add_auth 0.2.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb4c1fc11f2a73f54a42c1bc5379f328d63e4e3cf4124f83ceaa87187ee04ed8
-  data.tar.gz: bb0c1cf6c79e629cf3257a161c867dc0ea722596ccebe6a9b4dd609881e2be6a
+  metadata.gz: 1ed4ef07ed6308f6bb4b82de3e67552af3604472f38e7a379f1d9c863f76954e
+  data.tar.gz: 8189c0ddf517a9d06d291738e0d0d20bb383ffc9a7fdd085c9df33ad914312d4
 SHA512:
-  metadata.gz: b9cf550a17e5736ac23be86f151571b6434949c137295c9e12489cead2ba5393d26bb2652c50469eb40775dcb85e8b937bbf1a0fbe5d2359b9d07172efa94fa3
-  data.tar.gz: 76d3b435c7f3f6994f639a9d397cba861d1e25071a6143a121d596549c85e9736c5d4a0a54caff1bf7f05e77a8b168915e909002aef847aaaf41d406547de308
+  metadata.gz: 643216bb646e0ca6032f0b53f1928eb6da0b4efeffccadd8477fbb7776f6aa411c6ecf36bb4c3f785d94fa435320c04745a2565c70cef47e387f14fc534b805b
+  data.tar.gz: 48375790d81d186fa5cfd6f4f3ecf4672c46b2ec8602a3597c5a40b69562661212de41f5df8676a7080ef96ab36915af6dec798400aa97610b5b3c22d76be2d4

data/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.4.0 — 2026-09-13
+
+- Constrain JSON below 3.0 for the supported Rails decoding API; independently
+  installed hosts must be able to decrypt account and email proof deliveries.
+
+- Add explicit optional password-signup confirmation with atomic provisioning and
+  initial session issuance. Unverified email stays unverified; required
+  confirmation remains the default.
+- Add an independent opt-in for single-use password reset proofs to unconfirmed
+  password accounts, retaining account restrictions and authority revocation.
+- Allow password-only lifecycle/step-up generation without enabling email sign-in.
+- Expand the generated Rails initializer with executable defaults and commented
+  alternatives. Feature generators update their own setting in that file.
+
+## 0.3.0 — 2026-09-09
+
+Optional account lifecycle, bounded Devise migration and native authentication.
+The standard Rails-generator installation remains supported; enable only the
+additional capabilities your host needs. The latest-0.x support policy continues.
+
+- Add read-only Devise inventory, additive account preparation, explicit legacy
+  password adoption and retired-source write fences. Preserve account IDs and
+  reject ambiguous identifier/credential conversions.
+- Add optional registration, confirmation/reconfirmation, reset, lock/unlock,
+  account changes and remembered sessions with shared Core policy and delivery.
+- Integrate maintained provider libraries without owning their registrations,
+  protocol exchange, unrelated routes or provider API credentials. Preserve
+  identity ownership and require independent enrollment confirmation.
+- Add opt-in finite native sessions, account-scoped revocation, S256-bound
+  single-use browser handoffs and optional nonce-bound Apple token verification.
+  Mobile duration settings are separate from browser settings; refresh-token
+  families are not part of this finite profile.
+- Verify generated/ejected pages with Turbo, ordinary JavaScript without Turbo
+  and permitted no-JS. Add populated migration, checkpoint, compatibility
+  rollback, provider and native integration fixtures.
+
 ## 0.2.2 — 2026-09-08
 
 - Reject Solid Cache as an authentication rate-limit store: simultaneous first

data/README.md

@@ -1,6 +1,6 @@
 # AddAuth
 
-**0.2.1:** password, email-link and passkey sign-in extend
+Password, email-link and passkey sign-in extend
 Rails' generated authentication. AddAuth adds hardened sessions, verification
 for sensitive actions, passkey management and email recovery with an optional
 strict policy. Turnstile and reCAPTCHA integrations are available. See
@@ -9,27 +9,46 @@ strict policy. Turnstile and reCAPTCHA integrations are available. See
 AddAuth builds on top of Rails 8's built-in login system instead of
 replacing it -- it keeps using your existing `User` and `Session` models.
 
+Introduced in 0.3.0: optional account lifecycle, bounded Devise migration,
+provider-library integration and finite Android/iOS sessions. See the
+[migration guide](https://addauthgem.com/migrating-from-devise/) before changing
+an existing Devise app; do not run the Rails generator over its custom files.
+
 Read the [documentation](https://addauthgem.com) for setup guides, configuration
 reference and troubleshooting.
 
+## Configuration and optional signup confirmation
+
+Version 0.4.0 adds optional password-signup confirmation and a
+complete, commented [Rails initializer](lib/generators/add_auth/install/templates/initializer.rb).
+Its default assignments are active; opt-in alternatives are commented out.
+Required confirmation remains the default. See the [configuration guide](https://addauthgem.com/configuration/)
+and [account setup](https://addauthgem.com/configuration-preview/), or the
+[contributor rehearsal](CONTRIBUTING.md#optional-confirmation-integration-rehearsal)
+for verification in a disposable host.
+
 ## Quickstart
 
+These commands target 0.4.0 and are available after its
+[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.4.0).
+Check package availability before changing your app’s bundle.
+
 Install the `add_auth` gem from RubyGems through your Rails app’s Gemfile,
 then enable password and email-link sign-in. Use Ruby 3.3+ and Rails 8.0+
 with Active Record, and run the commands below from your Rails app’s root.
 
-**Release availability:** these commands require the published `0.2.1` package.
+**Release availability:** these commands require the published `0.4.0` package.
 If it is not yet listed on [RubyGems](https://rubygems.org/gems/add_auth/versions),
 wait for publication; see [release status](https://addauthgem.com/release-status/).
 Start in your app’s development environment; use the deployment settings
 below before enabling sign-in for users.
 
 1. Keep `source "https://rubygems.org"` in your app’s Gemfile and add the
-   0.2 release line:
+   0.4 release line:
 
    ```ruby
    # Gemfile
-   gem "add_auth", "~> 0.2.1"
+   gem "add_auth", "~> 0.4.0"
    ```
 
    Bundler downloads the package from RubyGems and records the resolved
@@ -39,17 +58,26 @@ below before enabling sign-in for users.
    bundle install
    ```
 
-2. If your app doesn't already have Rails' built-in login system, add it
-   first:
+2. For a fresh app without an existing authentication system, generate
+   Rails' built-in login system:
 
    ```sh
    bin/rails generate authentication
    ```
 
-3. Add AddAuth:
+3. Create your configuration file:
 
    ```sh
    bin/rails generate add_auth:install
+   ```
+
+   Open `config/initializers/add_auth.rb`. Defaults are active and optional
+   alternatives are commented out. This command enables no features and preserves
+   an existing initializer. Each feature section names its generator.
+
+4. Enable password and email-link sign-in:
+
+   ```sh
    bin/rails generate add_auth:email_link
    bin/rails db:migrate
    ```
@@ -58,7 +86,7 @@ below before enabling sign-in for users.
    in, plus a page where a signed-in user can see their active sessions and
    sign out of one remotely.
 
-4. Set these values in `config/initializers/add_auth.rb`:
+5. Set these values in `config/initializers/add_auth.rb`:
 
    ```ruby
    AddAuth.configure do |config|
@@ -78,7 +106,7 @@ below before enabling sign-in for users.
    config.action_mailer.raise_delivery_errors = true
    ```
 
-5. Create a trial account in `bin/rails console` using your own test address and
+6. Create a trial account in `bin/rails console` using your own test address and
    password, then start `bin/rails server` and visit `/sign-in`. Request a link
    for that account and open the message written under `tmp/mail`. Treat these
    local messages as credentials and delete them after testing. Raw sign-in
@@ -533,14 +561,33 @@ or recovery procedures work in production.
 
 ## Scope
 
-AddAuth 0.2 implements password/email/passkey sign-in, session
-adoption and management, purpose-bound verification, passkey recovery and
-strict account policy, durable security mail, and challenge adapters. Account
-provisioning, address confirmation and password reset remain host responsibilities.
-Release acceptance uses local real-database, generated-host, browser and
-SMTP/queue/cache tests. Hosts verify their own live providers and supported
-physical devices before deployment. Recovery codes and AddAuth-owned password
-policy remain deferred.
+AddAuth implements password/email/passkey sign-in, session adoption and
+management, purpose-bound verification, passkey recovery and strict account
+policy, durable security mail and challenge adapters. Optional account lifecycle
+adds registration, confirmation/reconfirmation, password reset, lock/unlock and
+account changes. Hosts retain account eligibility, resource authorization and
+provider registrations.
+
+## Optional integrations in 0.3.0
+
+Enable bounded [Devise migration](https://addauthgem.com/migrating-from-devise/),
+[account lifecycle](https://addauthgem.com/account-lifecycle/),
+[provider sign-in](https://addauthgem.com/omniauth/) and
+[Android/iOS sessions](https://addauthgem.com/mobile-authentication/) independently.
+Provider protocol handling stays with maintained libraries. Native sessions use
+finite expiry; the verified profile is 30 days absolute and 14 days idle, with
+fresh sign-in after expiry. Refresh-token families are not included.
+
+Migration evidence covers the documented Devise 5.0.4 source profiles, including
+integer and UUID accounts; it does not establish universal Devise-module parity.
+Preserve current credentials and revocations during cutover and compatible
+rollback. Follow the migration guide before removing Devise or retiring columns.
+
+Release acceptance uses local real-database, generated-host, browser,
+SMTP/queue/cache and native-consumer tests. Hosts verify their own live providers
+and supported physical devices before deployment. Recovery codes and multiple
+realms remain deferred. See [ROADMAP.md](ROADMAP.md) for scope and progress, and
+[CONTRIBUTING.md](CONTRIBUTING.md) for synthetic acceptance commands.
 
 ## Roadmap
 

data/ROADMAP.md

@@ -4,15 +4,17 @@ AddAuth extends Rails 8's authentication generator with email-link sign-in,
 passkeys, purpose-bound reauthentication, hardened sessions and pluggable captcha.
 It reuses the host's accounts and Session model.
 
-**Reviewed 2026-09-07: 0.2.1 is published, and the planned v1 strategy features
-have shipped.** The next work makes adoption, upgrades and the future 1.0 support
-commitment clearer. Milestones below describe priorities, not promised dates or
-versions. See [release status](https://addauthgem.com/release-status/),
-[the changelog](CHANGELOG.md) and [the manual](https://addauthgem.com/).
+**Reviewed 2026-09-13.** Check [published releases](https://github.com/taimoorq/add_auth/releases) for package availability and provenance. This checklist distinguishes verified implementation from publication.
+It adds the bounded Devise migration, optional account lifecycle, provider-library
+integration and finite native authentication below. Required PR and exact
+release-commit CI/CodeQL, protected OIDC publication, downloaded-package comparison
+and fresh-host installation passed. The matching migration and native guides are
+published in [the manual](https://addauthgem.com/).
 
-**0.2.2 is prepared locally, not published.** It contains the counter-store
-correction and upgrade/operations coverage described below. The owner selected
-this patch before accepting the proposed 1.0 commitment.
+The original strategy baseline shipped in 0.2.1; 0.2.2 supplied the counter-store
+correction. The separate 1.0 support commitment remains under review. Milestones
+describe priorities, not promised dates. See [release status](https://addauthgem.com/release-status/)
+and [the changelog](CHANGELOG.md).
 
 An unchecked item is remaining work; deferred candidates need a scope decision
 before implementation. Checked features have passing relevant acceptance specs.
@@ -21,13 +23,18 @@ can describe tested local work; release/publication remains a separate gate. Det
 design and decision records remain in the companion private planning workspace;
 this public checklist is derived from its section 14 and stands on its own.
 
-## Now — maintain 0.2 and learn from adoption
+## Now — maintain AddAuth and learn from adoption
 
-- [ ] **R1 · Resolve the outstanding dependency update.** Review
-      [actions/checkout PR #1](https://github.com/taimoorq/add_auth/pull/1) against
-      current master. Its old failed Ruby checks need current evidence; retain
-      immutable action pins and all merge/release protections. Record a merge,
-      replacement or reasoned deferral.
+- [x] Optional password-signup confirmation, immediate transactional provisioning
+  and session issuance, explicit unconfirmed-reset policy, password-only lifecycle
+  and the complete commented Rails initializer. Local supported-matrix, stock/
+  adopted-host, UUID PostgreSQL and three-mode bundled/ejected acceptance passes.
+  Added in the 0.4.0 source; see [release availability and provenance](https://github.com/taimoorq/add_auth/releases).
+
+- [x] **R1 · Resolve the outstanding dependency update.**
+      [PR #9](https://github.com/taimoorq/add_auth/pull/9) updates the immutable
+      checkout pin to 7.0.1 with current required checks passing. Old Dependabot
+      PR #1 is closed as superseded. All merge/release protections remain in force.
 - [x] **R1 · Complete the 2026-09-07 currency review.** Review Rails/Ruby support,
       authentication APIs, WebAuthn, advisories and the competitive landscape
       before the next version bump; repeat the standing review at least quarterly.
@@ -45,14 +52,14 @@ this public checklist is derived from its section 14 and stands on its own.
       quickstart, doctor and troubleshooting guidance with exact prerequisites,
       observable success and recovery steps. Keep the public manual tied to the
       published package. Upgrade, compatibility, cache and ejection guidance is
-      prepared locally; build and browser checks pass. Publication is pending.
+      published for 0.2.2; build, browser and live deployment checks pass.
 
-The current master CI and CodeQL runs pass. The post-publication
+The exact 0.2.2 release commit passed the full CI matrix and CodeQL. The post-publication
 passwordless-fixture isolation failure is fixed in
 [PR #8](https://github.com/taimoorq/add_auth/pull/8); it is not an open runtime
 defect or a reason by itself to republish 0.2.1.
 
-## Next — prove upgrades, plan migrations and define the 1.0 contract
+## Roadmap — migration delivery and the future 1.0 contract
 
 - [x] **R3 · Rehearse an upgrade from published 0.2.1.** Start with a populated
       host, active sessions, passkeys, strict accounts, pending mail and customized
@@ -67,8 +74,8 @@ defect or a reason by itself to republish 0.2.1.
       whether Solid Cache meets atomic rate-limit increment/TTL requirements;
       document a tested separate store if needed. Publish only verified adapter
       support. Solid Queue 1.7.0 passes with a separate queue database. Solid
-      Cache 1.0.10 loses concurrent first increments on PostgreSQL; the pending
-      fix rejects it for abuse counters and documents a separate Redis store.
+      Cache 1.0.10 loses concurrent first increments on PostgreSQL; 0.2.2
+      rejects it for abuse counters and documents a separate Redis store.
 - [x] **R4 · Measure bounded maintenance and recovery.** Record workload,
       query counts, backlog drain and latency for session pages, outbox retries
       and cleanup. Use those measurements to explain batch sizing, retention,
@@ -79,51 +86,99 @@ defect or a reason by itself to republish 0.2.1.
       Core/host hooks and Results, routes, generators/ejection metadata, testing
       helpers and redacted events. Distinguish internal APIs and document
       compatibility, deprecation and migration rules. The current integration
-      reference and proposed contract are prepared; owner acceptance of the
-      1.0 commitment remains the separate item below.
+      reference is published; the proposed 1.0 contract remains for owner
+      review under the separate item below.
 - [ ] **R5 · Set the 1.0 support policy.** Specify supported runtime/database
       combinations and security-supported release lines. Publish an upgrade
       guide and evidence-backed troubleshooting updates before the candidate
       freezes. The current latest-0.x policy remains in
       [SECURITY.md](SECURITY.md).
-- [ ] **R8 · Define Devise migration readiness.** Inventory source versions,
+- [x] **R8 · Define Devise migration readiness.** Inventory source versions,
       modules, extensions and customizations; provide a read-only preflight with
       supported mappings, prerequisites and actionable blockers. Running Rails 8
       alone does not establish the authentication contracts AddAuth needs.
-- [ ] **R8 · Provide a path for Rails-aligned Devise apps.** Reuse verified
+- [x] **R8 · Provide a path for Rails-aligned Devise apps.** Reuse verified
       account/session contracts and preserve host customizations while replacing
       remaining Devise authentication wiring. Prove password compatibility,
       account restrictions, session/token revocation and safe cutover/rollback.
-- [ ] **R8 · Provide a path for standard or customized Devise apps.** Guide an
+- [x] **R8 · Provide a path for standard or customized Devise apps.** Guide an
       additive conversion from existing models, identifiers, password storage
       and controllers to the supported Rails contracts. Preserve account IDs and
       associations; resolve incompatible hashes, identifier collisions and
       unsupported module policies before cutover. Include older-runtime
       prerequisites and host-owned lifecycle replacements where needed.
-- [ ] **R8 · Rehearse and document both migration paths.** Test populated Devise
+- [x] **R8 · Add optional account lifecycle support.** Registration,
+      confirmation/reconfirmation, password reset, lock/unlock and account
+      changes must preserve ownership, account policy and session revocation.
+- [x] **R8 · Preserve provider sign-in through maintained libraries.** Add
+      optional OmniAuth integration with verified identity binding, explicit
+      linking/unlinking and usable recovery for provider-only accounts.
+      Preserve host-owned OAuth configuration, routes and other provider flows;
+      delegate protocol work to the selected libraries.
+- [x] **R8 · Rehearse both migration paths and draft the guides.** Test populated Devise
       hosts before and after migration, including custom schema, peppered
       passwords, denied accounts, interrupted conversion and rollback. Verify
-      supported database/runtime and Turbo/no-JS journeys, publish step-by-step
-      guides and prove the destination works with Devise removed.
+      supported database/runtime, ordinary HTML with JavaScript and Turbo absent,
+      Turbo enhancement and permitted no-JS journeys. Draft step-by-step guides
+      and prove the destination works with Devise removed.
+- [x] **R8 · Publish migration and native guides with the feature release.**
+      The 0.3.0 package, installation commands, HTTPS and deep links are verified;
+      the six guides now describe the published release.
+
+Version 0.3.0 verifies preflight, optional account lifecycle and
+provider-library integration across the supported Ruby/Rails matrix, including
+ordinary HTML, Turbo and permitted no-JS journeys. These additions ship in 0.3.0. Migration/checkpoint/compatible-rollback tests and native client
+acceptance are complete locally. The full adopter suite passes 1,330 examples
+with zero failures and three existing empty scaffold examples pending. Six
+published guides pass build, browser, keyboard and no-JS checks. The proposed
+1.0 commitment remains a separate gate.
+
+## Shipped in 0.3.0 — Android and iOS login
+
+Mobile support ships as an optional integration in 0.3.0. These capabilities extend the
+same account and session policies. The verified finite profile uses explicit
+30-day absolute and 14-day idle limits, with fresh sign-in after expiry. Renewable
+refresh-token families remain a distinct optional capability, not implemented in this release.
+The published 0.3.0 package and installed native-consumer contracts are verified.
+
+- [x] **R8 · Password and provider login for native clients.** Return credentials
+      over authenticated HTTPS responses; preserve supported client contracts.
+- [x] **R8 · Secure browser-to-app sign-in handoffs.** Short-lived, single-use
+      codes bound to state and a verifier, exact callback validation, and native
+      Apple nonce verification; no reusable bearer tokens in callback URLs.
+- [x] **R8 · Device sessions and revocation.** Expiring, digested API credentials,
+      cookie/bearer separation, device listing, current-device and all-device
+      logout, and invalidation on password/account changes. Evaluate optional
+      renewal with rotation and replay detection as a distinct profile.
+- [x] **R8 · Android/iOS migration acceptance.** Test secure client storage,
+      cancellation/restarts, account switching, expiry and concurrent handoffs,
+      plus supported old/new client combinations. Android/iOS consumers also
+      pass against an installed gem in an isolated Rails adopter over local HTTPS.
 
 Each change owns its tests and keeps intermediate releases usable. R3/R4 findings
 feed R5. A patch may address compatible corrections; another 0.x minor is possible
 if integration contracts change. A 0.3 release is not a prerequisite for 1.0.
-R8 is planned after the prepared 0.2.2 correction; its supported source profiles
-and delivery version will be decided during discovery, with public API impact
-resolved before R5 freezes. Devise migration support is not available yet.
+R8 ships in 0.3.0 after the published 0.2.2 correction; its supported source profiles
+are bounded to the verified Devise 5.0.4 fixtures. The selected delivery version is 0.3.0. Its pre-1.0 integration contracts
+remain subject to review before R5 freezes. The bounded Devise migration guide is available for 0.3.0.
+
+## Delivery — 0.3.0 feature release, then the proposed 1.0 gate
 
-## Delivery — 0.2.2 first, then the proposed 1.0 gate
+- [x] Select 0.3.0 for the locally verified migration, lifecycle, provider and native scope.
+- [x] Pass required PR and exact default-branch CI/CodeQL for 0.3.0.
+- [x] Publish 0.3.0 through protected OIDC and verify the downloaded package and manual.
 
-- [ ] **R6 · Deliver the prepared 0.2.2 correction.** Commit and review the
-      tested changes, pass current required GitHub checks, publish through
-      protected OIDC, verify the registry package in a fresh host and publish
-      the matching manual. Preserve the existing latest-0.x support policy.
+- [x] **R6 · Deliver the 0.2.2 correction.**
+      [PR #10](https://github.com/taimoorq/add_auth/pull/10) passed all required
+      checks, followed by exact default-branch CI and protected OIDC publication.
+      The downloaded package checksum and all 121 files match the reviewed
+      candidate; fresh-host installation and the matching public manual pass.
+      The existing latest-0.x support policy remains in effect.
 
 - [ ] **R6 · Finish the adoption and compatibility review.** R1–R5 findings are
       completed or explicitly dispositioned, the supported API is accepted, and
       the published-package upgrade and documented operations profile pass.
-- [ ] **R6 · Verify the exact candidate.** Preserve the complete local
+- [ ] **R6 · Verify the exact 1.0 candidate.** Preserve the complete local
       Ruby/Rails, SQLite/PostgreSQL, generated/ejected browser and operations
       acceptance; resolve release-blocking security and upgrade findings.
       Recheck dependency currency and pass required GitHub CI/CodeQL controls.
@@ -160,19 +215,19 @@ compatible extension could ship in 1.x after an explicit scope decision.
       before implementation; codes must not silently satisfy passkey-only purposes.
 - [ ] **F2 · Rails-native password hashing integration.** Recheck available Rails
       support and real adopter needs before adding an adapter or changing a default.
-- [ ] **F3 · Account lifecycle helpers.** Evaluate registration, confirmation,
-      reset, lockout and password policy individually against repeated needs.
-      Current host password integration already ships.
+- [ ] **F3 · Account lifecycle helpers.** The bounded migration requirements
+      are promoted to R8 above; broader module parity remains outside this scope.
 - [ ] **F4 · Multiple realms.** Require a concrete identity/session-isolation need
       and migration design before adding models, cookies or routing APIs.
-- [ ] **F4 · API/token authentication.** Decide separately from browser sessions
-      and realms; require a real non-browser client use case.
+- [ ] **F4 · API/token authentication.** Android/iOS login shipped under R8
+      above; multiple realms and general API-key management remain separate.
 - [ ] **F5 · Standalone test helpers or challenge adapters.** Extract only if
       independent demand and maintenance capacity justify another package;
       retain one implementation per concern.
 
-Social/OIDC, SMS/TOTP and enterprise or cross-origin WebAuthn are outside the
-current roadmap. Account roles, invitations, authorization and email branding
+Optional provider-library integration ships under R8 in 0.3.0. SMS/TOTP and enterprise
+or cross-origin WebAuthn remain outside the current roadmap. Account roles,
+invitations, authorization and email branding
 stay with the host.
 
 ## Shipped — 0.2.1 baseline

data/SECURITY.md

@@ -34,6 +34,14 @@ mailing list, or social media) until a fix has been released.
   replacement handling.
 - Bounded session listing and authentication-history cleanup, including account
   scoping, eligibility rechecks and active-delivery-lease protection.
+- Optional account lifecycle and migration boundaries: credential
+  profile selection, source-write fencing, address ownership, account proofs,
+  policy and revocation. These capabilities are introduced in 0.3.0; 0.4.0 adds
+  optional confirmation, atomic signup provisioning/session issuance and the
+  independent unconfirmed-password-reset policy.
+- Optional provider identity binding and mobile sessions/handoffs, including
+  nonce/client/purpose binding, exact callbacks, single use and bearer/cookie
+  separation. Provider protocol cryptography remains library-owned.
 - The generated controllers and views this gem ships,
   including their CSRF, enumeration-safety, and Turbo-Stream behavior.
 - The GitHub Actions release pipeline (`.github/workflows/push_gem.yml`) and

data/app/controllers/add_auth/accounts_controller.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    layout "add_auth/authentication"
+    helper AddAuth::SignInsHelper
+    before_action :require_feature
+    before_action :private_response
+    before_action :require_add_auth_authentication, only: %i[edit_email change_email edit_password change_password confirm_deletion destroy]
+    protect_from_forgery with: :exception
+    rescue_from AddAuth::Error, "ActiveJob::EnqueueError", with: :service_unavailable
+
+    def new = page("register")
+    def check_email = page("check_email")
+
+    def create
+      admitted = intake(:register)
+      return intake_failure(admitted) if admitted.is_a?(Symbol)
+      accounts = Rails::Runtime.accounts
+      result = accounts.register(identifier: admitted, password: params[:password], profile: registration_profile,
+        replacing: add_auth_replacement_session, **add_auth_session_hints)
+      if result.success?
+        if result.grant
+          destination = after_authentication_url
+          add_auth_accept(result.grant)
+          redirect_to destination, status: :see_other
+        else
+          redirect_to accounts.registration_next_path, status: :see_other
+        end
+      else
+        @error = "Check your email and choose a password that meets this application's requirements."
+        page("register", status: :unprocessable_entity)
+      end
+    end
+
+    def request_form
+      @purpose = purpose
+      page("request")
+    end
+
+    def request_proof
+      @purpose = purpose
+      admitted = intake(:account_request)
+      return intake_failure(admitted) if %i[challenge_rejected challenge_unavailable].include?(admitted)
+      Rails::Runtime.enqueue_account_request(identifier: admitted, purpose: @purpose) unless admitted.is_a?(Symbol)
+      redirect_to "/account/check-email", status: :see_other
+    end
+
+    def proof
+      @purpose = purpose
+      result = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+      page(result.success? ? "proof" : "invalid_proof")
+    end
+
+    def consume
+      @purpose = purpose
+      admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :account_consume)
+      return intake_failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password])
+      if result.success?
+        redirect_to "/sign-in", status: :see_other, notice: "Your account has been updated. Sign in to start a new session."
+      else
+        @error = "This request could not be completed. Check the password requirements or request a new link."
+        page("proof", status: :unprocessable_entity)
+      end
+    end
+
+    def edit_email = page("email")
+    def edit_password = page("password")
+    def confirm_deletion = page("delete")
+
+    def destroy
+      result = Rails::Runtime.accounts.delete_account(user: Current.user, session: Current.session)
+      if result.success?
+        terminate_session
+        redirect_to "/sign-in", status: :see_other, notice: "Your account was deleted."
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=delete_account", status: :see_other
+      else
+        @error = "Your account could not be deleted. Contact support if this continues."
+        page("delete", status: :unprocessable_entity)
+      end
+    end
+
+    def change_password
+      result = Rails::Runtime.accounts.change_password(user: Current.user, session: Current.session, password: params[:password])
+      if result.success?
+        terminate_session
+        redirect_to "/sign-in", status: :see_other, notice: "Your password was changed. Sign in with your new password."
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=change_password", status: :see_other
+      else
+        @error = "This password cannot be used. Check the password requirements and try again."
+        page("password", status: :unprocessable_entity)
+      end
+    end
+
+    def change_email
+      result = Rails::Runtime.accounts.change_email(user: Current.user, session: Current.session, identifier: params[:email_address])
+      if result.success?
+        redirect_to "/account/check-email", status: :see_other
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=change_email", status: :see_other
+      else
+        @error = "This email address cannot be used. Check it and try again."
+        page("email", status: :unprocessable_entity)
+      end
+    end
+
+    private
+
+    # Host controllers may override with an explicit Rails parameter allowlist.
+    # The default does not forward arbitrary account/role parameters.
+    def registration_profile = {}
+
+    def require_feature
+      head :not_found unless AddAuth.configuration.lifecycle.enabled
+    end
+
+    def purpose
+      Core::AccountLifecycle::PURPOSES.include?(params[:purpose]) ? params[:purpose] : "confirm"
+    end
+
+    def intake(action)
+      Rails::Runtime.intake.call(identifier: params[:email_address], ip: request.remote_ip, action: action, challenge_token: challenge_token)
+    end
+
+    def authentication_partial(partial) = "add_auth/accounts/#{partial}"
+
+    def service_unavailable
+      @error = "Account requests are temporarily unavailable. Please try again shortly."
+      response.set_header("Retry-After", "60")
+      page("unavailable", status: :service_unavailable)
+    end
+
+    def intake_failure(reason)
+      @error = "This request could not be verified. Please try again shortly."
+      status = {rate_limited: :too_many_requests, challenge_unavailable: :service_unavailable}.fetch(reason, :unprocessable_entity)
+      response.set_header("Retry-After", "300") if %i[too_many_requests service_unavailable].include?(status)
+      page("unavailable", status: status)
+    end
+  end
+end

data/app/controllers/add_auth/assets_controller.rb

@@ -20,7 +20,8 @@ module AddAuth
     end
 
     def boot
-      source = 'if (!window.Turbo) await import("/add_auth/turbo.js"); await import("/add_auth/challenge.js");'
+      source = Rails::Runtime.config.turbo_enabled ? 'if (!window.Turbo) await import("/add_auth/turbo.js");' : ""
+      source += ' await import("/add_auth/challenge.js");'
       source += ' await import("/add_auth/passkey.js");' if Rails::Runtime.config.passkeys.enabled
       render body: source, content_type: "text/javascript"
     end