authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/controllers/invitations_controller_test.rb.tt

@@ -0,0 +1,230 @@
+require "test_helper"
+
+class <%= identity.namespaced? ? "#{identity.module_name}::InvitationsController" : "InvitationsController" %>Test < ActionDispatch::IntegrationTest
+  include ActiveJob::TestHelper
+
+  setup { @inviter = <%= identity.plural %>(:alice) }
+<%- if teams? -%>
+
+  def invite(address, team: <%= identity.team_class %>.create!(name: "Acme"))
+    <%= identity.invitation_class %>.create!(sent_to: address, inviter: @inviter, team:)
+  end
+<%- else -%>
+
+  def invite(address) = <%= identity.invitation_class %>.create!(sent_to: address, inviter: @inviter)
+<%- end -%>
+
+<%- if teams? -%>
+  test "opening the link while signed in spends nothing until it is confirmed" do
+    invitee = <%= identity.plural %>(:bob)
+    invitation = invite(invitee.<%= email_invitable? ? "email" : "phone" %>)
+    sign_in_as invitee
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.offer)
+
+    assert_response :success
+    assert_not invitation.reload.accepted?
+  end
+
+  test "an existing account signs in, comes back to the invitation, and accepts it" do
+    invitee = <%= identity.plural %>(:bob)
+    invitation = invite(invitee.<%= email_invitable? ? "email" : "phone" %>)
+    token = invitation.offer
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: token)
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: token), session[:<%= interrupted_destination_key %>]
+
+    sign_in_as invitee
+    assert_not invitation.reload.accepted?, "signing in accepts nothing"
+
+    patch <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: token)
+    assert_predicate invitation.reload, :accepted?
+    assert invitee.member_of?(invitation.team)
+    assert_equal "You've joined Acme.", flash[:notice]
+  end
+
+  test "a second invitation to a team already joined is accepted without a second membership" do
+    invitee = <%= identity.plural %>(:bob)
+    team = <%= identity.team_class %>.create!(name: "Acme")
+    first = invite(invitee.<%= email_invitable? ? "email" : "phone" %>, team:)
+    second = invite(invitee.<%= email_invitable? ? "email" : "phone" %>, team:)
+
+    assert first.accept(invitee)
+    assert second.accept(invitee)
+    assert_equal 1, team.memberships.where(<%= identity.singular %>: invitee).count
+  end
+
+  test "confirming spends the invitation its own link names" do
+    invitee = <%= identity.plural %>(:bob)
+    mine = invite(invitee.<%= email_invitable? ? "email" : "phone" %>)
+    token = mine.offer
+    stale = invite(invitee.<%= email_invitable? ? "email" : "phone" %>)
+    sign_in_as invitee
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: stale.offer)
+    patch <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: token)
+
+    assert mine.reload.accepted?, "the confirmed link is the one that gets spent"
+    assert_not stale.reload.accepted?, "the session's last link is not spent by another link's button"
+  end
+
+  test "accepting while signed in lands on the invited team" do
+    invitee = <%= identity.plural %>(:bob)
+    invitee.memberships.create!(team: <%= identity.team_class %>.create!(name: "Original"))
+    invitation = invite(invitee.<%= email_invitable? ? "email" : "phone" %>)
+    sign_in_as invitee
+
+    patch <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.offer)
+
+<%- if scope_teams? -%>
+    assert_redirected_to <%= team_root_helper %>(team_id: invitation.team)
+<%- elsif middleware_teams? -%>
+    assert_redirected_to root_url(script_name: "/#{invitation.team.id}")
+<%- else -%>
+    assert_equal invitation.team, invitee.sessions.sole.team
+<%- end -%>
+    assert_equal "You've joined Acme.", flash[:notice]
+  end
+
+  test "an invitation with no team whose address signed up first is accepted and the account still holds for a team" do
+    invitee = <%= identity.plural %>(:bob)
+    invitee.memberships.destroy_all
+    invitation = invite(<%= email_invitable? ? '"stranger-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>, team: nil)
+    invitation.update_column(:sent_to, invitee.<%= email_invitable? ? "email" : "phone" %>)
+    sign_in_as invitee
+
+    patch <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.offer)
+
+    assert invitation.reload.accepted?
+<%- if team_gated_page -%>
+    get <%= team_gated_page %>
+    assert_redirected_to <%= identity.nested_helper("teams_path") %>
+<%- end -%>
+  end
+<%- else -%>
+  test "an existing account has nothing to accept" do
+    invitee = <%= identity.plural %>(:bob)
+    invitation = invite(<%= email_invitable? ? '"stranger-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>)
+    sign_in_as invitee
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.offer)
+
+    assert_redirected_to <%= identity.namespaced? ? "#{identity.route_scope}_root_path" : "root_path" %>
+    assert_not invitation.reload.accepted?
+  end
+<%- end -%>
+
+  test "a tampered invitation link is refused" do
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: "not-a-real-token")
+    assert_redirected_to <%= identity.namespaced? ? "#{identity.route_scope}_root_path" : "root_path" %>
+  end
+
+  test "a stranger accepting an invitation is routed to create an account" do
+    destination = <%= email_invitable? ? '"invitee-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>
+    invitation = invite(destination)
+    token = invitation.offer
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: token)
+    assert_redirected_to <%= registration_entry_path %>
+    assert_equal token, session[:<%= session_key(:pending_invitation_token) %>],
+      "the session is the only thing carrying the invitation from here on"
+  end
+<%- if test_drivable_door? -%>
+
+  test "signing in drops the invitation from the session" do
+    invitation = invite(<%= email_invitable? ? '"invitee-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>)
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.offer)
+
+    sign_in_as <%= identity.plural %>(:bob)
+
+    assert_nil session[:<%= session_key(:pending_invitation_token) %>]
+  end
+<%- end -%>
+
+  test "changing the destination invalidates an outstanding link" do
+    invitation = invite(<%= email_invitable? ? '"first-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>)
+    token = invitation.offer
+    invitation.update!(sent_to: <%= email_invitable? ? '"second-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>)
+
+    assert_nil <%= identity.invitation_class %>.find_by_token_for(:invitation, token)
+  end
+
+  test "accepting spends the link" do
+    destination = <%= email_invitable? ? '"invitee-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>
+    invitation = invite(destination)
+    token = invitation.offer
+    invitee = <%= identity.class_name %>.create!(<%= account_fixture_literal(indent: 4) %>.merge(<%= email_invitable? ? "email" : "phone" %>: destination))
+    invitation.accept(invitee)
+
+    assert_nil <%= identity.invitation_class %>.find_by_token_for(:invitation, token)
+  end
+<%- if typed_registration? -%>
+
+  test "an invited stranger signs up and the invitation is applied" do
+    destination = <%= email_invitable? ? '"invitee-#{SecureRandom.hex(4)}@example.com"' : '"+1415555#{rand(1000..9999)}"' %>
+    invitation = invite(destination)
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.offer)
+    assert_redirected_to <%= identity.route_scope %>_sign_up_path
+
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(<%= email_invitable? ? "email" : "phone" %>: destination)
+
+<%- unless email_invitable? ? email_invitation_completes_registration? : phone_invitation_completes_registration? -%>
+    assert_nil <%= identity.class_name %>.find_by(<%= email_invitable? ? "email" : "phone" %>: destination)
+    assert <%= identity.pending_registration_class %>.exists?
+    assert_not_predicate invitation.reload, :accepted?
+<%- else -%>
+    <%= identity.singular %> = <%= identity.class_name %>.find_by(<%= email_invitable? ? "email" : "phone" %>: destination)
+    assert <%= identity.singular %>, "clicking the invitation verifies the address, so the account is minted here"
+    assert_predicate invitation.reload, :accepted?
+    assert_equal <%= identity.singular %>, invitation.invitee
+<%- if teams? -%>
+    assert <%= identity.singular %>.member_of?(invitation.team)
+<%- end -%>
+<%- end -%>
+  end
+<%- if phone_invitable? -%>
+
+  test "a phone invitation signs up without sending a verification code" do
+    number = "+1415555#{rand(1000..9999)}"
+    invitation = invite(number)
+    token = invitation.offer
+    clear_enqueued_jobs
+
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: token)
+    assert_redirected_to <%= identity.route_scope %>_sign_up_path
+
+    assert_no_enqueued_jobs only: SmsDeliveryJob do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params.except(:phone)
+    end
+
+<%- unless phone_invitation_completes_registration? -%>
+    assert_nil <%= identity.class_name %>.find_by(phone: number)
+    assert <%= identity.pending_registration_class %>.exists?
+    assert_not_predicate invitation.reload, :accepted?
+<%- else -%>
+    <%= identity.singular %> = <%= identity.class_name %>.find_by(phone: number)
+    assert <%= identity.singular %>
+    assert_predicate invitation.reload, :accepted?
+    assert_equal <%= identity.singular %>, invitation.invitee
+<%- if teams? -%>
+    assert <%= identity.singular %>.member_of?(invitation.team)
+<%- end -%>
+<%- end -%>
+  end
+<%- end -%>
+<%- end -%>
+
+  private
+<%- if typed_registration? -%>
+
+  def sign_up_params(**overrides)
+    <%= sign_up_fixture_literal(indent: 4) %>.merge(overrides)
+  end
+<%- end -%>
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/passkey_ceremony_test.rb.tt

@@ -0,0 +1,126 @@
+require "test_helper"
+require "webauthn/fake_client"
+
+class <%= identity.module_name %>::PasskeyCeremonyTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    @authenticator = WebAuthn::FakeAuthenticator.new
+    @client = WebAuthn::FakeClient.new(
+      WebAuthn.configuration.allowed_origins.first,
+      authenticator: @authenticator
+    )
+  end
+
+  test "passkey enrollment requires user verification" do
+    sign_in @user
+
+    assert_no_difference -> { @user.webauthn_credentials.count } do
+      enroll_passkey(user_verified: false)
+    end
+    assert_response :unprocessable_entity
+  end
+
+  test "a verified passkey enrolls and signs in" do
+    sign_in @user
+    assert_difference -> { @user.webauthn_credentials.count }, 1 do
+      enroll_passkey(user_verified: true)
+    end
+    assert_response :created
+
+    sign_out
+    assert_difference -> { @user.sessions.count }, 1 do
+      sign_in_with_passkey(user_verified: true)
+    end
+    assert_response :created
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "a replayed passkey assertion is refused, not an error" do
+    sign_in @user
+    enroll_passkey(user_verified: true)
+    sign_out
+
+    credential = sign_in_with_passkey(user_verified: true)
+    assert_response :created
+    sign_out
+
+    assert_no_difference -> { @user.sessions.count } do
+      post <%= identity.route_scope %>_passkeys_session_path, params: { credential: credential }, as: :json
+    end
+    assert_response :unprocessable_entity
+  end
+
+  test "passkey sign-in requires user verification" do
+    sign_in @user
+    enroll_passkey(user_verified: true)
+    sign_out
+
+    assert_no_difference -> { @user.sessions.count } do
+      sign_in_with_passkey(user_verified: false)
+    end
+    assert_response :unprocessable_entity
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+<%- if sudoable? -%>
+
+  test "a passkey satisfies the sudo challenge on a guarded action" do
+    sign_in @user
+    enroll_passkey(user_verified: true)
+
+    assert_no_difference -> { <%= identity.class_name %>.count }, "no assertion, no deletion" do
+      delete <%= identity.settings_helper_prefix %>_user_path, params: { confirmation: "DELETE ACCOUNT" }
+    end
+
+    assert_difference -> { <%= identity.class_name %>.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_user_path,
+        params: { confirmation: "DELETE ACCOUNT", sudo_credential: <%= identity.route_scope %>_sudo_assertion }
+    end
+  end
+<%- end -%>
+
+  private
+
+  def clear_sudo_bar
+<%= test_clear_sudo_body %>
+  end
+
+  def enroll_passkey(user_verified:)
+    clear_sudo_bar
+    get new_<%= identity.settings_helper_prefix %>_passkey_path, as: :json
+    credential = @client.create(
+      challenge: response.parsed_body.fetch("challenge"),
+      rp_id: WebAuthn.configuration.rp_id,
+      user_verified: user_verified
+    )
+
+    post <%= identity.settings_helper_prefix %>_passkeys_path,
+      params: { credential: credential }, as: :json
+  end
+
+  def sign_in_with_passkey(user_verified:)
+    get new_<%= identity.route_scope %>_passkeys_session_path, as: :json
+    credential = @client.get(
+      challenge: response.parsed_body.fetch("challenge"),
+      rp_id: WebAuthn.configuration.rp_id,
+      user_handle: @user.webauthn_handle,
+      user_verified: user_verified
+    )
+
+    post <%= identity.route_scope %>_passkeys_session_path,
+      params: { credential: credential }, as: :json
+    credential
+  end
+
+  def sign_in(user)
+    record = user.sessions.create!
+    env = Rails.application.env_config.merge("HTTP_HOST" => "www.example.com")
+    jar = ActionDispatch::Request.new(env).cookie_jar
+    jar.signed[:<%= identity.cookie_name %>] = record.id
+    cookies[:<%= identity.cookie_name %>] = jar[:<%= identity.cookie_name %>]
+  end
+
+  def sign_out
+    delete <%= identity.route_scope %>_sign_out_path
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/password_rotation_test.rb.tt

@@ -0,0 +1,67 @@
+require "test_helper"
+
+class <%= identity.module_name %>::PasswordRotationTest < ActionDispatch::IntegrationTest
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "a <%= identity.singular %> with an expired password is held at the change-password page" do
+    expire_password
+    assert_not @user.reload.password_fresh?
+    sign_in_as @user
+
+    get <%= identity.settings_helper_prefix %>_path
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_password_path
+  end
+
+  test "the change-password page itself stays reachable while held" do
+    expire_password
+    sign_in_as @user
+
+    get edit_<%= identity.settings_helper_prefix %>_password_path
+    assert_response :success
+  end
+
+  test "signing out is allowed even while held (never trapped in purgatory)" do
+    expire_password
+    sign_in_as @user
+
+    assert_difference -> { @user.sessions.count }, -1 do
+      delete <%= identity.route_scope %>_sign_out_path
+    end
+    assert_response :redirect
+  end
+
+  test "a <%= identity.singular %> with a current password passes the gate" do
+    assert @user.password_fresh?, "fixture password should start fresh"
+    sign_in_as @user
+
+    get <%= identity.settings_helper_prefix %>_path
+    assert_response :success
+  end
+
+  test "changing the password clears the gate" do
+    expire_password
+    sign_in_as @user
+
+    patch <%= identity.settings_helper_prefix %>_password_path, params: {
+      password_challenge: "quilted-lantern-moss-97",
+      password: "amber-thicket-90-vale",
+      password_confirmation: "amber-thicket-90-vale"
+    }
+    assert @user.reload.password_fresh?, "a fresh password stamps password_changed_at"
+
+    get <%= identity.settings_helper_prefix %>_path
+    assert_response :success
+  end
+
+  private
+
+  def expire_password
+    # Bypass the password-change callback so it does not replace the backdated timestamp.
+    @user.update_column(:password_changed_at, (<%= identity.config_reference %>.password.maximum_age + 1.day).ago)
+  end
+
+  def sign_in_as(user)
+    post <%= identity.route_scope %>_sign_in_path,
+      params: { <%= sign_in_field %>: user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/security_key_ceremony_test.rb.tt

@@ -0,0 +1,218 @@
+require "test_helper"
+require "webauthn/fake_client"
+
+class <%= identity.module_name %>::SecurityKeyCeremonyTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    @authenticator = WebAuthn::FakeAuthenticator.new
+    @client = WebAuthn::FakeClient.new(
+      WebAuthn.configuration.allowed_origins.first,
+      authenticator: @authenticator
+    )
+  end
+
+  test "a security key enrolls as a possession-only second factor" do
+    sign_in @user
+
+    assert_difference -> { @user.webauthn_credentials.count }, 1 do
+      enroll_security_key
+    end
+    assert_response :success
+    assert_equal "text/html", response.media_type
+
+    codes = response.body.scan(%r{<code>([a-z0-9]+)</code>}).flatten
+    assert_equal <%= identity.config_reference %>.second_factor.recovery_code_count, codes.length
+    assert_equal codes.length, @user.recovery_codes.count
+    assert <%= identity.recovery_code_class %>.redeem(user: @user, code: codes.first)
+
+    get <%= identity.settings_helper_prefix %>_mfa_security_keys_path
+    assert_response :success
+    codes.each { |code| assert_not_includes response.body, code }
+  end
+
+  test "the enrollment form opts out of Turbo" do
+    sign_in @user
+    clear_sudo_bar
+    get new_<%= identity.settings_helper_prefix %>_mfa_security_key_path
+
+    assert_select 'form[action=?][method="post"][data-turbo="false"]', <%= identity.settings_helper_prefix %>_mfa_security_keys_path
+  end
+
+  test "another key preserves the existing recovery codes" do
+    sign_in @user
+    enroll_security_key
+    codes = @user.recovery_codes.pluck(:code_digest).sort
+    assert_not_empty codes
+
+    assert_difference -> { @user.webauthn_credentials.count }, 1 do
+      enroll_security_key
+    end
+
+    assert_response :see_other
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_mfa_security_key_path(@user.webauthn_credentials.order(:id).last)
+    assert_equal codes, @user.recovery_codes.reload.pluck(:code_digest).sort
+  end
+
+  test "a recovery-code failure rolls back enrollment" do
+    sign_in @user
+    credential = security_key_credential
+
+    assert_no_difference -> { @user.webauthn_credentials.count } do
+      failing_recovery_codes do
+        assert_raises(RuntimeError) do
+          post <%= identity.settings_helper_prefix %>_mfa_security_keys_path, params: { credential: credential.to_json }
+        end
+      end
+    end
+    assert_empty @user.recovery_codes.reload
+  end
+
+  test "malformed enrollment renders a retry form" do
+    sign_in @user
+    security_key_credential
+
+    [ nil, "not json" ].each do |malformed|
+      assert_no_difference -> { @user.webauthn_credentials.count } do
+        post <%= identity.settings_helper_prefix %>_mfa_security_keys_path, params: { credential: malformed }
+      end
+      assert_response :unprocessable_entity
+      assert_select '[data-webauthn-target="field"]'
+      assert_select "p", text: "We couldn't add that security key. Please try again."
+    end
+
+    enroll_security_key
+    assert_response :success
+  end
+<%- if admin_mfa_gate? && password_rotatable? -%>
+
+  test "MFA enrollment displays recovery codes before the next requirement takes over" do
+    @user = <%= identity.plural %>(:alice)
+    @user.update_column(:password_changed_at, (<%= identity.config_reference %>.password.maximum_age + 1.day).ago)
+    sign_in @user
+
+    get <%= identity.settings_helper_prefix %>_path
+    assert_redirected_to <%= admin_mfa_hold_path %>
+
+    enroll_security_key
+    assert_response :success
+    assert @user.reload.second_factor_enrolled?
+    assert_not @user.password_fresh?
+    assert_select "h1", "Save your recovery codes"
+    assert_select "li code", count: <%= identity.config_reference %>.second_factor.recovery_code_count
+    assert_nil flash[:alert]
+
+    post complete_<%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_password_path
+  end
+<%- end -%>
+
+  test "a replayed enrollment is refused, not an error" do
+    sign_in @user
+    credential = enroll_security_key
+    assert_response :success
+
+    assert_no_difference -> { @user.webauthn_credentials.count } do
+      post <%= identity.settings_helper_prefix %>_mfa_security_keys_path,
+        params: { credential: credential.to_json }
+    end
+    assert_response :unprocessable_entity
+  end
+<%- if password? -%>
+
+  test "a security key clears the second-factor challenge" do
+    sign_in @user
+    enroll_security_key
+    sign_out
+
+    start_first_factor(@user)
+
+    get new_<%= identity.route_scope %>_mfa_challenge_security_keys_path, as: :json
+    credential = @client.get(
+      challenge: response.parsed_body.fetch("challenge"),
+      rp_id: WebAuthn.configuration.rp_id,
+      user_verified: false
+    )
+
+    assert_difference -> { @user.sessions.count }, 1 do
+      post <%= identity.route_scope %>_mfa_challenge_security_keys_path,
+        params: { credential: credential }, as: :json
+    end
+    assert_response :created
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- end -%>
+
+  test "a security key can be removed" do
+    sign_in @user
+    enroll_security_key
+
+    assert_difference -> { @user.webauthn_credentials.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_mfa_security_key_path(@user.webauthn_credentials.sole)
+    end
+  end
+<%- if sudoable? -%>
+
+  test "a security key satisfies the sudo challenge on a guarded action" do
+    sign_in @user
+    enroll_security_key
+
+    assert_no_difference -> { <%= identity.class_name %>.count }, "no assertion, no deletion" do
+      delete <%= identity.settings_helper_prefix %>_user_path, params: { confirmation: "DELETE ACCOUNT" }
+    end
+
+    assert_difference -> { <%= identity.class_name %>.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_user_path,
+        params: { confirmation: "DELETE ACCOUNT", sudo_credential: <%= identity.route_scope %>_sudo_assertion }
+    end
+  end
+<%- end -%>
+
+  private
+
+  def failing_recovery_codes
+    original = <%= identity.recovery_code_class %>.method(:regenerate_for)
+    <%= identity.recovery_code_class %>.define_singleton_method(:regenerate_for) { |*| raise "Recovery codes unavailable" }
+    yield
+  ensure
+    <%= identity.recovery_code_class %>.define_singleton_method(:regenerate_for, original)
+  end
+
+  def clear_sudo_bar
+<%= test_clear_sudo_body %>
+  end
+
+  def enroll_security_key
+    credential = security_key_credential
+    post <%= identity.settings_helper_prefix %>_mfa_security_keys_path,
+      params: { credential: credential.to_json }
+    credential
+  end
+
+  def security_key_credential
+    clear_sudo_bar
+    get new_<%= identity.settings_helper_prefix %>_mfa_security_key_path, as: :json
+    @client.create(
+      challenge: response.parsed_body.fetch("challenge"),
+      rp_id: WebAuthn.configuration.rp_id,
+      user_verified: false # User verification is optional here because the password is the first factor.
+    )
+  end
+
+  def sign_in(user)
+    record = user.sessions.create!
+    env = Rails.application.env_config.merge("HTTP_HOST" => "www.example.com")
+    jar = ActionDispatch::Request.new(env).cookie_jar
+    jar.signed[:<%= identity.cookie_name %>] = record.id
+    cookies[:<%= identity.cookie_name %>] = jar[:<%= identity.cookie_name %>]
+  end
+
+  def sign_out
+    delete <%= identity.route_scope %>_sign_out_path
+  end
+<%- if password? -%>
+
+  def start_first_factor(user)
+<%= test_sign_in_body %>
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/security_notifications_test.rb.tt

@@ -0,0 +1,39 @@
+require "test_helper"
+
+class <%= identity.module_name %>::SecurityNotificationsTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "revoking a session emails the account" do
+    sign_in_as @user
+    other_session = @user.sessions.create!
+
+    assert_security_notification(:session_revoked) do
+      delete <%= identity.settings_helper_prefix %>_session_path(other_session)
+    end
+  end
+<%- if password? -%>
+
+  test "changing the password emails the account" do
+    sign_in_as @user
+
+    assert_security_notification(:password_changed) do
+      patch <%= identity.settings_helper_prefix %>_password_path,
+        params: { password_challenge: "quilted-lantern-moss-97", password: "heron-basalt-drift-41",
+                  password_confirmation: "heron-basalt-drift-41" }
+    end
+  end
+<%- end -%>
+
+  private
+
+  def assert_security_notification(event, &block)
+    expected = ->(params) { params[:to] == @user.email && params[:event] == event }
+    assert_enqueued_email_with <%= identity.mailer_class %>, :security_notification, params: expected, &block
+  end
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end