authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/registrations_controller_test.rb.tt

@@ -0,0 +1,180 @@
+require "test_helper"
+
+class <%= identity.module_name %>::RegistrationsControllerTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+
+  setup { @existing = <%= identity.plural %>(:alice) }
+<%- if invite_only? -%>
+
+  test "sign up is gated behind an invitation" do
+    get <%= identity.route_scope %>_sign_up_path
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+<%- else -%>
+
+  test "sign up page renders" do
+    get <%= identity.route_scope %>_sign_up_path
+    assert_response :success
+  end
+
+<%- if typed_staged_registration? -%>
+  test "a valid sign up stages a claim without creating an account" do
+    assert_difference -> { <%= identity.pending_registration_class %>.count }, 1 do
+      assert_no_difference -> { <%= identity.class_name %>.count } do
+        post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+      end
+    end
+  end
+<%- if password_on_sign_up_form? -%>
+
+  # A claim carries the password typed beside it. Superseding would hand whoever
+  # signs up last the credential the first person's link installs, so claims stand
+  # on their own: your link always mints the password you typed.
+  test "a second claim on one identifier leaves the first standing" do
+    claimed = sign_up_params
+    post <%= identity.route_scope %>_sign_up_path, params: claimed
+    first = <%= identity.pending_registration_class %>.last
+
+    assert_difference -> { <%= identity.pending_registration_class %>.count }, 1 do
+      post <%= identity.route_scope %>_sign_up_path, params: claimed
+    end
+    assert <%= identity.pending_registration_class %>.exists?(first.id)
+  end
+<%- end -%>
+<%- else -%>
+  test "a valid sign up creates the account" do
+    assert_difference -> { <%= identity.class_name %>.count }, 1 do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    end
+  end
+<%- end -%>
+<%- if principals.phone -%>
+<%- if typed_phone_gated_registration? && coy? && principals.email.nil? -%>
+
+  test "an already-registered phone is answered like a free one" do
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(phone: @existing.phone)
+    end
+    assert_redirected_to <%= identity.route_scope %>_verify_phone_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- else -%>
+
+<%- if typed_staged_registration? && coy? -%>
+  test "an already-registered phone is staged like any other" do
+    assert_difference -> { <%= identity.pending_registration_class %>.count }, 1 do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(phone: @existing.phone)
+    end
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- else -%>
+  test "an already-registered phone is rejected" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(phone: @existing.phone)
+    assert_response :unprocessable_entity
+  end
+<%- end -%>
+<%- end -%>
+<%- if typed_phone_gated_registration? && coy? && principals.email&.optional? -%>
+
+  test "an already-registered phone is answered like a free one when no email is given" do
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(phone: @existing.phone, email: "")
+    end
+    assert_redirected_to <%= identity.route_scope %>_verify_phone_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- end -%>
+<%- end -%>
+<%- if email_verifiable? && coy? -%>
+
+  test "a fresh sign up does not sign in until the email is verified" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    assert_redirected_to <%= identity.route_scope %>_new_verify_email_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "signing up with an already-registered email mails nobody" do
+    assert_no_enqueued_emails do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(email: @existing.email)
+    end
+  end
+<%- elsif email_verifiable? -%>
+
+  test "a fresh sign up does not sign in until the email is verified" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    assert_redirected_to <%= identity.route_scope %>_<%= email_gated_registration? ? "new_verify_email" : "sign_up" %>_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "signing up with an already-registered email is rejected" do
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(email: @existing.email)
+    end
+    assert_response :unprocessable_entity
+    assert_includes response.body, "has already been taken"
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- else -%>
+
+<%- if typed_phone_gated_registration? && principals.email.nil? -%>
+  test "a valid sign up withholds the session until the phone is confirmed" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    assert_redirected_to <%= identity.route_scope %>_verify_phone_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- else -%>
+  test "a valid sign up signs in immediately" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- end -%>
+<%- if principals.email -%>
+
+  test "an already-registered email is rejected" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(email: @existing.email)
+    assert_response :unprocessable_entity
+  end
+<%- end -%>
+<%- end -%>
+<%- end -%>
+<%- if channel_less_registration? -%>
+
+  test "a sign up with no channel at all skips verification" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(<%= principals.email ? %(email: "", ) : "" %>phone: "")
+<%- if credential_staged_registration? -%>
+    assert_redirected_to <%= credential_enrollment_path %>
+    assert cookies[:<%= identity.cookie_name %>].blank?
+<%- else -%>
+    assert cookies[:<%= identity.cookie_name %>].present?
+<%- end -%>
+  end
+<%- end -%>
+<%- if contactable_validation? -%>
+
+  test "a sign up with no channel at all is refused" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(email: "", phone: "")
+
+    assert_response :unprocessable_entity
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- end -%>
+<%- if typed_phone_gated_registration? && principals.phone.optional? && principals.email&.optional? -%>
+
+  test "a sign up with a phone and no email must verify the phone first" do
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(<%= principals.email ? %(email: "") : "" %>)
+    assert_redirected_to <%= identity.route_scope %>_verify_phone_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- end -%>
+
+  private
+
+  def sign_up_params(**overrides)
+    <%= sign_up_fixture_literal(indent: 4) %>.merge(overrides)
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/sessions_controller_test.rb.tt

@@ -0,0 +1,124 @@
+require "test_helper"
+
+class <%= identity.module_name %>::SessionsControllerTest < ActionDispatch::IntegrationTest
+  setup { @user = <%= identity.plural %>(:alice) }
+
+<%- if password? -%>
+  test "signs in with valid credentials" do
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "rejects invalid credentials without revealing existence" do
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "wrong-password" }
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path(<%= login_hint_param %>: @user.<%= login_field %>)
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- if deadboltable? -%>
+
+  test "deadbolts the password sign-in door after too many failed attempts" do
+    @user.update!(failed_attempts: <%= identity.config_reference %>.deadbolt.maximum_attempts - 1)
+
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "wrong-password" }
+    assert @user.reload.deadbolted?
+
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].blank?, "the right password must not open a deadbolted door"
+  end
+
+  test "the deadbolt lifts itself once the window passes" do
+    @user.deadbolt!
+
+    travel <%= identity.config_reference %>.deadbolt.duration + 1.minute
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "an expired deadbolt starts the count over" do
+    @user.update!(failed_attempts: <%= identity.config_reference %>.deadbolt.maximum_attempts - 1)
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "wrong-password" }
+    assert @user.reload.deadbolted?
+
+    travel <%= identity.config_reference %>.deadbolt.duration + 1.minute
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "wrong-password" }
+    assert_not @user.reload.deadbolted?
+    assert_equal 1, @user.failed_attempts
+  end
+
+  test "deadbolting leaves the sessions the account already holds alone" do
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert @user.sessions.any?
+
+    @user.deadbolt!
+    assert @user.sessions.reload.any?
+  end
+
+  test "resets failed attempts after a successful sign in" do
+    @user.update!(failed_attempts: 3)
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert_equal 0, @user.reload.failed_attempts
+  end
+<%- end -%>
+<%- if bannable? && password? -%>
+
+  test "a suspended account cannot sign in and is told so" do
+    @user.ban!
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].blank?
+    assert_equal "Your account has been suspended.", flash[:alert]
+  end
+
+  test "suspending an account ends the sessions it already holds" do
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    assert @user.sessions.any?
+
+    @user.ban!
+    assert_empty @user.sessions.reload
+  end
+<%- end -%>
+
+  test "signs out" do
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+    delete <%= identity.route_scope %>_sign_out_path
+    assert_redirected_to root_url
+  end
+<%- if multi_login? && password? -%>
+
+<%- if principals.email -%>
+  test "signs in by email through the shared login field" do
+    post <%= identity.route_scope %>_sign_in_path, params: { login: @user.email, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- end -%>
+<%- if principals.phone -%>
+
+  test "signs in by phone through the shared login field" do
+    post <%= identity.route_scope %>_sign_in_path, params: { login: @user.phone, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- end -%>
+<%- if principals.username -%>
+
+  test "username sign-in folds case" do
+    post <%= identity.route_scope %>_sign_in_path, params: { login: @user.username.upcase, password: "quilted-lantern-moss-97" }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- end -%>
+<%- end -%>
+<%- else -%>
+  test "signs out" do
+    sign_in_as @user
+
+    delete <%= identity.route_scope %>_sign_out_path
+
+    assert_redirected_to root_url
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/sms_sessions_controller_test.rb.tt

@@ -0,0 +1,111 @@
+require "test_helper"
+
+class <%= identity.module_name %>::SmsSessionsControllerTest < ActionDispatch::IntegrationTest
+  include ActiveJob::TestHelper
+
+  setup { @user = <%= identity.plural %>(:alice) }
+
+  test "requesting a code for a known number texts one" do
+    assert_enqueued_jobs 1, only: SmsDeliveryJob do
+      request_code @user.phone
+    end
+
+    assert_redirected_to <%= identity.route_scope %>_sms_sign_in_code_path
+    assert cookies[:<%= identity.cookie_name %>].blank?, "asking for a code must not sign anyone in"
+  end
+
+  test "the texted code signs them in" do
+    request_code <%= identity.plural %>(:bob).phone
+
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: issued_code }
+
+    assert cookies[:<%= identity.cookie_name %>].present?
+<%- unless teams? -%>
+    assert_redirected_to <%= identity.nested_helper("root_url") %>
+<%- end -%>
+  end
+
+  test "a wrong code signs nobody in" do
+    request_code @user.phone
+
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: "000000" }
+
+    assert_response :unprocessable_entity
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "a redeemed code cannot be used twice" do
+    request_code @user.phone
+    code = issued_code
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: code }
+
+    delete <%= identity.route_scope %>_sign_out_path
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: code }
+
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "guessing past the attempt cap destroys the code" do
+    request_code @user.phone
+    code = issued_code
+
+    (<%= identity.config_reference %>.sms.max_attempts + 1).times do
+      patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: "000000" }
+    end
+
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: code }
+    assert cookies[:<%= identity.cookie_name %>].blank?, "the real code must be dead once the budget is spent"
+  end
+
+  test "an expired code signs nobody in" do
+    request_code @user.phone
+    code = issued_code
+
+    travel <%= identity.config_reference %>.tokens.sms_code + 1.minute
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: code }
+
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- if coy? -%>
+
+  test "requesting a code for an unknown number gives nothing away" do
+    assert_no_enqueued_jobs only: SmsDeliveryJob do
+      request_code "+14158264010"
+    end
+
+    assert_redirected_to <%= identity.route_scope %>_sms_sign_in_code_path
+  end
+
+  test "the code page behaves the same with nothing pending" do
+    request_code "+14158264010"
+
+    get <%= identity.route_scope %>_sms_sign_in_code_path
+    assert_response :success
+
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: "000000" }
+    assert_response :unprocessable_entity
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "an unknown number discards a parked code just as a known one does" do
+    request_code @user.phone
+    parked = issued_code
+
+    # Replace any parked code for every request; retaining it would reveal whether the submitted number has an account.
+    request_code "+14158264010"
+
+    patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: parked }
+    assert cookies[:<%= identity.cookie_name %>].blank?, "the parked code must not still sign anyone in"
+  end
+<%- end -%>
+
+  private
+
+  def request_code(phone)
+    post <%= identity.route_scope %>_sms_sign_in_path, params: { phone: phone }
+  end
+
+  def issued_code
+    enqueued_jobs.reverse.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/sudos_controller_test.rb.tt

@@ -0,0 +1,110 @@
+require "test_helper"
+
+class <%= identity.module_name %>::SudosControllerTest < ActionDispatch::IntegrationTest
+  setup { @user = <%= identity.plural %>(:bob) }
+<%- if sudo_test_mode == :open -%>
+
+  test "a challenge this account cannot answer fails open" do
+    sign_in_as @user
+
+    assert_difference -> { <%= identity.class_name %>.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_user_path, params: { confirmation: "DELETE ACCOUNT" }
+    end
+  end
+<%- else -%>
+
+  test "the sudo page presents the challenge" do
+    sign_in_as @user
+    get new_<%= identity.route_scope %>_sudo_path
+    assert_response :success
+  end
+
+  test "a wrong answer keeps you on the sudo page and stamps nothing" do
+    sign_in_as @user
+    session = <%= identity.session_class %>.last
+
+    post <%= identity.route_scope %>_sudo_path, params: { sudo_password: "wrong-password" }
+
+    assert_redirected_to new_<%= identity.route_scope %>_sudo_path
+    assert_nil session.reload.sudo_at
+  end
+
+  test "the right answer stamps the session and proceeds" do
+    sign_in_as @user
+    session = <%= identity.session_class %>.last
+
+    post <%= identity.route_scope %>_sudo_path, params: { <%= sudo_test_answer %> }
+
+    assert_redirected_to <%= identity.settings_helper_prefix %>_url
+    assert_not_nil session.reload.sudo_at
+  end
+
+  test "the request cannot choose where confirming sends you" do
+    sign_in_as @user
+
+    post <%= identity.route_scope %>_sudo_path,
+      params: { <%= sudo_test_answer %>, proceed_to_url: root_url, message: "Confirm to claim your refund." }
+
+    assert_redirected_to <%= identity.settings_helper_prefix %>_url
+  end
+
+  test "a guarded action with no answer changes nothing" do
+    sign_in_as @user
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      delete <%= identity.settings_helper_prefix %>_user_path, params: { confirmation: "DELETE ACCOUNT" }
+    end
+    assert_response :redirect
+  end
+
+  test "a guarded action with a wrong answer changes nothing" do
+    sign_in_as @user
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      delete <%= identity.settings_helper_prefix %>_user_path,
+        params: { confirmation: "DELETE ACCOUNT", sudo_password: "wrong-password" }
+    end
+    assert_response :redirect
+  end
+
+  test "a guarded action with the right answer runs in one request" do
+    sign_in_as @user
+
+    assert_difference -> { <%= identity.class_name %>.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_user_path,
+        params: { confirmation: "DELETE ACCOUNT", <%= sudo_test_answer %> }
+    end
+    assert_redirected_to root_path
+  end
+
+  test "an action answered inline still stamps, so an area opens too" do
+    sign_in_as @user
+    session = <%= identity.session_class %>.last
+<%- if email_changeable? -%>
+
+    patch <%= identity.settings_helper_prefix %>_email_path,
+      params: { email: "changed-#{SecureRandom.hex(4)}@example.com", <%= sudo_test_answer %> }
+
+    assert_not_nil session.reload.sudo_at
+<%- elsif phone_changeable? -%>
+
+    patch <%= identity.settings_helper_prefix %>_phone_path,
+      params: { phone: "+14158264010", <%= sudo_test_answer %> }
+
+    assert_not_nil session.reload.sudo_at
+<%- else -%>
+
+    delete <%= identity.settings_helper_prefix %>_user_path,
+      params: { confirmation: "DELETE ACCOUNT", <%= sudo_test_answer %> }
+
+    assert_not_nil session.reload.sudo_at
+<%- end -%>
+  end
+<%- end -%>
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/fixtures/memberships.yml.tt

@@ -0,0 +1,13 @@
+alice_acme:
+  <%= identity.singular %>: alice
+  team: acme
+
+bob_acme:
+  <%= identity.singular %>: bob
+  team: acme
+<%- if adminable? -%>
+
+carol_acme:
+  <%= identity.singular %>: carol
+  team: acme
+<%- end -%>

data/lib/generators/authnz_eleven/templates/test_unit/fixtures/teams.yml.tt

@@ -0,0 +1,2 @@
+acme:
+  name: Acme

data/lib/generators/authnz_eleven/templates/test_unit/fixtures/users.yml.tt

@@ -0,0 +1,68 @@
+alice:
+<%- if principals.email -%>
+  email: alice@example.com
+<%- end -%>
+<%- if principals.phone -%>
+  phone: "+14155550141"
+<%- end -%>
+<%- if principals.username -%>
+  username: alice
+<%- end -%>
+<%- if password? -%>
+  password_digest: <%%= BCrypt::Password.create("quilted-lantern-moss-97", cost: 4) %>
+<%- end -%>
+<%- if totp? -%>
+  totp_secret: <%%= ROTP::Base32.random %>
+<%- end -%>
+<%- if adminable? -%>
+  admin: true
+<%- end -%>
+<%- if webauthn_credentials? -%>
+  webauthn_handle: <%%= WebAuthn.generate_user_id %>
+<%- end -%>
+
+bob:
+<%- if principals.email -%>
+  email: bob@example.com
+<%- end -%>
+<%- if principals.phone -%>
+  phone: "+16505550142"
+<%- end -%>
+<%- if principals.username -%>
+  username: bob
+<%- end -%>
+<%- if password? -%>
+  password_digest: <%%= BCrypt::Password.create("quilted-lantern-moss-97", cost: 4) %>
+<%- end -%>
+<%- if totp? -%>
+  totp_secret: <%%= ROTP::Base32.random %>
+<%- end -%>
+<%- if adminable? -%>
+  admin: false
+<%- end -%>
+<%- if webauthn_credentials? -%>
+  webauthn_handle: <%%= WebAuthn.generate_user_id %>
+<%- end -%>
+<%- if adminable? -%>
+
+carol:
+<%- if principals.email -%>
+  email: carol@example.com
+<%- end -%>
+<%- if principals.phone -%>
+  phone: "+12125550143"
+<%- end -%>
+<%- if principals.username -%>
+  username: carol
+<%- end -%>
+<%- if password? -%>
+  password_digest: <%%= BCrypt::Password.create("quilted-lantern-moss-97", cost: 4) %>
+<%- end -%>
+<%- if totp? -%>
+  totp_secret: <%%= ROTP::Base32.random %>
+<%- end -%>
+  admin: true
+<%- if webauthn_credentials? -%>
+  webauthn_handle: <%%= WebAuthn.generate_user_id %>
+<%- end -%>
+<%- end -%>