add_auth 0.3.0 → 0.5.0

data/lib/generators/add_auth/install/templates/initializer.rb

@@ -1,52 +1,156 @@
-# AddAuth configuration. Feature generators enable only their own block.
+# frozen_string_literal: true
+
+# AddAuth settings. Defaults are active; alternatives are commented out.
+# Run the relevant generator and migrations before enabling a feature.
+# Install alone enables no features. Existing initializers are never replaced.
 AddAuth.configure do |config|
-  # Set false for email/passkey-only sign-in. Existing Rails password entry
-  # routes remain guarded; the host owns password reset and account provisioning.
-  # config.passwords_enabled = true
-
-  # Ordinary Rails HTML navigation, including hosts without Hotwire:
-  # config.turbo_enabled = false
-  # Passkeys/captcha still use scoped gem JavaScript; no host JS build is needed.
-
-  # BEGIN add_auth session
-  # config.session.enabled = true
-  # END add_auth session
-  # config.session.lifetime = 12.hours
-  # config.session.idle_timeout = 30.minutes
-  # Legacy cookies are rejected by default. Opt into a finite bridge explicitly:
-  # config.session.legacy_bridge_until = Time.iso8601("2026-09-13T00:00:00Z")
-
-  # BEGIN add_auth email_link
-  # config.email_link.enabled = true
-  # END add_auth email_link
-  # config.email_link.token_lifetime = 20.minutes
-  # config.email_link.same_browser = false # true requires the requesting browser
-  # REQUIRED for email delivery: fixed, trusted origin; never derive it from Host.
-  # config.base_url = "https://your-app.example"
-  # config.mail_from = "Your app <sign-in@your-app.example>"
-  # Configure a durable Active Job adapter and schedule add_auth:deliver_pending.
-  # Rails.cache is suitable only with shared atomic increments and expiry.
-  # Solid Cache is not suitable; configure a separate counter store:
-  # https://addauthgem.com/production/#rate-limits
-  # Each maintenance pass handles at most this many rows per operation/model:
-  # config.maintenance.batch_size = 100 # 1..1000
-  # History is retained until the host chooses a retention period (seconds):
-  # config.maintenance.session_retention = 7.days
-  # config.maintenance.email_retention = 7.days
-  # config.maintenance.notification_retention = 30.days
-
-  # Apply the host's current confirmed/locked/disabled policy on every resume:
-  # config.eligible = ->(user) { user.confirmed? && !user.locked? && !user.disabled? }
-
-  # Styling: nil disables CSS; a local path uses your own compiled stylesheet.
-  # config.stylesheet = "/add_auth.css"
-  # config.css_classes = { input: "form-control", button: "btn btn-primary" }
-  # Eject editable templates with bin/rails generate add_auth:views.
-
-  # Enable optional features with add_auth:passkeys, add_auth:step_up,
-  # add_auth:notifications or add_auth:challenge. Install alone enables none.
-  # Passkey recovery needs a host-verified recovery address; strict accounts
-  # use another passkey or the host's support process, never email recovery.
-  # config.challenge = AddAuth::Core::Challenge::Null.new
-  # config.challenge_on = []
+  # Sign-in and rendering. HTML forms work in all browser modes.
+  config.passwords_enabled = true
+  # config.passwords_enabled = false # Use only other explicitly enabled methods.
+  config.turbo_enabled = true
+  # config.turbo_enabled = false # Ordinary JS navigation, with Turbo absent.
+
+  # Host business eligibility is checked alongside Core account policy.
+  config.eligible = ->(_user) { true }
+  # config.eligible = ->(user) { user.access_state == "active" }
+
+  # Browser sessions: bin/rails generate add_auth:session_upgrade
+  config.session.enabled = false
+  config.session.lifetime = 43_200 # 12 hours, absolute expiry.
+  config.session.idle_timeout = 1800 # 30 minutes; no greater than lifetime.
+  config.session.legacy_bridge_until = nil # Reject old Rails session-ID cookies.
+  # config.session.legacy_bridge_until = Time.iso8601("2030-01-01T00:00:00Z")
+  # Choose a short, fixed cutover deadline for a reviewed legacy-cookie bridge.
+
+  # Account lifecycle: bin/rails generate add_auth:accounts
+  # Password-only host: bin/rails generate add_auth:accounts --no-email-link
+  config.lifecycle.enabled = false
+  # config.lifecycle.enabled = true # After policy review and migrations.
+  config.lifecycle.confirmation_required = true
+  # config.lifecycle.confirmation_required = false
+  # false: password signup provisions and signs in immediately, without mail.
+  # confirmed_at stays nil. Requires the add_auth_provisioned_at migration.
+  config.lifecycle.reset_unconfirmed = false
+  # config.lifecycle.reset_unconfirmed = true # Requires optional confirmation.
+  # true: the stored mailbox holder may reset an unconfirmed password account
+  # after consuming an exact-address, single-use reset proof. No automatic login
+  # or confirmation. This does not trust the address for any other recovery.
+  # false: confirm the address before password reset, or use host support.
+  # Email changes always need fresh reauthentication and proof of the new address.
+  config.lifecycle.password_policy = ->(password) { password.length >= 12 && password.bytesize <= 72 }
+  config.lifecycle.eligible = ->(_user) { true } # Additional lifecycle eligibility.
+  config.lifecycle.profile_attributes = ->(_profile) { {} } # Accept no profile fields.
+  # config.lifecycle.profile_attributes = ->(profile) { profile.slice(:name, :consent) }
+  # Also allowlist those fields in the host registration controller. Never roles.
+  config.lifecycle.provision = ->(_user) {} # Local writes in the account transaction.
+  # config.lifecycle.provision = ->(user) { user.create_personal_workspace! }
+  # Raise on failure. Use the same DB pool; remote work needs a host outbox.
+  config.lifecycle.maximum_attempts = 20 # Failed-password threshold: 1..100.
+  config.lifecycle.unlock_in = 3600 # Timed lock: 60..86400 seconds.
+  config.lifecycle.proof_lifetime = 3600 # Account links: 60..86400 seconds.
+  config.lifecycle.remember_lifetime = 1_209_600 # 14 days, absolute expiry.
+  config.lifecycle.remember_idle_timeout = 604_800 # 7 days; <= remember_lifetime.
+  config.lifecycle.deletion_allowed = ->(_user) { true } # Host authorization/retention.
+  # config.lifecycle.deletion_allowed = ->(user) { user.invoices.none? }
+  config.lifecycle.delete_account = ->(user) { user.destroy! } # Same-DB local deletion.
+
+  # Email-link sign-in: bin/rails generate add_auth:email_link
+  # Account confirmation/reset mail does not require email-link sign-in.
+  config.email_link.enabled = false
+  config.email_link.token_lifetime = 1200 # 20 minutes.
+  config.email_link.same_browser = false
+  # config.email_link.same_browser = true # Require the requesting browser.
+
+  # Fresh proof for sensitive actions: bin/rails generate add_auth:step_up
+  # Use --no-email-link for password-only reauthentication.
+  config.step_up.enabled = false
+  config.step_up.fresh_for = 600 # Ordinary proof: 10 minutes.
+  config.step_up.strong_for = 300 # Strong proof: 5 minutes.
+  config.step_up.purposes = {} # Built-in feature purposes are supplied by Core.
+  # config.step_up.purposes = {
+  #   export_data: {methods: [:password], return_to: "/exports/new", label: "export your data"}
+  # }
+  # Recheck elevation and host authorization inside the actual mutation.
+
+  # Passkeys: bin/rails generate add_auth:passkeys
+  config.passkeys.enabled = false
+  config.passkeys.rp_id = nil # Required: stable deployment RP ID.
+  # config.passkeys.rp_id = "example.com"
+  config.passkeys.origins = [] # Required: exact trusted origins, never request Host.
+  # config.passkeys.origins = ["https://app.example.com"]
+  config.passkeys.name = "Your account"
+  config.passkeys.anonymous_limit = 1000 # Shared ceremony budget per five minutes.
+  config.trusted_recovery_address = ->(_user) {} # No trusted recovery by default.
+  # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed_at }
+  # Lifecycle additionally rejects unconfirmed addresses as trusted recovery.
+  config.support_url = nil # Required before strict-policy activation.
+  # config.support_url = "/support" # Document your host-owned recovery process.
+
+  # Security notices: bin/rails generate add_auth:notifications
+  config.notifications.enabled = false
+  # Mail/queue settings also serve account proofs and optional email sign-in.
+  config.base_url = nil # Required for links: fixed trusted HTTPS origin.
+  # config.base_url = "https://app.example.com"
+  config.mail_from = nil # Required for mail; configure SMTP in Rails as usual.
+  # config.mail_from = "Your app <sign-in@example.com>"
+  # Configure a durable Active Job adapter and run add_auth:deliver_pending each minute.
+  config.rate_limit_store = nil # Defaults to Rails.cache; shared atomic counters required.
+  # config.rate_limit_store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV.fetch("AUTH_REDIS_URL"))
+  # Solid Cache can serve application caching, but cannot serve these counters.
+  config.maintenance.batch_size = 100 # Maximum rows per operation/model: 1..1000.
+  config.maintenance.session_retention = nil # Keep history until explicitly selected.
+  config.maintenance.email_retention = nil
+  config.maintenance.notification_retention = nil
+  config.maintenance.account_retention = nil
+  # config.maintenance.session_retention = 604_800 # 7 days, seconds.
+  # config.maintenance.email_retention = 604_800
+  # config.maintenance.notification_retention = 2_592_000 # 30 days.
+  # config.maintenance.account_retention = 604_800
+
+  # Captcha: bin/rails generate add_auth:challenge (provider-specific setup).
+  config.challenge = AddAuth::Core::Challenge::Null.new
+  config.challenge_on = [] # Available: sign_in, email_link, reauthenticate,
+  # passkey_enrollment, register, account_request, provider.
+  # config.challenge_on = [:sign_in, :register, :account_request]
+  config.challenge_when_unavailable = :closed
+  # config.challenge_when_unavailable = :open # Explicit outage bypass; emits an event.
+  # Replace challenge with a configured Turnstile or Recaptcha adapter. Keep
+  # secrets in Rails credentials/environment, and configure expected hostnames.
+
+  # Optional providers: bin/rails generate add_auth:external_identities
+  config.external_identities.enabled = false
+  # Register only reviewed Core provider configurations through
+  # config.external_identities.register(id:, label:, middleware_name:, configuration:,
+  #   apple_form_post: false, reauthentication: false)
+  # or config.external_identities.register_native(configuration:).
+  # The generated add_auth_providers.rb explains provider-library middleware,
+  # verifier and credential setup. It remains commented out until reviewed.
+
+  # Native sessions: bin/rails generate add_auth:mobile_sessions
+  config.mobile.enabled = false
+  config.mobile.lifetime = nil # Required when enabled; choose finite seconds.
+  config.mobile.idle_timeout = nil # Required; <= lifetime.
+  config.mobile.clients = [] # Explicit first-party client identifiers.
+  config.mobile.callbacks = {} # Reviewed callbacks per client, when using handoffs.
+  config.mobile.apple_providers = {} # Native Apple provider IDs per client.
+  # config.mobile.lifetime = 2_592_000 # Example: 30 days.
+  # config.mobile.idle_timeout = 1_209_600 # Example: 14 days.
+  # config.mobile.clients = %w[android ios]
+
+  # Presentation: eject with bin/rails generate add_auth:views.
+  config.stylesheet = "/add_auth.css"
+  # config.stylesheet = nil # Supply your own styling.
+  config.css_classes = {}
+  # config.css_classes = {input: "form-control", button: "btn btn-primary"}
+
+  # Password migration and cryptography: retain Rails' verifier by default.
+  config.legacy_password_verifier = nil
+  config.current_password_support = AddAuth::Core::Passwords::BcryptSupport.new
+  # A custom verifier must also declare current_password_support.available?(digest:).
+  # Rails configures digest_secret from its key generator automatically. Preserve it.
+  # Outside Rails only:
+  # config.digest_secret = -> { ENV.fetch("ADD_AUTH_DIGEST_SECRET") }
+  # Optional adapter overrides must implement digest(token) and matches?(digest, token):
+  # config.session_token_digest = MySessionDigest.new
+  # config.sign_in_token_digest = MyProofDigest.new
 end

data/lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class MobileSessionsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)

data/lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt

@@ -1,9 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthMobileHandoffs < ActiveRecord::Migration[8.0]
   def change
-    user_key = connection.columns(:users).find { |column| column.name == connection.primary_key(:users) }
-    raise "Unsupported authentication primary key" unless user_key && [:integer, :uuid].include?(user_key.type)
-    user_type = (user_key.type == :integer && user_key.limit == 8) ? :bigint : user_key.type
-    create_table :add_auth_mobile_handoffs do |t|
+    user_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    create_table :add_auth_mobile_handoffs, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
       t.string :external_digest, null: false
       t.string :digest

data/lib/generators/add_auth/notifications/notifications_generator.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class NotificationsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
@@ -21,10 +25,7 @@ module AddAuth
       end
 
       def configuration
-        path = "config/initializers/add_auth.rb"
-        unless File.read(File.join(destination_root, path)).include?("config.notifications.enabled = true")
-          append_to_file path, "\nAddAuth.configure do |config|\n  config.notifications.enabled = true\nend\n"
-        end
+        enable_feature(:notifications)
         say "Migrate, configure mail_from and a durable queue, and schedule add_auth:deliver_pending every minute."
       end
     end

data/lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt

@@ -2,7 +2,7 @@ require "add_auth/rails/migration/key_type"
 
 class CreateAddAuthSecurityEvents < ActiveRecord::Migration[8.0]
   def change
-    create_table :add_auth_security_events do |t|
+    create_table :add_auth_security_events, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), foreign_key: {on_delete: :nullify}
       t.string :kind, null: false
       t.string :digest, null: false

data/lib/generators/add_auth/passkeys/passkeys_generator.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class PasskeysGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
@@ -47,27 +51,7 @@ module AddAuth
             post "recover/link", to: "add_auth/recoveries#confirm"
           ROUTES
         end
-        path = "config/initializers/add_auth.rb"
-        unless File.read(File.join(destination_root, path)).include?("config.passkeys.enabled = true")
-          append_to_file path, <<~CONFIG
-
-            AddAuth.configure do |config|
-              config.passkeys.enabled = true
-              # REQUIRED: stable RP ID and exact deployment origins, never request Host.
-              # config.passkeys.rp_id = "example.com"
-              # config.passkeys.origins = ["https://app.example.com"]
-              # config.passkeys.name = "Your app"
-              # Shared anonymous ceremony budget per five minutes; positive integer.
-              # config.passkeys.anonymous_limit = 1000
-              # Schedule add_auth:deliver_pending every minute. Production doctor
-              # requires a completed cleanup within the last two minutes.
-              # REQUIRED for email replacement: a host-verified recovery address.
-              # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed? }
-              # REQUIRED before strict activation: your documented support route.
-              # config.support_url = "/support"
-            end
-          CONFIG
-        end
+        enable_feature(:passkeys)
         say "Review and migrate before enabling traffic. Configure RP/origins, trusted recovery and notifications; run add_auth:doctor."
       end
     end

data/lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt

@@ -14,7 +14,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_policy_version, :integer, default: 0, null: false
     add_column :sessions, :authentication_credential_id, :string
     add_column :sessions, :authentication_uv, :boolean, default: false_default, null: false
-    create_table :add_auth_credentials do |t|
+    create_table :add_auth_credentials, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :external_id, null: false
       t.text :public_key, null: false
@@ -29,7 +29,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
       t.timestamps
     end
     add_index :add_auth_credentials, :external_id, unique: true
-    create_table :add_auth_ceremonies do |t|
+    create_table :add_auth_ceremonies, id: <%= authentication_primary_key_type %> do |t|
       t.string :digest, null: false
       t.string :challenge, null: false
       t.string :kind, null: false

data/lib/generators/add_auth/primary_key.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Generators
+    module PrimaryKey
+      private
+
+      # Freeze Rails' generator preference into the migration source. Foreign
+      # keys independently follow the actual referenced table when it runs.
+      def authentication_primary_key_type
+        type = (::Rails.application.config.generators.options.dig(:active_record, :primary_key_type) || :bigint).to_s
+        unless %w[bigint integer uuid].include?(type)
+          raise Thor::Error, "AddAuth supports Rails primary_key_type :bigint, :integer or :uuid"
+        end
+        ":#{type}"
+      end
+    end
+  end
+end

data/lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class SessionUpgradeGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
 
@@ -23,6 +25,9 @@ module AddAuth
       end
 
       def migration
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_session_cursor_index.rb")].any?
+          migration_template "add_add_auth_session_cursor_index.rb.tt", "db/migrate/add_add_auth_session_cursor_index.rb"
+        end
         unless Dir[File.join(destination_root, "db/migrate/*_extend_sessions_for_add_auth.rb")].any?
           migration_template "extend_sessions_for_add_auth.rb.tt", "db/migrate/extend_sessions_for_add_auth.rb"
         end
@@ -62,7 +67,7 @@ module AddAuth
         unless File.read(File.join(destination_root, path)).include?('require "add_auth/rails/authentication"')
           prepend_to_file path, %(require "add_auth/rails/authentication"\nrequire "add_auth/rails/user_lifecycle"\n)
         end
-        gsub_file path, "# config.session.enabled = true", "config.session.enabled = true"
+        enable_feature(:session)
         routes = File.join(destination_root, "config/routes.rb")
         source = File.read(routes)
         unless source.include?("# AddAuth session management")

data/lib/generators/add_auth/session_upgrade/templates/add_add_auth_session_cursor_index.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthSessionCursorIndex < ActiveRecord::Migration[8.0]
+  def change
+    add_index :sessions, [:user_id, :created_at, :id], name: "index_add_auth_session_cursor"
+  end
+end

data/lib/generators/add_auth/step_up/step_up_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class StepUpGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)
+      class_option :email_link, type: :boolean, default: true, desc: "Enable email sign-in alongside reauthentication"
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)
 
       def dependencies
-        invoke "add_auth:email_link"
+        invoke "add_auth:email_link", [], enable: options[:email_link]
       end
 
       def persistence
@@ -33,10 +36,7 @@ module AddAuth
             post "reauthenticate/link", to: "add_auth/reauthentications#confirm"
           ROUTES
         end
-        initializer = "config/initializers/add_auth.rb"
-        unless File.read(File.join(destination_root, initializer)).include?("config.step_up.enabled = true")
-          append_to_file initializer, "\nAddAuth.configure do |config|\n  config.step_up.enabled = true\n  # Declare purpose methods and a fixed safe GET return_to before use.\nend\n"
-        end
+        enable_feature(:step_up)
         say "Migrate and declare config.step_up.purposes. Use with_elevated_session around sensitive database mutations."
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: add_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Taimoor Qureshi
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: webauthn
   requirement: !ruby/object:Gem::Requirement
@@ -315,6 +329,8 @@ files:
 - lib/add_auth/core/rate_limit.rb
 - lib/add_auth/core/remaining_factors.rb
 - lib/add_auth/core/security_events.rb
+- lib/add_auth/core/session_cursor.rb
+- lib/add_auth/core/session_key.rb
 - lib/add_auth/core/sessions.rb
 - lib/add_auth/core/step_up.rb
 - lib/add_auth/core/strategies/email_link.rb
@@ -364,6 +380,7 @@ files:
 - lib/add_auth/version.rb
 - lib/generators/add_auth/accounts/accounts_generator.rb
 - lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt
+- lib/generators/add_auth/accounts/templates/add_add_auth_provisioning.rb.tt
 - lib/generators/add_auth/accounts/templates/add_auth_account_token.rb
 - lib/generators/add_auth/accounts/templates/add_auth_address_claim.rb
 - lib/generators/add_auth/challenge/challenge_generator.rb
@@ -388,6 +405,7 @@ files:
 - lib/generators/add_auth/external_identities/templates/add_auth_external_transaction.rb
 - lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt
 - lib/generators/add_auth/external_identities/templates/providers.rb
+- lib/generators/add_auth/feature_configuration.rb
 - lib/generators/add_auth/install/install_generator.rb
 - lib/generators/add_auth/install/templates/initializer.rb
 - lib/generators/add_auth/javascript/javascript_generator.rb
@@ -407,8 +425,10 @@ files:
 - lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt
 - lib/generators/add_auth/passkeys/templates/add_auth_ceremony.rb
 - lib/generators/add_auth/passkeys/templates/add_auth_credential.rb
+- lib/generators/add_auth/primary_key.rb
 - lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb
 - lib/generators/add_auth/session_upgrade/templates/add_add_auth_elevation.rb.tt
+- lib/generators/add_auth/session_upgrade/templates/add_add_auth_session_cursor_index.rb.tt
 - lib/generators/add_auth/session_upgrade/templates/extend_sessions_for_add_auth.rb.tt
 - lib/generators/add_auth/step_up/step_up_generator.rb
 - lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt