add_auth 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b83eabd84666412ae2a83ffc20ac54c9765ef0133e0e401cffebce9e3f73f444
-  data.tar.gz: b187c3b70d0c43139f870a50231e5e024f71885218ed68770c98218c257b4be3
+  metadata.gz: 0f425748354f43e9f37579150ae2fe1cae7797f5da8c37af7e9f330b783a2d96
+  data.tar.gz: 8b7187ffe5b74c138d68cf4ffac7edf7c65e3d258941edec49c72f55a743c621
 SHA512:
-  metadata.gz: 65eb201de7ebebca70a786c9664a46df8c27404e74dcd2704b25ef33673ab0f42f7a9c5a865c707cb33a943a4a933c8903fc5dafd1479c32bf0ad0266263f7d6
-  data.tar.gz: a48427dfe1145c18be90ddb4ec027b70a7179f7e742d3806ee99ee2ddbf7e9f865abbb0486d96cce600e7e5284ee7487ea7a4b17c71639b94c1801dc95b1b8ee
+  metadata.gz: 51c64dbd5366aac908be7df8fd4f82c9501ce081400fb77976ece4b92fa9066a7aca0fc799a7ba4e99ce3c19609190db702373e6e45fddc055795df8b23898c7
+  data.tar.gz: 9a37bfc7978081e75ea517ae9ba414fa4b2771ec7d9bb8ea6a56acf6da1ee3fe2b0882989e9177198a701ce409e2b05af225214389bb5361b0845bb5d6df5f01

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.5.1 — 2026-10-21
+
+Security hardening; upgrading is recommended. Refresh ejected account and
+passkey controllers/views through the normal review process.
+
+- The first email confirmation of an account with a linked sign-in provider
+  names that provider in the email and on the page. Only an explicit "Confirm
+  and keep" preserves the link; any other confirmation removes it.
+- Automatic password lockout gates only password sign-in. It no longer revokes
+  existing sessions or blocks passkey, email-link or provider sign-in, never
+  counts failures for accounts that cannot use a password, and is cleared by a
+  successful password reset. Manual locks are unchanged.
+- Sign out everywhere also revokes outstanding email proofs, account proofs
+  (such as a pending address change), passkey/provider ceremonies and mobile
+  handoffs.
+- Rate limits check the IP budget first and charge the identifier budget only
+  after a configured challenge passes. Passkey sign-in option requests use their
+  own IP budget, and `passkeys.anonymous_limit` now applies per IPv4 address or
+  IPv6 /64 rather than globally.
+
 ## 0.5.0 — 2026-09-18
 
 - Honor Rails' `primary_key_type` generator setting for all AddAuth-owned tables.

data/README.md

@@ -29,15 +29,15 @@ for verification in a disposable host.
 
 ## Quickstart
 
-These commands target 0.5.0 and are available after its
-[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.5.0).
+These commands target 0.5.1 and are available after its
+[RubyGems publication](https://rubygems.org/gems/add_auth/versions/0.5.1).
 Check package availability before changing your app’s bundle.
 
 Install the `add_auth` gem from RubyGems through your Rails app’s Gemfile,
 then enable password and email-link sign-in. Use Ruby 3.3+ and Rails 8.0+
 with Active Record, and run the commands below from your Rails app’s root.
 
-**Release availability:** these commands require the published `0.5.0` package.
+**Release availability:** these commands require the published `0.5.1` package.
 If it is not yet listed on [RubyGems](https://rubygems.org/gems/add_auth/versions),
 wait for publication; see [release status](https://addauthgem.com/release-status/).
 Start in your app’s development environment; use the deployment settings
@@ -48,7 +48,7 @@ below before enabling sign-in for users.
 
    ```ruby
    # Gemfile
-   gem "add_auth", "~> 0.5.0"
+   gem "add_auth", "~> 0.5.1"
    ```
 
    Bundler downloads the package from RubyGems and records the resolved

data/app/controllers/add_auth/accounts_controller.rb

@@ -52,6 +52,7 @@ module AddAuth
     def proof
       @purpose = purpose
       result = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+      @providers = Rails::Runtime.provider_labels(result.credential) if result.success?
       page(result.success? ? "proof" : "invalid_proof")
     end
 
@@ -59,11 +60,14 @@ module AddAuth
       @purpose = purpose
       admitted = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: :account_consume)
       return intake_failure(admitted) if admitted.is_a?(Symbol)
-      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password])
+      result = Rails::Runtime.accounts.consume(token: params[:token], purpose: @purpose, password: params[:password],
+        keep_providers: params[:providers] == "keep")
       if result.success?
         redirect_to "/sign-in", status: :see_other, notice: "Your account has been updated. Sign in to start a new session."
       else
         @error = "This request could not be completed. Check the password requirements or request a new link."
+        preview = Rails::Runtime.accounts.preview(token: params[:token], purpose: @purpose)
+        @providers = Rails::Runtime.provider_labels(preview.credential) if preview.success?
         page("proof", status: :unprocessable_entity)
       end
     end

data/app/controllers/add_auth/passkeys_controller.rb

@@ -30,9 +30,11 @@ module AddAuth
       finish(result, destination: "/passkeys", grant: result.grant)
     end
 
+    # Conditional UI requests options on page load. Keep that off the
+    # password sign_in budget while still applying the sign_in challenge.
     def authentication_options
-      return unless admitted(:sign_in)
-      options(service.authentication_options(browser_secret: browser_secret))
+      return unless admitted(:sign_in, budget: :passkey_options)
+      options(service.authentication_options(browser_secret: browser_secret, ip: request.remote_ip))
     end
 
     def authenticate
@@ -92,8 +94,8 @@ module AddAuth
       value.to_unsafe_h if value.is_a?(ActionController::Parameters)
     end
 
-    def admitted(action)
-      result = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: action, challenge_token: challenge_token)
+    def admitted(action, budget: action)
+      result = Rails::Runtime.intake.anonymous(ip: request.remote_ip, action: action, challenge_token: challenge_token, budget: budget)
       return true if result == true
       render json: {error: "Verification could not start. Try again shortly."}, status: if result == :rate_limited
                                                                                           429

data/app/jobs/add_auth/account_delivery_job.rb

@@ -7,7 +7,8 @@ module AddAuth
       return unless record
       deliver(service: Rails::Runtime.accounts, record: record, mailer: AccountMailer) do |delivery|
         AccountMailer.link(recipient: delivery.fetch(:recipient), purpose: delivery.fetch(:purpose),
-          url: Rails::Runtime.account_proof_url(delivery.fetch(:token), purpose: delivery.fetch(:purpose)))
+          url: Rails::Runtime.account_proof_url(delivery.fetch(:token), purpose: delivery.fetch(:purpose)),
+          providers: Rails::Runtime.provider_labels(delivery.fetch(:providers, [])))
       end
     end
   end

data/app/mailers/add_auth/account_mailer.rb

@@ -2,7 +2,8 @@
 
 module AddAuth
   class AccountMailer < SignInMailer
-    def link(recipient:, url:, purpose:)
+    def link(recipient:, url:, purpose:, providers: [])
+      @providers = providers
       @instruction = {"confirm" => "Confirm your email address", "reset_password" => "Choose a new password", "unlock" => "Unlock your account"}.fetch(purpose)
       @url = url
       mail(to: recipient, from: Rails::Runtime.config.mail_from, subject: @instruction,

data/app/views/add_auth/account_mailer/link.text.erb

@@ -2,6 +2,10 @@
 
 Open this link, then use the button on the page to confirm your request:
 <%= @url %>
+<% if @providers.present? %>
+
+This account was started by signing in with <%= @providers.to_sentence %>. Keep <%= @providers.to_sentence %> only if you used it to create this account. If you did not, choose "Confirm without <%= @providers.to_sentence %>".
+<% end %>
 
 This link expires in <%= AddAuth.configuration.lifecycle.proof_lifetime.to_i / 60 %> minutes and can be used once.
 If you did not request this message, you can ignore it.

data/app/views/add_auth/accounts/_proof.html.erb

@@ -11,6 +11,13 @@
       <%= form.password_field :password, required: true, autocomplete: "new-password", class: add_auth_class(:input) %>
     </div>
   <% end %>
-  <%= form.submit title, class: add_auth_class(:button) %>
+  <% if @purpose == "confirm" && @providers.present? %>
+    <% providers = @providers.to_sentence %>
+    <p>This account was started by signing in with <%= providers %>. Keep <%= providers %> only if you used it to create this account.</p>
+    <%= form.button "Confirm and keep #{providers}", name: "providers", value: "keep", class: add_auth_class(:button) %>
+    <%= form.button "Confirm without #{providers}", name: "providers", value: "remove", class: add_auth_class(:button) %>
+  <% else %>
+    <%= form.submit title, class: add_auth_class(:button) %>
+  <% end %>
 <% end %>
 <p><%= link_to "Back to sign in", "/sign-in" %></p>

data/lib/add_auth/core/account_lifecycle.rb

@@ -35,7 +35,8 @@ module AddAuth
       end
 
       def initialize(store:, digest:, delivery_cipher:, policy:, password_policy:, trusted_address:, clock: Time, random: SecureRandom,
-        lifetime: 3600, notify: ->(**) {}, sessions: nil, step_up_policy: nil, profile_attributes: ->(_profile) { {} }, deletion_allowed: ->(_user) { true }, external_identities: nil)
+        lifetime: 3600, notify: ->(**) {}, sessions: nil, step_up_policy: nil, profile_attributes: ->(_profile) { {} }, deletion_allowed: ->(_user) { true }, external_identities: nil,
+        external_bindings: nil)
         raise ArgumentError, "proof lifetime must be between 60 and 86400 seconds" unless lifetime.is_a?(Numeric) && lifetime.between?(60, 86_400)
         @store, @digest, @cipher, @policy, @password_policy, @trusted_address = store, digest, delivery_cipher, policy, password_policy, trusted_address
         @clock, @random, @lifetime, @notify = clock, random, lifetime, notify
@@ -43,6 +44,7 @@ module AddAuth
         @profile_attributes = profile_attributes
         @deletion_allowed = deletion_allowed
         @external_identities = external_identities
+        @external_bindings = external_bindings
       end
 
       def register(identifier:, password:, profile: {}, replacing: nil, user_agent: nil, ip_address: nil, remember: false)
@@ -86,14 +88,21 @@ module AddAuth
         accepted
       end
 
+      # A confirm preview's credential lists the provider configurations whose
+      # bindings the address owner must explicitly keep (see #consume).
       def preview(token:, purpose:)
         return failure unless token.is_a?(String) && TOKEN.match?(token) && PURPOSES.include?(purpose.to_s)
         user, record = @store.inspect_token(digest: @digest.digest(token))
         reason = rejection(user, record, purpose: purpose.to_s)
-        reason ? Result.failure(reason: reason) : Result.success(user: user, strategy: purpose.to_sym)
+        return Result.failure(reason: reason) if reason
+        Result.success(user: user, strategy: purpose.to_sym, credential: (unadopted_providers(user) if purpose.to_s == "confirm"))
       end
 
-      def consume(token:, purpose:, password: nil)
+      # A first confirmation is the address owner's adoption decision for any
+      # provider binding made before the address was proved. Only an explicit
+      # keep_providers: true preserves those bindings; any other confirmation
+      # revokes them in the same transaction (canonical plan section 18, A1).
+      def consume(token:, purpose:, password: nil, keep_providers: false)
         return failure unless token.is_a?(String) && TOKEN.match?(token) && PURPOSES.include?(purpose.to_s)
         @store.with_token(digest: @digest.digest(token)) do |user, record|
           reason = rejection(user, record, purpose: purpose.to_s)
@@ -110,12 +119,14 @@ module AddAuth
               @notify.call(user: user, kind: :email_changed, at: now, recipient: old_address)
               @notify.call(user: user, kind: :email_changed, at: now, recipient: pending)
             else
+              @external_bindings.revoke_all_in_transaction(user_id: user.id, at: now) if keep_providers != true && unadopted_providers(user).any?
               @store.update_account(user: user, confirmed_at: now)
               provision_account(user)
             end
           when "reset_password"
             next failure unless valid_new_password?(password)
             @store.replace_password(user: user, password: password)
+            clear_password_lock(user)
             @store.revoke_authority(user: user, at: now)
             @notify.call(user: user, kind: :password_changed, at: now)
           when "unlock"
@@ -214,6 +225,18 @@ module AddAuth
         failure
       end
 
+      # A proved reset ends brute-force lockout, never a manual lock.
+      def clear_password_lock(user)
+        attempts = user.respond_to?(:failed_attempts) ? user.failed_attempts.to_i : 0
+        return if user.add_auth_manual_lock || (!user.locked_at && attempts.zero?)
+        @store.update_account(user: user, locked_at: nil, add_auth_locked_until: nil, failed_attempts: 0)
+      end
+
+      def unadopted_providers(user)
+        return [].freeze unless @external_bindings && user && !user.confirmed_at
+        @external_bindings.provider_ids(user_id: user.id)
+      end
+
       def provision_account(user)
         tracked = user.respond_to?(:add_auth_provisioned_at)
         return if tracked && user.add_auth_provisioned_at
@@ -286,7 +309,8 @@ module AddAuth
         payload = JSON.parse(raw)
         return unless payload["purpose"] == record.purpose && payload["recipient"] == recipient_for(user, record.purpose) &&
           payload["token"].is_a?(String) && @digest.matches?(record.digest, payload["token"])
-        {recipient: payload.fetch("recipient"), token: payload.fetch("token"), purpose: record.purpose}
+        {recipient: payload.fetch("recipient"), token: payload.fetch("token"), purpose: record.purpose,
+         providers: (record.purpose == "confirm") ? unadopted_providers(user) : []}
       rescue JSON::ParserError, KeyError
         nil
       end

data/lib/add_auth/core/account_policy.rb

@@ -41,13 +41,27 @@ module AddAuth
         return :disabled unless available?(user)
         return unless @enabled
         return :unconfirmed if !value(user, :confirmed_at) && (confirmation_required? || !password_account?(user))
-        :locked if locked?(user)
+        :locked if account_locked?(user)
       end
 
+      # Password results may also disclose an automatic lock to the holder of
+      # the correct password; other methods never consult this.
+      def password_denial(user) = denial(user) || ((@enabled && locked?(user)) ? :locked : nil)
+
+      # Any active lock, including the automatic password lock.
       def locked?(user)
         value(user, :locked_at) && (value(user, :add_auth_manual_lock) || !value(user, :add_auth_locked_until) || value(user, :add_auth_locked_until) > @clock.now)
       end
 
+      # Manual and imported (untimed) locks deny the whole account. An automatic
+      # brute-force lock gates only the password method (plan section 18, A2).
+      def account_locked?(user) = locked?(user) && !self.class.automatic_lock?(user, now: @clock.now)
+
+      def self.automatic_lock?(user, now:)
+        read = ->(name) { user.public_send(name) if user.respond_to?(name) }
+        !!(read.call(:locked_at) && !read.call(:add_auth_manual_lock) && read.call(:add_auth_locked_until) && read.call(:add_auth_locked_until) > now)
+      end
+
       private
 
       def password_account?(user)

data/lib/add_auth/core/external_identities.rb

@@ -185,6 +185,21 @@ module AddAuth
         self.class.invalidate_credentials_in_transaction(store: @store, user_id: user_id, at: at)
       end
 
+      # Bindings persist while provider sign-in is disabled, so G3 reaches them
+      # through this narrow port rather than the enabled service. G3 owns the
+      # adoption decision; this only reports and revokes live bindings.
+      class Bindings
+        def initialize(store:)
+          @store = store
+        end
+
+        def provider_ids(user_id:) = @store.bindings(user_id: user_id).map(&:provider_id).uniq.sort.freeze
+
+        def revoke_all_in_transaction(user_id:, at:)
+          @store.bindings(user_id: user_id).each { |identity| @store.revoke(identity: identity, at: at) }.size
+        end
+      end
+
       def credential_current?(user:, id:, version:)
         return false unless @enabled
         identity = @store.binding_for_user(user_id: user.id, id: id)

data/lib/add_auth/core/intake.rb

@@ -14,19 +14,24 @@ module AddAuth
         @on_challenge_unavailable = on_challenge_unavailable
       end
 
+      # An exhausted IP budget stops before the identifier budget, and the
+      # identifier is charged only after any configured challenge passes, so
+      # other clients cannot spend a target's budget (plan section 18, A4).
       def call(identifier:, ip:, action:, challenge_token: nil)
         value = (identifier.is_a?(String) && identifier.valid_encoding? && identifier.bytesize.between?(1, 254)) ? @normalizer.call(identifier) : ""
         value = "" unless value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 254)
-        ip_ok = @limiter.call(key: @digest.digest("ip:#{ip}:#{action}"), limit: 30)
-        identifier_ok = @limiter.call(key: @digest.digest("identifier:#{value}:#{action}"), limit: 5)
-        return :rate_limited unless ip_ok && identifier_ok
+        return :rate_limited unless @limiter.call(key: @digest.digest("ip:#{ip}:#{action}"), limit: 30)
         return :invalid_credentials if value.to_s.empty?
         rejection = verify_challenge(ip: ip, action: action, challenge_token: challenge_token)
-        rejection || value
+        return rejection if rejection
+        return :rate_limited unless @limiter.call(key: @digest.digest("identifier:#{value}:#{action}"), limit: 5)
+        value
       end
 
-      def anonymous(ip:, action:, challenge_token: nil)
-        return :rate_limited unless @limiter.call(key: @digest.digest("ip:#{ip}:#{action}"), limit: 30)
+      # budget separates an IP counter from the challenge action, so a
+      # background request cannot spend the budget of an interactive form.
+      def anonymous(ip:, action:, challenge_token: nil, budget: action)
+        return :rate_limited unless @limiter.call(key: @digest.digest("ip:#{ip}:#{budget}"), limit: 30)
         verify_challenge(ip: ip, action: action, challenge_token: challenge_token) || true
       end
 

data/lib/add_auth/core/passwords/lifecycle.rb

@@ -1,19 +1,30 @@
 # frozen_string_literal: true
 
+require "add_auth/core/account_policy"
+
 module AddAuth
   module Core
     module Passwords
       # Called only inside the owning account transaction. The adapter supplies
       # Rails hashing and persistence; these decisions are shared by entry paths.
       class Lifecycle
-        def initialize(store:, policy:, enabled:, maximum_attempts: 20, unlock_in: 3600, clock: Time, issue_unlock: ->(_user) {})
+        # password_allowed reports whether this account may use password sign-in
+        # at all (feature enabled, stored password, not strict). Accounts that
+        # cannot use a password never accumulate failures or locks.
+        def initialize(store:, policy:, enabled:, maximum_attempts: 20, unlock_in: 3600, clock: Time, issue_unlock: ->(_user) {},
+          password_allowed: ->(_user) { true })
           unless maximum_attempts.is_a?(Integer) && maximum_attempts.between?(1, 100) &&
               unlock_in.is_a?(Numeric) && unlock_in.finite? && unlock_in.between?(60, 86_400)
             raise ArgumentError, "configure bounded password attempts and unlock duration"
           end
           @store, @policy, @enabled, @maximum, @unlock_in, @clock, @issue_unlock = store, policy, enabled, maximum_attempts, unlock_in, clock, issue_unlock
+          @password_allowed = password_allowed
         end
 
+        # The automatic lock gates the password method only; it never denies
+        # other methods or revokes existing authority.
+        def locked?(user) = @enabled && !!user && AccountPolicy.automatic_lock?(user, now: @clock.now)
+
         def prepare(user:)
           return unless @enabled && user && !user.add_auth_manual_lock && user.locked_at &&
             user.add_auth_locked_until && user.add_auth_locked_until <= @clock.now
@@ -21,7 +32,8 @@ module AddAuth
         end
 
         def verified(user:, password:, valid:, rehash: true)
-          return false unless user && @policy.call(user) == true
+          return false unless user && @policy.call(user) == true && @password_allowed.call(user) == true
+          return false if locked?(user)
           if valid
             @store.update_account(user: user, failed_attempts: 0) if @enabled && user.failed_attempts != 0
             if rehash && user.respond_to?(:add_auth_password_scheme) && user.add_auth_password_scheme == "devise_bcrypt" && assignable?(password)
@@ -49,10 +61,7 @@ module AddAuth
             changes[:add_auth_locked_until] = @clock.now + @unlock_in
           end
           @store.update_account(user: user, **changes)
-          if attempts >= @maximum
-            @store.revoke_authority(user: user, at: @clock.now)
-            @issue_unlock.call(user)
-          end
+          @issue_unlock.call(user) if attempts >= @maximum
         end
       end
     end

data/lib/add_auth/core/rate_limit.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ipaddr"
+
 module AddAuth
   module Core
     class RateLimit
@@ -25,6 +27,15 @@ module AddAuth
         end
         counts.all? { |count| count <= limit }
       end
+
+      # One budget per IPv4 address or IPv6 /64, which a single client
+      # commonly controls in full.
+      def self.network(ip)
+        address = IPAddr.new(ip.to_s).native
+        address.ipv6? ? "#{address.mask(64)}/64" : address.to_s
+      rescue IPAddr::Error
+        "unknown"
+      end
     end
   end
 end

data/lib/add_auth/core/sessions.rb

@@ -31,7 +31,8 @@ module AddAuth
       Page = Struct.new(:entries, :next_cursor)
 
       def initialize(store:, digest:, eligible:, lifetime: 43_200, idle_timeout: 1800,
-        legacy_bridge_until: nil, clock: Time, access_policy: nil, password_lifecycle: nil, remembered_profile: nil, mobile_profile: nil, on_sign_in: nil, verified_denial: nil)
+        legacy_bridge_until: nil, clock: Time, access_policy: nil, password_lifecycle: nil, remembered_profile: nil, mobile_profile: nil, on_sign_in: nil, verified_denial: nil,
+        revoke_authority: nil)
         unless [lifetime, idle_timeout].all? { |n| n.is_a?(Numeric) && n.finite? && n.positive? } && idle_timeout <= lifetime
           raise ArgumentError, "session timeouts must be positive and idle_timeout <= lifetime"
         end
@@ -45,6 +46,7 @@ module AddAuth
         @password_lifecycle = password_lifecycle
         @on_sign_in = on_sign_in
         @verified_denial = verified_denial
+        @revoke_authority = revoke_authority
         raise ArgumentError, "invalid mobile profile" unless mobile_profile.nil? || mobile_profile.is_a?(MobileProfile)
         @mobile = mobile_profile
         @lifetime, @idle, @deadline = lifetime, idle_timeout, legacy_bridge_until
@@ -98,6 +100,7 @@ module AddAuth
         return if transport == :mobile && replacing
         raise ArgumentError, "unsupported proof" unless %w[password email_link passkey external_identity].include?(method.to_s)
         return if @access_policy && !@access_policy.sign_in_allowed?(user, method)
+        return if method.to_s == "password" && @password_lifecycle&.locked?(user)
         if method.to_s == "passkey"
           return unless proof.is_a?(StepUp::Evidence) && proof.strong? && proof.user_id == user.id &&
             proof.verified_at <= @clock.now && proof.verified_at > @clock.now - 300
@@ -255,9 +258,13 @@ module AddAuth
         end || Result.failure(reason: :elevation_required)
       end
 
+      # Sign-out-everywhere retires every outstanding proof, not only sessions:
+      # the shared authority port also revokes tokens, ceremonies and handoffs.
       def revoke_all(user:, session:, grant:)
         with_authority(user: user, session: session, grant: grant, purpose: :sign_out_everywhere) do |account, _row, now|
-          @store.revoke_all_in_transaction(user_id: account.id, at: now)
+          count = @store.revoke_all_in_transaction(user_id: account.id, at: now)
+          @revoke_authority&.call(user_id: account.id, at: now)
+          count
         end || false
       end
 

data/lib/add_auth/core/strategies/passkey.rb

@@ -44,7 +44,9 @@ module AddAuth
           end
         end
 
-        def authentication_options(browser_secret:, user: nil, session: nil, purpose: nil)
+        # ip selects the anonymous ceremony budget; one network cannot exhaust
+        # passkey sign-in for every other client.
+        def authentication_options(browser_secret:, user: nil, session: nil, purpose: nil, ip: nil)
           return failure unless @binding.valid?(browser_secret)
           if user || session || purpose
             @store.with_user(id: user&.id) do |account|
@@ -54,7 +56,8 @@ module AddAuth
               create_options(options, kind: "assertion", user: account, session: session, purpose: purpose, browser_secret: browser_secret)
             end
           else
-            return failure(:rate_limited) unless @limiter.call(key: @digest.digest("passkey:anonymous-ceremonies"), limit: @anonymous_limit)
+            budget = "passkey:anonymous-ceremonies:#{RateLimit.network(ip)}"
+            return failure(:rate_limited) unless @limiter.call(key: @digest.digest(budget), limit: @anonymous_limit)
             options = @rp.options_for_authentication(user_verification: "required")
             create_options(options, kind: "assertion", browser_secret: browser_secret)
           end

data/lib/add_auth/rails/runtime.rb

@@ -90,7 +90,26 @@ module AddAuth
           policy: account_policy, password_policy: config.lifecycle.password_policy, trusted_address: method(:trusted_recovery_address),
           lifetime: config.lifecycle.proof_lifetime, notify: ->(**event) { security_events.issue(**event) if config.notifications.enabled },
           sessions: sessions, step_up_policy: step_up_policy, profile_attributes: config.lifecycle.profile_attributes, deletion_allowed: config.lifecycle.deletion_allowed,
-          external_identities: -> { external_identities })
+          external_identities: -> { external_identities }, external_bindings: external_bindings)
+      end
+
+      # Present whenever the binding table exists, even with providers disabled:
+      # a first confirmation must still decide what happens to old bindings.
+      def external_bindings
+        return unless defined?(::AddAuthExternalIdentity) && ::AddAuthExternalIdentity.table_exists?
+        Core::ExternalIdentities::Bindings.new(store: external_identity_store)
+      end
+
+      # Display-only labels for provider configuration IDs held by Core. A
+      # native configuration borrows the label of a browser provider with the
+      # same issuer.
+      def provider_labels(ids)
+        options = config.external_identities
+        Array(ids).map { |id|
+          native = options.native_provider(id)
+          provider = options.provider(id) || (native && options.providers.find { |item| item.configuration.issuer == native.issuer })
+          provider&.label || "your sign-in provider"
+        }.uniq
       end
 
       def enqueue_account_request(identifier:, purpose:)
@@ -112,9 +131,9 @@ module AddAuth
           idle_timeout: config.session.idle_timeout, legacy_bridge_until: config.session.legacy_bridge_until, access_policy: access_policy,
           password_lifecycle: password_lifecycle,
           mobile_profile: mobile_profile,
-          verified_denial: ->(user) { (config.eligible.call(user) == true) ? account_policy.denial(user) : :disabled },
+          verified_denial: ->(user) { (config.eligible.call(user) == true) ? account_policy.password_denial(user) : :disabled },
           remembered_profile: config.lifecycle.enabled ? {lifetime: config.lifecycle.remember_lifetime, idle_timeout: config.lifecycle.remember_idle_timeout} : nil,
-          on_sign_in: method(:record_sign_in))
+          on_sign_in: method(:record_sign_in), revoke_authority: authority.method(:revoke))
       end
 
       def mobile_profile
@@ -163,7 +182,8 @@ module AddAuth
         Core::Passwords::Lifecycle.new(store: Stores::AccountCredentials.new(user_model: ::User, authority: authority),
           policy: method(:eligible), enabled: config.lifecycle.enabled,
           maximum_attempts: config.lifecycle.maximum_attempts, unlock_in: config.lifecycle.unlock_in,
-          issue_unlock: ->(user) { accounts.issue_unlock_in_transaction(user: user) })
+          issue_unlock: ->(user) { accounts.issue_unlock_in_transaction(user: user) },
+          password_allowed: ->(user) { access_policy.sign_in_allowed?(user, :password) })
       end
 
       def security_events

data/lib/add_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AddAuth
-  VERSION = "0.5.0"
+  VERSION = "0.5.1"
 end

data/lib/generators/add_auth/install/templates/initializer.rb

@@ -79,7 +79,7 @@ AddAuth.configure do |config|
   config.passkeys.origins = [] # Required: exact trusted origins, never request Host.
   # config.passkeys.origins = ["https://app.example.com"]
   config.passkeys.name = "Your account"
-  config.passkeys.anonymous_limit = 1000 # Shared ceremony budget per five minutes.
+  config.passkeys.anonymous_limit = 1000 # Ceremony budget per IPv4 address or IPv6 /64 per five minutes.
   config.trusted_recovery_address = ->(_user) {} # No trusted recovery by default.
   # config.trusted_recovery_address = ->(user) { user.email_address if user.confirmed_at }
   # Lifecycle additionally rejects unconfirmed addresses as trusted recovery.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: add_auth
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Taimoor Qureshi