add_auth 0.2.2 → 0.4.0

data/lib/add_auth/core/sessions.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "securerandom"
+require "add_auth/core/mobile_profile"
 
 module AddAuth
   module Core
@@ -10,14 +11,15 @@ module AddAuth
       end
       class Entry
         attr_reader :id, :current, :authenticated_with, :authenticated_at, :created_at,
-          :last_seen_at, :expires_at, :ip_address, :user_agent
+          :last_seen_at, :expires_at, :ip_address, :user_agent, :transport, :client_id
 
         def initialize(id:, current:, authenticated_with:, authenticated_at:, created_at:,
-          last_seen_at:, expires_at:, ip_address:, user_agent:)
+          last_seen_at:, expires_at:, ip_address:, user_agent:, transport: "browser", client_id: nil)
           @id, @current, @authenticated_with, @authenticated_at, @created_at = id, current,
             authenticated_with, authenticated_at, created_at
           @last_seen_at, @expires_at, @ip_address, @user_agent = last_seen_at, expires_at,
             ip_address, user_agent
+          @transport, @client_id = transport, client_id
         end
 
         def inspect = "#<AddAuth::Core::Sessions::Entry id=#{id} current=#{current.inspect}>"
@@ -27,7 +29,7 @@ module AddAuth
       Page = Struct.new(:entries, :next_cursor)
 
       def initialize(store:, digest:, eligible:, lifetime: 43_200, idle_timeout: 1800,
-        legacy_bridge_until: nil, clock: Time, access_policy: nil)
+        legacy_bridge_until: nil, clock: Time, access_policy: nil, password_lifecycle: nil, remembered_profile: nil, mobile_profile: nil, on_sign_in: nil, verified_denial: nil)
         unless [lifetime, idle_timeout].all? { |n| n.is_a?(Numeric) && n.finite? && n.positive? } && idle_timeout <= lifetime
           raise ArgumentError, "session timeouts must be positive and idle_timeout <= lifetime"
         end
@@ -36,7 +38,19 @@ module AddAuth
         end
         @store, @digest, @eligible, @clock = store, digest, eligible, clock
         @access_policy = access_policy
+        @password_lifecycle = password_lifecycle
+        @on_sign_in = on_sign_in
+        @verified_denial = verified_denial
+        raise ArgumentError, "invalid mobile profile" unless mobile_profile.nil? || mobile_profile.is_a?(MobileProfile)
+        @mobile = mobile_profile
         @lifetime, @idle, @deadline = lifetime, idle_timeout, legacy_bridge_until
+        if remembered_profile
+          values = remembered_profile.values_at(:lifetime, :idle_timeout)
+          unless values.all? { |n| n.is_a?(Numeric) && n.finite? && n.between?(60, 90 * 86_400) } && values.last <= values.first
+            raise ArgumentError, "remembered session timeouts must be bounded and idle_timeout <= lifetime"
+          end
+          @remembered = remembered_profile.slice(:lifetime, :idle_timeout).freeze
+        end
       end
 
       def start(user:, method:, replacing: nil, **hints)
@@ -50,36 +64,72 @@ module AddAuth
         end
       end
 
-      def authenticate(identifier:, password:, replacing: nil, **hints)
+      def authenticate(**arguments, &verify)
+        result = authenticate_result(**arguments, &verify)
+        result.grant if result.success?
+      end
+
+      def authenticate_result(identifier:, password:, replacing: nil, disclose_policy: false, **hints)
         @store.with_identifier(identifier: identifier, replacing: replacing) do |user|
+          @password_lifecycle&.prepare(user: user)
           verified = yield
-          create_in_transaction(user: user, method: :password, replacing: replacing, **hints) if user && verified && verified.id == user.id
+          valid = user && verified && verified.id == user.id && verified.password_digest == user.password_digest
+          denial = @verified_denial&.call(user) if valid && disclose_policy
+          valid = @password_lifecycle.verified(user: user, password: password, valid: !!valid) if @password_lifecycle
+          grant = create_in_transaction(user: user, method: :password, replacing: replacing, **hints) if valid
+          if grant
+            Result.success(user: user, strategy: :password, session: grant.session, grant: grant)
+          else
+            Result.failure(reason: %i[unconfirmed locked disabled].include?(denial) ? denial : :invalid_credentials)
+          end
         end
       end
 
       # Runs inside the store's account transaction. When replacing a browser,
       # that session's account must also be locked on the same connection.
-      def create_in_transaction(user:, method:, persist: nil, replacing: nil, proof: nil, **hints)
+      def create_in_transaction(user:, method:, persist: nil, replacing: nil, proof: nil, remember: false, transport: :browser, client_id: nil, **hints)
         return unless user && @eligible.call(user) == true
-        raise ArgumentError, "unsupported proof" unless %w[password email_link passkey].include?(method.to_s)
+        supported_transport = transport == :browser || (transport == :mobile && @mobile&.client?(client_id))
+        return unless supported_transport
+        return if transport == :mobile && replacing
+        raise ArgumentError, "unsupported proof" unless %w[password email_link passkey external_identity].include?(method.to_s)
         return if @access_policy && !@access_policy.sign_in_allowed?(user, method)
         if method.to_s == "passkey"
           return unless proof.is_a?(StepUp::Evidence) && proof.strong? && proof.user_id == user.id &&
             proof.verified_at <= @clock.now && proof.verified_at > @clock.now - 300
         end
+        if method.to_s == "external_identity"
+          return unless @access_policy && proof.is_a?(ExternalIdentities::SessionProof) && proof.user_id == user.id &&
+            proof.verified_at <= @clock.now && proof.verified_at > @clock.now - 300 &&
+            @access_policy.external_credential_current?(user: user, id: proof.credential_id, version: proof.credential_version)
+          hints = hints.merge(authentication_external_id: proof.credential_id,
+            authentication_external_version: proof.credential_version)
+        end
         if user.respond_to?(:add_auth_policy_version)
           hints = hints.merge(authentication_policy_version: @access_policy ? @access_policy.version(user) : user.add_auth_policy_version,
             authentication_credential_id: proof&.credential_id, authentication_uv: proof&.user_verification || false)
         end
-        raw = bearer
+        raw = (transport == :mobile) ? @mobile.bearer : bearer
         now = @clock.now
         if replacing
           prior = @store.find_for_user_in_transaction(user_id: replacing.user_id, session_id: replacing.id)
           @store.update(prior, revoked_at: now) if prior && !prior.revoked_at && prior.token_digest == replacing.token_digest
         end
         writer = persist || ->(**attributes) { @store.create(user: user, **attributes) }
+        duration = @lifetime
+        if @remembered
+          remembered = remember == true
+          duration = @remembered.fetch(:lifetime) if remembered
+          hints = hints.merge(remembered: remembered, idle_timeout: remembered ? @remembered.fetch(:idle_timeout) : @idle)
+        end
+        if transport == :mobile
+          duration = @mobile.lifetime
+          hints = hints.merge(transport: "mobile", client_id: client_id, mobile_idle_timeout: @mobile.idle_timeout)
+          hints[:remembered] = false if @remembered
+        end
         row = writer.call(token_digest: @digest.digest(raw), authenticated_with: method.to_s,
-          authenticated_at: now, expires_at: now + @lifetime, last_seen_at: now, **hints)
+          authenticated_at: now, expires_at: now + duration, last_seen_at: now, **hints)
+        @on_sign_in&.call(user: user, session: row, at: now)
         Grant.new(session: row, bearer: raw)
       end
 
@@ -90,7 +140,7 @@ module AddAuth
         legacy = lookup.key?(:id)
         @store.with_session(**lookup) do |user, row|
           now = @clock.now
-          next unless live?(user, row, now: now)
+          next unless transport_for(row) == "browser" && live?(user, row, now: now)
           if legacy
             next if row.token_digest || now >= @deadline
             raw = bearer
@@ -104,13 +154,25 @@ module AddAuth
         end
       end
 
+      # Only the exact Authorization bearer value enters this parser. Cookies,
+      # query parameters and legacy host API tokens are not alternate inputs.
+      def resume_mobile(bearer:)
+        return unless @mobile && bearer.is_a?(String) && MobileProfile::PATTERN.match?(bearer)
+        @store.with_session(digest: @digest.digest(bearer)) do |user, row|
+          now = @clock.now
+          next unless transport_for(row) == "mobile" && live?(user, row, now: now)
+          @store.update(row, last_seen_at: now) if row.last_seen_at <= now - 60
+          Grant.new(session: row)
+        end
+      end
+
       # A trusted cookie identifies what to retire, even if that account is now
       # ineligible. This snapshot is replacement input, never authentication.
       def replacement_for(signed_value:)
         lookup = cookie_lookup(signed_value)
         return unless lookup
         @store.with_session(**lookup) do |_user, row|
-          row unless lookup.key?(:id) && row&.token_digest
+          row if transport_for(row) == "browser" && !(lookup.key?(:id) && row&.token_digest)
         end
       end
 
@@ -134,7 +196,7 @@ module AddAuth
         now = @clock.now
         candidates = @store.list_for_user(user_id: user.id, before: before&.to_i,
           excluding: current_session_id, limit: PAGE_SIZE + 1, now: now,
-          active_after: now - @idle, legacy: !!(@deadline && now < @deadline))
+          active_after: now - [@idle, @remembered&.fetch(:idle_timeout) || @idle, @mobile&.idle_timeout || @idle].max, legacy: !!(@deadline && now < @deadline))
         cursor = candidates[PAGE_SIZE - 1].id if candidates.length > PAGE_SIZE
         rows = candidates.first(PAGE_SIZE)
         if before.nil? && current_session_id
@@ -147,7 +209,8 @@ module AddAuth
           Entry.new(id: row.id, current: row.id == current_session_id,
             authenticated_with: row.authenticated_with, authenticated_at: row.authenticated_at,
             created_at: row.created_at, last_seen_at: row.last_seen_at, expires_at: row.expires_at,
-            ip_address: row.ip_address, user_agent: row.user_agent)
+            ip_address: row.ip_address, user_agent: row.user_agent,
+            transport: transport_for(row), client_id: row.respond_to?(:client_id) ? row.client_id : nil)
         end
         Page.new(entries: entries, next_cursor: cursor)
       end
@@ -169,8 +232,11 @@ module AddAuth
       def reauthenticate(user:, session:, purpose:, policy:)
         with_live_session(user: user, session: session) do |account, row, _now|
           next Result.failure(reason: :elevation_required) if @access_policy && !@access_policy.sign_in_allowed?(account, :password)
+          @password_lifecycle&.prepare(user: account)
           verified = yield account
-          next Result.failure(reason: :invalid_credentials) unless verified && verified.id == account.id
+          valid = verified && verified.id == account.id && verified.password_digest == account.password_digest
+          valid = @password_lifecycle.verified(user: account, password: nil, valid: !!valid, rehash: false) if @password_lifecycle
+          next Result.failure(reason: :invalid_credentials) unless valid
           evidence = StepUp::Evidence.new(user_id: account.id, session_id: row.id,
             method: :password, verified_at: @clock.now, session_digest: row.token_digest,
             credential_version: policy.password_version(account))
@@ -202,7 +268,7 @@ module AddAuth
         row = current_in_transaction(user: user, session: session)
         return unless row && grant.is_a?(StepUp::Grant) && grant.valid_for?(user: user,
           user_id: user.id, session_id: row.id, session_digest: row.token_digest, purpose: grant.purpose, now: @clock.now)
-        raw = bearer
+        raw = (transport_for(row) == "mobile") ? @mobile.bearer : bearer
         attributes = {token_digest: @digest.digest(raw), elevated_at: grant.verified_at,
                       elevated_with: grant.method.to_s, elevation_purpose: grant.purpose.to_s,
                       elevation_credential_id: grant.credential_id, elevation_uv: grant.user_verification,
@@ -232,7 +298,9 @@ module AddAuth
         now = @clock.now
         return Result.failure(reason: :elevation_required) unless row&.respond_to?(:elevation_version) && row.elevated_at &&
           row.elevation_purpose == purpose.to_s && row.elevation_expires_at && now < row.elevation_expires_at
-        evidence = StepUp::Evidence.new(user_id: user.id, session_id: row.id,
+        evidence_class = (row.elevated_with == "external_identity") ? StepUp::ExternalEvidence : StepUp::Evidence
+        extra = (row.elevated_with == "external_identity") ? {purpose: purpose} : {}
+        evidence = evidence_class.send(:new, **extra, user_id: user.id, session_id: row.id,
           method: row.elevated_with, verified_at: row.elevated_at, session_digest: row.token_digest,
           credential_id: row.elevation_credential_id, user_verification: row.elevation_uv,
           credential_version: row.elevation_version)
@@ -277,10 +345,27 @@ module AddAuth
         return false unless user && row && @eligible.call(user) == true && !row.revoked_at
         return false if @access_policy && !@access_policy.session_allowed?(user, row)
         legacy = !row.token_digest && @deadline && now < @deadline
+        idle = @idle
+        if transport_for(row) == "mobile"
+          return false unless @mobile&.client?(row.client_id) && row.token_digest
+          stored_idle = row.mobile_idle_timeout
+          return false unless stored_idle.is_a?(Integer) && stored_idle.between?(60, 90 * 86_400)
+          idle = [stored_idle, @mobile.idle_timeout].min
+          return false unless row.authenticated_at && (row.authenticated_at + @mobile.lifetime > now)
+        elsif transport_for(row) != "browser"
+          return false
+        elsif @remembered && row.respond_to?(:remembered) && row.remembered == true
+          stored_idle = row.idle_timeout
+          return false unless stored_idle.is_a?(Numeric) && stored_idle.finite? && stored_idle.positive?
+          idle = [stored_idle, @remembered.fetch(:idle_timeout)].min
+          return false unless row.authenticated_at && row.authenticated_at + @remembered.fetch(:lifetime) > now
+        end
         (legacy || (row.expires_at && row.last_seen_at)) &&
-          (!row.expires_at || row.expires_at > now) && (!row.last_seen_at || row.last_seen_at > now - @idle)
+          (!row.expires_at || row.expires_at > now) && (!row.last_seen_at || row.last_seen_at > now - idle)
       end
 
+      def transport_for(row) = row.respond_to?(:transport) ? row.transport : "browser"
+
       def bearer = "lk1:#{SecureRandom.urlsafe_base64(32)}"
     end
   end

data/lib/add_auth/core/step_up.rb

@@ -5,7 +5,7 @@ module AddAuth
     # Evidence is issued by a trusted verifier, never deserialized from a client.
     # A grant retains that verifier's current policy and the proof's original age.
     class StepUp
-      METHODS = %i[password email_link passkey].freeze
+      METHODS = %i[password email_link passkey external_identity].freeze
 
       class Evidence
         attr_reader :user_id, :session_id, :method, :verified_at, :credential_id,
@@ -28,6 +28,15 @@ module AddAuth
         def inspect = "#<AddAuth::Core::StepUp::Evidence [FILTERED]>"
       end
 
+      class ExternalEvidence < Evidence
+        attr_reader :purpose
+        def initialize(purpose:, **attributes)
+          @purpose = purpose.to_sym
+          super(**attributes)
+        end
+        private_class_method :new
+      end
+
       class Grant
         attr_reader :purpose, :expires_at
         def initialize(evidence:, purpose:, expires_at:, policy:)
@@ -117,6 +126,9 @@ module AddAuth
         return false if rule.require_passkey && !evidence.strong?
         return false unless evidence.session_digest.is_a?(String) && !evidence.session_digest.empty?
         return false if evidence.method == :passkey && !evidence.strong?
+        if evidence.method == :external_identity
+          return false unless evidence.is_a?(ExternalEvidence) && evidence.purpose == purpose.to_sym
+        end
         if evidence.method == :password
           return false unless evidence.credential_version.is_a?(String) && !evidence.credential_version.empty?
           return false unless user.respond_to?(:password_digest) && password_version(user) == evidence.credential_version

data/lib/add_auth/migration/static_inventory.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "ripper"
+require "pathname"
+require "add_auth/core/migration/readiness"
+
+module AddAuth
+  module Migration
+    # Reads a bounded set of source files as data. Never require/load/eval a host.
+    class StaticInventory
+      MAX_FILES = 2000
+      MAX_BYTES = 1_048_576
+      TOTAL_BYTES = 16 * 1_048_576
+      PATTERNS = %w[app/models/**/*.rb app/controllers/**/*.rb app/services/**/*.rb app/jobs/**/*.rb app/workers/**/*.rb app/mailers/**/*.rb app/helpers/**/*.rb lib/**/*.rb lib/tasks/**/*.rake config/initializers/**/*.rb config/routes.rb db/schema.rb spec/factories/**/*.rb spec/support/**/*.rb].freeze
+      SURFACES = {
+        devise: %w[Devise devise devise_for devise_scope], warden: %w[warden Warden],
+        guards: %w[authenticate_user! current_user user_signed_in? authenticated],
+        passwords: %w[encrypted_password password_digest valid_password? password=],
+        tokens: %w[authentication_token MobileAuthToken reset_password_token confirmation_token unlock_token],
+        providers: %w[OmniAuth omniauth omniauth_callbacks],
+        eligibility: %w[active_for_authentication? inactive_message locked_at confirmed_at disabled_at]
+      }.freeze
+
+      def initialize(root:)
+        @root = File.realpath(root)
+      end
+
+      def call
+        @complete = true
+        @remaining_bytes = TOTAL_BYTES
+        paths = PATTERNS.flat_map { |pattern| Dir.glob(File.join(@root, pattern)) }.uniq.sort
+        @complete = false if paths.length > MAX_FILES
+        sources = paths.first(MAX_FILES).filter_map do |path|
+          source = read(path)
+          next unless source
+          lexical = Ripper.lex(source)
+          tokens = lexical.reject { |(_, kind, _, _)| %i[on_comment on_tstring_content].include?(kind) }
+          literal_keys = lexical.filter_map { |(_, kind, value, _)| value if kind == :on_tstring_content && SURFACES.values.flatten.include?(value) }
+          tree = Ripper.sexp(source)
+          @complete = false unless tree
+          [relative(path), {tokens: tokens.map { |token| token[2] }, literal_keys: literal_keys, tree: tree}]
+        end.to_h
+        calls = sources.values.flat_map { |source| devise_calls(source[:tree]) }
+        names = calls.flatten
+        unknown = names.count { |name| !Core::Migration::Readiness::MODULES.include?(name) }
+        @complete = false if names.include?(nil)
+        lock = read(File.join(@root, "Gemfile.lock")) || ""
+        versions = %w[devise rails ruby bcrypt].to_h do |name|
+          version = if name == "ruby"
+            lock[/^   ruby (\d+\.\d+\.\d+)/, 1]
+          else
+            lock[/^    #{Regexp.escape(name)} \((\d+\.\d+(?:\.\d+)*(?:[.a-z0-9-]*))\)/, 1]
+          end
+          [name.to_sym, version]
+        end
+        extensions = Core::Migration::Readiness::EXTENSIONS.select { |name| lock.match?(/^    #{Regexp.escape(name)} \(/) }
+        targets = Core::Migration::Readiness::TARGETS.select { |path| sources.key?(path) }
+        user = sources.dig("app/models/user.rb", :tokens) || []
+        facts = {mode: "static", complete: @complete, versions: versions,
+                 modules: (names.compact & Core::Migration::Readiness::MODULES).sort,
+                 unknown_modules: unknown, extensions: extensions, scope_count: calls.length,
+                 rails_contract: targets.length == Core::Migration::Readiness::TARGETS.length && user.include?("has_secure_password") && user.include?("normalizes"),
+                 target_conflicts: targets, files_inspected: sources.length,
+                 surfaces: SURFACES.transform_values { |terms| sources.filter_map { |path, source| path if ((source[:tokens] + source[:literal_keys]) & terms).any? } }}
+        Core::Migration::Readiness.new.call(facts)
+      end
+
+      private
+
+      def read(path)
+        # Reject symlinks at any depth, even those pointing to another host file.
+        current = Pathname.new(path)
+        while current.to_s != @root
+          return incomplete if current.symlink?
+          parent = current.parent
+          return incomplete if parent == current
+          current = parent
+        end
+        return incomplete unless File.file?(path)
+        return incomplete if @remaining_bytes <= 0
+        File.open(path, "rb") do |file|
+          limit = [MAX_BYTES, @remaining_bytes].min
+          source = file.read(limit + 1)
+          @remaining_bytes -= source.bytesize
+          return incomplete if source.bytesize > limit
+          source.force_encoding(Encoding::UTF_8)
+          return incomplete unless source.valid_encoding?
+          source
+        end
+      rescue SystemCallError
+        incomplete
+      end
+
+      def incomplete
+        @complete = false
+        nil
+      end
+
+      def relative(path) = Pathname.new(path).relative_path_from(Pathname.new(@root)).to_s
+
+      def devise_calls(node)
+        return [] unless node.is_a?(Array)
+        arguments = if node[0] == :command && node.dig(1, 1) == "devise"
+          node[2]
+        elsif node[0] == :method_add_arg && node.dig(1, 0) == :fcall && node.dig(1, 1, 1) == "devise"
+          node.dig(2, 1)
+        end
+        if arguments
+          args = (arguments[0] == :args_add_block) ? arguments[1] : []
+          return [args.reject { |arg| arg[0] == :bare_assoc_hash }.map { |arg| (arg[0] == :symbol_literal) ? arg.dig(1, 1, 1) : nil }]
+        end
+        node.flat_map { |child| child.is_a?(Array) ? devise_calls(child) : [] }
+      end
+    end
+  end
+end

data/lib/add_auth/rails/account_password_entry.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module AccountPasswordEntry
+      extend ActiveSupport::Concern
+
+      included do
+        protect_from_forgery with: :exception
+        prepend_before_action :add_auth_account_password_entry, only: %i[new create edit update]
+      end
+
+      private
+
+      def add_auth_account_password_entry
+        return unless AddAuth.configuration.lifecycle.enabled
+        verify_authenticity_token unless request.get? || request.head?
+        response.set_header("Cache-Control", "no-store")
+        response.set_header("Referrer-Policy", "no-referrer")
+        redirect_to "/account/requests/reset_password", status: request.get? ? :found : :see_other
+      end
+    end
+  end
+end

data/lib/add_auth/rails/authentication.rb

@@ -27,7 +27,7 @@ module AddAuth
       end
 
       def add_auth_session_hints
-        {user_agent: request.user_agent.to_s.truncate_bytes(512), ip_address: request.remote_ip}
+        {user_agent: request.user_agent.to_s.truncate_bytes(512), ip_address: request.remote_ip, remember: params[:remember] == "1"}
       end
 
       def add_auth_replacement_session

data/lib/add_auth/rails/authentication_pages.rb

@@ -16,7 +16,7 @@ module AddAuth
           add_auth_accept(grant)
           redirect_to destination, status: :see_other
         else
-          @error = "Email or password is incorrect. Try again or request a sign-in link."
+          @error = "Email or password is incorrect. Try again."
           page("form", status: :unprocessable_entity)
         end
       end
@@ -44,6 +44,11 @@ module AddAuth
 
       def page(partial, status: :ok)
         @page_partial = authentication_partial(partial)
+        # Turbo carries the form's stream Accept header across a 303. Prefer
+        # its HTML option on the destination GET so navigation commits the URL.
+        if (request.get? || request.head?) && request.accepts.include?(Mime[:html])
+          return render "add_auth/sign_ins/show", layout: "add_auth/authentication", formats: [:html], content_type: "text/html", status: status
+        end
         respond_to do |format|
           format.html { render "add_auth/sign_ins/show", layout: "add_auth/authentication", status: status }
           format.turbo_stream { render turbo_stream: turbo_stream.update("add_auth-content", partial: @page_partial), status: status }

data/lib/add_auth/rails/doctor.rb

@@ -33,6 +33,7 @@ module AddAuth
           end
           check("Include AddAuth::Rails::UserLifecycle in User") { ::User < UserLifecycle }
           check("Set passwords_enabled to true or false") { [true, false].include?(config.passwords_enabled) }
+          check("Set turbo_enabled to true or false") { [true, false].include?(config.turbo_enabled) }
           if config.passwords_enabled || defined?(::SessionsController)
             check("Install the shared password entry in SessionsController") { ::SessionsController < PasswordEntry }
           end
@@ -63,6 +64,25 @@ module AddAuth
             end
           end
         end
+        if config.mobile.enabled
+          columns(::Session, %w[transport client_id mobile_idle_timeout], "mobile session")
+          check("Configure explicit bounded mobile timeouts and registered client identifiers") { Runtime.mobile_profile }
+          check("Install mobile session routes") { ::Rails.application.routes.recognize_path("/mobile/session", method: :post) }
+          check("Configure mobile callbacks and Apple providers as explicit maps") do
+            config.mobile.callbacks.is_a?(Hash) && config.mobile.apple_providers.is_a?(Hash)
+          end
+          if config.mobile.callbacks.is_a?(Hash) && config.mobile.callbacks.any?
+            check("Enable reviewed provider integration before mobile handoffs") { config.external_identities.enabled }
+            columns(defined?(::AddAuthMobileHandoff) && ::AddAuthMobileHandoff,
+              %w[user_id external_digest digest client_id callback state challenge_digest credential_id credential_version policy_version authenticated_at issued_at expires_at consumed_at], "mobile handoff")
+            unique_index(::AddAuthMobileHandoff, "digest") if defined?(::AddAuthMobileHandoff)
+            unique_index(::AddAuthMobileHandoff, "external_digest") if defined?(::AddAuthMobileHandoff)
+            check("Use one database pool for mobile handoffs, accounts and sessions") { Runtime.mobile_handoffs }
+          end
+          if config.mobile.apple_providers.is_a?(Hash) && config.mobile.apple_providers.any?
+            check("Configure the optional native Apple library and exact client mapping") { Runtime.native_apple }
+          end
+        end
         if config.email_link.enabled
           check("Enable session_upgrade before email_link") { config.session.enabled }
           check("Configure base_url as a fixed HTTPS origin (HTTP only outside production)") { Runtime.sign_in_url("validation") }
@@ -75,7 +95,59 @@ module AddAuth
             columns(defined?(::AddAuthSignInToken) && ::AddAuthSignInToken, ["browser_digest"], "email browser binding")
           end
         end
-        if config.email_link.enabled || config.notifications.enabled
+        if config.external_identities.enabled
+          check("Enable session and step-up prerequisites for provider sign-in") { config.session.enabled && config.step_up.enabled }
+          check("Declare current password verifier support metadata") { config.current_password_support.respond_to?(:available?) }
+          if config.external_identities.providers.any?
+            require "add_auth/rails/provider_libraries/request_protection"
+            check("Configure a supported OmniAuth request validator") { !!ProviderLibraries::RequestProtection.validator }
+          end
+          check("Register at least one reviewed provider profile") { config.external_identities.configurations.any? }
+          columns(defined?(::AddAuthExternalIdentity) && ::AddAuthExternalIdentity,
+            %w[user_id namespace provider_id issuer audience subject provenance credential_version linked_at revoked_at invalidated_at], "external identity")
+          columns(defined?(::AddAuthExternalTransaction) && ::AddAuthExternalTransaction,
+            %w[digest browser_digest provider_id issuer audience purpose user_id session_id session_digest policy_version issued_at expires_at consumed_at enrollment_payload], "external transaction")
+          columns(::Session, %w[authentication_external_id authentication_external_version], "external session evidence")
+          unique_index(::AddAuthExternalIdentity, "namespace") if defined?(::AddAuthExternalIdentity)
+          unique_index(::AddAuthExternalTransaction, "digest") if defined?(::AddAuthExternalTransaction)
+          check("Use one database pool for provider, account and session persistence") { Runtime.external_identities }
+          config.external_identities.providers.each do |provider|
+            check("Install the configured provider callback and preparation routes") do
+              ::Rails.application.routes.recognize_path("/sign-in/providers/#{provider.middleware_name}", method: :post) &&
+                ::Rails.application.routes.recognize_path("/auth/#{provider.middleware_name}/callback", method: provider.apple_form_post? ? :post : :get)
+            end
+          end
+          check("Install provider account management routes") { ::Rails.application.routes.recognize_path("/account/external-identities", method: :get) }
+        end
+        if config.lifecycle.enabled
+          check("Set explicit confirmation and unconfirmed-reset policies") { Runtime.account_policy }
+          if config.lifecycle.confirmation_required == false
+            columns(::User, %w[add_auth_provisioned_at], "optional confirmation provisioning")
+            check("Enable password authentication for optional signup confirmation") { config.passwords_enabled }
+          end
+          if defined?(::PasswordsController)
+            check("Retire stock password reset entry points through the shared account flow") { ::PasswordsController < AccountPasswordEntry }
+          end
+          columns(::Session, %w[remembered idle_timeout], "remembered browser sessions")
+          check("Enable session, step-up and notification prerequisites for account lifecycle") { config.session.enabled && config.step_up.enabled && config.notifications.enabled }
+          columns(::User, %w[confirmed_at unconfirmed_email locked_at failed_attempts disabled_at deleted_at add_auth_manual_lock add_auth_locked_until add_auth_authority], "account lifecycle")
+          columns(defined?(::AddAuthAccountToken) && ::AddAuthAccountToken,
+            (TOKEN_COLUMNS - %w[identifier_digest]) + %w[address_digest account_version], "account proofs")
+          columns(defined?(::AddAuthAddressClaim) && ::AddAuthAddressClaim, %w[user_id digest state], "address claims")
+          if defined?(::AddAuthAccountToken)
+            unique_index(::AddAuthAccountToken, "digest")
+            unique_index(::AddAuthAccountToken, "request_id")
+          end
+          unique_index(::AddAuthAddressClaim, "digest") if defined?(::AddAuthAddressClaim)
+          check("Configure account policy, profile mapping and local transaction provisioning callbacks") do
+            %i[eligible password_policy profile_attributes provision deletion_allowed delete_account].all? { |name| config.lifecycle.public_send(name).respond_to?(:call) }
+          end
+          check("Configure account proof delivery, lock policy and shared account storage") { Runtime.accounts && Runtime.password_lifecycle && Runtime.account_proof_url("validation", purpose: "confirm") }
+          %w[/account/sign-up /account/requests/confirm /account/email /account/password].each do |path|
+            check("Install route #{path}") { ::Rails.application.routes.recognize_path(path, method: :get) }
+          end
+        end
+        if config.email_link.enabled || config.notifications.enabled || config.lifecycle.enabled
           check("Configure mail_from") { config.mail_from.is_a?(String) && !config.mail_from.strip.empty? }
           check("Enable Action Mailer delivery") { ActionMailer::Base.perform_deliveries && ActionMailer::Base.raise_delivery_errors }
           if ::Rails.env.production?
@@ -83,7 +155,7 @@ module AddAuth
             check("Configure production mail delivery") { !%i[test file].include?(ActionMailer::Base.delivery_method) }
           end
         end
-        maintenance_needed = config.passkeys.enabled || config.email_link.enabled || config.notifications.enabled || config.maintenance.session_retention
+        maintenance_needed = config.passkeys.enabled || config.email_link.enabled || config.notifications.enabled || config.lifecycle.enabled || config.external_identities.enabled || config.mobile.enabled || config.maintenance.session_retention
         if ::Rails.env.production? && maintenance_needed
           check("Schedule add_auth:deliver_pending every minute; no successful cleanup in the last two minutes") { Runtime.maintenance_current? }
         end
@@ -112,17 +184,19 @@ module AddAuth
           check("Enable security notification delivery errors") { ::AddAuth::SecurityMailer.raise_delivery_errors }
         end
         if config.step_up.enabled
-          check("Enable session and email prerequisites for step_up") { config.session.enabled && config.email_link.enabled }
+          check("Enable session prerequisites for step_up") { config.session.enabled }
           columns(::Session, %w[elevation_version elevation_expires_at], "reauthentication")
-          columns(defined?(::AddAuthSignInToken) && ::AddAuthSignInToken,
-            %w[browser_digest session_id session_digest authentication_purpose], "reauthentication")
+          if config.email_link.enabled
+            columns(defined?(::AddAuthSignInToken) && ::AddAuthSignInToken,
+              %w[browser_digest session_id session_digest authentication_purpose], "reauthentication")
+          end
           check("Declare valid step-up purposes and safe return destinations") { Runtime.step_up_purposes.any? && Runtime.step_up_policy }
           %w[/reauthenticate /reauthenticate/link].each do |path|
             check("Install route #{path}") { ::Rails.application.routes.recognize_path(path, method: :get) }
           end
         end
         if config.challenge_on.any?
-          check("Unknown challenge actions") { (config.challenge_on - %i[sign_in email_link reauthenticate passkey_enrollment]).empty? }
+          check("Unknown challenge actions (email proof pages cannot load third-party challenges)") { (config.challenge_on - %i[sign_in email_link reauthenticate passkey_enrollment register account_request provider]).empty? }
           check("Configure a challenge provider before setting challenge_on") { !config.challenge.is_a?(Core::Challenge::Null) }
           if ::Rails.env.production?
             check("Configure challenge hostname restrictions") { config.challenge.allowed_hostnames&.any? }

data/lib/add_auth/rails/ejection.rb

@@ -9,7 +9,7 @@ module AddAuth
     class Ejection
       MANIFEST = "config/add_auth-ejections.json"
       VIEW_GROUPS = {"email_link" => %w[sign_ins], "sessions" => %w[sessions],
-                     "step_up" => %w[reauthentications], "passkeys" => %w[passkeys recoveries]}.freeze
+                     "step_up" => %w[reauthentications], "passkeys" => %w[passkeys recoveries], "accounts" => %w[accounts], "providers" => %w[provider_sign_ins external_identities]}.freeze
 
       def initialize(host_root:, engine_root: File.expand_path("../../..", __dir__))
         @host, @engine = host_root.to_s, engine_root.to_s

data/lib/add_auth/rails/engine.rb

@@ -2,6 +2,7 @@
 
 require "turbo-rails"
 require "add_auth/rails/authentication_pages"
+require "add_auth/rails/provider_libraries/callback_route"
 
 module AddAuth
   module Rails
@@ -10,7 +11,7 @@ module AddAuth
       engine_name "add_auth"
 
       initializer "add_auth.filter_parameters" do |app|
-        app.config.filter_parameters += [:token, :password, :delivery_payload, :token_digest, :encrypted_identifier, :browser_digest, :session_digest, :elevation_version, :add_auth_browser, :credential, :transaction, :challenge, :external_id, :public_key, :"cf-turnstile-response", :"g-recaptcha-response"]
+        app.config.filter_parameters += [:token, :password, :enrollment_payload, :code, :state, :nonce, :id_token, :access_token, :refresh_token, :client_secret, :authorization_code, :raw_info, :id_info, :delivery_payload, :token_digest, :encrypted_identifier, :browser_digest, :session_digest, :elevation_version, :add_auth_browser, :credential, :transaction, :challenge, :external_id, :public_key, :"cf-turnstile-response", :"g-recaptcha-response"]
       end
 
       config.to_prepare do
@@ -21,6 +22,10 @@ module AddAuth
           if AddAuth.configuration.passwords_enabled || defined?(::SessionsController)
             ::SessionsController.include AddAuth::Rails::PasswordEntry
           end
+          if defined?(::PasswordsController)
+            require "add_auth/rails/account_password_entry"
+            ::PasswordsController.include AddAuth::Rails::AccountPasswordEntry
+          end
         end
       end