add_auth 0.2.1

data/lib/add_auth/rails/stores/delivery_state.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module Stores
+      module DeliveryState
+        def revoke(record:, at:)
+          record.update!(revoked_at: at, delivery_payload: nil)
+        end
+
+        def lease(record:, key:, until_time:)
+          record.update!(delivery_lease_key: key, delivery_lease_until: until_time)
+        end
+
+        def delivered(record:, at:)
+          record.update!(delivered_at: at, delivery_payload: nil, delivery_lease_key: nil, delivery_lease_until: nil)
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/stores/email_tokens.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/stores/account_lock"
+require "add_auth/rails/stores/delivery_state"
+
+module AddAuth
+  module Rails
+    module Stores
+      # Lock the account before reading token state, serializing issuance,
+      # consumption and revocation. All injected models must share a pool.
+      # Host finalizers may perform DB writes only, on this same connection.
+      class EmailTokens
+        include DeliveryState
+
+        def initialize(user_model:, token_model:, session_model:, identifier: :email_address)
+          @users, @tokens, @sessions = user_model, token_model, session_model
+          unless [@tokens, @sessions].all? { |model| model.connection_pool.equal?(@users.connection_pool) }
+            raise ArgumentError, "authentication models must share one connection pool"
+          end
+          unless @users.column_names.include?(identifier.to_s)
+            raise ArgumentError, "unknown identifier column"
+          end
+          @identifier = identifier
+        end
+
+        def with_user(identifier:)
+          with_account(@users.find_by(@identifier => identifier)) { |user| yield user }
+        end
+
+        def with_token(digest:, current_session: nil)
+          raise ArgumentError, "digest must be a nonempty string" unless digest.is_a?(String) && !digest.empty?
+
+          # A request may have inspected this token before another connection
+          # consumed it. Never authorize from Active Record's query cache.
+          @tokens.uncached do
+            locator = @tokens.find_by(digest: digest)
+            with_account(locator && @users.find_by(@users.primary_key => locator.user_id), additional_id: current_session&.user_id) do |user|
+              yield user, user && @tokens.find_by(digest: digest, user_id: user.id)
+            end
+          end
+        end
+
+        def replace_pending(user:, purpose: "sign_in", **attributes)
+          scope = attributes.slice(:session_id, :authentication_purpose)
+          @tokens.where(user_id: user.id, purpose: purpose, consumed_at: nil, revoked_at: nil, **scope)
+            .update_all(revoked_at: attributes.fetch(:created_at), delivery_payload: nil)
+          @tokens.create!(**attributes, user_id: user.id, purpose: purpose)
+        end
+
+        def session_for(user:, id:)
+          @sessions.uncached { @sessions.find_by(id: id, user_id: user.id) }
+        end
+
+        def consume(record:, at:)
+          record.update!(consumed_at: at, delivery_payload: nil)
+        end
+
+        # This capability owns creation; a model's previously_new_record? flag
+        # cannot establish which transaction created it. The writer expires when
+        # the callback exits and may create exactly one session for this account.
+        def finalize_session(user:)
+          transaction = @users.current_transaction
+          created = nil
+          active = true
+          writer = lambda do |**attributes|
+            unless active && transaction.open? && @users.current_transaction.equal?(transaction) && !created
+              raise AddAuth::Error, "session writer is no longer available"
+            end
+            created = @sessions.create!(**attributes.except(:user_id), user_id: user.id)
+          end
+          result = yield writer
+          unless created && result.equal?(created) && created.persisted? && created.user_id == user.id
+            raise AddAuth::Error, "finalizer must persist a session using the transaction writer"
+          end
+          result
+        ensure
+          active = false
+        end
+
+        def refresh_session(session) = session.reload
+
+        def issued?(request_id:) = @tokens.exists?(request_id: request_id)
+
+        private
+
+        def with_account(user, additional_id: nil)
+          AccountLock.new(@users).call(id: user&.id, additional_id: additional_id) { |account| yield account }
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/stores/maintenance.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module Stores
+      class Maintenance
+        def initialize(model:, kind:)
+          @model, @kind = model, kind
+        end
+
+        def purge_expired(before:, now:, limit:)
+          scope = @model.where("expires_at <= ?", before)
+          if @kind == :session
+            scope = scope.or(@model.where("revoked_at <= ?", before))
+          elsif @kind != :ceremony
+            scope = without_live_lease(scope, now)
+          end
+          bounded(scope, limit).delete_all
+        end
+
+        def erase_expired_payloads(now:, limit:)
+          scope = without_live_lease(@model.where("expires_at <= ?", now).where.not(delivery_payload: nil), now)
+          bounded(scope, limit).update_all(delivery_payload: nil)
+        end
+
+        def pending_ids(now:, limit:)
+          scope = @model.where(revoked_at: nil, delivered_at: nil).where.not(delivery_payload: nil)
+            .where("expires_at > ?", now)
+          without_live_lease(scope, now).order(:id).limit(limit).pluck(:id)
+        end
+
+        private
+
+        def without_live_lease(scope, now)
+          scope.where("delivery_lease_until IS NULL OR delivery_lease_until <= ?", now)
+        end
+
+        def bounded(scope, limit)
+          # Repeat the predicate after selection; a concurrent refresh/lease
+          # acquisition protects its row even if it appeared in this ID batch.
+          scope.where(id: scope.order(:id).limit(limit).pluck(:id))
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/stores/passkeys.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/stores/account_lock"
+
+module AddAuth
+  module Rails
+    module Stores
+      class Passkeys
+        def initialize(user_model:, session_model:, credential_model:, ceremony_model:, token_model:)
+          @users, @sessions, @credentials, @ceremonies = user_model, session_model, credential_model, ceremony_model
+          @tokens = token_model
+          unless [@sessions, @credentials, @ceremonies, @tokens].all? { |model| model.connection_pool.equal?(@users.connection_pool) }
+            raise ArgumentError, "authentication models must share one connection pool"
+          end
+          @lock = AccountLock.new(@users)
+        end
+
+        def with_user(id:, &block) = @lock.call(id: id, &block)
+        def credentials(user:) = @credentials.where(user_id: user.id, revoked_at: nil).order(:created_at).to_a
+        def credential(id:) = @credentials.find_by(external_id: id)
+        def update(record, **attributes) = record.update!(**attributes)
+        def create_ceremony(**attributes) = @ceremonies.create!(**attributes)
+
+        def with_ceremony(digest:, user_id:, replacing: nil)
+          @lock.call(id: user_id, additional_id: replacing&.user_id) do |user|
+            # Anonymous assertions for different accounts can share a challenge;
+            # locking only those different accounts would not prevent replay.
+            record = @ceremonies.lock.find_by(digest: digest) if user
+            yield user, record
+          end
+        end
+
+        def create_credential(user:, **attributes)
+          @credentials.transaction(requires_new: true) do
+            @credentials.create!(**attributes, user_id: user.id)
+          end
+        rescue ActiveRecord::RecordNotUnique
+          nil
+        end
+
+        def cancel(digest:)
+          @ceremonies.transaction do
+            if @ceremonies.connection.adapter_name == "SQLite"
+              pk = @ceremonies.connection.quote_column_name(@ceremonies.primary_key)
+              @ceremonies.where(digest: digest).update_all("#{pk} = #{pk}")
+            end
+            @ceremonies.uncached { yield @ceremonies.lock.find_by(digest: digest) }
+          end
+        end
+
+        def revoke_other_sessions(user:, except:, at:)
+          @sessions.where(user_id: user.id, revoked_at: nil).where.not(id: except.id).update_all(revoked_at: at)
+        end
+
+        def invalidate_proofs(user:, at:)
+          @tokens.where(user_id: user.id, consumed_at: nil, revoked_at: nil).update_all(revoked_at: at, delivery_payload: nil)
+          @ceremonies.where(user_id: user.id, consumed_at: nil).update_all(consumed_at: at)
+          @sessions.where(user_id: user.id).update_all(elevated_at: nil, elevation_version: nil, elevation_expires_at: nil)
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/stores/security_events.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/stores/delivery_state"
+
+module AddAuth
+  module Rails
+    module Stores
+      class SecurityEvents
+        include DeliveryState
+
+        def initialize(user_model:, event_model:)
+          @users, @events = user_model, event_model
+          raise ArgumentError, "authentication models must share one connection pool" unless @users.connection_pool.equal?(@events.connection_pool)
+        end
+
+        def append(user:, **attributes)
+          raise AddAuth::Error, "security notifications must join the account transaction" unless @users.current_transaction.open?
+          event = @events.create!(**attributes, user_id: user.id)
+          @users.current_transaction.after_commit do
+            job = ::AddAuth::SecurityNotificationJob.perform_later(event.id)
+            raise AddAuth::Error unless job
+          rescue
+            ActiveSupport::Notifications.instrument("notification_enqueue_failed.add_auth", event_id: event.id)
+          end
+          event
+        end
+
+        def with_token(digest:)
+          @events.transaction do
+            if @events.connection.adapter_name == "SQLite"
+              pk = @events.connection.quote_column_name(@events.primary_key)
+              @events.where(digest: digest).update_all("#{pk} = #{pk}")
+            end
+            @events.uncached { yield nil, @events.lock.find_by(digest: digest) }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/stores/sessions.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/stores/account_lock"
+
+module AddAuth
+  module Rails
+    module Stores
+      class Sessions
+        def initialize(user_model:, session_model:)
+          @users, @sessions = user_model, session_model
+          raise ArgumentError, "authentication models must share one connection pool" unless @users.connection_pool.equal?(@sessions.connection_pool)
+          @lock = AccountLock.new(@users)
+        end
+
+        def with_user(id:, replacing: nil, &block) = @lock.call(id: id, additional_id: replacing&.user_id, &block)
+
+        def with_identifier(identifier:, replacing: nil, &block)
+          with_user(id: @users.find_by(email_address: identifier)&.id, replacing: replacing, &block)
+        end
+
+        def with_session(digest: nil, id: nil)
+          @sessions.uncached do
+            criteria = digest ? {token_digest: digest} : {id: id}
+            locator = @sessions.find_by(criteria)
+            @lock.call(id: locator&.user_id) do |user|
+              yield user, user && @sessions.find_by(**criteria, user_id: user.id)
+            end
+          end
+        end
+
+        def create(user:, **attributes)
+          raise AddAuth::Error, "session finalization requires an account transaction" unless @users.connection.transaction_open?
+          @sessions.create!(**attributes, user_id: user.id)
+        end
+
+        def update(row, **attributes) = row.update!(**attributes)
+
+        # Query cutoffs come from Core; Core still authorizes every returned row.
+        def list_for_user(user_id:, before:, excluding:, limit:, now:, active_after:, legacy:)
+          scope = @sessions.where(user_id: user_id, revoked_at: nil)
+          scope = scope.where("id < ?", before) if before
+          scope = scope.where.not(id: excluding) if excluding
+          scope = scope.where("(expires_at IS NULL OR expires_at > ?) AND (last_seen_at IS NULL OR last_seen_at > ?)", now, active_after)
+          scope = scope.where.not(expires_at: nil).where.not(last_seen_at: nil) unless legacy
+          scope.order(id: :desc).limit(limit).to_a
+        end
+
+        def find_for_user(user_id:, session_id:) = @sessions.find_by(user_id: user_id, id: session_id)
+
+        def find_for_user_in_transaction(user_id:, session_id:)
+          raise AddAuth::Error, "session lookup requires an account transaction" unless @users.connection.transaction_open?
+          @sessions.uncached { @sessions.find_by(id: session_id, user_id: user_id) }
+        end
+
+        def revoke_all_in_transaction(user_id:, at:)
+          raise AddAuth::Error, "revocation requires an account transaction" unless @users.connection.transaction_open?
+          @sessions.where(user_id: user_id, revoked_at: nil).update_all(revoked_at: at, updated_at: at)
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/user_lifecycle.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module UserLifecycle
+      extend ActiveSupport::Concern
+
+      included do
+        after_update :add_auth_invalidate_proofs
+      end
+
+      private
+
+      def add_auth_invalidate_proofs
+        return unless Core::Intake.revoke_after_change?(saved_changes)
+        now = Time.current
+        if AddAuth.configuration.notifications.enabled
+          kind = saved_changes.key?("password_digest") ? :password_changed : :email_changed
+          Runtime.security_events.issue(user: self, kind: kind, at: now)
+          if saved_change_to_email_address? && email_address_before_last_save != email_address
+            Runtime.security_events.issue(user: self, kind: :email_changed, at: now, recipient: email_address_before_last_save)
+          end
+        end
+        if defined?(::AddAuthCeremony) && ::AddAuthCeremony.table_exists?
+          ::AddAuthCeremony.where(user_id: id, consumed_at: nil).update_all(consumed_at: now)
+        end
+        sessions.where(revoked_at: nil).update_all(revoked_at: now)
+        if defined?(::AddAuthSignInToken) && ::AddAuthSignInToken.table_exists?
+          ::AddAuthSignInToken.where(user_id: id, consumed_at: nil, revoked_at: nil)
+            .update_all(revoked_at: now, delivery_payload: nil)
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/result.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module AddAuth
+  # Every Core entry point returns one of these instead of raising for an
+  # authentication outcome (it still raises for programmer error) or
+  # returning a bare boolean. See docs/authentication-gem-plan.md section 2,
+  # "Everything returns a Result," for the rationale: a closed set of reason
+  # codes is something a host can exhaustively match/translate, and it can't
+  # accidentally leak *which* half of a credential check failed.
+  class Result
+    # Closed set. Adding a value here is a deliberate, documented decision --
+    # hosts are expected to `case`/`in` over this list.
+    REASONS = %i[
+      invalid_credentials unknown_identifier unconfirmed
+      locked disabled expired_token
+      consumed_token revoked_token challenge_rejected
+      challenge_unavailable rate_limited origin_mismatch
+      counter_regression elevation_required
+    ].freeze
+
+    attr_reader :user, :strategy, :credential, :reason, :session, :grant
+
+    def self.success(user:, strategy:, credential: nil, session: nil, grant: nil)
+      new(success: true, user:, strategy:, credential:, session:, grant:)
+    end
+
+    def self.failure(reason:)
+      raise ArgumentError, "unknown Result reason: #{reason.inspect}" unless REASONS.include?(reason)
+
+      new(success: false, reason:)
+    end
+
+    def success?
+      @success
+    end
+
+    def failure?
+      !success?
+    end
+
+    def inspect = "#<AddAuth::Result success=#{success?} strategy=#{strategy.inspect} reason=#{reason.inspect}>"
+
+    private
+
+    def initialize(success:, user: nil, strategy: nil, credential: nil, reason: nil, session: nil, grant: nil)
+      @success = success
+      @user = user
+      @strategy = strategy
+      @credential = credential
+      @reason = reason
+      @session, @grant = session, grant
+      freeze
+    end
+  end
+end

data/lib/add_auth/testing.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module AddAuth
+  module Testing
+    module_function
+
+    def delivered_link(mail, purpose: :sign_in)
+      path = {sign_in: "/sign-in/link", reauthentication: "/reauthenticate/link", recovery: "/recover/link"}.fetch(purpose)
+      urls = mail.body.decoded.scan(%r{https?://[^\s<>]+}).filter_map do |text|
+        uri = URI.parse(text)
+        uri if uri.path == path && URI.decode_www_form(uri.query.to_s).to_h["token"]
+      rescue URI::InvalidURIError, ArgumentError
+        nil
+      end
+      raise ArgumentError, "expected exactly one #{purpose} link" unless urls.length == 1
+      urls.first
+    end
+
+    def with_virtual_authenticator(driver, **options)
+      require "selenium-webdriver"
+      defaults = {protocol: :ctap2, transport: :internal, resident_key: true, user_verification: true, user_verified: true}
+      authenticator = driver.add_virtual_authenticator(Selenium::WebDriver::VirtualAuthenticatorOptions.new(**defaults, **options))
+      yield authenticator
+    ensure
+      authenticator.remove! if authenticator&.valid?
+    end
+  end
+end

data/lib/add_auth/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module AddAuth
+  VERSION = "0.2.1"
+end

data/lib/add_auth.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "add_auth/version"
+require "add_auth/result"
+require "add_auth/configuration"
+
+# Layer 1 (plain Ruby, no Rails dependency). See
+# docs/authentication-gem-plan.md section 2 in the workspace repo for the
+# two-layer architecture this module is built around: AddAuth::Core holds
+# every security decision and knows nothing about controllers, views, or the
+# session hash. AddAuth::Rails (loaded below, only inside a Rails app) is the
+# thin engine that wires Core into a host application and generates
+# ejectable, disposable UI on top of it.
+require "add_auth/core/browser_binding"
+require "add_auth/core/access_policy"
+require "add_auth/core/sessions"
+require "add_auth/core/step_up"
+require "add_auth/core/intake"
+require "add_auth/core/rate_limit"
+require "add_auth/core/delivery"
+require "add_auth/core/maintenance"
+require "add_auth/core/security_events"
+require "add_auth/core/strategies/email_link"
+require "add_auth/core/strategies/passkey"
+require "add_auth/core/challenge/base"
+require "add_auth/core/challenge/http"
+require "add_auth/core/challenge/null"
+require "add_auth/core/challenge/test"
+require "add_auth/core/challenge/turnstile"
+require "add_auth/core/challenge/recaptcha"
+require "add_auth/core/digest/base"
+require "add_auth/core/digest/hmac"
+
+module AddAuth
+  class Error < StandardError; end
+
+  class << self
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield configuration
+    end
+  end
+end
+
+if defined?(::Rails::Engine)
+  require "add_auth/rails/engine"
+  require "add_auth/rails/delivery_cipher"
+  require "add_auth/rails/stores/email_tokens"
+end

data/lib/generators/add_auth/challenge/challenge_generator.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module AddAuth
+  module Generators
+    # `bin/rails g add_auth:challenge turnstile` (or `recaptcha`) writes an
+    # opt-in initializer without touching the host's existing initializer.
+    class ChallengeGenerator < ::Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+      argument :provider, type: :string, required: true, banner: "turnstile|recaptcha"
+      class_option :version, type: :string, default: "v3", desc: "reCAPTCHA version (v2 or v3)"
+
+      def validate_provider
+        return if %w[turnstile recaptcha].include?(provider.to_s.downcase)
+
+        raise Thor::Error, "Choose a challenge provider: turnstile or recaptcha."
+      end
+
+      def validate_version
+        return if provider.to_s.downcase == "turnstile"
+        return if %w[v2 v3].include?(options[:version].to_s.downcase)
+
+        raise Thor::Error, "reCAPTCHA version must be v2 or v3."
+      end
+
+      def create_initializer
+        path = File.join(destination_root, "config/initializers/add_auth_challenge.rb")
+        if File.exist?(path)
+          say "Skipping #{path}; review the existing challenge configuration.", :yellow
+          return
+        end
+
+        empty_directory "config/initializers"
+        template "#{provider.to_s.downcase}.rb.tt", path
+        say "Challenge server verification configured for #{provider}. Review environment keys and allowed hostnames."
+      end
+
+      def add_route
+        path = File.join(destination_root, "config/routes.rb")
+        return unless File.file?(path)
+        return if File.read(path).include?("add_auth/challenge.js")
+
+        route 'get "add_auth/challenge.js", to: "add_auth/assets#challenge"'
+      end
+    end
+  end
+end

data/lib/generators/add_auth/challenge/templates/recaptcha.rb.tt

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+# Generated by add_auth:challenge. Set both keys before enabling this in a
+# deployed environment. v2 uses a checkbox; v3 additionally checks action and
+# score. The adapter always validates the token server-side.
+site_key = ENV["RECAPTCHA_SITE_KEY"]
+secret_key = ENV["RECAPTCHA_SECRET_KEY"]
+
+if site_key.to_s.empty? || secret_key.to_s.empty?
+  raise AddAuth::Error, "Configured captcha requires both provider keys in production" if Rails.env.production?
+  Rails.logger.warn("AddAuth reCAPTCHA is disabled: set RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY")
+else
+  if Rails.env.production? && ENV.fetch("RECAPTCHA_ALLOWED_HOSTNAMES", "").split(",").all? { |host| host.strip.empty? }
+    raise AddAuth::Error, "Configured captcha requires allowed hostnames in production"
+  end
+  AddAuth.configure do |config|
+    config.challenge = AddAuth::Core::Challenge::Recaptcha.new(
+      site_key: site_key,
+      secret_key: secret_key,
+      version: :<%= options[:version].to_s.downcase %>,
+      minimum_score: ENV.fetch("RECAPTCHA_MINIMUM_SCORE", "0.5"),
+      expected_action: ENV["RECAPTCHA_EXPECTED_ACTION"].presence,
+      allowed_hostnames: ENV.fetch("RECAPTCHA_ALLOWED_HOSTNAMES", "").split(",")
+    )
+    config.challenge_on = %i[sign_in email_link]
+    config.challenge_when_unavailable = :closed
+  end
+end

data/lib/generators/add_auth/challenge/templates/turnstile.rb.tt

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Generated by add_auth:challenge. Set both keys before enabling this in a
+# deployed environment. The adapter always validates the token server-side.
+site_key = ENV["TURNSTILE_SITE_KEY"]
+secret_key = ENV["TURNSTILE_SECRET_KEY"]
+
+if site_key.to_s.empty? || secret_key.to_s.empty?
+  raise AddAuth::Error, "Configured captcha requires both provider keys in production" if Rails.env.production?
+  Rails.logger.warn("AddAuth Turnstile is disabled: set TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY")
+else
+  if Rails.env.production? && ENV.fetch("TURNSTILE_ALLOWED_HOSTNAMES", "").split(",").all? { |host| host.strip.empty? }
+    raise AddAuth::Error, "Configured captcha requires allowed hostnames in production"
+  end
+  AddAuth.configure do |config|
+    config.challenge = AddAuth::Core::Challenge::Turnstile.new(
+      site_key: site_key,
+      secret_key: secret_key,
+      allowed_hostnames: ENV.fetch("TURNSTILE_ALLOWED_HOSTNAMES", "").split(",")
+    )
+    config.challenge_on = %i[sign_in email_link]
+    config.challenge_when_unavailable = :closed
+  end
+end

data/lib/generators/add_auth/controllers/controllers_generator.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "generators/add_auth/ejection"
+
+module AddAuth
+  module Generators
+    class ControllersGenerator < ::Rails::Generators::Base
+      include Ejection
+
+      def generate = eject(:controllers)
+    end
+  end
+end

data/lib/generators/add_auth/ejection.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/ejection"
+
+module AddAuth
+  module Generators
+    module Ejection
+      private
+
+      def eject(kind, only: "all")
+        Rails::Ejection.new(host_root: destination_root).install(kind: kind, only: only).each do |result|
+          say "#{result[:preserved] ? "Preserved" : "Created"} #{result[:path]}"
+        end
+        say "Run bin/rails add_auth:doctor after gem upgrades to review upstream changes."
+      end
+    end
+  end
+end