add_auth 0.4.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ed4ef07ed6308f6bb4b82de3e67552af3604472f38e7a379f1d9c863f76954e
-  data.tar.gz: 8189c0ddf517a9d06d291738e0d0d20bb383ffc9a7fdd085c9df33ad914312d4
+  metadata.gz: 0f425748354f43e9f37579150ae2fe1cae7797f5da8c37af7e9f330b783a2d96
+  data.tar.gz: 8b7187ffe5b74c138d68cf4ffac7edf7c65e3d258941edec49c72f55a743c621
 SHA512:
-  metadata.gz: 643216bb646e0ca6032f0b53f1928eb6da0b4efeffccadd8477fbb7776f6aa411c6ecf36bb4c3f785d94fa435320c04745a2565c70cef47e387f14fc534b805b
-  data.tar.gz: 48375790d81d186fa5cfd6f4f3ecf4672c46b2ec8602a3597c5a40b69562661212de41f5df8676a7080ef96ab36915af6dec798400aa97610b5b3c22d76be2d4
+  metadata.gz: 51c64dbd5366aac908be7df8fd4f82c9501ce081400fb77976ece4b92fa9066a7aca0fc799a7ba4e99ce3c19609190db702373e6e45fddc055795df8b23898c7
+  data.tar.gz: 9a37bfc7978081e75ea517ae9ba414fa4b2771ec7d9bb8ea6a56acf6da1ee3fe2b0882989e9177198a701ce409e2b05af225214389bb5361b0845bb5d6df5f01

data/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.5.1 — 2026-10-21
+
+Security hardening; upgrading is recommended. Refresh ejected account and
+passkey controllers/views through the normal review process.
+
+- The first email confirmation of an account with a linked sign-in provider
+  names that provider in the email and on the page. Only an explicit "Confirm
+  and keep" preserves the link; any other confirmation removes it.
+- Automatic password lockout gates only password sign-in. It no longer revokes
+  existing sessions or blocks passkey, email-link or provider sign-in, never
+  counts failures for accounts that cannot use a password, and is cleared by a
+  successful password reset. Manual locks are unchanged.
+- Sign out everywhere also revokes outstanding email proofs, account proofs
+  (such as a pending address change), passkey/provider ceremonies and mobile
+  handoffs.
+- Rate limits check the IP budget first and charge the identifier budget only
+  after a configured challenge passes. Passkey sign-in option requests use their
+  own IP budget, and `passkeys.anonymous_limit` now applies per IPv4 address or
+  IPv6 /64 rather than globally.
+
+## 0.5.0 — 2026-09-18
+
+- Honor Rails' `primary_key_type` generator setting for all AddAuth-owned tables.
+  Support PostgreSQL UUID sessions and mixed integer/UUID account/session keys,
+  retaining bigint defaults and deriving references from the existing schema.
+- Use creation time and a typed ID in opaque session-page cursors; validate
+  revocation and explicitly enabled legacy session adoption for either key type.
+  For apps already using hardened sessions, re-run `add_auth:session_upgrade`
+  for the new pagination index. Existing tables retain their IDs; refresh ejected
+  controllers through the normal review process.
+  Follow the [upgrade guide](https://addauthgem.com/upgrading/#uuid-support) for
+  the release gate, migration review, opaque client cursors and rollback boundary.
+
 ## 0.4.0 — 2026-09-13
 
 - Constrain JSON below 3.0 for the supported Rails decoding API; independently

data/README.md

@@ -29,26 +29,26 @@ for verification in a disposable host.
 
 ## Quickstart
 
-These commands target 0.4.0 and are available after its
-[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.4.0).
+These commands target 0.5.1 and are available after its
+[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.5.1).
 Check package availability before changing your app’s bundle.
 
 Install the `add_auth` gem from RubyGems through your Rails app’s Gemfile,
 then enable password and email-link sign-in. Use Ruby 3.3+ and Rails 8.0+
 with Active Record, and run the commands below from your Rails app’s root.
 
-**Release availability:** these commands require the published `0.4.0` package.
+**Release availability:** these commands require the published `0.5.1` package.
 If it is not yet listed on [RubyGems](https://rubygems.org/gems/add_auth/versions),
 wait for publication; see [release status](https://addauthgem.com/release-status/).
 Start in your app’s development environment; use the deployment settings
 below before enabling sign-in for users.
 
 1. Keep `source "https://rubygems.org"` in your app’s Gemfile and add the
-   0.4 release line:
+   0.5 release line:
 
    ```ruby
    # Gemfile
-   gem "add_auth", "~> 0.4.0"
+   gem "add_auth", "~> 0.5.1"
    ```
 
    Bundler downloads the package from RubyGems and records the resolved
@@ -568,6 +568,35 @@ adds registration, confirmation/reconfirmation, password reset, lock/unlock and
 account changes. Hosts retain account eligibility, resource authorization and
 provider registrations.
 
+### UUID and integer primary keys in 0.5.0
+
+Version 0.5.0 adds PostgreSQL UUID sessions and configurable primary keys for all
+AddAuth authentication tables. Integer apps retain the normal Rails defaults.
+These instructions become available after the 0.5.0 package is published.
+
+For a new PostgreSQL app, set Rails' generator preference in `config/application.rb`
+before generating authentication or AddAuth features:
+
+```ruby
+config.generators do |g|
+  g.orm :active_record, primary_key_type: :uuid
+end
+```
+
+AddAuth uses this setting for every table it creates. Leave it unset for Rails'
+bigint default, or set `:bigint` or `:integer` explicitly. References follow the
+actual target table, so UUID users can have bigint sessions and vice versa.
+The generated migration records its chosen type; later configuration changes do
+not change that migration or convert existing rows. Other key types are unsupported.
+
+For an existing installation, follow the
+[version-gated package upgrade](https://addauthgem.com/upgrading/#uuid-support).
+It covers the additive pagination index, ejected controller review, opaque
+pagination cursors, verification and rollback from older gems. Integer apps need
+no ID conversion. The [primary-key guide](https://addauthgem.com/uuid-primary-keys/)
+explains mixed schemas and the separate, app-owned migration needed to convert
+existing IDs. The published 0.4.0 package cannot manage UUID sessions.
+
 ## Optional integrations in 0.3.0
 
 Enable bounded [Devise migration](https://addauthgem.com/migrating-from-devise/),

data/ROADMAP.md

@@ -25,6 +25,12 @@ this public checklist is derived from its section 14 and stands on its own.
 
 ## Now — maintain AddAuth and learn from adoption
 
+- [x] Honor the Rails UUID/bigint generator setting across all authentication
+  tables, including UUID sessions, mixed references and three-mode bundled/ejected
+  session management. Local PostgreSQL and browser acceptance passes on Rails
+  8.0/8.1. Added in 0.5.0; see
+  [release availability](https://github.com/taimoorq/add_auth/releases).
+
 - [x] Optional password-signup confirmation, immediate transactional provisioning
   and session issuance, explicit unconfirmed-reset policy, password-only lifecycle
   and the complete commented Rails initializer. Local supported-matrix, stock/

data/SECURITY.md

@@ -54,6 +54,10 @@ the currency policy).
 
 ## Supported versions
 
+UUID/integer session lookup, account-scoped pagination and revocation are also
+in scope. Version 0.5.0 adds UUID sessions and UUID authentication-table generation;
+primary keys must never substitute for browser/mobile bearer secrets.
+
 Until a 1.0 is released, only the latest published version receives security
 fixes. This table will be expanded once there are stable release lines to
 support.

data/app/controllers/add_auth/accounts_controller.rb

@@ -52,6 +52,7 @@ module AddAuth
     def proof
       @purpose = purpose
       result = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+      @providers = Rails::Runtime.provider_labels(result.credential) if result.success?
       page(result.success? ? "proof" : "invalid_proof")
     end
 
@@ -59,11 +60,14 @@ module AddAuth
       @purpose = purpose
       admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :account_consume)
       return intake_failure(admitted) if admitted.is_a?(Symbol)
-      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password])
+      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password],
+        keep_providers: params[:providers] == "keep")
       if result.success?
         redirect_to "/sign-in", status: :see_other, notice: "Your account has been updated. Sign in to start a new session."
       else
         @error = "This request could not be completed. Check the password requirements or request a new link."
+        preview = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+        @providers = Rails::Runtime.provider_labels(preview.credential) if preview.success?
         page("proof", status: :unprocessable_entity)
       end
     end

data/app/controllers/add_auth/passkeys_controller.rb

@@ -30,9 +30,11 @@ module AddAuth
       finish(result, destination: "/passkeys", grant: result.grant)
     end
 
+    # Conditional UI requests options on page load. Keep that off the
+    # password sign_in budget while still applying the sign_in challenge.
     def authentication_options
-      return unless admitted(:sign_in)
-      options(service.authentication_options(browser_secret: browser_secret))
+      return unless admitted(:sign_in, budget: :passkey_options)
+      options(service.authentication_options(browser_secret: browser_secret, ip: request.remote_ip))
     end
 
     def authenticate
@@ -92,8 +94,8 @@ module AddAuth
       value.to_unsafe_h if value.is_a?(ActionController::Parameters)
     end
 
-    def admitted(action)
-      result = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: action, challenge_token: challenge_token)
+    def admitted(action, budget: action)
+      result = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: action, challenge_token: challenge_token, budget: budget)
       return true if result == true
       render json: {error: "Verification could not start. Try again shortly."}, status: if result == :rate_limited
                                                                                           429

data/app/controllers/add_auth/sessions_controller.rb

@@ -25,7 +25,7 @@ module AddAuth
 
     def destroy
       target_id = params[:id].to_s
-      if target_id.match?(/\A[1-9]\d*\z/) && target_id.to_i == Current.session.id
+      if Rails::Runtime.sessions.current_session?(session: Current.session, session_id: target_id)
         terminate_session
         return redirect_to Rails::Runtime.sign_in_path, status: :see_other
       end

data/app/jobs/add_auth/account_delivery_job.rb

@@ -7,7 +7,8 @@ module AddAuth
       return unless record
       deliver(service: Rails::Runtime.accounts, record: record, mailer: AccountMailer) do |delivery|
         AccountMailer.link(recipient: delivery.fetch(:recipient), purpose: delivery.fetch(:purpose),
-          url: Rails::Runtime.account_proof_url(delivery.fetch(:token), purpose: delivery.fetch(:purpose)))
+          url: Rails::Runtime.account_proof_url(delivery.fetch(:token), purpose: delivery.fetch(:purpose)),
+          providers: Rails::Runtime.provider_labels(delivery.fetch(:providers, [])))
       end
     end
   end

data/app/mailers/add_auth/account_mailer.rb

@@ -2,7 +2,8 @@
 
 module AddAuth
   class AccountMailer < SignInMailer
-    def link(recipient:, url:, purpose:)
+    def link(recipient:, url:, purpose:, providers: [])
+      @providers = providers
       @instruction = {"confirm" => "Confirm your email address", "reset_password" => "Choose a new password", "unlock" => "Unlock your account"}.fetch(purpose)
       @url = url
       mail(to: recipient, from: Rails::Runtime.config.mail_from, subject: @instruction,

data/app/views/add_auth/account_mailer/link.text.erb

@@ -2,6 +2,10 @@
 
 Open this link, then use the button on the page to confirm your request:
 <%= @url %>
+<% if @providers.present? %>
+
+This account was started by signing in with <%= @providers.to_sentence %>. Keep <%= @providers.to_sentence %> only if you used it to create this account. If you did not, choose "Confirm without <%= @providers.to_sentence %>".
+<% end %>
 
 This link expires in <%= AddAuth.configuration.lifecycle.proof_lifetime.to_i / 60 %> minutes and can be used once.
 If you did not request this message, you can ignore it.

data/app/views/add_auth/accounts/_proof.html.erb

@@ -11,6 +11,13 @@
       <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
     </div>
   <% end %>
-  <%= form.submit title, class: add_auth_class(:button) %>
+  <% if @purpose == "confirm" && @providers.present? %>
+    <% providers = @providers.to_sentence %>
+    <p>This account was started by signing in with <%= providers %>. Keep <%= providers %> only if you used it to create this account.</p>
+    <%= form.button "Confirm and keep #{providers}", name: "providers", value: "keep", class: add_auth_class(:button) %>
+    <%= form.button "Confirm without #{providers}", name: "providers", value: "remove", class: add_auth_class(:button) %>
+  <% else %>
+    <%= form.submit title, class: add_auth_class(:button) %>
+  <% end %>
 <% end %>
 <p><%= link_to "Back to sign in", "/sign-in" %></p>

data/lib/add_auth/core/account_lifecycle.rb

@@ -35,7 +35,8 @@ module AddAuth
       end
 
       def initialize(store:, digest:, delivery_cipher:, policy:, password_policy:, trusted_address:, clock: Time, random: SecureRandom,
-        lifetime: 3600, notify: ->(**) {}, sessions: nil, step_up_policy: nil, profile_attributes: ->(_profile) { {} }, deletion_allowed: ->(_user) { true }, external_identities: nil)
+        lifetime: 3600, notify: ->(**) {}, sessions: nil, step_up_policy: nil, profile_attributes: ->(_profile) { {} }, deletion_allowed: ->(_user) { true }, external_identities: nil,
+        external_bindings: nil)
         raise ArgumentError, "proof lifetime must be between 60 and 86400 seconds" unless lifetime.is_a?(Numeric) && lifetime.between?(60, 86_400)
         @store, @digest, @cipher, @policy, @password_policy, @trusted_address = store, digest, delivery_cipher, policy, password_policy, trusted_address
         @clock, @random, @lifetime, @notify = clock, random, lifetime, notify
@@ -43,6 +44,7 @@ module AddAuth
         @profile_attributes = profile_attributes
         @deletion_allowed = deletion_allowed
         @external_identities = external_identities
+        @external_bindings = external_bindings
       end
 
       def register(identifier:, password:, profile: {}, replacing: nil, user_agent: nil, ip_address: nil, remember: false)
@@ -86,14 +88,21 @@ module AddAuth
         accepted
       end
 
+      # A confirm preview's credential lists the provider configurations whose
+      # bindings the address owner must explicitly keep (see #consume).
       def preview(token:, purpose:)
         return failure unless token.is_a?(String) && TOKEN.match?(token) && PURPOSES.include?(purpose.to_s)
         user, record = @store.inspect_token(digest: @digest.digest(token))
         reason = rejection(user, record, purpose: purpose.to_s)
-        reason ? Result.failure(reason: reason) : Result.success(user: user, strategy: purpose.to_sym)
+        return Result.failure(reason: reason) if reason
+        Result.success(user: user, strategy: purpose.to_sym, credential: (unadopted_providers(user) if purpose.to_s == "confirm"))
       end
 
-      def consume(token:, purpose:, password: nil)
+      # A first confirmation is the address owner's adoption decision for any
+      # provider binding made before the address was proved. Only an explicit
+      # keep_providers: true preserves those bindings; any other confirmation
+      # revokes them in the same transaction (canonical plan section 18, A1).
+      def consume(token:, purpose:, password: nil, keep_providers: false)
         return failure unless token.is_a?(String) && TOKEN.match?(token) && PURPOSES.include?(purpose.to_s)
         @store.with_token(digest: @digest.digest(token)) do |user, record|
           reason = rejection(user, record, purpose: purpose.to_s)
@@ -110,12 +119,14 @@ module AddAuth
               @notify.call(user: user, kind: :email_changed, at: now, recipient: old_address)
               @notify.call(user: user, kind: :email_changed, at: now, recipient: pending)
             else
+              @external_bindings.revoke_all_in_transaction(user_id: user.id, at: now) if keep_providers != true && unadopted_providers(user).any?
               @store.update_account(user: user, confirmed_at: now)
               provision_account(user)
             end
           when "reset_password"
             next failure unless valid_new_password?(password)
             @store.replace_password(user: user, password: password)
+            clear_password_lock(user)
             @store.revoke_authority(user: user, at: now)
             @notify.call(user: user, kind: :password_changed, at: now)
           when "unlock"
@@ -214,6 +225,18 @@ module AddAuth
         failure
       end
 
+      # A proved reset ends brute-force lockout, never a manual lock.
+      def clear_password_lock(user)
+        attempts = user.respond_to?(:failed_attempts) ? user.failed_attempts.to_i : 0
+        return if user.add_auth_manual_lock || (!user.locked_at && attempts.zero?)
+        @store.update_account(user: user, locked_at: nil, add_auth_locked_until: nil, failed_attempts: 0)
+      end
+
+      def unadopted_providers(user)
+        return [].freeze unless @external_bindings && user && !user.confirmed_at
+        @external_bindings.provider_ids(user_id: user.id)
+      end
+
       def provision_account(user)
         tracked = user.respond_to?(:add_auth_provisioned_at)
         return if tracked && user.add_auth_provisioned_at
@@ -286,7 +309,8 @@ module AddAuth
         payload = JSON.parse(raw)
         return unless payload["purpose"] == record.purpose && payload["recipient"] == recipient_for(user, record.purpose) &&
           payload["token"].is_a?(String) && @digest.matches?(record.digest, payload["token"])
-        {recipient: payload.fetch("recipient"), token: payload.fetch("token"), purpose: record.purpose}
+        {recipient: payload.fetch("recipient"), token: payload.fetch("token"), purpose: record.purpose,
+         providers: (record.purpose == "confirm") ? unadopted_providers(user) : []}
       rescue JSON::ParserError, KeyError
         nil
       end

data/lib/add_auth/core/account_policy.rb

@@ -41,13 +41,27 @@ module AddAuth
         return :disabled unless available?(user)
         return unless @enabled
         return :unconfirmed if !value(user, :confirmed_at) && (confirmation_required? || !password_account?(user))
-        :locked if locked?(user)
+        :locked if account_locked?(user)
       end
 
+      # Password results may also disclose an automatic lock to the holder of
+      # the correct password; other methods never consult this.
+      def password_denial(user) = denial(user) || ((@enabled && locked?(user)) ? :locked : nil)
+
+      # Any active lock, including the automatic password lock.
       def locked?(user)
         value(user, :locked_at) && (value(user, :add_auth_manual_lock) || !value(user, :add_auth_locked_until) || value(user, :add_auth_locked_until) > @clock.now)
       end
 
+      # Manual and imported (untimed) locks deny the whole account. An automatic
+      # brute-force lock gates only the password method (plan section 18, A2).
+      def account_locked?(user) = locked?(user) && !self.class.automatic_lock?(user, now: @clock.now)
+
+      def self.automatic_lock?(user, now:)
+        read = ->(name) { user.public_send(name) if user.respond_to?(name) }
+        !!(read.call(:locked_at) && !read.call(:add_auth_manual_lock) && read.call(:add_auth_locked_until) && read.call(:add_auth_locked_until) > now)
+      end
+
       private
 
       def password_account?(user)

data/lib/add_auth/core/external_identities.rb

@@ -185,6 +185,21 @@ module AddAuth
         self.class.invalidate_credentials_in_transaction(store: @store, user_id: user_id, at: at)
       end
 
+      # Bindings persist while provider sign-in is disabled, so G3 reaches them
+      # through this narrow port rather than the enabled service. G3 owns the
+      # adoption decision; this only reports and revokes live bindings.
+      class Bindings
+        def initialize(store:)
+          @store = store
+        end
+
+        def provider_ids(user_id:) = @store.bindings(user_id: user_id).map(&:provider_id).uniq.sort.freeze
+
+        def revoke_all_in_transaction(user_id:, at:)
+          @store.bindings(user_id: user_id).each { |identity| @store.revoke(identity: identity, at: at) }.size
+        end
+      end
+
       def credential_current?(user:, id:, version:)
         return false unless @enabled
         identity = @store.binding_for_user(user_id: user.id, id: id)

data/lib/add_auth/core/intake.rb

@@ -14,19 +14,24 @@ module AddAuth
         @on_challenge_unavailable = on_challenge_unavailable
       end
 
+      # An exhausted IP budget stops before the identifier budget, and the
+      # identifier is charged only after any configured challenge passes, so
+      # other clients cannot spend a target's budget (plan section 18, A4).
       def call(identifier:, ip:, action:, challenge_token: nil)
         value = (identifier.is_a?(String) && identifier.valid_encoding? && identifier.bytesize.between?(1, 254)) ? @normalizer.call(identifier) : ""
         value = "" unless value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 254)
-        ip_ok = @limiter.call(key: @digest.digest("ip:#{ip}:#{action}"), limit: 30)
-        identifier_ok = @limiter.call(key: @digest.digest("identifier:#{value}:#{action}"), limit: 5)
-        return :rate_limited unless ip_ok && identifier_ok
+        return :rate_limited unless @limiter.call(key: @digest.digest("ip:#{ip}:#{action}"), limit: 30)
         return :invalid_credentials if value.to_s.empty?
         rejection = verify_challenge(ip: ip, action: action, challenge_token: challenge_token)
-        rejection || value
+        return rejection if rejection
+        return :rate_limited unless @limiter.call(key: @digest.digest("identifier:#{value}:#{action}"), limit: 5)
+        value
       end
 
-      def anonymous(ip:, action:, challenge_token: nil)
-        return :rate_limited unless @limiter.call(key: @digest.digest("ip:#{ip}:#{action}"), limit: 30)
+      # budget separates an IP counter from the challenge action, so a
+      # background request cannot spend the budget of an interactive form.
+      def anonymous(ip:, action:, challenge_token: nil, budget: action)
+        return :rate_limited unless @limiter.call(key: @digest.digest("ip:#{ip}:#{budget}"), limit: 30)
         verify_challenge(ip: ip, action: action, challenge_token: challenge_token) || true
       end
 

data/lib/add_auth/core/passwords/lifecycle.rb

@@ -1,19 +1,30 @@
 # frozen_string_literal: true
 
+require "add_auth/core/account_policy"
+
 module AddAuth
   module Core
     module Passwords
       # Called only inside the owning account transaction. The adapter supplies
       # Rails hashing and persistence; these decisions are shared by entry paths.
       class Lifecycle
-        def initialize(store:, policy:, enabled:, maximum_attempts: 20, unlock_in: 3600, clock: Time, issue_unlock: ->(_user) {})
+        # password_allowed reports whether this account may use password sign-in
+        # at all (feature enabled, stored password, not strict). Accounts that
+        # cannot use a password never accumulate failures or locks.
+        def initialize(store:, policy:, enabled:, maximum_attempts: 20, unlock_in: 3600, clock: Time, issue_unlock: ->(_user) {},
+          password_allowed: ->(_user) { true })
           unless maximum_attempts.is_a?(Integer) && maximum_attempts.between?(1, 100) &&
               unlock_in.is_a?(Numeric) && unlock_in.finite? && unlock_in.between?(60, 86_400)
             raise ArgumentError, "configure bounded password attempts and unlock duration"
           end
           @store, @policy, @enabled, @maximum, @unlock_in, @clock, @issue_unlock = store, policy, enabled, maximum_attempts, unlock_in, clock, issue_unlock
+          @password_allowed = password_allowed
         end
 
+        # The automatic lock gates the password method only; it never denies
+        # other methods or revokes existing authority.
+        def locked?(user) = @enabled && !!user && AccountPolicy.automatic_lock?(user, now: @clock.now)
+
         def prepare(user:)
           return unless @enabled && user && !user.add_auth_manual_lock && user.locked_at &&
             user.add_auth_locked_until && user.add_auth_locked_until <= @clock.now
@@ -21,7 +32,8 @@ module AddAuth
         end
 
         def verified(user:, password:, valid:, rehash: true)
-          return false unless user && @policy.call(user) == true
+          return false unless user && @policy.call(user) == true && @password_allowed.call(user) == true
+          return false if locked?(user)
           if valid
             @store.update_account(user: user, failed_attempts: 0) if @enabled && user.failed_attempts != 0
             if rehash && user.respond_to?(:add_auth_password_scheme) && user.add_auth_password_scheme == "devise_bcrypt" && assignable?(password)
@@ -49,10 +61,7 @@ module AddAuth
             changes[:add_auth_locked_until] = @clock.now + @unlock_in
           end
           @store.update_account(user: user, **changes)
-          if attempts >= @maximum
-            @store.revoke_authority(user: user, at: @clock.now)
-            @issue_unlock.call(user)
-          end
+          @issue_unlock.call(user) if attempts >= @maximum
         end
       end
     end

data/lib/add_auth/core/rate_limit.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ipaddr"
+
 module AddAuth
   module Core
     class RateLimit
@@ -25,6 +27,15 @@ module AddAuth
         end
         counts.all? { |count| count <= limit }
       end
+
+      # One budget per IPv4 address or IPv6 /64, which a single client
+      # commonly controls in full.
+      def self.network(ip)
+        address = IPAddr.new(ip.to_s).native
+        address.ipv6? ? "#{address.mask(64)}/64" : address.to_s
+      rescue IPAddr::Error
+        "unknown"
+      end
     end
   end
 end

data/lib/add_auth/core/session_cursor.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "time"
+
+module AddAuth
+  module Core
+    class SessionCursor
+      def initialize(key:)
+        @key = key
+      end
+
+      def encode(row)
+        "sc1:" + Base64.urlsafe_encode64(JSON.generate([row.created_at.utc.iso8601(6), row.id]), padding: false)
+      end
+
+      def decode(value)
+        # Retain links issued by releases with integer-only pagination.
+        legacy = @key.parse(value)
+        return {legacy_id: legacy} if legacy.is_a?(Integer)
+        return unless value.is_a?(String) && value.ascii_only? && value.bytesize <= 256 && value.match?(/\Asc1:[A-Za-z0-9_-]+\z/)
+
+        fields = JSON.parse(Base64.urlsafe_decode64(value.delete_prefix("sc1:")))
+        return unless fields.is_a?(Array) && fields.length == 2
+        timestamp, id = fields
+        return unless timestamp.is_a?(String) && timestamp.match?(/\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z\z/)
+        id = @key.parse(id)
+        return unless id
+        time = Time.iso8601(timestamp)
+        return unless time.year.positive? && time.utc.iso8601(6) == timestamp
+        {created_at: time, id: id}
+      rescue ArgumentError, JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/add_auth/core/session_key.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Core
+    class SessionKey
+      UUID = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i
+      MAX_INTEGER = (2**63) - 1
+
+      def initialize(type:)
+        raise ArgumentError, "unsupported session key type" unless %i[integer bigint uuid].include?(type)
+        @uuid = type == :uuid
+      end
+
+      def parse(value)
+        if @uuid
+          value.downcase if value.is_a?(String) && value.ascii_only? && UUID.match?(value)
+        elsif value.is_a?(Integer)
+          value if value.between?(1, MAX_INTEGER)
+        elsif value.is_a?(String) && value.ascii_only? && value.match?(/\A[1-9]\d{0,18}\z/)
+          integer = value.to_i
+          integer if integer <= MAX_INTEGER
+        end
+      end
+
+      # Stock Rails signed cookies serialize integer IDs as integers, UUIDs as
+      # strings. Numeric strings must not broaden the legacy integer bridge.
+      def legacy(value)
+        parse(value) if @uuid || value.is_a?(Integer)
+      end
+    end
+  end
+end

data/lib/add_auth/core/sessions.rb

@@ -2,6 +2,8 @@
 
 require "securerandom"
 require "add_auth/core/mobile_profile"
+require "add_auth/core/session_key"
+require "add_auth/core/session_cursor"
 
 module AddAuth
   module Core
@@ -29,7 +31,8 @@ module AddAuth
       Page = Struct.new(:entries, :next_cursor)
 
       def initialize(store:, digest:, eligible:, lifetime: 43_200, idle_timeout: 1800,
-        legacy_bridge_until: nil, clock: Time, access_policy: nil, password_lifecycle: nil, remembered_profile: nil, mobile_profile: nil, on_sign_in: nil, verified_denial: nil)
+        legacy_bridge_until: nil, clock: Time, access_policy: nil, password_lifecycle: nil, remembered_profile: nil, mobile_profile: nil, on_sign_in: nil, verified_denial: nil,
+        revoke_authority: nil)
         unless [lifetime, idle_timeout].all? { |n| n.is_a?(Numeric) && n.finite? && n.positive? } && idle_timeout <= lifetime
           raise ArgumentError, "session timeouts must be positive and idle_timeout <= lifetime"
         end
@@ -37,10 +40,13 @@ module AddAuth
           raise ArgumentError, "legacy_bridge_until must be an absolute Time or nil"
         end
         @store, @digest, @eligible, @clock = store, digest, eligible, clock
+        @key = SessionKey.new(type: store.respond_to?(:id_type) ? store.id_type : :integer)
+        @cursor = SessionCursor.new(key: @key)
         @access_policy = access_policy
         @password_lifecycle = password_lifecycle
         @on_sign_in = on_sign_in
         @verified_denial = verified_denial
+        @revoke_authority = revoke_authority
         raise ArgumentError, "invalid mobile profile" unless mobile_profile.nil? || mobile_profile.is_a?(MobileProfile)
         @mobile = mobile_profile
         @lifetime, @idle, @deadline = lifetime, idle_timeout, legacy_bridge_until
@@ -94,6 +100,7 @@ module AddAuth
         return if transport == :mobile && replacing
         raise ArgumentError, "unsupported proof" unless %w[password email_link passkey external_identity].include?(method.to_s)
         return if @access_policy && !@access_policy.sign_in_allowed?(user, method)
+        return if method.to_s == "password" && @password_lifecycle&.locked?(user)
         if method.to_s == "passkey"
           return unless proof.is_a?(StepUp::Evidence) && proof.strong? && proof.user_id == user.id &&
             proof.verified_at <= @clock.now && proof.verified_at > @clock.now - 300
@@ -191,13 +198,14 @@ module AddAuth
       def list_page(user:, current_session_id: nil, before: nil)
         empty = Page.new(entries: [])
         return empty unless user && @eligible.call(user) == true
-        return empty unless before.nil? || before.to_s.match?(/\A[1-9]\d{0,18}\z/)
+        boundary = @cursor.decode(before) unless before.nil?
+        return empty unless before.nil? || boundary
 
         now = @clock.now
-        candidates = @store.list_for_user(user_id: user.id, before: before&.to_i,
+        candidates = @store.list_for_user(user_id: user.id, before: boundary,
           excluding: current_session_id, limit: PAGE_SIZE + 1, now: now,
           active_after: now - [@idle, @remembered&.fetch(:idle_timeout) || @idle, @mobile&.idle_timeout || @idle].max, legacy: !!(@deadline && now < @deadline))
-        cursor = candidates[PAGE_SIZE - 1].id if candidates.length > PAGE_SIZE
+        cursor = @cursor.encode(candidates[PAGE_SIZE - 1]) if candidates.length > PAGE_SIZE
         rows = candidates.first(PAGE_SIZE)
         if before.nil? && current_session_id
           current = @store.find_for_user(user_id: user.id, session_id: current_session_id)
@@ -217,16 +225,22 @@ module AddAuth
 
       # Both the initiating bearer and target ownership are checked under lock.
       def revoke_one(user:, session:, session_id:)
-        return false unless session_id.is_a?(Integer) || session_id.to_s.match?(/\A[1-9]\d*\z/)
+        target_id = @key.parse(session_id)
+        return false unless target_id
 
         with_live_session(user: user, session: session) do |account, _current, now|
-          target = @store.find_for_user_in_transaction(user_id: account.id, session_id: session_id.to_i)
+          target = @store.find_for_user_in_transaction(user_id: account.id, session_id: target_id)
           next false unless target
           @store.update(target, revoked_at: now) unless target.revoked_at
           true
         end || false
       end
 
+      def current_session?(session:, session_id:)
+        id = @key.parse(session_id)
+        !!(id && session && id == session.id)
+      end
+
       # Password proof is obtained from the locked, current account. Intake
       # limits must be applied by the caller before reaching this expensive port.
       def reauthenticate(user:, session:, purpose:, policy:)
@@ -244,9 +258,13 @@ module AddAuth
         end || Result.failure(reason: :elevation_required)
       end
 
+      # Sign-out-everywhere retires every outstanding proof, not only sessions:
+      # the shared authority port also revokes tokens, ceremonies and handoffs.
       def revoke_all(user:, session:, grant:)
         with_authority(user: user, session: session, grant: grant, purpose: :sign_out_everywhere) do |account, _row, now|
-          @store.revoke_all_in_transaction(user_id: account.id, at: now)
+          count = @store.revoke_all_in_transaction(user_id: account.id, at: now)
+          @revoke_authority&.call(user_id: account.id, at: now)
+          count
         end || false
       end
 
@@ -315,10 +333,10 @@ module AddAuth
       private
 
       def cookie_lookup(value)
-        if value.is_a?(String) && PATTERN.match?(value)
+        if value.is_a?(String) && value.ascii_only? && PATTERN.match?(value)
           {digest: @digest.digest(value)}
-        elsif value.is_a?(Integer) && value.positive? && @deadline && @clock.now < @deadline
-          {id: value}
+        elsif @deadline && @clock.now < @deadline && (id = @key.legacy(value))
+          {id: id}
         end
       end
 

data/lib/add_auth/core/strategies/passkey.rb

@@ -44,7 +44,9 @@ module AddAuth
           end
         end
 
-        def authentication_options(browser_secret:, user: nil, session: nil, purpose: nil)
+        # ip selects the anonymous ceremony budget; one network cannot exhaust
+        # passkey sign-in for every other client.
+        def authentication_options(browser_secret:, user: nil, session: nil, purpose: nil, ip: nil)
           return failure unless @binding.valid?(browser_secret)
           if user || session || purpose
             @store.with_user(id: user&.id) do |account|
@@ -54,7 +56,8 @@ module AddAuth
               create_options(options, kind: "assertion", user: account, session: session, purpose: purpose, browser_secret: browser_secret)
             end
           else
-            return failure(:rate_limited) unless @limiter.call(key: @digest.digest("passkey:anonymous-ceremonies"), limit: @anonymous_limit)
+            budget = "passkey:anonymous-ceremonies:#{RateLimit.network(ip)}"
+            return failure(:rate_limited) unless @limiter.call(key: @digest.digest(budget), limit: @anonymous_limit)
             options = @rp.options_for_authentication(user_verification: "required")
             create_options(options, kind: "assertion", browser_secret: browser_secret)
           end

data/lib/add_auth/rails/migration/key_type.rb

@@ -7,15 +7,15 @@ module AddAuth
         module_function
 
         # Resolve when the migration runs, after the host's account table exists.
-        # Session IDs remain integer until opaque cursor support is established.
+        # Keep the session keyword for migrations generated by earlier releases.
         def for(connection, table, session: false)
           key = connection.primary_key(table)
           column = connection.columns(table).find { |entry| entry.name == key }
           raise ArgumentError, "AddAuth requires a single integer or UUID primary key on #{table}" unless column
           return :bigint if column.type == :integer && column.limit == 8
           return :integer if column.type == :integer
-          return :uuid if column.type == :uuid && !session
-          raise ArgumentError, session ? "AddAuth requires integer Session IDs; UUID accounts can use integer Sessions" : "AddAuth requires an integer or UUID account primary key"
+          return :uuid if column.type == :uuid
+          raise ArgumentError, "AddAuth requires an integer or UUID primary key on #{table}"
         end
       end
     end

data/lib/add_auth/rails/runtime.rb

@@ -90,7 +90,26 @@ module AddAuth
           policy: account_policy, password_policy: config.lifecycle.password_policy, trusted_address: method(:trusted_recovery_address),
           lifetime: config.lifecycle.proof_lifetime, notify: ->(**event) { security_events.issue(**event) if config.notifications.enabled },
           sessions: sessions, step_up_policy: step_up_policy, profile_attributes: config.lifecycle.profile_attributes, deletion_allowed: config.lifecycle.deletion_allowed,
-          external_identities: -> { external_identities })
+          external_identities: -> { external_identities }, external_bindings: external_bindings)
+      end
+
+      # Present whenever the binding table exists, even with providers disabled:
+      # a first confirmation must still decide what happens to old bindings.
+      def external_bindings
+        return unless defined?(::AddAuthExternalIdentity) && ::AddAuthExternalIdentity.table_exists?
+        Core::ExternalIdentities::Bindings.new(store: external_identity_store)
+      end
+
+      # Display-only labels for provider configuration IDs held by Core. A
+      # native configuration borrows the label of a browser provider with the
+      # same issuer.
+      def provider_labels(ids)
+        options = config.external_identities
+        Array(ids).map { |id|
+          native = options.native_provider(id)
+          provider = options.provider(id) || (native && options.providers.find { |item| item.configuration.issuer == native.issuer })
+          provider&.label || "your sign-in provider"
+        }.uniq
       end
 
       def enqueue_account_request(identifier:, purpose:)
@@ -112,9 +131,9 @@ module AddAuth
           idle_timeout: config.session.idle_timeout, legacy_bridge_until: config.session.legacy_bridge_until, access_policy: access_policy,
           password_lifecycle: password_lifecycle,
           mobile_profile: mobile_profile,
-          verified_denial: ->(user) { (config.eligible.call(user) == true) ? account_policy.denial(user) : :disabled },
+          verified_denial: ->(user) { (config.eligible.call(user) == true) ? account_policy.password_denial(user) : :disabled },
           remembered_profile: config.lifecycle.enabled ? {lifetime: config.lifecycle.remember_lifetime, idle_timeout: config.lifecycle.remember_idle_timeout} : nil,
-          on_sign_in: method(:record_sign_in))
+          on_sign_in: method(:record_sign_in), revoke_authority: authority.method(:revoke))
       end
 
       def mobile_profile
@@ -163,7 +182,8 @@ module AddAuth
         Core::Passwords::Lifecycle.new(store: Stores::AccountCredentials.new(user_model: ::User, authority: authority),
           policy: method(:eligible), enabled: config.lifecycle.enabled,
           maximum_attempts: config.lifecycle.maximum_attempts, unlock_in: config.lifecycle.unlock_in,
-          issue_unlock: ->(user) { accounts.issue_unlock_in_transaction(user: user) })
+          issue_unlock: ->(user) { accounts.issue_unlock_in_transaction(user: user) },
+          password_allowed: ->(user) { access_policy.sign_in_allowed?(user, :password) })
       end
 
       def security_events

data/lib/add_auth/rails/stores/sessions.rb

@@ -6,8 +6,11 @@ module AddAuth
   module Rails
     module Stores
       class Sessions
+        attr_reader :id_type
+
         def initialize(user_model:, session_model:)
           @users, @sessions = user_model, session_model
+          @id_type = @sessions.columns_hash.fetch(@sessions.primary_key).type
           raise ArgumentError, "authentication models must share one connection pool" unless @users.connection_pool.equal?(@sessions.connection_pool)
           @lock = AccountLock.new(@users)
         end
@@ -38,11 +41,16 @@ module AddAuth
         # Query cutoffs come from Core; Core still authorizes every returned row.
         def list_for_user(user_id:, before:, excluding:, limit:, now:, active_after:, legacy:)
           scope = @sessions.where(user_id: user_id, revoked_at: nil)
-          scope = scope.where("id < ?", before) if before
+          if before&.key?(:legacy_id)
+            scope = scope.where("id < ?", before.fetch(:legacy_id))
+          elsif before
+            scope = scope.where("created_at < ? OR (created_at = ? AND id < ?)",
+              before.fetch(:created_at), before.fetch(:created_at), before.fetch(:id))
+          end
           scope = scope.where.not(id: excluding) if excluding
           scope = scope.where("(expires_at IS NULL OR expires_at > ?) AND (last_seen_at IS NULL OR last_seen_at > ?)", now, active_after)
           scope = scope.where.not(expires_at: nil).where.not(last_seen_at: nil) unless legacy
-          scope.order(id: :desc).limit(limit).to_a
+          scope.order(created_at: :desc, id: :desc).limit(limit).to_a
         end
 
         def find_for_user(user_id:, session_id:) = @sessions.find_by(user_id: user_id, id: session_id)

data/lib/add_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AddAuth
-  VERSION = "0.4.0"
+  VERSION = "0.5.1"
 end

data/lib/generators/add_auth/accounts/accounts_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class AccountsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       class_option :email_link, type: :boolean, default: true, desc: "Enable email sign-in as a step-up dependency"

data/lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt

@@ -14,7 +14,7 @@ class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
     add_column :users, :add_auth_authority, :string, default: "add_auth", null: false unless column_exists?(:users, :add_auth_authority)
     add_column :sessions, :remembered, :boolean, default: false_default, null: false unless column_exists?(:sessions, :remembered)
     add_column :sessions, :idle_timeout, :integer unless column_exists?(:sessions, :idle_timeout)
-    create_table :add_auth_address_claims do |t|
+    create_table :add_auth_address_claims, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :digest, null: false
       t.string :state, null: false
@@ -22,7 +22,7 @@ class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
     end
     add_index :add_auth_address_claims, :digest, unique: true
     add_index :add_auth_address_claims, [:user_id, :state], unique: true
-    create_table :add_auth_account_tokens do |t|
+    create_table :add_auth_account_tokens, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :digest, null: false
       t.string :purpose, null: false

data/lib/generators/add_auth/email_tokens/email_tokens_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
@@ -8,6 +9,7 @@ module AddAuth
     # Internal persistence foundation only. Does not install sign-in routes.
     class EmailTokensGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
 

data/lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt

@@ -2,7 +2,7 @@ require "add_auth/rails/migration/key_type"
 
 class CreateAddAuthSignInTokens < ActiveRecord::Migration[8.0]
   def change
-    create_table :add_auth_sign_in_tokens do |t|
+    create_table :add_auth_sign_in_tokens, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), null: false, foreign_key: true
       t.string :digest, limit: 64, null: false
       t.string :identifier_digest, limit: 64, null: false

data/lib/generators/add_auth/external_identities/external_identities_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
@@ -8,6 +9,7 @@ module AddAuth
     # Optional persistence and routes; provider strategies remain disabled until configured.
     class ExternalIdentitiesGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)

data/lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt

@@ -1,8 +1,10 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
   def change
-    user_type = reference_type(:users)
-    session_type = reference_type(:sessions)
-    create_table :add_auth_external_identities do |t|
+    user_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    session_type = AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true)
+    create_table :add_auth_external_identities, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_type, null: false, foreign_key: {on_delete: :cascade}
       # SHA256 of the exact JSON [configuration, issuer, audience, subject].
       # Indexing this key preserves case-sensitive subjects on either store.
@@ -18,7 +20,7 @@ class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
       t.timestamps
     end
     add_index :add_auth_external_identities, :namespace, unique: true
-    create_table :add_auth_external_transactions do |t|
+    create_table :add_auth_external_transactions, id: <%= authentication_primary_key_type %> do |t|
       t.string :digest, null: false
       t.string :browser_digest, null: false
       t.string :provider_id, limit: 2048, null: false
@@ -39,12 +41,4 @@ class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_external_id, :string
     add_column :sessions, :authentication_external_version, :string
   end
-
-  private
-
-  def reference_type(table)
-    column = connection.columns(table).find { |item| item.name == connection.primary_key(table) }
-    raise "Unsupported authentication primary key" unless column && [:integer, :uuid].include?(column.type)
-    (column.type == :integer && column.limit == 8) ? :bigint : column.type
-  end
 end

data/lib/generators/add_auth/install/templates/initializer.rb

@@ -79,7 +79,7 @@ AddAuth.configure do |config|
   config.passkeys.origins = [] # Required: exact trusted origins, never request Host.
   # config.passkeys.origins = ["https://app.example.com"]
   config.passkeys.name = "Your account"
-  config.passkeys.anonymous_limit = 1000 # Shared ceremony budget per five minutes.
+  config.passkeys.anonymous_limit = 1000 # Ceremony budget per IPv4 address or IPv6 /64 per five minutes.
   config.trusted_recovery_address = ->(_user) {} # No trusted recovery by default.
   # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed_at }
   # Lifecycle additionally rejects unconfirmed addresses as trusted recovery.

data/lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class MobileSessionsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)

data/lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt

@@ -1,9 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthMobileHandoffs < ActiveRecord::Migration[8.0]
   def change
-    user_key = connection.columns(:users).find { |column| column.name == connection.primary_key(:users) }
-    raise "Unsupported authentication primary key" unless user_key && [:integer, :uuid].include?(user_key.type)
-    user_type = (user_key.type == :integer && user_key.limit == 8) ? :bigint : user_key.type
-    create_table :add_auth_mobile_handoffs do |t|
+    user_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    create_table :add_auth_mobile_handoffs, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
       t.string :external_digest, null: false
       t.string :digest

data/lib/generators/add_auth/notifications/notifications_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
@@ -8,6 +9,7 @@ module AddAuth
   module Generators
     class NotificationsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
       include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)

data/lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt

@@ -2,7 +2,7 @@ require "add_auth/rails/migration/key_type"
 
 class CreateAddAuthSecurityEvents < ActiveRecord::Migration[8.0]
   def change
-    create_table :add_auth_security_events do |t|
+    create_table :add_auth_security_events, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), foreign_key: {on_delete: :nullify}
       t.string :kind, null: false
       t.string :digest, null: false

data/lib/generators/add_auth/passkeys/passkeys_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
@@ -8,6 +9,7 @@ module AddAuth
   module Generators
     class PasskeysGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
       include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)

data/lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt

@@ -14,7 +14,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_policy_version, :integer, default: 0, null: false
     add_column :sessions, :authentication_credential_id, :string
     add_column :sessions, :authentication_uv, :boolean, default: false_default, null: false
-    create_table :add_auth_credentials do |t|
+    create_table :add_auth_credentials, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :external_id, null: false
       t.text :public_key, null: false
@@ -29,7 +29,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
       t.timestamps
     end
     add_index :add_auth_credentials, :external_id, unique: true
-    create_table :add_auth_ceremonies do |t|
+    create_table :add_auth_ceremonies, id: <%= authentication_primary_key_type %> do |t|
       t.string :digest, null: false
       t.string :challenge, null: false
       t.string :kind, null: false

data/lib/generators/add_auth/primary_key.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Generators
+    module PrimaryKey
+      private
+
+      # Freeze Rails' generator preference into the migration source. Foreign
+      # keys independently follow the actual referenced table when it runs.
+      def authentication_primary_key_type
+        type = (::Rails.application.config.generators.options.dig(:active_record, :primary_key_type) || :bigint).to_s
+        unless %w[bigint integer uuid].include?(type)
+          raise Thor::Error, "AddAuth supports Rails primary_key_type :bigint, :integer or :uuid"
+        end
+        ":#{type}"
+      end
+    end
+  end
+end

data/lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb

@@ -25,6 +25,9 @@ module AddAuth
       end
 
       def migration
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_session_cursor_index.rb")].any?
+          migration_template "add_add_auth_session_cursor_index.rb.tt", "db/migrate/add_add_auth_session_cursor_index.rb"
+        end
         unless Dir[File.join(destination_root, "db/migrate/*_extend_sessions_for_add_auth.rb")].any?
           migration_template "extend_sessions_for_add_auth.rb.tt", "db/migrate/extend_sessions_for_add_auth.rb"
         end

data/lib/generators/add_auth/session_upgrade/templates/add_add_auth_session_cursor_index.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthSessionCursorIndex < ActiveRecord::Migration[8.0]
+  def change
+    add_index :sessions, [:user_id, :created_at, :id], name: "index_add_auth_session_cursor"
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: add_auth
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Taimoor Qureshi
@@ -329,6 +329,8 @@ files:
 - lib/add_auth/core/rate_limit.rb
 - lib/add_auth/core/remaining_factors.rb
 - lib/add_auth/core/security_events.rb
+- lib/add_auth/core/session_cursor.rb
+- lib/add_auth/core/session_key.rb
 - lib/add_auth/core/sessions.rb
 - lib/add_auth/core/step_up.rb
 - lib/add_auth/core/strategies/email_link.rb
@@ -423,8 +425,10 @@ files:
 - lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt
 - lib/generators/add_auth/passkeys/templates/add_auth_ceremony.rb
 - lib/generators/add_auth/passkeys/templates/add_auth_credential.rb
+- lib/generators/add_auth/primary_key.rb
 - lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb
 - lib/generators/add_auth/session_upgrade/templates/add_add_auth_elevation.rb.tt
+- lib/generators/add_auth/session_upgrade/templates/add_add_auth_session_cursor_index.rb.tt
 - lib/generators/add_auth/session_upgrade/templates/extend_sessions_for_add_auth.rb.tt
 - lib/generators/add_auth/step_up/step_up_generator.rb
 - lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt