add_auth 0.3.0 → 0.5.0

data/lib/add_auth/core/session_key.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Core
+    class SessionKey
+      UUID = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i
+      MAX_INTEGER = (2**63) - 1
+
+      def initialize(type:)
+        raise ArgumentError, "unsupported session key type" unless %i[integer bigint uuid].include?(type)
+        @uuid = type == :uuid
+      end
+
+      def parse(value)
+        if @uuid
+          value.downcase if value.is_a?(String) && value.ascii_only? && UUID.match?(value)
+        elsif value.is_a?(Integer)
+          value if value.between?(1, MAX_INTEGER)
+        elsif value.is_a?(String) && value.ascii_only? && value.match?(/\A[1-9]\d{0,18}\z/)
+          integer = value.to_i
+          integer if integer <= MAX_INTEGER
+        end
+      end
+
+      # Stock Rails signed cookies serialize integer IDs as integers, UUIDs as
+      # strings. Numeric strings must not broaden the legacy integer bridge.
+      def legacy(value)
+        parse(value) if @uuid || value.is_a?(Integer)
+      end
+    end
+  end
+end

data/lib/add_auth/core/sessions.rb

@@ -2,6 +2,8 @@
 
 require "securerandom"
 require "add_auth/core/mobile_profile"
+require "add_auth/core/session_key"
+require "add_auth/core/session_cursor"
 
 module AddAuth
   module Core
@@ -37,6 +39,8 @@ module AddAuth
           raise ArgumentError, "legacy_bridge_until must be an absolute Time or nil"
         end
         @store, @digest, @eligible, @clock = store, digest, eligible, clock
+        @key = SessionKey.new(type: store.respond_to?(:id_type) ? store.id_type : :integer)
+        @cursor = SessionCursor.new(key: @key)
         @access_policy = access_policy
         @password_lifecycle = password_lifecycle
         @on_sign_in = on_sign_in
@@ -191,13 +195,14 @@ module AddAuth
       def list_page(user:, current_session_id: nil, before: nil)
         empty = Page.new(entries: [])
         return empty unless user && @eligible.call(user) == true
-        return empty unless before.nil? || before.to_s.match?(/\A[1-9]\d{0,18}\z/)
+        boundary = @cursor.decode(before) unless before.nil?
+        return empty unless before.nil? || boundary
 
         now = @clock.now
-        candidates = @store.list_for_user(user_id: user.id, before: before&.to_i,
+        candidates = @store.list_for_user(user_id: user.id, before: boundary,
           excluding: current_session_id, limit: PAGE_SIZE + 1, now: now,
           active_after: now - [@idle, @remembered&.fetch(:idle_timeout) || @idle, @mobile&.idle_timeout || @idle].max, legacy: !!(@deadline && now < @deadline))
-        cursor = candidates[PAGE_SIZE - 1].id if candidates.length > PAGE_SIZE
+        cursor = @cursor.encode(candidates[PAGE_SIZE - 1]) if candidates.length > PAGE_SIZE
         rows = candidates.first(PAGE_SIZE)
         if before.nil? && current_session_id
           current = @store.find_for_user(user_id: user.id, session_id: current_session_id)
@@ -217,16 +222,22 @@ module AddAuth
 
       # Both the initiating bearer and target ownership are checked under lock.
       def revoke_one(user:, session:, session_id:)
-        return false unless session_id.is_a?(Integer) || session_id.to_s.match?(/\A[1-9]\d*\z/)
+        target_id = @key.parse(session_id)
+        return false unless target_id
 
         with_live_session(user: user, session: session) do |account, _current, now|
-          target = @store.find_for_user_in_transaction(user_id: account.id, session_id: session_id.to_i)
+          target = @store.find_for_user_in_transaction(user_id: account.id, session_id: target_id)
           next false unless target
           @store.update(target, revoked_at: now) unless target.revoked_at
           true
         end || false
       end
 
+      def current_session?(session:, session_id:)
+        id = @key.parse(session_id)
+        !!(id && session && id == session.id)
+      end
+
       # Password proof is obtained from the locked, current account. Intake
       # limits must be applied by the caller before reaching this expensive port.
       def reauthenticate(user:, session:, purpose:, policy:)
@@ -315,10 +326,10 @@ module AddAuth
       private
 
       def cookie_lookup(value)
-        if value.is_a?(String) && PATTERN.match?(value)
+        if value.is_a?(String) && value.ascii_only? && PATTERN.match?(value)
           {digest: @digest.digest(value)}
-        elsif value.is_a?(Integer) && value.positive? && @deadline && @clock.now < @deadline
-          {id: value}
+        elsif @deadline && @clock.now < @deadline && (id = @key.legacy(value))
+          {id: id}
         end
       end
 

data/lib/add_auth/rails/authentication_pages.rb

@@ -16,7 +16,7 @@ module AddAuth
           add_auth_accept(grant)
           redirect_to destination, status: :see_other
         else
-          @error = "Email or password is incorrect. Try again or request a sign-in link."
+          @error = "Email or password is incorrect. Try again."
           page("form", status: :unprocessable_entity)
         end
       end

data/lib/add_auth/rails/doctor.rb

@@ -120,6 +120,11 @@ module AddAuth
           check("Install provider account management routes") { ::Rails.application.routes.recognize_path("/account/external-identities", method: :get) }
         end
         if config.lifecycle.enabled
+          check("Set explicit confirmation and unconfirmed-reset policies") { Runtime.account_policy }
+          if config.lifecycle.confirmation_required == false
+            columns(::User, %w[add_auth_provisioned_at], "optional confirmation provisioning")
+            check("Enable password authentication for optional signup confirmation") { config.passwords_enabled }
+          end
           if defined?(::PasswordsController)
             check("Retire stock password reset entry points through the shared account flow") { ::PasswordsController < AccountPasswordEntry }
           end
@@ -179,10 +184,12 @@ module AddAuth
           check("Enable security notification delivery errors") { ::AddAuth::SecurityMailer.raise_delivery_errors }
         end
         if config.step_up.enabled
-          check("Enable session and email prerequisites for step_up") { config.session.enabled && config.email_link.enabled }
+          check("Enable session prerequisites for step_up") { config.session.enabled }
           columns(::Session, %w[elevation_version elevation_expires_at], "reauthentication")
-          columns(defined?(::AddAuthSignInToken) && ::AddAuthSignInToken,
-            %w[browser_digest session_id session_digest authentication_purpose], "reauthentication")
+          if config.email_link.enabled
+            columns(defined?(::AddAuthSignInToken) && ::AddAuthSignInToken,
+              %w[browser_digest session_id session_digest authentication_purpose], "reauthentication")
+          end
           check("Declare valid step-up purposes and safe return destinations") { Runtime.step_up_purposes.any? && Runtime.step_up_policy }
           %w[/reauthenticate /reauthenticate/link].each do |path|
             check("Install route #{path}") { ::Rails.application.routes.recognize_path(path, method: :get) }

data/lib/add_auth/rails/migration/key_type.rb

@@ -7,15 +7,15 @@ module AddAuth
         module_function
 
         # Resolve when the migration runs, after the host's account table exists.
-        # Session IDs remain integer until opaque cursor support is established.
+        # Keep the session keyword for migrations generated by earlier releases.
         def for(connection, table, session: false)
           key = connection.primary_key(table)
           column = connection.columns(table).find { |entry| entry.name == key }
           raise ArgumentError, "AddAuth requires a single integer or UUID primary key on #{table}" unless column
           return :bigint if column.type == :integer && column.limit == 8
           return :integer if column.type == :integer
-          return :uuid if column.type == :uuid && !session
-          raise ArgumentError, session ? "AddAuth requires integer Session IDs; UUID accounts can use integer Sessions" : "AddAuth requires an integer or UUID account primary key"
+          return :uuid if column.type == :uuid
+          raise ArgumentError, "AddAuth requires an integer or UUID primary key on #{table}"
         end
       end
     end

data/lib/add_auth/rails/runtime.rb

@@ -15,11 +15,17 @@ module AddAuth
       def config = AddAuth.configuration
 
       def account_policy
-        Core::AccountPolicy.new(enabled: config.lifecycle.enabled, eligible: config.lifecycle.eligible)
+        Core::AccountPolicy.new(enabled: config.lifecycle.enabled,
+          eligible: ->(user) { config.eligible.call(user) == true && config.lifecycle.eligible.call(user) == true },
+          confirmation_required: config.lifecycle.confirmation_required, reset_unconfirmed: config.lifecycle.reset_unconfirmed)
       end
 
       def eligible(user)
-        config.eligible.call(user) == true && account_policy.allowed?(user)
+        account_policy.allowed?(user)
+      end
+
+      def trusted_recovery_address(user)
+        config.trusted_recovery_address.call(user) if account_policy.trusted_address?(user)
       end
 
       def authority
@@ -74,11 +80,14 @@ module AddAuth
 
       def accounts
         raise AddAuth::Error, "enable account lifecycle first" unless config.lifecycle.enabled
+        if !account_policy.confirmation_required? && !::User.column_names.include?("add_auth_provisioned_at")
+          raise AddAuth::Error, "rerun add_auth:accounts and migrate before enabling optional confirmation"
+        end
         require "add_auth/rails/stores/account_tokens"
         Core::AccountLifecycle.new(store: Stores::AccountTokens.new(user_model: ::User, token_model: ::AddAuthAccountToken,
           session_model: ::Session, address_model: ::AddAuthAddressClaim, authority: authority, provision: config.lifecycle.provision, delete_account: config.lifecycle.delete_account),
           digest: config.sign_in_token_digest, delivery_cipher: DeliveryCipher.new(key: key("account-proofs")),
-          policy: account_policy, password_policy: config.lifecycle.password_policy, trusted_address: config.trusted_recovery_address,
+          policy: account_policy, password_policy: config.lifecycle.password_policy, trusted_address: method(:trusted_recovery_address),
           lifetime: config.lifecycle.proof_lifetime, notify: ->(**event) { security_events.issue(**event) if config.notifications.enabled },
           sessions: sessions, step_up_policy: step_up_policy, profile_attributes: config.lifecycle.profile_attributes, deletion_allowed: config.lifecycle.deletion_allowed,
           external_identities: -> { external_identities })
@@ -168,7 +177,7 @@ module AddAuth
         Core::AccessPolicy.new(credentials: ->(id) {
           ::AddAuthCredential.find_by(external_id: id) if defined?(::AddAuthCredential) && ::AddAuthCredential.table_exists?
         }, passkeys_enabled: config.passkeys.enabled, email_enabled: Core::Intake.email_available?(config),
-          trusted_recovery_address: config.trusted_recovery_address, password_enabled: config.passwords_enabled,
+          trusted_recovery_address: method(:trusted_recovery_address), password_enabled: config.passwords_enabled,
           external_enabled: config.external_identities.enabled,
           external_current: ->(**arguments) { external_identities.credential_current?(**arguments) })
       end

data/lib/add_auth/rails/stores/account_tokens.rb

@@ -16,16 +16,19 @@ module AddAuth
           @account_credentials = AccountCredentials.new(user_model: user_model, authority: authority)
         end
 
-        def create_account(email:, password:, profile: {})
+        def create_account(email:, password:, profile: {}, replacing: nil)
           raise AddAuth::Error, "registration must own its transaction" if @users.connection.transaction_open?
           completed = false
+          saved = false
           @users.transaction do |transaction|
             transaction.after_commit { completed = true }
+            AccountLock.new(@users).current_in_transaction(id: replacing.user_id) if replacing
             user = @users.new(profile)
             user.email_address = email
             user.password = password
             user.add_auth_authority = "add_auth"
             user.save!
+            saved = true
             yield user
           end
           raise AddAuth::Error, "registration transaction rolled back" unless completed
@@ -33,6 +36,7 @@ module AddAuth
         rescue ActiveRecord::RecordNotUnique, Core::AccountLifecycle::Conflict
           :duplicate
         rescue ActiveRecord::RecordInvalid => error
+          raise if saved
           (error.record.errors.attribute_names - [:email_address]).empty? ? :duplicate : :invalid
         end
 
@@ -81,7 +85,11 @@ module AddAuth
         end
 
         def revoke_authority(user:, at:) = @authority.revoke(user_id: user.id, at: at)
-        def provision(user:) = @provision.call(user)
+
+        def provision(user:)
+          @provision.call(user)
+          user.reload
+        end
 
         def delete_account(user:)
           raise AddAuth::Error, "account deletion requires its owning transaction" unless @users.connection.transaction_open?

data/lib/add_auth/rails/stores/sessions.rb

@@ -6,8 +6,11 @@ module AddAuth
   module Rails
     module Stores
       class Sessions
+        attr_reader :id_type
+
         def initialize(user_model:, session_model:)
           @users, @sessions = user_model, session_model
+          @id_type = @sessions.columns_hash.fetch(@sessions.primary_key).type
           raise ArgumentError, "authentication models must share one connection pool" unless @users.connection_pool.equal?(@sessions.connection_pool)
           @lock = AccountLock.new(@users)
         end
@@ -38,11 +41,16 @@ module AddAuth
         # Query cutoffs come from Core; Core still authorizes every returned row.
         def list_for_user(user_id:, before:, excluding:, limit:, now:, active_after:, legacy:)
           scope = @sessions.where(user_id: user_id, revoked_at: nil)
-          scope = scope.where("id < ?", before) if before
+          if before&.key?(:legacy_id)
+            scope = scope.where("id < ?", before.fetch(:legacy_id))
+          elsif before
+            scope = scope.where("created_at < ? OR (created_at = ? AND id < ?)",
+              before.fetch(:created_at), before.fetch(:created_at), before.fetch(:id))
+          end
           scope = scope.where.not(id: excluding) if excluding
           scope = scope.where("(expires_at IS NULL OR expires_at > ?) AND (last_seen_at IS NULL OR last_seen_at > ?)", now, active_after)
           scope = scope.where.not(expires_at: nil).where.not(last_seen_at: nil) unless legacy
-          scope.order(id: :desc).limit(limit).to_a
+          scope.order(created_at: :desc, id: :desc).limit(limit).to_a
         end
 
         def find_for_user(user_id:, session_id:) = @sessions.find_by(user_id: user_id, id: session_id)

data/lib/add_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AddAuth
-  VERSION = "0.3.0"
+  VERSION = "0.5.0"
 end

data/lib/generators/add_auth/accounts/accounts_generator.rb

@@ -1,27 +1,33 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class AccountsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
+      class_option :email_link, type: :boolean, default: true, desc: "Enable email sign-in as a step-up dependency"
       desc "Prepare optional account lifecycle schema and pages; review existing account confirmation and policy before enabling"
 
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
 
       def prerequisites
         invoke "add_auth:notifications"
-        invoke "add_auth:step_up"
+        invoke "add_auth:step_up", [], email_link: options[:email_link]
       end
 
       def persistence
         unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_accounts.rb")].any?
           migration_template "add_add_auth_accounts.rb.tt", "db/migrate/add_add_auth_accounts.rb"
         end
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_provisioning.rb")].any?
+          migration_template "add_add_auth_provisioning.rb.tt", "db/migrate/add_add_auth_provisioning.rb"
+        end
         %w[add_auth_account_token add_auth_address_claim].each do |name|
           template "#{name}.rb", "app/models/#{name}.rb" unless File.exist?(File.join(destination_root, "app/models/#{name}.rb"))
         end

data/lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt

@@ -14,7 +14,7 @@ class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
     add_column :users, :add_auth_authority, :string, default: "add_auth", null: false unless column_exists?(:users, :add_auth_authority)
     add_column :sessions, :remembered, :boolean, default: false_default, null: false unless column_exists?(:sessions, :remembered)
     add_column :sessions, :idle_timeout, :integer unless column_exists?(:sessions, :idle_timeout)
-    create_table :add_auth_address_claims do |t|
+    create_table :add_auth_address_claims, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :digest, null: false
       t.string :state, null: false
@@ -22,7 +22,7 @@ class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
     end
     add_index :add_auth_address_claims, :digest, unique: true
     add_index :add_auth_address_claims, [:user_id, :state], unique: true
-    create_table :add_auth_account_tokens do |t|
+    create_table :add_auth_account_tokens, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :digest, null: false
       t.string :purpose, null: false

data/lib/generators/add_auth/accounts/templates/add_add_auth_provisioning.rb.tt

@@ -0,0 +1,9 @@
+class AddAddAuthProvisioning < ActiveRecord::Migration[8.0]
+  def up
+    add_column :users, :add_auth_provisioned_at, :datetime unless column_exists?(:users, :add_auth_provisioned_at)
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration, "Retain provisioning receipts to prevent repeating account setup"
+  end
+end

data/lib/generators/add_auth/email_link/email_link_generator.rb

@@ -1,14 +1,17 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class EmailLinkGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
+      class_option :enable, type: :boolean, default: true, desc: "Enable email sign-in after preparing its storage"
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
 
       def dependencies
@@ -48,7 +51,7 @@ module AddAuth
         unless File.read(File.join(destination_root, "config/routes.rb")).include?("add_auth/challenge.js")
           route 'get "add_auth/challenge.js", to: "add_auth/assets#challenge"'
         end
-        gsub_file "config/initializers/add_auth.rb", "# config.email_link.enabled = true", "config.email_link.enabled = true"
+        enable_feature(:email_link) if options[:enable]
         say "Review and migrate, configure base_url/mail_from, a durable queue, shared rate-limit cache and a recurring add_auth:deliver_pending sweep."
       end
     end

data/lib/generators/add_auth/email_tokens/email_tokens_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
@@ -8,6 +9,7 @@ module AddAuth
     # Internal persistence foundation only. Does not install sign-in routes.
     class EmailTokensGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
 

data/lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt

@@ -2,7 +2,7 @@ require "add_auth/rails/migration/key_type"
 
 class CreateAddAuthSignInTokens < ActiveRecord::Migration[8.0]
   def change
-    create_table :add_auth_sign_in_tokens do |t|
+    create_table :add_auth_sign_in_tokens, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), null: false, foreign_key: true
       t.string :digest, limit: 64, null: false
       t.string :identifier_digest, limit: 64, null: false

data/lib/generators/add_auth/external_identities/external_identities_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
@@ -8,6 +9,7 @@ module AddAuth
     # Optional persistence and routes; provider strategies remain disabled until configured.
     class ExternalIdentitiesGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)

data/lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt

@@ -1,8 +1,10 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
   def change
-    user_type = reference_type(:users)
-    session_type = reference_type(:sessions)
-    create_table :add_auth_external_identities do |t|
+    user_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    session_type = AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true)
+    create_table :add_auth_external_identities, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_type, null: false, foreign_key: {on_delete: :cascade}
       # SHA256 of the exact JSON [configuration, issuer, audience, subject].
       # Indexing this key preserves case-sensitive subjects on either store.
@@ -18,7 +20,7 @@ class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
       t.timestamps
     end
     add_index :add_auth_external_identities, :namespace, unique: true
-    create_table :add_auth_external_transactions do |t|
+    create_table :add_auth_external_transactions, id: <%= authentication_primary_key_type %> do |t|
       t.string :digest, null: false
       t.string :browser_digest, null: false
       t.string :provider_id, limit: 2048, null: false
@@ -39,12 +41,4 @@ class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_external_id, :string
     add_column :sessions, :authentication_external_version, :string
   end
-
-  private
-
-  def reference_type(table)
-    column = connection.columns(table).find { |item| item.name == connection.primary_key(table) }
-    raise "Unsupported authentication primary key" unless column && [:integer, :uuid].include?(column.type)
-    (column.type == :integer && column.limit == 8) ? :bigint : column.type
-  end
 end

data/lib/generators/add_auth/feature_configuration.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Generators
+    module FeatureConfiguration
+      private
+
+      def enable_feature(name)
+        path = "config/initializers/add_auth.rb"
+        source = File.read(File.join(destination_root, path))
+        setting = "config.#{name}.enabled"
+        pattern = /^(\s*)(?:# #{Regexp.escape(setting)} = true|#{Regexp.escape(setting)} = false)$/
+        if source.match?(pattern)
+          gsub_file path, pattern, "\\1#{setting} = true"
+        elsif !source.match?(/^\s*#{Regexp.escape(setting)}\s*=/)
+          append_to_file path, "\nAddAuth.configure do |config|\n  #{setting} = true\nend\n"
+        end
+      end
+    end
+  end
+end