add_auth 0.2.2 → 0.3.0

data/lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt

@@ -0,0 +1,27 @@
+class CreateAddAuthMobileHandoffs < ActiveRecord::Migration[8.0]
+  def change
+    user_key = connection.columns(:users).find { |column| column.name == connection.primary_key(:users) }
+    raise "Unsupported authentication primary key" unless user_key && [:integer, :uuid].include?(user_key.type)
+    user_type = (user_key.type == :integer && user_key.limit == 8) ? :bigint : user_key.type
+    create_table :add_auth_mobile_handoffs do |t|
+      t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
+      t.string :external_digest, null: false
+      t.string :digest
+      t.string :client_id, limit: 64, null: false
+      t.string :callback, limit: 2048, null: false
+      t.string :state, limit: 128, null: false
+      t.string :challenge_digest, null: false
+      t.string :credential_id
+      t.string :credential_version
+      t.integer :policy_version
+      t.datetime :authenticated_at
+      t.datetime :issued_at, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.timestamps
+    end
+    add_index :add_auth_mobile_handoffs, :external_digest, unique: true
+    add_index :add_auth_mobile_handoffs, :digest, unique: true
+    add_index :add_auth_mobile_handoffs, :expires_at
+  end
+end

data/lib/generators/add_auth/mobile_sessions/templates/mobile.rb

@@ -0,0 +1,8 @@
+# Mobile sessions are optional and remain disabled after generating persistence.
+# Review the host/client timeout policy before enabling. These are example values.
+# AddAuth.configure do |config|
+#   config.mobile.lifetime = 30 * 86_400
+#   config.mobile.idle_timeout = 14 * 86_400
+#   config.mobile.clients = %w[android ios]
+#   config.mobile.enabled = true
+# end

data/lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt

@@ -1,7 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthSecurityEvents < ActiveRecord::Migration[8.0]
   def change
     create_table :add_auth_security_events do |t|
-      t.references :user, foreign_key: {on_delete: :nullify}
+      t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), foreign_key: {on_delete: :nullify}
       t.string :kind, null: false
       t.string :digest, null: false
       t.text :delivery_payload

data/lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt

@@ -1,5 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
   def change
+    user_key_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    session_key_type = AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true)
     # Rails 8.0 cannot reflect SQLite's FALSE literal emitted by Rails 8.1.
     # Keep the additive schema readable by both supported Rails lines.
     false_default = (connection.adapter_name == "SQLite") ? -> { "0" } : false
@@ -11,7 +15,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_credential_id, :string
     add_column :sessions, :authentication_uv, :boolean, default: false_default, null: false
     create_table :add_auth_credentials do |t|
-      t.references :user, null: false, foreign_key: {on_delete: :cascade}
+      t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :external_id, null: false
       t.text :public_key, null: false
       t.bigint :sign_count, default: 0, null: false
@@ -31,8 +35,8 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
       t.string :kind, null: false
       t.string :browser_digest, null: false
       t.string :configuration_digest, null: false
-      t.references :user, foreign_key: {on_delete: :cascade}
-      t.references :session, foreign_key: {on_delete: :cascade}
+      t.references :user, type: user_key_type, foreign_key: {on_delete: :cascade}
+      t.references :session, type: session_key_type, foreign_key: {on_delete: :cascade}
       t.string :session_digest
       t.string :authentication_purpose
       t.datetime :expires_at, null: false

data/lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt

@@ -1,8 +1,10 @@
+require "add_auth/rails/migration/key_type"
+
 class AddAddAuthReauthentication < ActiveRecord::Migration[8.0]
   def change
     add_column :sessions, :elevation_version, :string
     add_column :sessions, :elevation_expires_at, :datetime
-    add_reference :add_auth_sign_in_tokens, :session, foreign_key: {on_delete: :cascade}
+    add_reference :add_auth_sign_in_tokens, :session, type: AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true), foreign_key: {on_delete: :cascade}
     add_column :add_auth_sign_in_tokens, :session_digest, :string
     add_column :add_auth_sign_in_tokens, :authentication_purpose, :string
   end

data/lib/tasks/add_auth.rake

@@ -1,6 +1,20 @@
 # frozen_string_literal: true
 
 namespace :add_auth do
+  desc "Read-only Devise inventory in an isolated local test/development host"
+  task devise_preflight: :environment do
+    require "json"
+    require "add_auth/rails/migration/effective_inventory"
+    begin
+      report = AddAuth::Rails::Migration::EffectiveInventory.new.call
+      puts JSON.pretty_generate(report)
+      abort "Inventory is incomplete; resolve the reported bounds before migration." unless report.dig(:facts, :complete)
+    rescue
+      # Host exception text may contain query values or secret configuration.
+      abort "Effective inventory failed. Use an isolated local Devise host with one SQLite/PostgreSQL pool and no surrounding transaction."
+    end
+  end
+
   desc "Check installed AddAuth authentication, delivery and maintenance wiring"
   task doctor: :environment do
     require "add_auth/rails/doctor"
@@ -19,13 +33,16 @@ namespace :add_auth do
     require "add_auth/rails/stores/maintenance"
     models = {}
     models[:session] = ::Session if AddAuth.configuration.session.enabled && defined?(::Session)
+    models[:external_transaction] = ::AddAuthExternalTransaction if defined?(::AddAuthExternalTransaction)
+    models[:mobile_handoff] = ::AddAuthMobileHandoff if defined?(::AddAuthMobileHandoff)
     models[:ceremony] = ::AddAuthCeremony if defined?(::AddAuthCeremony)
     models[:email] = ::AddAuthSignInToken if defined?(::AddAuthSignInToken)
     models[:notification] = ::AddAuthSecurityEvent if defined?(::AddAuthSecurityEvent)
+    models[:account] = ::AddAuthAccountToken if defined?(::AddAuthAccountToken)
     stores = models.filter_map do |kind, model|
       [kind, AddAuth::Rails::Stores::Maintenance.new(model: model, kind: kind)] if model.table_exists?
     end.to_h
-    jobs = {email: AddAuth::EmailDeliveryJob, notification: AddAuth::SecurityNotificationJob}
+    jobs = {email: AddAuth::EmailDeliveryJob, notification: AddAuth::SecurityNotificationJob, account: AddAuth::AccountDeliveryJob}
     enqueue = lambda do |kind, id|
       raise AddAuth::Error, "maintenance enqueue failed" unless jobs.fetch(kind).perform_later(id)
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: add_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.0
 platform: ruby
 authors:
 - Taimoor Qureshi
@@ -203,10 +203,13 @@ description: |
   reauthentication and recovery. It adds hardened sessions, security mail and
   challenge providers, with shared Turbo/HTML pages and permitted no-JavaScript
   alternatives. It upgrades the generated User and Session models in place.
+  Optional account lifecycle, Devise migration, provider-library integration
+  and finite native sessions share the same account and session policies.
   Documentation: https://addauthgem.com.
 email:
 - taimoorq@gmail.com
-executables: []
+executables:
+- add_auth-preflight
 extensions: []
 extra_rdoc_files: []
 files:
@@ -216,24 +219,46 @@ files:
 - README.md
 - ROADMAP.md
 - SECURITY.md
+- app/controllers/add_auth/accounts_controller.rb
 - app/controllers/add_auth/assets_controller.rb
+- app/controllers/add_auth/external_identities_controller.rb
+- app/controllers/add_auth/mobile_sessions_controller.rb
 - app/controllers/add_auth/passkeys_controller.rb
+- app/controllers/add_auth/provider_sign_ins_controller.rb
 - app/controllers/add_auth/reauthentications_controller.rb
 - app/controllers/add_auth/recoveries_controller.rb
 - app/controllers/add_auth/sessions_controller.rb
 - app/controllers/add_auth/sign_ins_controller.rb
 - app/helpers/add_auth/sign_ins_helper.rb
 - app/javascript/controllers/.keep
+- app/jobs/add_auth/account_delivery_job.rb
+- app/jobs/add_auth/account_request_job.rb
 - app/jobs/add_auth/delivery_job.rb
 - app/jobs/add_auth/email_delivery_job.rb
 - app/jobs/add_auth/email_request_job.rb
 - app/jobs/add_auth/security_notification_job.rb
+- app/mailers/add_auth/account_mailer.rb
 - app/mailers/add_auth/security_mailer.rb
 - app/mailers/add_auth/sign_in_mailer.rb
 - app/models/concerns/.keep
 - app/views/.keep
+- app/views/add_auth/account_mailer/link.text.erb
+- app/views/add_auth/accounts/_check_email.html.erb
+- app/views/add_auth/accounts/_delete.html.erb
+- app/views/add_auth/accounts/_email.html.erb
+- app/views/add_auth/accounts/_invalid_proof.html.erb
+- app/views/add_auth/accounts/_password.html.erb
+- app/views/add_auth/accounts/_proof.html.erb
+- app/views/add_auth/accounts/_register.html.erb
+- app/views/add_auth/accounts/_request.html.erb
+- app/views/add_auth/accounts/_unavailable.html.erb
+- app/views/add_auth/external_identities/_index.html.erb
+- app/views/add_auth/external_identities/_unavailable.html.erb
 - app/views/add_auth/passkeys/_controls.html.erb
 - app/views/add_auth/passkeys/_list.html.erb
+- app/views/add_auth/provider_sign_ins/_enrollment.html.erb
+- app/views/add_auth/provider_sign_ins/_failure.html.erb
+- app/views/add_auth/provider_sign_ins/_prepare.html.erb
 - app/views/add_auth/reauthentications/_check_email.html.erb
 - app/views/add_auth/reauthentications/_confirmation.html.erb
 - app/views/add_auth/reauthentications/_different_browser.html.erb
@@ -253,11 +278,15 @@ files:
 - app/views/add_auth/sign_ins/_different_browser.html.erb
 - app/views/add_auth/sign_ins/_form.html.erb
 - app/views/add_auth/sign_ins/_invalid_link.html.erb
+- app/views/add_auth/sign_ins/_remember.html.erb
 - app/views/add_auth/sign_ins/show.html.erb
 - app/views/layouts/add_auth/authentication.html.erb
+- exe/add_auth-preflight
 - lib/add_auth.rb
 - lib/add_auth/configuration.rb
 - lib/add_auth/core/access_policy.rb
+- lib/add_auth/core/account_lifecycle.rb
+- lib/add_auth/core/account_policy.rb
 - lib/add_auth/core/browser_binding.rb
 - lib/add_auth/core/challenge/base.rb
 - lib/add_auth/core/challenge/http.rb
@@ -268,14 +297,30 @@ files:
 - lib/add_auth/core/delivery.rb
 - lib/add_auth/core/digest/base.rb
 - lib/add_auth/core/digest/hmac.rb
+- lib/add_auth/core/external_identities.rb
+- lib/add_auth/core/external_identities/evidence.rb
 - lib/add_auth/core/intake.rb
 - lib/add_auth/core/maintenance.rb
+- lib/add_auth/core/migration/account_adoption.rb
+- lib/add_auth/core/migration/readiness.rb
+- lib/add_auth/core/mobile_authentication.rb
+- lib/add_auth/core/mobile_handoffs.rb
+- lib/add_auth/core/mobile_profile.rb
+- lib/add_auth/core/mobile_response.rb
+- lib/add_auth/core/native_authentication.rb
+- lib/add_auth/core/passwords/bcrypt_support.rb
+- lib/add_auth/core/passwords/credential.rb
+- lib/add_auth/core/passwords/legacy_bcrypt.rb
+- lib/add_auth/core/passwords/lifecycle.rb
 - lib/add_auth/core/rate_limit.rb
+- lib/add_auth/core/remaining_factors.rb
 - lib/add_auth/core/security_events.rb
 - lib/add_auth/core/sessions.rb
 - lib/add_auth/core/step_up.rb
 - lib/add_auth/core/strategies/email_link.rb
 - lib/add_auth/core/strategies/passkey.rb
+- lib/add_auth/migration/static_inventory.rb
+- lib/add_auth/rails/account_password_entry.rb
 - lib/add_auth/rails/authentication.rb
 - lib/add_auth/rails/authentication_pages.rb
 - lib/add_auth/rails/delivery_cipher.rb
@@ -283,13 +328,33 @@ files:
 - lib/add_auth/rails/ejection.rb
 - lib/add_auth/rails/elevation.rb
 - lib/add_auth/rails/engine.rb
+- lib/add_auth/rails/migration/account_store.rb
+- lib/add_auth/rails/migration/effective_inventory.rb
+- lib/add_auth/rails/migration/key_type.rb
+- lib/add_auth/rails/migration/source_bridge.rb
+- lib/add_auth/rails/password_adoption.rb
 - lib/add_auth/rails/password_entry.rb
+- lib/add_auth/rails/provider_enrollment.rb
+- lib/add_auth/rails/provider_libraries/apple_form_post_correlation.rb
+- lib/add_auth/rails/provider_libraries/apple_jwks.rb
+- lib/add_auth/rails/provider_libraries/apple_native.rb
+- lib/add_auth/rails/provider_libraries/callback_route.rb
+- lib/add_auth/rails/provider_libraries/omniauth.rb
+- lib/add_auth/rails/provider_libraries/omniauth_correlation.rb
+- lib/add_auth/rails/provider_libraries/openid_connect.rb
+- lib/add_auth/rails/provider_libraries/request_protection.rb
 - lib/add_auth/rails/rate_limit_cache.rb
 - lib/add_auth/rails/runtime.rb
+- lib/add_auth/rails/stores/account_credentials.rb
 - lib/add_auth/rails/stores/account_lock.rb
+- lib/add_auth/rails/stores/account_tokens.rb
+- lib/add_auth/rails/stores/authority.rb
+- lib/add_auth/rails/stores/commit_dispatch.rb
 - lib/add_auth/rails/stores/delivery_state.rb
 - lib/add_auth/rails/stores/email_tokens.rb
+- lib/add_auth/rails/stores/external_identities.rb
 - lib/add_auth/rails/stores/maintenance.rb
+- lib/add_auth/rails/stores/mobile_handoffs.rb
 - lib/add_auth/rails/stores/passkeys.rb
 - lib/add_auth/rails/stores/security_events.rb
 - lib/add_auth/rails/stores/sessions.rb
@@ -297,10 +362,16 @@ files:
 - lib/add_auth/result.rb
 - lib/add_auth/testing.rb
 - lib/add_auth/version.rb
+- lib/generators/add_auth/accounts/accounts_generator.rb
+- lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt
+- lib/generators/add_auth/accounts/templates/add_auth_account_token.rb
+- lib/generators/add_auth/accounts/templates/add_auth_address_claim.rb
 - lib/generators/add_auth/challenge/challenge_generator.rb
 - lib/generators/add_auth/challenge/templates/recaptcha.rb.tt
 - lib/generators/add_auth/challenge/templates/turnstile.rb.tt
 - lib/generators/add_auth/controllers/controllers_generator.rb
+- lib/generators/add_auth/devise_accounts/devise_accounts_generator.rb
+- lib/generators/add_auth/devise_accounts/templates/prepare_add_auth_devise_accounts.rb.tt
 - lib/generators/add_auth/ejection.rb
 - lib/generators/add_auth/email_link/email_link_generator.rb
 - lib/generators/add_auth/email_link/templates/add_add_auth_email_binding.rb.tt
@@ -310,6 +381,13 @@ files:
 - lib/generators/add_auth/email_tokens/email_tokens_generator.rb
 - lib/generators/add_auth/email_tokens/templates/add_auth_sign_in_token.rb
 - lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt
+- lib/generators/add_auth/external_identities/external_identities_generator.rb
+- lib/generators/add_auth/external_identities/templates/add_add_auth_external_enrollment.rb.tt
+- lib/generators/add_auth/external_identities/templates/add_add_auth_external_identity_validity.rb.tt
+- lib/generators/add_auth/external_identities/templates/add_auth_external_identity.rb
+- lib/generators/add_auth/external_identities/templates/add_auth_external_transaction.rb
+- lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt
+- lib/generators/add_auth/external_identities/templates/providers.rb
 - lib/generators/add_auth/install/install_generator.rb
 - lib/generators/add_auth/install/templates/initializer.rb
 - lib/generators/add_auth/javascript/javascript_generator.rb
@@ -317,6 +395,11 @@ files:
 - lib/generators/add_auth/javascript/templates/codec.js
 - lib/generators/add_auth/javascript/templates/passkey.js
 - lib/generators/add_auth/mailer_views/mailer_views_generator.rb
+- lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb
+- lib/generators/add_auth/mobile_sessions/templates/add_add_auth_mobile_sessions.rb.tt
+- lib/generators/add_auth/mobile_sessions/templates/add_auth_mobile_handoff.rb
+- lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt
+- lib/generators/add_auth/mobile_sessions/templates/mobile.rb
 - lib/generators/add_auth/notifications/notifications_generator.rb
 - lib/generators/add_auth/notifications/templates/add_auth_security_event.rb
 - lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt