Runtime.config)
+      previous = add_auth_replacement_session
+      grant = nil
+      result = Rails::Runtime.email.consume(token: params[:token], current_session: previous,
+        switch_account: params[:switch_account] == "1", browser_secret: session[:add_auth_browser]) do |user, persist|
+        grant = Rails::Runtime.sessions.create_in_transaction(user: user, method: :email_link, persist: persist,
+          replacing: previous, **add_auth_session_hints)
+        grant&.session
+      end
+      if result.success?
+        destination = after_authentication_url
+        add_auth_accept(grant)
+        redirect_to destination, status: :see_other
+      else
+        page("invalid_link", status: :unprocessable_entity)
+      end
+    end
+
+    private
+  end
+end

data/app/helpers/add_auth/sign_ins_helper.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module SignInsHelper
+    def add_auth_stylesheet
+      path = AddAuth.configuration.stylesheet
+      raise AddAuth::Error, "authentication stylesheets must use a same-origin path" if path && !Core::Sessions.safe_return(path)
+      path
+    end
+
+    def add_auth_class(role)
+      AddAuth.configuration.css_classes.fetch(role, "add_auth-#{role}")
+    end
+
+    def add_auth_challenge_form_data(action)
+      data = {turbo_frame: "_top"}
+      return data unless AddAuth.configuration.challenge_on.include?(action)
+      provider = AddAuth.configuration.challenge
+      return data unless provider.site_key
+      kind = case provider
+      when Core::Challenge::Turnstile then "turnstile"
+      when Core::Challenge::Recaptcha then "recaptcha-#{provider.version}"
+      else return data
+      end
+      data.merge(controller: "add-auth-challenge",
+        action: "submit->add-auth-challenge#submit add_auth:proof-used->add-auth-challenge#reset turbo:submit-end->add-auth-challenge#reset turbo:before-cache@document->add-auth-challenge#beforeCache",
+        add_auth_challenge_provider_value: kind, add_auth_challenge_site_key_value: provider.site_key,
+        add_auth_challenge_action_value: (provider.respond_to?(:expected_action) && provider.expected_action) || action,
+        add_auth_challenge_script_url_value: provider.script_url)
+    end
+
+    def add_auth_challenge_tag(action, id: action)
+      return safe_join([]) unless AddAuth.configuration.challenge_on.include?(action)
+      safe_join([
+        hidden_field_tag(:challenge_token, nil, id: "#{id}_challenge_token", data: {add_auth_challenge_target: "token"}),
+        tag.div(hidden: true, data: {add_auth_challenge_target: "widget"}),
+        tag.p("Verification is loading.", hidden: true, role: "status", class: add_auth_class(:notice),
+          data: {add_auth_challenge_target: "status"})
+      ])
+    end
+  end
+end

data/app/jobs/add_auth/delivery_job.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require "net/smtp"
+
+module AddAuth
+  class DeliveryJob < ActiveJob::Base
+    self.log_arguments = false
+    retry_on StandardError, wait: :polynomially_longer, attempts: 8
+
+    private
+
+    def deliver(service:, record:, mailer:)
+      delivery = service.claim_delivery(digest: record.digest)
+      return unless delivery
+      begin
+        message = yield delivery
+        raise AddAuth::Error, "mail delivery is disabled" unless mailer.perform_deliveries
+        message.deliver_now
+        outcome = message.add_auth_delivery_completed? ? :delivered : :cancelled
+        if service.finish_delivery(digest: record.digest, lease: delivery.fetch(:lease), outcome: outcome) && outcome == :cancelled
+          ActiveSupport::Notifications.instrument("delivery_cancelled.add_auth", issuance_id: record.id)
+        end
+      rescue Net::SMTPFatalError
+        service.delivery_failed(digest: record.digest, lease: delivery.fetch(:lease))
+      rescue
+        service.delivery_retry(digest: record.digest, lease: delivery.fetch(:lease))
+        raise
+      end
+    end
+  end
+end

data/app/jobs/add_auth/email_delivery_job.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class EmailDeliveryJob < DeliveryJob
+    def perform(id)
+      record = ::AddAuthSignInToken.find_by(id: id)
+      return unless record
+      service = Rails::Runtime.email(purpose: record.purpose)
+      deliver(service: service, record: record, mailer: SignInMailer) do |delivery|
+        SignInMailer.link(recipient: delivery.fetch(:recipient),
+          url: Rails::Runtime.sign_in_url(delivery.fetch(:token), purpose: record.purpose), purpose: record.purpose)
+      end
+    end
+  end
+end

data/app/jobs/add_auth/email_request_job.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class EmailRequestJob < ActiveJob::Base
+    self.log_arguments = false
+    retry_on StandardError, wait: :polynomially_longer, attempts: 8
+
+    def perform(encrypted_identifier)
+      payload = Rails::Runtime.decrypt_intake(encrypted_identifier)
+      # Continue accepting encrypted identifier-only jobs from the prior deploy.
+      identifier = payload.is_a?(Hash) ? payload["identifier"] : payload
+      browser_digest = payload["browser_digest"] if payload.is_a?(Hash)
+      # Dispatch an already committed intent even after the intake has expired.
+      purpose = payload.is_a?(Hash) ? payload.fetch("purpose", "sign_in") : "sign_in"
+      context = payload.is_a?(Hash) ? payload.slice("session_id", "session_digest", "authentication_purpose").symbolize_keys : {}
+      Rails::Runtime.email(purpose: purpose).issue(identifier: identifier, request_id: job_id, browser_digest: browser_digest, **context) if identifier
+      record = ::AddAuthSignInToken.find_by(request_id: job_id)
+      EmailDeliveryJob.perform_later(record.id) if record
+    end
+  end
+end

data/app/jobs/add_auth/security_notification_job.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class SecurityNotificationJob < DeliveryJob
+    def perform(id)
+      record = ::AddAuthSecurityEvent.find_by(id: id)
+      return unless record
+      deliver(service: Rails::Runtime.security_events, record: record, mailer: SecurityMailer) do |delivery|
+        SecurityMailer.notice(recipient: delivery.fetch(:recipient), kind: delivery.fetch(:kind))
+      end
+    end
+  end
+end

data/app/mailers/add_auth/security_mailer.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class SecurityMailer < SignInMailer
+    def notice(recipient:, kind:)
+      @description = {
+        "password_changed" => "Your password changed.", "email_changed" => "Your account email address changed.",
+        "passkey_added" => "A passkey was added to your account.", "passkey_removed" => "A passkey was removed from your account.",
+        "policy_changed" => "Your account sign-in and recovery policy changed.", "recovery_completed" => "Passkey recovery completed on your account."
+      }.fetch(kind.to_s)
+      from = Rails::Runtime.config.mail_from
+      raise AddAuth::Error, "configure mail_from before delivering security notifications" if from.to_s.empty?
+      mail(to: recipient, from: from, subject: "Account security change", content_type: "text/plain").extend(DeliveryReceipt)
+    end
+  end
+end

data/app/mailers/add_auth/sign_in_mailer.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class SignInMailer < ActionMailer::Base
+    module DeliveryReceipt
+      def add_auth_delivery_completed? = @add_auth_delivery_completed == true
+      def add_auth_delivery_completed! = @add_auth_delivery_completed = true
+    end
+
+    # Action Mailer's default instrumentation includes the entire bearer-bearing
+    # message in debug logs. Keep this mailer's delivery event secret-free.
+    def self.deliver_mail(mail)
+      # Interceptors have already run. Suppression is cancellation, and errors
+      # must propagate rather than silently turning a failed transport into success.
+      return unless mail.perform_deliveries
+      raise AddAuth::Error, "sign-in mail must report delivery errors" unless mail.raise_delivery_errors
+      ActiveSupport::Notifications.instrument("deliver.add_auth", message_id: mail.message_id) { yield }
+      mail.add_auth_delivery_completed!
+    end
+
+    self.raise_delivery_errors = true
+
+    def link(recipient:, url:, purpose: "sign_in")
+      from = Rails::Runtime.config.mail_from
+      raise AddAuth::Error, "configure mail_from before delivering sign-in links" if from.to_s.empty?
+      subject, instruction, minutes = {
+        "sign_in" => ["Your sign-in link", "Open this link, then choose Sign in to confirm your account", Rails::Runtime.config.email_link.token_lifetime / 60],
+        "reauthentication" => ["Verify your current session", "Open this link in the signed-in browser where you started, then confirm verification", 5],
+        "recovery" => ["Recover your passkeys", "Open this link, then explicitly confirm that you want to recover your passkeys", 20]
+      }.fetch(purpose.to_s)
+      @url, @instruction, @minutes = url, instruction, minutes
+      # No token-bearing mail body in Action Mailer's debug logs.
+      mail(to: recipient, from: from, subject: subject, content_type: "text/plain").extend(DeliveryReceipt)
+    end
+  end
+end

data/app/views/add_auth/passkeys/_controls.html.erb

@@ -0,0 +1,17 @@
+<div data-controller="add-auth-passkey"
+  data-add-auth-passkey-options-url-value="<%= options_url %>"
+  data-add-auth-passkey-finish-url-value="<%= finish_url %>"
+  data-add-auth-passkey-mode-value="<%= mode %>"
+  data-add-auth-passkey-purpose-value="<%= local_assigns[:purpose] %>"
+  data-add-auth-passkey-conditional-value="<%= local_assigns.fetch(:conditional, false) && !AddAuth.configuration.challenge_on.include?(action) %>"
+  data-add-auth-passkey-csrf-value="<%= form_authenticity_token %>"
+  data-action="turbo:before-cache@document->add-auth-passkey#beforeCache submit@document->add-auth-passkey#otherSubmission">
+  <p data-add-auth-passkey-target="unavailable">Passkeys need JavaScript and a compatible browser or device. Use another method allowed by your account policy if available.</p>
+  <%= form_with url: options_url, data: add_auth_challenge_form_data(action).merge(add_auth_passkey_target: "form", action: [add_auth_challenge_form_data(action)[:action], "submit->add-auth-passkey#submit"].compact.join(" ")) do |form| %>
+    <%= add_auth_challenge_tag action, id: "passkey_#{action}" %>
+    <div hidden data-add-auth-passkey-target="controls">
+      <%= form.submit label, class: add_auth_class(:button), data: {add_auth_challenge_target: "submit", add_auth_passkey_target: "button"} %>
+    </div>
+  <% end %>
+  <p role="status" aria-live="polite" tabindex="-1" hidden data-add-auth-passkey-target="status"></p>
+</div>

data/app/views/add_auth/passkeys/_list.html.erb

@@ -0,0 +1,32 @@
+<h1 id="add_auth-title">Your passkeys</h1>
+<% if @error %><p role="alert"><%= @error %></p><% end %>
+<p>Add a passkey for this browser, another device, or a security key. First verify your account when prompted.</p>
+<%= render "add_auth/passkeys/controls", mode: "create", options_url: "/passkeys/options", finish_url: "/passkeys", label: "Add a passkey", action: :passkey_enrollment %>
+<% @credentials.each do |credential| %>
+  <section id="passkey_<%= credential.id %>">
+    <h2><%= credential.nickname %></h2>
+    <p>Added <%= credential.created_at.strftime("%Y-%m-%d") %><% if credential.last_used_at %> · Last used <%= credential.last_used_at.strftime("%Y-%m-%d") %><% end %></p>
+    <% if credential.backup_eligible %><p>Supports backup. This does not prove you have a separately usable device.</p><% end %>
+    <%= form_with url: "/passkeys/#{credential.id}", method: :patch, data: {turbo_frame: "_top"} do |form| %>
+      <%= form.label :nickname, "Passkey name", for: "nickname_#{credential.id}" %>
+      <%= form.text_field :nickname, id: "nickname_#{credential.id}", value: credential.nickname, maxlength: 60, required: true %>
+      <%= form.submit "Rename" %>
+    <% end %>
+    <details>
+      <summary>Remove this passkey</summary>
+      <p>This removes access to this account. You may also delete the saved passkey from your password manager afterward. Keep another usable sign-in method.</p>
+      <%= button_to "Confirm removal", "/passkeys/#{credential.id}", method: :delete, form: {data: {turbo_frame: "_top"}} %>
+    </details>
+  </section>
+<% end %>
+<h2>Recovery policy</h2>
+<p><%= @strict ? "Strict: passkeys are required. Password reset and email cannot replace a lost passkey." : "Default: enabled methods can sign in. Email replacement is available only through an established, trusted recovery address." %></p>
+<p>Keep a separately usable passkey and test it before relying on strict policy. Two synced entries may share the same failure point.</p>
+<%= form_with url: "/passkeys/policy", data: {turbo_frame: "_top"} do |form| %>
+  <%= form.hidden_field :policy, value: @strict ? "default" : "strict" %>
+  <%= form.check_box :acknowledged, required: true %>
+  <%= form.label :acknowledged, "I understand the recovery limits and have tested another way to access my account." %>
+  <%= form.submit @strict ? "Use default recovery policy" : "Require passkeys for this account" %>
+<% end %>
+<p><%= link_to "Verify to change policy", "/reauthenticate?purpose=manage_policy" %></p>
+<p><%= link_to "I can’t use my passkeys", "/recover" %> · <%= link_to "Your sessions", "/sessions" %></p>

data/app/views/add_auth/reauthentications/_check_email.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Check your email</h1>
+<p>If this verification is permitted, we’ve sent a link. Use the newest email within five minutes and open it in this browser.</p>
+<%= link_to "Try again or use another method", "/reauthenticate?#{URI.encode_www_form(purpose: @purpose)}", class: add_auth_class(:link) %>

data/app/views/add_auth/reauthentications/_confirmation.html.erb

@@ -0,0 +1,7 @@
+<h1 id="add_auth-title">Confirm this verification</h1>
+<p>Verify <strong><%= @preview.fetch(:masked_address) %></strong> in the browser where you started. You’ll return to review the action before submitting it.</p>
+<%= form_with url: "/reauthenticate/link", data: {turbo_frame: "_top"} do |form| %>
+  <%= form.hidden_field :token, value: params[:token] %>
+  <%= form.submit "Confirm verification", class: add_auth_class(:button) %>
+<% end %>
+<%= link_to "Cancel", "/", class: add_auth_class(:link) %>

data/app/views/add_auth/reauthentications/_different_browser.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Return to the browser where you started</h1>
+<p role="status">This verification can only continue in the signed-in browser that requested it. Copy the link into that browser. Opening it here does not verify another device.</p>
+<%= link_to "Cancel", "/", class: add_auth_class(:link) %>

data/app/views/add_auth/reauthentications/_form.html.erb

@@ -0,0 +1,27 @@
+<h1 id="add_auth-title">Verify it’s you</h1>
+<p>Confirm your identity to <%= @rule&.label || "continue" %>.</p>
+<% if @error %><p role="alert"><%= @error %></p><% end %>
+<% if Array(@methods).include?(:password) %>
+  <%= form_with url: "/reauthenticate/password", data: add_auth_challenge_form_data(:reauthenticate) do |form| %>
+    <%= form.hidden_field :purpose, value: @purpose %>
+    <div class="<%= add_auth_class(:field) %>">
+      <%= form.label :password, "Current password" %>
+      <%= form.password_field :password, required: true, autocomplete: "current-password", class: add_auth_class(:input) %>
+    </div>
+    <%= add_auth_challenge_tag :reauthenticate, id: :password %>
+    <%= form.submit "Verify with password", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+  <% end %>
+<% end %>
+<% if Array(@methods).include?(:email_link) %>
+  <%= form_with url: "/reauthenticate/email", data: add_auth_challenge_form_data(:reauthenticate) do |form| %>
+    <%= form.hidden_field :purpose, value: @purpose %>
+    <%= add_auth_challenge_tag :reauthenticate, id: :email %>
+    <%= form.submit "Email me a verification link", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+  <% end %>
+<% end %>
+<% if Array(@methods).empty? %><p role="status">No permitted verification method is available here. Contact your account administrator for an allowed way to continue.</p><% end %>
+<p><%= link_to "Cancel", @rule&.return_to || "/", class: add_auth_class(:link) %></p>
+
+<% if Array(@methods).include?(:passkey) %>
+  <%= render "add_auth/passkeys/controls", mode: "get", options_url: "/reauthenticate/passkey/options", finish_url: "/reauthenticate/passkey", label: "Verify with a passkey", action: :reauthenticate, purpose: @purpose %>
+<% end %>

data/app/views/add_auth/reauthentications/_invalid_link.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Start verification again</h1>
+<p role="alert">This link cannot verify your session. It may have expired, been used, or belong to another browser. Return to your original action to start again.</p>
+<%= link_to "Return to your account", "/", class: add_auth_class(:link) %>

data/app/views/add_auth/recoveries/_check_email.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Check your email</h1>
+<p>If this account can use email recovery, we’ve sent a link. Use the newest link within twenty minutes. Strict accounts need another passkey or account support.</p>
+<%= link_to "Try again", "/recover" %> · <%= link_to "Back to sign in", "/sign-in" %>

data/app/views/add_auth/recoveries/_confirmation.html.erb

@@ -0,0 +1,9 @@
+<h1 id="add_auth-title">Confirm passkey recovery</h1>
+<p>Recover access to <strong><%= @preview.fetch(:masked_address) %></strong>. This replaces any account signed in on this browser. You’ll have ten minutes to add a replacement passkey.</p>
+<p>Existing passkeys stay active until you explicitly review and remove them. Other sessions are revoked only after replacement succeeds.</p>
+<%= form_with url: "/recover/link", data: {turbo_frame: "_top"} do |form| %>
+  <%= form.hidden_field :token, value: params[:token] %>
+  <%= form.hidden_field :switch_account, value: "1" %>
+  <%= form.submit "Continue recovering this account" %>
+<% end %>
+<%= link_to "Cancel", "/sign-in" %>

data/app/views/add_auth/recoveries/_form.html.erb

@@ -0,0 +1,11 @@
+<h1 id="add_auth-title">Recover your passkeys</h1>
+<p>Request a replacement link at your established recovery address. Accounts using strict policy require another passkey or your account administrator’s documented recovery process.</p>
+<% if @error %><p role="alert"><%= @error %></p><% end %>
+<%= form_with url: "/recover/email", data: add_auth_challenge_form_data(:email_link) do |form| %>
+  <%= form.label :email_address, "Recovery email address" %>
+  <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email" %>
+  <%= add_auth_challenge_tag :email_link %>
+  <%= form.submit "Send recovery link", data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>
+<% if AddAuth.configuration.support_url %><p><%= link_to "Contact account support", AddAuth.configuration.support_url %></p><% end %>

data/app/views/add_auth/recoveries/_invalid_link.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Request a new recovery link</h1>
+<p role="alert">This recovery link is unavailable, expired, or already used. Existing passkeys have not been removed.</p>
+<%= link_to "Start recovery again", "/recover" %>

data/app/views/add_auth/security_mailer/notice.text.erb

@@ -0,0 +1,3 @@
+<%= @description %>
+
+If you did not make this change, contact your account administrator immediately. This email contains no sign-in or recovery link.

data/app/views/add_auth/sessions/_list.html.erb

@@ -0,0 +1,25 @@
+<ul class="add_auth-session-list">
+  <% @sessions.each do |session| %>
+    <li class="add_auth-session" id="session_<%= session.id %>">
+      <div>
+        <strong><%= session.current ? "This browser" : "Signed-in browser" %></strong>
+        <p class="<%= add_auth_class(:muted) %>">
+          <%= session.authenticated_with ? "Signed in with #{session.authenticated_with.tr("_", " ")}" : "Imported session" %>
+          · <%= session.last_seen_at ? "Last active #{session.last_seen_at.strftime("%Y-%m-%d %H:%M UTC")}" : "Activity unknown" %>
+        </p>
+        <% if session.user_agent.present? %><p class="<%= add_auth_class(:muted) %>"><%= session.user_agent %></p><% end %>
+      </div>
+      <%= button_to(session.current ? "Sign out" : "Revoke", security_session_path(session.id), method: :delete,
+        class: add_auth_class(:button),
+        form: {data: {turbo_frame: "_top"}}) %>
+    </li>
+  <% end %>
+</ul>
+<nav aria-label="Session pages">
+  <% if params[:before].present? %>
+    <%= link_to "Newest sessions", security_sessions_path %>
+  <% end %>
+  <% if @session_page.next_cursor %>
+    <%= link_to "Older sessions", security_sessions_path(before: @session_page.next_cursor) %>
+  <% end %>
+</nav>

data/app/views/add_auth/sessions/_revoke_all.html.erb

@@ -0,0 +1,18 @@
+<% content_for :title, "Sign out everywhere" %>
+<h1 id="add_auth-title">Sign out everywhere</h1>
+<p class="<%= add_auth_class(:muted) %>">Revoke every active session, including this browser. This requires a recent verification.</p>
+<% if @error %><p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p><% end %>
+<% if @elevated || @password_available != false %>
+<%= form_with url: "/sessions/revoke-all", data: add_auth_challenge_form_data(:reauthenticate) do |form| %>
+  <% unless @elevated %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :password, "Current password" %>
+    <%= form.password_field :password, required: true, autocomplete: "current-password", class: add_auth_class(:input) %>
+  </div>
+  <% end %>
+  <%= add_auth_challenge_tag :reauthenticate %>
+  <%= form.submit "Sign out everywhere", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<% end %>
+<% if AddAuth.configuration.step_up.enabled %><p><%= link_to "Verify with an allowed method", "/reauthenticate?purpose=sign_out_everywhere" %></p><% end %>
+<p><%= link_to "Cancel", "/sessions", class: add_auth_class(:link) %></p>

data/app/views/add_auth/sessions/index.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Sessions" %>
+<% content_for :head do %>
+  <% turbo_exempts_page_from_cache %>
+  <% turbo_page_requires_reload if request.headers["Turbo-Frame"].present? %>
+  <%= stylesheet_link_tag add_auth_stylesheet, skip_pipeline: true if add_auth_stylesheet %>
+<% end %>
+<main class="<%= add_auth_class(:panel) %>" aria-labelledby="add_auth-title">
+  <h1 id="add_auth-title">Your sessions</h1>
+  <p class="<%= add_auth_class(:muted) %>">Review browsers signed in to your account and revoke any you no longer use.</p>
+  <p><%= link_to "Sign out everywhere", "/sessions/revoke-all", class: add_auth_class(:link) %></p>
+  <div id="add_auth-session-content"><%= render "add_auth/sessions/list" %></div>
+</main>

data/app/views/add_auth/sign_in_mailer/link.text.erb

@@ -0,0 +1,5 @@
+<%= @instruction %>:
+
+<%= @url %>
+
+Use only the newest email. This link expires in <%= @minutes %> minutes. If you did not request it, you can ignore this email.

data/app/views/add_auth/sign_ins/_check_email.html.erb

@@ -0,0 +1,5 @@
+<h1 id="add_auth-title">Check your email</h1>
+<p role="status">If this address can sign in, a link will arrive shortly.</p>
+<p class="<%= add_auth_class(:muted) %>">Use the newest email. Open its link, then confirm to sign in on that device.</p>
+<p>Nothing yet? Check your spam folder or wait a few minutes before trying again.</p>
+<%= link_to "Return to sign in", "/sign-in", class: add_auth_class(:link) %>

data/app/views/add_auth/sign_ins/_confirmation.html.erb

@@ -0,0 +1,9 @@
+<h1 id="add_auth-title">Confirm your sign-in</h1>
+<p>Sign in as <strong><%= @preview.fetch(:masked_address) %></strong> on this device.</p>
+<p class="<%= add_auth_class(:muted) %>">This will replace any account currently signed in on this browser.</p>
+<%= form_with url: "/sign-in/link", data: {turbo_frame: "_top"} do |form| %>
+  <%= form.hidden_field :token, value: params[:token] %>
+  <%= form.hidden_field :switch_account, value: "1" %>
+  <%= form.submit "Sign in to this account", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Cancel", "/sign-in", class: add_auth_class(:link) %></p>

data/app/views/add_auth/sign_ins/_different_browser.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Open this link in the requesting browser</h1>
+<p role="status">This sign-in link is tied to the browser that requested it. Copy the link into that browser, or request a new link here.</p>
+<%= link_to "Request a link here", "/sign-in", class: add_auth_class(:link) %>

data/app/views/add_auth/sign_ins/_form.html.erb

@@ -0,0 +1,34 @@
+<h1 id="add_auth-title">Sign in</h1>
+<p class="<%= add_auth_class(:muted) %>">Choose an available sign-in method.</p>
+<% if @error %><p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p><% end %>
+<% if AddAuth.configuration.passwords_enabled %>
+<%= form_with url: "/sign-in/password", id: "add_auth-password-form", data: add_auth_challenge_form_data(:sign_in) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, autocomplete: "username webauthn", value: (params[:email_address] if params[:email_address].is_a?(String)), maxlength: 254, class: add_auth_class(:input) %>
+  </div>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :password, "Password" %>
+    <%= form.password_field :password, required: true, autocomplete: "current-password", class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :sign_in %>
+  <%= form.submit "Sign in with password", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<% end %>
+<% if AddAuth::Core::Intake.email_available?(AddAuth.configuration) %>
+<hr class="<%= add_auth_class(:divider) %>">
+<%= form_with url: "/sign-in/email", id: "add_auth-email-form", data: add_auth_challenge_form_data(:email_link) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email me a sign-in link", for: "link_email_address" %>
+    <%= form.email_field :email_address, id: "link_email_address", value: (params[:email_address] if params[:email_address].is_a?(String)), required: true, autocomplete: "email", maxlength: 254, class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :email_link %>
+  <%= form.submit "Send sign-in link", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+
+<% end %>
+
+<% if AddAuth.configuration.passkeys.enabled %>
+  <%= render "add_auth/passkeys/controls", mode: "get", options_url: "/passkeys/sign-in/options", finish_url: "/passkeys/sign-in", label: "Sign in with a passkey", action: :sign_in, conditional: true %>
+  <p><%= link_to "I can’t use my passkeys", "/recover" %></p>
+<% end %>

data/app/views/add_auth/sign_ins/_invalid_link.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Request a new link</h1>
+<p role="alert">This link cannot sign you in. It may have expired or already been used.</p>
+<%= link_to "Get a new sign-in link", "/sign-in", class: add_auth_class(:link) %>

data/app/views/add_auth/sign_ins/show.html.erb

@@ -0,0 +1 @@
+<%= render @page_partial %>

data/app/views/layouts/add_auth/authentication.html.erb

@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <title>Sign in</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="referrer" content="no-referrer">
+    <% turbo_exempts_page_from_cache %>
+    <% turbo_page_requires_reload if request.headers["Turbo-Frame"].present? %>
+    <%= yield :head %>
+    <%= csrf_meta_tags %>
+    <script src="/add_auth/boot.js" type="module" data-turbo-track="reload"></script>
+    <%= stylesheet_link_tag add_auth_stylesheet, skip_pipeline: true if add_auth_stylesheet %>
+  </head>
+  <body class="<%= add_auth_class(:body) %>">
+    <main class="<%= add_auth_class(:panel) %>" aria-labelledby="add_auth-title">
+      <div id="add_auth-content"><%= yield %></div>
+    </main>
+  </body>
+</html>