authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/controllers/users/multi_factor_authentication/challenge/sms_controller.rb.tt

@@ -0,0 +1,45 @@
+class <%= identity.module_name %>::MultiFactorAuthentication::Challenge::SmsController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sms_second_factor, only: :create,
+    with: -> { redirect_to new_<%= identity.route_scope %>_mfa_challenge_sms_path, alert: "Too many codes requested. Please try again later." })
+  before_action :set_user
+  before_action :require_sms_enrolled
+
+  def new
+    @user.issue_sms_challenge unless @user.sms_challenge?
+  end
+
+  def create
+    @user.issue_sms_challenge
+
+    redirect_to new_<%= identity.route_scope %>_mfa_challenge_sms_path, notice: "We sent you another code."
+  end
+
+  def update
+    unless @user.verify_sms_challenge(params[:code])
+      flash.now[:alert] = "That code is incorrect or has expired."
+      return render :new, status: :unprocessable_entity
+    end
+
+<%- if rememberable? -%>
+    start_new_session_for(@user, via: :second_factor, remember: session.delete(:<%= session_key(:remember_me) %>))
+<%- else -%>
+    start_new_session_for(@user, via: :second_factor)
+<%- end -%>
+    redirect_to after_authentication_url, status: :see_other
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.class_name %>.find_by_token_for!(:authentication_challenge, session[:<%= session_key(:challenge_token) %>])
+  rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Your sign-in challenge has expired. Please sign in again."
+  end
+
+  def require_sms_enrolled
+    return if @user.sms_enrolled_at?
+
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Please sign in again."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/multi_factor_authentication/challenge/totps_controller.rb.tt

@@ -0,0 +1,42 @@
+class <%= identity.module_name %>::MultiFactorAuthentication::Challenge::TotpsController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.totp_challenge, only: :create,
+    with: -> { redirect_to new_<%= identity.route_scope %>_mfa_challenge_totp_path, alert: "Too many attempts. Please try again later." })
+  before_action :set_user
+  before_action :require_totp_enrolled
+
+  def new
+  end
+
+  def create
+    totp = ROTP::TOTP.new(@user.totp_secret, issuer: <%= identity.config_reference %>.app_name)
+    used_at = totp.verify(params[:code], drift_behind: <%= identity.config_reference %>.second_factor.totp_drift_behind,
+      after: @user.totp_last_used_at)
+
+    if used_at
+      @user.update!(totp_last_used_at: Time.at(used_at))
+<%- if rememberable? -%>
+      start_new_session_for(@user, via: :second_factor, remember: session.delete(:<%= session_key(:remember_me) %>))
+<%- else -%>
+      start_new_session_for(@user, via: :second_factor)
+<%- end -%>
+      redirect_to after_authentication_url, status: :see_other
+    else
+      redirect_to new_<%= identity.route_scope %>_mfa_challenge_totp_path, alert: "That code is incorrect."
+    end
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.class_name %>.find_by_token_for!(:authentication_challenge, session[:<%= session_key(:challenge_token) %>])
+  rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Your sign-in challenge has expired. Please sign in again."
+  end
+
+  def require_totp_enrolled
+    return if @user.totp_enrolled_at?
+
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Please sign in again."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/omniauth/registrations_controller.rb.tt

@@ -0,0 +1,26 @@
+class <%= identity.module_name %>::Omniauth::RegistrationsController < <%= identity.controller_superclass %>
+  include <%= identity.authentication_concern %>::Registering
+
+  require_unauthenticated_access
+  before_action :set_registration
+
+  def new
+  end
+
+  def create
+    return render :new, status: :unprocessable_entity unless @registration.update(profile_params)
+
+    advance(@registration)
+  end
+
+  private
+
+  def set_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "That took too long. Please sign in again." unless @registration&.provider
+  end
+
+  def profile_params
+    params.permit(<%= omniauth_registration_permits %>)
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/omniauth_controller.rb.tt

@@ -0,0 +1,139 @@
+class <%= identity.module_name %>::OmniauthController < <%= identity.controller_superclass %>
+<%- if pending_registration_holds_provider? -%>
+  include <%= identity.authentication_concern %>::Registering
+
+<%- end -%>
+  allow_unauthenticated_access
+  skip_before_action :verify_authenticity_token
+
+  def create
+    identity = <%= identity.omniauth_identity_class %>.find_by(provider: omniauth.provider, uid: omniauth.uid)
+
+    return link_identity(identity) if authenticated?
+    return sign_in(identity) if identity
+<%- if pre_account_provider_enrollment? -%>
+    return complete_pending_registration if request.env.dig("omniauth.params", "registration_intent")
+<%- end -%>
+
+    register
+  end
+
+  def failure
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: params[:message]
+  end
+
+  private
+
+  def sign_in(identity)
+    user = identity.<%= identity.singular %>
+    <%= sign_in_call("user", via: "identity.via") %>
+    redirect_to after_authentication_url, status: :see_other
+  end
+<%- if pre_account_provider_enrollment? -%>
+
+  def complete_pending_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    unless @registration
+      return redirect_to <%= identity.route_scope %>_sign_up_path, alert: "That sign-up has expired. Please start again."
+    end
+
+    @registration.update!(provider: omniauth.provider, uid: omniauth.uid)
+    advance(@registration)
+  end
+
+  def render_invalid_registration
+    redirect_to <%= credential_enrollment_path %>, alert: @registration.errors.full_messages.to_sentence
+  end
+<%- end -%>
+
+  def link_identity(existing)
+    if existing && existing.<%= identity.foreign_key %> != <%= identity.current_class %>.user.id
+      return redirect_to <%= identity.settings_helper_prefix %>_omniauth_identities_path,
+        alert: "That #{provider_name} account is already linked to another account."
+    end
+
+    if existing
+      return redirect_to <%= identity.settings_helper_prefix %>_omniauth_identities_path,
+        notice: "That account is already linked."
+    end
+
+    <%= identity.current_class %>.user.omniauth_identities.create!(provider: omniauth.provider, uid: omniauth.uid)
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:connected_account_linked)
+<%- end -%>
+    redirect_to <%= identity.settings_helper_prefix %>_omniauth_identities_path, notice: "Linked.", status: :see_other
+  end
+
+<%- if email_verifiable? -%>
+  # A provider's email address is taken as verified. Nothing reverifies it.
+<%- end -%>
+  def register
+<%- if principals.email&.required? -%>
+    return redirect_to <%= identity.route_scope %>_sign_in_path, alert: no_address_alert if omniauth.info.email.blank?
+
+<%- end -%>
+<%- if invite_only? -%>
+    unless pending_invitation_for(omniauth.info.email)
+      return redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Registration is invite-only."
+    end
+
+<%- end -%>
+<%- if omniauth_registration? -%>
+    registration = <%= identity.pending_registration_class %>.new(provider: omniauth.provider, uid: omniauth.uid<%= ", email: omniauth.info.email" if principals.email %>)
+<%- if email_verifiable? -%>
+    registration.email_verified_at = Time.current if registration.email.present?
+<%- end -%>
+<%- if invitable? -%>
+    registration.invitation = pending_invitation_for(omniauth.info.email)
+<%- end -%>
+    registration.save!(validate: false)
+    session[:<%= pending_registration_session_key %>] = registration.id
+
+    advance(registration)
+<%- else -%>
+    # Do not look up an account by the provider-reported email: it is a claim and could link an attacker to another account.
+    user = <%= identity.class_name %>.new<%= "(email: omniauth.info.email)" if principals.email %>
+    user.omniauth_identities.build(provider: omniauth.provider, uid: omniauth.uid)
+
+    case save_account(user)
+    when :ok
+<%- if invitable? -%>
+      pending_invitation_for(omniauth.info.email)&.accept(user)
+<%- end -%>
+      <%= sign_in_call("user", via: "provider_via") %>
+      redirect_to after_authentication_url, status: :see_other
+    when :taken
+      redirect_to <%= identity.route_scope %>_sign_in_path, alert: taken_alert
+    else
+      redirect_to <%= identity.route_scope %>_sign_in_path, alert: no_address_alert
+    end
+<%- end -%>
+  end
+<%- if !omniauth_registration? -%>
+
+  def save_account(user)
+    return :ok if user.save
+
+    user.errors.of_kind?(:email, :taken) ? :taken : :invalid
+  rescue ActiveRecord::RecordNotUnique
+    :taken
+  end
+
+  def taken_alert
+    "An account already uses that email address. Sign in, then link #{provider_name} from your settings."
+  end
+<%- end -%>
+<%- if !omniauth_registration? || principals.email&.required? -%>
+
+  def no_address_alert
+    "That provider didn't share an email address, try signing up another way."
+  end
+<%- end -%>
+
+  def provider_via = <%= identity.omniauth_identity_class %>.via(omniauth.provider)
+  def provider_name = provider_via.to_s.titleize
+
+  def omniauth
+    request.env["omniauth.auth"]
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/passkeys/sessions_controller.rb.tt

@@ -0,0 +1,18 @@
+class <%= identity.module_name %>::Passkeys::SessionsController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+
+  def new
+    # Omit an allow-list so discoverable passkeys can identify their owner; require user verification because this is passwordless sign-in.
+    issue_webauthn_challenge(WebAuthn::Credential.options_for_get(user_verification: "required"))
+  end
+
+  def create
+    passkey = verify_webauthn_assertion(params.expect(credential: {}), from: <%= identity.webauthn_credential_class %><%= ".passkeys" if passkey_and_security_keys? %>)
+    user = passkey.<%= identity.singular %>
+
+    <%= sign_in_call("user", via: :passkey) %>
+    render json: { status: "ok", location: after_authentication_url }, status: :created
+  rescue WebAuthn::Error, ActiveRecord::RecordNotFound
+    render json: { error: "We couldn't verify that passkey. Please try again." }, status: :unprocessable_entity
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/password_resets_controller.rb.tt

@@ -0,0 +1,64 @@
+class <%= identity.module_name %>::PasswordResetsController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.password_reset, only: :create,
+    with: -> { redirect_to root_path, alert: "Too many reset links requested. Please try again later." })
+  before_action :set_user, only: %i[edit update]
+
+  def new
+  end
+
+  def edit
+  end
+
+  def create
+<%- if captchable? -%>
+    unless captcha_verified?
+      flash.now[:alert] = "Captcha verification failed. Please try again."
+      return render :new, status: :unprocessable_entity
+    end
+
+<%- end -%>
+<%- if coy? -%>
+    <%= deferred_call(identity.class_name, :request_password_reset, "params[:email].to_s") %>
+    redirect_to <%= identity.route_scope %>_sign_in_path, notice: "Check your email for password reset instructions."
+<%- else -%>
+    if <%= identity.class_name %>.request_password_reset(params[:email])
+      redirect_to <%= identity.route_scope %>_sign_in_path, notice: "Check your email for password reset instructions."
+    else
+      redirect_to <%= identity.route_scope %>_forgot_password_path, alert: "No<%= email_verifiable? ? " verified" : "" %> account was found for that email."
+    end
+<%- end -%>
+  end
+
+  def update
+    if @user.update(user_params)
+<%- if deadboltable? -%>
+      @user.undeadbolt!
+<%- end -%>
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:password_reset, to: @user.email)
+<%- end -%>
+      redirect_to <%= identity.route_scope %>_sign_in_path, notice: "Your password has been reset. Please sign in.",
+        status: :see_other
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.class_name %>.find_by_token_for(:password_reset, params.expect(:sid))
+
+    redirect_to_rejection unless @user
+  end
+
+  def redirect_to_rejection
+    redirect_to <%= identity.route_scope %>_forgot_password_path, alert: "That password reset link is invalid or has expired.",
+      status: :see_other
+  end
+
+  def user_params
+    params.permit(:password, :password_confirmation)
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/registrations/email_verifications_controller.rb.tt

@@ -0,0 +1,53 @@
+class <%= identity.module_name %>::Registrations::EmailVerificationsController < <%= identity.controller_superclass %>
+  include <%= identity.authentication_concern %>::Registering
+
+  allow_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.email_verification, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_new_verify_email_path, alert: "Too many links requested. Please try again later." })
+  before_action :set_pending_registration, only: [ :new, :create ]
+  before_action :set_claimed_registration, only: [ :show, :update ]
+
+  def new
+  end
+
+  def create
+    <%= deferred_call("@registration", :request_email_verification) %>
+    redirect_to <%= identity.route_scope %>_new_verify_email_path, notice: "We sent you another link."
+  end
+
+  def show
+  end
+
+  def update
+<%- if principals.username -%>
+    @registration.username = params[:username] if params[:username]
+<%- end -%>
+    @registration.email_verified_at = Time.current
+    return render :show, status: :unprocessable_entity unless @registration.save
+
+    advance(@registration)
+  end
+
+  private
+
+  def set_pending_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    redirect_to <%= registration_entry_path %> unless @registration
+  end
+
+  def set_claimed_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by_token_for(
+      :registration_email_verification, params.expect(:sid)
+    )
+
+    redirect_to_rejection unless @registration && session[:<%= pending_registration_session_key %>] == @registration.id
+  end
+
+  def render_invalid_registration
+    render :show, status: :unprocessable_entity
+  end
+
+  def redirect_to_rejection
+    redirect_to <%= registration_entry_path %>, alert: "That confirmation link is invalid or has expired."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/registrations/phone_verifications_controller.rb.tt

@@ -0,0 +1,37 @@
+class <%= identity.module_name %>::Registrations::PhoneVerificationsController < <%= identity.controller_superclass %>
+  include <%= identity.authentication_concern %>::Registering
+
+  allow_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.phone_verification, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_verify_phone_path, alert: "Too many codes requested. Please try again later." })
+  before_action :set_pending_registration
+
+  def new
+  end
+
+  def create
+    <%= deferred_call("@registration", :request_phone_verification) %>
+    redirect_to <%= identity.route_scope %>_verify_phone_path, notice: "We sent you another code."
+  end
+
+  def update
+<%- if principals.username -%>
+    @registration.username = params[:username] if params[:username]
+    return render :new, status: :unprocessable_entity unless @registration.valid?
+<%- end -%>
+    unless @registration.verify_sms_challenge(params[:code])
+      flash.now[:alert] = "That code is incorrect or has expired."
+      return render :new, status: :unprocessable_entity
+    end
+
+    @registration.update!(phone_verified_at: Time.current)
+    advance(@registration)
+  end
+
+  private
+
+  def set_pending_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    redirect_to <%= registration_entry_path %> unless @registration
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/registrations_controller.rb.tt

@@ -0,0 +1,112 @@
+class <%= identity.module_name %>::RegistrationsController < <%= identity.controller_superclass %>
+<%- if typed_staged_registration? -%>
+  include <%= identity.authentication_concern %>::Registering
+
+<%- end -%>
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sign_up, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_sign_up_path, alert: "Too many sign-up attempts. Please try again later." })
+<%- if invite_only? -%>
+  before_action :require_invitation_to_register
+<%- end -%>
+
+  def new
+<%- if invitable? -%>
+    @pending_invitation = pending_invitation
+<%- end -%>
+<%- if typed_staged_registration? -%>
+    @registration = <%= identity.pending_registration_class %>.new
+<%- else -%>
+    @user = <%= identity.class_name %>.new
+<%- end -%>
+  end
+
+<%- if typed_staged_registration? -%>
+  def create
+    @registration = <%= identity.pending_registration_class %>.new(registration_params)
+<%- if captchable? -%>
+    @registration.validate
+    @registration.errors.add(:base, "Captcha verification failed. Please try again.") unless captcha_verified?
+    return render :new, status: :unprocessable_entity if @registration.errors.any?
+<%- else -%>
+    return render :new, status: :unprocessable_entity unless @registration.valid?
+<%- end -%>
+<%- if !coy? -%>
+
+    if (taken = taken_identifier)
+      @registration.errors.add(taken, "has already been taken")
+      return render :new, status: :unprocessable_entity
+    end
+<%- end -%>
+
+    @registration.save!
+    session[:<%= pending_registration_session_key %>] = @registration.id
+
+    advance(@registration)
+  end
+
+  private
+<%- if !coy? -%>
+
+  def taken_identifier
+<%- if principals.email -%>
+    return :email if @registration.email.present? && <%= identity.class_name %>.exists?(email: @registration.email)
+<%- end -%>
+<%- if principals.phone -%>
+    return :phone if @registration.phone.present? && <%= identity.class_name %>.exists?(phone: @registration.phone)
+<%- end -%>
+
+    nil
+  end
+<%- end -%>
+
+  def registration_params
+    <%= sign_up_params_expression %>
+  end
+<%- else -%>
+  def create
+    @user = <%= identity.class_name %>.new(user_params)
+<%- if captchable? -%>
+    @user.validate
+    @user.errors.add(:base, "Captcha verification failed. Please try again.") unless captcha_verified?
+    return render :new, status: :unprocessable_entity if @user.errors.any?
+<%- else -%>
+    return render :new, status: :unprocessable_entity unless @user.valid?
+<%- end -%>
+
+    if @user.save
+<%- if invitable? -%>
+      pending_invitation&.accept(@user)
+<%- end -%>
+      <%= sign_in_call("@user", via: :registration, may_challenge: false) %>
+      redirect_to after_authentication_url, status: :see_other
+    else
+      render :new, status: :unprocessable_entity
+    end
+  rescue ActiveRecord::RecordNotUnique
+<%- if principals.email -%>
+    @user.errors.add(:email, "has already been taken")
+<%- elsif principals.phone -%>
+    @user.errors.add(:phone, "has already been taken")
+<%- else -%>
+    @user.errors.add(:base, "That account already exists")
+<%- end -%>
+    render :new, status: :unprocessable_entity
+  end
+
+  private
+
+  def user_params
+    <%= sign_up_params_expression %>
+  end
+<%- end -%>
+<%- if invitable? -%>
+
+  def with_invitation(permitted)
+    invitation = pending_invitation
+    return permitted unless invitation
+
+    permitted.merge(<%= invitation_channel_pair %><%= ", invitation:" if typed_staged_registration? %>)
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/users/sessions_controller.rb.tt

@@ -0,0 +1,52 @@
+class <%= identity.module_name %>::SessionsController < <%= identity.controller_superclass %>
+  require_unauthenticated_access except: [ :destroy ]
+<%- if impeded? -%>
+  skip_impediments only: :destroy
+<%- end -%>
+<%- if password? -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sign_in, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Too many sign-in attempts. Please try again later." })
+<%- end -%>
+
+  def new
+  end
+
+<%- if password? -%>
+  def create
+<%- if multi_login? -%>
+    identifier = params[:login].to_s.strip
+
+<%- end -%>
+<%- if captchable? -%>
+    unless captcha_verified?
+      return redirect_to <%= identity.route_scope %>_sign_in_path(<%= login_hint_param %>: <%= login_identifier_expr %>),
+        alert: "Captcha verification failed. Please try again."
+    end
+
+<%- end -%>
+    user = <%= identity.class_name %>.authenticate_with_password(<%= login_identifier_expr %>, params[:password])
+
+    unless user
+<%- if deadboltable? -%>
+      <%= failed_sign_in_lookup %>
+      return redirect_to <%= identity.route_scope %>_sign_in_path(<%= login_hint_param %>: <%= login_identifier_expr %>),
+        alert: <%= failed_sign_in_alert %>
+<%- else -%>
+      return redirect_to <%= identity.route_scope %>_sign_in_path(<%= login_hint_param %>: <%= login_identifier_expr %>), alert: "<%= incorrect_login_message %>."
+<%- end -%>
+    end
+<%- if deadboltable? -%>
+
+    user.reset_failed_attempts!
+<%- end -%>
+
+    <%= sign_in_call("user", via: :password, remember_expr: 'params[:remember_me] == "1"') %>
+    redirect_to after_authentication_url, status: :see_other
+  end
+
+<%- end -%>
+  def destroy
+    terminate_current_session
+    redirect_to root_url, notice: "Signed out.", status: :see_other
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/sms_sessions_controller.rb.tt

@@ -0,0 +1,53 @@
+class <%= identity.module_name %>::SmsSessionsController < <%= identity.controller_superclass %>
+  allow_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sms_sign_in, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_sms_sign_in_path, alert: "Too many codes requested. Please try again later." })
+  before_action :set_pending_user, only: [ :edit, :update ]
+
+  SESSION_KEY = :pending_sms_sign_in
+
+  def new
+  end
+
+  def create
+<%- if captchable? -%>
+    unless captcha_verified?
+      flash.now[:alert] = "Captcha verification failed. Please try again."
+      return render :new, status: :unprocessable_entity
+    end
+
+<%- end -%>
+<%- if coy? -%>
+    <%= deferred_call(identity.class_name, :issue_sms_sign_in_code, "params[:phone].to_s") %>
+    session[SESSION_KEY] = params[:phone].to_s
+    redirect_to <%= identity.route_scope %>_sms_sign_in_code_path, notice: "We sent a code if that number has an account."
+<%- else -%>
+    unless <%= identity.class_name %>.issue_sms_sign_in_code(params[:phone])
+      return redirect_to <%= identity.route_scope %>_sms_sign_in_path, alert: "No account was found for that number."
+    end
+
+    session[SESSION_KEY] = params[:phone].to_s
+    redirect_to <%= identity.route_scope %>_sms_sign_in_code_path, notice: "We sent a code to that number."
+<%- end -%>
+  end
+
+  def edit
+  end
+
+  def update
+    unless (@user || <%= identity.class_name %>.new).verify_sms_challenge(params[:code])
+      flash.now[:alert] = "That code is incorrect or has expired."
+      return render :edit, status: :unprocessable_entity
+    end
+
+    session.delete(SESSION_KEY)
+    <%= sign_in_call("@user", via: :sms_code) %>
+    redirect_to after_authentication_url, status: :see_other
+  end
+
+  private
+
+  def set_pending_user
+    @user = <%= identity.class_name %>.find_by(phone: session[SESSION_KEY])
+  end
+end