authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/controllers/users/sudos_controller.rb.tt

@@ -0,0 +1,42 @@
+class <%= identity.module_name %>::SudosController < <%= identity.controller_superclass %>
+<%- if impeded? -%>
+  skip_impediments
+
+<%- end -%>
+  def new
+<%- if fail_open_sudo? -%>
+    <%= "return " if sudo_bars.include?(:webauthn) %>redirect_to(sudo_proceed_url) if sudo_strategy == :open
+<%- end -%>
+<%- if sudo_bars.include?(:webauthn) -%>
+<%- if fail_open_sudo? -%>
+
+<%- end -%>
+    respond_to do |format|
+      format.html
+      format.json do
+        issue_webauthn_challenge(WebAuthn::Credential.options_for_get(
+<%- if passkey? -%>
+          user_verification: "<%= passkey_and_security_keys? ? "preferred" : "required" %>",
+<%- end -%>
+          allow: <%= sudo_subject %>.webauthn_credentials.pluck(:external_id)
+        ))
+      end
+    end
+<%- end -%>
+  end
+
+  def create
+    if sudo_confirmed?
+      redirect_to sudo_proceed_url
+    else
+      redirect_to new_<%= identity.route_scope %>_sudo_path, alert: "That didn't match. Please try again."
+    end
+  end
+
+  private
+
+  def sudo_proceed_url
+    session.delete(:<%= session_key(:sudo_message) %>)
+    session.delete(:<%= session_key(:sudo_proceed_to) %>).presence || <%= identity.settings_helper_prefix %>_url
+  end
+end

data/lib/generators/authnz_eleven/templates/erb/admin/dashboard/index.html.erb.tt

@@ -0,0 +1,9 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Admin</h1>
+
+<p>
+  <%%= link_to "Users", <%= admin_helper("users_path") %> %> |
+  <%%= link_to "Sessions", <%= admin_helper("sessions_path") %> %>
+</p>

data/lib/generators/authnz_eleven/templates/erb/admin/sessions/index.html.erb.tt

@@ -0,0 +1,27 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Sessions</h1>
+
+<%% if @filtered_user %>
+  <p>Filtered to <%%= @filtered_user.<%= principals.display.column %> %>. <%%= link_to "Clear", <%= admin_helper("sessions_path") %> %></p>
+<%% end %>
+
+<table>
+  <thead>
+    <tr><th>User</th><%- if session_carries_team? -%><th>Team</th><%- end -%><th>Via</th><th>IP</th><th>Created</th><th></th></tr>
+  </thead>
+  <tbody>
+    <%% @sessions.each do |session| %>
+      <tr>
+        <td><%%= link_to session.<%= identity.singular %>.<%= principals.display.column %>, <%= admin_helper("user_path") %>(session.<%= identity.singular %>) %></td>
+<%- if session_carries_team? -%>
+        <td><%%= session.team&.name %></td>
+<%- end -%>
+        <td><%%= session.via&.humanize %></td>
+        <td><%%= session.ip_address %></td>
+        <td><%%= session.created_at %></td>
+        <td><%%= button_to "End", <%= admin_helper("session_path") %>(session), method: :delete %></td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>

data/lib/generators/authnz_eleven/templates/erb/admin/users/index.html.erb.tt

@@ -0,0 +1,32 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Users</h1>
+
+<table>
+  <thead>
+    <tr><th><%= principals.display.label %></th><th>Admin</th><%- if deadboltable? -%><th>Deadbolted</th><%- end -%><%- if bannable? -%><th>Suspended</th><%- end -%><th></th></tr>
+  </thead>
+  <tbody>
+    <%% @users.each do |user| %>
+      <tr>
+        <td><%%= link_to user.<%= principals.display.column %>, <%= admin_helper("user_path") %>(user) %></td>
+        <td><%%= user.admin? %></td>
+<%- if deadboltable? -%>
+        <td><%%= user.deadbolted? %></td>
+<%- end -%>
+<%- if bannable? -%>
+        <td><%%= user.banned? %></td>
+<%- end -%>
+        <td>
+          <%% unless user.admin? %>
+<%- if impersonatable? -%>
+            <%%= button_to "Impersonate", <%= admin_helper("impersonate_user_path") %>(user), method: :post %>
+<%- end -%>
+            <%%= button_to "Delete", <%= admin_helper("user_path") %>(user), method: :delete,
+                  data: {turbo_confirm: "Delete #{user.<%= principals.display.column %>}?"} %>
+          <%% end %>
+        </td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>

data/lib/generators/authnz_eleven/templates/erb/admin/users/show.html.erb.tt

@@ -0,0 +1,70 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1><%%= @user.<%= principals.display.column %> %></h1>
+<p>Admin: <%%= @user.admin? %></p>
+<%- if second_factor? -%>
+<p>
+  Second factor: <%%= @user.second_factor_enrolled? %>
+  <%% if @user.second_factor_enrolled? && !@user.admin? %>
+    <%%= button_to "Reset second factor", reset_second_factor_<%= admin_helper("user_path") %>(@user), method: :post,
+          data: {turbo_confirm: "Clear every second factor on #{@user.<%= principals.display.column %>}'s account? Their recovery codes go too."} %>
+  <%% end %>
+</p>
+<%- end -%>
+<%- if deadboltable? -%>
+<p>
+  Password deadbolted: <%%= @user.deadbolted? %>
+  <%% if @user.deadbolted? %>
+    <%%= button_to "Clear deadbolt", undeadbolt_<%= admin_helper("user_path") %>(@user), method: :post %>
+  <%% end %>
+</p>
+<%- end -%>
+<%- if bannable? -%>
+<p>
+  Suspended: <%%= @user.banned? %>
+  <%% if @user.banned? %>
+    <%%= button_to "Lift suspension", unban_<%= admin_helper("user_path") %>(@user), method: :post %>
+  <%% elsif !@user.admin? %>
+    <%%= button_to "Suspend", ban_<%= admin_helper("user_path") %>(@user), method: :post,
+          data: {turbo_confirm: "Suspend #{@user.<%= principals.display.column %>}? This ends all their sessions."} %>
+  <%% end %>
+</p>
+<%- end -%>
+
+<h2>Sessions</h2>
+<%%= button_to "End all sessions", sessions_<%= admin_helper("user_path") %>(@user), method: :delete %>
+<table>
+  <thead>
+    <tr><th>Device</th><th>IP</th><th>Created</th><th></th></tr>
+  </thead>
+  <tbody>
+    <%% @sessions.each do |session| %>
+      <tr>
+        <td><%%= session.user_agent %></td>
+        <td><%%= session.ip_address %></td>
+        <td><%%= session.created_at %></td>
+        <td><%%= button_to "End", <%= admin_helper("session_path") %>(session), method: :delete %></td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>
+<%- if trackable? -%>
+
+<h2>Recent activity</h2>
+<table>
+  <thead>
+    <tr><th>When</th><th>Event</th><th>IP</th></tr>
+  </thead>
+  <tbody>
+    <%% @events.each do |event| %>
+      <tr>
+        <td><%%= event.occurred_at %></td>
+        <td><%%= event.event_type %></td>
+        <td><%%= event.ip_address %></td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>
+<%- end -%>
+
+<p><%%= link_to "Back to users", <%= admin_helper("users_path") %> %></p>

data/lib/generators/authnz_eleven/templates/erb/invitations/show.html.erb.tt

@@ -0,0 +1,9 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Accept your invitation</h1>
+
+<p>You were invited as <%%= @invitation.sent_to %>.</p>
+
+<%%# Accept with a non-GET request so mail scanners cannot spend the invitation. %>
+<%%= button_to "Accept invitation", <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: params[:token]), method: :patch %>

data/lib/generators/authnz_eleven/templates/erb/settings/api_tokens/create.html.erb.tt

@@ -0,0 +1,7 @@
+<h1>API token created</h1>
+
+<p>Copy this token now. It will not be shown again.</p>
+<pre><%%= @secret %></pre>
+<p>Expires <%%= @api_token.expires_at %>. Keep it private; anyone with this token can use your API as you.</p>
+
+<p><%%= link_to "Back to API tokens", <%= identity.settings_helper_prefix %>_api_tokens_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/api_tokens/index.html.erb.tt

@@ -0,0 +1,29 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= @error %></p>
+
+<h1>API tokens</h1>
+<p>Use a token to access your application's API. Tokens expire after 90 days. Keep them secret; anyone holding one can access your API as you.</p>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_api_tokens_path, data: { turbo: false } do |form| %>
+  <div>
+    <%%= form.label :name, "Token name" %><br>
+    <%%= form.text_field :name, required: true, maxlength: 100, placeholder: "My script" %>
+  </div>
+<%- if sudoable? -%>
+  <%%= render "<%= identity.sudo_partial %>", form:, submit: "Create token" %>
+<%- else -%>
+  <%%= form.submit "Create token" %>
+<%- end -%>
+<%% end %>
+
+<ul>
+  <%% @api_tokens.each do |token| %>
+    <li>
+      <%%= token.name %> (created <%%= token.created_at %>, expires <%%= token.expires_at %>)
+      <%%= button_to "Revoke", <%= identity.settings_helper_prefix %>_api_token_path(token), method: :delete,
+            data: { turbo_confirm: "Revoke this token?" } %>
+    </li>
+  <%% end %>
+</ul>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/authentications/events/index.html.erb.tt

@@ -0,0 +1,18 @@
+<h1>Security activity</h1>
+
+<table>
+  <thead>
+    <tr><th>When</th><th>Event</th><th>IP address</th></tr>
+  </thead>
+  <tbody>
+    <%% @events.each do |event| %>
+      <tr>
+        <td><%%= event.occurred_at %></td>
+        <td><%%= event.event_type %></td>
+        <td><%%= event.ip_address %></td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/dashboard/index.html.erb.tt

@@ -0,0 +1,75 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Settings</h1>
+
+<h2>Account</h2>
+
+<ul>
+<%- if email_changeable? -%>
+  <li><%%= link_to "Email address", edit_<%= identity.settings_helper_prefix %>_email_path %></li>
+<%- elsif principals.email -%>
+  <li>Email address: <%%= <%= identity.current_class %>.user.email %></li>
+<%- end -%>
+<%- if phone_changeable? -%>
+  <li><%%= link_to "Phone number", edit_<%= identity.settings_helper_prefix %>_phone_path %></li>
+<%- if phone_change_verification? -%>
+  <%% if <%= identity.current_class %>.user.pending_phone.present? %>
+    <li><%%= link_to "Verify your phone number", new_<%= identity.settings_helper_prefix %>_phone_verification_path %></li>
+  <%% end %>
+<%- end -%>
+<%- elsif principals.phone -%>
+  <li>Phone number: <%%= <%= identity.current_class %>.user.phone %></li>
+<%- end -%>
+<%- if password? -%>
+  <li><%%= link_to "Password", edit_<%= identity.settings_helper_prefix %>_password_path %></li>
+<%- end -%>
+<%- if invitable? -%>
+  <li><%%= link_to "Invite someone", new_<%= identity.settings_helper_prefix %>_invitation_path %></li>
+<%- end -%>
+  <li><%%= link_to "Delete your account", <%= identity.settings_helper_prefix %>_user_path %></li>
+</ul>
+
+<h2>Security</h2>
+
+<ul>
+<%- if passkey? -%>
+  <li><%%= link_to "Passkeys", <%= identity.settings_helper_prefix %>_passkeys_path %></li>
+<%- end -%>
+<%- if omniauth? -%>
+  <li><%%= link_to "Connected accounts", <%= identity.settings_helper_prefix %>_omniauth_identities_path %></li>
+<%- end -%>
+<%- if totp? -%>
+  <%% if <%= identity.current_class %>.user.totp_enrolled_at? %>
+    <li><%%= link_to "Authenticator app", new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path %></li>
+  <%% else %>
+    <li><%%= link_to "Set up an authenticator app", new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path %></li>
+  <%% end %>
+<%- end -%>
+<%- if sms_second_factor? -%>
+  <%% if <%= identity.current_class %>.user.sms_enrolled_at? %>
+    <li><%%= link_to "Two-factor authentication by text", new_<%= identity.settings_helper_prefix %>_mfa_sms_path %></li>
+  <%% else %>
+    <li><%%= link_to "Set up two-factor authentication by text", new_<%= identity.settings_helper_prefix %>_mfa_sms_path %></li>
+  <%% end %>
+<%- end -%>
+<%- if security_keys? -%>
+  <li><%%= link_to "Security keys", <%= identity.settings_helper_prefix %>_mfa_security_keys_path %></li>
+<%- end -%>
+<%- if second_factor? -%>
+  <%% if <%= identity.current_class %>.user.second_factor_enrolled? %>
+    <%% if <%= identity.current_class %>.user.recovery_codes.any? %>
+      <li><%%= link_to "Recovery codes", <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path %></li>
+    <%% else %>
+      <li><%%= link_to "Generate recovery codes", <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path %></li>
+    <%% end %>
+  <%% end %>
+<%- end -%>
+  <li><%%= link_to "Active sessions", <%= identity.settings_helper_prefix %>_sessions_path %></li>
+<%- if api_tokens? -%>
+  <li><%%= link_to "API tokens", <%= identity.settings_helper_prefix %>_api_tokens_path %></li>
+<%- end -%>
+<%- if trackable? -%>
+  <li><%%= link_to "Sign-in history", <%= identity.settings_helper_prefix %>_authentications_events_path %></li>
+<%- end -%>
+</ul>

data/lib/generators/authnz_eleven/templates/erb/settings/emails/edit.html.erb.tt

@@ -0,0 +1,68 @@
+<%- optional = principals.email.optional? -%>
+<%- field_label = optional ? %q(email ? "New email" : "Email") : %q("New email") -%>
+<%- submit_label = optional ? %q(email ? "Change email" : "Add an email") : %q("Change email") -%>
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<%- if optional -%>
+<%% email = <%= identity.current_class %>.user.email_in_database.presence %>
+
+<h1><%%= email ? "Change your email" : "Add an email" %></h1>
+
+<%% if email %>
+  <p>
+    Current email: <%%= email %>
+  </p>
+<%% end %>
+<%- else -%>
+<h1>Change your email</h1>
+
+<p>
+  Current email: <%%= <%= identity.current_class %>.user.email_in_database %>
+</p>
+<%- end -%>
+<%- if email_verifiable? -%>
+<%% if <%= identity.current_class %>.user.pending_email_in_database.present? %>
+  <p>Unconfirmed email: <%%= <%= identity.current_class %>.user.pending_email_in_database %></p>
+<%% end %>
+<%- end -%>
+
+<%% if @user.errors.any? %>
+  <ul style="color: red">
+    <%% @user.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_email_path, method: :patch do |form| %>
+  <div>
+    <%%= form.label :email, <%= field_label %> %><br>
+    <%%= form.email_field :email, value: <%= email_verifiable? ? "#{identity.current_class}.user.pending_email || " : "" %><%= identity.current_class %>.user.email<%= principals.email.required? ? ", required: true" : "" %>, autocomplete: "email" %>
+<%- if optional -%>
+    <%% if email %><small>Leave blank to remove your email.</small><%% end %>
+<%- end -%>
+  </div>
+<%- if sudoable? -%>
+
+  <%%= render "<%= identity.sudo_partial %>", form:, submit: <%= submit_label %> %>
+<%- else -%>
+<%- if password? -%>
+
+  <div>
+    <%%= form.label :password_challenge, "Current password" %><br>
+    <%%= form.password_field :password_challenge, autocomplete: "current-password" %>
+  </div>
+<%- end -%>
+
+  <div><%%= form.submit <%= submit_label %> %></div>
+<%- end -%>
+<%% end %>
+<%- if email_verifiable? -%>
+
+<%% if <%= identity.current_class %>.user.pending_email_in_database.present? %>
+  <%%= button_to "Resend confirmation email", <%= identity.settings_helper_prefix %>_email_verification_path, method: :post %>
+<%% end %>
+<%- end -%>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/invitations/new.html.erb.tt

@@ -0,0 +1,31 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Invite someone</h1>
+
+<%% if @invitation.errors.any? %>
+  <ul style="color: red">
+    <%% @invitation.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_invitation_path, method: :post do |form| %>
+  <div>
+    <%%= form.label :sent_to, "<%= invitation_recipient_label %>" %><br>
+    <%%= form.<%= multi_channel_invitable? ? "text_field" : (email_invitable? ? "email_field" : "telephone_field") %> :sent_to, value: @invitation.sent_to, required: true, autofocus: true %>
+  </div>
+
+<%- if teams? -%>
+  <div>
+    <%%= form.label :team_id, "Team" %><br>
+    <%%= form.select :team_id, @teams.map { |team| [ team.name, team.id ] },
+          include_blank: "No team, invite to #{<%= identity.config_reference %>.app_name}" %>
+  </div>
+
+<%- end -%>
+  <div><%%= form.submit "Send invitation" %></div>
+<%% end %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/authenticators/new.html.erb.tt

@@ -0,0 +1,57 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<%% if @user.totp_enrolled_at? %>
+  <h1>Two-factor authentication</h1>
+
+  <p>Two-factor authentication is on. You'll be asked for a code from your
+  authenticator app when you sign in.</p>
+
+  <h2>Add another device</h2>
+
+  <p>Scan this with any authenticator app to pair it with this account. Every paired
+  app shows the same code.</p>
+
+  <%%= raw @qr_svg %>
+
+  <p>Or enter this setup key manually:</p>
+  <pre><%%= @provisioning_uri %></pre>
+
+  <%%= form_with url: <%= identity.settings_helper_prefix %>_mfa_authenticator_path, method: :post do |form| %>
+    <div>
+      <%%= form.label :code, "Enter a code from the app to check that it works" %><br>
+      <%%= form.text_field :code, required: true, autocomplete: "one-time-code", inputmode: "numeric" %>
+    </div>
+
+    <div><%%= form.submit "Check this app" %></div>
+  <%% end %>
+
+  <h2>Turn it off</h2>
+
+  <p>Turning off two-factor authentication invalidates every authenticator app you've paired. Your recovery
+  codes are deleted once you have no second factor left.</p>
+
+  <%%= button_to "Turn off two-factor authentication", <%= identity.settings_helper_prefix %>_mfa_authenticator_path, method: :delete,
+        data: {turbo_confirm: "You'll no longer be asked for a code when you sign in. Continue?"} %>
+<%% else %>
+  <h1>Set up two-factor authentication</h1>
+
+  <p>Scan this QR code with your authenticator app:</p>
+
+  <%%= raw @qr_svg %>
+
+  <p>Or enter this setup key manually:</p>
+  <pre><%%= @provisioning_uri %></pre>
+
+  <%%# Disable Turbo because this successful response is the only page that reveals the newly generated recovery codes. %>
+  <%%= form_with url: <%= identity.settings_helper_prefix %>_mfa_authenticator_path, method: :post, data: {turbo: false} do |form| %>
+    <div>
+      <%%= form.label :code, "Enter the 6-digit code to confirm" %><br>
+      <%%= form.text_field :code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric" %>
+    </div>
+
+    <div><%%= form.submit "Enable two-factor authentication" %></div>
+  <%% end %>
+<%% end %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/recovery_codes/create.html.erb.tt

@@ -0,0 +1,14 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Save your recovery codes</h1>
+
+<p><strong>This is the only time these will be shown.</strong> Each one signs you in
+once if you lose your authenticator app, so store them somewhere safe.</p>
+
+<ul>
+  <%% @codes.each do |code| %>
+    <li><code><%%= code %></code></li>
+  <%% end %>
+</ul>
+
+<p><%%= button_to "I've saved them", complete_<%= identity.settings_helper_prefix %>_mfa_recovery_codes_path, method: :post %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/recovery_codes/index.html.erb.tt

@@ -0,0 +1,13 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Recovery codes</h1>
+
+<p>Each one signs you in once if you can't use your second factor. They can't be shown to you again. If you no longer have yours, generate
+a new set. Doing so invalidates the codes you have now.</p>
+
+<p>You have <%%= @remaining %> unused recovery <%%= "code".pluralize(@remaining) %>.</p>
+
+<%%= button_to "Generate a new set", <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path, method: :post,
+      data: {turbo: false} %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/security_keys/edit.html.erb.tt

@@ -0,0 +1,14 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Rename security key</h1>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_mfa_security_key_path(@security_key), method: :patch do |form| %>
+  <div>
+    <%%= label_tag :name %><br>
+    <%%= text_field_tag :name, @security_key.name, required: true, autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Save" %></div>
+<%% end %>
+
+<p><%%= link_to "Back to security keys", <%= identity.settings_helper_prefix %>_mfa_security_keys_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/security_keys/index.html.erb.tt

@@ -0,0 +1,20 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Security keys</h1>
+
+<ul>
+  <%% @security_keys.each do |security_key| %>
+    <li>
+      <%%= security_key.name %>
+      <%%= link_to "Rename", edit_<%= identity.settings_helper_prefix %>_mfa_security_key_path(security_key) %>
+      <%%= button_to "Remove", <%= identity.settings_helper_prefix %>_mfa_security_key_path(security_key), method: :delete,
+            data: {turbo_confirm: "Remove this security key?"} %>
+    </li>
+  <%% end %>
+</ul>
+
+<p>Your recovery codes are deleted once you have no second factor left.</p>
+
+<p><%%= link_to "Add a security key", new_<%= identity.settings_helper_prefix %>_mfa_security_key_path %></p>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/security_keys/new.html.erb.tt

@@ -0,0 +1,17 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Add a security key</h1>
+
+<p>Plug in or activate your security key, then click below to register it.</p>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_mfa_security_keys_path, method: :post, data: {turbo: false} do |form| %>
+  <div data-controller="webauthn"
+       data-webauthn-challenge-url-value="<%%= new_<%= identity.settings_helper_prefix %>_mfa_security_key_path(format: :json) %>">
+    <%%= form.hidden_field :credential, data: { webauthn_target: "field" } %>
+    <%%= form.button "Register security key", type: "button",
+          data: { webauthn_target: "button", action: "webauthn#createCredential" } %>
+    <p data-webauthn-target="error" style="color: red" hidden></p>
+  </div>
+<%% end %>
+
+<p><%%= link_to "Back to security keys", <%= identity.settings_helper_prefix %>_mfa_security_keys_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/multi_factor_authentication/sms/new.html.erb.tt

@@ -0,0 +1,35 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<%% if @user.sms_enrolled_at? %>
+  <h1>Two-factor authentication</h1>
+
+  <p>Two-factor authentication is on. We'll text you a code when you sign in.</p>
+
+  <h2>Turn it off</h2>
+
+  <p>Your recovery codes are deleted once you have no second factor left.</p>
+
+  <%%= button_to "Turn off two-factor authentication", <%= identity.settings_helper_prefix %>_mfa_sms_path, method: :delete,
+        data: {turbo_confirm: "You'll no longer be asked for a code when you sign in. Continue?"} %>
+<%% else %>
+  <h1>Set up two-factor authentication</h1>
+
+  <p>We'll text a six-digit code to the number on your account, and ask for one
+  every time you sign in.</p>
+
+  <%%= button_to "Text me a code", <%= identity.settings_helper_prefix %>_mfa_sms_path %>
+
+  <%%# Disable Turbo because this successful response is the only page that reveals the newly generated recovery codes. %>
+  <%%= form_with url: <%= identity.settings_helper_prefix %>_mfa_sms_path, method: :patch, data: {turbo: false} do |form| %>
+    <div>
+      <%%= form.label :code, "Enter the code to confirm" %><br>
+      <%%= form.text_field :code, required: true, autocomplete: "one-time-code",
+            inputmode: "numeric", pattern: "[0-9]*" %>
+    </div>
+
+    <div><%%= form.submit "Enable two-factor authentication" %></div>
+  <%% end %>
+<%% end %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/omniauth_identities/index.html.erb.tt

@@ -0,0 +1,28 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Connected accounts</h1>
+
+<%% if @omniauth_identities.any? %>
+  <ul>
+    <%% @omniauth_identities.each do |omniauth_identity| %>
+      <li>
+        <%%= omniauth_identity.provider_name %>
+        <small>linked <%%= omniauth_identity.created_at.to_date %></small>
+        <%%= button_to "Unlink", <%= identity.settings_helper_prefix %>_omniauth_identity_path(omniauth_identity), method: :delete %>
+      </li>
+    <%% end %>
+  </ul>
+<%% else %>
+  <p>No connected accounts yet.</p>
+<%% end %>
+
+<%%# Add one connection button per configured provider above this development-only example. %>
+<%% if Rails.env.development? %>
+<fieldset style="color: gray; margin-top: 1em;">
+  <legend><em>Development</em></legend>
+  <%%= button_to "Connect Developer", "<%= omniauth_path_prefix %>/developer", data: {turbo: false} %>
+</fieldset>
+<%% end %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>