add_auth 0.2.2 → 0.4.0

data/lib/add_auth/rails/provider_libraries/omniauth.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+# This adapter deliberately has no `require "omniauth"`: provider gems remain
+# host-selected optional dependencies. It accepts only the in-process Rack
+# callback product that OmniAuth installs after a strategy completes. It never
+# accepts HTTP parameters or an auth hash supplied by a controller.
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      module OmniAuth
+        # An immutable, allowlisted projection of an OmniAuth callback. The raw
+        # auth hash can include OAuth credentials and profile data, so this
+        # object intentionally exposes neither. A configured Verifier maps only
+        # the identity claims it needs into Core's trusted verifier contract.
+        class CallbackResult
+          attr_reader :provider, :strategy_class
+
+          def self.capture(env:, provider:)
+            return unless env.respond_to?(:[])
+
+            strategy = env["omniauth.strategy"]
+            auth = env["omniauth.auth"]
+            return unless defined?(::OmniAuth::Strategy) && strategy.is_a?(::OmniAuth::Strategy)
+            return unless defined?(::OmniAuth::AuthHash) && auth.is_a?(::OmniAuth::AuthHash)
+            return unless strategy.name.to_s == provider.to_s && auth.provider.to_s == provider.to_s
+
+            new(provider: provider.to_s, strategy_class: strategy.class.name, auth: auth)
+          end
+
+          def initialize(provider:, strategy_class:, auth:)
+            @provider = provider.dup.freeze
+            @strategy_class = strategy_class.dup.freeze
+            @auth = auth
+            freeze
+          end
+          private_class_method :new
+
+          # A mapping is declared in trusted server configuration, rather than
+          # selected by a request. Its paths are evaluated against the Rack
+          # result before this object crosses into Core.
+          def values(mapping)
+            mapping.transform_values { |path| read(path) }
+          end
+
+          def inspect = "#<AddAuth::Rails::ProviderLibraries::OmniAuth::CallbackResult [FILTERED]>"
+
+          private
+
+          def read(path)
+            Array(path).reduce(@auth) do |value, key|
+              if value.respond_to?(:[])
+                value[key] || value[key.to_s] || value[key.to_sym]
+              end
+            end
+          rescue NoMethodError
+            nil
+          end
+        end
+
+        # Builds the callable supplied to
+        # Core::ExternalIdentities::Configuration#verifier. It binds that
+        # configuration to one OmniAuth strategy and one static claim map. The
+        # provider strategy remains responsible for authorization-code exchange,
+        # JWKS/signature validation, state and nonce verification; this adapter
+        # only prevents an HTTP parameter/raw profile from impersonating that
+        # completed strategy result.
+        class Verifier
+          DEFAULT_MAPPING = {
+            issuer: %i[extra id_info iss],
+            audience: %i[extra id_info aud],
+            subject: %i[extra id_info sub],
+            authenticated_at: %i[extra id_info auth_time]
+          }.freeze
+
+          def initialize(provider:, provenance:, mapping: DEFAULT_MAPPING)
+            @provider = text(provider.to_s)
+            @provenance = text(provenance)
+            @mapping = normalize_mapping(mapping)
+            freeze
+          end
+
+          def call(server_result:, transaction:)
+            return unless server_result.is_a?(CallbackResult) && server_result.provider == @provider
+            return unless transaction.respond_to?(:id)
+
+            claims = server_result.values(@mapping)
+            issuer, audience, subject = claims.values_at(:issuer, :audience, :subject)
+            return unless [issuer, audience, subject].all? { |value| valid_text?(value) }
+            return unless subject == server_result.values(subject: :uid).fetch(:subject)
+
+            authenticated_at = time(claims[:authenticated_at])
+            return if claims[:authenticated_at] && !authenticated_at
+
+            {issuer: issuer, audience: audience, subject: subject, provenance: @provenance,
+             authenticated_at: authenticated_at}
+          end
+
+          private
+
+          def normalize_mapping(mapping)
+            required = %i[issuer audience subject]
+            raise ArgumentError, "provider claim mapping must contain issuer, audience and subject" unless mapping.is_a?(Hash) &&
+              (required - mapping.keys.map(&:to_sym)).empty?
+
+            mapping.to_h.transform_keys(&:to_sym).transform_values do |path|
+              parts = Array(path)
+              raise ArgumentError, "provider claim paths must be nonempty" if parts.empty? || parts.any? { |part| !part.is_a?(String) && !part.is_a?(Symbol) }
+
+              parts.map(&:to_sym).freeze
+            end.freeze
+          end
+
+          def text(value)
+            raise ArgumentError, "invalid provider verifier value" unless valid_text?(value)
+
+            value.dup.freeze
+          end
+
+          def valid_text?(value)
+            value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+          end
+
+          def time(value)
+            return value if value.is_a?(Time)
+            return unless value.is_a?(Integer) || value.is_a?(Float)
+            return if value.is_a?(Float) && !value.finite?
+
+            Time.at(value).utc
+          rescue ArgumentError, RangeError
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/omniauth_correlation.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "rack/request"
+
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      # Correlates the Core one-use transaction with OmniAuth's already-CSRF-
+      # protected state value. It stores only opaque Core data in the ordinary
+      # application session; OAuth tokens, profile data, and claims never enter
+      # this boundary. Apple form_post needs its own cookie transport because
+      # its cross-site callback deliberately lacks this session.
+      class OmniAuthCorrelation
+        PENDING_KEY = "add_auth.provider_pending"
+        CORRELATIONS_KEY = "add_auth.provider_correlations"
+        ENV_KEY = "add_auth.provider_correlation"
+
+        def self.remember!(session:, provider:, transaction:, browser_secret:, configuration_id:, purpose:, remember: false)
+          payload = {"provider" => provider.to_s, "transaction" => transaction, "browser_secret" => browser_secret,
+                     "configuration_id" => configuration_id, "purpose" => purpose.to_s, "remember" => remember == true}
+          raise ArgumentError, "provider transaction correlation is invalid" unless valid_payload?(payload)
+
+          session[PENDING_KEY] ||= {}
+          raise ArgumentError, "provider transaction correlation is invalid" unless session[PENDING_KEY].is_a?(Hash)
+
+          session[PENDING_KEY][payload.fetch("provider")] = payload
+        end
+
+        def self.valid_payload?(payload)
+          payload.is_a?(Hash) && %w[provider transaction browser_secret configuration_id purpose].all? { |key| text?(payload[key]) } &&
+            [true, false].include?(payload["remember"])
+        end
+
+        def self.text?(value)
+          value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+        end
+        private_class_method :text?, :valid_payload?
+
+        def initialize(app, providers:, lifetime: 600, clock: -> { Time.now })
+          raise ArgumentError, "provider correlation lifetime is invalid" unless lifetime.is_a?(Integer) && lifetime.between?(1, 600)
+          raise ArgumentError, "provider correlation providers are invalid" unless providers.is_a?(Array) && providers.all? { |name| self.class.send(:text?, name.to_s) }
+
+          @app, @providers, @lifetime, @clock = app, providers.map(&:to_s).freeze, lifetime, clock
+        end
+
+        def call(env)
+          request = Rack::Request.new(env)
+          provider = provider_for(request.path_info)
+          return @app.call(env) unless provider
+
+          return request.post? ? start(env, provider) : @app.call(env) if request.path_info == "/auth/#{provider}"
+          callback(env, request, provider)
+        end
+
+        private
+
+        def provider_for(path)
+          @providers.find { |provider| ["/auth/#{provider}", "/auth/#{provider}/callback"].include?(path) }
+        end
+
+        def start(env, provider)
+          session = env.fetch("rack.session", {})
+          pending = session.fetch(PENDING_KEY, {}).delete(provider)
+          return @app.call(env) if pending.nil?
+          return failure unless self.class.send(:valid_payload?, pending) && pending.fetch("provider") == provider
+
+          status, headers, body = @app.call(env)
+          state = session["omniauth.state"]
+          return [status, headers, body] unless status.between?(300, 399) && self.class.send(:text?, state)
+
+          correlations = session[CORRELATIONS_KEY] ||= {}
+          return failure unless correlations.is_a?(Hash)
+
+          purge!(correlations)
+          correlations[state] = pending.merge("expires_at" => (@clock.call + @lifetime).to_i)
+          [status, headers, body]
+        end
+
+        def callback(env, request, provider)
+          state = request.params["state"]
+          session = env.fetch("rack.session", {})
+          correlations = session.fetch(CORRELATIONS_KEY, {})
+          payload = correlations.delete(state) if self.class.send(:text?, state) && correlations.is_a?(Hash)
+          # A shared OmniAuth stack may serve other host-owned OAuth journeys.
+          # Only attach authority correlation for a transaction we started. The
+          # AddAuth callback controller independently rejects missing correlation.
+          return @app.call(env) if payload.nil?
+          return failure unless self.class.send(:valid_payload?, payload) && payload.fetch("provider") == provider &&
+            payload.fetch("expires_at", 0).is_a?(Integer) && payload.fetch("expires_at") > @clock.call.to_i
+
+          env[ENV_KEY] = payload.slice("transaction", "browser_secret", "configuration_id", "purpose", "remember")
+          @app.call(env)
+        end
+
+        def purge!(correlations)
+          now = @clock.call.to_i
+          correlations.delete_if { |_state, payload| !payload.is_a?(Hash) || payload["expires_at"].to_i <= now }
+          correlations.shift while correlations.size >= 8
+        end
+
+        def failure
+          [422, {"content-type" => "text/plain", "cache-control" => "no-store"}, ["Provider sign-in could not be verified."]]
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/openid_connect.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+# Optional bridge for a host that uses openid_connect directly rather than
+# OmniAuth. It deliberately accepts an OpenIDConnect::AccessToken obtained by
+# the server-side authorization-code exchange, never `params[:id_token]`.
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      module OpenIdConnect
+        class CallbackResult
+          attr_reader :issuer, :audience, :subject, :authenticated_at, :provenance
+
+          def self.capture(access_token:, verification_key:, issuer:, audience:, nonce:, provenance:)
+            return unless defined?(::OpenIDConnect::AccessToken) && access_token.is_a?(::OpenIDConnect::AccessToken)
+            return unless access_token.id_token.is_a?(String) && !access_token.id_token.empty?
+
+            # `decode` performs JWS verification using the discovery/JWKS key
+            # (or an equivalent pinned verification key); `verify!` performs
+            # the OIDC issuer, audience, expiration and nonce checks. AddAuth
+            # deliberately delegates both operations to openid_connect.
+            token = ::OpenIDConnect::ResponseObject::IdToken.decode(access_token.id_token, verification_key)
+            token.verify!(issuer: issuer, audience: audience, nonce: nonce)
+            new(issuer: token.iss, audience: audience_for(token.aud, audience), subject: token.sub,
+              authenticated_at: token.auth_time && Time.at(token.auth_time).utc, provenance: provenance)
+          rescue
+            nil
+          end
+
+          def initialize(issuer:, audience:, subject:, authenticated_at:, provenance:)
+            @issuer = text(issuer)
+            @audience = text(audience)
+            @subject = text(subject)
+            @authenticated_at = authenticated_at&.dup&.freeze
+            @provenance = text(provenance)
+            freeze
+          end
+          private_class_method :new
+
+          def to_verified_claims(transaction:)
+            return unless transaction.respond_to?(:id)
+
+            {issuer: issuer, audience: audience, subject: subject, authenticated_at: authenticated_at, provenance: provenance}
+          end
+
+          def inspect = "#<AddAuth::Rails::ProviderLibraries::OpenIdConnect::CallbackResult [FILTERED]>"
+
+          def self.audience_for(value, expected)
+            Array(value).find { |candidate| candidate == expected }
+          end
+          private_class_method :audience_for
+
+          def text(value)
+            raise ArgumentError, "invalid verified OIDC claim" unless value.is_a?(String) && value.valid_encoding? &&
+              value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+
+            value.dup.freeze
+          end
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/request_protection.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      # Mint the form token with the actual maintained OmniAuth validator. A
+      # Rails adopter may already configure its session key; using a separate
+      # default Rack validator would generate a token that cannot be accepted.
+      module RequestProtection
+        module_function
+
+        def validator
+          return unless defined?(::OmniAuth::AuthenticityTokenProtection)
+          require "rack/protection"
+          phase = ::OmniAuth.config.request_validation_phase
+          candidate = (phase.is_a?(Class) && phase <= ::Rack::Protection::AuthenticityToken) ? phase.new : phase
+          candidate if candidate.is_a?(::Rack::Protection::AuthenticityToken) || rails_validator?(candidate)
+        end
+
+        def token(session:, rails_token: nil)
+          configured = validator
+          raise AddAuth::Error, "configure a supported OmniAuth request validator" unless configured
+          if rails_validator?(configured)
+            raise AddAuth::Error, "Rails request token is unavailable" unless rails_token.respond_to?(:call)
+            return rails_token.call
+          end
+          configured.mask_authenticity_token(session)
+        end
+
+        def parameter
+          configured = validator
+          raise AddAuth::Error, "configure a supported OmniAuth request validator" unless configured
+          rails_validator?(configured) ? ::ActionController::Base.request_forgery_protection_token : configured.options.fetch(:authenticity_param)
+        end
+
+        def rails_validator?(candidate)
+          defined?(::OmniAuth::RailsCsrfProtection::TokenVerifier) && candidate.is_a?(::OmniAuth::RailsCsrfProtection::TokenVerifier)
+        end
+        private_class_method :rails_validator?
+      end
+    end
+  end
+end

data/lib/add_auth/rails/runtime.rb

@@ -14,10 +14,156 @@ module AddAuth
 
       def config = AddAuth.configuration
 
+      def account_policy
+        Core::AccountPolicy.new(enabled: config.lifecycle.enabled,
+          eligible: ->(user) { config.eligible.call(user) == true && config.lifecycle.eligible.call(user) == true },
+          confirmation_required: config.lifecycle.confirmation_required, reset_unconfirmed: config.lifecycle.reset_unconfirmed)
+      end
+
+      def eligible(user)
+        account_policy.allowed?(user)
+      end
+
+      def trusted_recovery_address(user)
+        config.trusted_recovery_address.call(user) if account_policy.trusted_address?(user)
+      end
+
+      def authority
+        require "add_auth/rails/stores/authority"
+        tokens = []
+        tokens << ::AddAuthSignInToken if defined?(::AddAuthSignInToken) && ::AddAuthSignInToken.table_exists?
+        tokens << ::AddAuthAccountToken if defined?(::AddAuthAccountToken) && ::AddAuthAccountToken.table_exists?
+        ceremonies = []
+        ceremonies << ::AddAuthCeremony if defined?(::AddAuthCeremony) && ::AddAuthCeremony.table_exists?
+        ceremonies << ::AddAuthExternalTransaction if defined?(::AddAuthExternalTransaction) && ::AddAuthExternalTransaction.table_exists?
+        ceremonies << ::AddAuthMobileHandoff if defined?(::AddAuthMobileHandoff) && ::AddAuthMobileHandoff.table_exists?
+        invalidator = if defined?(::AddAuthExternalIdentity) && ::AddAuthExternalIdentity.table_exists?
+          ->(user_id:, at:) { Core::ExternalIdentities.invalidate_credentials_in_transaction(store: external_identity_store, user_id: user_id, at: at) }
+        end
+        Stores::Authority.new(user_model: ::User, session_model: ::Session, token_models: tokens, ceremony_models: ceremonies, external_invalidator: invalidator)
+      end
+
+      def external_identity_store
+        require "add_auth/rails/stores/external_identities"
+        Stores::ExternalIdentities.new(user_model: ::User, identity_model: ::AddAuthExternalIdentity, transaction_model: ::AddAuthExternalTransaction)
+      end
+
+      def external_provider(id)
+        config.external_identities.provider(id) if config.external_identities.enabled
+      end
+
+      def external_reauthentication? = config.external_identities.enabled && config.external_identities.providers.any?(&:reauthentication?)
+
+      def external_identities
+        options = config.external_identities
+        raise AddAuth::Error, "enable external identities and register a provider first" unless options.enabled && options.configurations.any?
+        Core::ExternalIdentities.new(store: external_identity_store, configurations: options.configurations,
+          sessions: sessions, access_policy: access_policy, policy: step_up_policy, eligible: method(:eligible),
+          digest: config.sign_in_token_digest, revoke_authority: authority.method(:revoke),
+          remaining_method: remaining_factors,
+          enrollment_eligible: ->(user) { account_policy.allowed?(user, purpose: :confirm) }, enabled: true, mobile_enabled: config.mobile.enabled)
+      end
+
+      def remaining_factors
+        require "add_auth/core/remaining_factors"
+        require "add_auth/core/passwords/credential"
+        credential = Core::Passwords::Credential.new(legacy_verifier: config.legacy_password_verifier)
+        Core::RemainingFactors.new(access_policy: access_policy,
+          passkey_count: ->(user) { (defined?(::AddAuthCredential) && ::AddAuthCredential.table_exists?) ? ::AddAuthCredential.where(user_id: user.id, revoked_at: nil).count : 0 },
+          password_available: ->(user) { credential.available?(user: user, current: config.current_password_support) })
+      end
+
+      def provider_enrollment
+        require "add_auth/rails/provider_enrollment"
+        ProviderEnrollment.new(model: ::AddAuthExternalTransaction, digest: config.sign_in_token_digest, key: key("external-enrollment"))
+      end
+
+      def accounts
+        raise AddAuth::Error, "enable account lifecycle first" unless config.lifecycle.enabled
+        if !account_policy.confirmation_required? && !::User.column_names.include?("add_auth_provisioned_at")
+          raise AddAuth::Error, "rerun add_auth:accounts and migrate before enabling optional confirmation"
+        end
+        require "add_auth/rails/stores/account_tokens"
+        Core::AccountLifecycle.new(store: Stores::AccountTokens.new(user_model: ::User, token_model: ::AddAuthAccountToken,
+          session_model: ::Session, address_model: ::AddAuthAddressClaim, authority: authority, provision: config.lifecycle.provision, delete_account: config.lifecycle.delete_account),
+          digest: config.sign_in_token_digest, delivery_cipher: DeliveryCipher.new(key: key("account-proofs")),
+          policy: account_policy, password_policy: config.lifecycle.password_policy, trusted_address: method(:trusted_recovery_address),
+          lifetime: config.lifecycle.proof_lifetime, notify: ->(**event) { security_events.issue(**event) if config.notifications.enabled },
+          sessions: sessions, step_up_policy: step_up_policy, profile_attributes: config.lifecycle.profile_attributes, deletion_allowed: config.lifecycle.deletion_allowed,
+          external_identities: -> { external_identities })
+      end
+
+      def enqueue_account_request(identifier:, purpose:)
+        job = ::AddAuth::AccountRequestJob.perform_later(encrypt_intake(identifier: identifier, purpose: purpose))
+        raise AddAuth::Error, "account request queue unavailable" unless job
+        job
+      rescue
+        raise AddAuth::Error, "account request queue unavailable", cause: nil
+      end
+
+      def account_proof_url(token, purpose:)
+        raise AddAuth::Error, "unsupported account proof" unless Core::AccountLifecycle::PURPOSES.include?(purpose)
+        authentication_url("/account/proofs/#{purpose}", token: token)
+      end
+
       def sessions
         Core::Sessions.new(store: Stores::Sessions.new(user_model: ::User, session_model: ::Session),
-          digest: config.session_token_digest, eligible: config.eligible, lifetime: config.session.lifetime,
-          idle_timeout: config.session.idle_timeout, legacy_bridge_until: config.session.legacy_bridge_until, access_policy: access_policy)
+          digest: config.session_token_digest, eligible: method(:eligible), lifetime: config.session.lifetime,
+          idle_timeout: config.session.idle_timeout, legacy_bridge_until: config.session.legacy_bridge_until, access_policy: access_policy,
+          password_lifecycle: password_lifecycle,
+          mobile_profile: mobile_profile,
+          verified_denial: ->(user) { (config.eligible.call(user) == true) ? account_policy.denial(user) : :disabled },
+          remembered_profile: config.lifecycle.enabled ? {lifetime: config.lifecycle.remember_lifetime, idle_timeout: config.lifecycle.remember_idle_timeout} : nil,
+          on_sign_in: method(:record_sign_in))
+      end
+
+      def mobile_profile
+        options = config.mobile
+        return unless options.enabled
+        raise AddAuth::Error, "enable session_upgrade before mobile sessions" unless config.session.enabled
+        Core::MobileProfile.new(lifetime: options.lifetime, idle_timeout: options.idle_timeout, clients: options.clients, callbacks: options.callbacks)
+      end
+
+      def mobile_authentication
+        require "add_auth/core/mobile_authentication"
+        Core::MobileAuthentication.new(sessions: sessions, profile: mobile_profile,
+          intake: intake, verify_password: method(:authenticate_password))
+      end
+
+      def mobile_handoffs
+        require "add_auth/core/mobile_handoffs"
+        require "add_auth/rails/stores/mobile_handoffs"
+        Core::MobileHandoffs.new(store: Stores::MobileHandoffs.new(user_model: ::User, handoff_model: ::AddAuthMobileHandoff, session_model: ::Session),
+          profile: mobile_profile, sessions: sessions, access_policy: access_policy, digest: config.sign_in_token_digest)
+      end
+
+      def native_apple
+        require "add_auth/core/native_authentication"
+        require "add_auth/rails/provider_libraries/apple_native"
+        require "add_auth/rails/provider_libraries/apple_jwks"
+        raise AddAuth::Error, "install and require ruby-jwt for native Apple authentication" unless defined?(::JWT)
+        raise AddAuth::Error, "configure native Apple providers as an explicit client map" unless config.mobile.apple_providers.is_a?(Hash)
+        providers = config.mobile.apple_providers.transform_values { |id| config.external_identities.native_provider(id) }
+        Core::NativeAuthentication.new(external_identities: external_identities, profile: mobile_profile,
+          providers: providers, intake: intake, accounts: (method(:accounts) if config.lifecycle.enabled), verify: ->(**arguments) {
+            ProviderLibraries::AppleNative::CallbackResult.capture(**arguments, jwks: ProviderLibraries::AppleJwks.new(cache: ::Rails.cache))
+          })
+      end
+
+      def record_sign_in(user:, session:, at:)
+        require "add_auth/rails/stores/commit_dispatch"
+        Stores::CommitDispatch.event(transaction: ::User.current_transaction, event: "session_created.add_auth",
+          payload: {user_id: user.id, session_id: session.id, method: session.authenticated_with, occurred_at: at})
+      end
+
+      def password_lifecycle
+        return unless config.lifecycle.enabled || ::User.column_names.include?("add_auth_password_scheme")
+        require "add_auth/core/passwords/lifecycle"
+        require "add_auth/rails/stores/account_credentials"
+        Core::Passwords::Lifecycle.new(store: Stores::AccountCredentials.new(user_model: ::User, authority: authority),
+          policy: method(:eligible), enabled: config.lifecycle.enabled,
+          maximum_attempts: config.lifecycle.maximum_attempts, unlock_in: config.lifecycle.unlock_in,
+          issue_unlock: ->(user) { accounts.issue_unlock_in_transaction(user: user) })
       end
 
       def security_events
@@ -31,7 +177,9 @@ module AddAuth
         Core::AccessPolicy.new(credentials: ->(id) {
           ::AddAuthCredential.find_by(external_id: id) if defined?(::AddAuthCredential) && ::AddAuthCredential.table_exists?
         }, passkeys_enabled: config.passkeys.enabled, email_enabled: Core::Intake.email_available?(config),
-          trusted_recovery_address: config.trusted_recovery_address, password_enabled: config.passwords_enabled)
+          trusted_recovery_address: method(:trusted_recovery_address), password_enabled: config.passwords_enabled,
+          external_enabled: config.external_identities.enabled,
+          external_current: ->(**arguments) { external_identities.credential_current?(**arguments) })
       end
 
       def email(purpose: :sign_in)
@@ -41,7 +189,7 @@ module AddAuth
         raise AddAuth::Error, "enable session_upgrade and email_link first" unless Core::Intake.email_available?(config)
         Core::Strategies::EmailLink.new(store: Stores::EmailTokens.new(user_model: ::User,
           token_model: ::AddAuthSignInToken, session_model: ::Session), digest: config.sign_in_token_digest,
-          delivery_cipher: DeliveryCipher.new(key: key("delivery")), eligible: config.eligible,
+          delivery_cipher: DeliveryCipher.new(key: key("delivery")), eligible: method(:eligible),
           normalize_identifier: method(:normalize), identifier_for: ->(user) { user.email_address },
           token_lifetime: {"reauthentication" => 300, "recovery" => 1200}.fetch(purpose.to_s, config.email_link.token_lifetime),
           same_browser: (purpose.to_s == "recovery") ? false : config.email_link.same_browser, purpose: purpose,
@@ -82,7 +230,23 @@ module AddAuth
         else
           {}
         end
-        {sign_out_everywhere: {methods: [:password, :email_link, :passkey], return_to: "/sessions/revoke-all", label: "sign out everywhere"}}.merge(defaults).merge(config.step_up.purposes)
+        if config.lifecycle.enabled
+          defaults = defaults.merge(
+            change_email: {methods: [:password, :email_link, :passkey], return_to: "/account/email", label: "change your email address"},
+            change_password: {methods: [:password, :email_link, :passkey], return_to: "/account/password", label: "change your password"},
+            delete_account: {methods: [:password, :email_link, :passkey], return_to: "/account/delete", label: "delete your account"}
+          )
+        end
+        if config.external_identities.enabled
+          defaults = defaults.merge(
+            link_external_identity: {methods: [:password, :email_link, :passkey], return_to: "/account/external-identities", label: "link a sign-in provider"},
+            unlink_external_identity: {methods: [:password, :email_link, :passkey], return_to: "/account/external-identities", label: "remove a sign-in provider"}
+          )
+          defaults = defaults.transform_values do |rule|
+            (!external_reauthentication? || rule[:require_passkey] || rule[:reauthentication] == false) ? rule : rule.merge(methods: (rule[:methods] + [:external_identity]).uniq)
+          end
+        end
+        {sign_out_everywhere: {methods: [:password, :email_link, :passkey, *(:external_identity if external_reauthentication?)], return_to: "/sessions/revoke-all", label: "sign out everywhere"}}.merge(defaults).merge(config.step_up.purposes)
       end
 
       def passkeys
@@ -91,7 +255,7 @@ module AddAuth
         Core::Strategies::Passkey.new(store: Stores::Passkeys.new(user_model: ::User, session_model: ::Session,
           credential_model: ::AddAuthCredential, ceremony_model: ::AddAuthCeremony, token_model: ::AddAuthSignInToken), sessions: sessions,
           policy: step_up_policy, access_policy: access_policy, digest: config.sign_in_token_digest,
-          eligible: config.eligible, rp_id: config.passkeys.rp_id, origins: config.passkeys.origins, name: config.passkeys.name,
+          eligible: method(:eligible), rp_id: config.passkeys.rp_id, origins: config.passkeys.origins, name: config.passkeys.name,
           limiter: method(:limit), anonymous_limit: config.passkeys.anonymous_limit,
           notify: ->(**event) { security_events.issue(**event) }, allow_localhost: !::Rails.env.production?, support_url: config.support_url,
           on_failure: ->(reason) { ::ActiveSupport::Notifications.instrument("passkey_failure.add_auth", reason: reason) })
@@ -103,6 +267,7 @@ module AddAuth
           password_version: ->(user) { config.sign_in_token_digest.digest("password:#{user.password_digest}") },
           credential_current: ->(user:, evidence:) {
             evidence.method == :password ||
+              (evidence.method == :external_identity && access_policy.external_credential_current?(user: user, id: evidence.credential_id, version: evidence.credential_version)) ||
               (evidence.method == :passkey && access_policy.credential_current?(user: user, id: evidence.credential_id) &&
                 ::AddAuthCredential.find_by(external_id: evidence.credential_id)&.public_key == evidence.credential_version) ||
               (evidence.method == :email_link && Core::Intake.email_available?(config) &&
@@ -204,14 +369,20 @@ module AddAuth
       end
 
       def sign_in_url(token, purpose: "sign_in")
+        path = {"sign_in" => "/sign-in/link", "reauthentication" => "/reauthenticate/link", "recovery" => "/recover/link"}.fetch(purpose.to_s)
+        authentication_url(path, token: token)
+      end
+
+      def authentication_url(path, **query)
         uri = URI.parse(config.base_url.to_s)
         valid = uri.host && !uri.userinfo && !uri.query && !uri.fragment && ["", "/"].include?(uri.path) &&
           (uri.scheme == "https" || (!::Rails.env.production? && uri.scheme == "http"))
         unless valid
           raise AddAuth::Error, "configure base_url as a fixed HTTPS origin (HTTP allowed only outside production)"
         end
-        path = {"sign_in" => "/sign-in/link", "reauthentication" => "/reauthenticate/link", "recovery" => "/recover/link"}.fetch(purpose.to_s)
-        "#{uri.to_s.delete_suffix("/")}#{path}?token=#{URI.encode_www_form_component(token)}"
+        "#{uri.to_s.delete_suffix("/")}#{path}?#{URI.encode_www_form(query)}"
+      rescue URI::InvalidURIError
+        raise AddAuth::Error, "configure a fixed HTTPS origin", cause: nil
       end
     end
   end

data/lib/add_auth/rails/stores/account_credentials.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module Stores
+      class AccountCredentials
+        def initialize(user_model:, authority:)
+          @users, @authority = user_model, authority
+        end
+
+        def update_account(user:, **attributes)
+          raise AddAuth::Error, "credential changes require an account transaction" unless @users.connection.transaction_open?
+          user.update_columns(attributes)
+          user.reload
+        rescue ActiveRecord::RecordNotUnique
+          raise Core::AccountLifecycle::Conflict
+        end
+
+        def replace_password(user:, password:)
+          raise AddAuth::Error, "credential changes require an account transaction" unless @users.connection.transaction_open?
+          user.password = password
+          unless user.valid?
+            user.reload
+            raise Core::AccountLifecycle::InvalidPassword
+          end
+          persist_password(user: user, digest: user.password_digest)
+        end
+
+        def rehash_password(user:, password:)
+          fresh = @users.new(password: password)
+          persist_password(user: user, digest: fresh.password_digest)
+        end
+
+        def revoke_authority(user:, at:) = @authority.revoke(user_id: user.id, at: at)
+
+        private
+
+        def persist_password(user:, digest:)
+          update_account(user: user, password_digest: digest, add_auth_password_scheme: "rails")
+        end
+      end
+    end
+  end
+end