authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/erb/users/multi_factor_authentication/challenge/sms/new.html.erb.tt

@@ -0,0 +1,25 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Two-factor authentication</h1>
+
+<p>Type the six-digit code we texted you.</p>
+
+<%%= form_with url: <%= identity.route_scope %>_mfa_challenge_sms_path, method: :patch do |form| %>
+  <div>
+    <%%= form.label :code, "Security code" %><br>
+    <%%= form.text_field :code, required: true, autocomplete: "one-time-code",
+          inputmode: "numeric", pattern: "[0-9]*", autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Verify" %></div>
+<%% end %>
+
+<%%= button_to "Didn't get it? Send another code", <%= identity.route_scope %>_mfa_challenge_sms_path %>
+
+<p><%%= link_to "Use a recovery code instead", new_<%= identity.route_scope %>_mfa_challenge_recovery_codes_path %></p>
+<%- second_factor_alternatives(:sms).each do |clause, label, path| -%>
+<%% if <%= clause %> %>
+  <p><%%= link_to "<%= label %>", <%= path %> %></p>
+<%% end %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/users/multi_factor_authentication/challenge/totps/new.html.erb.tt

@@ -0,0 +1,21 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Two-factor authentication</h1>
+
+<p>Enter the 6-digit code from your authenticator app.</p>
+
+<%%= form_with url: <%= identity.route_scope %>_mfa_challenge_totp_path, method: :post do |form| %>
+  <div>
+    <%%= form.label :code %><br>
+    <%%= form.text_field :code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric" %>
+  </div>
+
+  <div><%%= form.submit "Verify" %></div>
+<%% end %>
+
+<p><%%= link_to "Use a recovery code instead", new_<%= identity.route_scope %>_mfa_challenge_recovery_codes_path %></p>
+<%- second_factor_alternatives(:totp).each do |clause, label, path| -%>
+<%% if <%= clause %> %>
+  <p><%%= link_to "<%= label %>", <%= path %> %></p>
+<%% end %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/users/omniauth/registrations/new.html.erb.tt

@@ -0,0 +1,28 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Finish signing up</h1>
+
+<%- if principals.email -%>
+<%% if @registration.email.present? %>
+  <p>Signing in as <%%= @registration.email %>. Choose the rest of your details to finish.</p>
+<%% end %>
+<%- end -%>
+
+<%% if @registration.errors.any? %>
+  <ul style="color: red">
+    <%% @registration.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.route_scope %>_omniauth_registration_path do |form| %>
+<%- omniauth_registration_principals.each_with_index do |principal, i| -%>
+  <div>
+    <%%= form.label :<%= principal.column %> %><br>
+    <%%= form.<%= principal.field_helper %> :<%= principal.column %>, value: @registration.<%= principal.column %>, required: true<%= i.zero? ? ", autofocus: true" : "" %>, autocomplete: "<%= principal.autocomplete %>" %>
+  </div>
+<%- end -%>
+  <div><%%= form.submit "Complete sign up" %></div>
+<%% end %>

data/lib/generators/authnz_eleven/templates/erb/users/password_resets/edit.html.erb.tt

@@ -0,0 +1,26 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Reset your password</h1>
+
+<%% if @user.errors.any? %>
+  <ul style="color: red">
+    <%% @user.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.route_scope %>_reset_password_path(sid: params[:sid]), method: :patch do |form| %>
+  <div>
+    <%%= form.label :password, "New password" %><br>
+    <%%= form.password_field :password, required: true, autofocus: true, autocomplete: "new-password" %>
+  </div>
+
+  <div>
+    <%%= form.label :password_confirmation %><br>
+    <%%= form.password_field :password_confirmation, required: true, autocomplete: "new-password" %>
+  </div>
+
+  <div><%%= form.submit "Reset password" %></div>
+<%% end %>

data/lib/generators/authnz_eleven/templates/erb/users/password_resets/new.html.erb.tt

@@ -0,0 +1,20 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Forgot your password?</h1>
+
+<%%= form_with url: <%= identity.route_scope %>_reset_password_path, method: :post<%= captcha_form_options %> do |form| %>
+  <div>
+    <%%= form.label :email %><br>
+    <%%= form.email_field :email, required: true, autofocus: true, autocomplete: "email" %>
+  </div>
+
+<%- if captchable? -%>
+
+  <%%= render "shared/captcha" %>
+<%- end -%>
+
+  <div><%%= form.submit "Send reset instructions" %></div>
+<%% end %>
+
+<p><%%= link_to "Back to sign in", <%= identity.route_scope %>_sign_in_path %></p>

data/lib/generators/authnz_eleven/templates/erb/users/registrations/email_verifications/new.html.erb.tt

@@ -0,0 +1,11 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Confirm your email</h1>
+
+<p>Click the link we sent to <%%= @registration.email %> to finish creating your account.</p>
+
+<%%# Always offer resend. If we only showed it when a link had actually been sent it would reveal whether the address already has an account. %>
+<%%= button_to "Send me another link", <%= identity.route_scope %>_verify_email_path, method: :post %>
+
+<p><%%= link_to "<%= typed_registration? ? "Back to sign up" : "Back to sign in" %>", <%= registration_entry_path %> %></p>

data/lib/generators/authnz_eleven/templates/erb/users/registrations/email_verifications/show.html.erb.tt

@@ -0,0 +1,34 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Confirm your email</h1>
+
+<p>Confirm <%%= @registration.email %> to finish creating your account.</p>
+<%- if principals.username -%>
+
+<%% if @registration.errors.any? %>
+  <ul style="color: red">
+    <%% @registration.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.route_scope %>_verify_email_path(sid: params[:sid]), method: :patch do |form| %>
+  <%%# Username may have been taken in between time the registration was made and the email was verified. %>
+  <%% if @registration.errors.any? %>
+    <div>
+      <%%= form.label :username %><br>
+      <%%= form.text_field :username, value: @registration.username, required: true, autofocus: true, autocomplete: "username" %>
+    </div>
+  <%% else %>
+    <%%= form.hidden_field :username, value: @registration.username %>
+  <%% end %>
+
+  <div><%%= form.submit "Confirm my email" %></div>
+<%% end %>
+<%- else -%>
+
+<%%# Confirm with a non-GET request so mail scanners cannot create and sign in an account. %>
+<%%= button_to "Confirm my email", <%= identity.route_scope %>_verify_email_path(sid: params[:sid]), method: :patch %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/users/registrations/new.html.erb.tt

@@ -0,0 +1,87 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Sign up</h1>
+
+<%% if <%= registration_form_object %>.errors.any? %>
+  <ul style="color: red">
+    <%% <%= registration_form_object %>.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: <%= identity.route_scope %>_sign_up_path<%= captcha_form_options %> do |form| %>
+<%- if principals.username -%>
+  <div>
+    <%%= form.label :username %><br>
+    <%%= form.text_field :username, value: <%= registration_form_object %>.username, required: true, autofocus: true, autocomplete: "username" %>
+  </div>
+<%- end -%>
+<%- if principals.email -%>
+  <div>
+    <%%= form.label :email<%= principals.email.optional? ? %q(, "Email (optional)") : "" %> %><br>
+<%- if invitable? -%>
+    <%% if @pending_invitation&.email_addressed? %>
+      <%%= form.email_field :email, value: @pending_invitation.sent_to, readonly: true %>
+    <%% else %>
+      <%%= form.email_field :email, value: <%= registration_form_object %>.email<%= principals.email.required? ? ", required: true" : "" %><%= principals.username ? "" : ", autofocus: true" %>, autocomplete: "email" %>
+    <%% end %>
+<%- else -%>
+    <%%= form.email_field :email, value: <%= registration_form_object %>.email<%= principals.email.required? ? ", required: true" : "" %><%= principals.username ? "" : ", autofocus: true" %>, autocomplete: "email" %>
+<%- end -%>
+  </div>
+<%- end -%>
+<%- if principals.phone -%>
+  <div>
+    <%%= form.label :phone<%= principals.phone.optional? ? %q(, "Phone (optional)") : "" %> %><br>
+<%- if invitable? -%>
+    <%% if @pending_invitation&.phone_addressed? %>
+      <%%= form.telephone_field :phone, value: @pending_invitation.sent_to, readonly: true %>
+    <%% else %>
+      <%%= form.telephone_field :phone, value: <%= registration_form_object %>.phone<%= principals.phone.required? ? ", required: true" : "" %>, autocomplete: "tel", placeholder: "(415) 826-4001" %>
+    <%% end %>
+<%- else -%>
+    <%%= form.telephone_field :phone, value: <%= registration_form_object %>.phone<%= principals.phone.required? ? ", required: true" : "" %><%= (!principals.username && !principals.email) ? ", autofocus: true" : "" %>, autocomplete: "tel", placeholder: "(415) 826-4001" %>
+<%- end -%>
+  </div>
+<%- end -%>
+<%- if password_on_sign_up_form? -%>
+
+  <div>
+    <%%= form.label :password<%= password_form_optional? ? %(, "Password (optional)") : "" %> %><br>
+<%- if password_form_optional? -%>
+    <%%# There is more than one way to sign in, so this field is not required. %>
+<%- end -%>
+    <%%= form.password_field :password<%= password_form_optional? ? "" : ", required: true" %>, autocomplete: "new-password" %>
+<%- if password_form_optional? -%>
+<%- end -%>
+  </div>
+
+  <div>
+    <%%= form.label :password_confirmation %><br>
+    <%%= form.password_field :password_confirmation<%= password_form_optional? ? "" : ", required: true" %>, autocomplete: "new-password" %>
+  </div>
+<%- end -%>
+<%- if captchable? -%>
+
+  <%%= render "shared/captcha" %>
+<%- end -%>
+
+  <div><%%= form.submit "Sign up" %></div>
+<%% end %>
+<%- if omniauth? -%>
+
+<%- end -%>
+<%- if omniauth? -%>
+
+<%%# Add buttons for configured OmniAuth providers above this development-only example. %>
+<%% if Rails.env.development? %>
+<fieldset style="color: gray; margin-top: 1em;">
+  <legend><em>Development sign-up</em></legend>
+  <%%= button_to "Sign up with Developer", "<%= omniauth_path_prefix %>/developer", data: {turbo: false} %>
+</fieldset>
+<%% end %>
+<%- end -%>
+
+<p><%%= link_to "Sign in", <%= identity.route_scope %>_sign_in_path %></p>

data/lib/generators/authnz_eleven/templates/erb/users/registrations/phone_verifications/new.html.erb.tt

@@ -0,0 +1,46 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Confirm your phone</h1>
+
+<p>
+  Enter the six-digit code we texted you to finish creating your account.
+</p>
+
+<%#- The number is deliberately NOT echoed here. Sign-up answers identically
+      whether or not the submitted number was already registered, and printing
+      it back would undo that. -%>
+
+<%- if principals.username -%>
+<%% if @registration.errors.any? %>
+  <ul style="color: red">
+    <%% @registration.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%- end -%>
+<%%= form_with url: <%= identity.route_scope %>_verify_phone_path, method: :patch do |form| %>
+<%- if principals.username -%>
+  <%%# Username may have been taken in between time the registration was made and the phone was verified. %>
+  <%% if @registration.errors.any? %>
+    <div>
+      <%%= form.label :username %><br>
+      <%%= form.text_field :username, value: @registration.username, required: true, autocomplete: "username" %>
+    </div>
+  <%% else %>
+    <%%= form.hidden_field :username, value: @registration.username %>
+  <%% end %>
+
+<%- end -%>
+  <div>
+    <%%= form.label :code, "Verification code" %><br>
+    <%%= form.text_field :code, required: true, autocomplete: "one-time-code",
+          inputmode: "numeric", pattern: "[0-9]*", autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Confirm phone" %></div>
+<%% end %>
+
+<%%= button_to "Send me another code", <%= identity.route_scope %>_verify_phone_path, method: :post %>

data/lib/generators/authnz_eleven/templates/erb/users/sessions/new.html.erb.tt

@@ -0,0 +1,88 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Sign in</h1>
+
+<%- if password? -%>
+<%%= form_with url: <%= identity.route_scope %>_sign_in_path<%= captcha_form_options %> do |form| %>
+  <div>
+<%- if multi_login? -%>
+    <%%= form.label :login, "<%= login_keys_phrase.capitalize %>" %><br>
+    <%%= form.text_field :login, value: params[:login_hint], required: true, autofocus: true, autocomplete: "username" %>
+<%- else -%>
+    <%%= form.label :<%= login_field %> %><br>
+    <%%= form.<%= login_principal.field_helper %> :<%= login_field %>, value: params[:<%= login_hint_param %>], required: true, autofocus: true, autocomplete: "<%= login_principal.autocomplete %>" %>
+<%- end -%>
+  </div>
+
+  <div>
+    <%%= form.label :password %><br>
+    <%%= form.password_field :password, required: true, autocomplete: "current-password" %>
+  </div>
+<%- if rememberable? -%>
+
+  <div>
+    <%%= form.check_box :remember_me %>
+    <%%= form.label :remember_me, "Remember me on this device" %>
+  </div>
+<%- end -%>
+<%- if captchable? -%>
+
+  <%%= render "shared/captcha" %>
+<%- end -%>
+
+  <div><%%= form.submit "Sign in" %></div>
+<%% end %>
+<%- end -%>
+<%- if passkey? -%>
+
+<div data-controller="webauthn"
+     data-webauthn-challenge-url-value="<%%= new_<%= identity.route_scope %>_passkeys_session_path(format: :json) %>"
+     data-webauthn-verification-url-value="<%%= <%= identity.route_scope %>_passkeys_session_path %>">
+  <button data-webauthn-target="button" data-action="webauthn#getCredential">Sign in with a passkey</button>
+  <p data-webauthn-target="error" style="color: red" hidden></p>
+</div>
+<%- end -%>
+
+<%- if public_registration? || recoverable? -%>
+<p>
+<%- if public_registration? -%>
+  <%%= link_to "Sign up", <%= identity.route_scope %>_sign_up_path %><%= recoverable? ? " |" : "" %>
+<%- end -%>
+<%- if recoverable? -%>
+  <%%= link_to "Forgot your password?", <%= identity.route_scope %>_forgot_password_path %>
+<%- end -%>
+</p>
+<%- end -%>
+<%- if magic_link? -%>
+<p><%%= link_to "Sign in with a magic link", <%= identity.route_scope %>_new_magic_link_path %></p>
+<%- end -%>
+<%- if sms_code? -%>
+<p><%%= link_to "Sign in with a texted code", <%= identity.route_scope %>_sms_sign_in_path %></p>
+<%- end -%>
+<%- if omniauth? -%>
+<%- end -%>
+<%- if omniauth? || easy_dev_login? -%>
+
+<%%# Add sign-in buttons for configured OmniAuth providers above the development-only example. %>
+<%% if Rails.env.development? %>
+<fieldset style="color: gray; margin-top: 1em;">
+  <legend><em>Development sign-in</em></legend>
+<%- if omniauth? -%>
+  <%%= button_to "Sign in with Developer", "<%= omniauth_path_prefix %>/developer", data: {turbo: false} %>
+<%- end -%>
+<%- if easy_dev_login? && password? -%>
+  <p>Enter any user's <%= login_keys_phrase %> above. The password is ignored.</p>
+<%- elsif easy_dev_login? -%>
+  <%%= form_with url: <%= identity.route_scope %>_easy_dev_login_path do |form| %>
+<%- if multi_login? -%>
+    <%%= form.text_field :login, required: true, autocomplete: "off", placeholder: "<%= login_keys_phrase %>" %>
+<%- else -%>
+    <%%= form.<%= login_principal.field_helper %> :<%= login_field %>, required: true, autocomplete: "off", placeholder: "<%= login_field %>" %>
+<%- end -%>
+    <%%= form.submit "Sign in as" %>
+  <%% end %>
+<%- end -%>
+</fieldset>
+<%% end %>
+<%- end -%>

data/lib/generators/authnz_eleven/templates/erb/users/sms_sessions/edit.html.erb.tt

@@ -0,0 +1,30 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Enter your code</h1>
+
+<p>Type the six-digit code we texted you.</p>
+
+<%#- The number is deliberately NOT echoed here. This page answers identically
+      whether or not the number that was submitted has an account, and printing it
+      back (even the one that was typed) invites the habit of trusting whatever
+      the page claims to know about you. -%>
+
+<%%= form_with url: <%= identity.route_scope %>_sms_sign_in_code_path, method: :patch do |form| %>
+  <div>
+    <%%= form.label :code, "Sign-in code" %><br>
+    <%%= form.text_field :code, required: true, autocomplete: "one-time-code",
+          inputmode: "numeric", pattern: "[0-9]*", autofocus: true %>
+  </div>
+
+  <div><%%= form.submit "Sign in" %></div>
+<%% end %>
+
+<%#- Resending means going back and retyping the number, deliberately. A resend
+      button here would need a second endpoint that texts whatever number the
+      pending row names, reachable by anyone who reached this page, and it would
+      buy very little, since the request form is one click away. -%>
+<p>
+  <%%= link_to "Didn't get it? Request another code", <%= identity.route_scope %>_sms_sign_in_path %> |
+  <%%= link_to "Back to sign in", <%= identity.route_scope %>_sign_in_path %>
+</p>

data/lib/generators/authnz_eleven/templates/erb/users/sms_sessions/new.html.erb.tt

@@ -0,0 +1,22 @@
+<p style="color: green"><%%= notice %></p>
+<p style="color: red"><%%= alert %></p>
+
+<h1>Sign in with a code</h1>
+
+<p>Enter your phone number and we'll text you a six-digit code to sign in with.</p>
+
+<%%= form_with url: <%= identity.route_scope %>_sms_sign_in_path, method: :post<%= captcha_form_options %> do |form| %>
+  <div>
+    <%%= form.label :phone, "Phone number" %><br>
+    <%%= form.telephone_field :phone, required: true, autofocus: true, autocomplete: "tel" %>
+  </div>
+
+<%- if captchable? -%>
+
+  <%%= render "shared/captcha" %>
+<%- end -%>
+
+  <div><%%= form.submit "Text me a code" %></div>
+<%% end %>
+
+<p><%%= link_to "Back to sign in", <%= identity.route_scope %>_sign_in_path %></p>

data/lib/generators/authnz_eleven/templates/erb/users/sudos/new.html.erb.tt

@@ -0,0 +1,9 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Confirm it's you</h1>
+
+<p><%%= session[:<%= session_key(:sudo_message) %>].presence || "Please confirm it's you before continuing." %></p>
+
+<%%= form_with url: <%= identity.route_scope %>_sudo_path, method: :post do |form| %>
+  <%%= render "<%= identity.sudo_partial %>", form:, submit: "Confirm" %>
+<%% end %>

data/lib/generators/authnz_eleven/templates/javascript/controllers/webauthn_controller.js.tt

@@ -0,0 +1,142 @@
+import { Controller } from "@hotwired/stimulus"
+import { FetchRequest } from "@rails/request.js"
+
+export default class WebauthnController extends Controller {
+  static targets = [ "error", "button", "supportText", "field" ]
+  static classes = [ "loading" ]
+  static values = {
+    challengeUrl: String,
+    verificationUrl: String,
+    fallbackUrl: String,
+    retryText: { type: String, default: "Retry" },
+    notAllowedText: { type: String, default: "That didn't work. Either it was cancelled or took too long. Please try again." },
+    invalidStateText: { type: String, default: "We couldn't add that security key. Please confirm you haven't already registered it, then try again." },
+    unsupportedText: { type: String, default: "This browser can't use passkeys or security keys. Please try again in an up-to-date browser." }
+  }
+
+  connect() {
+    if (!this.supported()) {
+      this.handleUnsupportedBrowser()
+    }
+  }
+
+  getCredential() {
+    this.hideError()
+    this.disableForm()
+    this.requestChallengeAndVerify("get")
+  }
+
+  createCredential() {
+    this.hideError()
+    this.disableForm()
+    this.requestChallengeAndVerify("create")
+  }
+
+
+  supported() {
+    return typeof PublicKeyCredential !== "undefined" &&
+      typeof navigator.credentials !== "undefined" &&
+      typeof PublicKeyCredential.parseCreationOptionsFromJSON === "function" &&
+      typeof PublicKeyCredential.parseRequestOptionsFromJSON === "function" &&
+      typeof PublicKeyCredential.prototype.toJSON === "function"
+  }
+
+  handleUnsupportedBrowser() {
+    this.buttonTarget.disabled = true
+
+    if (this.fallbackUrlValue) return window.location.replace(this.fallbackUrlValue)
+
+    if (this.hasErrorTarget) {
+      this.errorTarget.textContent = this.unsupportedTextValue
+      this.errorTarget.hidden = false
+    }
+    this.supportTextTargets.forEach(target => target.hidden = !target.hidden)
+  }
+
+  async requestChallengeAndVerify(mode) {
+    try {
+      const challengeResponse = await this.requestPublicKeyChallenge()
+      const credentialResponse = await this.requestCredential(mode, challengeResponse)
+
+      if (this.hasFieldTarget) {
+        this.fieldTarget.value = JSON.stringify(credentialResponse.toJSON())
+        this.element.closest("form").requestSubmit()
+      } else {
+        this.onCompletion(await this.verify(credentialResponse.toJSON()))
+      }
+    } catch (error) {
+      this.onError(error)
+    }
+  }
+
+  async requestCredential(mode, challengeResponse) {
+    if (mode === "create") {
+      return await navigator.credentials.create({
+        publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(challengeResponse)
+      })
+    } else {
+      return await navigator.credentials.get({
+        publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(challengeResponse)
+      })
+    }
+  }
+
+  async requestPublicKeyChallenge() {
+    return await this.request("get", this.challengeUrlValue)
+  }
+
+  async verify(credentialResponse) {
+    return await this.request("post", this.verificationUrlValue, {
+      body: JSON.stringify({ credential: credentialResponse }),
+      contentType: "application/json",
+      responseKind: "json"
+    })
+  }
+
+  onCompletion(response) {
+    window.location.replace(response.location)
+  }
+
+  onError(error) {
+    if (error.code === 0 && error.name === "NotAllowedError") {
+      this.errorTarget.textContent = this.notAllowedTextValue
+    } else if (error.code === 11 && error.name === "InvalidStateError") {
+      this.errorTarget.textContent = this.invalidStateTextValue
+    } else {
+      this.errorTarget.textContent = error.message
+    }
+    this.showError()
+  }
+
+  hideError() {
+    if (this.hasErrorTarget) this.errorTarget.hidden = true
+  }
+
+  showError() {
+    if (this.hasErrorTarget) {
+      this.errorTarget.hidden = false
+      this.buttonTarget.textContent = this.retryTextValue
+      this.enableForm()
+    }
+  }
+
+  enableForm() {
+    if (this.hasLoadingClass) this.element.classList.remove(this.loadingClass)
+    this.buttonTarget.disabled = false
+  }
+
+  disableForm() {
+    if (this.hasLoadingClass) this.element.classList.add(this.loadingClass)
+    this.buttonTarget.disabled = true
+  }
+
+  async request(method, url, options) {
+    const request = new FetchRequest(method, url, { responseKind: "json", ...options })
+    const response = await request.perform()
+    const body = await response.json
+
+    if (!response.ok) throw new Error(body.error ?? `Something went wrong (${response.statusCode}).`)
+
+    return body
+  }
+}

data/lib/generators/authnz_eleven/templates/jobs/authnz_eleven_deferred_job.rb.tt

@@ -0,0 +1,9 @@
+class AuthnzElevenDeferredJob < ApplicationJob
+  self.log_arguments = false
+
+  discard_on ActiveJob::DeserializationError
+
+  def perform(receiver, method, *args)
+    receiver.public_send(method, *args)
+  end
+end

data/lib/generators/authnz_eleven/templates/jobs/authnz_eleven_mail_delivery_job.rb.tt

@@ -0,0 +1,3 @@
+class AuthnzElevenMailDeliveryJob < ActionMailer::MailDeliveryJob
+  self.log_arguments = false
+end

data/lib/generators/authnz_eleven/templates/jobs/sms_delivery_job.rb.tt

@@ -0,0 +1,11 @@
+class SmsDeliveryJob < ApplicationJob
+  queue_as :default
+
+  self.log_arguments = false
+
+  retry_on Sms::Twilio::TransientError, wait: :polynomially_longer, attempts: 3
+
+  def perform(to:, body:)
+    Sms.deliver(to: to, body: body)
+  end
+end

data/lib/generators/authnz_eleven/templates/lib/captcha/null.rb.tt

@@ -0,0 +1,9 @@
+module Captcha
+  module Null
+    class << self
+      def verify(_token, ip: nil) = true
+
+      def site_key = nil
+    end
+  end
+end