authentication-zero 2.16.15 → 2.16.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85fbe83273139a893939d4f20c3a06de269e0cea2b5fe3a7994f8d66919c3532
-  data.tar.gz: 63396f6a2ceb39fc3a49be717a6ffc7097c29e6782b7a351ca0d6f3bb7f2cae6
+  metadata.gz: 99df48ab46b9859695eadb1675580d523f1953a3f211b648b3c752e22598557a
+  data.tar.gz: c9fa8cfc8785c16a3329737b89c43ded33f74b79857e52a32f5e1b00872e388f
 SHA512:
-  metadata.gz: '0899627eceb12252ec843541a19ec9da8de2e0d4ab12e76e43f34e1117597be485f58a090a66f825f2a1fdb1affe5c83cb55502e2deb7a681e2d70e7578ede31'
-  data.tar.gz: 8ee00bb247a6989e0c930b33ffefc5c546f6e2c4161d77297344343ec5585b6c80f5b11dd18cd06937b6264d4abb1d89b9f47d1ab80494201bf5d523cb289f86
+  metadata.gz: 72daf22b87d0960c34885348cdf1c24ae3d67dbc9e34c816ac0d1592fd9e46299776b624383d4d318034edfbcedfa5e894fa65495188afe94aee6b011d3b4281
+  data.tar.gz: 219aa2ebe407eacf4344c462e20aad1abea1389b96b629f6313486821d07f04ea3682e789accaef04fb2bf60365cacb229fddbbafbf8c6e2bb8172ab18195ec7

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Authentication Zero 2.16.16 ##
+
+* Add recovery codes to two factor auth
+
 ## Authentication Zero 2.16.15 ##
 
 * Add sign-in as button functionallity (--masqueradable)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.15)
+    authentication-zero (2.16.16)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -28,12 +28,11 @@ Since Authentication Zero generates this code into your application instead of b
 - Authentication by cookie
 - Authentication by token (--api)
 - Passwordless authentication (--passwordless)
-- Two factor authentication (--two-factor)
+- Two factor authentication + recovery codes (--two-factor)
 - Social Login with OmniAuth (--omniauthable)
 - Send invitations (--invitable)
 - Sign-in as button functionallity (--masqueradable)
 - Verify email using a link with token
-- Verify email using a six random digits code for api (--code-verifiable)
 - Ask password before sensitive data changes, aka: sudo (--sudoable)
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.15"
+  VERSION = "2.16.16"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -3,18 +3,17 @@ require "rails/generators/active_record"
 class AuthenticationGenerator < Rails::Generators::Base
   include ActiveRecord::Generators::Migration
 
-  class_option :api,             type: :boolean, desc: "Generates API authentication"
-  class_option :pwned,           type: :boolean, desc: "Add pwned password validation"
-  class_option :code_verifiable, type: :boolean, desc: "Add email verification using a code for api"
-  class_option :sudoable,        type: :boolean, desc: "Add password request before sensitive data changes"
-  class_option :lockable,        type: :boolean, desc: "Add password reset locking"
-  class_option :ratelimit,       type: :boolean, desc: "Add request rate limiting"
-  class_option :passwordless,    type: :boolean, desc: "Add passwordless sign"
-  class_option :omniauthable,    type: :boolean, desc: "Add social login support"
-  class_option :trackable,       type: :boolean, desc: "Add activity log support"
-  class_option :two_factor,      type: :boolean, desc: "Add two factor authentication"
-  class_option :invitable,       type: :boolean, desc: "Add sending invitations"
-  class_option :masqueradable,   type: :boolean, desc: "Add sign-in as button functionallity"
+  class_option :api,           type: :boolean, desc: "Generates API authentication"
+  class_option :pwned,         type: :boolean, desc: "Add pwned password validation"
+  class_option :sudoable,      type: :boolean, desc: "Add password request before sensitive data changes"
+  class_option :lockable,      type: :boolean, desc: "Add password reset locking"
+  class_option :ratelimit,     type: :boolean, desc: "Add request rate limiting"
+  class_option :passwordless,  type: :boolean, desc: "Add passwordless sign"
+  class_option :omniauthable,  type: :boolean, desc: "Add social login support"
+  class_option :trackable,     type: :boolean, desc: "Add activity log support"
+  class_option :two_factor,    type: :boolean, desc: "Add two factor authentication"
+  class_option :invitable,     type: :boolean, desc: "Add sending invitations"
+  class_option :masqueradable, type: :boolean, desc: "Add sign-in as button functionallity"
 
   source_root File.expand_path("templates", __dir__)
 
@@ -98,9 +97,13 @@ class AuthenticationGenerator < Rails::Generators::Base
 
   def create_views
     if options.api?
-      directory "erb/user_mailer", "app/views/user_mailer"
+      template "erb/user_mailer/email_verification.html.erb", "app/views/user_mailer/email_verification.html.erb"
+      template "erb/user_mailer/password_reset.html.erb", "app/views/user_mailer/password_reset.html.erb"
     else
-      directory "erb/user_mailer", "app/views/user_mailer"
+      template "erb/user_mailer/email_verification.html.erb", "app/views/user_mailer/email_verification.html.erb"
+      template "erb/user_mailer/password_reset.html.erb", "app/views/user_mailer/password_reset.html.erb"
+      template "erb/user_mailer/invitation_instructions.html.erb", "app/views/user_mailer/invitation_instructions.html.erb" if invitable?
+      template "erb/user_mailer/passwordless.html.erb", "app/views/user_mailer/passwordless.html.erb" if passwordless?
 
       directory "erb/home", "app/views/home"
 
@@ -133,6 +136,10 @@ class AuthenticationGenerator < Rails::Generators::Base
       route "resource :sudo, only: [:new, :create]", namespace: :sessions
     end
 
+    if invitable?
+      route "resource :invitation, only: [:new, :create]"
+    end
+
     if passwordless?
       route "resource :passwordless, only: [:new, :edit, :create]", namespace: :sessions
     end
@@ -148,8 +155,9 @@ class AuthenticationGenerator < Rails::Generators::Base
     end
 
     if two_factor?
-      route "resource :totp,      only: [:new, :create]", namespace: :two_factor_authentication
-      route "resource :challenge, only: [:new, :create]", namespace: :two_factor_authentication
+      route "resources :recovery_codes, only: [:index, :create]", namespace: :two_factor_authentication
+      route "resource  :totp,           only: [:new, :create]", namespace: :two_factor_authentication
+      route "resource  :challenge,      only: [:new, :create]", namespace: :two_factor_authentication
     end
 
     if options.trackable?
@@ -160,11 +168,12 @@ class AuthenticationGenerator < Rails::Generators::Base
     route "resource :email_verification, only: [:show, :create]", namespace: :identity
     route "resource :email,              only: [:edit, :update]", namespace: :identity
 
-    route "resource  :invitation, only: [:new, :create]" if invitable?
-    route "resource  :password,   only: [:edit, :update]"
-    route "resources :sessions,   only: [:index, :show, :destroy]"
+    route "resource  :password, only: [:edit, :update]"
+    route "resources :sessions, only: [:index, :show, :destroy]"
+
     route 'post "sign_up", to: "registrations#create"'
     route 'get  "sign_up", to: "registrations#new"' unless options.api?
+
     route 'post "sign_in", to: "sessions#create"'
     route 'get  "sign_in", to: "sessions#new"' unless options.api?
   end
@@ -213,11 +222,7 @@ class AuthenticationGenerator < Rails::Generators::Base
       options.sudoable? && !options.api?
     end
 
-    def code_verifiable?
-      options.code_verifiable? && options.api?
-    end
-
     def redis?
-      options.lockable? || options.ratelimit? || sudoable? || code_verifiable?
+      options.lockable? || options.ratelimit? || sudoable?
     end
 end

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -13,18 +13,8 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-    <%- if code_verifiable? -%>
-      verified_user = User.find_by(email: params[:email])
-
-      if verified_user && verified_user.verification_code.value == params[:token]
-        @user = verified_user
-      else
-        render json: { error: "That email verification code is invalid" }, status: :bad_request
-      end
-    <%- else -%>
       @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       render json: { error: "That email verification link is invalid" }, status: :bad_request
-    <%- end -%>
     end
 end

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -6,6 +6,10 @@ class Identity::PasswordResetsController < ApplicationController
   <%- end -%>
   before_action :set_user, only: :update
 
+  def edit
+    head :no_content
+  end
+
   def create
     if @user = User.find_by(email: params[:email], verified: true)
       UserMailer.with(user: @user).password_reset.deliver_later
@@ -25,7 +29,7 @@ class Identity::PasswordResetsController < ApplicationController
   private
     def set_user
       @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end
 

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -16,7 +16,7 @@ class Identity::EmailVerificationsController < ApplicationController
   private
     def set_user
       @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end
 

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -32,7 +32,7 @@ class Identity::PasswordResetsController < ApplicationController
   private
     def set_user
       @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end
 

data/lib/generators/authentication/templates/controllers/html/sessions/passwordlesses_controller.rb.tt

@@ -28,7 +28,7 @@ class Sessions::PasswordlessesController < ApplicationController
   private
     def set_user
       @token = SignInToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       redirect_to new_sessions_passwordless_path, alert: "That sign in link is invalid"
     end
 

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -16,7 +16,7 @@ class SessionsController < ApplicationController
 
     if user && user.authenticate(params[:password])
       <%- if two_factor? -%>
-      if user.otp_secret
+      if user.otp_secret.present?
         signed_id = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
         redirect_to new_two_factor_authentication_challenge_path(token: signed_id)
       else

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt

@@ -7,22 +7,46 @@ class TwoFactorAuthentication::ChallengesController < ApplicationController
   end
 
   def create
-    @totp = ROTP::TOTP.new(@user.otp_secret, issuer: "YourAppName")
-
-    if @totp.verify(params[:code], drift_behind: 15)
-      session = @user.sessions.create!
-      cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
-
-      redirect_to root_path, notice: "Signed in successfully"
+    if params[:scheme_type] == "recovery_codes"
+      verify_recovery_code
     else
-      redirect_to new_two_factor_authentication_challenge_path(token: params[:token]), alert: "That code didn't work. Please try again"
+      verify_time_based_one_time_password
     end
   end
 
   private
     def set_user
       @user = User.find_signed!(params[:token], purpose: :authentication_challenge)
-    rescue
+    rescue StandardError
       redirect_to sign_in_path, alert: "That's taking too long. Please re-enter your password and try again"
     end
+
+    def verify_recovery_code
+      if recover_code = @user.recovery_codes.find_by(code: params[:code], used: false)
+        recover_code.update!(used: true); sign_in_and_redirect_to_root
+      else
+        redirect_to_authentication_challenge
+      end
+    end
+
+    def verify_time_based_one_time_password
+      @totp = ROTP::TOTP.new(@user.otp_secret, issuer: "YourAppName")
+
+      if @totp.verify(params[:code], drift_behind: 15)
+        sign_in_and_redirect_to_root
+      else
+        redirect_to_authentication_challenge
+      end
+    end
+
+    def sign_in_and_redirect_to_root
+      session = @user.sessions.create!
+      cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
+
+      redirect_to root_path, notice: "Signed in successfully"
+    end
+
+    def redirect_to_authentication_challenge
+      redirect_to new_two_factor_authentication_challenge_path(token: params[:token], scheme_type: params[:scheme_type]), alert: "That code didn't work. Please try again"
+    end
 end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/recovery_codes_controller.rb.tt

@@ -0,0 +1,31 @@
+class TwoFactorAuthentication::RecoveryCodesController < ApplicationController
+  before_action :set_user
+
+  def index
+    if Current.user.recovery_codes.exists?
+      @recovery_codes = @user.recovery_codes
+    else
+      @recovery_codes = @user.recovery_codes.create!(new_recovery_codes)
+    end
+  end
+
+  def create
+    @user.recovery_codes.delete_all
+    @user.recovery_codes.create!(new_recovery_codes)
+
+    redirect_to two_factor_authentication_recovery_codes_path, notice: "Your new recovery codes have been generated"
+  end
+
+  private
+    def set_user
+      @user = Current.user
+    end
+
+    def new_recovery_codes
+      10.times.map { { code: new_recovery_code } }
+    end
+
+    def new_recovery_code
+      SecureRandom.alphanumeric(10).insert(5, "-").downcase
+    end
+end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt

@@ -9,17 +9,18 @@ class TwoFactorAuthentication::TotpsController < ApplicationController
   def create
     if @totp.verify(params[:code], drift_behind: 15)
       @user.update! otp_secret: params[:secret]
-      redirect_to root_path, notice: "2FA is enabled on your account"
+      redirect_to two_factor_authentication_recovery_codes_path
     else
       redirect_to new_two_factor_authentication_totp_path, alert: "That code didn't work. Please try again"
     end
   end
 
-  def set_user
-    @user = Current.user
-  end
+  private
+    def set_user
+      @user = Current.user
+    end
 
-  def set_totp
-    @totp = ROTP::TOTP.new(params[:secret] || ROTP::Base32.random, issuer: "YourAppName")
-  end
+    def set_totp
+      @totp = ROTP::TOTP.new(params[:secret] || ROTP::Base32.random, issuer: "YourAppName")
+    end
 end

data/lib/generators/authentication/templates/erb/home/index.html.erb.tt

@@ -33,6 +33,10 @@
   <div>
     <%%= link_to "Two-Factor Authentication", new_two_factor_authentication_totp_path %>
   </div>
+
+  <%% if Current.user.otp_secret.present? %>
+    <div><%%= link_to "Recovery Codes", two_factor_authentication_recovery_codes_path %></div>
+  <%% end %>
   <%- end -%>
 
   <br>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_recovery_code_form.html.erb.tt

@@ -0,0 +1,19 @@
+<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
+  <%%= form.hidden_field :token, value: params[:token] %>
+  <%%= form.hidden_field :scheme_type, value: "recovery_codes" %>
+
+  <div>
+    <%%= form.label :code do %>
+      <h1>OK, enter one of your recovery codes below:</h1>
+    <%% end %>
+    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.submit "Continue" %>
+  </div>
+<%% end %>
+
+<div>
+  <p>To access your account, enter one of the recovery codes (e.g., XXXXX-XXXXX) you saved when you set up your two-factor authentication device.</p>
+</div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_totp_form.html.erb.tt

@@ -0,0 +1,20 @@
+<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
+  <%%= form.hidden_field :token, value: params[:token] %>
+  <%%= form.hidden_field :scheme_type, value: "totp" %>
+
+  <div>
+    <%%= form.label :code do %>
+      <h1>Next, open the 2FA authenticator app on your phone and type the six digit code below:</h1>
+    <%% end %>
+    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.submit "Verify" %>
+  </div>
+<%% end %>
+
+<div>
+  <p><strong>Don't have your phone?</strong></p>
+  <%%= link_to "Use a recovery code to access your account.", new_two_factor_authentication_challenge_path(token: params[:token], scheme_type: "recovery_codes") %>
+</div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt

@@ -1,16 +1,7 @@
 <p style="color: red"><%%= alert %></p>
 
-<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
-  <%%= form.hidden_field :token, value: params[:token] %>
-
-  <div>
-    <%%= form.label :code do %>
-      <h1>Next, open the 2FA authenticator app on your phone and type the six digit code below:</h1>
-    <%% end %>
-    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
-  </div>
-
-  <div>
-    <%%= form.submit "Verify" %>
-  </div>
+<%% if params[:scheme_type] == "recovery_codes" %>
+  <%%= render "recovery_code_form" %>
+<%% else %>
+  <%%= render "totp_form" %>
 <%% end %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/_recovery_code.html.erb.tt

@@ -0,0 +1,5 @@
+<%% if recovery_code.used? %>
+  <li><del><%%= recovery_code.code %></del></li>
+<%% else %>
+  <li><%%= recovery_code.code %></li>
+<%% end %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/index.html.erb.tt

@@ -0,0 +1,16 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Two-factor recovery codes</h1>
+<p>Recovery codes provide a way to log in if you lose your phone (or don't have it with you). Save these and keep them somewhere safe.</p>
+
+<ul><%%= render @recovery_codes %></ul>
+
+<%%= link_to "OK, I'm done", root_path %>
+
+<hr>
+
+<h2>Need new recovery codes?</h2>
+
+<p>If you think your codes have fallen into the wrong hands, you can get a new set. Be sure to save the new ones because the old codes will stop working.</p>
+
+<%%= button_to "Generate new recovery codes", two_factor_authentication_recovery_codes_path %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt

@@ -10,8 +10,8 @@
 <p>Next, open the authenticator app, tap "Scan QR code" or "+", and, when it asks, point your phone's camera at this QR code picture below.</p>
 
 <figure>
-    <%%= image_tag @qr_code.as_png(resize_exactly_to: 200).to_data_url%>
-    <figcaption>Point your camera here</figcaption>
+  <%%= image_tag @qr_code.as_png(resize_exactly_to: 200).to_data_url%>
+  <figcaption>Point your camera here</figcaption>
 </figure>
 
 <%%= form_with(url: two_factor_authentication_totp_path) do |form| %>

data/lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt

@@ -2,13 +2,9 @@
 
 <p>This is to confirm that <%%= @user.email %> is the email you want to use on your account. If you ever lose your password, that's where we'll email a reset link.</p>
 
-<p><strong>You must <%= code_verifiable? ? "put the code" : "hit the link" %> below to confirm that you received this email.</strong></p>
+<p><strong>You must hit the link below to confirm that you received this email.</strong></p>
 
-<%- if code_verifiable? -%>
-<strong><%%= @user.verification_code.value %></strong>
-<%- else -%>
 <%%= link_to "Yes, use this email for my account", identity_email_verification_url(sid: @signed_id) %>
-<%- end -%>
 
 <hr>
 

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -8,11 +8,7 @@ class UserMailer < ApplicationMailer
 
   def email_verification
     @user = params[:user]
-    <%- if code_verifiable? -%>
-    @user.verification_code.value = rand.to_s[2..7]
-    <%- else -%>
     @signed_id = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
-    <%- end -%>
 
     mail to: @user.email, subject: "Verify your email"
   end

data/lib/generators/authentication/templates/migrations/create_recovery_codes_migration.rb.tt

@@ -0,0 +1,11 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :recovery_codes do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string  :code, null: false
+      t.boolean :used, null: false, default: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authentication/templates/models/recovery_code.rb.tt

@@ -0,0 +1,3 @@
+class RecoveryCode < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -3,6 +3,9 @@ class User < ApplicationRecord
 
   has_many :email_verification_tokens, dependent: :destroy
   has_many :password_reset_tokens, dependent: :destroy
+  <%- if two_factor? -%>
+  has_many :recovery_codes, dependent: :destroy
+  <%- end -%>
   <%- if passwordless? -%>
   has_many :sign_in_tokens, dependent: :destroy
   <%- end -%>
@@ -11,9 +14,6 @@ class User < ApplicationRecord
   <%- if options.trackable? -%>
   has_many :events, dependent: :destroy
   <%- end -%>
-  <%- if code_verifiable? %>
-  kredis_string :verification_code, expires_in: 2.days
-  <%- end -%>
 
   validates :email, presence: true, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }
   validates :password, allow_nil: true, length: { minimum: 12 }
@@ -30,7 +30,7 @@ class User < ApplicationRecord
   end
 
   after_update if: :password_digest_previously_changed? do
-    sessions.where.not(id: Current.session).destroy_all
+    sessions.where.not(id: Current.session).delete_all
   end
   <%- if options.trackable? %>
   after_update if: :email_previously_changed? do

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -5,6 +5,13 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
     @user = users(:lazaro_nixon)
   end
 
+  test "should get edit" do
+    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+
+    get edit_identity_password_reset_url(sid: sid)
+    assert_response :no_content
+  end
+
   test "should send a password reset email" do
     assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.15
+  version: 2.16.16
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-06 00:00:00.000000000 Z
+date: 2023-04-07 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -60,6 +60,7 @@ files:
 - lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt
+- lib/generators/authentication/templates/controllers/html/two_factor_authentication/recovery_codes_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt
 - lib/generators/authentication/templates/erb/authentications/events/index.html.erb.tt
 - lib/generators/authentication/templates/erb/home/index.html.erb.tt
@@ -73,7 +74,11 @@ files:
 - lib/generators/authentication/templates/erb/sessions/new.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/passwordlesses/new.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_recovery_code_form.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_totp_form.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/_recovery_code.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/index.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt
 - lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt
 - lib/generators/authentication/templates/erb/user_mailer/invitation_instructions.html.erb.tt
@@ -83,6 +88,7 @@ files:
 - lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt
+- lib/generators/authentication/templates/migrations/create_recovery_codes_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sign_in_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_users_migration.rb.tt
@@ -90,6 +96,7 @@ files:
 - lib/generators/authentication/templates/models/email_verification_token.rb.tt
 - lib/generators/authentication/templates/models/event.rb.tt
 - lib/generators/authentication/templates/models/password_reset_token.rb.tt
+- lib/generators/authentication/templates/models/recovery_code.rb.tt
 - lib/generators/authentication/templates/models/session.rb.tt
 - lib/generators/authentication/templates/models/sign_in_token.rb.tt
 - lib/generators/authentication/templates/models/user.rb.tt