authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/mailers/user_mailer_test.rb.tt

@@ -0,0 +1,88 @@
+require "test_helper"
+
+class <%= identity.mailer_class %>Test < ActionMailer::TestCase
+  setup { @user = <%= identity.plural %>(:alice) }
+<%- if security_notifications? -%>
+
+  test "security_notification describes the change without including credentials" do
+    mail = <%= identity.mailer_class %>.with(
+      to: @user.email,
+      event: :password_changed,
+      occurred_at: Time.zone.local(2026, 1, 2, 3, 4),
+      ip_address: "192.0.2.1",
+      user_agent: "Example Browser"
+    ).security_notification
+
+    assert_equal [ @user.email ], mail.to
+    assert_equal "Your password was changed", mail.subject
+    assert_includes mail.body.encoded, "This security change was made to your account."
+    assert_includes mail.body.encoded, "192.0.2.1"
+    assert_includes mail.body.encoded, "Example Browser"
+  end
+<%- end -%>
+<%- if recoverable? -%>
+
+  test "password_reset links to the reset form" do
+    token = @user.generate_token_for(:password_reset)
+    mail = <%= identity.mailer_class %>.with(signed_id: token, to: @user.email).password_reset
+
+    assert_equal [ @user.email ], mail.to
+    assert_equal "Reset your password", mail.subject
+    expected_url = Rails.application.routes.url_helpers.<%= identity.route_scope %>_reset_password_url(sid: token, host: "example.com")
+    assert_includes mail.body.encoded, expected_url
+  end
+<%- end -%>
+<%- if email_change_verification? -%>
+
+  test "email_change_verification describes and links the change" do
+    @user.update!(pending_email: "moved@example.com")
+    token = @user.generate_token_for(:email_change_verification)
+    mail = <%= identity.mailer_class %>.with(signed_id: token, to: @user.pending_email).email_change_verification
+
+    assert_equal [ "moved@example.com" ], mail.to
+    assert_equal "Verify your new email address", mail.subject
+    expected_url = Rails.application.routes.url_helpers.<%= identity.route_scope %>_verify_email_change_url(sid: token, host: "example.com")
+    assert_includes mail.body.encoded, expected_url
+  end
+<%- end -%>
+<%- if email_gated_registration? -%>
+
+  test "registration_email_verification describes registration" do
+    registration = <%= identity.pending_registration_class %>.new(email: "fresh@example.com"<%= staged_registration_invitation(%("fresh@example.com")) %>)
+    registration.save!(validate: false)
+    token = registration.generate_token_for(:registration_email_verification)
+    mail = <%= identity.mailer_class %>.with(signed_id: token, to: registration.email).registration_email_verification
+
+    assert_equal [ "fresh@example.com" ], mail.to
+    assert_equal "Verify your email to finish signing up", mail.subject
+    expected_url = Rails.application.routes.url_helpers.<%= identity.route_scope %>_verify_email_url(sid: token, host: "example.com")
+    assert_includes mail.body.encoded, expected_url
+  end
+<%- end -%>
+<%- if magic_link? -%>
+
+  test "magic_link links to the sign in url" do
+    token = @user.generate_magic_link
+    mail = <%= identity.mailer_class %>.with(signed_id: token, to: @user.email).magic_link
+
+    assert_equal [ @user.email ], mail.to
+    assert_equal "Your sign in link", mail.subject
+    expected_url = Rails.application.routes.url_helpers.<%= identity.route_scope %>_magic_link_url(sid: token, host: "example.com")
+    assert_includes mail.body.encoded, expected_url
+  end
+<%- end -%>
+<%- if email_invitable? -%>
+
+  test "invitation names the inviter and links to the accept page" do
+    invitation = <%= identity.invitation_class %>.create!(sent_to: "invitee@example.com", inviter: @user)
+    token = invitation.generate_token_for(:invitation)
+    mail = <%= identity.mailer_class %>.with(invitation: invitation, signed_id: token, to: invitation.sent_to).invitation
+
+    assert_equal [ "invitee@example.com" ], mail.to
+    assert_equal "You've been invited to #{<%= identity.config_reference %>.app_name}", mail.subject
+    assert_includes mail.body.encoded, @user.<%= principals.display.column %>
+    expected_url = Rails.application.routes.url_helpers.<%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation" : "accept_invitation" %>_url(token: token, host: "example.com")
+    assert_includes mail.body.encoded, expected_url
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/api_token_test.rb.tt

@@ -0,0 +1,38 @@
+require "test_helper"
+
+class <%= identity.api_token_class %>Test < ActiveSupport::TestCase
+  test "only the secret authenticates until expiry or revocation" do
+    user = <%= identity.plural %>(:bob)
+    token, secret = <%= identity.api_token_class %>.issue!(user:, name: "Script")
+
+    assert_equal user, <%= identity.api_token_class %>.authenticate(secret).user
+    refute_equal secret, token.token_digest
+    assert_nil <%= identity.api_token_class %>.authenticate("ae11_#{SecureRandom.urlsafe_base64(32)}")
+    assert_nil <%= identity.api_token_class %>.authenticate("not-a-token")
+
+    token.update!(expires_at: 1.second.ago)
+    assert_nil <%= identity.api_token_class %>.authenticate(secret)
+
+    token.update!(expires_at: 1.day.from_now)
+    token.destroy!
+    assert_nil <%= identity.api_token_class %>.authenticate(secret)
+  end
+
+  test "deleting the account deletes its tokens" do
+    user = <%= identity.plural %>(:bob)
+    _, secret = <%= identity.api_token_class %>.issue!(user:, name: "Script")
+    user.destroy!
+    assert_nil <%= identity.api_token_class %>.authenticate(secret)
+  end
+<%- if bannable? -%>
+
+  test "a suspended account cannot use a token" do
+    user = <%= identity.plural %>(:bob)
+    _, secret = <%= identity.api_token_class %>.issue!(user:, name: "Script")
+    user.ban!
+    assert_nil <%= identity.api_token_class %>.authenticate(secret)
+    user.unban!
+    assert_nil <%= identity.api_token_class %>.authenticate(secret)
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/password_history_test.rb.tt

@@ -0,0 +1,51 @@
+require "test_helper"
+
+class <%= identity.password_history_class %>ReuseTest < ActiveSupport::TestCase
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "rejects changing the password to the current one" do
+    assert_not @user.update(password: "quilted-lantern-moss-97", password_confirmation: "quilted-lantern-moss-97")
+    assert_includes @user.errors[:password], "was used recently. Please choose a different one"
+  end
+
+  test "rejects reusing a recently-used password" do
+    @user.update!(password: "FirstChange1", password_confirmation: "FirstChange1")
+
+    assert_not @user.update(password: "quilted-lantern-moss-97", password_confirmation: "quilted-lantern-moss-97")
+    assert @user.errors[:password].any?
+  end
+
+  test "accepts a genuinely new password and archives the digest it replaced" do
+    assert_difference -> { @user.password_histories.count }, 1 do
+      assert @user.update(password: "BrandNew1234", password_confirmation: "BrandNew1234"),
+             @user.errors.full_messages.to_sentence
+    end
+  end
+
+  test "a later save of the same record does not re-check the new password" do
+    @user.update!(password: "BrandNew1234", password_confirmation: "BrandNew1234")
+
+    assert @user.update(updated_at: Time.current), @user.errors.full_messages.to_sentence
+  end
+
+  test "keeps only the configured depth of history" do
+    depth = <%= identity.config_reference %>.password.history_depth
+
+    (1..depth + 2).each do |i|
+      @user.update!(password: "Rotation#{i}pw", password_confirmation: "Rotation#{i}pw")
+    end
+
+    assert_equal depth, @user.password_histories.count
+  end
+
+  test "forgets a password once it falls past the depth window" do
+    depth = <%= identity.config_reference %>.password.history_depth
+
+    (1..depth + 1).each do |i|
+      @user.update!(password: "Rotation#{i}pw", password_confirmation: "Rotation#{i}pw")
+    end
+
+    assert @user.update(password: "quilted-lantern-moss-97", password_confirmation: "quilted-lantern-moss-97"),
+           @user.errors.full_messages.to_sentence
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/session_test.rb.tt

@@ -0,0 +1,16 @@
+require "test_helper"
+
+class <%= identity.session_class %>Test < ActiveSupport::TestCase
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "active and timed_out split sessions by the idle timeout" do
+    fresh = @user.sessions.create!
+    stale = @user.sessions.create!
+    stale.update_column(:updated_at, (<%= identity.config_reference %>.session.idle_timeout + 1.hour).ago)
+
+    assert_includes <%= identity.session_class %>.active,    fresh
+    assert_includes <%= identity.session_class %>.timed_out, stale
+    refute_includes <%= identity.session_class %>.active,    stale
+    refute_includes <%= identity.session_class %>.timed_out, fresh
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/sms_challengeable_test.rb.tt

@@ -0,0 +1,108 @@
+require "test_helper"
+
+class <%= identity.class_name %>::SmsChallengeableTest < ActiveSupport::TestCase
+  include ActiveJob::TestHelper
+
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    Rails.cache.clear
+  end
+
+  test "issuing stores a challenge and texts six digits" do
+    assert_enqueued_with(job: SmsDeliveryJob) do
+      assert @user.issue_sms_challenge
+    end
+
+    assert @user.sms_challenge?
+    assert_match(/\d{6} is your/, enqueued_jobs.last.to_s)
+  end
+
+  test "a new delivery replaces the previous code" do
+    @user.issue_sms_challenge
+    replace_code("xxxxxx")
+
+    @user.issue_sms_challenge
+
+    assert_not @user.verify_sms_challenge("xxxxxx")
+    assert @user.verify_sms_challenge(issued_code)
+  end
+
+  test "a correct code works exactly once" do
+    @user.issue_sms_challenge
+    code = issued_code
+
+    assert @user.verify_sms_challenge(code)
+    assert_not @user.verify_sms_challenge(code)
+  end
+
+  test "a correct code verifies only the number it was texted to" do
+    @user.issue_sms_challenge(to: "+14155550100")
+    code = issued_code
+
+    assert_not @user.verify_sms_challenge(code, to: "+14155550199")
+    assert @user.verify_sms_challenge(code, to: "+14155550100")
+  end
+
+  test "a code waiting for another number is not a challenge for this one" do
+    @user.issue_sms_challenge(to: "+14155550100")
+
+    assert_not @user.sms_challenge?
+    assert @user.sms_challenge?(to: "+14155550100")
+  end
+
+  test "a code expires" do
+    @user.issue_sms_challenge
+    code = issued_code
+    travel <%= identity.config_reference %>.tokens.sms_code + 1.minute
+
+    assert_not @user.verify_sms_challenge(code)
+  end
+
+  test "wrong codes spend the attempt budget" do
+    @user.issue_sms_challenge
+    code = issued_code
+
+    <%= identity.config_reference %>.sms.max_attempts.times do
+      assert_not @user.verify_sms_challenge(wrong_code)
+    end
+
+    assert_not @user.verify_sms_challenge(code)
+  end
+
+  test "a new delivery starts a fresh attempt budget" do
+    @user.issue_sms_challenge
+    <%= identity.config_reference %>.sms.max_attempts.times do
+      @user.verify_sms_challenge(wrong_code)
+    end
+
+    @user.issue_sms_challenge
+
+    assert @user.verify_sms_challenge(issued_code)
+  end
+
+  test "a missing cache fails closed" do
+    cache = Rails.cache
+    Rails.cache = ActiveSupport::Cache::NullStore.new
+
+    @user.issue_sms_challenge
+
+    assert_not @user.verify_sms_challenge(issued_code)
+  ensure
+    Rails.cache = cache
+  end
+
+  private
+
+  def issued_code
+    enqueued_jobs.reverse.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+  end
+
+  def wrong_code
+    issued_code == "000000" ? "000001" : "000000"
+  end
+
+  def replace_code(code, to: @user.phone)
+    Rails.cache.write(@user.send(:sms_challenge_key, :code), { code: code, to: to },
+      expires_in: <%= identity.config_reference %>.tokens.sms_code)
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/user/guestable_test.rb.tt

@@ -0,0 +1,78 @@
+require "test_helper"
+
+class <%= identity.class_name %>::GuestableTest < ActiveSupport::TestCase
+  test "create_guest! builds a valid, persisted guest" do
+    guest = <%= identity.class_name %>.create_guest!
+
+    assert guest.persisted?
+    assert guest.guest?
+<%- if principals.email -%>
+    assert_match(/\Aguest_.+@example\.com\z/, guest.email)
+<%- end -%>
+<%- if principals.username -%>
+    assert_match(/\Aguest_[a-zA-Z0-9]+\z/, guest.username)
+<%- end -%>
+  end
+
+  test "create_guest! generates a unique guest each time" do
+    assert_not_equal <%= identity.class_name %>.create_guest!.<%= principals.display.column %>, <%= identity.class_name %>.create_guest!.<%= principals.display.column %>
+  end
+
+  test "guests scope returns only guest users" do
+    guest = <%= identity.class_name %>.create_guest!
+
+    assert_includes <%= identity.class_name %>.guests, guest
+    assert_not_includes <%= identity.class_name %>.guests, <%= identity.plural %>(:alice)
+  end
+
+  test "regular users are not guests" do
+    assert_not <%= identity.plural %>(:alice).guest?
+  end
+
+  test "expired_guests finds guests past config.guest.ttl, and only those" do
+    fresh = <%= identity.class_name %>.create_guest!
+    stale = <%= identity.class_name %>.create_guest!
+    stale.update_column(:created_at, (<%= identity.config_reference %>.guest.ttl + 1.day).ago)
+
+    assert_includes <%= identity.class_name %>.expired_guests, stale
+    assert_not_includes <%= identity.class_name %>.expired_guests, fresh
+  end
+
+  test "expired_guests never collects a real <%= identity.singular %>, however old" do
+    <%= identity.plural %>(:alice).update_column(:created_at, (<%= identity.config_reference %>.guest.ttl + 1.year).ago)
+
+    assert_not_includes <%= identity.class_name %>.expired_guests, <%= identity.plural %>(:alice)
+  end
+
+  test "absorb_guest takes the guest row with it, in one transaction" do
+    guest = <%= identity.class_name %>.create_guest!
+
+    assert_difference -> { <%= identity.class_name %>.guests.count }, -1 do
+      <%= identity.plural %>(:alice).absorb_guest(guest)
+    end
+    assert_nil <%= identity.class_name %>.find_by(id: guest.id)
+  end
+<%- if timeoutable? -%>
+
+  test "<%= identity.session_class %>.timed_out leaves idle guest sessions alone" do
+    guest_session = <%= identity.class_name %>.create_guest!.sessions.create!
+    <%= identity.singular %>_session = <%= identity.plural %>(:alice).sessions.create!
+    idle = (<%= identity.session_class %>.idle_timeout + 1.hour).ago
+    [ guest_session, <%= identity.singular %>_session ].each { |s| s.update_column(:updated_at, idle) }
+
+    assert_includes <%= identity.session_class %>.timed_out, <%= identity.singular %>_session
+    assert_not_includes <%= identity.session_class %>.timed_out, guest_session,
+      "guests do not time out; config.guest.ttl controls when they are collected"
+  end
+<%- end -%>
+<%- if trackable? -%>
+
+  test "a guest session records no sign-in event" do
+    guest = <%= identity.class_name %>.create_guest!
+
+    assert_no_difference -> { guest.events.count } do
+      guest.sessions.create!
+    end
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/user/recovery_codes_test.rb.tt

@@ -0,0 +1,32 @@
+require "test_helper"
+
+class <%= identity.class_name %>::RecoveryCodesTest < ActiveSupport::TestCase
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    @user.update!(totp_enrolled_at: Time.current)
+    <%= identity.recovery_code_class %>.regenerate_for(@user)
+  end
+
+  test "turning the authenticator off keeps the codes while a security key remains" do
+    add_security_key
+    @user.update!(totp_enrolled_at: nil)
+    @user.discard_orphaned_recovery_codes!
+
+    assert @user.recovery_codes.reload.any?
+  end
+
+  test "removing the last security key takes the codes with it" do
+    add_security_key
+    @user.update!(totp_enrolled_at: nil)
+    <%= second_factor_keys_expr("@user") %>.destroy_all
+    @user.discard_orphaned_recovery_codes!
+
+    assert_empty @user.recovery_codes.reload
+  end
+
+  private
+
+  def add_security_key
+    <%= second_factor_keys_expr("@user") %>.create!(name: "Key", external_id: "ext-#{@user.id}", public_key: "pk"<%= factor_attr(:second_factor) %>)
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/user/sign_in_methods_test.rb.tt

@@ -0,0 +1,56 @@
+require "test_helper"
+
+class <%= identity.class_name %>::SignInMethodsTest < ActiveSupport::TestCase
+  setup { @user = <%= identity.plural %>(:bob) }
+<%- if omniauth? -%>
+
+  test "a linked provider is a way in" do
+    @user.omniauth_identities.create!(provider: "developer", uid: "only")
+    assert_includes @user.reload.sign_in_methods, :omniauth
+  end
+
+  test "a spare provider is always another way in" do
+    @user.omniauth_identities.create!(provider: "developer", uid: "one")
+    @user.omniauth_identities.create!(provider: "developer", uid: "two")
+
+    assert_not @user.reload.last_sign_in_method?(:omniauth),
+      "two linked accounts means removing one leaves the other"
+  end
+
+  test "last_sign_in_method? is true exactly when this kind is all that is left" do
+    @user.omniauth_identities.create!(provider: "developer", uid: "only")
+    @user.reload
+
+    assert_equal (@user.sign_in_methods == [ :omniauth ]), @user.last_sign_in_method?(:omniauth)
+  end
+<%- end -%>
+<%- if passkey? && omniauth? -%>
+
+  test "a provider is protected in a passkey build when no passkey was ever enrolled" do
+    @user.webauthn_credentials.destroy_all
+    @user.omniauth_identities.destroy_all
+    @user.omniauth_identities.create!(provider: "developer", uid: "only")
+    @user.reload
+<%- if password? || magic_link? -%>
+
+    assert_not @user.last_sign_in_method?(:omniauth),
+      "this build has another sign-in method, so the link is removable"
+<%- else -%>
+
+    assert @user.last_sign_in_method?(:omniauth),
+      "having passkey sign-in enabled does not mean this account has a passkey"
+<%- end -%>
+  end
+<%- end -%>
+<%- if passkey? -%>
+
+  test "an enrolled passkey is a way in, and the last one is protected" do
+    @user.webauthn_credentials<%= ".passkeys" if passkey_and_security_keys? %>.destroy_all
+    @user.webauthn_credentials.create!(name: "Only key", external_id: "ext-only", public_key: "pk"<%= factor_attr(:first_factor) %>)
+    @user.reload
+
+    assert_includes @user.sign_in_methods, :passkey
+    assert_equal (@user.sign_in_methods == [ :passkey ]), @user.last_sign_in_method?(:passkey)
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/models/user_test.rb.tt

@@ -0,0 +1,145 @@
+require "test_helper"
+
+class <%= identity.class_name %>Test < ActiveSupport::TestCase
+<%- if principals.email -%>
+  test "malformed emails are rejected" do
+    user = build_<%= identity.singular %>(email: "person..name@example.com")
+    assert_not user.valid?
+    assert_includes user.errors[:email], "is invalid"
+  end
+<%- end -%>
+<%- if principals.email&.optional? -%>
+
+  test "email is optional" do
+    user = build_<%= identity.singular %>(email: nil)
+    assert user.valid?
+  end
+
+  test "a blank email normalizes to nil so the partial unique index applies" do
+    user = build_<%= identity.singular %>(email: "")
+    assert user.save
+    assert_nil user.reload.email
+  end
+
+  test "set emails are still unique (enforced by the DB index)" do
+    assert build_<%= identity.singular %>(email: "dup@example.com").save
+    assert_raises(ActiveRecord::RecordNotUnique) do
+      build_<%= identity.singular %>(email: "dup@example.com").save(validate: false)
+    end
+  end
+<%- end -%>
+<%- if principals.username -%>
+<%- if principals.email&.optional? -%>
+
+<%- end -%>
+  test "username is required" do
+    user = build_<%= identity.singular %>(username: nil)
+    assert_not user.valid?
+    assert_includes user.errors[:username], "can't be blank"
+  end
+
+  test "username uniqueness is honest and case-insensitive" do
+    taken = <%= identity.plural %>(:alice).username
+    user = build_<%= identity.singular %>(username: taken.upcase)
+    assert_not user.valid?
+    assert_includes user.errors[:username], "has already been taken"
+  end
+
+  test "forbidden usernames are rejected" do
+    user = build_<%= identity.singular %>(username: "admin")
+    assert_not user.valid?
+    assert_includes user.errors[:username], "is forbidden"
+  end
+
+  test "the chosen case is preserved on save" do
+    user = build_<%= identity.singular %>(username: "MixedCase")
+    assert user.save
+    assert_equal "MixedCase", user.reload.username
+  end
+
+  test "username uniqueness is also enforced by the DB index" do
+    taken = <%= identity.plural %>(:alice).username
+    assert_raises(ActiveRecord::RecordNotUnique) do
+      build_<%= identity.singular %>(username: taken.upcase).save(validate: false)
+    end
+  end
+<%- end -%>
+<%- if principals.phone -%>
+<%- if principals.email&.optional? || principals.username -%>
+
+<%- end -%>
+  test "a valid phone is accepted and normalized to E.164" do
+    user = build_<%= identity.singular %>(phone: "+1 415 826 4001")
+    assert user.save
+    assert_equal "+14158264001", user.reload.phone
+  end
+
+  test "a number typed without a country code is read in the default country" do
+    with_default_country("US") do
+      user = build_<%= identity.singular %>(phone: "(415) 826-4002")
+      assert user.save
+      assert_equal "+14158264002", user.reload.phone
+    end
+  end
+
+  test "a bare number that isn't valid in the default country is rejected, not reinterpreted" do
+    with_default_country("US") do
+      user = build_<%= identity.singular %>(phone: "6494461709")
+      assert_not user.valid?
+      assert_not_equal "+6494461709", user.phone, "must not be read as a New Zealand number"
+    end
+  end
+
+  test "an explicit country code overrides the default country" do
+    with_default_country("US") do
+      user = build_<%= identity.singular %>(phone: "+44 20 7183 8750")
+      assert user.save
+      assert_equal "+442071838750", user.reload.phone
+    end
+  end
+
+  test "an array of default countries is tried in order" do
+    with_default_country(%w[US GB]) do
+      user = build_<%= identity.singular %>(phone: "02071838750")
+      assert user.save
+      assert_equal "+442071838750", user.reload.phone
+    end
+  end
+<%- if principals.phone.required? -%>
+
+  test "phone is required" do
+    assert_not build_<%= identity.singular %>(phone: nil).valid?
+  end
+<%- else -%>
+
+  test "phone is optional" do
+    assert build_<%= identity.singular %>(phone: nil).valid?
+  end
+<%- end -%>
+
+  test "set phones are unique (enforced by the DB index)" do
+    assert build_<%= identity.singular %>(phone: "+14158264002").save
+    assert_raises(ActiveRecord::RecordNotUnique) do
+      build_<%= identity.singular %>(phone: "+14158264002").save(validate: false)
+    end
+  end
+<%- end -%>
+
+  private
+
+  def build_<%= identity.singular %>(**attrs)
+    defaults = <%= account_fixture_literal(indent: 4) %>
+    <%= identity.class_name %>.new(defaults.merge(attrs))
+  end
+<%- if principals.phone -%>
+
+  def with_default_country(country)
+    # Mutate and restore this OrderedOptions value because its method_missing reader cannot be stubbed reliably.
+    previous = <%= identity.config_reference %>.phone.default_country
+    <%= identity.config_reference %>.phone.default_country = country
+    yield
+  ensure
+    <%= identity.config_reference %>.phone.default_country = previous
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/wizard_generator.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+require_relative "authnz_eleven_generator"
+require_relative "../../authnz_eleven/wizard"
+
+module AuthnzEleven
+  # `bin/rails generate authnz_eleven:wizard`
+  #
+  # Picks the flags interactively, prints the command it assembled, and offers
+  # to run it. The printed command is the point: it goes in a README, and
+  # re-running it means the same thing.
+  class WizardGenerator < Rails::Generators::Base
+    desc "Pick authnz_eleven's flags interactively, then run the generator"
+
+    # Not a gemspec dependency: huh isn't on RubyGems yet (the `huh` name there
+    # belongs to an unrelated library, so don't send anyone to `gem install`),
+    # and a gemspec can't declare a git source. It is also wanted exactly once.
+    INSTALL = <<~MSG
+      The wizard needs the `huh` gem for its terminal forms. Add it to your
+      Gemfile, then `bundle install`:
+
+        gem "huh", github: "marcoroth/huh-ruby", group: :development
+
+      Or skip the wizard and write the flags yourself:
+
+        bin/rails generate authnz_eleven --help
+    MSG
+
+    def pick_flags
+      @flags = wizard.run
+    rescue LoadError
+      abort INSTALL
+    end
+
+    def report
+      say ""
+      say "  #{wizard.command}", :green
+      say ""
+    end
+
+    def generate
+      return say("Nothing generated.", :yellow) unless yes?("Run it now? [y/N]")
+
+      AuthnzElevenGenerator.start(@flags)
+    end
+
+    private
+
+    def wizard = @wizard ||= Wizard.new
+  end
+end