add_auth 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ed4ef07ed6308f6bb4b82de3e67552af3604472f38e7a379f1d9c863f76954e
-  data.tar.gz: 8189c0ddf517a9d06d291738e0d0d20bb383ffc9a7fdd085c9df33ad914312d4
+  metadata.gz: b83eabd84666412ae2a83ffc20ac54c9765ef0133e0e401cffebce9e3f73f444
+  data.tar.gz: b187c3b70d0c43139f870a50231e5e024f71885218ed68770c98218c257b4be3
 SHA512:
-  metadata.gz: 643216bb646e0ca6032f0b53f1928eb6da0b4efeffccadd8477fbb7776f6aa411c6ecf36bb4c3f785d94fa435320c04745a2565c70cef47e387f14fc534b805b
-  data.tar.gz: 48375790d81d186fa5cfd6f4f3ecf4672c46b2ec8602a3597c5a40b69562661212de41f5df8676a7080ef96ab36915af6dec798400aa97610b5b3c22d76be2d4
+  metadata.gz: 65eb201de7ebebca70a786c9664a46df8c27404e74dcd2704b25ef33673ab0f42f7a9c5a865c707cb33a943a4a933c8903fc5dafd1479c32bf0ad0266263f7d6
+  data.tar.gz: a48427dfe1145c18be90ddb4ec027b70a7179f7e742d3806ee99ee2ddbf7e9f865abbb0486d96cce600e7e5284ee7487ea7a4b17c71639b94c1801dc95b1b8ee

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.5.0 — 2026-09-18
+
+- Honor Rails' `primary_key_type` generator setting for all AddAuth-owned tables.
+  Support PostgreSQL UUID sessions and mixed integer/UUID account/session keys,
+  retaining bigint defaults and deriving references from the existing schema.
+- Use creation time and a typed ID in opaque session-page cursors; validate
+  revocation and explicitly enabled legacy session adoption for either key type.
+  For apps already using hardened sessions, re-run `add_auth:session_upgrade`
+  for the new pagination index. Existing tables retain their IDs; refresh ejected
+  controllers through the normal review process.
+  Follow the [upgrade guide](https://addauthgem.com/upgrading/#uuid-support) for
+  the release gate, migration review, opaque client cursors and rollback boundary.
+
 ## 0.4.0 — 2026-09-13
 
 - Constrain JSON below 3.0 for the supported Rails decoding API; independently

data/README.md

@@ -29,26 +29,26 @@ for verification in a disposable host.
 
 ## Quickstart
 
-These commands target 0.4.0 and are available after its
-[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.4.0).
+These commands target 0.5.0 and are available after its
+[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.5.0).
 Check package availability before changing your app’s bundle.
 
 Install the `add_auth` gem from RubyGems through your Rails app’s Gemfile,
 then enable password and email-link sign-in. Use Ruby 3.3+ and Rails 8.0+
 with Active Record, and run the commands below from your Rails app’s root.
 
-**Release availability:** these commands require the published `0.4.0` package.
+**Release availability:** these commands require the published `0.5.0` package.
 If it is not yet listed on [RubyGems](https://rubygems.org/gems/add_auth/versions),
 wait for publication; see [release status](https://addauthgem.com/release-status/).
 Start in your app’s development environment; use the deployment settings
 below before enabling sign-in for users.
 
 1. Keep `source "https://rubygems.org"` in your app’s Gemfile and add the
-   0.4 release line:
+   0.5 release line:
 
    ```ruby
    # Gemfile
-   gem "add_auth", "~> 0.4.0"
+   gem "add_auth", "~> 0.5.0"
    ```
 
    Bundler downloads the package from RubyGems and records the resolved
@@ -568,6 +568,35 @@ adds registration, confirmation/reconfirmation, password reset, lock/unlock and
 account changes. Hosts retain account eligibility, resource authorization and
 provider registrations.
 
+### UUID and integer primary keys in 0.5.0
+
+Version 0.5.0 adds PostgreSQL UUID sessions and configurable primary keys for all
+AddAuth authentication tables. Integer apps retain the normal Rails defaults.
+These instructions become available after the 0.5.0 package is published.
+
+For a new PostgreSQL app, set Rails' generator preference in `config/application.rb`
+before generating authentication or AddAuth features:
+
+```ruby
+config.generators do |g|
+  g.orm :active_record, primary_key_type: :uuid
+end
+```
+
+AddAuth uses this setting for every table it creates. Leave it unset for Rails'
+bigint default, or set `:bigint` or `:integer` explicitly. References follow the
+actual target table, so UUID users can have bigint sessions and vice versa.
+The generated migration records its chosen type; later configuration changes do
+not change that migration or convert existing rows. Other key types are unsupported.
+
+For an existing installation, follow the
+[version-gated package upgrade](https://addauthgem.com/upgrading/#uuid-support).
+It covers the additive pagination index, ejected controller review, opaque
+pagination cursors, verification and rollback from older gems. Integer apps need
+no ID conversion. The [primary-key guide](https://addauthgem.com/uuid-primary-keys/)
+explains mixed schemas and the separate, app-owned migration needed to convert
+existing IDs. The published 0.4.0 package cannot manage UUID sessions.
+
 ## Optional integrations in 0.3.0
 
 Enable bounded [Devise migration](https://addauthgem.com/migrating-from-devise/),

data/ROADMAP.md

@@ -25,6 +25,12 @@ this public checklist is derived from its section 14 and stands on its own.
 
 ## Now — maintain AddAuth and learn from adoption
 
+- [x] Honor the Rails UUID/bigint generator setting across all authentication
+  tables, including UUID sessions, mixed references and three-mode bundled/ejected
+  session management. Local PostgreSQL and browser acceptance passes on Rails
+  8.0/8.1. Added in 0.5.0; see
+  [release availability](https://github.com/taimoorq/add_auth/releases).
+
 - [x] Optional password-signup confirmation, immediate transactional provisioning
   and session issuance, explicit unconfirmed-reset policy, password-only lifecycle
   and the complete commented Rails initializer. Local supported-matrix, stock/

data/SECURITY.md

@@ -54,6 +54,10 @@ the currency policy).
 
 ## Supported versions
 
+UUID/integer session lookup, account-scoped pagination and revocation are also
+in scope. Version 0.5.0 adds UUID sessions and UUID authentication-table generation;
+primary keys must never substitute for browser/mobile bearer secrets.
+
 Until a 1.0 is released, only the latest published version receives security
 fixes. This table will be expanded once there are stable release lines to
 support.

data/app/controllers/add_auth/sessions_controller.rb

@@ -25,7 +25,7 @@ module AddAuth
 
     def destroy
       target_id = params[:id].to_s
-      if target_id.match?(/\A[1-9]\d*\z/) && target_id.to_i == Current.session.id
+      if Rails::Runtime.sessions.current_session?(session: Current.session, session_id: target_id)
         terminate_session
         return redirect_to Rails::Runtime.sign_in_path, status: :see_other
       end

data/lib/add_auth/core/session_cursor.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "time"
+
+module AddAuth
+  module Core
+    class SessionCursor
+      def initialize(key:)
+        @key = key
+      end
+
+      def encode(row)
+        "sc1:" + Base64.urlsafe_encode64(JSON.generate([row.created_at.utc.iso8601(6), row.id]), padding: false)
+      end
+
+      def decode(value)
+        # Retain links issued by releases with integer-only pagination.
+        legacy = @key.parse(value)
+        return {legacy_id: legacy} if legacy.is_a?(Integer)
+        return unless value.is_a?(String) && value.ascii_only? && value.bytesize <= 256 && value.match?(/\Asc1:[A-Za-z0-9_-]+\z/)
+
+        fields = JSON.parse(Base64.urlsafe_decode64(value.delete_prefix("sc1:")))
+        return unless fields.is_a?(Array) && fields.length == 2
+        timestamp, id = fields
+        return unless timestamp.is_a?(String) && timestamp.match?(/\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z\z/)
+        id = @key.parse(id)
+        return unless id
+        time = Time.iso8601(timestamp)
+        return unless time.year.positive? && time.utc.iso8601(6) == timestamp
+        {created_at: time, id: id}
+      rescue ArgumentError, JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/add_auth/core/session_key.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Core
+    class SessionKey
+      UUID = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i
+      MAX_INTEGER = (2**63) - 1
+
+      def initialize(type:)
+        raise ArgumentError, "unsupported session key type" unless %i[integer bigint uuid].include?(type)
+        @uuid = type == :uuid
+      end
+
+      def parse(value)
+        if @uuid
+          value.downcase if value.is_a?(String) && value.ascii_only? && UUID.match?(value)
+        elsif value.is_a?(Integer)
+          value if value.between?(1, MAX_INTEGER)
+        elsif value.is_a?(String) && value.ascii_only? && value.match?(/\A[1-9]\d{0,18}\z/)
+          integer = value.to_i
+          integer if integer <= MAX_INTEGER
+        end
+      end
+
+      # Stock Rails signed cookies serialize integer IDs as integers, UUIDs as
+      # strings. Numeric strings must not broaden the legacy integer bridge.
+      def legacy(value)
+        parse(value) if @uuid || value.is_a?(Integer)
+      end
+    end
+  end
+end

data/lib/add_auth/core/sessions.rb

@@ -2,6 +2,8 @@
 
 require "securerandom"
 require "add_auth/core/mobile_profile"
+require "add_auth/core/session_key"
+require "add_auth/core/session_cursor"
 
 module AddAuth
   module Core
@@ -37,6 +39,8 @@ module AddAuth
           raise ArgumentError, "legacy_bridge_until must be an absolute Time or nil"
         end
         @store, @digest, @eligible, @clock = store, digest, eligible, clock
+        @key = SessionKey.new(type: store.respond_to?(:id_type) ? store.id_type : :integer)
+        @cursor = SessionCursor.new(key: @key)
         @access_policy = access_policy
         @password_lifecycle = password_lifecycle
         @on_sign_in = on_sign_in
@@ -191,13 +195,14 @@ module AddAuth
       def list_page(user:, current_session_id: nil, before: nil)
         empty = Page.new(entries: [])
         return empty unless user && @eligible.call(user) == true
-        return empty unless before.nil? || before.to_s.match?(/\A[1-9]\d{0,18}\z/)
+        boundary = @cursor.decode(before) unless before.nil?
+        return empty unless before.nil? || boundary
 
         now = @clock.now
-        candidates = @store.list_for_user(user_id: user.id, before: before&.to_i,
+        candidates = @store.list_for_user(user_id: user.id, before: boundary,
           excluding: current_session_id, limit: PAGE_SIZE + 1, now: now,
           active_after: now - [@idle, @remembered&.fetch(:idle_timeout) || @idle, @mobile&.idle_timeout || @idle].max, legacy: !!(@deadline && now < @deadline))
-        cursor = candidates[PAGE_SIZE - 1].id if candidates.length > PAGE_SIZE
+        cursor = @cursor.encode(candidates[PAGE_SIZE - 1]) if candidates.length > PAGE_SIZE
         rows = candidates.first(PAGE_SIZE)
         if before.nil? && current_session_id
           current = @store.find_for_user(user_id: user.id, session_id: current_session_id)
@@ -217,16 +222,22 @@ module AddAuth
 
       # Both the initiating bearer and target ownership are checked under lock.
       def revoke_one(user:, session:, session_id:)
-        return false unless session_id.is_a?(Integer) || session_id.to_s.match?(/\A[1-9]\d*\z/)
+        target_id = @key.parse(session_id)
+        return false unless target_id
 
         with_live_session(user: user, session: session) do |account, _current, now|
-          target = @store.find_for_user_in_transaction(user_id: account.id, session_id: session_id.to_i)
+          target = @store.find_for_user_in_transaction(user_id: account.id, session_id: target_id)
           next false unless target
           @store.update(target, revoked_at: now) unless target.revoked_at
           true
         end || false
       end
 
+      def current_session?(session:, session_id:)
+        id = @key.parse(session_id)
+        !!(id && session && id == session.id)
+      end
+
       # Password proof is obtained from the locked, current account. Intake
       # limits must be applied by the caller before reaching this expensive port.
       def reauthenticate(user:, session:, purpose:, policy:)
@@ -315,10 +326,10 @@ module AddAuth
       private
 
       def cookie_lookup(value)
-        if value.is_a?(String) && PATTERN.match?(value)
+        if value.is_a?(String) && value.ascii_only? && PATTERN.match?(value)
           {digest: @digest.digest(value)}
-        elsif value.is_a?(Integer) && value.positive? && @deadline && @clock.now < @deadline
-          {id: value}
+        elsif @deadline && @clock.now < @deadline && (id = @key.legacy(value))
+          {id: id}
         end
       end
 

data/lib/add_auth/rails/migration/key_type.rb

@@ -7,15 +7,15 @@ module AddAuth
         module_function
 
         # Resolve when the migration runs, after the host's account table exists.
-        # Session IDs remain integer until opaque cursor support is established.
+        # Keep the session keyword for migrations generated by earlier releases.
         def for(connection, table, session: false)
           key = connection.primary_key(table)
           column = connection.columns(table).find { |entry| entry.name == key }
           raise ArgumentError, "AddAuth requires a single integer or UUID primary key on #{table}" unless column
           return :bigint if column.type == :integer && column.limit == 8
           return :integer if column.type == :integer
-          return :uuid if column.type == :uuid && !session
-          raise ArgumentError, session ? "AddAuth requires integer Session IDs; UUID accounts can use integer Sessions" : "AddAuth requires an integer or UUID account primary key"
+          return :uuid if column.type == :uuid
+          raise ArgumentError, "AddAuth requires an integer or UUID primary key on #{table}"
         end
       end
     end

data/lib/add_auth/rails/stores/sessions.rb

@@ -6,8 +6,11 @@ module AddAuth
   module Rails
     module Stores
       class Sessions
+        attr_reader :id_type
+
         def initialize(user_model:, session_model:)
           @users, @sessions = user_model, session_model
+          @id_type = @sessions.columns_hash.fetch(@sessions.primary_key).type
           raise ArgumentError, "authentication models must share one connection pool" unless @users.connection_pool.equal?(@sessions.connection_pool)
           @lock = AccountLock.new(@users)
         end
@@ -38,11 +41,16 @@ module AddAuth
         # Query cutoffs come from Core; Core still authorizes every returned row.
         def list_for_user(user_id:, before:, excluding:, limit:, now:, active_after:, legacy:)
           scope = @sessions.where(user_id: user_id, revoked_at: nil)
-          scope = scope.where("id < ?", before) if before
+          if before&.key?(:legacy_id)
+            scope = scope.where("id < ?", before.fetch(:legacy_id))
+          elsif before
+            scope = scope.where("created_at < ? OR (created_at = ? AND id < ?)",
+              before.fetch(:created_at), before.fetch(:created_at), before.fetch(:id))
+          end
           scope = scope.where.not(id: excluding) if excluding
           scope = scope.where("(expires_at IS NULL OR expires_at > ?) AND (last_seen_at IS NULL OR last_seen_at > ?)", now, active_after)
           scope = scope.where.not(expires_at: nil).where.not(last_seen_at: nil) unless legacy
-          scope.order(id: :desc).limit(limit).to_a
+          scope.order(created_at: :desc, id: :desc).limit(limit).to_a
         end
 
         def find_for_user(user_id:, session_id:) = @sessions.find_by(user_id: user_id, id: session_id)

data/lib/add_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AddAuth
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/generators/add_auth/accounts/accounts_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class AccountsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       class_option :email_link, type: :boolean, default: true, desc: "Enable email sign-in as a step-up dependency"

data/lib/generators/add_auth/accounts/templates/add_add_auth_accounts.rb.tt

@@ -14,7 +14,7 @@ class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
     add_column :users, :add_auth_authority, :string, default: "add_auth", null: false unless column_exists?(:users, :add_auth_authority)
     add_column :sessions, :remembered, :boolean, default: false_default, null: false unless column_exists?(:sessions, :remembered)
     add_column :sessions, :idle_timeout, :integer unless column_exists?(:sessions, :idle_timeout)
-    create_table :add_auth_address_claims do |t|
+    create_table :add_auth_address_claims, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :digest, null: false
       t.string :state, null: false
@@ -22,7 +22,7 @@ class AddAddAuthAccounts < ActiveRecord::Migration[8.0]
     end
     add_index :add_auth_address_claims, :digest, unique: true
     add_index :add_auth_address_claims, [:user_id, :state], unique: true
-    create_table :add_auth_account_tokens do |t|
+    create_table :add_auth_account_tokens, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :digest, null: false
       t.string :purpose, null: false

data/lib/generators/add_auth/email_tokens/email_tokens_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
@@ -8,6 +9,7 @@ module AddAuth
     # Internal persistence foundation only. Does not install sign-in routes.
     class EmailTokensGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
 

data/lib/generators/add_auth/email_tokens/templates/create_add_auth_sign_in_tokens.rb.tt

@@ -2,7 +2,7 @@ require "add_auth/rails/migration/key_type"
 
 class CreateAddAuthSignInTokens < ActiveRecord::Migration[8.0]
   def change
-    create_table :add_auth_sign_in_tokens do |t|
+    create_table :add_auth_sign_in_tokens, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), null: false, foreign_key: true
       t.string :digest, limit: 64, null: false
       t.string :identifier_digest, limit: 64, null: false

data/lib/generators/add_auth/external_identities/external_identities_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
@@ -8,6 +9,7 @@ module AddAuth
     # Optional persistence and routes; provider strategies remain disabled until configured.
     class ExternalIdentitiesGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)

data/lib/generators/add_auth/external_identities/templates/create_add_auth_external_identities.rb.tt

@@ -1,8 +1,10 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
   def change
-    user_type = reference_type(:users)
-    session_type = reference_type(:sessions)
-    create_table :add_auth_external_identities do |t|
+    user_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    session_type = AddAuth::Rails::Migration::KeyType.for(connection, :sessions, session: true)
+    create_table :add_auth_external_identities, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_type, null: false, foreign_key: {on_delete: :cascade}
       # SHA256 of the exact JSON [configuration, issuer, audience, subject].
       # Indexing this key preserves case-sensitive subjects on either store.
@@ -18,7 +20,7 @@ class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
       t.timestamps
     end
     add_index :add_auth_external_identities, :namespace, unique: true
-    create_table :add_auth_external_transactions do |t|
+    create_table :add_auth_external_transactions, id: <%= authentication_primary_key_type %> do |t|
       t.string :digest, null: false
       t.string :browser_digest, null: false
       t.string :provider_id, limit: 2048, null: false
@@ -39,12 +41,4 @@ class CreateAddAuthExternalIdentities < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_external_id, :string
     add_column :sessions, :authentication_external_version, :string
   end
-
-  private
-
-  def reference_type(table)
-    column = connection.columns(table).find { |item| item.name == connection.primary_key(table) }
-    raise "Unsupported authentication primary key" unless column && [:integer, :uuid].include?(column.type)
-    (column.type == :integer && column.limit == 8) ? :bigint : column.type
-  end
 end

data/lib/generators/add_auth/mobile_sessions/mobile_sessions_generator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "rails/generators/active_record"
 
 module AddAuth
   module Generators
     class MobileSessionsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
 
       source_root File.expand_path("templates", __dir__)
       def self.next_migration_number(dirname) = ::ActiveRecord::Generators::Base.next_migration_number(dirname)

data/lib/generators/add_auth/mobile_sessions/templates/create_add_auth_mobile_handoffs.rb.tt

@@ -1,9 +1,9 @@
+require "add_auth/rails/migration/key_type"
+
 class CreateAddAuthMobileHandoffs < ActiveRecord::Migration[8.0]
   def change
-    user_key = connection.columns(:users).find { |column| column.name == connection.primary_key(:users) }
-    raise "Unsupported authentication primary key" unless user_key && [:integer, :uuid].include?(user_key.type)
-    user_type = (user_key.type == :integer && user_key.limit == 8) ? :bigint : user_key.type
-    create_table :add_auth_mobile_handoffs do |t|
+    user_type = AddAuth::Rails::Migration::KeyType.for(connection, :users)
+    create_table :add_auth_mobile_handoffs, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_type, foreign_key: {on_delete: :cascade}
       t.string :external_digest, null: false
       t.string :digest

data/lib/generators/add_auth/notifications/notifications_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
@@ -8,6 +9,7 @@ module AddAuth
   module Generators
     class NotificationsGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
       include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)

data/lib/generators/add_auth/notifications/templates/create_add_auth_security_events.rb.tt

@@ -2,7 +2,7 @@ require "add_auth/rails/migration/key_type"
 
 class CreateAddAuthSecurityEvents < ActiveRecord::Migration[8.0]
   def change
-    create_table :add_auth_security_events do |t|
+    create_table :add_auth_security_events, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: AddAuth::Rails::Migration::KeyType.for(connection, :users), foreign_key: {on_delete: :nullify}
       t.string :kind, null: false
       t.string :digest, null: false

data/lib/generators/add_auth/passkeys/passkeys_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rails/generators"
+require "generators/add_auth/primary_key"
 require "generators/add_auth/feature_configuration"
 require "rails/generators/active_record"
 
@@ -8,6 +9,7 @@ module AddAuth
   module Generators
     class PasskeysGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
+      include PrimaryKey
       include FeatureConfiguration
 
       source_root File.expand_path("templates", __dir__)

data/lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt

@@ -14,7 +14,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
     add_column :sessions, :authentication_policy_version, :integer, default: 0, null: false
     add_column :sessions, :authentication_credential_id, :string
     add_column :sessions, :authentication_uv, :boolean, default: false_default, null: false
-    create_table :add_auth_credentials do |t|
+    create_table :add_auth_credentials, id: <%= authentication_primary_key_type %> do |t|
       t.references :user, type: user_key_type, null: false, foreign_key: {on_delete: :cascade}
       t.string :external_id, null: false
       t.text :public_key, null: false
@@ -29,7 +29,7 @@ class AddAddAuthPasskeys < ActiveRecord::Migration[8.0]
       t.timestamps
     end
     add_index :add_auth_credentials, :external_id, unique: true
-    create_table :add_auth_ceremonies do |t|
+    create_table :add_auth_ceremonies, id: <%= authentication_primary_key_type %> do |t|
       t.string :digest, null: false
       t.string :challenge, null: false
       t.string :kind, null: false

data/lib/generators/add_auth/primary_key.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Generators
+    module PrimaryKey
+      private
+
+      # Freeze Rails' generator preference into the migration source. Foreign
+      # keys independently follow the actual referenced table when it runs.
+      def authentication_primary_key_type
+        type = (::Rails.application.config.generators.options.dig(:active_record, :primary_key_type) || :bigint).to_s
+        unless %w[bigint integer uuid].include?(type)
+          raise Thor::Error, "AddAuth supports Rails primary_key_type :bigint, :integer or :uuid"
+        end
+        ":#{type}"
+      end
+    end
+  end
+end

data/lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb

@@ -25,6 +25,9 @@ module AddAuth
       end
 
       def migration
+        unless Dir[File.join(destination_root, "db/migrate/*_add_add_auth_session_cursor_index.rb")].any?
+          migration_template "add_add_auth_session_cursor_index.rb.tt", "db/migrate/add_add_auth_session_cursor_index.rb"
+        end
         unless Dir[File.join(destination_root, "db/migrate/*_extend_sessions_for_add_auth.rb")].any?
           migration_template "extend_sessions_for_add_auth.rb.tt", "db/migrate/extend_sessions_for_add_auth.rb"
         end

data/lib/generators/add_auth/session_upgrade/templates/add_add_auth_session_cursor_index.rb.tt

@@ -0,0 +1,5 @@
+class AddAddAuthSessionCursorIndex < ActiveRecord::Migration[8.0]
+  def change
+    add_index :sessions, [:user_id, :created_at, :id], name: "index_add_auth_session_cursor"
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: add_auth
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Taimoor Qureshi
@@ -329,6 +329,8 @@ files:
 - lib/add_auth/core/rate_limit.rb
 - lib/add_auth/core/remaining_factors.rb
 - lib/add_auth/core/security_events.rb
+- lib/add_auth/core/session_cursor.rb
+- lib/add_auth/core/session_key.rb
 - lib/add_auth/core/sessions.rb
 - lib/add_auth/core/step_up.rb
 - lib/add_auth/core/strategies/email_link.rb
@@ -423,8 +425,10 @@ files:
 - lib/generators/add_auth/passkeys/templates/add_add_auth_passkeys.rb.tt
 - lib/generators/add_auth/passkeys/templates/add_auth_ceremony.rb
 - lib/generators/add_auth/passkeys/templates/add_auth_credential.rb
+- lib/generators/add_auth/primary_key.rb
 - lib/generators/add_auth/session_upgrade/session_upgrade_generator.rb
 - lib/generators/add_auth/session_upgrade/templates/add_add_auth_elevation.rb.tt
+- lib/generators/add_auth/session_upgrade/templates/add_add_auth_session_cursor_index.rb.tt
 - lib/generators/add_auth/session_upgrade/templates/extend_sessions_for_add_auth.rb.tt
 - lib/generators/add_auth/step_up/step_up_generator.rb
 - lib/generators/add_auth/step_up/templates/add_add_auth_reauthentication.rb.tt