add_auth 0.2.2 → 0.3.0

data/lib/add_auth/core/mobile_profile.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module AddAuth
+  module Core
+    # Host-selected finite API sessions. Client identifiers select configuration,
+    # never prove application identity or authorize an account.
+    class MobileProfile
+      PATTERN = /\Aam1:[A-Za-z0-9_-]{43}\z/
+      attr_reader :lifetime, :idle_timeout, :clients
+
+      def initialize(lifetime:, idle_timeout:, clients:, callbacks: {})
+        unless [lifetime, idle_timeout].all? { |value| value.is_a?(Integer) && value.between?(60, 90 * 86_400) } && idle_timeout <= lifetime
+          raise ArgumentError, "mobile timeouts must be explicit, finite and at most 90 days"
+        end
+        unless clients.is_a?(Array) && clients.size.between?(1, 32) && clients.uniq == clients &&
+            clients.all? { |value| value.is_a?(String) && value.match?(/\A[a-z][a-z0-9_-]{0,63}\z/) }
+          raise ArgumentError, "register bounded mobile client identifiers"
+        end
+        @lifetime, @idle_timeout = lifetime, idle_timeout
+        @clients = clients.map { |client| client.dup.freeze }.freeze
+        unless callbacks.is_a?(Hash) && callbacks.all? { |client, callback| client?(client) && valid_callback?(callback) }
+          raise ArgumentError, "register exact mobile callbacks without query, fragment or credentials"
+        end
+        @callbacks = callbacks.to_h { |client, callback| [client.dup.freeze, callback.dup.freeze] }.freeze
+        freeze
+      end
+
+      def client?(id) = id.is_a?(String) && clients.include?(id)
+      def callback(client_id) = @callbacks[client_id]
+      def bearer = "am1:#{SecureRandom.urlsafe_base64(32)}"
+
+      private
+
+      def valid_callback?(value)
+        return false unless value.is_a?(String) && value.ascii_only? && value.bytesize.between?(10, 2048) && !value.match?(/[\x00-\x20\x7f\\%]/)
+        uri = URI.parse(value)
+        uri.scheme && !%w[http javascript data file].include?(uri.scheme.downcase) &&
+          uri.host && !uri.host.empty? && uri.path && !uri.path.empty? && !uri.userinfo && !uri.query && !uri.fragment
+      rescue URI::InvalidURIError
+        false
+      end
+    end
+  end
+end

data/lib/add_auth/core/mobile_response.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Core
+    module MobileResponse
+      def self.status(reason)
+        {rate_limited: 429, challenge_unavailable: 503, challenge_rejected: 422, unconfirmed: 403, locked: 423, disabled: 403,
+         elevation_required: 403}.fetch(reason, 401)
+      end
+    end
+  end
+end

data/lib/add_auth/core/native_authentication.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module AddAuth
+  module Core
+    class NativeAuthentication
+      Challenge = Struct.new(:id, :nonce, :expires_at) do
+        def inspect = "#<AddAuth::Core::NativeAuthentication::Challenge [FILTERED]>"
+      end
+
+      def initialize(external_identities:, profile:, providers:, intake:, verify:, accounts: nil)
+        @external, @profile, @providers, @intake, @verify = external_identities, profile, providers, intake, verify
+        unless providers.is_a?(Hash) && providers.all? { |client_id, provider| profile&.client?(client_id) && provider.is_a?(ExternalIdentities::Configuration) }
+          raise ArgumentError, "register a native provider configuration for each supported client"
+        end
+        @providers = providers.dup.freeze
+        @accounts = accounts
+      end
+
+      def start(client_id:, ip:, challenge_token: nil, intent: "sign_in")
+        admitted = @intake.anonymous(ip: ip, action: (intent == "enroll") ? :register : :provider, challenge_token: challenge_token)
+        return failure(admitted) if admitted.is_a?(Symbol)
+        provider = @providers[client_id]
+        return failure unless @profile&.client?(client_id) && provider
+        purpose = {"sign_in" => ExternalIdentities::NATIVE, "enroll" => ExternalIdentities::NATIVE_ENROLL}[intent]
+        return failure unless purpose
+        return failure if intent == "enroll" && !@accounts
+        nonce = SecureRandom.urlsafe_base64(32)
+        result = @external.begin_transaction(configuration_id: provider.id, browser_secret: nonce, purpose: purpose,
+          binding_context: context(client_id))
+        return result unless result.success?
+        Result.success(user: nil, strategy: :external_identity,
+          credential: Challenge.new(id: result.credential.id, nonce: nonce, expires_at: result.credential.expires_at))
+      end
+
+      def complete(client_id:, challenge_id:, nonce:, identity_token:, ip:, user_agent: nil)
+        checked = verified(client_id: client_id, challenge_id: challenge_id, nonce: nonce, identity_token: identity_token,
+          ip: ip, purpose: ExternalIdentities::NATIVE)
+        return checked unless checked.success?
+        @external.native_sign_in(evidence: checked.credential, client_id: client_id, ip_address: hint(ip, 128), user_agent: hint(user_agent, 512))
+      end
+
+      def enroll(client_id:, challenge_id:, nonce:, identity_token:, ip:, identifier:, profile: {})
+        return failure(:disabled) unless @accounts
+        checked = verified(client_id: client_id, challenge_id: challenge_id, nonce: nonce, identity_token: identity_token,
+          ip: ip, purpose: ExternalIdentities::NATIVE_ENROLL)
+        return checked unless checked.success?
+        @accounts.call.register_external(identifier: identifier, evidence: checked.credential, profile: profile)
+      end
+
+      private
+
+      def verified(client_id:, challenge_id:, nonce:, identity_token:, ip:, purpose:)
+        admitted = @intake.anonymous(ip: ip, action: :native_exchange)
+        return failure(admitted) if admitted.is_a?(Symbol)
+        provider = @providers[client_id]
+        return failure unless @profile&.client?(client_id) && provider && identity_token.is_a?(String) &&
+          identity_token.ascii_only? && identity_token.bytesize.between?(1, 16_384)
+        pending = @external.pending(transaction: challenge_id, browser_secret: nonce, binding_context: context(client_id))
+        return failure unless pending && pending.purpose == purpose && pending.configuration.equal?(provider)
+        result = @verify.call(identity_token: identity_token, pending: pending, nonce: nonce)
+        evidence = provider.verify(server_result: result, transaction: pending)
+        return failure unless evidence
+        Result.success(user: nil, strategy: :external_identity, credential: evidence)
+      end
+
+      def context(client_id) = "native:#{client_id}"
+
+      def failure(reason = :invalid_credentials) = Result.failure(reason: reason)
+
+      def hint(value, limit)
+        value if value.is_a?(String) && value.valid_encoding? && value.bytesize <= limit && !value.match?(/[\x00-\x1f\x7f]/)
+      end
+    end
+  end
+end

data/lib/add_auth/core/passwords/bcrypt_support.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "bcrypt"
+
+module AddAuth
+  module Core
+    module Passwords
+      # Explicit metadata support for the stock Rails bcrypt verifier, not an
+      # algorithm detector or authentication proof. Override verifiers supply
+      # their own available?(digest:) contract instead of using this adapter.
+      class BcryptSupport
+        PATTERN = /\A\$2[aby]\$(\d{2})\$[.\/A-Za-z0-9]{53}\z/
+
+        def initialize(maximum_cost: BCrypt::Engine::MAX_COST)
+          @maximum_cost = maximum_cost
+        end
+
+        def available?(digest:)
+          return false unless digest.is_a?(String) && digest.valid_encoding? && digest.bytesize == 60
+          match = PATTERN.match(digest)
+          !!(match && match[1].to_i.between?(BCrypt::Engine::MIN_COST, @maximum_cost))
+        rescue ArgumentError, EncodingError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/core/passwords/credential.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require "bcrypt"
+
+module AddAuth
+  module Core
+    module Passwords
+      class Credential
+        def self.scheme_after_assignment(scheme:, password:, digest_changed:)
+          (digest_changed && password.is_a?(String) && !password.empty?) ? "rails" : scheme
+        end
+
+        def initialize(legacy_verifier:)
+          @legacy = legacy_verifier
+        end
+
+        def authenticate(user:, password:, current:)
+          return Result.failure(reason: :invalid_credentials) unless password.is_a?(String) && password.valid_encoding? && password.bytesize.between?(1, 1024)
+          verified = case scheme(user)
+          when nil, "rails" then current.call(password)
+          when "devise_bcrypt" then @legacy&.verify(digest: user.password_digest, password: password) == true
+          else false
+          end
+          verified ? Result.success(user: user, strategy: :password) : Result.failure(reason: :invalid_credentials)
+        rescue BCrypt::Errors::InvalidHash, BCrypt::Errors::InvalidSecret, ArgumentError, EncodingError
+          Result.failure(reason: :invalid_credentials)
+        end
+
+        # Availability is not authentication. It asks the explicitly selected
+        # verifier whether it supports this persisted credential with its current
+        # configuration. Older/custom adapters without that contract fail closed.
+        def available?(user:, current:)
+          return false unless user.respond_to?(:password_digest)
+          digest = user.password_digest
+          return false unless digest.is_a?(String) && digest.valid_encoding? && !digest.empty?
+          verifier = case scheme(user)
+          when nil, "rails" then current
+          when "devise_bcrypt" then @legacy
+          end
+          verifier.respond_to?(:available?) && verifier.available?(digest: digest) == true
+        end
+
+        private
+
+        def scheme(user) = user.respond_to?(:add_auth_password_scheme) ? user.add_auth_password_scheme : nil
+      end
+    end
+  end
+end

data/lib/add_auth/core/passwords/legacy_bcrypt.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "bcrypt"
+require "add_auth/core/passwords/bcrypt_support"
+
+module AddAuth
+  module Core
+    module Passwords
+      # Verification only. New password assignment remains the Rails host's job.
+      # The source profile chooses this adapter explicitly; no digest guessing.
+      class LegacyBcrypt
+        PATTERN = BcryptSupport::PATTERN
+
+        def initialize(pepper: -> {}, maximum_cost: 14)
+          raise ArgumentError, "pepper must be callable" unless pepper.respond_to?(:call)
+          raise ArgumentError, "maximum_cost must be between 4 and 20" unless maximum_cost.is_a?(Integer) && maximum_cost.between?(4, 20)
+          @pepper, @maximum_cost = pepper, maximum_cost
+          @support = BcryptSupport.new(maximum_cost: maximum_cost)
+        end
+
+        def available?(digest:)
+          @support.available?(digest: digest) && valid_pepper?(@pepper.call)
+        end
+
+        def verify(digest:, password:)
+          return false unless password.is_a?(String) && password.valid_encoding? && password.bytesize.between?(1, 1024)
+          return false unless @support.available?(digest: digest)
+          pepper = @pepper.call
+          return false unless valid_pepper?(pepper)
+          BCrypt::Password.new(digest).is_password?((pepper.nil? || pepper.empty?) ? password : "#{password}#{pepper}")
+        rescue BCrypt::Errors::InvalidHash, BCrypt::Errors::InvalidSecret, ArgumentError, EncodingError
+          false
+        end
+
+        def inspect = "#<AddAuth::Core::Passwords::LegacyBcrypt [FILTERED]>"
+
+        private
+
+        def valid_pepper?(pepper) = pepper.nil? || (pepper.is_a?(String) && pepper.valid_encoding? && pepper.bytesize <= 1024)
+      end
+    end
+  end
+end

data/lib/add_auth/core/passwords/lifecycle.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Core
+    module Passwords
+      # Called only inside the owning account transaction. The adapter supplies
+      # Rails hashing and persistence; these decisions are shared by entry paths.
+      class Lifecycle
+        def initialize(store:, policy:, enabled:, maximum_attempts: 20, unlock_in: 3600, clock: Time, issue_unlock: ->(_user) {})
+          unless maximum_attempts.is_a?(Integer) && maximum_attempts.between?(1, 100) &&
+              unlock_in.is_a?(Numeric) && unlock_in.finite? && unlock_in.between?(60, 86_400)
+            raise ArgumentError, "configure bounded password attempts and unlock duration"
+          end
+          @store, @policy, @enabled, @maximum, @unlock_in, @clock, @issue_unlock = store, policy, enabled, maximum_attempts, unlock_in, clock, issue_unlock
+        end
+
+        def prepare(user:)
+          return unless @enabled && user && !user.add_auth_manual_lock && user.locked_at &&
+            user.add_auth_locked_until && user.add_auth_locked_until <= @clock.now
+          @store.update_account(user: user, locked_at: nil, add_auth_locked_until: nil, failed_attempts: 0)
+        end
+
+        def verified(user:, password:, valid:, rehash: true)
+          return false unless user && @policy.call(user) == true
+          if valid
+            @store.update_account(user: user, failed_attempts: 0) if @enabled && user.failed_attempts != 0
+            if rehash && user.respond_to?(:add_auth_password_scheme) && user.add_auth_password_scheme == "devise_bcrypt" && assignable?(password)
+              @store.rehash_password(user: user, password: password)
+              @store.revoke_authority(user: user, at: @clock.now)
+            end
+            true
+          else
+            record_failure(user) if @enabled
+            false
+          end
+        end
+
+        private
+
+        def assignable?(password)
+          password.is_a?(String) && password.valid_encoding? && password.bytesize.between?(1, 72) && !password.include?("\0")
+        end
+
+        def record_failure(user)
+          attempts = [user.failed_attempts.to_i + 1, @maximum].min
+          changes = {failed_attempts: attempts}
+          if attempts >= @maximum
+            changes[:locked_at] = @clock.now
+            changes[:add_auth_locked_until] = @clock.now + @unlock_in
+          end
+          @store.update_account(user: user, **changes)
+          if attempts >= @maximum
+            @store.revoke_authority(user: user, at: @clock.now)
+            @issue_unlock.call(user)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/core/remaining_factors.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Core
+    # Evaluate against a reloaded account under the credential mutation lock.
+    # Counts must include only this account's live credentials. Feature flags
+    # and method labels alone do not establish a usable remaining factor.
+    class RemainingFactors
+      def initialize(access_policy:, passkey_count:, password_available:)
+        @access, @passkey_count, @password_available = access_policy, passkey_count, password_available
+      end
+
+      def call(user)
+        return true if @access.sign_in_allowed?(user, :passkey) && positive_count?(@passkey_count.call(user))
+        return true if @access.recoverable?(user)
+        @access.sign_in_allowed?(user, :password) && @password_available.call(user) == true
+      end
+
+      private
+
+      def positive_count?(value) = value.is_a?(Integer) && value.positive?
+    end
+  end
+end

data/lib/add_auth/core/sessions.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "securerandom"
+require "add_auth/core/mobile_profile"
 
 module AddAuth
   module Core
@@ -10,14 +11,15 @@ module AddAuth
       end
       class Entry
         attr_reader :id, :current, :authenticated_with, :authenticated_at, :created_at,
-          :last_seen_at, :expires_at, :ip_address, :user_agent
+          :last_seen_at, :expires_at, :ip_address, :user_agent, :transport, :client_id
 
         def initialize(id:, current:, authenticated_with:, authenticated_at:, created_at:,
-          last_seen_at:, expires_at:, ip_address:, user_agent:)
+          last_seen_at:, expires_at:, ip_address:, user_agent:, transport: "browser", client_id: nil)
           @id, @current, @authenticated_with, @authenticated_at, @created_at = id, current,
             authenticated_with, authenticated_at, created_at
           @last_seen_at, @expires_at, @ip_address, @user_agent = last_seen_at, expires_at,
             ip_address, user_agent
+          @transport, @client_id = transport, client_id
         end
 
         def inspect = "#<AddAuth::Core::Sessions::Entry id=#{id} current=#{current.inspect}>"
@@ -27,7 +29,7 @@ module AddAuth
       Page = Struct.new(:entries, :next_cursor)
 
       def initialize(store:, digest:, eligible:, lifetime: 43_200, idle_timeout: 1800,
-        legacy_bridge_until: nil, clock: Time, access_policy: nil)
+        legacy_bridge_until: nil, clock: Time, access_policy: nil, password_lifecycle: nil, remembered_profile: nil, mobile_profile: nil, on_sign_in: nil, verified_denial: nil)
         unless [lifetime, idle_timeout].all? { |n| n.is_a?(Numeric) && n.finite? && n.positive? } && idle_timeout <= lifetime
           raise ArgumentError, "session timeouts must be positive and idle_timeout <= lifetime"
         end
@@ -36,7 +38,19 @@ module AddAuth
         end
         @store, @digest, @eligible, @clock = store, digest, eligible, clock
         @access_policy = access_policy
+        @password_lifecycle = password_lifecycle
+        @on_sign_in = on_sign_in
+        @verified_denial = verified_denial
+        raise ArgumentError, "invalid mobile profile" unless mobile_profile.nil? || mobile_profile.is_a?(MobileProfile)
+        @mobile = mobile_profile
         @lifetime, @idle, @deadline = lifetime, idle_timeout, legacy_bridge_until
+        if remembered_profile
+          values = remembered_profile.values_at(:lifetime, :idle_timeout)
+          unless values.all? { |n| n.is_a?(Numeric) && n.finite? && n.between?(60, 90 * 86_400) } && values.last <= values.first
+            raise ArgumentError, "remembered session timeouts must be bounded and idle_timeout <= lifetime"
+          end
+          @remembered = remembered_profile.slice(:lifetime, :idle_timeout).freeze
+        end
       end
 
       def start(user:, method:, replacing: nil, **hints)
@@ -50,36 +64,72 @@ module AddAuth
         end
       end
 
-      def authenticate(identifier:, password:, replacing: nil, **hints)
+      def authenticate(**arguments, &verify)
+        result = authenticate_result(**arguments, &verify)
+        result.grant if result.success?
+      end
+
+      def authenticate_result(identifier:, password:, replacing: nil, disclose_policy: false, **hints)
         @store.with_identifier(identifier: identifier, replacing: replacing) do |user|
+          @password_lifecycle&.prepare(user: user)
           verified = yield
-          create_in_transaction(user: user, method: :password, replacing: replacing, **hints) if user && verified && verified.id == user.id
+          valid = user && verified && verified.id == user.id && verified.password_digest == user.password_digest
+          denial = @verified_denial&.call(user) if valid && disclose_policy
+          valid = @password_lifecycle.verified(user: user, password: password, valid: !!valid) if @password_lifecycle
+          grant = create_in_transaction(user: user, method: :password, replacing: replacing, **hints) if valid
+          if grant
+            Result.success(user: user, strategy: :password, session: grant.session, grant: grant)
+          else
+            Result.failure(reason: %i[unconfirmed locked disabled].include?(denial) ? denial : :invalid_credentials)
+          end
         end
       end
 
       # Runs inside the store's account transaction. When replacing a browser,
       # that session's account must also be locked on the same connection.
-      def create_in_transaction(user:, method:, persist: nil, replacing: nil, proof: nil, **hints)
+      def create_in_transaction(user:, method:, persist: nil, replacing: nil, proof: nil, remember: false, transport: :browser, client_id: nil, **hints)
         return unless user && @eligible.call(user) == true
-        raise ArgumentError, "unsupported proof" unless %w[password email_link passkey].include?(method.to_s)
+        supported_transport = transport == :browser || (transport == :mobile && @mobile&.client?(client_id))
+        return unless supported_transport
+        return if transport == :mobile && replacing
+        raise ArgumentError, "unsupported proof" unless %w[password email_link passkey external_identity].include?(method.to_s)
         return if @access_policy && !@access_policy.sign_in_allowed?(user, method)
         if method.to_s == "passkey"
           return unless proof.is_a?(StepUp::Evidence) && proof.strong? && proof.user_id == user.id &&
             proof.verified_at <= @clock.now && proof.verified_at > @clock.now - 300
         end
+        if method.to_s == "external_identity"
+          return unless @access_policy && proof.is_a?(ExternalIdentities::SessionProof) && proof.user_id == user.id &&
+            proof.verified_at <= @clock.now && proof.verified_at > @clock.now - 300 &&
+            @access_policy.external_credential_current?(user: user, id: proof.credential_id, version: proof.credential_version)
+          hints = hints.merge(authentication_external_id: proof.credential_id,
+            authentication_external_version: proof.credential_version)
+        end
         if user.respond_to?(:add_auth_policy_version)
           hints = hints.merge(authentication_policy_version: @access_policy ? @access_policy.version(user) : user.add_auth_policy_version,
             authentication_credential_id: proof&.credential_id, authentication_uv: proof&.user_verification || false)
         end
-        raw = bearer
+        raw = (transport == :mobile) ? @mobile.bearer : bearer
         now = @clock.now
         if replacing
           prior = @store.find_for_user_in_transaction(user_id: replacing.user_id, session_id: replacing.id)
           @store.update(prior, revoked_at: now) if prior && !prior.revoked_at && prior.token_digest == replacing.token_digest
         end
         writer = persist || ->(**attributes) { @store.create(user: user, **attributes) }
+        duration = @lifetime
+        if @remembered
+          remembered = remember == true
+          duration = @remembered.fetch(:lifetime) if remembered
+          hints = hints.merge(remembered: remembered, idle_timeout: remembered ? @remembered.fetch(:idle_timeout) : @idle)
+        end
+        if transport == :mobile
+          duration = @mobile.lifetime
+          hints = hints.merge(transport: "mobile", client_id: client_id, mobile_idle_timeout: @mobile.idle_timeout)
+          hints[:remembered] = false if @remembered
+        end
         row = writer.call(token_digest: @digest.digest(raw), authenticated_with: method.to_s,
-          authenticated_at: now, expires_at: now + @lifetime, last_seen_at: now, **hints)
+          authenticated_at: now, expires_at: now + duration, last_seen_at: now, **hints)
+        @on_sign_in&.call(user: user, session: row, at: now)
         Grant.new(session: row, bearer: raw)
       end
 
@@ -90,7 +140,7 @@ module AddAuth
         legacy = lookup.key?(:id)
         @store.with_session(**lookup) do |user, row|
           now = @clock.now
-          next unless live?(user, row, now: now)
+          next unless transport_for(row) == "browser" && live?(user, row, now: now)
           if legacy
             next if row.token_digest || now >= @deadline
             raw = bearer
@@ -104,13 +154,25 @@ module AddAuth
         end
       end
 
+      # Only the exact Authorization bearer value enters this parser. Cookies,
+      # query parameters and legacy host API tokens are not alternate inputs.
+      def resume_mobile(bearer:)
+        return unless @mobile && bearer.is_a?(String) && MobileProfile::PATTERN.match?(bearer)
+        @store.with_session(digest: @digest.digest(bearer)) do |user, row|
+          now = @clock.now
+          next unless transport_for(row) == "mobile" && live?(user, row, now: now)
+          @store.update(row, last_seen_at: now) if row.last_seen_at <= now - 60
+          Grant.new(session: row)
+        end
+      end
+
       # A trusted cookie identifies what to retire, even if that account is now
       # ineligible. This snapshot is replacement input, never authentication.
       def replacement_for(signed_value:)
         lookup = cookie_lookup(signed_value)
         return unless lookup
         @store.with_session(**lookup) do |_user, row|
-          row unless lookup.key?(:id) && row&.token_digest
+          row if transport_for(row) == "browser" && !(lookup.key?(:id) && row&.token_digest)
         end
       end
 
@@ -134,7 +196,7 @@ module AddAuth
         now = @clock.now
         candidates = @store.list_for_user(user_id: user.id, before: before&.to_i,
           excluding: current_session_id, limit: PAGE_SIZE + 1, now: now,
-          active_after: now - @idle, legacy: !!(@deadline && now < @deadline))
+          active_after: now - [@idle, @remembered&.fetch(:idle_timeout) || @idle, @mobile&.idle_timeout || @idle].max, legacy: !!(@deadline && now < @deadline))
         cursor = candidates[PAGE_SIZE - 1].id if candidates.length > PAGE_SIZE
         rows = candidates.first(PAGE_SIZE)
         if before.nil? && current_session_id
@@ -147,7 +209,8 @@ module AddAuth
           Entry.new(id: row.id, current: row.id == current_session_id,
             authenticated_with: row.authenticated_with, authenticated_at: row.authenticated_at,
             created_at: row.created_at, last_seen_at: row.last_seen_at, expires_at: row.expires_at,
-            ip_address: row.ip_address, user_agent: row.user_agent)
+            ip_address: row.ip_address, user_agent: row.user_agent,
+            transport: transport_for(row), client_id: row.respond_to?(:client_id) ? row.client_id : nil)
         end
         Page.new(entries: entries, next_cursor: cursor)
       end
@@ -169,8 +232,11 @@ module AddAuth
       def reauthenticate(user:, session:, purpose:, policy:)
         with_live_session(user: user, session: session) do |account, row, _now|
           next Result.failure(reason: :elevation_required) if @access_policy && !@access_policy.sign_in_allowed?(account, :password)
+          @password_lifecycle&.prepare(user: account)
           verified = yield account
-          next Result.failure(reason: :invalid_credentials) unless verified && verified.id == account.id
+          valid = verified && verified.id == account.id && verified.password_digest == account.password_digest
+          valid = @password_lifecycle.verified(user: account, password: nil, valid: !!valid, rehash: false) if @password_lifecycle
+          next Result.failure(reason: :invalid_credentials) unless valid
           evidence = StepUp::Evidence.new(user_id: account.id, session_id: row.id,
             method: :password, verified_at: @clock.now, session_digest: row.token_digest,
             credential_version: policy.password_version(account))
@@ -202,7 +268,7 @@ module AddAuth
         row = current_in_transaction(user: user, session: session)
         return unless row && grant.is_a?(StepUp::Grant) && grant.valid_for?(user: user,
           user_id: user.id, session_id: row.id, session_digest: row.token_digest, purpose: grant.purpose, now: @clock.now)
-        raw = bearer
+        raw = (transport_for(row) == "mobile") ? @mobile.bearer : bearer
         attributes = {token_digest: @digest.digest(raw), elevated_at: grant.verified_at,
                       elevated_with: grant.method.to_s, elevation_purpose: grant.purpose.to_s,
                       elevation_credential_id: grant.credential_id, elevation_uv: grant.user_verification,
@@ -232,7 +298,9 @@ module AddAuth
         now = @clock.now
         return Result.failure(reason: :elevation_required) unless row&.respond_to?(:elevation_version) && row.elevated_at &&
           row.elevation_purpose == purpose.to_s && row.elevation_expires_at && now < row.elevation_expires_at
-        evidence = StepUp::Evidence.new(user_id: user.id, session_id: row.id,
+        evidence_class = (row.elevated_with == "external_identity") ? StepUp::ExternalEvidence : StepUp::Evidence
+        extra = (row.elevated_with == "external_identity") ? {purpose: purpose} : {}
+        evidence = evidence_class.send(:new, **extra, user_id: user.id, session_id: row.id,
           method: row.elevated_with, verified_at: row.elevated_at, session_digest: row.token_digest,
           credential_id: row.elevation_credential_id, user_verification: row.elevation_uv,
           credential_version: row.elevation_version)
@@ -277,10 +345,27 @@ module AddAuth
         return false unless user && row && @eligible.call(user) == true && !row.revoked_at
         return false if @access_policy && !@access_policy.session_allowed?(user, row)
         legacy = !row.token_digest && @deadline && now < @deadline
+        idle = @idle
+        if transport_for(row) == "mobile"
+          return false unless @mobile&.client?(row.client_id) && row.token_digest
+          stored_idle = row.mobile_idle_timeout
+          return false unless stored_idle.is_a?(Integer) && stored_idle.between?(60, 90 * 86_400)
+          idle = [stored_idle, @mobile.idle_timeout].min
+          return false unless row.authenticated_at && (row.authenticated_at + @mobile.lifetime > now)
+        elsif transport_for(row) != "browser"
+          return false
+        elsif @remembered && row.respond_to?(:remembered) && row.remembered == true
+          stored_idle = row.idle_timeout
+          return false unless stored_idle.is_a?(Numeric) && stored_idle.finite? && stored_idle.positive?
+          idle = [stored_idle, @remembered.fetch(:idle_timeout)].min
+          return false unless row.authenticated_at && row.authenticated_at + @remembered.fetch(:lifetime) > now
+        end
         (legacy || (row.expires_at && row.last_seen_at)) &&
-          (!row.expires_at || row.expires_at > now) && (!row.last_seen_at || row.last_seen_at > now - @idle)
+          (!row.expires_at || row.expires_at > now) && (!row.last_seen_at || row.last_seen_at > now - idle)
       end
 
+      def transport_for(row) = row.respond_to?(:transport) ? row.transport : "browser"
+
       def bearer = "lk1:#{SecureRandom.urlsafe_base64(32)}"
     end
   end

data/lib/add_auth/core/step_up.rb

@@ -5,7 +5,7 @@ module AddAuth
     # Evidence is issued by a trusted verifier, never deserialized from a client.
     # A grant retains that verifier's current policy and the proof's original age.
     class StepUp
-      METHODS = %i[password email_link passkey].freeze
+      METHODS = %i[password email_link passkey external_identity].freeze
 
       class Evidence
         attr_reader :user_id, :session_id, :method, :verified_at, :credential_id,
@@ -28,6 +28,15 @@ module AddAuth
         def inspect = "#<AddAuth::Core::StepUp::Evidence [FILTERED]>"
       end
 
+      class ExternalEvidence < Evidence
+        attr_reader :purpose
+        def initialize(purpose:, **attributes)
+          @purpose = purpose.to_sym
+          super(**attributes)
+        end
+        private_class_method :new
+      end
+
       class Grant
         attr_reader :purpose, :expires_at
         def initialize(evidence:, purpose:, expires_at:, policy:)
@@ -117,6 +126,9 @@ module AddAuth
         return false if rule.require_passkey && !evidence.strong?
         return false unless evidence.session_digest.is_a?(String) && !evidence.session_digest.empty?
         return false if evidence.method == :passkey && !evidence.strong?
+        if evidence.method == :external_identity
+          return false unless evidence.is_a?(ExternalEvidence) && evidence.purpose == purpose.to_sym
+        end
         if evidence.method == :password
           return false unless evidence.credential_version.is_a?(String) && !evidence.credential_version.empty?
           return false unless user.respond_to?(:password_digest) && password_version(user) == evidence.credential_version