authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/controllers/invitations_controller.rb.tt

@@ -0,0 +1,65 @@
+class <%= identity.namespaced? ? "#{identity.module_name}::InvitationsController" : "InvitationsController" %> < <%= identity.controller_superclass %>
+  allow_unauthenticated_access only: :show
+<%- if teams? -%>
+  skip_before_action :require_team
+<%- end -%>
+
+  before_action :set_invitation
+
+<%- if teams? -%>
+  def show
+    return if authenticated?
+
+    if invited_account_exists?
+      remember_interrupted_destination
+      redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Sign in to accept your invitation."
+    else
+      session[:<%= session_key(:pending_invitation_token) %>] = params.expect(:token)
+      redirect_to <%= registration_entry_path %>, notice: "Create an account to accept your invitation."
+    end
+  end
+
+  def update
+    unless @invitation.accept(<%= identity.current_class %>.user)
+      return redirect_to <%= identity.nested_helper("root_path") %>, alert: "That invitation was sent to a different <%= multi_channel_invitable? ? "email address or phone number" : (email_invitable? ? "email address" : "phone number") %>."
+    end
+
+    team = @invitation.team
+<%- if session_carries_team? -%>
+    set_session_team!(team) if team
+    redirect_to <%= identity.nested_helper("root_path") %>, notice: team && "You've joined #{team.name}.", status: :see_other
+<%- elsif scope_teams? -%>
+    redirect_to team ? <%= team_root_helper %>(team_id: team) : <%= identity.nested_helper("root_path") %>,
+      notice: team && "You've joined #{team.name}.", status: :see_other
+<%- else -%>
+    redirect_to root_url(script_name: team && "/#{team.id}"),
+      notice: team && "You've joined #{team.name}.", status: :see_other
+<%- end -%>
+  end
+<%- else -%>
+  def show
+    if authenticated?
+      redirect_to <%= identity.namespaced? ? "#{identity.route_scope}_root_path" : "root_path" %>, notice: "You already have an account."
+    else
+      session[:<%= session_key(:pending_invitation_token) %>] = params.expect(:token)
+      redirect_to <%= registration_entry_path %>, notice: "Create an account to accept your invitation."
+    end
+  end
+<%- end -%>
+
+  private
+
+  def set_invitation
+    @invitation = <%= identity.invitation_class %>.find_by_token_for(:invitation, params.expect(:token))
+
+    unless @invitation
+      redirect_to <%= identity.namespaced? ? "#{identity.route_scope}_root_path" : "root_path" %>, alert: "That invitation is invalid or has expired."
+    end
+  end
+<%- if teams? -%>
+
+  def invited_account_exists?
+    <%= identity.class_name %>.exists?(@invitation.sent_to_channel => @invitation.sent_to)
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/api_tokens_controller.rb.tt

@@ -0,0 +1,54 @@
+class <%= identity.settings_module %>::ApiTokensController < <%= identity.settings_controller %>
+<%- if sudoable? -%>
+  require_sudo message: "Please confirm it's you before creating an API token.", only: :create
+<%- end -%>
+<%- if impersonatable? -%>
+  before_action :refuse_impersonation
+<%- end -%>
+<%- if guestable? -%>
+  before_action :refuse_guest
+<%- end -%>
+<%- if sudoable? || impersonatable? || guestable? -%>
+
+<%- end -%>
+  def index
+    @api_tokens = <%= identity.current_class %>.user.api_tokens.order(created_at: :desc)
+  end
+
+  def create
+    @api_token, @secret = <%= identity.api_token_class %>.issue!(user: <%= identity.current_class %>.user, name: params[:name].to_s.strip)
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:api_token_created)
+<%- end -%>
+    response.headers["Cache-Control"] = "no-store"
+    render :create, status: :created
+  rescue ActiveRecord::RecordInvalid => error
+    @api_tokens = <%= identity.current_class %>.user.api_tokens.order(created_at: :desc)
+    @error = error.record.errors.full_messages.to_sentence
+    render :index, status: :unprocessable_entity
+  end
+
+  def destroy
+    <%= identity.current_class %>.user.api_tokens.find(params[:id]).destroy!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:api_token_revoked)
+<%- end -%>
+    redirect_to <%= identity.settings_helper_prefix %>_api_tokens_path, notice: "API token revoked.", status: :see_other
+  end
+<%- if impersonatable? || guestable? -%>
+
+  private
+<%- if impersonatable? -%>
+
+  def refuse_impersonation
+    head :forbidden if <%= identity.current_class %>.impersonated_user
+  end
+<%- end -%>
+<%- if guestable? -%>
+
+  def refuse_guest
+    head :forbidden if <%= identity.current_class %>.user.guest?
+  end
+<%- end -%>
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/authentications/events_controller.rb.tt

@@ -0,0 +1,5 @@
+class <%= identity.settings_module %>::Authentications::EventsController < <%= identity.settings_controller %>
+  def index
+    @events = <%= identity.current_class %>.user.events.recent_first
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/dashboard_controller.rb.tt

@@ -0,0 +1,4 @@
+class <%= identity.settings_module %>::DashboardController < <%= identity.settings_controller %>
+  def index
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/email_verifications_controller.rb.tt

@@ -0,0 +1,15 @@
+class <%= identity.settings_module %>::EmailVerificationsController < <%= identity.settings_controller %>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.email_verification, only: :create,
+    with: -> { redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, alert: "Too many links requested. Please try again later." })
+
+  def create
+<%- unless coy? -%>
+    unless <%= identity.current_class %>.user.pending_email
+      return redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, alert: "You have no email confirmation waiting."
+    end
+
+<%- end -%>
+    <%= deferred_call("#{identity.current_class}.user", :send_email_change_verification) %>
+    redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, notice: "We sent you another link."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/emails_controller.rb.tt

@@ -0,0 +1,93 @@
+class <%= identity.settings_module %>::EmailsController < <%= identity.settings_controller %>
+<%- if sudoable? -%>
+  require_sudo message: "Please confirm it's you before changing your email address.", only: :update
+<%- end -%>
+<%- if email_verifiable? -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.email_verification, only: :update,
+    with: -> { redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, alert: "Too many links requested. Please try again later.", status: :see_other })
+<%- end -%>
+<%- if password? && !sudoable? -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.password_challenge, only: :update, name: "password_challenge",
+    with: -> { redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, alert: "Too many attempts. Please try again later.", status: :see_other })
+<%- end -%>
+  before_action :set_user
+
+  def edit
+  end
+<%- if email_verifiable? -%>
+
+  def update
+<%- if security_notifications? -%>
+    old_email = @user.email
+<%- end -%>
+<%- if password? && !sudoable? -%>
+    @user.assign_attributes(user_params.except(:email))
+<%- end -%>
+    @user.stage_email(user_params[:email])
+    return render :edit, status: :unprocessable_entity unless @user.save
+    unless @user.pending_email
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:email_changed, to: old_email) if @user.email_previously_changed?
+<%- end -%>
+      return redirect_to_settled
+    end
+
+    <%= deferred_call("@user", :send_email_change_verification) %>
+    redirect_to_edit("Check your email for a link to confirm your new address.")
+  end
+<%- else -%>
+
+  def update
+<%- if security_notifications? -%>
+    old_email = @user.email
+<%- end -%>
+    if @user.update(user_params)
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:email_changed, to: old_email) if @user.email_previously_changed?
+<%- end -%>
+      redirect_to_settled
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  rescue ActiveRecord::RecordNotUnique
+    respond_to_taken_email
+  end
+<%- end -%>
+
+  private
+<%- unless email_verifiable? -%>
+
+  def respond_to_taken_email
+    @user.errors.add(:email, :taken)
+    render :edit, status: :unprocessable_entity
+  end
+<%- end -%>
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def user_params
+<%- if password? && !sudoable? -%>
+    params.permit(:email, :password_challenge).with_defaults(password_challenge: "")
+<%- else -%>
+    params.permit(:email)
+<%- end -%>
+  end
+
+  def redirect_to_settled
+<%- if principals.email.optional? -%>
+    return redirect_to_edit("Your email has been removed.") if @user.email.blank?
+
+<%- end -%>
+<%- unless email_verifiable? -%>
+    return redirect_to_edit("Your email has been changed.") if @user.email_previously_changed?
+
+<%- end -%>
+    redirect_to_edit("That's already your email address.")
+  end
+
+  def redirect_to_edit(notice)
+    redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, notice: notice, status: :see_other
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/invitations_controller.rb.tt

@@ -0,0 +1,61 @@
+class <%= identity.settings_module %>::InvitationsController < <%= identity.settings_controller %>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.invitation, only: :create,
+    with: -> { redirect_to new_<%= identity.settings_helper_prefix %>_invitation_path, alert: "Too many invitations. Please try again later." })
+
+  def new
+    @invitation = <%= identity.invitation_class %>.new
+<%- if teams? -%>
+    @teams = <%= identity.current_class %>.user.teams
+<%- end -%>
+  end
+
+  def create
+    @invitation = <%= identity.current_class %>.user.sent_invitations.new(invitation_params)
+<%- if teams? -%>
+    @invitation.team = invited_team
+<%- end -%>
+
+    unless @invitation.save
+<%- if teams? -%>
+      @teams = <%= identity.current_class %>.user.teams
+<%- end -%>
+      return render :new, status: :unprocessable_entity
+    end
+
+<%- if coy? -%>
+    <%= deferred_call("@invitation", :offer_unless_redundant) %>
+
+    redirect_to new_<%= identity.settings_helper_prefix %>_invitation_path, notice: "Invitation sent to #{@invitation.sent_to}."
+<%- elsif teams? -%>
+    @invitation.offer
+    if invited_account_exists?
+      redirect_to new_<%= identity.settings_helper_prefix %>_invitation_path, notice: "Invitation sent to #{@invitation.sent_to}."
+    else
+      redirect_to new_<%= identity.settings_helper_prefix %>_invitation_path,
+        notice: "Invitation sent to #{@invitation.sent_to}. They'll join when they confirm their #{@invitation.email_addressed? ? "email" : "phone"}."
+    end
+<%- else -%>
+    @invitation.offer
+    redirect_to new_<%= identity.settings_helper_prefix %>_invitation_path,
+      notice: "Invitation sent to #{@invitation.sent_to}. They'll join when they confirm their #{@invitation.email_addressed? ? "email" : "phone"}."
+<%- end -%>
+  end
+
+  private
+<%- if teams? -%>
+
+  def invited_team
+    <%= identity.current_class %>.user.teams.find(params[:team_id]) if params[:team_id].present?
+  end
+<%- end -%>
+<%- if teams? && !coy? -%>
+
+  def invited_account_exists?
+    <%= identity.class_name %>.exists?(@invitation.sent_to_channel => @invitation.sent_to)
+  end
+<%- end -%>
+
+  def invitation_params
+    params.permit(:sent_to)
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/multi_factor_authentication/authenticators_controller.rb.tt

@@ -0,0 +1,87 @@
+class <%= identity.settings_module %>::MultiFactorAuthentication::AuthenticatorsController < <%= identity.settings_controller %>
+<%- if admin_mfa_gate? -%>
+  skip_impediments
+<%- end -%>
+  before_action :no_store, only: %i[new create]
+  before_action :set_user
+  before_action :set_totp, only: %i[new create]
+
+  def new
+    @provisioning_uri = @totp.provisioning_uri(@user.<%= principals.display.column %>)
+    @qr_svg = RQRCode::QRCode.new(@provisioning_uri).as_svg(
+      module_size: 4,
+      standalone: true,
+      use_path: true
+    )
+  end
+
+  def create
+    return just_check_code if @user.totp_enrolled_at? # Do not regenerate recovery codes if just checking code.
+
+    unless @totp.verify(params[:code], drift_behind: <%= identity.config_reference %>.second_factor.totp_drift_behind)
+      return redirect_to new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path, alert: "That code is incorrect."
+    end
+
+    should_mint = @user.recovery_codes.none?
+
+    @user.transaction do
+      @user.update!(totp_enrolled_at: Time.current)
+      @codes = <%= identity.recovery_code_class %>.regenerate_for(@user) if should_mint
+<%- if trackable? -%>
+      @user.record_event("<%= identity.singular %>.two_factor_enabled")
+<%- end -%>
+    end
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:authenticator_enabled)
+<%- end -%>
+
+    if should_mint
+      flash.delete(:alert)
+      flash.now[:notice] = "Two-factor authentication is on."
+      render "<%= identity.settings_path_prefix %>/multi_factor_authentication/recovery_codes/create"
+    else
+      redirect_to interrupted_destination(
+        otherwise: new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path
+      ), notice: "Two-factor authentication is on. Your existing recovery codes still work.",
+         status: :see_other
+    end
+  end
+
+  def show
+    redirect_to <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+  end
+
+  def destroy
+    @user.transaction do
+      @user.update!(totp_enrolled_at: nil, totp_secret: ROTP::Base32.random)
+      @user.discard_orphaned_recovery_codes!
+<%- if trackable? -%>
+      @user.record_event("<%= identity.singular %>.two_factor_disabled")
+<%- end -%>
+    end
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:authenticator_disabled)
+<%- end -%>
+
+    redirect_to <%= identity.settings_helper_prefix %>_path, notice: "Two-factor authentication is off.", status: :see_other
+  end
+
+  private
+
+  def just_check_code
+    if @totp.verify(params[:code], drift_behind: <%= identity.config_reference %>.second_factor.totp_drift_behind)
+      redirect_to new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path, notice: "That code is correct."
+    else
+      redirect_to new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path,
+        alert: "That code didn't match. Check you scanned the whole QR code, then try again."
+    end
+  end
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def set_totp
+    @totp = ROTP::TOTP.new(@user.totp_secret, issuer: <%= identity.config_reference %>.app_name)
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/multi_factor_authentication/recovery_codes_controller.rb.tt

@@ -0,0 +1,27 @@
+class <%= identity.settings_module %>::MultiFactorAuthentication::RecoveryCodesController < <%= identity.settings_controller %>
+  before_action :no_store, only: :create
+  before_action :set_user
+
+  def index
+    @remaining = @user.recovery_codes.count
+  end
+
+  def create
+    @codes = <%= identity.recovery_code_class %>.regenerate_for(@user)
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:recovery_codes_generated)
+<%- end -%>
+  end
+
+  def complete
+    redirect_to interrupted_destination(
+      otherwise: <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    ), status: :see_other
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/multi_factor_authentication/security_keys_controller.rb.tt

@@ -0,0 +1,86 @@
+class <%= identity.settings_module %>::MultiFactorAuthentication::SecurityKeysController < <%= identity.settings_controller %>
+<%- if sudoable? -%>
+  require_sudo_within <%= identity.config_reference %>.sudo.window,
+    message: "Please confirm it's you before adding a security key.", only: :new
+<%- end -%>
+<%- if admin_mfa_gate? -%>
+  skip_impediments
+<%- end -%>
+  before_action :set_user
+  before_action :set_security_key, only: %i[edit update destroy]
+
+  def index
+    @security_keys = <%= second_factor_keys_expr("@user") %>
+  end
+
+  def new
+    respond_to do |format|
+      format.html
+      format.json do
+        issue_webauthn_challenge(WebAuthn::Credential.options_for_create(
+          user: { id: @user.webauthn_handle, name: @user.<%= principals.display.column %> },
+          exclude: @user.webauthn_credentials.pluck(:external_id)
+        ))
+      end
+    end
+  end
+
+  def edit
+  end
+
+  def create
+    @user.transaction do
+      @security_key = @user.webauthn_credentials.create!(
+        **verify_webauthn_registration(JSON.parse(params[:credential].to_s), user_verification: false),
+        name: "Security key"<%= factor_attr(:second_factor) %>
+      )
+      @codes = <%= identity.recovery_code_class %>.regenerate_for(@user) if @user.recovery_codes.none?
+    end
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:security_key_added)
+<%- end -%>
+
+    if @codes
+      flash.delete(:alert)
+      flash.now[:notice] = "Your security key has been added. Save your recovery codes."
+      render "<%= identity.settings_path_prefix %>/multi_factor_authentication/recovery_codes/create"
+    else
+      redirect_to interrupted_destination(
+        otherwise: edit_<%= identity.settings_helper_prefix %>_mfa_security_key_path(@security_key)
+      ), notice: "Your security key has been added. Your existing recovery codes still work.",
+         status: :see_other
+    end
+  rescue WebAuthn::Error, JSON::ParserError
+    flash.now[:alert] = "We couldn't add that security key. Please try again."
+    render :new, status: :unprocessable_entity
+  end
+
+  def update
+    @security_key.update!(name: params[:name])
+    redirect_to <%= identity.settings_helper_prefix %>_mfa_security_keys_path, notice: "Renamed your security key.",
+      status: :see_other
+  end
+
+  def destroy
+    @user.transaction do
+      @security_key.destroy!
+      @user.discard_orphaned_recovery_codes!
+    end
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:security_key_removed)
+<%- end -%>
+
+    redirect_to <%= identity.settings_helper_prefix %>_mfa_security_keys_path, notice: "Removed #{@security_key.name}.",
+      status: :see_other
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def set_security_key
+    @security_key = <%= second_factor_keys_expr("@user") %>.find(params[:id])
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/multi_factor_authentication/sms_controller.rb.tt

@@ -0,0 +1,84 @@
+class <%= identity.settings_module %>::MultiFactorAuthentication::SmsController < <%= identity.settings_controller %>
+<%- if admin_mfa_gate? -%>
+  skip_impediments
+<%- end -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sms_second_factor, only: :create,
+    with: -> { redirect_to new_<%= identity.settings_helper_prefix %>_mfa_sms_path, alert: "Too many codes requested. Please try again later." })
+  before_action :no_store, only: :update
+  before_action :set_user
+<%- if phone_column_nullable? -%>
+  before_action :require_a_number_to_text, only: %i[create update]
+<%- end -%>
+
+  def new
+  end
+
+  def create
+    @user.issue_sms_challenge
+
+    redirect_to new_<%= identity.settings_helper_prefix %>_mfa_sms_path, notice: "We sent a code to your phone."
+  end
+
+  def show
+    redirect_to <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+  end
+
+  def update
+    unless @user.verify_sms_challenge(params[:code])
+      return redirect_to new_<%= identity.settings_helper_prefix %>_mfa_sms_path, alert: "That code is incorrect or has expired."
+    end
+
+    should_mint = @user.recovery_codes.none?
+
+    @user.transaction do
+      @user.update!(sms_enrolled_at: Time.current)
+      @codes = <%= identity.recovery_code_class %>.regenerate_for(@user) if should_mint
+<%- if trackable? -%>
+      @user.record_event("<%= identity.singular %>.two_factor_enabled")
+<%- end -%>
+    end
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:sms_mfa_enabled)
+<%- end -%>
+
+    if should_mint
+      flash.delete(:alert)
+      flash.now[:notice] = "Two-factor authentication is on."
+      render "<%= identity.settings_path_prefix %>/multi_factor_authentication/recovery_codes/create"
+    else
+      redirect_to interrupted_destination(otherwise: new_<%= identity.settings_helper_prefix %>_mfa_sms_path),
+         notice: "Two-factor authentication is on. Your existing recovery codes still work.",
+         status: :see_other
+    end
+  end
+
+  def destroy
+    @user.transaction do
+      @user.update!(sms_enrolled_at: nil)
+      @user.clear_sms_challenge
+      @user.discard_orphaned_recovery_codes!
+<%- if trackable? -%>
+      @user.record_event("<%= identity.singular %>.two_factor_disabled")
+<%- end -%>
+    end
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:sms_mfa_disabled)
+<%- end -%>
+
+    redirect_to <%= identity.settings_helper_prefix %>_path, notice: "Two-factor authentication is off.", status: :see_other
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+<%- if phone_column_nullable? -%>
+
+  def require_a_number_to_text
+    return if @user.phone.present?
+
+    redirect_to edit_<%= identity.settings_helper_prefix %>_phone_path, alert: "Add a phone number first."
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/omniauth_identities_controller.rb.tt

@@ -0,0 +1,27 @@
+class <%= identity.settings_module %>::OmniauthIdentitiesController < <%= identity.settings_controller %>
+  before_action :set_identity, only: :destroy
+
+  def index
+    @omniauth_identities = <%= identity.current_class %>.user.omniauth_identities.order(:provider, :created_at)
+  end
+
+  def destroy
+    if <%= identity.current_class %>.user.last_sign_in_method?(:omniauth)
+      return redirect_to <%= identity.settings_helper_prefix %>_omniauth_identities_path,
+        alert: "This is the only way into your account. Link another before removing this one.", status: :see_other
+    end
+
+    @omniauth_identity.destroy!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:connected_account_unlinked)
+<%- end -%>
+    redirect_to <%= identity.settings_helper_prefix %>_omniauth_identities_path, notice: "Unlinked #{@omniauth_identity.provider_name}.",
+      status: :see_other
+  end
+
+  private
+
+  def set_identity
+    @omniauth_identity = <%= identity.current_class %>.user.omniauth_identities.find(params[:id]) # Scope the lookup to the signed-in user to prevent unlinking another account's provider identity.
+  end
+end