authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/lib/captcha/turnstile.rb.tt

@@ -0,0 +1,39 @@
+require "net/http"
+
+module Captcha
+  module Turnstile
+    VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify".freeze
+
+    class << self
+      def verify(token, ip: nil)
+        return false if token.blank?
+
+        response = Net::HTTP.post_form(URI(VERIFY_URL), {
+          "secret" => secret_key,
+          "response" => token,
+          "remoteip" => ip
+        }.compact)
+        response.is_a?(Net::HTTPSuccess) && JSON.parse(response.body)["success"] == true
+      rescue => e
+        Rails.logger.error("[captcha] Turnstile verification error: #{e.class}: #{e.message}")
+        false
+      end
+
+      def site_key
+        ENV["TURNSTILE_SITE_KEY"] || Rails.application.credentials.dig(:turnstile, :site_key) || test_key("1x00000000000000000000AA")
+      end
+
+      def secret_key
+        ENV["TURNSTILE_SECRET_KEY"] || Rails.application.credentials.dig(:turnstile, :secret_key) || test_key("1x0000000000000000000000000000000AA")
+      end
+
+      private
+
+      def test_key(key)
+        raise "Set TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY (or turnstile.site_key / turnstile.secret_key in credentials)" unless Rails.env.local?
+
+        key
+      end
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/lib/captcha.rb.tt

@@ -0,0 +1,15 @@
+module Captcha
+  class << self
+    def verify(token, ip: nil)
+      provider.verify(token, ip:)
+    end
+
+    def site_key
+      provider.site_key
+    end
+
+    def provider
+      Rails.env.test? ? Null : Turnstile
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/lib/sms/log.rb.tt

@@ -0,0 +1,8 @@
+module Sms
+  module Log
+    def self.deliver(to:, body:)
+      Rails.logger.info("[sms] to=#{to} body=#{body}")
+      true
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/lib/sms/twilio.rb.tt

@@ -0,0 +1,70 @@
+require "net/http"
+
+module Sms
+  module Twilio
+    class DeliveryError < StandardError; end
+    class TransientError < DeliveryError; end
+
+    API_HOST = "api.twilio.com".freeze
+    API_VERSION = "2010-04-01".freeze
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 10
+
+    class << self
+      def deliver(to:, body:)
+        raise DeliveryError, "Twilio credentials are not configured" if account_sid.blank? || auth_token.blank?
+
+        response = post(to: to, body: body)
+        return true if response.is_a?(Net::HTTPSuccess)
+        raise TransientError, "Twilio responded #{response.code}" if retryable?(response)
+
+        raise DeliveryError, "Twilio responded #{response.code} (error #{error_code(response)})"
+      end
+
+      private
+
+      def post(to:, body:)
+        uri = URI("https://#{API_HOST}/#{API_VERSION}/Accounts/#{account_sid}/Messages.json")
+        params = { "To" => to, "Body" => body }.merge(sender_param)
+
+        request = Net::HTTP::Post.new(uri)
+        request.basic_auth(account_sid, auth_token)
+        request.set_form_data(params)
+
+        Net::HTTP.start(uri.hostname, uri.port, use_ssl: true,
+          open_timeout: OPEN_TIMEOUT, read_timeout: READ_TIMEOUT) { |http| http.request(request) }
+      rescue Net::ReadTimeout
+        raise DeliveryError, "Twilio did not answer in time; the message may have been sent"
+      rescue Net::OpenTimeout, Net::WriteTimeout, SocketError, SystemCallError => e
+        raise TransientError, "Twilio unreachable (#{e.class})"
+      end
+
+      def retryable?(response) = response.is_a?(Net::HTTPServerError) || response.code == "429"
+
+      def error_code(response)
+        JSON.parse(response.body)["code"]
+      rescue StandardError
+        "unknown"
+      end
+
+      def sender_param
+        if messaging_service_sid.present?
+          { "MessagingServiceSid" => messaging_service_sid }
+        elsif from_number.present?
+          { "From" => from_number }
+        else
+          raise DeliveryError, "Set TWILIO_MESSAGING_SERVICE_SID or TWILIO_FROM_NUMBER"
+        end
+      end
+
+      def account_sid = credential("TWILIO_ACCOUNT_SID", :account_sid)
+      def auth_token = credential("TWILIO_AUTH_TOKEN", :auth_token)
+      def messaging_service_sid = credential("TWILIO_MESSAGING_SERVICE_SID", :messaging_service_sid)
+      def from_number = credential("TWILIO_FROM_NUMBER", :from_number)
+
+      def credential(env_key, credentials_key)
+        ENV[env_key].presence || Rails.application.credentials.dig(:twilio, credentials_key)
+      end
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/lib/sms.rb.tt

@@ -0,0 +1,15 @@
+module Sms
+  class << self
+    def deliver_later(to:, body:)
+      SmsDeliveryJob.perform_later(to: to, body: body)
+    end
+
+    def deliver(to:, body:)
+      provider.deliver(to: to, body: body)
+    end
+
+    def provider
+      Rails.env.production? ? Twilio : Log
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/mailers/user_mailer.rb.tt

@@ -0,0 +1,98 @@
+class <%= identity.mailer_class %> < ApplicationMailer
+  self.delivery_job = AuthnzElevenMailDeliveryJob
+<%- if security_notifications? -%>
+
+  SECURITY_NOTIFICATION_SUBJECTS = {
+    password_set: "Your password was set",
+    password_changed: "Your password was changed",
+    password_reset: "Your password was reset",
+    password_removed: "Your password was removed",
+    passkey_added: "A passkey was added",
+    passkey_removed: "A passkey was removed",
+    security_key_added: "A security key was added",
+    security_key_removed: "A security key was removed",
+    authenticator_enabled: "An authenticator was enabled",
+    authenticator_disabled: "An authenticator was disabled",
+    sms_mfa_enabled: "SMS two-factor authentication was enabled",
+    sms_mfa_disabled: "SMS two-factor authentication was disabled",
+    recovery_codes_generated: "Your recovery codes were generated",
+    connected_account_linked: "A connected account was linked",
+    connected_account_unlinked: "A connected account was unlinked",
+    email_changed: "Your email address was changed",
+    phone_changed: "Your phone number was changed",
+    session_revoked: "A session was signed out",
+<%- if api_tokens? -%>
+    api_token_created: "An API token was created",
+    api_token_revoked: "An API token was revoked",
+<%- end -%>
+    sessions_revoked_by_admin: "An administrator signed out your sessions",
+    second_factor_reset_by_admin: "An administrator reset your two-factor authentication",
+    deadbolt_cleared_by_admin: "An administrator restored password sign-in",
+    account_suspended: "An administrator suspended your account",
+    account_restored: "An administrator restored your account",
+    account_deleted: "Your account was deleted"
+  }.freeze
+
+  def self.send_security_notification(event, to: <%= identity.current_class %>.user.email)
+    return if to.blank?
+
+    with(
+      to:, event:, occurred_at: Time.current,
+      ip_address: <%= identity.current_class %>.ip_address,
+      user_agent: <%= identity.current_class %>.user_agent
+    ).security_notification.deliver_later
+  end
+<%- end -%>
+<%- if email_gated_registration? -%>
+
+  def registration_email_verification
+    @signed_id = params[:signed_id]
+
+    mail to: params[:to], subject: "Verify your email to finish signing up"
+  end
+<%- end -%>
+<%- if email_change_verification? -%>
+
+  def email_change_verification
+    @signed_id = params[:signed_id]
+
+    mail to: params[:to], subject: "Verify your new email address"
+  end
+<%- end -%>
+<%- if recoverable? -%>
+
+  def password_reset
+    @signed_id = params[:signed_id]
+
+    mail to: params[:to], subject: "Reset your password"
+  end
+<%- end -%>
+<%- if magic_link? -%>
+
+  def magic_link
+    @signed_id = params[:signed_id]
+
+    mail to: params[:to], subject: "Your sign in link"
+  end
+<%- end -%>
+<%- if security_notifications? -%>
+
+  def security_notification
+    @subject = SECURITY_NOTIFICATION_SUBJECTS.fetch(params[:event].to_sym)
+    @occurred_at = params[:occurred_at]
+    @ip_address = params[:ip_address]
+    @user_agent = params[:user_agent]
+
+    mail to: params[:to], subject: @subject
+  end
+<%- end -%>
+<%- if email_invitable? -%>
+
+  def invitation
+    @invitation = params[:invitation]
+    @signed_id = params[:signed_id]
+
+    mail to: params[:to], subject: "You've been invited to #{<%= identity.config_reference %>.app_name}"
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/migrations/add_guest_to_users_migration.rb.tt

@@ -0,0 +1,6 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    add_column :<%= identity.table %>, :guest, :boolean, null: false, default: false
+    add_index  :<%= identity.table %>, :guest, where: "guest", name: "index_<%= identity.table %>_on_guest"
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_api_tokens_migration.rb.tt

@@ -0,0 +1,14 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.api_tokens_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+      t.string :name, null: false
+      t.string :token_digest, null: false
+      t.datetime :expires_at, null: false
+
+      t.timestamps
+    end
+
+    add_index :<%= identity.api_tokens_table %>, :token_digest, unique: true
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_events_migration.rb.tt

@@ -0,0 +1,26 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.events_table %><%= primary_key_options %> do |t|
+      t.string :event_type, null: false
+
+      t.references :subject, polymorphic: true, null: false, index: false<%= reference_type_options %>
+      t.references :actor,   polymorphic: true, index: false<%= reference_type_options %>
+      t.references :context, polymorphic: true, index: false<%= reference_type_options %>
+
+      t.datetime :occurred_at, null: false
+      t.json :data
+
+      t.string :ip_address
+      t.string :user_agent
+      t.string :request_id
+
+      t.timestamps
+    end
+
+    add_index :<%= identity.events_table %>, :event_type
+    add_index :<%= identity.events_table %>, :request_id
+    add_index :<%= identity.events_table %>, [ :subject_type, :subject_id, :occurred_at ]
+    add_index :<%= identity.events_table %>, [ :context_type, :context_id, :occurred_at ]
+    add_index :<%= identity.events_table %>, [ :actor_type, :actor_id ]
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_invitations_migration.rb.tt

@@ -0,0 +1,20 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.invitations_table %><%= primary_key_options %> do |t|
+      t.string :sent_to, null: false, index: true
+<%- if multi_channel_invitable? -%>
+      t.string :sent_to_channel, null: false
+<%- end -%>
+      t.datetime :expires_at
+      t.datetime :accepted_at
+
+      t.references :inviter,    null: false, foreign_key: { to_table: :<%= identity.table %> }<%= reference_type_options %>
+      t.references :invitee,    foreign_key: { to_table: :<%= identity.table %> }<%= reference_type_options %>
+<%- if teams? -%>
+      t.references :team,       foreign_key: <%= team_foreign_key %><%= reference_type_options %>
+<%- end -%>
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_memberships_migration.rb.tt

@@ -0,0 +1,12 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.memberships_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+      t.references :team, null: false, foreign_key: <%= team_foreign_key %><%= reference_type_options %>
+
+      t.timestamps
+    end
+
+    add_index :<%= identity.memberships_table %>, [ :<%= identity.foreign_key %>, :team_id ], unique: true
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_omniauth_identities_migration.rb.tt

@@ -0,0 +1,16 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.omniauth_identities_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+      t.string :provider, null: false
+      t.string :uid,      null: false
+
+      t.timestamps
+    end
+
+    # A provider UID is meaningful and unique only within its provider.
+    add_index :<%= identity.omniauth_identities_table %>, %i[provider uid], unique: true
+
+    add_index :<%= identity.omniauth_identities_table %>, %i[<%= identity.foreign_key %> provider]
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_password_histories_migration.rb.tt

@@ -0,0 +1,11 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.password_histories_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+      # Each row stores an old password digest; Authenticatable prunes rows to the configured history depth.
+      t.string :password_digest, null: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_pending_registrations_migration.rb.tt

@@ -0,0 +1,31 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.pending_registrations_table %><%= primary_key_options %> do |t|
+<%- principals.each do |principal| -%>
+      # Do not add principal uniqueness here: an unverified or abandoned claim must not reserve another person's identifier.
+      t.string   :<%= principal.column %>
+<%- end -%>
+<%- if password? -%>
+      t.string   :password_digest
+<%- end -%>
+<%- if email_verifiable? -%>
+      t.datetime :email_verified_at
+<%- end -%>
+<%- if phone_verifiable? -%>
+      t.datetime :phone_verified_at
+<%- end -%>
+<%- if pre_account_passkey_enrollment? -%>
+      t.string   :webauthn_handle
+<%- end -%>
+<%- if pending_registration_holds_provider? -%>
+      t.string   :provider
+      t.string   :uid
+<%- end -%>
+<%- if invitable? -%>
+      t.references :invitation, null: <%= !invite_only? %>, foreign_key: { to_table: :<%= identity.invitations_table %>, on_delete: :cascade }<%= reference_type_options %>
+<%- end -%>
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_recovery_codes_migration.rb.tt

@@ -0,0 +1,11 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.recovery_codes_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+      # Store only the digest; redemption deletes the row rather than marking it used.
+      t.string :code_digest, null: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_sessions_migration.rb.tt

@@ -0,0 +1,19 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.sessions_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+<%- if session_carries_team? -%>
+      t.references :team, foreign_key: <%= team_foreign_key %><%= reference_type_options %>
+<%- end -%>
+      t.string :via
+      t.string :user_agent
+<%- if sudoable? -%>
+      # Persist sudo recency on the session record so signing out clears it.
+      t.datetime :sudo_at
+<%- end -%>
+      t.string :ip_address
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_teams_migration.rb.tt

@@ -0,0 +1,9 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.teams_table %><%= primary_key_options %> do |t|
+      t.string :name, null: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_users_migration.rb.tt

@@ -0,0 +1,70 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.table %><%= primary_key_options %> do |t|
+<%- principals.each do |principal| -%>
+<%- if principal.type == :phone -%>
+<%- if guest_excused_from_phone? || (guestable? && principal.required?) -%>
+      # Nullable because guests and incomplete accounts may not have a phone yet.
+<%- end -%>
+      <%= principal.migration_field(nullable: phone_column_nullable?) %>
+<%- else -%>
+      <%= principal.migration_field %>
+<%- end -%>
+<%- end -%>
+<%- principals.select(&:functional_unique_index?).each do |principal| -%>
+      t.index "(LOWER(<%= principal.column %>))", unique: true, name: "index_<%= identity.table %>_on_lower_<%= principal.column %>"
+<%- end -%>
+<%- if password? -%>
+<%- if password_nullable? -%>
+      # Nullable because there are multiple sign in methods.
+      t.string :password_digest
+<%- else -%>
+      t.string :password_digest, null: false
+<%- end -%>
+<%- end -%>
+<%- if password_rotatable? -%>
+      t.datetime :password_changed_at
+<%- end -%>
+<%- if deadboltable? -%>
+      t.integer  :failed_attempts, null: false, default: 0
+      t.datetime :deadbolted_at
+<%- end -%>
+<%- if bannable? -%>
+      t.datetime :banned_at
+      t.datetime :banned_until
+<%- end -%>
+<%- if email_change_verification? -%>
+
+      t.string :pending_email
+<%- end -%>
+<%- if phone_change_verification? -%>
+
+      t.string :pending_phone
+<%- end -%>
+<%- if totp? -%>
+
+      t.datetime :totp_enrolled_at
+      t.string   :totp_secret, null: false
+      t.datetime :totp_last_used_at
+<%- end -%>
+<%- if sms_second_factor? -%>
+
+      t.datetime :sms_enrolled_at
+<%- end -%>
+<%- if adminable? -%>
+
+      t.boolean :admin, null: false, default: false
+<%- end -%>
+<%- if webauthn_credentials? -%>
+
+      t.string :webauthn_handle, null: false
+<%- end -%>
+<%- if last_seenable? -%>
+
+      t.datetime :last_seen_at
+<%- end -%>
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/migrations/create_webauthn_credentials_migration.rb.tt

@@ -0,0 +1,16 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= identity.webauthn_credentials_table %><%= primary_key_options %> do |t|
+      t.references :<%= identity.singular %>, null: false, foreign_key: true<%= reference_type_options %>
+      t.string :name,        null: false
+      t.string :external_id, null: false, index: { unique: true }
+      t.string :public_key,  null: false
+      t.bigint :sign_count,  null: false, default: 0
+<%- if passkey_and_security_keys? -%>
+      t.integer :authentication_factor, null: false
+<%- end -%>
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authnz_eleven/templates/models/api_token.rb.tt

@@ -0,0 +1,24 @@
+class <%= identity.api_token_class %> < ApplicationRecord
+  belongs_to :<%= identity.singular %>
+<%- if identity.namespaced? -%>
+
+  alias_method :user, :<%= identity.singular %>
+<%- end -%>
+
+  validates :name, presence: true, length: { maximum: 100 }
+  validates :token_digest, presence: true, uniqueness: true
+  validates :expires_at, presence: true
+
+  def self.issue!(user:, name:)
+    secret = "ae11_#{SecureRandom.urlsafe_base64(32)}"
+    token = user.api_tokens.create!(name:, token_digest: Digest::SHA256.hexdigest(secret), expires_at: 90.days.from_now)
+    [ token, secret ]
+  end
+
+  def self.authenticate(secret)
+    return unless secret&.start_with?("ae11_") && secret.bytesize == 48
+
+    token = includes(:<%= identity.singular %>).find_by(token_digest: Digest::SHA256.hexdigest(secret))
+    token if token && token.expires_at.future?<%= " && !token.user.guest?" if guestable? %>
+  end
+end

data/lib/generators/authnz_eleven/templates/models/concerns/adminable.rb.tt

@@ -0,0 +1,15 @@
+module <%= identity.class_name %>::Adminable
+  extend ActiveSupport::Concern
+
+  included do
+    attr_readonly :admin # Prevent mass assignment or ordinary updates from elevating an existing account.
+
+    scope :admins, -> { where(admin: true) }
+  end
+<%- if admin_mfa_gate? -%>
+
+  def admin_mfa_enrolled?
+    !admin? || second_factor_enrolled?
+  end
+<%- end -%>
+end