authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/erb/settings/passkeys/edit.html.erb.tt

@@ -0,0 +1,14 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Rename passkey</h1>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_passkey_path(@passkey), method: :patch do |form| %>
+  <div>
+    <%%= form.label :name %><br>
+    <%%= form.text_field :name, value: @passkey.name, required: true, autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Save" %></div>
+<%% end %>
+
+<p><%%= link_to "Back to passkeys", <%= identity.settings_helper_prefix %>_passkeys_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/passkeys/index.html.erb.tt

@@ -0,0 +1,21 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Passkeys</h1>
+
+<p>Passkeys let you sign in without a password, using your device's screen lock,
+a fingerprint, or a security key.</p>
+
+<ul>
+  <%% @passkeys.each do |passkey| %>
+    <li>
+      <%%= passkey.name %>
+      <%%= link_to "Rename", edit_<%= identity.settings_helper_prefix %>_passkey_path(passkey) %>
+      <%%= button_to "Remove", <%= identity.settings_helper_prefix %>_passkey_path(passkey), method: :delete,
+            data: {turbo_confirm: "Remove this passkey?"} %>
+    </li>
+  <%% end %>
+</ul>
+
+<p><%%= link_to "Add a passkey", new_<%= identity.settings_helper_prefix %>_passkey_path %></p>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/passkeys/new.html.erb.tt

@@ -0,0 +1,13 @@
+<h1>Add a passkey</h1>
+
+<p>Follow your browser's prompt to create a passkey with your device screen lock,
+a fingerprint, or a security key.</p>
+
+<div data-controller="webauthn"
+     data-webauthn-challenge-url-value="<%%= new_<%= identity.settings_helper_prefix %>_passkey_path(format: :json) %>"
+     data-webauthn-verification-url-value="<%%= <%= identity.settings_helper_prefix %>_passkeys_path %>">
+  <button data-webauthn-target="button" data-action="webauthn#createCredential">Create passkey</button>
+  <p data-webauthn-target="error" style="color: red" hidden></p>
+</div>
+
+<p><%%= link_to "Back to passkeys", <%= identity.settings_helper_prefix %>_passkeys_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/passwords/edit.html.erb.tt

@@ -0,0 +1,68 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<%- if password_nullable? -%>
+<h1><%%= @user.password_set? ? "Change your password" : "Add a password" %></h1>
+<%- else -%>
+<h1>Change your password</h1>
+<%- end -%>
+
+<%% if @user.errors.any? %>
+  <ul style="color: red">
+    <%% @user.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%- if password_nullable? -%>
+<%% if @user.password_set? %>
+<%- end -%>
+<%%= form_with url: <%= identity.settings_helper_prefix %>_password_path, method: :patch do |form| %>
+  <div>
+    <%%= form.label :password_challenge, "Current password" %><br>
+    <%%= form.password_field :password_challenge, autocomplete: "current-password" %>
+  </div>
+
+  <div>
+    <%%= form.label :password, "New password" %><br>
+    <%%= form.password_field :password, required: true, autocomplete: "new-password" %>
+  </div>
+
+  <div>
+    <%%= form.label :password_confirmation %><br>
+    <%%= form.password_field :password_confirmation, required: true, autocomplete: "new-password" %>
+  </div>
+
+  <div><%%= form.submit "Change password" %></div>
+<%% end %>
+<%- if password_nullable? -%>
+<%% else %>
+<%%= form_with url: <%= identity.settings_helper_prefix %>_password_path, method: :post do |form| %>
+  <div>
+    <%%= form.label :password %><br>
+    <%%= form.password_field :password, required: true, autocomplete: "new-password" %>
+  </div>
+
+  <div>
+    <%%= form.label :password_confirmation %><br>
+    <%%= form.password_field :password_confirmation, required: true, autocomplete: "new-password" %>
+  </div>
+
+  <div><%%= form.submit "Set password" %></div>
+<%% end %>
+<%% end %>
+<%- end -%>
+<%- if password_removable? -%>
+
+<%%# Never offer removal when the password is the account's last sign-in method. %>
+<%% if @user.password_set? && !@user.last_sign_in_method?(:password) %>
+<hr>
+<p>
+  You can sign in without a password. Removing it will prevent phishing.
+</p>
+<%%= button_to "Remove my password", <%= identity.settings_helper_prefix %>_password_path, method: :delete %>
+<%% end %>
+<%- end -%>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/phone_verifications/new.html.erb.tt

@@ -0,0 +1,22 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Verify your phone</h1>
+
+<p>
+  Enter the six-digit code we texted to <%%= <%= identity.current_class %>.user.pending_phone %> to confirm the number is yours.
+</p>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_phone_verification_path, method: :patch do |form| %>
+  <div>
+    <%%= form.label :code, "Verification code" %><br>
+    <%%= form.text_field :code, required: true, autocomplete: "one-time-code",
+          inputmode: "numeric", pattern: "[0-9]*", autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Verify phone" %></div>
+<%% end %>
+
+<%%= button_to "Send me a code", <%= identity.settings_helper_prefix %>_phone_verification_path, method: :post %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/phones/edit.html.erb.tt

@@ -0,0 +1,58 @@
+<%- optional = principals.phone.optional? -%>
+<%- field_label = optional ? %q(phone ? "New phone" : "Phone") : %q("New phone") -%>
+<%- submit_label = optional ? %q(phone ? "Change phone" : "Add a phone") : %q("Change phone") -%>
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<%- if optional -%>
+<%% phone = <%= identity.current_class %>.user.phone_in_database.presence %>
+
+<h1><%%= phone ? "Change your phone" : "Add a phone" %></h1>
+
+<%% if phone %>
+  <p>Current phone: <%%= phone %></p>
+<%% end %>
+<%- else -%>
+<h1>Change your phone</h1>
+
+<p>Current phone: <%%= <%= identity.current_class %>.user.phone_in_database %></p>
+<%- end -%>
+<%- if phone_verifiable? -%>
+<%% if <%= identity.current_class %>.user.pending_phone_in_database.present? %>
+  <p>Unconfirmed phone: <%%= <%= identity.current_class %>.user.pending_phone_in_database %></p>
+<%% end %>
+<%- end -%>
+
+<%% if @user.errors.any? %>
+  <ul style="color: red">
+    <%% @user.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_phone_path, method: :patch do |form| %>
+  <div>
+    <%%= form.label :phone, <%= field_label %> %><br>
+    <%%= form.telephone_field :phone, value: <%= phone_verifiable? ? "#{identity.current_class}.user.pending_phone || " : "" %><%= identity.current_class %>.user.phone<%= principals.phone.required? ? ", required: true" : "" %>, autocomplete: "tel", placeholder: "(415) 826-4001" %>
+<%- if optional -%>
+    <%% if phone %><small>Leave blank to remove your phone.</small><%% end %>
+<%- end -%>
+  </div>
+<%- if sudoable? -%>
+
+  <%%= render "<%= identity.sudo_partial %>", form:, submit: <%= submit_label %> %>
+<%- else -%>
+<%- if password? -%>
+
+  <div>
+    <%%= form.label :password_challenge, "Current password" %><br>
+    <%%= form.password_field :password_challenge, autocomplete: "current-password" %>
+  </div>
+<%- end -%>
+
+  <div><%%= form.submit <%= submit_label %> %></div>
+<%- end -%>
+<%% end %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/sessions/index.html.erb.tt

@@ -0,0 +1,29 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Your sessions</h1>
+
+<table>
+  <thead>
+    <tr><th>Device</th><th>Signed in with</th><th>IP address</th><th>Signed in</th><th></th></tr>
+  </thead>
+  <tbody>
+    <%% @sessions.each do |session| %>
+      <tr>
+        <td><%%= session.user_agent %></td>
+        <td><%%= session.via&.humanize %></td>
+        <td><%%= session.ip_address %></td>
+        <td><%%= session.created_at %></td>
+        <td>
+          <%% if session == <%= identity.current_class %>.session %>
+            This session
+          <%% else %>
+            <%%= button_to "Sign out", <%= identity.settings_helper_prefix %>_session_path(session), method: :delete %>
+          <%% end %>
+        </td>
+      </tr>
+    <%% end %>
+  </tbody>
+</table>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/settings/users/show.html.erb.tt

@@ -0,0 +1,28 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Delete your account</h1>
+
+<p>This permanently deletes your account and signs out every session. It can't be undone.</p>
+
+<%%= form_with url: <%= identity.settings_helper_prefix %>_user_path, method: :delete do |form| %>
+  <div>
+    <%%= form.label :confirmation, "Type DELETE ACCOUNT to confirm" %><br>
+    <%%= form.text_field :confirmation, required: true, autocomplete: "off" %>
+  </div>
+
+<%- if sudoable? -%>
+  <%%= render "<%= identity.sudo_partial %>", form:, submit: "Delete my account" %>
+<%- else -%>
+<%- if password? -%>
+  <div>
+    <%%= form.label :password_challenge, "Current password" %><br>
+    <%%= form.password_field :password_challenge, required: true, autocomplete: "current-password" %>
+  </div>
+
+<%- end -%>
+  <div><%%= form.submit "Delete my account" %></div>
+<%- end -%>
+<%% end %>
+
+<p><%%= link_to "Back to settings", <%= identity.settings_helper_prefix %>_path %></p>

data/lib/generators/authnz_eleven/templates/erb/shared/_authnz_eleven_nav.html.erb.tt

@@ -0,0 +1,24 @@
+<nav>
+<%- if impersonatable? -%>
+  <%% if impersonating? %>
+    <span>Impersonating <%%= <%= principals.display_expression("#{identity.current_class}.user") %> %>.</span>
+    <%%= button_to "Stop impersonating", <%= identity.nested_helper("impersonation_path") %>, method: :delete %>
+  <%% end %>
+<%- end -%>
+  <%% if authenticated? %>
+    <span><%- if teams? -%><%% if <%= identity.current_class %>.team %><%%= <%= identity.current_class %>.team.name %>/<%% end %><%- end -%><%%= <%= principals.display_expression("#{identity.current_class}.user") %> %></span>
+    <%%= link_to "Settings", <%= identity.settings_helper_prefix %>_path %>
+<%- if teams? -%>
+    <%%= link_to "Teams", <%= identity.nested_helper("teams_path") %> %>
+<%- end -%>
+<%- if admin_dashboard? -%>
+    <%% if <%= identity.current_class %>.user.admin? %><%%= link_to "Admin", <%= admin_helper("root_path") %> %><%% end %>
+<%- end -%>
+    <%%= button_to "Sign out", <%= identity.route_scope %>_sign_out_path, method: :delete %>
+  <%% else %>
+    <%%= link_to "Sign in", <%= identity.route_scope %>_sign_in_path %>
+<%- if typed_registration? -%>
+    <%%= link_to "Sign up", <%= identity.route_scope %>_sign_up_path %>
+<%- end -%>
+  <%% end %>
+</nav>

data/lib/generators/authnz_eleven/templates/erb/shared/_authnz_eleven_sudo_challenge.html.erb.tt

@@ -0,0 +1,43 @@
+<%- if single_sudo_bar? -%>
+  <div>
+    <%%= form.label :sudo_password, "Current password" %><br>
+    <%%= form.password_field :sudo_password, required: true, autocomplete: "current-password" %>
+  </div>
+
+  <div><%%= form.submit submit %></div>
+<%- else -%>
+  <%%# Keep each strategy's submit button in its branch: WebAuthn must intercept it and submit only after obtaining an assertion. %>
+  <%% case sudo_strategy %>
+<%- if sudo_bars.include?(:webauthn) -%>
+  <%% when :webauthn %>
+    <div data-controller="webauthn"
+         data-webauthn-challenge-url-value="<%%= new_<%= identity.route_scope %>_sudo_path(format: :json) %>">
+      <%%= form.hidden_field :sudo_credential, data: { webauthn_target: "field" } %>
+      <%%= form.button submit, type: "button",
+            data: { webauthn_target: "button", action: "webauthn#getCredential" } %>
+      <p data-webauthn-target="error" style="color: red" hidden></p>
+    </div>
+<%- end -%>
+<%- if sudo_bars.include?(:password) -%>
+  <%% when :password %>
+    <div>
+      <%%= form.label :sudo_password, "Current password" %><br>
+      <%%= form.password_field :sudo_password, required: true, autocomplete: "current-password" %>
+    </div>
+
+    <div><%%= form.submit submit %></div>
+<%- end -%>
+<%- if sudo_bars.include?(:totp) -%>
+  <%% when :totp %>
+    <div>
+      <%%= form.label :sudo_code, "Code from your authenticator app" %><br>
+      <%%= form.text_field :sudo_code, required: true, autocomplete: "one-time-code", inputmode: "numeric" %>
+    </div>
+
+    <div><%%= form.submit submit %></div>
+<%- end -%>
+  <%%# This branch intentionally permits the request when the account has no challengeable factor. %>
+  <%% else %>
+    <div><%%= form.submit submit %></div>
+  <%% end %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/shared/_captcha.html.erb.tt

@@ -0,0 +1,8 @@
+<%% if Captcha.site_key %>
+<div class="cf-turnstile"
+     data-sitekey="<%%= Captcha.site_key %>"
+     <%%# Turnstile writes this field; its name must match Captchable's parameter, and forms using this partial must disable Turbo so rejected one-use tokens are replaced. %>
+     data-response-field-name="captcha_token"></div>
+<%%= javascript_include_tag "https://challenges.cloudflare.com/turnstile/v0/api.js",
+      async: true, defer: true %>
+<%% end %>

data/lib/generators/authnz_eleven/templates/erb/teams/index.html.erb.tt

@@ -0,0 +1,34 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Your teams</h1>
+<%- if session_carries_team? -%>
+
+<%% if <%= identity.current_class %>.user.on_a_team? %>
+  <%%= form_with url: <%= identity.nested_helper("active_team_path") %>, method: :post do |form| %>
+    <%% @teams.each do |team| %>
+      <div>
+        <label>
+          <%%= radio_button_tag "team_id", team.id %>
+          <%%= team.name %>
+        </label>
+      </div>
+    <%% end %>
+
+    <div><%%= form.submit "Continue" %></div>
+  <%% end %>
+<%% end %>
+<%- else -%>
+
+<ul>
+  <%% @teams.each do |team| %>
+<%- if scope_teams? -%>
+    <li><%%= link_to team.name, <%= team_root_helper %>(team_id: team) %></li>
+<%- else -%>
+    <li><%%= link_to team.name, root_path(script_name: "/#{team.id}") %></li>
+<%- end -%>
+  <%% end %>
+</ul>
+<%- end -%>
+
+<%%= link_to "Start a new team", new_<%= identity.nested_helper("team_path") %> %>

data/lib/generators/authnz_eleven/templates/erb/teams/new.html.erb.tt

@@ -0,0 +1,22 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Start a new team</h1>
+
+<%%= form_with model: @team, url: <%= identity.nested_helper("teams_path") %> do |form| %>
+  <%% if @team.errors.any? %>
+    <div style="color: red">
+      <%% @team.errors.full_messages.each do |message| %>
+        <div><%%= message %></div>
+      <%% end %>
+    </div>
+  <%% end %>
+
+  <div>
+    <%%= form.label :name %>
+    <%%= form.text_field :name, required: true, autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Create team" %></div>
+<%% end %>
+
+<%%= link_to "Back", <%= identity.nested_helper("teams_path") %> %>

data/lib/generators/authnz_eleven/templates/erb/teams/show.html.erb.tt

@@ -0,0 +1,5 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1><%%= <%= identity.current_class %>.team.name %></h1>
+
+<%%= link_to "Your teams", <%= identity.nested_helper("teams_path") %> %>

data/lib/generators/authnz_eleven/templates/erb/user_mailer/email_change_verification.html.erb.tt

@@ -0,0 +1,7 @@
+<p>Hi,</p>
+
+<p>Confirm your new email address by clicking the link below.</p>
+
+<p><%%= link_to "Confirm new address", <%= identity.route_scope %>_verify_email_change_url(sid: @signed_id) %></p>
+
+<p>If you didn't ask for this, you can ignore this message.</p>

data/lib/generators/authnz_eleven/templates/erb/user_mailer/invitation.html.erb.tt

@@ -0,0 +1,11 @@
+<p>Hi,</p>
+
+<%- if teams? -%>
+<p><%%= @invitation.inviter.<%= principals.display.column %> %> has invited you to join their team. Use the link
+below to accept:</p>
+<%- else -%>
+<p><%%= @invitation.inviter.<%= principals.display.column %> %> has invited you to <%%= <%= identity.config_reference %>.app_name %>.
+Use the link below to accept:</p>
+<%- end -%>
+
+<p><%%= link_to "Accept invitation", <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation" : "accept_invitation" %>_url(token: @signed_id) %></p>

data/lib/generators/authnz_eleven/templates/erb/user_mailer/magic_link.html.erb.tt

@@ -0,0 +1,5 @@
+<p>Hi,</p>
+
+<p>Use the link below to sign in. It expires in 20 minutes.</p>
+
+<p><%%= link_to "Sign in", <%= identity.route_scope %>_magic_link_url(sid: @signed_id) %></p>

data/lib/generators/authnz_eleven/templates/erb/user_mailer/password_reset.html.erb.tt

@@ -0,0 +1,6 @@
+<p>Hi,</p>
+
+<p>Someone requested a password reset for your account. If that was you, use the
+link below (it expires in 20 minutes). If not, you can ignore this email.</p>
+
+<p><%%= link_to "Reset password", <%= identity.route_scope %>_reset_password_url(sid: @signed_id) %></p>

data/lib/generators/authnz_eleven/templates/erb/user_mailer/registration_email_verification.html.erb.tt

@@ -0,0 +1,7 @@
+<p>Hi,</p>
+
+<p>Confirm this email address to finish signing up.</p>
+
+<p><%%= link_to "Confirm email", <%= identity.route_scope %>_verify_email_url(sid: @signed_id) %></p>
+
+<p>If you didn't ask for this, you can ignore this message.</p>

data/lib/generators/authnz_eleven/templates/erb/user_mailer/security_notification.html.erb.tt

@@ -0,0 +1,15 @@
+<h1><%%= @subject %></h1>
+
+<p>This security change was made to your account.</p>
+
+<%% if @occurred_at %>
+  <p>When: <%%= @occurred_at %></p>
+<%% end %>
+<%% if @ip_address.present? %>
+  <p>IP address: <%%= @ip_address %></p>
+<%% end %>
+<%% if @user_agent.present? %>
+  <p>Device: <%%= @user_agent %></p>
+<%% end %>
+
+<p>If this wasn't you, secure your account and contact support.</p>

data/lib/generators/authnz_eleven/templates/erb/users/credential_enrollments/passkeys/new.html.erb.tt

@@ -0,0 +1,24 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Create a passkey</h1>
+
+<p>Follow your browser's prompt to create a passkey with your device screen lock,
+a fingerprint, or a security key.</p>
+
+<%% if @registration.errors.any? %>
+  <ul style="color: red">
+    <%% @registration.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.route_scope %>_registration_passkey_path, method: :post, data: { turbo: false } do |form| %>
+  <div data-controller="webauthn"
+       data-webauthn-challenge-url-value="<%%= <%= identity.route_scope %>_new_registration_passkey_path(format: :json) %>">
+    <%%= form.hidden_field :credential, data: { webauthn_target: "field" } %>
+    <%%= form.button "Create passkey", type: "button",
+          data: { webauthn_target: "button", action: "webauthn#createCredential" } %>
+    <p data-webauthn-target="error" style="color: red" hidden></p>
+  </div>
+<%% end %>

data/lib/generators/authnz_eleven/templates/erb/users/credential_enrollments/passwords/new.html.erb.tt

@@ -0,0 +1,21 @@
+<h1>Choose a password</h1>
+
+<%% if @registration.errors.any? %>
+  <ul style="color: red">
+    <%% @registration.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.route_scope %>_registration_password_path do |form| %>
+  <div>
+    <%%= form.label :password %><br>
+    <%%= form.password_field :password, required: true, autocomplete: "new-password" %>
+  </div>
+  <div>
+    <%%= form.label :password_confirmation %><br>
+    <%%= form.password_field :password_confirmation, required: true, autocomplete: "new-password" %>
+  </div>
+  <div><%%= form.submit "Finish setting up my account" %></div>
+<%% end %>

data/lib/generators/authnz_eleven/templates/erb/users/credential_enrollments/show.html.erb.tt

@@ -0,0 +1,21 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Finish setting up your account</h1>
+
+<%- if pre_account_password_enrollment? -%>
+<p><%%= link_to "Choose a password", <%= identity.route_scope %>_new_registration_password_path %></p>
+<%- end -%>
+<%- if pre_account_passkey_enrollment? -%>
+<p><%%= link_to "Create a passkey", <%= identity.route_scope %>_new_registration_passkey_path %></p>
+<%- end -%>
+<%- if pre_account_provider_enrollment? -%>
+<%%# Connecting a provider is the only way to finish this sign-up, so add a button
+    per configured provider here, each with ?registration_intent=1 in its URL as below. %>
+<%% if Rails.env.development? %>
+<fieldset style="color: gray; margin-top: 1em;">
+  <legend><em>Development</em></legend>
+  <%%# OmniAuth returns query params, as request.env["omniauth.params"]. %>
+  <%%= button_to "Continue with Developer", "<%= omniauth_path_prefix %>/developer?registration_intent=1", data: { turbo: false } %>
+</fieldset>
+<%% end %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/users/email_verifications/show.html.erb.tt

@@ -0,0 +1,9 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Confirm your email</h1>
+
+<p>Confirm <%%= @<%= identity.singular %>.pending_email %> as your new email address.</p>
+
+<%%# Confirm with a non-GET request so mail scanners cannot apply the change. %>
+<%%= button_to "Confirm my email", <%= identity.route_scope %>_verify_email_change_path(sid: params[:sid]), method: :patch %>

data/lib/generators/authnz_eleven/templates/erb/users/magic_link/edit.html.erb.tt

@@ -0,0 +1,9 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Sign in</h1>
+
+<p>Your sign-in link is ready.</p>
+
+<%%# Keep session creation behind a non-GET request because mail scanners and link previewers may follow the link. %>
+<%%= button_to "Sign me in", <%= identity.route_scope %>_magic_link_path(sid: params[:sid]), method: :patch %>

data/lib/generators/authnz_eleven/templates/erb/users/magic_link/new.html.erb.tt

@@ -0,0 +1,22 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Sign in with a magic link</h1>
+
+<p>Enter your email and we'll send you a link to sign in without a password.</p>
+
+<%%= form_with url: <%= identity.route_scope %>_magic_link_path, method: :post<%= captcha_form_options %> do |form| %>
+  <div>
+    <%%= form.label :email %><br>
+    <%%= form.email_field :email, required: true, autofocus: true, autocomplete: "email" %>
+  </div>
+
+<%- if captchable? -%>
+
+  <%%= render "shared/captcha" %>
+<%- end -%>
+
+  <div><%%= form.submit "Send magic link" %></div>
+<%% end %>
+
+<p><%%= link_to "Back to sign in", <%= identity.route_scope %>_sign_in_path %></p>

data/lib/generators/authnz_eleven/templates/erb/users/multi_factor_authentication/challenge/recovery_codes/new.html.erb.tt

@@ -0,0 +1,20 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Enter a recovery code</h1>
+
+<p>Enter one of the recovery codes you saved when you set up two-factor authentication.</p>
+
+<%%= form_with url: <%= identity.route_scope %>_mfa_challenge_recovery_codes_path, method: :post do |form| %>
+  <div>
+    <%%= form.label :code %><br>
+    <%%= form.text_field :code, required: true, autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Verify" %></div>
+<%% end %>
+
+<%- second_factor_alternatives(:recovery_codes).each do |clause, label, path| -%>
+<%% if <%= clause %> %>
+  <p><%%= link_to "<%= label %>", <%= path %> %></p>
+<%% end %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/users/multi_factor_authentication/challenge/security_keys/new.html.erb.tt

@@ -0,0 +1,17 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Use your security key</h1>
+
+<div data-controller="webauthn"
+     data-webauthn-challenge-url-value="<%%= new_<%= identity.route_scope %>_mfa_challenge_security_keys_path(format: :json) %>"
+     data-webauthn-verification-url-value="<%%= <%= identity.route_scope %>_mfa_challenge_security_keys_path %>">
+  <button data-webauthn-target="button" data-action="webauthn#getCredential">Use security key</button>
+  <p data-webauthn-target="error" style="color: red" hidden></p>
+</div>
+
+<%- second_factor_alternatives(:security_keys).each do |clause, label, path| -%>
+<%% if <%= clause %> %>
+  <p><%%= link_to "<%= label %>", <%= path %> %></p>
+<%% end %>
+<%- end -%>
+<p><%%= link_to "Use a recovery code instead", new_<%= identity.route_scope %>_mfa_challenge_recovery_codes_path %></p>