add_auth 0.2.2 → 0.3.0

data/app/controllers/add_auth/mobile_sessions_controller.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module AddAuth
+  # This transport never reads/writes browser cookies or invokes the host's
+  # browser Authentication concern. Hosts may map the same Core result to a
+  # versioned application DTO through Runtime.mobile_authentication.
+  class MobileSessionsController < ActionController::API
+    before_action :private_response
+    before_action :require_mobile_feature
+    before_action :require_native_feature, only: %i[apple_challenge apple apple_enroll]
+    before_action :require_mobile_session, except: %i[create exchange apple_challenge apple apple_enroll]
+    rescue_from AddAuth::Error, ActiveRecord::ActiveRecordError, with: :unavailable
+
+    def create
+      result = Rails::Runtime.mobile_authentication.password(identifier: params[:email_address], password: params[:password],
+        client_id: params[:client_id], ip: request.remote_ip, user_agent: request.user_agent, challenge_token: params[:challenge_token])
+      return failure(result.reason) unless result.success?
+      created(result)
+    end
+
+    def show
+      render json: {session_id: @mobile_session.id, user_id: @mobile_session.user_id, expires_at: @mobile_session.expires_at}
+    end
+
+    def exchange
+      admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :mobile_handoff)
+      return failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.mobile_handoffs.exchange(code: params[:code], state: params[:state],
+        code_verifier: params[:code_verifier], client_id: params[:client_id], ip: request.remote_ip, user_agent: request.user_agent)
+      return failure(result.reason) unless result.success?
+      created(result)
+    end
+
+    def apple_challenge
+      result = Rails::Runtime.native_apple.start(client_id: params[:client_id], ip: request.remote_ip, challenge_token: params[:challenge_token],
+        intent: params.fetch(:intent, "sign_in"))
+      return failure(result.reason) unless result.success?
+      challenge = result.credential
+      render json: {challenge_id: challenge.id, nonce: challenge.nonce, expires_at: challenge.expires_at}, status: :created
+    end
+
+    def apple
+      result = Rails::Runtime.native_apple.complete(client_id: params[:client_id], challenge_id: params[:challenge_id], nonce: params[:nonce],
+        identity_token: params[:identity_token], ip: request.remote_ip, user_agent: request.user_agent)
+      return failure(result.reason) unless result.success?
+      created(result)
+    end
+
+    def apple_enroll
+      result = Rails::Runtime.native_apple.enroll(client_id: params[:client_id], challenge_id: params[:challenge_id], nonce: params[:nonce],
+        identity_token: params[:identity_token], ip: request.remote_ip, identifier: params[:email_address])
+      return failure(result.reason) unless result.success?
+      render json: {status: "confirmation_required"}, status: :accepted
+    end
+
+    def index
+      page = Rails::Runtime.sessions.list_page(user: @mobile_user, current_session_id: @mobile_session.id, before: params[:before])
+      render json: {sessions: page.entries.map { |entry|
+        {id: entry.id, current: entry.current, transport: entry.transport, client_id: entry.client_id,
+         authenticated_with: entry.authenticated_with, last_seen_at: entry.last_seen_at, expires_at: entry.expires_at}
+      }, next_cursor: page.next_cursor}
+    end
+
+    def destroy
+      Rails::Runtime.sessions.revoke(session: @mobile_session)
+      head :no_content
+    end
+
+    def revoke
+      revoked = Rails::Runtime.sessions.revoke_one(user: @mobile_user, session: @mobile_session, session_id: params[:id])
+      head(revoked ? :no_content : :not_found)
+    end
+
+    def revoke_all
+      result = Rails::Runtime.revoke_all(user: @mobile_user, session: @mobile_session,
+        password: params[:password], ip: request.remote_ip, challenge_token: params[:challenge_token])
+      result.success? ? head(:no_content) : failure(result.reason)
+    end
+
+    private
+
+    def created(result)
+      render json: {token: result.grant.bearer, token_type: "Bearer", expires_at: result.session.expires_at,
+                    session_id: result.session.id, user_id: result.user.id}, status: :created
+    end
+
+    def require_mobile_session
+      require "add_auth/core/mobile_authentication"
+      bearer = Core::MobileAuthentication.bearer(request.authorization)
+      grant = Rails::Runtime.sessions.resume_mobile(bearer: bearer)
+      return failure(:invalid_credentials) unless grant
+      @mobile_session = grant.session
+      @mobile_user = grant.session.user
+    end
+
+    def require_mobile_feature
+      head :not_found unless Rails::Runtime.config.mobile.enabled
+    end
+
+    def require_native_feature
+      return unavailable unless Rails::Runtime.config.mobile.apple_providers.is_a?(Hash)
+      head :not_found if Rails::Runtime.config.mobile.apple_providers.empty?
+    end
+
+    def private_response
+      response.set_header("Cache-Control", "no-store")
+      response.set_header("Referrer-Policy", "no-referrer")
+      head :upgrade_required if ::Rails.env.production? && !request.ssl?
+    end
+
+    def failure(reason)
+      status = Core::MobileResponse.status(reason)
+      response.set_header("Retry-After", "300") if [429, 503].include?(status)
+      response.set_header("WWW-Authenticate", "Bearer") if status == 401
+      render json: {error: reason}, status: status
+    end
+
+    def unavailable = failure(:challenge_unavailable)
+  end
+end

data/app/controllers/add_auth/provider_sign_ins_controller.rb

@@ -0,0 +1,248 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/provider_libraries/apple_form_post_correlation"
+require "add_auth/rails/provider_libraries/omniauth"
+require "add_auth/rails/provider_libraries/omniauth_correlation"
+require "add_auth/rails/provider_libraries/request_protection"
+
+module AddAuth
+  # The protocol library has already verified the callback before this
+  # controller sees it. This controller only starts/consumes a Core
+  # transaction and maps its typed result to the normal Rails session/UI.
+  class ProviderSignInsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    before_action :private_response
+    before_action :load_provider
+    before_action :require_add_auth_authentication, unless: :anonymous_or_callback?
+    protect_from_forgery with: :exception, except: :callback
+    helper AddAuth::SignInsHelper
+    layout "add_auth/authentication"
+    rescue_from AddAuth::Error, with: :provider_unavailable
+
+    # This deliberately renders an ordinary confirmation form instead of
+    # redirecting to /auth/:provider: OmniAuth 2 accepts a CSRF-protected POST,
+    # and a 303 would turn that navigation into an unsafe GET. It is equally
+    # usable with Turbo, inside a frame, and with JavaScript disabled.
+    def enrollment
+      return head :not_found unless Rails::Runtime.config.lifecycle.enabled
+      page("enrollment")
+    end
+
+    def prepare
+      return head :not_found if mobile? && !Rails::Runtime.config.mobile.enabled
+      if enrollment?
+        return head :not_found unless Rails::Runtime.config.lifecycle.enabled
+        @enrollment_identifier = Rails::Runtime.intake.call(identifier: params[:email_address], ip: request.remote_ip,
+          action: :register, challenge_token: challenge_token)
+        return provider_intake_failure(@enrollment_identifier) if @enrollment_identifier.is_a?(Symbol)
+      else
+        admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: (params[:flow].to_s == "reauthenticate") ? :reauthenticate : :provider, challenge_token: challenge_token)
+        return provider_intake_failure(admitted) if admitted.is_a?(Symbol)
+      end
+      if params[:flow].to_s == "link"
+        elevation = Rails::Runtime.sessions.with_elevation(user: Current.user, session: Current.session,
+          purpose: Core::ExternalIdentities::LINK, policy: Rails::Runtime.step_up_policy)
+        return redirect_to "/reauthenticate?purpose=link_external_identity", status: :see_other unless elevation.success?
+      end
+      pending = service.begin_transaction(configuration_id: @provider.configuration.id,
+        browser_secret: browser_secret, **transaction_subject)
+      return provider_failure(pending.reason) unless pending.success?
+
+      if mobile?
+        accepted = Rails::Runtime.mobile_handoffs.begin_transaction(pending: pending.credential,
+          client_id: params[:client_id], callback: params[:callback], state: params[:state],
+          code_challenge: params[:code_challenge], code_challenge_method: params[:code_challenge_method])
+        unless accepted.success?
+          service.cancel(transaction: pending.credential.id, browser_secret: browser_secret)
+          return provider_failure(accepted.reason)
+        end
+      end
+
+      if enrollment? && !Rails::Runtime.provider_enrollment.write(pending: pending.credential,
+        identifier: @enrollment_identifier, profile: registration_profile)
+        service.cancel(transaction: pending.credential.id, browser_secret: browser_secret)
+        return provider_failure(:invalid_credentials)
+      end
+      remember_correlation!(pending.credential)
+      @provider_path = "/auth/#{@provider.middleware_name}"
+      @omniauth_csrf_parameter = Rails::ProviderLibraries::RequestProtection.parameter
+      @omniauth_csrf_token = Rails::ProviderLibraries::RequestProtection.token(session: request.env.fetch("rack.session"),
+        rails_token: -> { form_authenticity_token })
+      @heading = heading_for(pending.credential.purpose)
+      # This token-free URL posts to the host's existing OAuth middleware.
+      # Preserve its Rails origin check without sending a referrer off-site.
+      response.set_header("Referrer-Policy", "same-origin")
+      page("prepare")
+    end
+
+    # OmniAuth performs callback state/nonce/code validation. The correlation
+    # middleware has attached the opaque Core transaction only after its
+    # state check succeeds; no raw params, profile attributes, or tokens are
+    # accepted here. Apple's signed callback cookie supplies that same opaque
+    # data when its form_post cannot send the normal SameSite=Lax session.
+    def callback
+      correlation = request.env[correlation_env_key]
+      return provider_failure(:invalid_credentials) unless valid_correlation?(correlation)
+      return provider_failure(:invalid_credentials) unless correlation.fetch("configuration_id") == @provider.configuration.id
+
+      pending = service.pending(transaction: correlation.fetch("transaction"), browser_secret: correlation.fetch("browser_secret"))
+      return provider_failure(:invalid_credentials) unless pending && pending.configuration.equal?(@provider.configuration) &&
+        pending.purpose.to_s == correlation.fetch("purpose")
+
+      callback = Rails::ProviderLibraries::OmniAuth::CallbackResult.capture(env: request.env, provider: @provider.middleware_name)
+      evidence = pending.configuration.verify(server_result: callback, transaction: pending)
+      return provider_failure(:invalid_credentials) unless evidence
+
+      case pending.purpose
+      when Core::ExternalIdentities::MOBILE then finish_mobile(evidence)
+      when Core::ExternalIdentities::ENROLL then finish_enrollment(pending, evidence)
+      when :sign_in then finish_sign_in(evidence)
+      when Core::ExternalIdentities::LINK then finish_link(pending, evidence)
+      else finish_reauthentication(pending, evidence)
+      end
+    ensure
+      Rails::Runtime.provider_enrollment.erase(pending: pending) if pending&.purpose == Core::ExternalIdentities::ENROLL
+    end
+
+    private
+
+    def service = Rails::Runtime.external_identities
+
+    def load_provider
+      return head :not_found unless Rails::Runtime.config.external_identities.enabled
+
+      @provider = Rails::Runtime.config.external_identities.providers.find { |item| item.middleware_name == params[:provider].to_s }
+      head :not_found unless @provider
+    end
+
+    def sign_in? = params[:flow].to_s == "sign_in"
+    def mobile? = params[:flow].to_s == "mobile"
+
+    def enrollment? = params[:flow].to_s == "enroll"
+    def anonymous_or_callback? = sign_in? || enrollment? || mobile? || action_name == "callback"
+    def registration_profile = {}
+
+    def transaction_subject
+      return {purpose: Core::ExternalIdentities::MOBILE} if mobile?
+      return {purpose: Core::ExternalIdentities::ENROLL} if enrollment?
+      return {purpose: :sign_in} if sign_in?
+      return {user: Current.user, session: Current.session, purpose: Core::ExternalIdentities::LINK} if params[:flow].to_s == "link"
+
+      {user: Current.user, session: Current.session, purpose: params[:purpose].to_s}
+    end
+
+    def browser_secret
+      session[:add_auth_browser] ||= Rails::Runtime.browser_binding.generate
+    end
+
+    def remember_correlation!(pending)
+      if @provider.apple_form_post?
+        Rails::ProviderLibraries::AppleFormPostCorrelation.remember!(session: session, transaction: pending.id,
+          browser_secret: browser_secret, configuration_id: @provider.configuration.id, purpose: pending.purpose, remember: remember?)
+      else
+        Rails::ProviderLibraries::OmniAuthCorrelation.remember!(session: session, provider: @provider.middleware_name,
+          transaction: pending.id, browser_secret: browser_secret, configuration_id: @provider.configuration.id, purpose: pending.purpose, remember: remember?)
+      end
+    end
+
+    def correlation_env_key
+      @provider.apple_form_post? ? "add_auth.apple_correlation" : Rails::ProviderLibraries::OmniAuthCorrelation::ENV_KEY
+    end
+
+    def valid_correlation?(value)
+      value.is_a?(Hash) && %w[transaction browser_secret configuration_id purpose].all? do |key|
+        value[key].is_a?(String) && value[key].valid_encoding? && value[key].bytesize.between?(1, 2048)
+      end
+    end
+
+    def finish_enrollment(pending, evidence)
+      intake = Rails::Runtime.provider_enrollment.read(pending: pending)
+      return provider_failure(:invalid_credentials) unless intake
+      result = Rails::Runtime.accounts.register_external(evidence: evidence, **intake)
+      return provider_failure(result.reason) unless result.success?
+      redirect_to "/account/check-email", status: :see_other
+    end
+
+    def provider_intake_failure(reason)
+      status = {rate_limited: :too_many_requests, challenge_unavailable: :service_unavailable}.fetch(reason, :unprocessable_entity)
+      @error = "This request could not be verified. Please try again shortly."
+      response.set_header("Retry-After", "300") if %i[rate_limited challenge_unavailable].include?(reason)
+      page("failure", status: status)
+    end
+
+    def finish_sign_in(evidence)
+      result = service.sign_in(evidence: evidence, replacing: add_auth_replacement_session,
+        **add_auth_session_hints.merge(remember: correlation_remember?))
+      return provider_failure(result.reason) unless result.success?
+
+      destination = after_authentication_url
+      add_auth_accept(result.grant)
+      redirect_to destination, status: :see_other
+    end
+
+    def finish_mobile(evidence)
+      result = service.mobile_handoff(evidence: evidence, handoffs: Rails::Runtime.mobile_handoffs)
+      return provider_failure(result.reason) unless result.success?
+      handoff = result.credential
+      redirect_to "#{handoff.callback}?#{URI.encode_www_form(code: handoff.code, state: handoff.state)}", status: :see_other, allow_other_host: true
+    end
+
+    def finish_link(pending, evidence)
+      account, current = correlated_session(pending)
+      return provider_failure(:elevation_required) unless account && current
+
+      elevation = Rails::Runtime.sessions.with_elevation(user: account, session: current,
+        purpose: Core::ExternalIdentities::LINK, policy: Rails::Runtime.step_up_policy)
+      result = service.link(user: account, session: current, evidence: evidence, grant: elevation.credential)
+      return provider_failure(result.reason) unless result.success?
+
+      redirect_to "/account/external-identities", status: :see_other
+    end
+
+    def finish_reauthentication(pending, evidence)
+      account, current = correlated_session(pending)
+      return provider_failure(:elevation_required) unless account && current
+
+      result = service.reauthenticate(user: account, session: current, evidence: evidence)
+      return provider_failure(result.reason) unless result.success?
+
+      grant = Rails::Runtime.sessions.rotate_for_step_up(user: account, session: current, grant: result.credential)
+      return provider_failure(:elevation_required) unless grant
+
+      add_auth_accept(grant)
+      redirect_to Rails::Runtime.step_up_policy.return_to(pending.purpose), status: :see_other
+    end
+
+    # A form_post callback can correctly correlate an authenticated transaction
+    # while lacking the normal app cookie. Rehydrate only the exact session row
+    # recorded by Core; Core rechecks that row's digest and policy version under
+    # lock before link/reauthentication can mutate authority.
+    def correlated_session(pending)
+      account = ::User.find_by(id: pending.user_id)
+      current = account && ::Session.find_by(id: pending.session_id, user_id: account.id, token_digest: pending.session_digest)
+      [account, current]
+    end
+
+    def provider_failure(_reason)
+      @error = "We could not verify this provider sign-in. Please try again."
+      page("failure", status: :unprocessable_entity)
+    end
+
+    def provider_unavailable
+      @error = "Provider sign-in is temporarily unavailable. Please try again shortly."
+      page("failure", status: :service_unavailable)
+    end
+
+    def heading_for(purpose)
+      [:sign_in, Core::ExternalIdentities::ENROLL, Core::ExternalIdentities::MOBILE].include?(purpose) ? "Continue to #{@provider.label}" : "Confirm with #{@provider.label}"
+    end
+
+    def correlation_remember? = request.env[correlation_env_key].fetch("remember") == true
+
+    def remember? = sign_in? && params[:remember].to_s == "1"
+
+    def authentication_partial(partial) = "add_auth/provider_sign_ins/#{partial}"
+  end
+end

data/app/helpers/add_auth/sign_ins_helper.rb

@@ -14,6 +14,7 @@ module AddAuth
 
     def add_auth_challenge_form_data(action)
       data = {turbo_frame: "_top"}
+      data[:turbo] = false unless AddAuth.configuration.turbo_enabled
       return data unless AddAuth.configuration.challenge_on.include?(action)
       provider = AddAuth.configuration.challenge
       return data unless provider.site_key
@@ -23,7 +24,7 @@ module AddAuth
       else return data
       end
       data.merge(controller: "add-auth-challenge",
-        action: "submit->add-auth-challenge#submit add_auth:proof-used->add-auth-challenge#reset turbo:submit-end->add-auth-challenge#reset turbo:before-cache@document->add-auth-challenge#beforeCache",
+        action: "submit->add-auth-challenge#submit add_auth:proof-used->add-auth-challenge#reset turbo:submit-end->add-auth-challenge#reset turbo:before-cache@document->add-auth-challenge#beforeCache pagehide@window->add-auth-challenge#beforeCache pageshow@window->add-auth-challenge#restore",
         add_auth_challenge_provider_value: kind, add_auth_challenge_site_key_value: provider.site_key,
         add_auth_challenge_action_value: (provider.respond_to?(:expected_action) && provider.expected_action) || action,
         add_auth_challenge_script_url_value: provider.script_url)

data/app/jobs/add_auth/account_delivery_job.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountDeliveryJob < DeliveryJob
+    def perform(id)
+      record = ::AddAuthAccountToken.find_by(id: id)
+      return unless record
+      deliver(service: Rails::Runtime.accounts, record: record, mailer: AccountMailer) do |delivery|
+        AccountMailer.link(recipient: delivery.fetch(:recipient), purpose: delivery.fetch(:purpose),
+          url: Rails::Runtime.account_proof_url(delivery.fetch(:token), purpose: delivery.fetch(:purpose)))
+      end
+    end
+  end
+end

data/app/jobs/add_auth/account_request_job.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountRequestJob < ActiveJob::Base
+    self.log_arguments = false
+    retry_on StandardError, wait: :polynomially_longer, attempts: 8
+
+    def perform(encrypted_identifier)
+      payload = Rails::Runtime.decrypt_intake(encrypted_identifier)
+      if payload.is_a?(Hash)
+        Rails::Runtime.accounts.issue(identifier: payload["identifier"], purpose: payload["purpose"], request_id: job_id)
+      end
+      record = ::AddAuthAccountToken.find_by(request_id: job_id)
+      AccountDeliveryJob.perform_later(record.id) if record
+    end
+  end
+end

data/app/mailers/add_auth/account_mailer.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountMailer < SignInMailer
+    def link(recipient:, url:, purpose:)
+      @instruction = {"confirm" => "Confirm your email address", "reset_password" => "Choose a new password", "unlock" => "Unlock your account"}.fetch(purpose)
+      @url = url
+      mail(to: recipient, from: Rails::Runtime.config.mail_from, subject: @instruction,
+        content_type: "text/plain").extend(SignInMailer::DeliveryReceipt)
+    end
+  end
+end

data/app/views/add_auth/account_mailer/link.text.erb

@@ -0,0 +1,7 @@
+<%= @instruction %>
+
+Open this link, then use the button on the page to confirm your request:
+<%= @url %>
+
+This link expires in <%= AddAuth.configuration.lifecycle.proof_lifetime.to_i / 60 %> minutes and can be used once.
+If you did not request this message, you can ignore it.

data/app/views/add_auth/accounts/_check_email.html.erb

@@ -0,0 +1,5 @@
+<% content_for :title, "Check your email" %>
+<h1 id="add_auth-title">Check your email</h1>
+<p role="status">If this request is available for your account, we’ll send a link with the next step.</p>
+<p class="<%= add_auth_class(:muted) %>">Check your spam folder too. Only the latest link for this request will work.</p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_delete.html.erb

@@ -0,0 +1,6 @@
+<% content_for :title, "Delete your account" %>
+<h1 id="add_auth-title">Delete your account</h1>
+<p>Your account will be deleted and all sessions signed out. Verify it’s you, then return here to confirm.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= button_to "Delete my account", "/account", method: :delete, class: add_auth_class(:button), form: {data: {turbo_frame: "_top"}} %>
+<p><%= link_to "Keep my account", "/sessions" %></p>

data/app/views/add_auth/accounts/_email.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Change your email" %>
+<h1 id="add_auth-title">Change your email</h1>
+<p class="<%= add_auth_class(:muted) %>">Your current email stays active until you confirm the new address. Confirmation signs out your existing sessions.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/email", data: {turbo_frame: "_top"} do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "New email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", value: (params[:email_address] if params[:email_address].is_a?(String)), class: add_auth_class(:input) %>
+  </div>
+  <%= form.submit "Send confirmation link", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Back to your sessions", "/sessions" %></p>

data/app/views/add_auth/accounts/_invalid_proof.html.erb

@@ -0,0 +1,5 @@
+<% content_for :title, "Request a new link" %>
+<h1 id="add_auth-title">Request a new link</h1>
+<p>This link is unavailable, expired, or already used. Request a new link to finish your account update.</p>
+<p><%= link_to "Request another link", "/account/requests/#{@purpose}" %></p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_password.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Change your password" %>
+<h1 id="add_auth-title">Change your password</h1>
+<p class="<%= add_auth_class(:muted) %>">Verify it’s you before changing your password. This signs out your existing sessions.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/password", data: {turbo_frame: "_top"} do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :password, "New password" %>
+    <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
+  </div>
+  <%= form.submit "Change password", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Back to your sessions", "/sessions" %></p>

data/app/views/add_auth/accounts/_proof.html.erb

@@ -0,0 +1,16 @@
+<% title = {"confirm" => "Confirm this email address", "reset_password" => "Choose a new password", "unlock" => "Unlock this account"}.fetch(@purpose) %>
+<% content_for :title, title %>
+<h1 id="add_auth-title"><%= title %></h1>
+<p class="<%= add_auth_class(:muted) %>">Use the button below to complete your request. You’ll sign in afterward.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/proofs/#{@purpose}", data: {turbo_frame: "_top"} do |form| %>
+  <%= form.hidden_field :token, value: (params[:token] if params[:token].is_a?(String)) %>
+  <% if @purpose == "reset_password" %>
+    <div class="<%= add_auth_class(:field) %>">
+      <%= form.label :password, "New password" %>
+      <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
+    </div>
+  <% end %>
+  <%= form.submit title, class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_register.html.erb

@@ -0,0 +1,17 @@
+<% content_for :title, "Create an account" %>
+<h1 id="add_auth-title">Create an account</h1>
+<p class="<%= add_auth_class(:muted) %>">We’ll email you a link to confirm your address before you sign in.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/sign-up", data: add_auth_challenge_form_data(:register) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", value: (params[:email_address] if params[:email_address].is_a?(String)), class: add_auth_class(:input) %>
+  </div>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :password, "New password" %>
+    <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :register %>
+  <%= form.submit "Create account", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Already have an account? Sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_request.html.erb

@@ -0,0 +1,14 @@
+<% title = {"confirm" => "Confirm your email", "reset_password" => "Reset your password", "unlock" => "Unlock your account"}.fetch(@purpose) %>
+<% content_for :title, title %>
+<h1 id="add_auth-title"><%= title %></h1>
+<p class="<%= add_auth_class(:muted) %>">Enter your account email address to request a secure link.</p>
+<% if @error %><p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p><% end %>
+<%= form_with url: "/account/requests/#{@purpose}", data: add_auth_challenge_form_data(:account_request) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", value: (params[:email_address] if params[:email_address].is_a?(String)), class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :account_request %>
+  <%= form.submit "Send account link", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/accounts/_unavailable.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Try your request again</h1>
+<p role="alert" class="<%= add_auth_class(:notice) %>"><%= @error %></p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/external_identities/_index.html.erb

@@ -0,0 +1,22 @@
+<h1 id="add_auth-title">External sign-in methods</h1>
+<% if @error %><p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p><% end %>
+<p>Add another way to sign in. You’ll verify your account before linking or removing a provider.</p>
+<% @providers.each do |provider| %>
+  <%= form_with url: "/account/external-identities/providers/#{provider.middleware_name}", method: :post, data: add_auth_challenge_form_data(:provider).merge(turbo: false) do |form| %>
+    <%= add_auth_challenge_tag :provider, id: "link_#{provider.middleware_name}" %>
+    <%= form.submit "Link #{provider.label}", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+  <% end %>
+<% end %>
+<% @identities.each do |identity| %>
+  <% provider = @providers.find { |item| item.configuration.id == identity.provider_id } %>
+  <section id="external_identity_<%= identity.id %>">
+    <h2><%= provider&.label || "External provider" %></h2>
+    <p>Linked <%= identity.linked_at.strftime("%Y-%m-%d") %>.</p>
+    <details>
+      <summary>Remove this sign-in method</summary>
+      <p>Keep another usable sign-in method before removing this one.</p>
+      <%= button_to "Confirm removal", "/account/external-identities/#{identity.id}", method: :delete, form: {data: {turbo: false}} %>
+    </details>
+  </section>
+<% end %>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/external_identities/_unavailable.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Try again shortly</h1>
+<p role="alert"><%= @error %></p>
+<p><%= link_to "Back to sign in", "/sign-in" %></p>

data/app/views/add_auth/passkeys/_controls.html.erb

@@ -1,15 +1,17 @@
 <div data-controller="add-auth-passkey"
+  data-add-auth-passkey-turbo-value="<%= AddAuth.configuration.turbo_enabled %>"
   data-add-auth-passkey-options-url-value="<%= options_url %>"
   data-add-auth-passkey-finish-url-value="<%= finish_url %>"
   data-add-auth-passkey-mode-value="<%= mode %>"
   data-add-auth-passkey-purpose-value="<%= local_assigns[:purpose] %>"
   data-add-auth-passkey-conditional-value="<%= local_assigns.fetch(:conditional, false) && !AddAuth.configuration.challenge_on.include?(action) %>"
   data-add-auth-passkey-csrf-value="<%= form_authenticity_token %>"
-  data-action="turbo:before-cache@document->add-auth-passkey#beforeCache submit@document->add-auth-passkey#otherSubmission">
+  data-action="turbo:before-cache@document->add-auth-passkey#beforeCache pagehide@window->add-auth-passkey#beforeCache pageshow@window->add-auth-passkey#restore submit@document->add-auth-passkey#otherSubmission">
   <p data-add-auth-passkey-target="unavailable">Passkeys need JavaScript and a compatible browser or device. Use another method allowed by your account policy if available.</p>
   <%= form_with url: options_url, data: add_auth_challenge_form_data(action).merge(add_auth_passkey_target: "form", action: [add_auth_challenge_form_data(action)[:action], "submit->add-auth-passkey#submit"].compact.join(" ")) do |form| %>
     <%= add_auth_challenge_tag action, id: "passkey_#{action}" %>
     <div hidden data-add-auth-passkey-target="controls">
+      <%= render "add_auth/sign_ins/remember", form: form, id: "passkey" if action == :sign_in %>
       <%= form.submit label, class: add_auth_class(:button), data: {add_auth_challenge_target: "submit", add_auth_passkey_target: "button"} %>
     </div>
   <% end %>

data/app/views/add_auth/provider_sign_ins/_enrollment.html.erb

@@ -0,0 +1,12 @@
+<% content_for :title, "Create an account" %>
+<h1 id="add_auth-title">Create an account with <%= @provider.label %></h1>
+<p>Enter your email, then continue to your provider. We’ll email you a separate confirmation link before you can sign in.</p>
+<%= form_with url: "/account/sign-up/providers/#{@provider.middleware_name}", method: :post, data: add_auth_challenge_form_data(:register).merge(turbo: false) do |form| %>
+  <div class="<%= add_auth_class(:field) %>">
+    <%= form.label :email_address, "Email address" %>
+    <%= form.email_field :email_address, required: true, maxlength: 254, autocomplete: "email", class: add_auth_class(:input) %>
+  </div>
+  <%= add_auth_challenge_tag :register %>
+  <%= form.submit "Continue with #{@provider.label}", class: add_auth_class(:button), data: {add_auth_challenge_target: "submit"} %>
+<% end %>
+<p><%= link_to "Already have an account? Sign in", "/sign-in" %></p>

data/app/views/add_auth/provider_sign_ins/_failure.html.erb

@@ -0,0 +1,3 @@
+<h1 id="add_auth-title">Provider sign-in could not be completed</h1>
+<p class="<%= add_auth_class(:notice) %>" role="alert"><%= @error %></p>
+<p><%= link_to "Return to sign in", "/sign-in" %></p>

data/app/views/add_auth/provider_sign_ins/_prepare.html.erb

@@ -0,0 +1,7 @@
+<h1 id="add_auth-title"><%= @heading %></h1>
+<p class="<%= add_auth_class(:muted) %>">You will continue to <%= @provider.label %> to verify this request.</p>
+<%= form_with url: @provider_path, method: :post, authenticity_token: false, data: {turbo: false} do |form| %>
+  <%= hidden_field_tag @omniauth_csrf_parameter, @omniauth_csrf_token %>
+  <%= form.submit "Continue with #{@provider.label}", class: add_auth_class(:button) %>
+<% end %>
+<p><%= link_to "Cancel", "/sign-in" %></p>