add_auth 0.2.2 → 0.4.0

data/lib/generators/add_auth/email_link/templates/add_auth_challenge.js

@@ -104,6 +104,7 @@ class ChallengeController extends Controller {
   }
 
   beforeCache() { this.teardown() }
+  restore(event) { if (event.persisted) this.connect() }
   disconnect() { this.teardown() }
   teardown() {
     this.active = false

data/lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt

@@ -1,7 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthSignInTokens < ActiveRecord::Migration[8.0]
   def change
     create_table :add_auth_sign_in_tokens do |t|
-      t.references :user, null: false, foreign_key: true
+      t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), null: false, foreign_key: true
       t.string :digest, limit: 64, null: false
       t.string :identifier_digest, limit: 64, null: false
       t.string :purpose, null: false, default: "sign_in"

data/lib/generators/add_auth/external_identities/external_identities_generator.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    # Optional persistence and routes; provider strategies remain disabled until configured.
+    class ExternalIdentitiesGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_create_add_auth_external_identities.rb")].any?
+          migration_template "create_add_auth_external_identities.rb.tt", "db/migrate/create_add_auth_external_identities.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_external_identity_validity.rb")].any?
+          migration_template "add_add_auth_external_identity_validity.rb.tt", "db/migrate/add_add_auth_external_identity_validity.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_external_enrollment.rb")].any?
+          migration_template "add_add_auth_external_enrollment.rb.tt", "db/migrate/add_add_auth_external_enrollment.rb"
+        end
+        %w[external_identity external_transaction].each do |name|
+          copy_file "add_auth_#{name}.rb", "app/models/add_auth_#{name}.rb", skip: true
+        end
+      end
+
+      def routes
+        source = File.read(File.join(destination_root, "config/routes.rb"))
+        return if source.include?("# AddAuth external provider callbacks")
+
+        route <<~ROUTES
+          # AddAuth external provider callbacks
+          get "account/sign-up/providers/:provider", to: "add_auth/provider_sign_ins#enrollment", defaults: {flow: "enroll"}
+          post "account/sign-up/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "enroll"}
+          post "sign-in/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "sign_in"}
+          post "account/external-identities/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "link"}
+          get "account/external-identities", to: "add_auth/external_identities#index"
+          delete "account/external-identities/:id", to: "add_auth/external_identities#destroy"
+          post "reauthenticate/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "reauthenticate"}
+          match "auth/:provider/callback", to: "add_auth/provider_sign_ins#callback", via: [:get, :post], constraints: AddAuth::Rails::ProviderLibraries::CallbackRoute
+        ROUTES
+      end
+
+      def provider_configuration
+        copy_file "providers.rb", "config/initializers/add_auth_providers.rb", skip: true
+      end
+    end
+  end
+end

data/lib/generators/add_auth/external_identities/templates/add_add_auth_external_enrollment.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthExternalEnrollment < ActiveRecord::Migration[8.0]
+  def change
+    add_column :add_auth_external_transactions, :enrollment_payload, :text
+  end
+end

data/lib/generators/add_auth/external_identities/templates/add_add_auth_external_identity_validity.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthExternalIdentityValidity < ActiveRecord::Migration[8.0]
+  def change
+    add_column :add_auth_external_identities, :invalidated_at, :datetime
+  end
+end

data/lib/generators/add_auth/external_identities/templates/add_auth_external_identity.rb

@@ -0,0 +1,4 @@
+class AddAuthExternalIdentity < ApplicationRecord
+  belongs_to :user
+  def inspect = "#<AddAuthExternalIdentity [FILTERED]>"
+end

data/lib/generators/add_auth/external_identities/templates/add_auth_external_transaction.rb

@@ -0,0 +1,6 @@
+class AddAuthExternalTransaction < ApplicationRecord
+  self.filter_attributes += [:enrollment_payload, :digest, :browser_digest, :session_digest]
+  belongs_to :user, optional: true
+  belongs_to :session, optional: true
+  def inspect = "#<AddAuthExternalTransaction [FILTERED]>"
+end

data/lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt

@@ -0,0 +1,50 @@
+class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
+  def change
+    user_type = reference_type(:users)
+    session_type = reference_type(:sessions)
+    create_table :add_auth_external_identities do |t|
+      t.references :user, type: user_type, null: false, foreign_key: {on_delete: :cascade}
+      # SHA256 of the exact JSON [configuration, issuer, audience, subject].
+      # Indexing this key preserves case-sensitive subjects on either store.
+      t.string :namespace, limit: 64, null: false
+      t.string :provider_id, limit: 2048, null: false
+      t.string :issuer, limit: 2048, null: false
+      t.string :audience, limit: 2048, null: false
+      t.string :subject, limit: 2048, null: false
+      t.string :provenance, limit: 2048, null: false
+      t.string :credential_version, null: false
+      t.datetime :linked_at, null: false
+      t.datetime :revoked_at
+      t.timestamps
+    end
+    add_index :add_auth_external_identities, :namespace, unique: true
+    create_table :add_auth_external_transactions do |t|
+      t.string :digest, null: false
+      t.string :browser_digest, null: false
+      t.string :provider_id, limit: 2048, null: false
+      t.string :issuer, limit: 2048, null: false
+      t.string :audience, limit: 2048, null: false
+      t.string :purpose, null: false
+      t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
+      t.references :session, type: session_type, foreign_key: {on_delete: :cascade}
+      t.string :session_digest
+      t.integer :policy_version
+      t.datetime :issued_at, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.timestamps
+    end
+    add_index :add_auth_external_transactions, :digest, unique: true
+    add_index :add_auth_external_transactions, :expires_at
+    add_column :sessions, :authentication_external_id, :string
+    add_column :sessions, :authentication_external_version, :string
+  end
+
+  private
+
+  def reference_type(table)
+    column = connection.columns(table).find { |item| item.name == connection.primary_key(table) }
+    raise "Unsupported authentication primary key" unless column && [:integer, :uuid].include?(column.type)
+    (column.type == :integer && column.limit == 8) ? :bigint : column.type
+  end
+end

data/lib/generators/add_auth/external_identities/templates/providers.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+# External provider support is opt-in. Add only the provider gems you use to
+# the host application's Gemfile, then configure their OmniAuth middleware
+# using their normal configuration. Reuse existing registrations rather than
+# adding a second OmniAuth::Builder for the same provider. Keep the host's CSRF
+# validator, scopes, request methods and failure handler. AddAuth changes none
+# of them. Keep issuer/audience fixed; never derive them from a request, Host
+# header, profile attribute, or callback parameter.
+#
+# AddAuth's correlation middleware goes before OmniAuth::Builder. It retains
+# opaque Core transaction data only. OmniAuth (or the selected OIDC library)
+# owns code exchange, state, nonce, JWKS/signature, issuer, audience and expiry.
+# Requests without an AddAuth transaction continue through the existing stack.
+# Generated callback routes select only enabled, explicitly registered providers.
+# Review routing precedence before adopting a provider with an existing callback.
+# Custom provider paths/callbacks require an explicit host integration; do not
+# rewrite an existing library configuration to fit this conventional-path example.
+#
+# require "omniauth"
+# require "omniauth-google-oauth2"
+# require "add_auth/rails/provider_libraries/omniauth"
+# require "add_auth/rails/provider_libraries/omniauth_correlation"
+# Rails.application.config.middleware.use AddAuth::Rails::ProviderLibraries::OmniAuthCorrelation,
+#   providers: ["google_oauth2"]
+# Rails.application.config.middleware.use OmniAuth::Builder do
+#   provider :google_oauth2, ENV.fetch("GOOGLE_CLIENT_ID"), ENV.fetch("GOOGLE_CLIENT_SECRET")
+# end
+#
+# verifier = AddAuth::Rails::ProviderLibraries::OmniAuth::Verifier.new(
+#   provider: "google_oauth2", provenance: "omniauth-google-oauth2",
+#   mapping: {issuer: %i[extra id_info iss], audience: %i[extra id_info aud], subject: %i[extra id_info sub],
+#             authenticated_at: %i[extra id_info auth_time]}
+# )
+# AddAuth.configure do |config|
+#   config.external_identities.register(
+#     id: "google", label: "Google", middleware_name: "google_oauth2",
+#     configuration: AddAuth::Core::ExternalIdentities::Configuration.new(
+#       id: "google", issuer: "https://accounts.google.com", audience: ENV.fetch("GOOGLE_CLIENT_ID"), verifier: verifier
+#     )
+#   )
+#   config.external_identities.enabled = true
+# end
+#
+# Apple form_post needs its own callback-only cookie wrapper before
+# OmniAuth::Builder. Do not weaken your normal Rails session cookie:
+#
+# require "omniauth-apple"
+# require "add_auth/rails/provider_libraries/apple_form_post_correlation"
+# Rails.application.config.middleware.use AddAuth::Rails::ProviderLibraries::AppleFormPostCorrelation,
+#   key: Rails.application.key_generator.generate_key("add_auth.apple-form-post.v1", 32)

data/lib/generators/add_auth/feature_configuration.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Generators
+    module FeatureConfiguration
+      private
+
+      def enable_feature(name)
+        path = "config/initializers/add_auth.rb"
+        source = File.read(File.join(destination_root, path))
+        setting = "config.#{name}.enabled"
+        pattern = /^(\s*)(?:# #{Regexp.escape(setting)} = true|#{Regexp.escape(setting)} = false)$/
+        if source.match?(pattern)
+          gsub_file path, pattern, "\\1#{setting} = true"
+        elsif !source.match?(/^\s*#{Regexp.escape(setting)}\s*=/)
+          append_to_file path, "\nAddAuth.configure do |config|\n  #{setting} = true\nend\n"
+        end
+      end
+    end
+  end
+end

data/lib/generators/add_auth/install/templates/initializer.rb

@@ -1,48 +1,156 @@
-# AddAuth configuration. Feature generators enable only their own block.
+# frozen_string_literal: true
+
+# AddAuth settings. Defaults are active; alternatives are commented out.
+# Run the relevant generator and migrations before enabling a feature.
+# Install alone enables no features. Existing initializers are never replaced.
 AddAuth.configure do |config|
-  # Set false for email/passkey-only sign-in. Existing Rails password entry
-  # routes remain guarded; the host owns password reset and account provisioning.
-  # config.passwords_enabled = true
-
-  # BEGIN add_auth session
-  # config.session.enabled = true
-  # END add_auth session
-  # config.session.lifetime = 12.hours
-  # config.session.idle_timeout = 30.minutes
-  # Legacy cookies are rejected by default. Opt into a finite bridge explicitly:
-  # config.session.legacy_bridge_until = Time.iso8601("2026-09-13T00:00:00Z")
-
-  # BEGIN add_auth email_link
-  # config.email_link.enabled = true
-  # END add_auth email_link
-  # config.email_link.token_lifetime = 20.minutes
-  # config.email_link.same_browser = false # true requires the requesting browser
-  # REQUIRED for email delivery: fixed, trusted origin; never derive it from Host.
-  # config.base_url = "https://your-app.example"
-  # config.mail_from = "Your app <sign-in@your-app.example>"
-  # Configure a durable Active Job adapter and schedule add_auth:deliver_pending.
-  # Rails.cache is suitable only with shared atomic increments and expiry.
-  # Solid Cache is not suitable; configure a separate counter store:
-  # https://addauthgem.com/production/#rate-limits
-  # Each maintenance pass handles at most this many rows per operation/model:
-  # config.maintenance.batch_size = 100 # 1..1000
-  # History is retained until the host chooses a retention period (seconds):
-  # config.maintenance.session_retention = 7.days
-  # config.maintenance.email_retention = 7.days
-  # config.maintenance.notification_retention = 30.days
-
-  # Apply the host's current confirmed/locked/disabled policy on every resume:
-  # config.eligible = ->(user) { user.confirmed? && !user.locked? && !user.disabled? }
-
-  # Styling: nil disables CSS; a local path uses your own compiled stylesheet.
-  # config.stylesheet = "/add_auth.css"
-  # config.css_classes = { input: "form-control", button: "btn btn-primary" }
-  # Eject editable templates with bin/rails generate add_auth:views.
-
-  # Enable optional features with add_auth:passkeys, add_auth:step_up,
-  # add_auth:notifications or add_auth:challenge. Install alone enables none.
-  # Passkey recovery needs a host-verified recovery address; strict accounts
-  # use another passkey or the host's support process, never email recovery.
-  # config.challenge = AddAuth::Core::Challenge::Null.new
-  # config.challenge_on = []
+  # Sign-in and rendering. HTML forms work in all browser modes.
+  config.passwords_enabled = true
+  # config.passwords_enabled = false # Use only other explicitly enabled methods.
+  config.turbo_enabled = true
+  # config.turbo_enabled = false # Ordinary JS navigation, with Turbo absent.
+
+  # Host business eligibility is checked alongside Core account policy.
+  config.eligible = ->(_user) { true }
+  # config.eligible = ->(user) { user.access_state == "active" }
+
+  # Browser sessions: bin/rails generate add_auth:session_upgrade
+  config.session.enabled = false
+  config.session.lifetime = 43_200 # 12 hours, absolute expiry.
+  config.session.idle_timeout = 1800 # 30 minutes; no greater than lifetime.
+  config.session.legacy_bridge_until = nil # Reject old Rails session-ID cookies.
+  # config.session.legacy_bridge_until = Time.iso8601("2030-01-01T00:00:00Z")
+  # Choose a short, fixed cutover deadline for a reviewed legacy-cookie bridge.
+
+  # Account lifecycle: bin/rails generate add_auth:accounts
+  # Password-only host: bin/rails generate add_auth:accounts --no-email-link
+  config.lifecycle.enabled = false
+  # config.lifecycle.enabled = true # After policy review and migrations.
+  config.lifecycle.confirmation_required = true
+  # config.lifecycle.confirmation_required = false
+  # false: password signup provisions and signs in immediately, without mail.
+  # confirmed_at stays nil. Requires the add_auth_provisioned_at migration.
+  config.lifecycle.reset_unconfirmed = false
+  # config.lifecycle.reset_unconfirmed = true # Requires optional confirmation.
+  # true: the stored mailbox holder may reset an unconfirmed password account
+  # after consuming an exact-address, single-use reset proof. No automatic login
+  # or confirmation. This does not trust the address for any other recovery.
+  # false: confirm the address before password reset, or use host support.
+  # Email changes always need fresh reauthentication and proof of the new address.
+  config.lifecycle.password_policy = ->(password) { password.length >= 12 && password.bytesize <= 72 }
+  config.lifecycle.eligible = ->(_user) { true } # Additional lifecycle eligibility.
+  config.lifecycle.profile_attributes = ->(_profile) { {} } # Accept no profile fields.
+  # config.lifecycle.profile_attributes = ->(profile) { profile.slice(:name, :consent) }
+  # Also allowlist those fields in the host registration controller. Never roles.
+  config.lifecycle.provision = ->(_user) {} # Local writes in the account transaction.
+  # config.lifecycle.provision = ->(user) { user.create_personal_workspace! }
+  # Raise on failure. Use the same DB pool; remote work needs a host outbox.
+  config.lifecycle.maximum_attempts = 20 # Failed-password threshold: 1..100.
+  config.lifecycle.unlock_in = 3600 # Timed lock: 60..86400 seconds.
+  config.lifecycle.proof_lifetime = 3600 # Account links: 60..86400 seconds.
+  config.lifecycle.remember_lifetime = 1_209_600 # 14 days, absolute expiry.
+  config.lifecycle.remember_idle_timeout = 604_800 # 7 days; <= remember_lifetime.
+  config.lifecycle.deletion_allowed = ->(_user) { true } # Host authorization/retention.
+  # config.lifecycle.deletion_allowed = ->(user) { user.invoices.none? }
+  config.lifecycle.delete_account = ->(user) { user.destroy! } # Same-DB local deletion.
+
+  # Email-link sign-in: bin/rails generate add_auth:email_link
+  # Account confirmation/reset mail does not require email-link sign-in.
+  config.email_link.enabled = false
+  config.email_link.token_lifetime = 1200 # 20 minutes.
+  config.email_link.same_browser = false
+  # config.email_link.same_browser = true # Require the requesting browser.
+
+  # Fresh proof for sensitive actions: bin/rails generate add_auth:step_up
+  # Use --no-email-link for password-only reauthentication.
+  config.step_up.enabled = false
+  config.step_up.fresh_for = 600 # Ordinary proof: 10 minutes.
+  config.step_up.strong_for = 300 # Strong proof: 5 minutes.
+  config.step_up.purposes = {} # Built-in feature purposes are supplied by Core.
+  # config.step_up.purposes = {
+  #   export_data: {methods: [:password], return_to: "/exports/new", label: "export your data"}
+  # }
+  # Recheck elevation and host authorization inside the actual mutation.
+
+  # Passkeys: bin/rails generate add_auth:passkeys
+  config.passkeys.enabled = false
+  config.passkeys.rp_id = nil # Required: stable deployment RP ID.
+  # config.passkeys.rp_id = "example.com"
+  config.passkeys.origins = [] # Required: exact trusted origins, never request Host.
+  # config.passkeys.origins = ["https://app.example.com"]
+  config.passkeys.name = "Your account"
+  config.passkeys.anonymous_limit = 1000 # Shared ceremony budget per five minutes.
+  config.trusted_recovery_address = ->(_user) {} # No trusted recovery by default.
+  # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed_at }
+  # Lifecycle additionally rejects unconfirmed addresses as trusted recovery.
+  config.support_url = nil # Required before strict-policy activation.
+  # config.support_url = "/support" # Document your host-owned recovery process.
+
+  # Security notices: bin/rails generate add_auth:notifications
+  config.notifications.enabled = false
+  # Mail/queue settings also serve account proofs and optional email sign-in.
+  config.base_url = nil # Required for links: fixed trusted HTTPS origin.
+  # config.base_url = "https://app.example.com"
+  config.mail_from = nil # Required for mail; configure SMTP in Rails as usual.
+  # config.mail_from = "Your app <sign-in@example.com>"
+  # Configure a durable Active Job adapter and run add_auth:deliver_pending each minute.
+  config.rate_limit_store = nil # Defaults to Rails.cache; shared atomic counters required.
+  # config.rate_limit_store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV.fetch("AUTH_REDIS_URL"))
+  # Solid Cache can serve application caching, but cannot serve these counters.
+  config.maintenance.batch_size = 100 # Maximum rows per operation/model: 1..1000.
+  config.maintenance.session_retention = nil # Keep history until explicitly selected.
+  config.maintenance.email_retention = nil
+  config.maintenance.notification_retention = nil
+  config.maintenance.account_retention = nil
+  # config.maintenance.session_retention = 604_800 # 7 days, seconds.
+  # config.maintenance.email_retention = 604_800
+  # config.maintenance.notification_retention = 2_592_000 # 30 days.
+  # config.maintenance.account_retention = 604_800
+
+  # Captcha: bin/rails generate add_auth:challenge (provider-specific setup).
+  config.challenge = AddAuth::Core::Challenge::Null.new
+  config.challenge_on = [] # Available: sign_in, email_link, reauthenticate,
+  # passkey_enrollment, register, account_request, provider.
+  # config.challenge_on = [:sign_in, :register, :account_request]
+  config.challenge_when_unavailable = :closed
+  # config.challenge_when_unavailable = :open # Explicit outage bypass; emits an event.
+  # Replace challenge with a configured Turnstile or Recaptcha adapter. Keep
+  # secrets in Rails credentials/environment, and configure expected hostnames.
+
+  # Optional providers: bin/rails generate add_auth:external_identities
+  config.external_identities.enabled = false
+  # Register only reviewed Core provider configurations through
+  # config.external_identities.register(id:, label:, middleware_name:, configuration:,
+  #   apple_form_post: false, reauthentication: false)
+  # or config.external_identities.register_native(configuration:).
+  # The generated add_auth_providers.rb explains provider-library middleware,
+  # verifier and credential setup. It remains commented out until reviewed.
+
+  # Native sessions: bin/rails generate add_auth:mobile_sessions
+  config.mobile.enabled = false
+  config.mobile.lifetime = nil # Required when enabled; choose finite seconds.
+  config.mobile.idle_timeout = nil # Required; <= lifetime.
+  config.mobile.clients = [] # Explicit first-party client identifiers.
+  config.mobile.callbacks = {} # Reviewed callbacks per client, when using handoffs.
+  config.mobile.apple_providers = {} # Native Apple provider IDs per client.
+  # config.mobile.lifetime = 2_592_000 # Example: 30 days.
+  # config.mobile.idle_timeout = 1_209_600 # Example: 14 days.
+  # config.mobile.clients = %w[android ios]
+
+  # Presentation: eject with bin/rails generate add_auth:views.
+  config.stylesheet = "/add_auth.css"
+  # config.stylesheet = nil # Supply your own styling.
+  config.css_classes = {}
+  # config.css_classes = {input: "form-control", button: "btn btn-primary"}
+
+  # Password migration and cryptography: retain Rails' verifier by default.
+  config.legacy_password_verifier = nil
+  config.current_password_support = AddAuth::Core::Passwords::BcryptSupport.new
+  # A custom verifier must also declare current_password_support.available?(digest:).
+  # Rails configures digest_secret from its key generator automatically. Preserve it.
+  # Outside Rails only:
+  # config.digest_secret = -> { ENV.fetch("ADD_AUTH_DIGEST_SECRET") }
+  # Optional adapter overrides must implement digest(token) and matches?(digest, token):
+  # config.session_token_digest = MySessionDigest.new
+  # config.sign_in_token_digest = MyProofDigest.new
 end

data/lib/generators/add_auth/javascript/templates/passkey.js

@@ -4,9 +4,9 @@ import { options, credential } from "/add_auth/codec.js"
 
 export class PasskeyController extends Controller {
   static targets = ["form", "controls", "unavailable", "status", "button"]
-  static values = { optionsUrl: String, finishUrl: String, mode: String, purpose: String, csrf: String, conditional: Boolean }
+  static values = { optionsUrl: String, finishUrl: String, mode: String, purpose: String, csrf: String, conditional: Boolean, turbo: { type: Boolean, default: true } }
   connect() {
-    this.generation = 0
+    this.generation = (this.generation || 0) + 1
     this.active = true
     if (!window.PublicKeyCredential || !navigator.credentials || !window.isSecureContext) return
     this.controlsTarget.hidden = false
@@ -25,13 +25,16 @@ export class PasskeyController extends Controller {
   otherSubmission(event) { if (event.target !== this.formTarget) this.stop() }
   disconnect() { this.active = false; this.stop() }
   beforeCache() { this.active = false; this.stop(); this.controlsTarget.hidden = true; this.unavailableTarget.hidden = false; this.message("") }
+  restore(event) { if (event.persisted) this.connect() }
   async run(conditional) {
     this.stop()
     const generation = this.generation
     this.abort = new AbortController()
     if (!conditional) { this.buttonTarget.disabled = true; this.message("Follow your browser’s passkey prompt.") }
     try {
-      const challenge = new FormData(this.formTarget).get("challenge_token")
+      const form = new FormData(this.formTarget)
+      const challenge = form.get("challenge_token")
+      const remember = form.getAll("remember").at(-1)
       const start = await this.post(this.optionsUrlValue, { purpose: this.purposeValue || null, challenge_token: challenge }, this.abort.signal)
       this.formTarget.dispatchEvent(new CustomEvent("add_auth:proof-used"))
       if (!this.current(generation)) return
@@ -42,7 +45,7 @@ export class PasskeyController extends Controller {
       if (conditional) request.mediation = "conditional"
       const proof = await navigator.credentials[create ? "create" : "get"](request)
       if (!this.current(generation)) return
-      const result = await this.post(this.finishUrlValue, { transaction: this.transaction, credential: credential(proof) }, this.abort.signal)
+      const result = await this.post(this.finishUrlValue, { transaction: this.transaction, credential: credential(proof), remember }, this.abort.signal)
       if (!this.current(generation)) return
       this.transaction = null
       this.navigate(result.redirect)
@@ -76,6 +79,6 @@ export class PasskeyController extends Controller {
   }
   current(generation) { return this.active && this.element.isConnected && this.generation === generation }
   message(text) { this.statusTarget.textContent = text; this.statusTarget.hidden = !text }
-  navigate(path) { if (path) window.Turbo ? window.Turbo.visit(path) : window.location.assign(path) }
+  navigate(path) { if (path) (this.turboValue && window.Turbo) ? window.Turbo.visit(path) : window.location.assign(path) }
 }
 application.register("add-auth-passkey", PasskeyController)

data/lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module AddAuth
+  module Generators
+    class MobileSessionsGenerator < ::Rails::Generators::Base
+      include ::Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
+
+      def persistence
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_mobile_sessions.rb")].any?
+          migration_template "add_add_auth_mobile_sessions.rb.tt", "db/migrate/add_add_auth_mobile_sessions.rb"
+        end
+        unless Dir[File.join(destination_root, "db/migrate/*_create_add_auth_mobile_handoffs.rb")].any?
+          migration_template "create_add_auth_mobile_handoffs.rb.tt", "db/migrate/create_add_auth_mobile_handoffs.rb"
+        end
+        copy_file "add_auth_mobile_handoff.rb", "app/models/add_auth_mobile_handoff.rb", skip: true
+      end
+
+      def routes
+        source = File.read(File.join(destination_root, "config/routes.rb"))
+        return if source.include?("# AddAuth mobile sessions")
+        route <<~ROUTES
+          # AddAuth mobile sessions
+          post "mobile/session", to: "add_auth/mobile_sessions#create"
+          get "mobile/session", to: "add_auth/mobile_sessions#show"
+          delete "mobile/session", to: "add_auth/mobile_sessions#destroy"
+          get "mobile/sessions", to: "add_auth/mobile_sessions#index"
+          delete "mobile/sessions/:id", to: "add_auth/mobile_sessions#revoke"
+          post "mobile/sessions/revoke-all", to: "add_auth/mobile_sessions#revoke_all"
+          get "mobile/providers/:provider", to: "add_auth/provider_sign_ins#prepare", defaults: {flow: "mobile"}
+          post "mobile/handoff", to: "add_auth/mobile_sessions#exchange"
+          post "mobile/apple/challenge", to: "add_auth/mobile_sessions#apple_challenge"
+          post "mobile/apple/session", to: "add_auth/mobile_sessions#apple"
+          post "mobile/apple/enrollment", to: "add_auth/mobile_sessions#apple_enroll"
+        ROUTES
+      end
+
+      def configuration
+        copy_file "mobile.rb", "config/initializers/add_auth_mobile.rb", skip: true
+      end
+    end
+  end
+end

data/lib/generators/add_auth/mobile_sessions/templates/add_add_auth_mobile_sessions.rb.tt

@@ -0,0 +1,9 @@
+class AddAddAuthMobileSessions < ActiveRecord::Migration[8.0]
+  def change
+    add_column :sessions, :transport, :string, null: false, default: "browser"
+    add_column :sessions, :client_id, :string
+    add_column :sessions, :mobile_idle_timeout, :integer
+    add_check_constraint :sessions, "transport IN ('browser', 'mobile')", name: "add_auth_session_transport"
+    add_check_constraint :sessions, "transport != 'mobile' OR (client_id IS NOT NULL AND mobile_idle_timeout IS NOT NULL AND mobile_idle_timeout BETWEEN 60 AND 7776000 AND token_digest IS NOT NULL AND authenticated_at IS NOT NULL AND expires_at IS NOT NULL AND last_seen_at IS NOT NULL)", name: "add_auth_mobile_profile"
+  end
+end

data/lib/generators/add_auth/mobile_sessions/templates/add_auth_mobile_handoff.rb

@@ -0,0 +1,5 @@
+class AddAuthMobileHandoff < ApplicationRecord
+  self.filter_attributes += [:external_digest, :digest, :state, :challenge_digest]
+  belongs_to :user, optional: true
+  def inspect = "#<AddAuthMobileHandoff [FILTERED]>"
+end

data/lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt

@@ -0,0 +1,27 @@
+class CreateAddAuthMobileHandoffs < ActiveRecord::Migration[8.0]
+  def change
+    user_key = connection.columns(:users).find { |column| column.name == connection.primary_key(:users) }
+    raise "Unsupported authentication primary key" unless user_key && [:integer, :uuid].include?(user_key.type)
+    user_type = (user_key.type == :integer && user_key.limit == 8) ? :bigint : user_key.type
+    create_table :add_auth_mobile_handoffs do |t|
+      t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
+      t.string :external_digest, null: false
+      t.string :digest
+      t.string :client_id, limit: 64, null: false
+      t.string :callback, limit: 2048, null: false
+      t.string :state, limit: 128, null: false
+      t.string :challenge_digest, null: false
+      t.string :credential_id
+      t.string :credential_version
+      t.integer :policy_version
+      t.datetime :authenticated_at
+      t.datetime :issued_at, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+      t.timestamps
+    end
+    add_index :add_auth_mobile_handoffs, :external_digest, unique: true
+    add_index :add_auth_mobile_handoffs, :digest, unique: true
+    add_index :add_auth_mobile_handoffs, :expires_at
+  end
+end

data/lib/generators/add_auth/mobile_sessions/templates/mobile.rb

@@ -0,0 +1,8 @@
+# Mobile sessions are optional and remain disabled after generating persistence.
+# Review the host/client timeout policy before enabling. These are example values.
+# AddAuth.configure do |config|
+#   config.mobile.lifetime = 30 * 86_400
+#   config.mobile.idle_timeout = 14 * 86_400
+#   config.mobile.clients = %w[android ios]
+#   config.mobile.enabled = true
+# end

data/lib/generators/add_auth/notifications/notifications_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class NotificationsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
@@ -21,10 +23,7 @@ module AddAuth
       end
 
       def configuration
-        path = "config/initializers/add_auth.rb"
-        unless File.read(File.join(destination_root, path)).include?("config.notifications.enabled = true")
-          append_to_file path, "\nAddAuth.configure do |config|\n  config.notifications.enabled = true\nend\n"
-        end
+        enable_feature(:notifications)
         say "Migrate, configure mail_from and a durable queue, and schedule add_auth:deliver_pending every minute."
       end
     end

data/lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt

@@ -1,7 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthSecurityEvents < ActiveRecord::Migration[8.0]
   def change
     create_table :add_auth_security_events do |t|
-      t.references :user, foreign_key: {on_delete: :nullify}
+      t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), foreign_key: {on_delete: :nullify}
       t.string :kind, null: false
       t.string :digest, null: false
       t.text :delivery_payload