add_auth 0.2.2 → 0.3.0

data/lib/add_auth/rails/stores/mobile_handoffs.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "add_auth/rails/stores/account_lock"
+
+module AddAuth
+  module Rails
+    module Stores
+      class MobileHandoffs
+        def initialize(user_model:, handoff_model:, session_model:)
+          @users, @handoffs = user_model, handoff_model
+          unless [handoff_model, session_model].all? { |model| model.connection_pool.equal?(@users.connection_pool) }
+            raise ArgumentError, "mobile authentication models must share one connection pool"
+          end
+          @lock = AccountLock.new(@users)
+        end
+
+        def create_pending(**attributes)
+          @handoffs.transaction(requires_new: true) { @handoffs.create!(**attributes) }
+        rescue ActiveRecord::RecordNotUnique
+          nil
+        end
+
+        def by_external_digest(digest:) = @handoffs.uncached { @handoffs.find_by(external_digest: digest) }
+
+        def issue(row:, **attributes)
+          require_transaction!
+          @handoffs.where(id: row.id, digest: nil, consumed_at: nil, user_id: nil).update_all(**attributes) == 1
+        end
+
+        def with_code(digest:)
+          @handoffs.uncached do
+            locator = @handoffs.find_by(digest: digest)
+            @lock.call(id: locator&.user_id) do |user|
+              yield user, user && @handoffs.find_by(digest: digest, user_id: user.id)
+            end
+          end
+        end
+
+        def consume(row:, at:)
+          require_transaction!
+          @handoffs.where(id: row.id, user_id: row.user_id, consumed_at: nil).where("expires_at > ?", at)
+            .update_all(consumed_at: at) == 1
+        end
+
+        private
+
+        def require_transaction!
+          raise AddAuth::Error, "mobile handoff requires an account transaction" unless @users.connection.transaction_open?
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/stores/security_events.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "add_auth/rails/stores/delivery_state"
+require "add_auth/rails/stores/commit_dispatch"
 
 module AddAuth
   module Rails
@@ -16,12 +17,8 @@ module AddAuth
         def append(user:, **attributes)
           raise AddAuth::Error, "security notifications must join the account transaction" unless @users.current_transaction.open?
           event = @events.create!(**attributes, user_id: user.id)
-          @users.current_transaction.after_commit do
-            job = ::AddAuth::SecurityNotificationJob.perform_later(event.id)
-            raise AddAuth::Error unless job
-          rescue
-            ActiveSupport::Notifications.instrument("notification_enqueue_failed.add_auth", event_id: event.id)
-          end
+          CommitDispatch.enqueue(transaction: @users.current_transaction, job: ::AddAuth::SecurityNotificationJob,
+            id: event.id, failure_event: "notification_enqueue_failed.add_auth", payload: {event_id: event.id})
           event
         end
 

data/lib/add_auth/rails/user_lifecycle.rb

@@ -6,29 +6,27 @@ module AddAuth
       extend ActiveSupport::Concern
 
       included do
+        before_update :add_auth_validate_account_write
         after_update :add_auth_invalidate_proofs
       end
 
       private
 
+      def add_auth_validate_account_write
+        Core::AccountLifecycle.validate_host_write!(changes: changes_to_save, enabled: AddAuth.configuration.lifecycle.enabled)
+      end
+
       def add_auth_invalidate_proofs
         return unless Core::Intake.revoke_after_change?(saved_changes)
         now = Time.current
-        if AddAuth.configuration.notifications.enabled
-          kind = saved_changes.key?("password_digest") ? :password_changed : :email_changed
+        kind = Core::Intake.notification_after_change(saved_changes)
+        if AddAuth.configuration.notifications.enabled && kind
           Runtime.security_events.issue(user: self, kind: kind, at: now)
           if saved_change_to_email_address? && email_address_before_last_save != email_address
             Runtime.security_events.issue(user: self, kind: :email_changed, at: now, recipient: email_address_before_last_save)
           end
         end
-        if defined?(::AddAuthCeremony) && ::AddAuthCeremony.table_exists?
-          ::AddAuthCeremony.where(user_id: id, consumed_at: nil).update_all(consumed_at: now)
-        end
-        sessions.where(revoked_at: nil).update_all(revoked_at: now)
-        if defined?(::AddAuthSignInToken) && ::AddAuthSignInToken.table_exists?
-          ::AddAuthSignInToken.where(user_id: id, consumed_at: nil, revoked_at: nil)
-            .update_all(revoked_at: now, delivery_payload: nil)
-        end
+        Runtime.authority.revoke(user_id: id, at: now)
       end
     end
   end

data/lib/add_auth/result.rb

@@ -16,6 +16,7 @@ module AddAuth
       consumed_token revoked_token challenge_rejected
       challenge_unavailable rate_limited origin_mismatch
       counter_regression elevation_required
+      identity_unbound identity_conflict last_credential
     ].freeze
 
     attr_reader :user, :strategy, :credential, :reason, :session, :grant

data/lib/add_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AddAuth
-  VERSION = "0.2.2"
+  VERSION = "0.3.0"
 end

data/lib/add_auth.rb

@@ -13,11 +13,15 @@ require "add_auth/configuration"
 # ejectable, disposable UI on top of it.
 require "add_auth/core/browser_binding"
 require "add_auth/core/access_policy"
+require "add_auth/core/account_policy"
 require "add_auth/core/sessions"
+require "add_auth/core/mobile_response"
 require "add_auth/core/step_up"
+require "add_auth/core/external_identities"
 require "add_auth/core/intake"
 require "add_auth/core/rate_limit"
 require "add_auth/core/delivery"
+require "add_auth/core/account_lifecycle"
 require "add_auth/core/maintenance"
 require "add_auth/core/security_events"
 require "add_auth/core/strategies/email_link"

data/lib/generators/add_auth/accounts/accounts_generator.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class AccountsGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      desc "Prepare optional account lifecycle schema and pages; review existing account confirmation and policy before enabling"
+
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def prerequisites
+        invoke "add_auth:notifications"
+        invoke "add_auth:step_up"
+      end
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_accounts.rb")].any?
+          migration_template "add_add_auth_accounts.rb.tt", "db/migrate/add_add_auth_accounts.rb"
+        end
+        %w[add_auth_account_token add_auth_address_claim].each do |name|
+          template "#{name}.rb", "app/models/#{name}.rb" unless File.exist?(File.join(destination_root, "app/models/#{name}.rb"))
+        end
+        say "Account lifecycle is prepared but disabled. Map existing account policy and confirmation state, then set config.lifecycle.enabled = true."
+      end
+
+      def routes
+        return if File.read(File.join(destination_root, "config/routes.rb")).include?("# AddAuth account lifecycle")
+        route <<~ROUTES
+          # AddAuth account lifecycle
+          get "account/sign-up", to: "add_auth/accounts#new"
+          post "account/sign-up", to: "add_auth/accounts#create"
+          get "account/check-email", to: "add_auth/accounts#check_email"
+          get "account/requests/:purpose", to: "add_auth/accounts#request_form", constraints: {purpose: /confirm|reset_password|unlock/}
+          post "account/requests/:purpose", to: "add_auth/accounts#request_proof", constraints: {purpose: /confirm|reset_password|unlock/}
+          get "account/proofs/:purpose", to: "add_auth/accounts#proof", constraints: {purpose: /confirm|reset_password|unlock/}
+          post "account/proofs/:purpose", to: "add_auth/accounts#consume", constraints: {purpose: /confirm|reset_password|unlock/}
+          get "account/email", to: "add_auth/accounts#edit_email"
+          post "account/email", to: "add_auth/accounts#change_email"
+          get "account/password", to: "add_auth/accounts#edit_password"
+          post "account/password", to: "add_auth/accounts#change_password"
+          get "account/delete", to: "add_auth/accounts#confirm_deletion"
+          delete "account", to: "add_auth/accounts#destroy"
+        ROUTES
+      end
+    end
+  end
+end

data/lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt

@@ -0,0 +1,49 @@
+require "add_auth/rails/migration/key_type"
+
+class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
+  def up
+    user_key_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    false_default = (connection.adapter_name == "SQLite") ? -> { "0" } : false
+    %i[confirmed_at locked_at disabled_at deleted_at add_auth_locked_until].each do |name|
+      add_column :users, name, :datetime unless column_exists?(:users, name)
+    end
+    add_column :users, :unconfirmed_email, :string unless column_exists?(:users, :unconfirmed_email)
+    add_column :users, :failed_attempts, :integer, default: 0, null: false unless column_exists?(:users, :failed_attempts)
+    add_column :users, :add_auth_manual_lock, :boolean, default: false_default, null: false unless column_exists?(:users, :add_auth_manual_lock)
+    add_column :users, :add_auth_password_scheme, :string unless column_exists?(:users, :add_auth_password_scheme)
+    add_column :users, :add_auth_authority, :string, default: "add_auth", null: false unless column_exists?(:users, :add_auth_authority)
+    add_column :sessions, :remembered, :boolean, default: false_default, null: false unless column_exists?(:sessions, :remembered)
+    add_column :sessions, :idle_timeout, :integer unless column_exists?(:sessions, :idle_timeout)
+    create_table :add_auth_address_claims do |t|
+      t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
+      t.string :digest, null: false
+      t.string :state, null: false
+      t.timestamps
+    end
+    add_index :add_auth_address_claims, :digest, unique: true
+    add_index :add_auth_address_claims, [:user_id, :state], unique: true
+    create_table :add_auth_account_tokens do |t|
+      t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
+      t.string :digest, null: false
+      t.string :purpose, null: false
+      t.string :address_digest, null: false
+      t.string :account_version, null: false
+      t.string :request_id, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.datetime :revoked_at
+      t.text :delivery_payload
+      t.string :delivery_lease_key
+      t.datetime :delivery_lease_until
+      t.datetime :delivered_at
+      t.timestamps
+    end
+    add_index :add_auth_account_tokens, :digest, unique: true
+    add_index :add_auth_account_tokens, :request_id, unique: true
+    add_index :add_auth_account_tokens, :expires_at
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration, "Retain account policy, address claims and spent proofs during rollback; retire them only after reviewed reconciliation"
+  end
+end

data/lib/generators/add_auth/accounts/templates/add_auth_account_token.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+class AddAuthAccountToken < ApplicationRecord
+  belongs_to :user
+  self.filter_attributes += [:digest, :address_digest, :account_version, :delivery_payload, :delivery_lease_key]
+end

data/lib/generators/add_auth/accounts/templates/add_auth_address_claim.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+class AddAuthAddressClaim < ApplicationRecord
+  belongs_to :user
+  self.filter_attributes += [:digest]
+end

data/lib/generators/add_auth/devise_accounts/devise_accounts_generator.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class DeviseAccountsGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      desc "Prepare additive account columns for a reviewed Devise migration; does not convert accounts or switch authentication"
+
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def migration
+        return if Dir[File.join(destination_root, "db/migrate/*_prepare_add_auth_devise_accounts.rb")].any?
+        migration_template "prepare_add_auth_devise_accounts.rb.tt", "db/migrate/prepare_add_auth_devise_accounts.rb"
+        say "Review the generated migration and run preflight before conversion. Authentication and host models are unchanged."
+      end
+    end
+  end
+end

data/lib/generators/add_auth/devise_accounts/templates/prepare_add_auth_devise_accounts.rb.tt

@@ -0,0 +1,17 @@
+require "add_auth/rails/migration/key_type"
+
+class PrepareAddAuthDeviseAccounts < ActiveRecord::Migration[8.0]
+  def up
+    AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    add_column :users, :email_address, :string unless column_exists?(:users, :email_address)
+    add_column :users, :password_digest, :string unless column_exists?(:users, :password_digest)
+    add_column :users, :add_auth_password_scheme, :string unless column_exists?(:users, :add_auth_password_scheme)
+    add_column :users, :add_auth_migration_stamp, :string unless column_exists?(:users, :add_auth_migration_stamp)
+    add_column :users, :add_auth_authority, :string, default: "devise", null: false unless column_exists?(:users, :add_auth_authority)
+    add_index :users, :email_address, unique: true unless index_exists?(:users, :email_address, unique: true)
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration, "Retain canonical credentials for the reviewed bridge rollback; retire columns only after reconciliation"
+  end
+end

data/lib/generators/add_auth/email_link/templates/add_auth_challenge.js

@@ -104,6 +104,7 @@ class ChallengeController extends Controller {
   }
 
   beforeCache() { this.teardown() }
+  restore(event) { if (event.persisted) this.connect() }
   disconnect() { this.teardown() }
   teardown() {
     this.active = false

data/lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt

@@ -1,7 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthSignInTokens < ActiveRecord::Migration[8.0]
   def change
     create_table :add_auth_sign_in_tokens do |t|
-      t.references :user, null: false, foreign_key: true
+      t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), null: false, foreign_key: true
       t.string :digest, limit: 64, null: false
       t.string :identifier_digest, limit: 64, null: false
       t.string :purpose, null: false, default: "sign_in"

data/lib/generators/add_auth/external_identities/external_identities_generator.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    # Optional persistence and routes; provider strategies remain disabled until configured.
+    class ExternalIdentitiesGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_create_add_auth_external_identities.rb")].any?
+          migration_template "create_add_auth_external_identities.rb.tt", "db/migrate/create_add_auth_external_identities.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_external_identity_validity.rb")].any?
+          migration_template "add_add_auth_external_identity_validity.rb.tt", "db/migrate/add_add_auth_external_identity_validity.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_external_enrollment.rb")].any?
+          migration_template "add_add_auth_external_enrollment.rb.tt", "db/migrate/add_add_auth_external_enrollment.rb"
+        end
+        %w[external_identity external_transaction].each do |name|
+          copy_file "add_auth_#{name}.rb", "app/models/add_auth_#{name}.rb", skip: true
+        end
+      end
+
+      def routes
+        source = File.read(File.join(destination_root, "config/routes.rb"))
+        return if source.include?("# AddAuth external provider callbacks")
+
+        route <<~ROUTES
+          # AddAuth external provider callbacks
+          get "account/sign-up/providers/:provider", to: "add_auth/provider_sign_ins#enrollment", defaults: {flow: "enroll"}
+          post "account/sign-up/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "enroll"}
+          post "sign-in/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "sign_in"}
+          post "account/external-identities/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "link"}
+          get "account/external-identities", to: "add_auth/external_identities#index"
+          delete "account/external-identities/:id", to: "add_auth/external_identities#destroy"
+          post "reauthenticate/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "reauthenticate"}
+          match "auth/:provider/callback", to: "add_auth/provider_sign_ins#callback", via: [:get, :post], constraints: AddAuth::Rails::ProviderLibraries::CallbackRoute
+        ROUTES
+      end
+
+      def provider_configuration
+        copy_file "providers.rb", "config/initializers/add_auth_providers.rb", skip: true
+      end
+    end
+  end
+end

data/lib/generators/add_auth/external_identities/templates/add_add_auth_external_enrollment.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthExternalEnrollment < ActiveRecord::Migration[8.0]
+  def change
+    add_column :add_auth_external_transactions, :enrollment_payload, :text
+  end
+end

data/lib/generators/add_auth/external_identities/templates/add_add_auth_external_identity_validity.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthExternalIdentityValidity < ActiveRecord::Migration[8.0]
+  def change
+    add_column :add_auth_external_identities, :invalidated_at, :datetime
+  end
+end

data/lib/generators/add_auth/external_identities/templates/add_auth_external_identity.rb

@@ -0,0 +1,4 @@
+class AddAuthExternalIdentity < ApplicationRecord
+  belongs_to :user
+  def inspect = "#<AddAuthExternalIdentity [FILTERED]>"
+end

data/lib/generators/add_auth/external_identities/templates/add_auth_external_transaction.rb

@@ -0,0 +1,6 @@
+class AddAuthExternalTransaction < ApplicationRecord
+  self.filter_attributes += [:enrollment_payload, :digest, :browser_digest, :session_digest]
+  belongs_to :user, optional: true
+  belongs_to :session, optional: true
+  def inspect = "#<AddAuthExternalTransaction [FILTERED]>"
+end

data/lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt

@@ -0,0 +1,50 @@
+class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
+  def change
+    user_type = reference_type(:users)
+    session_type = reference_type(:sessions)
+    create_table :add_auth_external_identities do |t|
+      t.references :user, type: user_type, null: false, foreign_key: {on_delete: :cascade}
+      # SHA256 of the exact JSON [configuration, issuer, audience, subject].
+      # Indexing this key preserves case-sensitive subjects on either store.
+      t.string :namespace, limit: 64, null: false
+      t.string :provider_id, limit: 2048, null: false
+      t.string :issuer, limit: 2048, null: false
+      t.string :audience, limit: 2048, null: false
+      t.string :subject, limit: 2048, null: false
+      t.string :provenance, limit: 2048, null: false
+      t.string :credential_version, null: false
+      t.datetime :linked_at, null: false
+      t.datetime :revoked_at
+      t.timestamps
+    end
+    add_index :add_auth_external_identities, :namespace, unique: true
+    create_table :add_auth_external_transactions do |t|
+      t.string :digest, null: false
+      t.string :browser_digest, null: false
+      t.string :provider_id, limit: 2048, null: false
+      t.string :issuer, limit: 2048, null: false
+      t.string :audience, limit: 2048, null: false
+      t.string :purpose, null: false
+      t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
+      t.references :session, type: session_type, foreign_key: {on_delete: :cascade}
+      t.string :session_digest
+      t.integer :policy_version
+      t.datetime :issued_at, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.timestamps
+    end
+    add_index :add_auth_external_transactions, :digest, unique: true
+    add_index :add_auth_external_transactions, :expires_at
+    add_column :sessions, :authentication_external_id, :string
+    add_column :sessions, :authentication_external_version, :string
+  end
+
+  private
+
+  def reference_type(table)
+    column = connection.columns(table).find { |item| item.name == connection.primary_key(table) }
+    raise "Unsupported authentication primary key" unless column && [:integer, :uuid].include?(column.type)
+    (column.type == :integer && column.limit == 8) ? :bigint : column.type
+  end
+end

data/lib/generators/add_auth/external_identities/templates/providers.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+# External provider support is opt-in. Add only the provider gems you use to
+# the host application's Gemfile, then configure their OmniAuth middleware
+# using their normal configuration. Reuse existing registrations rather than
+# adding a second OmniAuth::Builder for the same provider. Keep the host's CSRF
+# validator, scopes, request methods and failure handler. AddAuth changes none
+# of them. Keep issuer/audience fixed; never derive them from a request, Host
+# header, profile attribute, or callback parameter.
+#
+# AddAuth's correlation middleware goes before OmniAuth::Builder. It retains
+# opaque Core transaction data only. OmniAuth (or the selected OIDC library)
+# owns code exchange, state, nonce, JWKS/signature, issuer, audience and expiry.
+# Requests without an AddAuth transaction continue through the existing stack.
+# Generated callback routes select only enabled, explicitly registered providers.
+# Review routing precedence before adopting a provider with an existing callback.
+# Custom provider paths/callbacks require an explicit host integration; do not
+# rewrite an existing library configuration to fit this conventional-path example.
+#
+# require "omniauth"
+# require "omniauth-google-oauth2"
+# require "add_auth/rails/provider_libraries/omniauth"
+# require "add_auth/rails/provider_libraries/omniauth_correlation"
+# Rails.application.config.middleware.use AddAuth::Rails::ProviderLibraries::OmniAuthCorrelation,
+#   providers: ["google_oauth2"]
+# Rails.application.config.middleware.use OmniAuth::Builder do
+#   provider :google_oauth2, ENV.fetch("GOOGLE_CLIENT_ID"), ENV.fetch("GOOGLE_CLIENT_SECRET")
+# end
+#
+# verifier = AddAuth::Rails::ProviderLibraries::OmniAuth::Verifier.new(
+#   provider: "google_oauth2", provenance: "omniauth-google-oauth2",
+#   mapping: {issuer: %i[extra id_info iss], audience: %i[extra id_info aud], subject: %i[extra id_info sub],
+#             authenticated_at: %i[extra id_info auth_time]}
+# )
+# AddAuth.configure do |config|
+#   config.external_identities.register(
+#     id: "google", label: "Google", middleware_name: "google_oauth2",
+#     configuration: AddAuth::Core::ExternalIdentities::Configuration.new(
+#       id: "google", issuer: "https://accounts.google.com", audience: ENV.fetch("GOOGLE_CLIENT_ID"), verifier: verifier
+#     )
+#   )
+#   config.external_identities.enabled = true
+# end
+#
+# Apple form_post needs its own callback-only cookie wrapper before
+# OmniAuth::Builder. Do not weaken your normal Rails session cookie:
+#
+# require "omniauth-apple"
+# require "add_auth/rails/provider_libraries/apple_form_post_correlation"
+# Rails.application.config.middleware.use AddAuth::Rails::ProviderLibraries::AppleFormPostCorrelation,
+#   key: Rails.application.key_generator.generate_key("add_auth.apple-form-post.v1", 32)

data/lib/generators/add_auth/install/templates/initializer.rb

@@ -4,6 +4,10 @@ AddAuth.configure do |config|
   # routes remain guarded; the host owns password reset and account provisioning.
   # config.passwords_enabled = true
 
+  # Ordinary Rails HTML navigation, including hosts without Hotwire:
+  # config.turbo_enabled = false
+  # Passkeys/captcha still use scoped gem JavaScript; no host JS build is needed.
+
   # BEGIN add_auth session
   # config.session.enabled = true
   # END add_auth session

data/lib/generators/add_auth/javascript/templates/passkey.js

@@ -4,9 +4,9 @@ import { options, credential } from "/add_auth/codec.js"
 
 export class PasskeyController extends Controller {
   static targets = ["form", "controls", "unavailable", "status", "button"]
-  static values = { optionsUrl: String, finishUrl: String, mode: String, purpose: String, csrf: String, conditional: Boolean }
+  static values = { optionsUrl: String, finishUrl: String, mode: String, purpose: String, csrf: String, conditional: Boolean, turbo: { type: Boolean, default: true } }
   connect() {
-    this.generation = 0
+    this.generation = (this.generation || 0) + 1
     this.active = true
     if (!window.PublicKeyCredential || !navigator.credentials || !window.isSecureContext) return
     this.controlsTarget.hidden = false
@@ -25,13 +25,16 @@ export class PasskeyController extends Controller {
   otherSubmission(event) { if (event.target !== this.formTarget) this.stop() }
   disconnect() { this.active = false; this.stop() }
   beforeCache() { this.active = false; this.stop(); this.controlsTarget.hidden = true; this.unavailableTarget.hidden = false; this.message("") }
+  restore(event) { if (event.persisted) this.connect() }
   async run(conditional) {
     this.stop()
     const generation = this.generation
     this.abort = new AbortController()
     if (!conditional) { this.buttonTarget.disabled = true; this.message("Follow your browser’s passkey prompt.") }
     try {
-      const challenge = new FormData(this.formTarget).get("challenge_token")
+      const form = new FormData(this.formTarget)
+      const challenge = form.get("challenge_token")
+      const remember = form.getAll("remember").at(-1)
       const start = await this.post(this.optionsUrlValue, { purpose: this.purposeValue || null, challenge_token: challenge }, this.abort.signal)
       this.formTarget.dispatchEvent(new CustomEvent("add_auth:proof-used"))
       if (!this.current(generation)) return
@@ -42,7 +45,7 @@ export class PasskeyController extends Controller {
       if (conditional) request.mediation = "conditional"
       const proof = await navigator.credentials[create ? "create" : "get"](request)
       if (!this.current(generation)) return
-      const result = await this.post(this.finishUrlValue, { transaction: this.transaction, credential: credential(proof) }, this.abort.signal)
+      const result = await this.post(this.finishUrlValue, { transaction: this.transaction, credential: credential(proof), remember }, this.abort.signal)
       if (!this.current(generation)) return
       this.transaction = null
       this.navigate(result.redirect)
@@ -76,6 +79,6 @@ export class PasskeyController extends Controller {
   }
   current(generation) { return this.active && this.element.isConnected && this.generation === generation }
   message(text) { this.statusTarget.textContent = text; this.statusTarget.hidden = !text }
-  navigate(path) { if (path) window.Turbo ? window.Turbo.visit(path) : window.location.assign(path) }
+  navigate(path) { if (path) (this.turboValue && window.Turbo) ? window.Turbo.visit(path) : window.location.assign(path) }
 }
 application.register("add-auth-passkey", PasskeyController)

data/lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class MobileSessionsGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_mobile_sessions.rb")].any?
+          migration_template "add_add_auth_mobile_sessions.rb.tt", "db/migrate/add_add_auth_mobile_sessions.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_create_add_auth_mobile_handoffs.rb")].any?
+          migration_template "create_add_auth_mobile_handoffs.rb.tt", "db/migrate/create_add_auth_mobile_handoffs.rb"
+        end
+        copy_file "add_auth_mobile_handoff.rb", "app/models/add_auth_mobile_handoff.rb", skip: true
+      end
+
+      def routes
+        source = File.read(File.join(destination_root, "config/routes.rb"))
+        return if source.include?("# AddAuth mobile sessions")
+        route <<~ROUTES
+          # AddAuth mobile sessions
+          post "mobile/session", to: "add_auth/mobile_sessions#create"
+          get "mobile/session", to: "add_auth/mobile_sessions#show"
+          delete "mobile/session", to: "add_auth/mobile_sessions#destroy"
+          get "mobile/sessions", to: "add_auth/mobile_sessions#index"
+          delete "mobile/sessions/:id", to: "add_auth/mobile_sessions#revoke"
+          post "mobile/sessions/revoke-all", to: "add_auth/mobile_sessions#revoke_all"
+          get "mobile/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "mobile"}
+          post "mobile/handoff", to: "add_auth/mobile_sessions#exchange"
+          post "mobile/apple/challenge", to: "add_auth/mobile_sessions#apple_challenge"
+          post "mobile/apple/session", to: "add_auth/mobile_sessions#apple"
+          post "mobile/apple/enrollment", to: "add_auth/mobile_sessions#apple_enroll"
+        ROUTES
+      end
+
+      def configuration
+        copy_file "mobile.rb", "config/initializers/add_auth_mobile.rb", skip: true
+      end
+    end
+  end
+end

data/lib/generators/add_auth/mobile_sessions/templates/add_add_auth_mobile_sessions.rb.tt

@@ -0,0 +1,9 @@
+class AddAddAuthMobileSessions < ActiveRecord::Migration[8.0]
+  def change
+    add_column :sessions, :transport, :string, null: false, default: "browser"
+    add_column :sessions, :client_id, :string
+    add_column :sessions, :mobile_idle_timeout, :integer
+    add_check_constraint :sessions, "transport IN ('browser', 'mobile')", name: "add_auth_session_transport"
+    add_check_constraint :sessions, "transport != 'mobile' OR (client_id IS NOT NULL AND mobile_idle_timeout IS NOT NULL AND mobile_idle_timeout BETWEEN 60 AND 7776000 AND token_digest IS NOT NULL AND authenticated_at IS NOT NULL AND expires_at IS NOT NULL AND last_seen_at IS NOT NULL)", name: "add_auth_mobile_profile"
+  end
+end

data/lib/generators/add_auth/mobile_sessions/templates/add_auth_mobile_handoff.rb

@@ -0,0 +1,5 @@
+class AddAuthMobileHandoff < ApplicationRecord
+  self.filter_attributes += [:external_digest, :digest, :state, :challenge_digest]
+  belongs_to :user, optional: true
+  def inspect = "#<AddAuthMobileHandoff [FILTERED]>"
+end