add_auth 0.2.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb4c1fc11f2a73f54a42c1bc5379f328d63e4e3cf4124f83ceaa87187ee04ed8
-  data.tar.gz: bb0c1cf6c79e629cf3257a161c867dc0ea722596ccebe6a9b4dd609881e2be6a
+  metadata.gz: 5856e424011a6e4b49dabd271324aadd29862aad6e0dc5a8b5e06c6e1ea27186
+  data.tar.gz: 5169c854a4428c4daee558abb68208eae29a1f5ae98b91478c9e803ccb3383d4
 SHA512:
-  metadata.gz: b9cf550a17e5736ac23be86f151571b6434949c137295c9e12489cead2ba5393d26bb2652c50469eb40775dcb85e8b937bbf1a0fbe5d2359b9d07172efa94fa3
-  data.tar.gz: 76d3b435c7f3f6994f639a9d397cba861d1e25071a6143a121d596549c85e9736c5d4a0a54caff1bf7f05e77a8b168915e909002aef847aaaf41d406547de308
+  metadata.gz: ee5a6a0df85d2719372eba860f0afb1030c3c1ccaf5644fd0ece45395e0f648bd689e0cb8b8b48a04ffa3fb5d066aab5aa8d4925ba502d0db26e8922c48302a9
+  data.tar.gz: 5b9bcc71dd3f72271dd140eb9b335cc93feb6222ec4a95e012afc2eaaa6f96945cd3ff7193e2fbfd816dc4e66bcaea293f9075ae9948931892952a4ba9b25b74

data/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.3.0 — 2026-09-09
+
+Optional account lifecycle, bounded Devise migration and native authentication.
+The standard Rails-generator installation remains supported; enable only the
+additional capabilities your host needs. The latest-0.x support policy continues.
+
+- Add read-only Devise inventory, additive account preparation, explicit legacy
+  password adoption and retired-source write fences. Preserve account IDs and
+  reject ambiguous identifier/credential conversions.
+- Add optional registration, confirmation/reconfirmation, reset, lock/unlock,
+  account changes and remembered sessions with shared Core policy and delivery.
+- Integrate maintained provider libraries without owning their registrations,
+  protocol exchange, unrelated routes or provider API credentials. Preserve
+  identity ownership and require independent enrollment confirmation.
+- Add opt-in finite native sessions, account-scoped revocation, S256-bound
+  single-use browser handoffs and optional nonce-bound Apple token verification.
+  Mobile duration settings are separate from browser settings; refresh-token
+  families are not part of this finite profile.
+- Verify generated/ejected pages with Turbo, ordinary JavaScript without Turbo
+  and permitted no-JS. Add populated migration, checkpoint, compatibility
+  rollback, provider and native integration fixtures.
+
 ## 0.2.2 — 2026-09-08
 
 - Reject Solid Cache as an authentication rate-limit store: simultaneous first

data/README.md

@@ -1,6 +1,6 @@
 # AddAuth
 
-**0.2.1:** password, email-link and passkey sign-in extend
+**0.3.0:** password, email-link and passkey sign-in extend
 Rails' generated authentication. AddAuth adds hardened sessions, verification
 for sensitive actions, passkey management and email recovery with an optional
 strict policy. Turnstile and reCAPTCHA integrations are available. See
@@ -9,6 +9,11 @@ strict policy. Turnstile and reCAPTCHA integrations are available. See
 AddAuth builds on top of Rails 8's built-in login system instead of
 replacing it -- it keeps using your existing `User` and `Session` models.
 
+Version 0.3.0 adds optional account lifecycle, bounded Devise migration,
+provider-library integration and finite Android/iOS sessions. See the
+[migration guide](https://addauthgem.com/migrating-from-devise/) before changing
+an existing Devise app; do not run the Rails generator over its custom files.
+
 Read the [documentation](https://addauthgem.com) for setup guides, configuration
 reference and troubleshooting.
 
@@ -18,18 +23,18 @@ Install the `add_auth` gem from RubyGems through your Rails app’s Gemfile,
 then enable password and email-link sign-in. Use Ruby 3.3+ and Rails 8.0+
 with Active Record, and run the commands below from your Rails app’s root.
 
-**Release availability:** these commands require the published `0.2.1` package.
+**Release availability:** these commands require the published `0.3.0` package.
 If it is not yet listed on [RubyGems](https://rubygems.org/gems/add_auth/versions),
 wait for publication; see [release status](https://addauthgem.com/release-status/).
 Start in your app’s development environment; use the deployment settings
 below before enabling sign-in for users.
 
 1. Keep `source "https://rubygems.org"` in your app’s Gemfile and add the
-   0.2 release line:
+   0.3 release line:
 
    ```ruby
    # Gemfile
-   gem "add_auth", "~> 0.2.1"
+   gem "add_auth", "~> 0.3.0"
    ```
 
    Bundler downloads the package from RubyGems and records the resolved
@@ -39,8 +44,8 @@ below before enabling sign-in for users.
    bundle install
    ```
 
-2. If your app doesn't already have Rails' built-in login system, add it
-   first:
+2. For a fresh app without an existing authentication system, generate
+   Rails' built-in login system:
 
    ```sh
    bin/rails generate authentication
@@ -533,14 +538,33 @@ or recovery procedures work in production.
 
 ## Scope
 
-AddAuth 0.2 implements password/email/passkey sign-in, session
-adoption and management, purpose-bound verification, passkey recovery and
-strict account policy, durable security mail, and challenge adapters. Account
-provisioning, address confirmation and password reset remain host responsibilities.
-Release acceptance uses local real-database, generated-host, browser and
-SMTP/queue/cache tests. Hosts verify their own live providers and supported
-physical devices before deployment. Recovery codes and AddAuth-owned password
-policy remain deferred.
+AddAuth 0.3 implements password/email/passkey sign-in, session adoption and
+management, purpose-bound verification, passkey recovery and strict account
+policy, durable security mail and challenge adapters. Optional account lifecycle
+adds registration, confirmation/reconfirmation, password reset, lock/unlock and
+account changes. Hosts retain account eligibility, resource authorization and
+provider registrations.
+
+## Optional integrations in 0.3.0
+
+Enable bounded [Devise migration](https://addauthgem.com/migrating-from-devise/),
+[account lifecycle](https://addauthgem.com/account-lifecycle/),
+[provider sign-in](https://addauthgem.com/omniauth/) and
+[Android/iOS sessions](https://addauthgem.com/mobile-authentication/) independently.
+Provider protocol handling stays with maintained libraries. Native sessions use
+finite expiry; the verified profile is 30 days absolute and 14 days idle, with
+fresh sign-in after expiry. Refresh-token families are not included.
+
+Migration evidence covers the documented Devise 5.0.4 source profiles, including
+integer and UUID accounts; it does not establish universal Devise-module parity.
+Preserve current credentials and revocations during cutover and compatible
+rollback. Follow the migration guide before removing Devise or retiring columns.
+
+Release acceptance uses local real-database, generated-host, browser,
+SMTP/queue/cache and native-consumer tests. Hosts verify their own live providers
+and supported physical devices before deployment. Recovery codes and multiple
+realms remain deferred. See [ROADMAP.md](ROADMAP.md) for scope and progress, and
+[CONTRIBUTING.md](CONTRIBUTING.md) for synthetic acceptance commands.
 
 ## Roadmap
 

data/ROADMAP.md

@@ -4,15 +4,16 @@ AddAuth extends Rails 8's authentication generator with email-link sign-in,
 passkeys, purpose-bound reauthentication, hardened sessions and pluggable captcha.
 It reuses the host's accounts and Session model.
 
-**Reviewed 2026-09-07: 0.2.1 is published, and the planned v1 strategy features
-have shipped.** The next work makes adoption, upgrades and the future 1.0 support
-commitment clearer. Milestones below describe priorities, not promised dates or
+**Reviewed 2026-09-09: 0.2.2 is published, and the planned v1 strategy features
+have shipped.** The bounded Devise migration and native additions below are locally verified
+and selected for 0.3.0. The future 1.0 support commitment remains separate. Milestones below describe priorities, not promised dates or
 versions. See [release status](https://addauthgem.com/release-status/),
 [the changelog](CHANGELOG.md) and [the manual](https://addauthgem.com/).
 
-**0.2.2 is prepared locally, not published.** It contains the counter-store
-correction and upgrade/operations coverage described below. The owner selected
-this patch before accepting the proposed 1.0 commitment.
+**[0.2.2 is published and verified](https://github.com/taimoorq/add_auth/releases/tag/v0.2.2).**
+It contains the counter-store correction and upgrade/operations coverage below.
+The registry package passes fresh-host installation and the matching manual is
+live. The owner selected this patch before accepting the proposed 1.0 commitment.
 
 An unchecked item is remaining work; deferred candidates need a scope decision
 before implementation. Checked features have passing relevant acceptance specs.
@@ -23,11 +24,10 @@ this public checklist is derived from its section 14 and stands on its own.
 
 ## Now — maintain 0.2 and learn from adoption
 
-- [ ] **R1 · Resolve the outstanding dependency update.** Review
-      [actions/checkout PR #1](https://github.com/taimoorq/add_auth/pull/1) against
-      current master. Its old failed Ruby checks need current evidence; retain
-      immutable action pins and all merge/release protections. Record a merge,
-      replacement or reasoned deferral.
+- [x] **R1 · Resolve the outstanding dependency update.**
+      [PR #9](https://github.com/taimoorq/add_auth/pull/9) updates the immutable
+      checkout pin to 7.0.1 with current required checks passing. Old Dependabot
+      PR #1 is closed as superseded. All merge/release protections remain in force.
 - [x] **R1 · Complete the 2026-09-07 currency review.** Review Rails/Ruby support,
       authentication APIs, WebAuthn, advisories and the competitive landscape
       before the next version bump; repeat the standing review at least quarterly.
@@ -45,9 +45,9 @@ this public checklist is derived from its section 14 and stands on its own.
       quickstart, doctor and troubleshooting guidance with exact prerequisites,
       observable success and recovery steps. Keep the public manual tied to the
       published package. Upgrade, compatibility, cache and ejection guidance is
-      prepared locally; build and browser checks pass. Publication is pending.
+      published for 0.2.2; build, browser and live deployment checks pass.
 
-The current master CI and CodeQL runs pass. The post-publication
+The exact 0.2.2 release commit passed the full CI matrix and CodeQL. The post-publication
 passwordless-fixture isolation failure is fixed in
 [PR #8](https://github.com/taimoorq/add_auth/pull/8); it is not an open runtime
 defect or a reason by itself to republish 0.2.1.
@@ -67,8 +67,8 @@ defect or a reason by itself to republish 0.2.1.
       whether Solid Cache meets atomic rate-limit increment/TTL requirements;
       document a tested separate store if needed. Publish only verified adapter
       support. Solid Queue 1.7.0 passes with a separate queue database. Solid
-      Cache 1.0.10 loses concurrent first increments on PostgreSQL; the pending
-      fix rejects it for abuse counters and documents a separate Redis store.
+      Cache 1.0.10 loses concurrent first increments on PostgreSQL; 0.2.2
+      rejects it for abuse counters and documents a separate Redis store.
 - [x] **R4 · Measure bounded maintenance and recovery.** Record workload,
       query counts, backlog drain and latency for session pages, outbox retries
       and cleanup. Use those measurements to explain batch sizing, retention,
@@ -79,46 +79,95 @@ defect or a reason by itself to republish 0.2.1.
       Core/host hooks and Results, routes, generators/ejection metadata, testing
       helpers and redacted events. Distinguish internal APIs and document
       compatibility, deprecation and migration rules. The current integration
-      reference and proposed contract are prepared; owner acceptance of the
-      1.0 commitment remains the separate item below.
+      reference is published; the proposed 1.0 contract remains for owner
+      review under the separate item below.
 - [ ] **R5 · Set the 1.0 support policy.** Specify supported runtime/database
       combinations and security-supported release lines. Publish an upgrade
       guide and evidence-backed troubleshooting updates before the candidate
       freezes. The current latest-0.x policy remains in
       [SECURITY.md](SECURITY.md).
-- [ ] **R8 · Define Devise migration readiness.** Inventory source versions,
+- [x] **R8 · Define Devise migration readiness.** Inventory source versions,
       modules, extensions and customizations; provide a read-only preflight with
       supported mappings, prerequisites and actionable blockers. Running Rails 8
       alone does not establish the authentication contracts AddAuth needs.
-- [ ] **R8 · Provide a path for Rails-aligned Devise apps.** Reuse verified
+- [x] **R8 · Provide a path for Rails-aligned Devise apps.** Reuse verified
       account/session contracts and preserve host customizations while replacing
       remaining Devise authentication wiring. Prove password compatibility,
       account restrictions, session/token revocation and safe cutover/rollback.
-- [ ] **R8 · Provide a path for standard or customized Devise apps.** Guide an
+- [x] **R8 · Provide a path for standard or customized Devise apps.** Guide an
       additive conversion from existing models, identifiers, password storage
       and controllers to the supported Rails contracts. Preserve account IDs and
       associations; resolve incompatible hashes, identifier collisions and
       unsupported module policies before cutover. Include older-runtime
       prerequisites and host-owned lifecycle replacements where needed.
-- [ ] **R8 · Rehearse and document both migration paths.** Test populated Devise
+- [x] **R8 · Add optional account lifecycle support.** Registration,
+      confirmation/reconfirmation, password reset, lock/unlock and account
+      changes must preserve ownership, account policy and session revocation.
+- [x] **R8 · Preserve provider sign-in through maintained libraries.** Add
+      optional OmniAuth integration with verified identity binding, explicit
+      linking/unlinking and usable recovery for provider-only accounts.
+      Preserve host-owned OAuth configuration, routes and other provider flows;
+      delegate protocol work to the selected libraries.
+- [x] **R8 · Rehearse both migration paths and draft the guides.** Test populated Devise
       hosts before and after migration, including custom schema, peppered
       passwords, denied accounts, interrupted conversion and rollback. Verify
-      supported database/runtime and Turbo/no-JS journeys, publish step-by-step
-      guides and prove the destination works with Devise removed.
+      supported database/runtime, ordinary HTML with JavaScript and Turbo absent,
+      Turbo enhancement and permitted no-JS journeys. Draft step-by-step guides
+      and prove the destination works with Devise removed.
+- [ ] **R8 · Publish migration and native guides with the feature release.**
+      Verify the released package, installation commands, HTTPS and deep links;
+      keep development guides explicitly unpublished until then.
+
+Local development has verified preflight, optional account lifecycle and
+provider-library integration across the supported Ruby/Rails matrix, including
+ordinary HTML, Turbo and permitted no-JS journeys. These additions are
+unpublished. Migration/checkpoint/compatible-rollback tests and native client
+acceptance are complete locally. The full adopter suite passes 1,330 examples
+with zero failures and three existing empty scaffold examples pending. Six
+development guides pass build, browser, keyboard and no-JS checks. Publication
+and the proposed 1.0 commitment remain separate gates.
+
+## Locally verified — Android and iOS login
+
+Mobile support is now part of the active migration implementation. It is not available in the published gem. These capabilities extend the
+same account and session policies. The verified finite profile uses explicit
+30-day absolute and 14-day idle limits, with fresh sign-in after expiry. Renewable
+refresh-token families remain a distinct optional capability, currently disabled.
+The owner selected 0.3.0; publication and package verification remain pending.
+
+- [x] **R8 · Password and provider login for native clients.** Return credentials
+      over authenticated HTTPS responses; preserve supported client contracts.
+- [x] **R8 · Secure browser-to-app sign-in handoffs.** Short-lived, single-use
+      codes bound to state and a verifier, exact callback validation, and native
+      Apple nonce verification; no reusable bearer tokens in callback URLs.
+- [x] **R8 · Device sessions and revocation.** Expiring, digested API credentials,
+      cookie/bearer separation, device listing, current-device and all-device
+      logout, and invalidation on password/account changes. Evaluate optional
+      renewal with rotation and replay detection as a distinct profile.
+- [x] **R8 · Android/iOS migration acceptance.** Test secure client storage,
+      cancellation/restarts, account switching, expiry and concurrent handoffs,
+      plus supported old/new client combinations. Android/iOS consumers also
+      pass against an installed gem in an isolated Rails adopter over local HTTPS.
 
 Each change owns its tests and keeps intermediate releases usable. R3/R4 findings
 feed R5. A patch may address compatible corrections; another 0.x minor is possible
 if integration contracts change. A 0.3 release is not a prerequisite for 1.0.
-R8 is planned after the prepared 0.2.2 correction; its supported source profiles
-and delivery version will be decided during discovery, with public API impact
-resolved before R5 freezes. Devise migration support is not available yet.
+R8 follows the published 0.2.2 correction; its supported source profiles
+are bounded to the verified Devise 5.0.4 fixtures. The selected delivery version is 0.3.0. Its pre-1.0 integration contracts
+remain subject to review before R5 freezes. Devise migration support is not available yet.
+
+## Delivery — 0.3.0 feature release, then the proposed 1.0 gate
 
-## Delivery — 0.2.2 first, then the proposed 1.0 gate
+- [x] Select 0.3.0 for the locally verified migration, lifecycle, provider and native scope.
+- [ ] Pass required PR and exact default-branch CI/CodeQL for 0.3.0.
+- [ ] Publish 0.3.0 through protected OIDC and verify the downloaded package and manual.
 
-- [ ] **R6 · Deliver the prepared 0.2.2 correction.** Commit and review the
-      tested changes, pass current required GitHub checks, publish through
-      protected OIDC, verify the registry package in a fresh host and publish
-      the matching manual. Preserve the existing latest-0.x support policy.
+- [x] **R6 · Deliver the 0.2.2 correction.**
+      [PR #10](https://github.com/taimoorq/add_auth/pull/10) passed all required
+      checks, followed by exact default-branch CI and protected OIDC publication.
+      The downloaded package checksum and all 121 files match the reviewed
+      candidate; fresh-host installation and the matching public manual pass.
+      The existing latest-0.x support policy remains in effect.
 
 - [ ] **R6 · Finish the adoption and compatibility review.** R1–R5 findings are
       completed or explicitly dispositioned, the supported API is accepted, and
@@ -160,19 +209,19 @@ compatible extension could ship in 1.x after an explicit scope decision.
       before implementation; codes must not silently satisfy passkey-only purposes.
 - [ ] **F2 · Rails-native password hashing integration.** Recheck available Rails
       support and real adopter needs before adding an adapter or changing a default.
-- [ ] **F3 · Account lifecycle helpers.** Evaluate registration, confirmation,
-      reset, lockout and password policy individually against repeated needs.
-      Current host password integration already ships.
+- [ ] **F3 · Account lifecycle helpers.** The bounded migration requirements
+      are promoted to R8 above; broader module parity remains outside this scope.
 - [ ] **F4 · Multiple realms.** Require a concrete identity/session-isolation need
       and migration design before adding models, cookies or routing APIs.
-- [ ] **F4 · API/token authentication.** Decide separately from browser sessions
-      and realms; require a real non-browser client use case.
+- [ ] **F4 · API/token authentication.** Android/iOS login is the active R8
+      work above; multiple realms and general API-key management remain separate.
 - [ ] **F5 · Standalone test helpers or challenge adapters.** Extract only if
       independent demand and maintenance capacity justify another package;
       retain one implementation per concern.
 
-Social/OIDC, SMS/TOTP and enterprise or cross-origin WebAuthn are outside the
-current roadmap. Account roles, invitations, authorization and email branding
+Optional provider-library integration is locally verified under R8. SMS/TOTP and enterprise
+or cross-origin WebAuthn remain outside the current roadmap. Account roles,
+invitations, authorization and email branding
 stay with the host.
 
 ## Shipped — 0.2.1 baseline

data/SECURITY.md

@@ -34,6 +34,12 @@ mailing list, or social media) until a fix has been released.
   replacement handling.
 - Bounded session listing and authentication-history cleanup, including account
   scoping, eligibility rechecks and active-delivery-lease protection.
+- Optional account lifecycle and migration boundaries: credential
+  profile selection, source-write fencing, address ownership, account proofs,
+  policy and revocation. These capabilities are introduced in 0.3.0.
+- Optional provider identity binding and mobile sessions/handoffs, including
+  nonce/client/purpose binding, exact callbacks, single use and bearer/cookie
+  separation. Provider protocol cryptography remains library-owned.
 - The generated controllers and views this gem ships,
   including their CSRF, enumeration-safety, and Turbo-Stream behavior.
 - The GitHub Actions release pipeline (`.github/workflows/push_gem.yml`) and

data/app/controllers/add_auth/accounts_controller.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class AccountsController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    layout "add_auth/authentication"
+    helper AddAuth::SignInsHelper
+    before_action :require_feature
+    before_action :private_response
+    before_action :require_add_auth_authentication, only: %i[edit_email change_email edit_password change_password confirm_deletion destroy]
+    protect_from_forgery with: :exception
+    rescue_from AddAuth::Error, "ActiveJob::EnqueueError", with: :service_unavailable
+
+    def new = page("register")
+    def check_email = page("check_email")
+
+    def create
+      admitted = intake(:register)
+      return intake_failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.accounts.register(identifier: admitted, password: params[:password], profile: registration_profile)
+      if result.success?
+        redirect_to "/account/check-email", status: :see_other
+      else
+        @error = "Check your email and choose a password that meets this application's requirements."
+        page("register", status: :unprocessable_entity)
+      end
+    end
+
+    def request_form
+      @purpose = purpose
+      page("request")
+    end
+
+    def request_proof
+      @purpose = purpose
+      admitted = intake(:account_request)
+      return intake_failure(admitted) if %i[challenge_rejected challenge_unavailable].include?(admitted)
+      Rails::Runtime.enqueue_account_request(identifier: admitted, purpose: @purpose) unless admitted.is_a?(Symbol)
+      redirect_to "/account/check-email", status: :see_other
+    end
+
+    def proof
+      @purpose = purpose
+      result = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+      page(result.success? ? "proof" : "invalid_proof")
+    end
+
+    def consume
+      @purpose = purpose
+      admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :account_consume)
+      return intake_failure(admitted) if admitted.is_a?(Symbol)
+      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password])
+      if result.success?
+        redirect_to "/sign-in", status: :see_other, notice: "Your account has been updated. Sign in to start a new session."
+      else
+        @error = "This request could not be completed. Check the password requirements or request a new link."
+        page("proof", status: :unprocessable_entity)
+      end
+    end
+
+    def edit_email = page("email")
+    def edit_password = page("password")
+    def confirm_deletion = page("delete")
+
+    def destroy
+      result = Rails::Runtime.accounts.delete_account(user: Current.user, session: Current.session)
+      if result.success?
+        terminate_session
+        redirect_to "/sign-in", status: :see_other, notice: "Your account was deleted."
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=delete_account", status: :see_other
+      else
+        @error = "Your account could not be deleted. Contact support if this continues."
+        page("delete", status: :unprocessable_entity)
+      end
+    end
+
+    def change_password
+      result = Rails::Runtime.accounts.change_password(user: Current.user, session: Current.session, password: params[:password])
+      if result.success?
+        terminate_session
+        redirect_to "/sign-in", status: :see_other, notice: "Your password was changed. Sign in with your new password."
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=change_password", status: :see_other
+      else
+        @error = "This password cannot be used. Check the password requirements and try again."
+        page("password", status: :unprocessable_entity)
+      end
+    end
+
+    def change_email
+      result = Rails::Runtime.accounts.change_email(user: Current.user, session: Current.session, identifier: params[:email_address])
+      if result.success?
+        redirect_to "/account/check-email", status: :see_other
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=change_email", status: :see_other
+      else
+        @error = "This email address cannot be used. Check it and try again."
+        page("email", status: :unprocessable_entity)
+      end
+    end
+
+    private
+
+    # Host controllers may override with an explicit Rails parameter allowlist.
+    # The default does not forward arbitrary account/role parameters.
+    def registration_profile = {}
+
+    def require_feature
+      head :not_found unless AddAuth.configuration.lifecycle.enabled
+    end
+
+    def purpose
+      Core::AccountLifecycle::PURPOSES.include?(params[:purpose]) ? params[:purpose] : "confirm"
+    end
+
+    def intake(action)
+      Rails::Runtime.intake.call(identifier: params[:email_address], ip: request.remote_ip, action: action, challenge_token: challenge_token)
+    end
+
+    def authentication_partial(partial) = "add_auth/accounts/#{partial}"
+
+    def service_unavailable
+      @error = "Account requests are temporarily unavailable. Please try again shortly."
+      response.set_header("Retry-After", "60")
+      page("unavailable", status: :service_unavailable)
+    end
+
+    def intake_failure(reason)
+      @error = "This request could not be verified. Please try again shortly."
+      status = {rate_limited: :too_many_requests, challenge_unavailable: :service_unavailable}.fetch(reason, :unprocessable_entity)
+      response.set_header("Retry-After", "300") if %i[too_many_requests service_unavailable].include?(status)
+      page("unavailable", status: status)
+    end
+  end
+end

data/app/controllers/add_auth/assets_controller.rb

@@ -20,7 +20,8 @@ module AddAuth
     end
 
     def boot
-      source = 'if (!window.Turbo) await import("/add_auth/turbo.js"); await import("/add_auth/challenge.js");'
+      source = Rails::Runtime.config.turbo_enabled ? 'if (!window.Turbo) await import("/add_auth/turbo.js");' : ""
+      source += ' await import("/add_auth/challenge.js");'
       source += ' await import("/add_auth/passkey.js");' if Rails::Runtime.config.passkeys.enabled
       render body: source, content_type: "text/javascript"
     end

data/app/controllers/add_auth/external_identities_controller.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module AddAuth
+  class ExternalIdentitiesController < ::ApplicationController
+    include Rails::AuthenticationPages
+
+    skip_before_action :require_authentication, raise: false
+    before_action :private_response
+    before_action :require_feature
+    before_action :require_add_auth_authentication
+    protect_from_forgery with: :exception
+    helper AddAuth::SignInsHelper
+    layout "add_auth/authentication"
+    rescue_from AddAuth::Error, with: :unavailable
+
+    def index
+      load_identities
+      page("index")
+    end
+
+    def destroy
+      elevation = Rails::Runtime.sessions.with_elevation(user: Current.user, session: Current.session,
+        purpose: Core::ExternalIdentities::UNLINK, policy: Rails::Runtime.step_up_policy)
+      result = service.unlink(user: Current.user, session: Current.session, identity_id: params[:id], grant: elevation.credential)
+      if result.success?
+        redirect_to "/account/external-identities", status: :see_other
+      elsif result.reason == :elevation_required
+        redirect_to "/reauthenticate?purpose=unlink_external_identity", status: :see_other
+      else
+        @error = (result.reason == :last_credential) ? "Add another usable sign-in method before removing this one." : "This sign-in method could not be changed. Try again."
+        load_identities
+        page("index", status: :unprocessable_entity)
+      end
+    end
+
+    private
+
+    def service = Rails::Runtime.external_identities
+
+    def require_feature
+      head :not_found unless Rails::Runtime.config.external_identities.enabled
+    end
+
+    def authentication_partial(partial) = "add_auth/external_identities/#{partial}"
+
+    def load_identities
+      @identities = ::AddAuthExternalIdentity.where(user_id: Current.user.id, revoked_at: nil).order(:linked_at)
+      @providers = Rails::Runtime.config.external_identities.providers
+    end
+
+    def unavailable
+      @error = "External sign-in is temporarily unavailable."
+      page("unavailable", status: :service_unavailable)
+    end
+  end
+end