aikotoba 0.2.0 → 0.3.0

data/app/controllers/aikotoba/accounts_controller.rb

@@ -27,7 +27,12 @@ module Aikotoba
     end
 
     def build_account(params)
-      Account.build_by(attributes: params)
+      # NOTE: This is the password sign-up form, so it must always attempt to build a
+      #       password credential — otherwise an omitted :password key (as opposed to a
+      #       blank one) makes Account.build_by skip it entirely, silently registering an
+      #       account no auth method can ever sign into. Defaulting the key to "" ensures
+      #       Account::PasswordHash's own presence validation is what actually rejects it.
+      Account.build_by(attributes: {password: ""}.merge(params))
     end
 
     def save_with_callbacks!(account)

data/app/controllers/aikotoba/application_controller.rb

@@ -5,10 +5,16 @@ module Aikotoba
     include EnabledFeatureCheckable
     include Scopable
 
-    helper_method :confirmable?, :lockable?, :recoverable?, :registerable?, :aikotoba_scoped_path, :aikotoba_scoped_path, :aikotoba_scope
+    helper_method :confirmable?, :lockable?, :recoverable?, :registerable?, :magic_link_authenticatable?, :aikotoba_scoped_path, :aikotoba_scope, :aikotoba_scope_registerable?
 
     def aikotoba_controller?
       true
     end
+
+    private
+
+    def aikotoba_scope_registerable?
+      registerable? && aikotoba_scope_config.registerable?
+    end
   end
 end

data/app/controllers/aikotoba/confirms_controller.rb

@@ -46,7 +46,7 @@ module Aikotoba
     end
 
     def find_by_send_token_account!(params)
-      Account.unconfirmed.find_by!(email: params[:email])
+      Account.for_target_type(aikotoba_authenticate_target).unconfirmed.find_by!(email: params[:email])
     end
 
     def send_token_account!(account)
@@ -54,7 +54,7 @@ module Aikotoba
     end
 
     def find_by_has_token_account!(params)
-      Account::ConfirmationToken.active.find_by!(token: params[:token]).account
+      Account::ConfirmationToken.active.for_target_type(aikotoba_authenticate_target).find_by!(token: params[:token]).account
     end
 
     def confirm_account!(account)

data/app/controllers/aikotoba/magic_links_controller.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  class MagicLinksController < ApplicationController
+    include Authenticatable
+    include Protection::RateLimiting
+
+    def self.magic_link_rate_limit_options
+      Aikotoba.magic_link_rate_limit_options
+    end
+    private_class_method :magic_link_rate_limit_options
+
+    rate_limit(**magic_link_rate_limit_options)
+
+    def new
+      @account = build_account({email: ""})
+    end
+
+    def create
+      account = find_by_send_token_account!(magic_link_accounts_params)
+      before_send_magic_link_token_process
+      send_magic_link_token!(account)
+      after_send_magic_link_token_process
+    rescue ActiveRecord::RecordNotFound => e
+      failed_send_magic_link_token_process(e)
+    ensure
+      # NOTE: Always show success message to avoid account enumeration.
+      redirect_to success_send_magic_link_token_path, flash: {notice: success_send_magic_link_token_message}
+    end
+
+    def update
+      # NOTE: Sign-in is done using a URL token (a GET request), so both consuming the
+      #       token and establishing the session are done in the writing role -- unlike
+      #       Confirm/Unlock, which only flip a boolean flag, this also creates an
+      #       Account::Session record via aikotoba_sign_in.
+      ActiveRecord::Base.connected_to(role: :writing) do
+        account = authenticate_account!(params[:token])
+        before_sign_in_process
+        aikotoba_sign_in(account)
+        after_sign_in_process
+      end
+      redirect_to after_sign_in_path, flash: {notice: successed_message}
+    end
+
+    private
+
+    def magic_link_accounts_params
+      params.require(:account).permit(:email)
+    end
+
+    def build_account(params)
+      Account.new(params)
+    end
+
+    def find_by_send_token_account!(params)
+      Account.for_target_type(aikotoba_authenticate_target).find_by!(email: params[:email])
+    end
+
+    def send_magic_link_token!(account)
+      Account::MagicLink.create_token!(account: account, notify: true)
+    end
+
+    def authenticate_account!(token)
+      Account::MagicLink.authenticate_by(token: token, target_type_name: aikotoba_authenticate_target) || raise(ActiveRecord::RecordNotFound)
+    end
+
+    def after_sign_in_path
+      aikotoba_after_authentication_path
+    end
+
+    def success_send_magic_link_token_path
+      aikotoba_scoped_path(:new_session_path)
+    end
+
+    def successed_message
+      I18n.t(".aikotoba.messages.authentication.success")
+    end
+
+    def success_send_magic_link_token_message
+      I18n.t(".aikotoba.messages.magic_link.sent")
+    end
+
+    # NOTE: Methods to override if you want to do something before send magic link token.
+    def before_send_magic_link_token_process
+    end
+
+    # NOTE: Methods to override if you want to do something after send magic link token.
+    def after_send_magic_link_token_process
+    end
+
+    # NOTE: Methods to override if you want to do something failed send magic link token.
+    def failed_send_magic_link_token_process(e)
+    end
+
+    # NOTE: Methods to override if you want to do something before sign in.
+    def before_sign_in_process
+    end
+
+    # NOTE: Methods to override if you want to do something after sign in.
+    def after_sign_in_process
+    end
+  end
+end

data/app/controllers/aikotoba/recoveries_controller.rb

@@ -58,11 +58,11 @@ module Aikotoba
     end
 
     def find_by_send_token_account!(params)
-      Account.find_by!(email: params[:email])
+      Account.for_target_type(aikotoba_authenticate_target).find_by!(email: params[:email])
     end
 
     def find_by_has_token_account!(params)
-      Account::RecoveryToken.active.find_by!(token: params[:token]).account
+      Account::RecoveryToken.active.for_target_type(aikotoba_authenticate_target).find_by!(token: params[:token]).account
     end
 
     def send_recovery_token!(account)

data/app/controllers/aikotoba/sessions_controller.rb

@@ -40,11 +40,11 @@ module Aikotoba
     end
 
     def authenticate_account(params)
-      Account.authenticate_by(attributes: params, target_type_name: aikotoba_authenticate_target)
+      Account::PasswordHash.authenticate_by(attributes: params, target_type_name: aikotoba_authenticate_target)
     end
 
     def after_sign_in_path
-      aikotoba_scope_config[:after_sign_in_path]
+      aikotoba_after_authentication_path
     end
 
     def after_sign_out_path

data/app/controllers/aikotoba/unlocks_controller.rb

@@ -46,7 +46,7 @@ module Aikotoba
     end
 
     def find_by_send_token_account!(params)
-      Account.locked.find_by!(email: params[:email])
+      Account.for_target_type(aikotoba_authenticate_target).locked.find_by!(email: params[:email])
     end
 
     def send_token_account!(account)
@@ -54,7 +54,7 @@ module Aikotoba
     end
 
     def find_by_has_token_account!(params)
-      Account::UnlockToken.active.find_by!(token: params[:token]).account
+      Account::UnlockToken.active.for_target_type(aikotoba_authenticate_target).find_by!(token: params[:token]).account
     end
 
     def unlock_account!(account)

data/app/controllers/concerns/aikotoba/authenticatable.rb

@@ -3,6 +3,7 @@ module Aikotoba
     extend ActiveSupport::Concern
     include Protection::SessionFixationAttack
     include Scopable
+    include RequestBackable
 
     included do
       helper_method :aikotoba_current_account
@@ -41,12 +42,6 @@ module Aikotoba
         # Deleting only the cookie will require explicit re-login, and the situation where only the DB session remains can also occur
         # when the cookie is directly deleted on the browser side, so we decided to allow it.
         terminate_aikotoba_session(only_cookie: true)
-        # NOTE: This is to maintain the session logged in by the old login process, so if you find the account from the session, log in.
-        # TODO: Remove this process in future.
-        if Aikotoba.keep_legacy_login_session && session[aikotoba_session_key].present?
-          account = find_aikotoba_account_by_legacy_session
-          account_session = start_new_aikotoba_session_for(account) if account.present?
-        end
       end
       account_session
     end
@@ -56,12 +51,6 @@ module Aikotoba
       aikotoba_session_find_by(token) if token.present?
     end
 
-    # NOTE: This is to maintain the session logged in by the old login process, so if you find the account from the session, log in.
-    # TODO: Remove this process in future.
-    def find_aikotoba_account_by_legacy_session
-      aikotoba_authenticatable_accounts.find_by(id: session[aikotoba_session_key])
-    end
-
     def start_new_aikotoba_session_for(account)
       prevent_session_fixation_attack
       @aikotoba_current_session = Aikotoba::Account::Session.start!(account: account, **aikotoba_session_meta_from_request)
@@ -99,18 +88,8 @@ module Aikotoba
       }
     end
 
-    # NOTE: Authenticate by target type if specified in the scope configuration.
-    # TODO: Remove this process in future.
-    def aikotoba_authenticatable_accounts
-      Account.authenticatable(target_type_name: aikotoba_authenticate_target)
-    end
-
     def aikotoba_session_find_by(token)
       Account::Session.find_by_token(token, target_type_name: aikotoba_authenticate_target)
     end
-
-    def aikotoba_authenticate_target
-      aikotoba_scope_config[:authenticate_for]
-    end
   end
 end

data/app/controllers/concerns/aikotoba/protection/rate_limiting.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # Rate limiting protection for email-sending endpoints to prevent email bombing attacks.
-# Requires Rails 8+ to use the built-in rate_limit feature.
+# Uses Rails' built-in rate_limit feature.
 #
 # Usage:
 #   class MyController < ApplicationController
@@ -16,16 +16,7 @@ module Aikotoba
       def rate_limit(**options)
         return if options.empty? # Allow empty config (disabled by default)
 
-        if available_rails_rate_limiting?
-          super
-        else
-          raise Errors::NotAvailableException,
-            "Rate limiting requires Rails 8+. Current version: #{Rails::VERSION::STRING}"
-        end
-      end
-
-      def available_rails_rate_limiting?
-        Rails::VERSION::MAJOR >= 8
+        super
       end
     end
   end

data/app/controllers/concerns/aikotoba/request_backable.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  module RequestBackable
+    extend ActiveSupport::Concern
+    include Scopable
+
+    # NOTE: Modeled on the Rails authentication generator's
+    # `request_authentication` / `after_authentication_url` pair. Call this
+    # from the host app's own `authenticate_account!`-style before_action
+    # instead of a bare `redirect_to` to the sign in page. The engine can't
+    # capture the destination on its own: the host owns that redirect, and the
+    # `Referer` the browser sends to `GET /sign_in` is the page that *linked*
+    # to the protected page, not the protected page itself (a redirect never
+    # updates the Referer).
+    def aikotoba_request_authentication(**redirect_options)
+      aikotoba_store_return_to_path
+      redirect_to aikotoba_scoped_path(:new_session_path), **redirect_options
+    end
+
+    private
+
+    # NOTE: Not session[key] -- deleting makes this single-use, so a stale
+    # return_to can't be replayed on a later sign in.
+    def aikotoba_after_authentication_path
+      session.delete(aikotoba_return_to_session_key) || aikotoba_scope_config[:after_sign_in_path]
+    end
+
+    # NOTE: Unlike the Rails generator, which stores `request.url`, store only
+    # the host-less `fullpath`, so the stored value can never point at
+    # another host.
+    def aikotoba_store_return_to_path
+      path = request.fullpath
+      session[aikotoba_return_to_session_key] = path if aikotoba_storable_return_to_path?(path)
+    end
+
+    # NOTE: Only a page the browser can be sent back to with a plain GET is
+    # stored -- redirecting back to a POST/XHR/JSON endpoint after sign in
+    # would replay it as a GET and fail. `fullpath` never carries a host, but
+    # a request for "//evil.example.com/x" (or "/\evil.example.com/x", which
+    # browsers treat the same) still yields a protocol-relative URL once
+    # redirected to -- Rails only started guarding against this in
+    # redirect_to itself in 7.1, and this gem supports Rails >= 6.1.4.
+    def aikotoba_storable_return_to_path?(path)
+      return false unless request.get? && !request.xhr? && request.format.html?
+      path.start_with?("/") && !path.start_with?("//", "/\\")
+    end
+
+    def aikotoba_return_to_session_key
+      "#{aikotoba_scope_config[:session_key]}_return_to_after_authenticating"
+    end
+  end
+end

data/app/controllers/concerns/aikotoba/scopable.rb

@@ -18,19 +18,19 @@ module Aikotoba
 
     private
 
+    def aikotoba_authenticate_target
+      aikotoba_scope_config.authenticate_for
+    end
+
     def aikotoba_calc_scope_from(request_path)
       scope = :default
       Aikotoba.scopes.except(:default).each do |name, config|
-        if aikotoba_from_scope_path?(config[:root_path])
+        if config.covers?(request_path)
           scope = name
           break # NOTE: Adopt the first matching scope
         end
       end
       scope
     end
-
-    def aikotoba_from_scope_path?(scope_root_path)
-      request.path == scope_root_path || request.path.start_with?("#{scope_root_path}/")
-    end
   end
 end

data/app/mailers/aikotoba/account_mailer.rb

@@ -1,24 +1,56 @@
 module Aikotoba
+  # NOTE: These run from deliver_later, so the token is read when the job runs, not when
+  #       it was enqueued. Reading the account's current token is deliberate: issuing a new
+  #       token destroys the previous one, so the latest is the only link that still works.
+  #       It can also be gone by then (used, or cleared by unlock!), in which case nothing is
+  #       sent -- returning without calling `mail` makes the delivery a no-op.
   class AccountMailer < ApplicationMailer
     def confirm
       @account = params[:account]
       @token = @account.confirmation_token
-      @confirm_url = aikotoba.confirm_account_url(token: @token.token)
+      return unless @token
+
+      @confirm_url = aikotoba_scoped_url(:confirm_account_url, token: @token.token)
       mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.confirm.subject"))
     end
 
     def unlock
       @account = params[:account]
       @token = @account.unlock_token
-      @unlock_url = aikotoba.unlock_account_url(token: @token.token)
+      return unless @token
+
+      @unlock_url = aikotoba_scoped_url(:unlock_account_url, token: @token.token)
       mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.unlock.subject"))
     end
 
     def recover
       @account = params[:account]
       @token = @account.recovery_token
-      @recover_url = aikotoba.edit_account_password_url(token: @token.token)
+      return unless @token
+
+      @recover_url = aikotoba_scoped_url(:edit_account_password_url, token: @token.token)
       mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.recover.subject"))
     end
+
+    def magic_link
+      @account = params[:account]
+      @token = @account.magic_link_token
+      return unless @token
+
+      @magic_link_url = aikotoba_scoped_url(:authenticate_via_magic_link_url, token: @token.token)
+      mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.magic_link.subject"))
+    end
+
+    private
+
+    def aikotoba_scoped_url(route, **params)
+      scope = Aikotoba.scopes.name_for(@account.authenticate_target_type)
+      name = (scope == "default") ? route : :"#{scope}_#{route}"
+      # NOTE: The name is built from config, never from request input, but only ever
+      #       public_send an engine route helper, not other public methods on the proxy.
+      raise ArgumentError, "not an Aikotoba route helper: #{name}" unless Aikotoba::Engine.routes.named_routes.route_defined?(name)
+
+      aikotoba.public_send(name, **params)
+    end
   end
 end

data/app/models/aikotoba/account/confirmation_token.rb

@@ -9,6 +9,7 @@ module Aikotoba
     validates :expired_at, presence: true
 
     scope :active, ->(now: Time.current) { where("expired_at >= ?", now) }
+    scope :for_target_type, ->(target_type_name) { joins(:account).merge(Account.for_target_type(target_type_name)) }
 
     after_initialize do |record|
       token = Account::Token.new(expiry: Aikotoba.confirmation_token_expiry)
@@ -16,8 +17,12 @@ module Aikotoba
       record.expired_at ||= token.expired_at
     end
 
+    # NOTE: Waits for every open transaction (including callers' outer ones) to commit,
+    #       and is dropped on rollback, so a sent link never points at a missing token.
     def notify
-      AccountMailer.with(account: account).confirm.deliver_now
+      ActiveRecord.after_all_transactions_commit do
+        AccountMailer.with(account: account).confirm.deliver_later
+      end
     end
   end
 end

data/app/models/aikotoba/account/magic_link.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  class Account::MagicLink
+    def self.create_token!(account:, notify: false)
+      new(account: account).create_token!(notify: notify)
+    end
+
+    def self.authenticate_by(token:, target_type_name: nil)
+      account = Account.authenticatable(target_type_name: target_type_name)
+        .joins(:magic_link_token)
+        .merge(Account::MagicLinkToken.active.where(token: token))
+        .first
+      return unless account
+
+      new(account: account).authenticate!
+    end
+
+    def initialize(account:)
+      @account = account
+    end
+
+    def create_token!(notify:)
+      ActiveRecord::Base.transaction do
+        @account.build_magic_link_token.save!
+        @account.magic_link_token.notify if notify
+      end
+    end
+
+    def authenticate!
+      ActiveRecord::Base.transaction do
+        @account.authentication_success!
+        @account.magic_link_token.destroy!
+      end
+      @account
+    end
+  end
+end

data/app/models/aikotoba/account/magic_link_token.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  class Account::MagicLinkToken < ApplicationRecord
+    include TokenEncryptable
+
+    belongs_to :account, class_name: "Aikotoba::Account", foreign_key: "aikotoba_account_id"
+    validates :token, presence: true
+    validates :expired_at, presence: true
+
+    scope :active, ->(now: Time.current) { where("expired_at >= ?", now) }
+
+    after_initialize do |record|
+      token = Account::Token.new(expiry: Aikotoba.magic_link_token_expiry)
+      record.token ||= token.value
+      record.expired_at ||= token.expired_at
+    end
+
+    # NOTE: Waits for every open transaction (including callers' outer ones) to commit,
+    #       and is dropped on rollback, so a sent link never points at a missing token.
+    def notify
+      ActiveRecord.after_all_transactions_commit do
+        AccountMailer.with(account: account).magic_link.deliver_later
+      end
+    end
+  end
+end

data/app/models/aikotoba/account/{password → password_hash}/argon2.rb

@@ -3,7 +3,7 @@
 require "argon2"
 
 module Aikotoba
-  class Account::Password::Argon2
+  class Account::PasswordHash::Argon2
     def initialize(password:)
       @password = password
     end

data/app/models/aikotoba/account/password_hash.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  class Account::PasswordHash < ApplicationRecord
+    LENGTH_RANGE = Aikotoba.password_length_range
+
+    belongs_to :account, class_name: "Aikotoba::Account", foreign_key: "aikotoba_account_id", inverse_of: :password_hash
+
+    # NOTE: No separate `validates :digest, presence: true`. `digest` only ever ends up
+    #       blank as a direct side effect of `generate` being given a blank input, which
+    #       always fails this same `plaintext` validation at the same time -- a digest
+    #       presence check would only ever fire alongside this one, never independently.
+    #       The DB's `null: false` constraint still guards against `digest` ending up nil
+    #       through some other path.
+    #
+    # NOTE: Deliberately no `on:` restriction (used to be `on: [:create, :recover]`).
+    #       Nested has_one/belongs_to autosave validation uses the parent's context when
+    #       one is explicitly given (e.g. `save!(context: :recover)`), but otherwise
+    #       validates an already-persisted child under its own natural `:update` context
+    #       -- so a scoped `on:` here let `account.password_hash.generate("short");
+    #       account.save` silently skip this validation entirely for any *existing*
+    #       account (only `#recover!`'s explicit `context: :recover` caught it). Running
+    #       unconditionally closes that gap; it's still cheap, because Rails only
+    #       revalidates this record at all when it has pending changes to save (i.e. some
+    #       code actually called `generate`) or a custom context was passed -- an
+    #       untouched, already-persisted password_hash is never re-validated just because
+    #       the parent account is saved for an unrelated reason.
+    validates :plaintext, presence: true, length: {in: LENGTH_RANGE}
+
+    def generate(input, pepper: Aikotoba.password_pepper, algorithm_class: Argon2)
+      @plaintext = input
+      self.digest = input.blank? ? "" : algorithm_class.new(password: with_pepper(input, pepper)).generate_hash
+    end
+
+    def match?(input, pepper: Aikotoba.password_pepper, algorithm_class: Argon2)
+      algorithm_class.new(password: with_pepper(input, pepper)).verify_password?(digest)
+    end
+
+    def recover!(new_value)
+      generate(new_value)
+      save!(context: :recover)
+    end
+
+    class << self
+      def authenticate_by(attributes:, target_type_name: nil)
+        email, password = attributes.values_at(:email, :password)
+        # NOTE: A blank password can never match anything, so there's nothing to guard
+        #       against timing-wise here -- the caller already knows their own input was
+        #       blank, and returning instantly regardless of account state leaks nothing.
+        #       This also means `password` is guaranteed non-blank below, so it's safe to
+        #       use as the dummy digest's seed (see prevent_timing_attack).
+        return nil if password.blank?
+
+        account = Account.find_by_identifier(email, target_type_name: target_type_name)
+
+        matched = if account&.password_hash
+          account.password_hash.match?(password)
+        else
+          # NOTE: Runs whether account is nil (not found) or exists but has no
+          #       password_hash (e.g. a magic-link-only account), so neither case is
+          #       distinguishable from a wrong-password guess by response time.
+          prevent_timing_attack(password)
+          false
+        end
+        return nil unless account
+
+        ActiveRecord::Base.transaction do
+          if matched
+            account.authentication_success!
+          else
+            account.authentication_failed!
+            Account::Lock.lock!(account: account, notify: true) if account.lockable? && account.should_lock?
+          end
+        end
+        matched ? account : nil
+      end
+
+      private
+
+      # NOTE: Seeds the dummy digest from the caller's own (guaranteed non-blank, per the
+      #       guard in authenticate_by) password, so `generate` always pays full Argon2
+      #       cost -- it only takes its blank-input shortcut for blank input, which can't
+      #       reach here.
+      def prevent_timing_attack(password)
+        Account::PasswordHash.new.tap { |password_hash| password_hash.generate(password) }.match?(password)
+      end
+    end
+
+    private
+
+    attr_reader :plaintext
+
+    def with_pepper(input, pepper)
+      "#{input}-#{pepper}"
+    end
+  end
+end

data/app/models/aikotoba/account/recovery.rb

@@ -1,6 +1,15 @@
 # frozen_string_literal: true
 
 module Aikotoba
+  # NOTE: The web-facing shape here (token, controller, routes) is deliberately generic/
+  #       Account-level, mirroring how SessionsController stays generic while delegating
+  #       the actual credential check to Account::PasswordHash.authenticate_by -- a
+  #       recovery token proves ownership of the account/email, which is an account-level
+  #       concept, not a credential-specific one. But the *operation* this class performs
+  #       is still hardcoded to password reset (`new_password:`, `@account.password_hash`)
+  #       -- there's no polymorphism yet for recovering some other future credential type.
+  #       If/when a second auth method needs its own recovery-like flow, revisit whether
+  #       this should generalize or whether that method should own a separate mechanism.
   class Account::Recovery
     def self.create_token!(account:, notify: false)
       new(account: account).create_token!(notify: notify)
@@ -22,10 +31,27 @@ module Aikotoba
     end
 
     def recover!(new_password:)
+      # NOTE: An account can legitimately have no password (e.g. a magic-link-only
+      #       account), so there's nothing to recover. Surface this the same way an
+      #       invalid new_password would be (RecordInvalid -> :password_hash error)
+      #       instead of raising NoMethodError on a nil association.
+      unless @account.password_hash
+        @account.errors.add(:password_hash, :blank)
+        raise ActiveRecord::RecordInvalid, @account
+      end
+
       ActiveRecord::Base.transaction do
-        @account.recover!(new_password: new_password)
+        @account.password_hash.recover!(new_password)
         @account.recovery_token&.destroy!
       end
+    rescue ActiveRecord::RecordInvalid => e
+      raise if e.record == @account
+      # NOTE: e.record here is @account.password_hash, not @account -- its own save!
+      #       failed, so @account.errors is still empty. The controller re-renders using
+      #       @account.errors, so copy the errors over (attribute: :password_hash also
+      #       gives them a clean display label via config/locales/en.yml).
+      e.record.errors.each { |error| @account.errors.import(error, attribute: :password_hash) }
+      raise ActiveRecord::RecordInvalid, @account
     end
   end
 end