authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/config/initializers/authentication.rb.tt

@@ -0,0 +1,275 @@
+# Generated by authnz_eleven <%= AuthnzEleven::VERSION %> with:
+#
+<%- generation_command_lines.each do |line| -%>
+#   <%= line %>
+<%- end -%>
+#
+# Configuration for your generated auth system. Adjust them to suit
+# your needs.
+#
+# <%= identity.config_constant %> is an alias for <%= identity.config_storage %>.
+# Both refer to the same config, so you can use either. The generated code uses
+# <%= identity.config_constant %>.
+<%= identity.config_storage %> = ActiveSupport::OrderedOptions.new
+<%= identity.config_constant %> = <%= identity.config_storage %>
+
+<%= identity.config_constant %>.tap do |config|
+  # Shown as the issuer in authenticator apps and used in mailer subjects.
+  config.app_name = Rails.application.class.module_parent_name
+
+  # How often to save a session's last activity to the database. No need to
+  # write it on every request.
+  config.session = ActiveSupport::OrderedOptions.new
+  config.session.activity_write_interval = 15.minutes
+<%- if timeoutable? -%>
+  # Sign out sessions after they are inactive for this long. They are deleted on the user's
+  # next request. For users who never come back, run the included cleanup task:
+  # `authnz_eleven:delete_timed_out_sessions`.
+  config.session.idle_timeout = 7.days
+<%- end -%>
+<%- if rememberable? -%>
+  # How long the "remember me" cookie lasts. Without "remember me", the cookie
+  # lasts only until the browser closes.
+  config.session.remember_for = 2.weeks
+<%- end -%>
+<%- if max_sessionable? -%>
+  # How many devices a <%= identity.singular %> can be signed in on at once.
+  # "Remember me" sessions count too. If a new sign-in would exceed the limit,
+<%- if max_sessions_prompt? -%>
+  # the user is held at the session list until they sign one out
+  # (--max-sessionable=prompt). Set to nil to allow any number of sessions.
+<%- else -%>
+  # the least-recently-active session is signed out to make room
+  # (--max-sessionable=evict). Set to nil to allow any number of sessions.
+<%- end -%>
+  config.session.concurrent_limit = 3
+<%- end -%>
+<%- if guestable? -%>
+
+  # How long to keep a guest <%= identity.singular %>. This is measured from creation, not last activity.
+  # Guests are not authenticated, so we don't "sign them out" due to inactivity.
+<%- if timeoutable? -%>
+  # session.idle_timeout does not apply to guests.
+<%- end -%>
+  # The guest cookie lives for this long too, including across browser restarts.
+  # Run `authnz_eleven:delete_expired_guests` to delete expired guests.
+  config.guest = ActiveSupport::OrderedOptions.new
+  config.guest.ttl = 30.days
+<%- end -%>
+<%- if impersonatable? -%>
+
+  # How long an admin can impersonate another <%= identity.singular %>. Activity does
+  # not extend this. Once it expires, the next request returns the admin to the
+  # admin area as themselves, and that request is not carried out, since it was made
+  # as someone else.
+  config.impersonation = ActiveSupport::OrderedOptions.new
+  config.impersonation.duration = 1.hour
+<%- end -%>
+
+<%- if principals.username -%>
+  # Usernames nobody may register, like "admin" or "support". Edit
+  # config/forbidden_usernames.txt to add or remove names, or replace this with
+  # your own list. It must be a Set of downcased strings. Blank lines and "#"
+  # comments in the file are ignored.
+  #
+  # To change the format or the 3–20 character limit, edit the model's `format:`
+  # validation. When sign-in accepts multiple identifiers, it checks for "@"
+  # first (email), then a letter (username), otherwise it tries a phone number.
+  # Keep usernames free of "@" and require at least one letter so they cannot
+  # be mistaken for either.
+  config.username = ActiveSupport::OrderedOptions.new
+  config.username.forbidden = File.readlines(Rails.root.join("config/forbidden_usernames.txt"), chomp: true)
+    .map { |line| line.strip.downcase }
+    .reject { |line| line.empty? || line.start_with?("#") }
+    .to_set
+
+<%- end -%>
+<%- if principals.phone -%>
+  # Interpret numbers without "+" using this country:
+  #   "US": (415) 826-4001 → +14158264001
+  #   "GB": 020 7183 8750 → +442071838750
+  # An array, like %w[US GB], tries countries in order.
+  # Numbers with "+" already specify their country and ignore this default.
+  # This controls parsing, not which countries are allowed.
+  # Keep a default to avoid guessing from leading digits. Without one, a
+  # number from Gainesville, Florida (Go Gators! 🐊), (352) 555-0166, is parsed
+  # as +352 5550166 (Luxembourg).
+  config.phone = ActiveSupport::OrderedOptions.new
+  config.phone.default_country = %w[US CA]
+
+  # Accepted phone-number countries. nil allows all countries.
+  config.phone.allowed_countries = nil
+  # config.phone.allowed_countries = %w[US CA]
+
+<%- end -%>
+<%- if password? -%>
+  # Password rules.
+  config.password = ActiveSupport::OrderedOptions.new
+  config.password.minimum_length = 10
+<%- if password_rotatable? -%>
+  # Require a new password after this long. On their next request, the user is
+  # held at the change-password page until they change it. Set to nil to stop
+  # expiring passwords.
+  #
+  # I do not recommend scheduled rotation unless your compliance policy requires
+  # it. NIST SP 800-63B advises against it because it encourages predictable
+  # passwords. Prefer longer passwords and breach-checking (--pwned).
+  config.password.maximum_age = 90.days
+<%- end -%>
+<%- if password_historical? -%>
+  # How many previous passwords to check when refusing password reuse. The
+  # current password is also checked. Stored digests are small, so you can raise
+  # this if your policy requires a longer history. Set to nil to keep archiving
+  # passwords without rejecting reuse.
+  config.password.history_depth = 5
+<%- end -%>
+<%- if strong_passwords? -%>
+  # Minimum zxcvbn strength score (0–4). 3 is "safely unguessable", and 4 is the
+  # strictest. Passwords scoring below this are rejected by the Authenticatable
+  # concern.
+  config.password.minimum_strength = 3
+<%- end -%>
+<%- if pwned? -%>
+
+  # Check new passwords against Have I Been Pwned. Enabled only in production
+  # because it makes an HTTP request and would reject the test fixture passwords.
+  config.password.check_breaches = Rails.env.production?
+<%- end -%>
+
+<%- end -%>
+  # How long links, codes, and challenges remain valid.
+  config.tokens = ActiveSupport::OrderedOptions.new
+<%- if email_gated_registration? -%>
+  config.tokens.registration_email_verification = 2.days
+<%- end -%>
+<%- if email_change_verification? -%>
+  config.tokens.email_change_verification = 2.days
+<%- end -%>
+<%- if recoverable? -%>
+  config.tokens.password_reset = 20.minutes
+<%- end -%>
+<%- if magic_link? -%>
+  config.tokens.magic_link = 20.minutes
+<%- end -%>
+<%- if second_factor? -%>
+  config.tokens.mfa_challenge = 20.minutes
+<%- end -%>
+<%- if invitable? -%>
+  config.tokens.invitation = 7.days
+<%- end -%>
+<%- if sms? -%>
+  config.tokens.sms_code = 10.minutes
+<%- end -%>
+<%- if pending_registration? -%>
+  # How long an unfinished sign-up can sit before cleanup deletes it. Each step,
+  # and each link or code sent, restarts the clock. Keep this longer than the
+  # registration links above so cleanup doesn't delete a sign-up whose link is
+  # still valid.
+  config.tokens.pending_registration = 3.days
+<%- end -%>
+<%- if second_factor? -%>
+
+  # Second-factor authentication.
+  config.second_factor = ActiveSupport::OrderedOptions.new
+<%- if totp? -%>
+  config.second_factor.totp_drift_behind = 10
+<%- end -%>
+  config.second_factor.recovery_code_count = 10
+  config.second_factor.recovery_code_length = 10
+
+  # Which sign-in methods require a second factor, if the user has enrolled one.
+  # Methods not listed are accepted on their own. Passkey sign-in is not listed
+  # by default because it is already phishing-resistant.
+  #
+  # Adjust this to suit your security/convenience trade-off. For example, add
+  # :magic_link if access to the user's inbox is not enough for your app.
+  #
+<%- if omniauth? -%>
+  # For social login, use the provider name, not :omniauth. For example, :google
+  # for google_oauth2. Add providers if you don't want to rely on their own MFA.
+  # :omniauth itself matches nothing.
+  #
+<%- end -%>
+  # Do not add :second_factor. It is used after a successful second-factor
+  # challenge, so requiring another would cause a redirect loop. :registration
+  # is also unnecessary: a newly created account has no second factor yet.
+  config.second_factor.needed_after = %i[<%= default_needed_after.join(" ") %>]
+<%- end -%>
+
+<%- if deadboltable? -%>
+  # How many consecutive failed password sign-ins deadbolt the password door,
+  # and how long it stays shut. Once the duration passes, it unlocks and the
+  # count starts over. A completed password reset unlocks it early, or you can
+  # call `user.undeadbolt!` yourself.
+  #
+  # Other sign-in methods still work. An attacker guessing at someone's password
+  # should not also lock them out of their passkey or magic link.
+  #
+  # Set maximum_attempts to nil to count failures without locking password
+  # sign-in.
+  config.deadbolt = ActiveSupport::OrderedOptions.new
+  config.deadbolt.maximum_attempts = 10
+  config.deadbolt.duration = 1.day
+
+<%- end -%>
+<%- if sms? -%>
+  # Wrong guesses allowed per texted code. This is separate from the rate limits,
+  # which limit how often codes can be sent.
+  config.sms = ActiveSupport::OrderedOptions.new
+  config.sms.max_attempts = 3
+
+<%- end -%>
+  # Request limits, written as { to: number_of_requests, within: duration }.
+  # Limits sends, not guesses.
+  config.rate_limits = ActiveSupport::OrderedOptions.new
+<%- if password? -%>
+  config.rate_limits.sign_in = { to: 10, within: 10.minutes }
+<%- end -%>
+<%- if recoverable? -%>
+  config.rate_limits.password_reset = { to: 3, within: 1.hour }
+<%- end -%>
+<%- if second_factor? -%>
+<%- if totp? -%>
+  config.rate_limits.totp_challenge = { to: 10, within: 5.minutes }
+<%- end -%>
+<%- if sms_second_factor? -%>
+  config.rate_limits.sms_second_factor = { to: 5, within: 1.hour }
+<%- end -%>
+  config.rate_limits.recovery_code_challenge = { to: 10, within: 1.hour }
+<%- end -%>
+<%- if magic_link? -%>
+  config.rate_limits.magic_link = { to: 10, within: 1.hour }
+<%- end -%>
+<%- if email_verifiable? -%>
+  # Requests and resends for email confirmation.
+  config.rate_limits.email_verification = { to: 5, within: 1.hour }
+<%- end -%>
+<%- if invitable? -%>
+  config.rate_limits.invitation = { to: 5, within: 1.hour }
+<%- end -%>
+<%- if phone_verifiable? -%>
+  # Requests and resends for phone confirmation. Every text costs money.
+  config.rate_limits.phone_verification = { to: 5, within: 1.hour }
+<%- end -%>
+<%- if sms_code? -%>
+  # Texted sign-in codes. These typically cost more than emails.
+  config.rate_limits.sms_sign_in = { to: 5, within: 1.hour }
+<%- end -%>
+<%- if sudoable? -%>
+  # Failed sudo challenges per session. Successful confirmation resets the count.
+  config.rate_limits.sudo = { to: 10, within: 10.minutes }
+<%- end -%>
+<%- if sudoable? -%>
+
+  # How long a sudo confirmation keeps protected pages unlocked.
+  config.sudo = ActiveSupport::OrderedOptions.new
+  config.sudo.window = 15.minutes
+<%- end -%>
+<%- if password? -%>
+  # Submission limits for settings forms that require the current password.
+  config.rate_limits.password_challenge = { to: 5, within: 10.minutes }
+<%- end -%>
+<%- if typed_registration? -%>
+  config.rate_limits.sign_up = { to: 5, within: 1.hour }
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/config/initializers/omniauth.rb.tt

@@ -0,0 +1,9 @@
+OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)
+
+# Replace :developer with your real provider(s), e.g.
+#   provider :google_oauth2, ENV["GOOGLE_CLIENT_ID"], ENV["GOOGLE_CLIENT_SECRET"], scope: "email,profile"
+#   provider :github, ENV["GITHUB_ID"], ENV["GITHUB_SECRET"], scope: "user:email"
+Rails.application.config.middleware.use OmniAuth::Builder do
+  options path_prefix: "<%= omniauth_path_prefix %>"
+  provider :developer unless Rails.env.production?
+end

data/lib/generators/authnz_eleven/templates/config/initializers/team_slug.rb.tt

@@ -0,0 +1,24 @@
+module TeamSlug
+  PREFIX = %r{\A/(\d+)(?=/|\z)}
+
+  class Extractor
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      request = ActionDispatch::Request.new(env)
+
+      if (match = PREFIX.match(request.path_info)) && (team = Team.find_by(id: match[1]))
+        request.script_name = "#{request.script_name}/#{match[1]}"
+        request.path_info   = match.post_match.presence || "/"
+
+        Current.team = team
+      end
+
+      @app.call(request.env)
+    end
+  end
+end
+
+Rails.application.config.middleware.insert_after Rack::TempfileReaper, TeamSlug::Extractor

data/lib/generators/authnz_eleven/templates/config/initializers/webauthn.rb.tt

@@ -0,0 +1,14 @@
+WebAuthn.configure do |config|
+  # The fully-qualified origin(s) of your app. Set per environment (use your
+  # real https origin(s) in production)
+  config.allowed_origins = ENV.fetch("WEBAUTHN_ORIGIN", "http://localhost:3000").split(",")
+
+  # The domain WebAuthn credentials are scoped to (no scheme, port, or path).
+  # Set WEBAUTHN_RP_ID in production. Every allowed origin's host must equal
+  # this value or be its subdomain; for example, app.example.com and
+  # admin.example.com can share an RP ID of example.com.
+  config.rp_id = ENV.fetch("WEBAUTHN_RP_ID", "localhost")
+
+  # Relying-party display name, shown by some authenticators.
+  config.rp_name = Rails.application.class.module_parent_name
+end

data/lib/generators/authnz_eleven/templates/config/locales/authentication.en.yml.tt

@@ -0,0 +1,11 @@
+en:
+  activerecord:
+    attributes:
+      <%= identity.singular %>:
+        pending_email: "Email"
+        pending_phone: "Phone"
+        password_challenge: "Current password"
+<%- if invitable? -%>
+      <%= identity.invitation_file %>:
+        sent_to: "<%= invitation_recipient_label %>"
+<%- end -%>

data/lib/generators/authnz_eleven/templates/controllers/active_teams_controller.rb.tt

@@ -0,0 +1,6 @@
+class <%= identity.nested_module("ActiveTeamsController") %> < <%= identity.controller_superclass %>
+  def create
+    set_session_team!(<%= identity.current_class %>.user.teams.find(params[:team_id]))
+    redirect_to <%= identity.nested_helper("root_path") %>, notice: "Switched team."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/admin/dashboard_controller.rb.tt

@@ -0,0 +1,4 @@
+class <%= admin_module %>::DashboardController < <%= admin_controller %>
+  def index
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/admin/sessions_controller.rb.tt

@@ -0,0 +1,17 @@
+class <%= admin_module %>::SessionsController < <%= admin_controller %>
+  def index
+    sessions = <%= identity.session_class %>.includes(:<%= identity.singular %><%= session_carries_team? ? ", :team" : "" %>).order(created_at: :desc)
+
+    if params[:user_id].present?
+      sessions = sessions.where(<%= identity.foreign_key %>: params[:user_id])
+      @filtered_user = <%= identity.class_name %>.find(params[:user_id])
+    end
+
+    @sessions = sessions.limit(100)
+  end
+
+  def destroy
+    <%= identity.session_class %>.find(params[:id]).destroy!
+    redirect_to <%= admin_helper("sessions_path") %>, notice: "Session ended.", status: :see_other
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/admin/users_controller.rb.tt

@@ -0,0 +1,91 @@
+class <%= admin_module %>::UsersController < <%= admin_controller %>
+  before_action :set_user, only: %i[show destroy destroy_all_sessions<%= " reset_second_factor" if second_factor? %><%= " undeadbolt" if deadboltable? %><%= " ban unban" if bannable? %><%= " impersonate" if impersonatable? %>]
+  before_action :refuse_admin_target, only: %i[destroy<%= " reset_second_factor" if second_factor? %><%= " ban" if bannable? %><%= " impersonate" if impersonatable? %>]
+
+  def index
+    @users = <%= identity.class_name %>.order(:<%= principals.display.column %>)
+  end
+
+  def show
+    @sessions = @user.sessions.order(created_at: :desc)
+<%- if trackable? -%>
+    @events = @user.events.recent_first.limit(100)
+<%- end -%>
+  end
+
+  def destroy
+<%- if security_notifications? -%>
+    email = @user.email
+<%- end -%>
+    @user.destroy!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:account_deleted, to: email)
+<%- end -%>
+    redirect_to <%= admin_helper("users_path") %>, notice: "User deleted.", status: :see_other
+  end
+
+  def destroy_all_sessions
+    count = @user.sessions.count
+    @user.sessions.destroy_all
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:sessions_revoked_by_admin, to: @user.email)
+<%- end -%>
+    redirect_to <%= admin_helper("user_path") %>(@user), notice: "Ended #{count} session(s) for #{@user.<%= principals.display.column %>}.",
+      status: :see_other
+  end
+<%- if second_factor? -%>
+
+  def reset_second_factor
+    @user.reset_second_factor!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:second_factor_reset_by_admin, to: @user.email)
+<%- end -%>
+    redirect_to <%= admin_helper("user_path") %>(@user), notice: "Cleared every second factor on #{@user.<%= principals.display.column %>}'s account."
+  end
+<%- end -%>
+<%- if deadboltable? -%>
+
+  def undeadbolt
+    @user.undeadbolt!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:deadbolt_cleared_by_admin, to: @user.email)
+<%- end -%>
+    redirect_to <%= admin_helper("user_path") %>(@user), notice: "Cleared the sign-in deadbolt on #{@user.<%= principals.display.column %>}."
+  end
+<%- end -%>
+<%- if bannable? -%>
+
+  def ban
+    @user.ban!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:account_suspended, to: @user.email)
+<%- end -%>
+    redirect_to <%= admin_helper("user_path") %>(@user), notice: "Suspended #{@user.<%= principals.display.column %>} and ended their sessions."
+  end
+
+  def unban
+    @user.unban!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:account_restored, to: @user.email)
+<%- end -%>
+    redirect_to <%= admin_helper("user_path") %>(@user), notice: "Lifted the suspension on #{@user.<%= principals.display.column %>}."
+  end
+<%- end -%>
+<%- if impersonatable? -%>
+
+  def impersonate
+    impersonate_user(@user)
+    redirect_to <%= identity.nested_helper("root_path") %>
+  end
+<%- end -%>
+
+  private
+
+  def set_user
+    @user = <%= identity.class_name %>.find(params[:id])
+  end
+
+  def refuse_admin_target
+    redirect_to <%= admin_helper("users_path") %>, alert: "That isn't available for an admin account.", status: :see_other if @user.admin?
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/admin_controller.rb.tt

@@ -0,0 +1,6 @@
+class <%= admin_controller %> < <%= identity.controller_superclass %>
+  admins_only
+<%- if teams? -%>
+  skip_before_action :require_team
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/base_controller.rb.tt

@@ -0,0 +1,11 @@
+class <%= identity.base_controller %> < ActionController::Base
+  include <%= identity.authentication_concern %>
+<%- if authorization? -%>
+  include <%= identity.authorization_concern %>
+<%- end -%>
+<%- if captchable? -%>
+  include Captchable
+<%- end -%>
+
+  layout "<%= identity.controller_module %>"
+end

data/lib/generators/authnz_eleven/templates/controllers/concerns/api_token_authentication.rb.tt

@@ -0,0 +1,21 @@
+module <%= identity.nested_module("ApiTokenAuthentication") %>
+  extend ActiveSupport::Concern
+
+  included do
+    include ActionController::HttpAuthentication::Token::ControllerMethods
+    before_action :authenticate_api_token
+  end
+
+  private
+
+  attr_reader :current_api_token
+
+  def current_api_user
+    current_api_token.user
+  end
+
+  def authenticate_api_token
+    @current_api_token = authenticate_with_http_token { |secret, _| <%= identity.api_token_class %>.authenticate(secret) }
+    render json: { error: "Unauthorized" }, status: :unauthorized unless @current_api_token
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/concerns/authentication/easy_dev_login.rb.tt

@@ -0,0 +1,47 @@
+module <%= identity.authentication_concern %>::EasyDevLogin
+  extend ActiveSupport::Concern
+<%- if second_factor? -%>
+
+  def self.mfa_required?
+    ENV["REQUIRE_DEV_MFA"].present?
+  end
+
+  def self.passwords_required?
+    ENV["REQUIRE_DEV_PASSWORD"].present? || mfa_required?
+  end
+<%- else -%>
+
+  def self.passwords_required?
+    ENV["REQUIRE_DEV_PASSWORD"].present?
+  end
+<%- end -%>
+
+  included do
+    raise "Authentication::EasyDevLogin must never load outside development" unless Rails.env.development?
+
+    prepend_before_action :easy_dev_login!
+<%- if admin_mfa_gate? -%>
+
+    skip_before_action :require_admin_mfa unless Authentication::EasyDevLogin.mfa_required?
+<%- end -%>
+  end
+
+  private
+
+  def easy_dev_login!
+    return if Authentication::EasyDevLogin.passwords_required?
+    return if find_session_by_cookie.present?
+
+    email = params[:<%= sign_in_field %>]
+    return if email.blank?
+
+    user = <%= find_by_login_expr("email") %>
+    unless user
+      Rails.logger.warn("[EASY_DEV_LOGIN] no user found for #{email.inspect}; skipping bypass")
+      return
+    end
+
+    Rails.logger.warn("[EASY_DEV_LOGIN] signing in as #{user.<%= principals.display.column %>} (id=#{user.id}). Password bypass is active.")
+    <%= sign_in_call("user", via: :easy_dev_login, may_challenge: false) %>
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/concerns/authentication/registering.rb.tt

@@ -0,0 +1,25 @@
+module <%= identity.authentication_concern %>::Registering
+  extend ActiveSupport::Concern
+
+  private
+
+<%= advance_body %>
+
+  def finish_registration(result)
+    case result.status
+    when :created
+      session.delete(:<%= pending_registration_session_key %>)
+      <%= sign_in_call("result.user", via: "result.via", may_challenge: false) %>
+      redirect_to after_authentication_url, status: :see_other
+    when :taken
+      session.delete(:<%= pending_registration_session_key %>)
+      redirect_to <%= identity.route_scope %>_sign_in_path, alert: "You already have an account. Sign in to continue."
+    when :invalid
+      render_invalid_registration
+    end
+  end
+
+  def render_invalid_registration
+    render :new, status: :unprocessable_entity
+  end
+end