add_auth 0.2.2 → 0.4.0

data/lib/generators/add_auth/passkeys/passkeys_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class PasskeysGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
@@ -47,27 +49,7 @@ module AddAuth
             post "recover/link", to: "add_auth/recoveries#confirm"
           ROUTES
         end
-        path = "config/initializers/add_auth.rb"
-        unless File.read(File.join(destination_root, path)).include?("config.passkeys.enabled = true")
-          append_to_file path, <<~CONFIG
-
-            AddAuth.configure do |config|
-              config.passkeys.enabled = true
-              # REQUIRED: stable RP ID and exact deployment origins, never request Host.
-              # config.passkeys.rp_id = "example.com"
-              # config.passkeys.origins = ["https://app.example.com"]
-              # config.passkeys.name = "Your app"
-              # Shared anonymous ceremony budget per five minutes; positive integer.
-              # config.passkeys.anonymous_limit = 1000
-              # Schedule add_auth:deliver_pending every minute. Production doctor
-              # requires a completed cleanup within the last two minutes.
-              # REQUIRED for email replacement: a host-verified recovery address.
-              # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed? }
-              # REQUIRED before strict activation: your documented support route.
-              # config.support_url = "/support"
-            end
-          CONFIG
-        end
+        enable_feature(:passkeys)
         say "Review and migrate before enabling traffic. Configure RP/origins, trusted recovery and notifications; run add_auth:doctor."
       end
     end

data/lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt

@@ -1,5 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
   def change
+    user_key_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    session_key_type = AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true)
     # Rails 8.0 cannot reflect SQLite's FALSE literal emitted by Rails 8.1.
     # Keep the additive schema readable by both supported Rails lines.
     false_default = (connection.adapter_name == "SQLite") ? -> { "0" } : false
@@ -11,7 +15,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_credential_id, :string
     add_column :sessions, :authentication_uv, :boolean, default: false_default, null: false
     create_table :add_auth_credentials do |t|
-      t.references :user, null: false, foreign_key: {on_delete: :cascade}
+      t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :external_id, null: false
       t.text :public_key, null: false
       t.bigint :sign_count, default: 0, null: false
@@ -31,8 +35,8 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
       t.string :kind, null: false
       t.string :browser_digest, null: false
       t.string :configuration_digest, null: false
-      t.references :user, foreign_key: {on_delete: :cascade}
-      t.references :session, foreign_key: {on_delete: :cascade}
+      t.references :user, type: user_key_type, foreign_key: {on_delete: :cascade}
+      t.references :session, type: session_key_type, foreign_key: {on_delete: :cascade}
       t.string :session_digest
       t.string :authentication_purpose
       t.datetime :expires_at, null: false

data/lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class SessionUpgradeGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
 
@@ -62,7 +64,7 @@ module AddAuth
         unless File.read(File.join(destination_root, path)).include?('require "add_auth/rails/authentication"')
           prepend_to_file path, %(require "add_auth/rails/authentication"\nrequire "add_auth/rails/user_lifecycle"\n)
         end
-        gsub_file path, "# config.session.enabled = true", "config.session.enabled = true"
+        enable_feature(:session)
         routes = File.join(destination_root, "config/routes.rb")
         source = File.read(routes)
         unless source.include?("# AddAuth session management")

data/lib/generators/add_auth/step_up/step_up_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class StepUpGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
+      class_option :email_link, type: :boolean, default: true, desc: "Enable email sign-in alongside reauthentication"
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
 
       def dependencies
-        invoke "add_auth:email_link"
+        invoke "add_auth:email_link", [], enable: options[:email_link]
       end
 
       def persistence
@@ -33,10 +36,7 @@ module AddAuth
             post "reauthenticate/link", to: "add_auth/reauthentications#confirm"
           ROUTES
         end
-        initializer = "config/initializers/add_auth.rb"
-        unless File.read(File.join(destination_root, initializer)).include?("config.step_up.enabled = true")
-          append_to_file initializer, "\nAddAuth.configure do |config|\n  config.step_up.enabled = true\n  # Declare purpose methods and a fixed safe GET return_to before use.\nend\n"
-        end
+        enable_feature(:step_up)
         say "Migrate and declare config.step_up.purposes. Use with_elevated_session around sensitive database mutations."
       end
     end

data/lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt

@@ -1,8 +1,10 @@
+require "add_auth/rails/migration/key_type"
+
 class AddAddAuthReauthentication < ActiveRecord::Migration[8.0]
   def change
     add_column :sessions, :elevation_version, :string
     add_column :sessions, :elevation_expires_at, :datetime
-    add_reference :add_auth_sign_in_tokens, :session, foreign_key: {on_delete: :cascade}
+    add_reference :add_auth_sign_in_tokens, :session, type: AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true), foreign_key: {on_delete: :cascade}
     add_column :add_auth_sign_in_tokens, :session_digest, :string
     add_column :add_auth_sign_in_tokens, :authentication_purpose, :string
   end

data/lib/tasks/add_auth.rake

@@ -1,6 +1,20 @@
 # frozen_string_literal: true
 
 namespace :add_auth do
+  desc "Read-only Devise inventory in an isolated local test/development host"
+  task devise_preflight: :environment do
+    require "json"
+    require "add_auth/rails/migration/effective_inventory"
+    begin
+      report = AddAuth::Rails::Migration::EffectiveInventory.new.call
+      puts JSON.pretty_generate(report)
+      abort "Inventory is incomplete; resolve the reported bounds before migration." unless report.dig(:facts, :complete)
+    rescue
+      # Host exception text may contain query values or secret configuration.
+      abort "Effective inventory failed. Use an isolated local Devise host with one SQLite/PostgreSQL pool and no surrounding transaction."
+    end
+  end
+
   desc "Check installed AddAuth authentication, delivery and maintenance wiring"
   task doctor: :environment do
     require "add_auth/rails/doctor"
@@ -19,13 +33,16 @@ namespace :add_auth do
     require "add_auth/rails/stores/maintenance"
     models = {}
     models[:session] = ::Session if AddAuth.configuration.session.enabled && defined?(::Session)
+    models[:external_transaction] = ::AddAuthExternalTransaction if defined?(::AddAuthExternalTransaction)
+    models[:mobile_handoff] = ::AddAuthMobileHandoff if defined?(::AddAuthMobileHandoff)
     models[:ceremony] = ::AddAuthCeremony if defined?(::AddAuthCeremony)
     models[:email] = ::AddAuthSignInToken if defined?(::AddAuthSignInToken)
     models[:notification] = ::AddAuthSecurityEvent if defined?(::AddAuthSecurityEvent)
+    models[:account] = ::AddAuthAccountToken if defined?(::AddAuthAccountToken)
     stores = models.filter_map do |kind, model|
       [kind, AddAuth::Rails::Stores::Maintenance.new(model: model, kind: kind)] if model.table_exists?
     end.to_h
-    jobs = {email: AddAuth::EmailDeliveryJob, notification: AddAuth::SecurityNotificationJob}
+    jobs = {email: AddAuth::EmailDeliveryJob, notification: AddAuth::SecurityNotificationJob, account: AddAuth::AccountDeliveryJob}
     enqueue = lambda do |kind, id|
       raise AddAuth::Error, "maintenance enqueue failed" unless jobs.fetch(kind).perform_later(id)
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: add_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Taimoor Qureshi
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: webauthn
   requirement: !ruby/object:Gem::Requirement
@@ -203,10 +217,13 @@ description: |
   reauthentication and recovery. It adds hardened sessions, security mail and
   challenge providers, with shared Turbo/HTML pages and permitted no-JavaScript
   alternatives. It upgrades the generated User and Session models in place.
+  Optional account lifecycle, Devise migration, provider-library integration
+  and finite native sessions share the same account and session policies.
   Documentation: https://addauthgem.com.
 email:
 - taimoorq@gmail.com
-executables: []
+executables:
+- add_auth-preflight
 extensions: []
 extra_rdoc_files: []
 files:
@@ -216,24 +233,46 @@ files:
 - README.md
 - ROADMAP.md
 - SECURITY.md
+- app/controllers/add_auth/accounts_controller.rb
 - app/controllers/add_auth/assets_controller.rb
+- app/controllers/add_auth/external_identities_controller.rb
+- app/controllers/add_auth/mobile_sessions_controller.rb
 - app/controllers/add_auth/passkeys_controller.rb
+- app/controllers/add_auth/provider_sign_ins_controller.rb
 - app/controllers/add_auth/reauthentications_controller.rb
 - app/controllers/add_auth/recoveries_controller.rb
 - app/controllers/add_auth/sessions_controller.rb
 - app/controllers/add_auth/sign_ins_controller.rb
 - app/helpers/add_auth/sign_ins_helper.rb
 - app/javascript/controllers/.keep
+- app/jobs/add_auth/account_delivery_job.rb
+- app/jobs/add_auth/account_request_job.rb
 - app/jobs/add_auth/delivery_job.rb
 - app/jobs/add_auth/email_delivery_job.rb
 - app/jobs/add_auth/email_request_job.rb
 - app/jobs/add_auth/security_notification_job.rb
+- app/mailers/add_auth/account_mailer.rb
 - app/mailers/add_auth/security_mailer.rb
 - app/mailers/add_auth/sign_in_mailer.rb
 - app/models/concerns/.keep
 - app/views/.keep
+- app/views/add_auth/account_mailer/link.text.erb
+- app/views/add_auth/accounts/_check_email.html.erb
+- app/views/add_auth/accounts/_delete.html.erb
+- app/views/add_auth/accounts/_email.html.erb
+- app/views/add_auth/accounts/_invalid_proof.html.erb
+- app/views/add_auth/accounts/_password.html.erb
+- app/views/add_auth/accounts/_proof.html.erb
+- app/views/add_auth/accounts/_register.html.erb
+- app/views/add_auth/accounts/_request.html.erb
+- app/views/add_auth/accounts/_unavailable.html.erb
+- app/views/add_auth/external_identities/_index.html.erb
+- app/views/add_auth/external_identities/_unavailable.html.erb
 - app/views/add_auth/passkeys/_controls.html.erb
 - app/views/add_auth/passkeys/_list.html.erb
+- app/views/add_auth/provider_sign_ins/_enrollment.html.erb
+- app/views/add_auth/provider_sign_ins/_failure.html.erb
+- app/views/add_auth/provider_sign_ins/_prepare.html.erb
 - app/views/add_auth/reauthentications/_check_email.html.erb
 - app/views/add_auth/reauthentications/_confirmation.html.erb
 - app/views/add_auth/reauthentications/_different_browser.html.erb
@@ -253,11 +292,15 @@ files:
 - app/views/add_auth/sign_ins/_different_browser.html.erb
 - app/views/add_auth/sign_ins/_form.html.erb
 - app/views/add_auth/sign_ins/_invalid_link.html.erb
+- app/views/add_auth/sign_ins/_remember.html.erb
 - app/views/add_auth/sign_ins/show.html.erb
 - app/views/layouts/add_auth/authentication.html.erb
+- exe/add_auth-preflight
 - lib/add_auth.rb
 - lib/add_auth/configuration.rb
 - lib/add_auth/core/access_policy.rb
+- lib/add_auth/core/account_lifecycle.rb
+- lib/add_auth/core/account_policy.rb
 - lib/add_auth/core/browser_binding.rb
 - lib/add_auth/core/challenge/base.rb
 - lib/add_auth/core/challenge/http.rb
@@ -268,14 +311,30 @@ files:
 - lib/add_auth/core/delivery.rb
 - lib/add_auth/core/digest/base.rb
 - lib/add_auth/core/digest/hmac.rb
+- lib/add_auth/core/external_identities.rb
+- lib/add_auth/core/external_identities/evidence.rb
 - lib/add_auth/core/intake.rb
 - lib/add_auth/core/maintenance.rb
+- lib/add_auth/core/migration/account_adoption.rb
+- lib/add_auth/core/migration/readiness.rb
+- lib/add_auth/core/mobile_authentication.rb
+- lib/add_auth/core/mobile_handoffs.rb
+- lib/add_auth/core/mobile_profile.rb
+- lib/add_auth/core/mobile_response.rb
+- lib/add_auth/core/native_authentication.rb
+- lib/add_auth/core/passwords/bcrypt_support.rb
+- lib/add_auth/core/passwords/credential.rb
+- lib/add_auth/core/passwords/legacy_bcrypt.rb
+- lib/add_auth/core/passwords/lifecycle.rb
 - lib/add_auth/core/rate_limit.rb
+- lib/add_auth/core/remaining_factors.rb
 - lib/add_auth/core/security_events.rb
 - lib/add_auth/core/sessions.rb
 - lib/add_auth/core/step_up.rb
 - lib/add_auth/core/strategies/email_link.rb
 - lib/add_auth/core/strategies/passkey.rb
+- lib/add_auth/migration/static_inventory.rb
+- lib/add_auth/rails/account_password_entry.rb
 - lib/add_auth/rails/authentication.rb
 - lib/add_auth/rails/authentication_pages.rb
 - lib/add_auth/rails/delivery_cipher.rb
@@ -283,13 +342,33 @@ files:
 - lib/add_auth/rails/ejection.rb
 - lib/add_auth/rails/elevation.rb
 - lib/add_auth/rails/engine.rb
+- lib/add_auth/rails/migration/account_store.rb
+- lib/add_auth/rails/migration/effective_inventory.rb
+- lib/add_auth/rails/migration/key_type.rb
+- lib/add_auth/rails/migration/source_bridge.rb
+- lib/add_auth/rails/password_adoption.rb
 - lib/add_auth/rails/password_entry.rb
+- lib/add_auth/rails/provider_enrollment.rb
+- lib/add_auth/rails/provider_libraries/apple_form_post_correlation.rb
+- lib/add_auth/rails/provider_libraries/apple_jwks.rb
+- lib/add_auth/rails/provider_libraries/apple_native.rb
+- lib/add_auth/rails/provider_libraries/callback_route.rb
+- lib/add_auth/rails/provider_libraries/omniauth.rb
+- lib/add_auth/rails/provider_libraries/omniauth_correlation.rb
+- lib/add_auth/rails/provider_libraries/openid_connect.rb
+- lib/add_auth/rails/provider_libraries/request_protection.rb
 - lib/add_auth/rails/rate_limit_cache.rb
 - lib/add_auth/rails/runtime.rb
+- lib/add_auth/rails/stores/account_credentials.rb
 - lib/add_auth/rails/stores/account_lock.rb
+- lib/add_auth/rails/stores/account_tokens.rb
+- lib/add_auth/rails/stores/authority.rb
+- lib/add_auth/rails/stores/commit_dispatch.rb
 - lib/add_auth/rails/stores/delivery_state.rb
 - lib/add_auth/rails/stores/email_tokens.rb
+- lib/add_auth/rails/stores/external_identities.rb
 - lib/add_auth/rails/stores/maintenance.rb
+- lib/add_auth/rails/stores/mobile_handoffs.rb
 - lib/add_auth/rails/stores/passkeys.rb
 - lib/add_auth/rails/stores/security_events.rb
 - lib/add_auth/rails/stores/sessions.rb
@@ -297,10 +376,17 @@ files:
 - lib/add_auth/result.rb
 - lib/add_auth/testing.rb
 - lib/add_auth/version.rb
+- lib/generators/add_auth/accounts/accounts_generator.rb
+- lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt
+- lib/generators/add_auth/accounts/templates/add_add_auth_provisioning.rb.tt
+- lib/generators/add_auth/accounts/templates/add_auth_account_token.rb
+- lib/generators/add_auth/accounts/templates/add_auth_address_claim.rb
 - lib/generators/add_auth/challenge/challenge_generator.rb
 - lib/generators/add_auth/challenge/templates/recaptcha.rb.tt
 - lib/generators/add_auth/challenge/templates/turnstile.rb.tt
 - lib/generators/add_auth/controllers/controllers_generator.rb
+- lib/generators/add_auth/devise_accounts/devise_accounts_generator.rb
+- lib/generators/add_auth/devise_accounts/templates/prepare_add_auth_devise_accounts.rb.tt
 - lib/generators/add_auth/ejection.rb
 - lib/generators/add_auth/email_link/email_link_generator.rb
 - lib/generators/add_auth/email_link/templates/add_add_auth_email_binding.rb.tt
@@ -310,6 +396,14 @@ files:
 - lib/generators/add_auth/email_tokens/email_tokens_generator.rb
 - lib/generators/add_auth/email_tokens/templates/add_auth_sign_in_token.rb
 - lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt
+- lib/generators/add_auth/external_identities/external_identities_generator.rb
+- lib/generators/add_auth/external_identities/templates/add_add_auth_external_enrollment.rb.tt
+- lib/generators/add_auth/external_identities/templates/add_add_auth_external_identity_validity.rb.tt
+- lib/generators/add_auth/external_identities/templates/add_auth_external_identity.rb
+- lib/generators/add_auth/external_identities/templates/add_auth_external_transaction.rb
+- lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt
+- lib/generators/add_auth/external_identities/templates/providers.rb
+- lib/generators/add_auth/feature_configuration.rb
 - lib/generators/add_auth/install/install_generator.rb
 - lib/generators/add_auth/install/templates/initializer.rb
 - lib/generators/add_auth/javascript/javascript_generator.rb
@@ -317,6 +411,11 @@ files:
 - lib/generators/add_auth/javascript/templates/codec.js
 - lib/generators/add_auth/javascript/templates/passkey.js
 - lib/generators/add_auth/mailer_views/mailer_views_generator.rb
+- lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb
+- lib/generators/add_auth/mobile_sessions/templates/add_add_auth_mobile_sessions.rb.tt
+- lib/generators/add_auth/mobile_sessions/templates/add_auth_mobile_handoff.rb
+- lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt
+- lib/generators/add_auth/mobile_sessions/templates/mobile.rb
 - lib/generators/add_auth/notifications/notifications_generator.rb
 - lib/generators/add_auth/notifications/templates/add_auth_security_event.rb
 - lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt