authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/controllers/settings/passkeys_controller.rb.tt

@@ -0,0 +1,70 @@
+class <%= identity.settings_module %>::PasskeysController < <%= identity.settings_controller %>
+<%- if sudoable? -%>
+  require_sudo_within <%= identity.config_reference %>.sudo.window,
+    message: "Please confirm it's you before adding a passkey.", only: :new
+<%- end -%>
+  before_action :set_user
+  before_action :set_passkey, only: %i[edit update destroy]
+
+  def index
+    @passkeys = @user.webauthn_credentials<%= ".passkeys" if passkey_and_security_keys? %>
+  end
+
+  def new
+    respond_to do |format|
+      format.html
+      format.json do
+        issue_webauthn_challenge(WebAuthn::Credential.options_for_create(
+          user: { id: @user.webauthn_handle, name: @user.<%= principals.display.column %> },
+          exclude: @user.webauthn_credentials.pluck(:external_id),
+          authenticator_selection: { resident_key: "required", user_verification: "required" } # Discoverable, user-verified credentials are required because these passkeys perform passwordless sign-in.
+        ))
+      end
+    end
+  end
+
+  def edit
+  end
+
+  def create
+    @passkey = @user.webauthn_credentials.create!(
+      **verify_webauthn_registration(params.expect(credential: {}), user_verification: true),
+      name: "Passkey"<%= factor_attr(:first_factor) %>
+    )
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:passkey_added)
+<%- end -%>
+
+    render json: { status: "ok", location: edit_<%= identity.settings_helper_prefix %>_passkey_url(@passkey) }, status: :created
+  rescue WebAuthn::Error
+    render json: { error: "We couldn't add that passkey. Please try again." }, status: :unprocessable_entity
+  end
+
+  def update
+    @passkey.update!(name: params[:name])
+    redirect_to <%= identity.settings_helper_prefix %>_passkeys_path, notice: "Renamed your passkey.", status: :see_other
+  end
+
+  def destroy
+    if @user.last_sign_in_method?(:passkey)
+      return redirect_to <%= identity.settings_helper_prefix %>_passkeys_path,
+        alert: "This is the only way into your account. Add another passkey before removing this one.", status: :see_other
+    end
+
+    @passkey.destroy!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:passkey_removed)
+<%- end -%>
+    redirect_to <%= identity.settings_helper_prefix %>_passkeys_path, notice: "Removed #{@passkey.name}.", status: :see_other
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def set_passkey
+    @passkey = @user.webauthn_credentials<%= ".passkeys" if passkey_and_security_keys? %>.find(params[:id]) # Scope the lookup to the signed-in user and first-factor passkeys to prevent cross-account or wrong-factor changes.
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/passwords_controller.rb.tt

@@ -0,0 +1,74 @@
+class <%= identity.settings_module %>::PasswordsController < <%= identity.settings_controller %>
+<%- if password_rotatable? -%>
+  skip_impediments
+<%- end -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.password_challenge, only: :update, name: "password_challenge",
+    with: -> { redirect_to edit_<%= identity.settings_helper_prefix %>_password_path, alert: "Too many attempts. Please try again later.", status: :see_other })
+  before_action :set_user
+
+  def edit
+  end
+
+  def update
+    if @user.update(user_params)
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:password_changed)
+<%- end -%>
+      redirect_to interrupted_destination(otherwise: edit_<%= identity.settings_helper_prefix %>_password_path),
+        notice: "Your password has been changed.", status: :see_other
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  end
+<%- if password_nullable? -%>
+
+  def create
+    if @user.password_set?
+      return redirect_to edit_<%= identity.settings_helper_prefix %>_password_path,
+        alert: "You already have a password. Change it instead.", status: :see_other
+    end
+
+    if @user.update(new_password_params)
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:password_set)
+<%- end -%>
+      redirect_to edit_<%= identity.settings_helper_prefix %>_password_path, notice: "Your password has been set.",
+        status: :see_other
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  end
+<%- end -%>
+<%- if password_removable? -%>
+
+  def destroy
+    if @user.last_sign_in_method?(:password)
+      return redirect_to edit_<%= identity.settings_helper_prefix %>_password_path,
+        alert: "This is the only way into your account. Add another way to sign in before removing it.", status: :see_other
+    end
+
+    @user.update_columns(password_digest: nil<%= password_rotatable? ? ", password_changed_at: nil" : "" %>)
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:password_removed)
+<%- end -%>
+    redirect_to edit_<%= identity.settings_helper_prefix %>_password_path, notice: "Your password has been removed.",
+      status: :see_other
+  end
+<%- end -%>
+
+  private
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def user_params
+    params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
+  end
+<%- if password_nullable? -%>
+
+  def new_password_params
+    params.permit(:password, :password_confirmation)
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/phone_verifications_controller.rb.tt

@@ -0,0 +1,39 @@
+class <%= identity.settings_module %>::PhoneVerificationsController < <%= identity.settings_controller %>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.phone_verification, only: :create,
+    with: -> { redirect_to new_<%= identity.settings_helper_prefix %>_phone_verification_path, alert: "Too many codes requested. Please try again later." })
+  before_action :set_user
+  before_action :require_something_to_verify
+
+  def new
+  end
+
+  def create
+    <%= deferred_call("@user", :request_phone_change_verification) %>
+
+    redirect_to new_<%= identity.settings_helper_prefix %>_phone_verification_path, notice: "We sent you another code."
+  end
+
+  def update
+    if @user.verify_sms_challenge(params[:code], to: @user.pending_phone) && @user.verify_pending_phone
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:phone_changed)
+<%- end -%>
+      redirect_to <%= identity.settings_helper_prefix %>_path, notice: "Your phone number has been verified.", status: :see_other
+    else
+      flash.now[:alert] = "That code is incorrect or has expired."
+      render :new, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def require_something_to_verify
+    return if @user.pending_phone.present?
+
+    redirect_to edit_<%= identity.settings_helper_prefix %>_phone_path, alert: "Add a phone number first."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/phones_controller.rb.tt

@@ -0,0 +1,88 @@
+class <%= identity.settings_module %>::PhonesController < <%= identity.settings_controller %>
+<%- if sudoable? -%>
+  require_sudo message: "Please confirm it's you before changing your phone number.", only: :update
+<%- end -%>
+<%- if phone_verifiable? -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.phone_verification, only: :update,
+    with: -> { redirect_to edit_<%= identity.settings_helper_prefix %>_phone_path, alert: "Too many codes requested. Please try again later.", status: :see_other })
+<%- end -%>
+<%- if password? && !sudoable? -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.password_challenge, only: :update, name: "password_challenge",
+    with: -> { redirect_to edit_<%= identity.settings_helper_prefix %>_phone_path, alert: "Too many attempts. Please try again later.", status: :see_other })
+<%- end -%>
+  before_action :set_user
+
+  def edit
+  end
+<%- if phone_verifiable? -%>
+
+  def update
+<%- if password? && !sudoable? -%>
+    @user.assign_attributes(user_params.except(:phone))
+<%- end -%>
+    @user.stage_phone(user_params[:phone])
+    return render :edit, status: :unprocessable_entity unless @user.save
+    unless @user.pending_phone
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:phone_changed) if @user.phone_previously_changed?
+<%- end -%>
+      return redirect_to_settled
+    end
+
+    <%= deferred_call("@user", :request_phone_change_verification) %>
+    redirect_to new_<%= identity.settings_helper_prefix %>_phone_verification_path, notice: "Check your phone for a code to confirm your new number.",
+      status: :see_other
+  end
+<%- else -%>
+
+  def update
+    if @user.update(user_params)
+<%- if security_notifications? -%>
+      <%= identity.mailer_class %>.send_security_notification(:phone_changed) if @user.phone_previously_changed?
+<%- end -%>
+      redirect_to_settled
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  rescue ActiveRecord::RecordNotUnique
+    respond_to_taken_phone
+  end
+<%- end -%>
+
+  private
+<%- unless phone_verifiable? -%>
+
+  def respond_to_taken_phone
+    @user.errors.add(:phone, :taken)
+    render :edit, status: :unprocessable_entity
+  end
+<%- end -%>
+
+  def set_user
+    @user = <%= identity.current_class %>.user
+  end
+
+  def user_params
+<%- if password? && !sudoable? -%>
+    params.permit(:phone, :password_challenge).with_defaults(password_challenge: "")
+<%- else -%>
+    params.permit(:phone)
+<%- end -%>
+  end
+
+  def redirect_to_settled
+<%- if principals.phone.optional? -%>
+    return redirect_to_edit("Your phone has been removed.") if @user.phone.blank?
+
+<%- end -%>
+<%- unless phone_verifiable? -%>
+    return redirect_to_edit("Your phone has been changed.") if @user.phone_previously_changed?
+
+<%- end -%>
+    redirect_to_edit("That's already your phone number.")
+  end
+
+  def redirect_to_edit(notice)
+    redirect_to edit_<%= identity.settings_helper_prefix %>_phone_path, notice: notice, status: :see_other
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/sessions_controller.rb.tt

@@ -0,0 +1,29 @@
+class <%= identity.settings_module %>::SessionsController < <%= identity.settings_controller %>
+<%- if max_sessions_prompt? -%>
+  skip_impediments
+<%- end -%>
+  before_action :set_sessions
+
+  def index
+    @sessions = @sessions.order(created_at: :desc)
+  end
+
+  def destroy
+    @sessions.find(params[:id]).destroy!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:session_revoked)
+<%- end -%>
+    redirect_to interrupted_destination(otherwise: <%= identity.settings_helper_prefix %>_sessions_path),
+      notice: "That session has been signed out.", status: :see_other
+  end
+
+  private
+
+  def set_sessions
+<%- if timeoutable? -%>
+    @sessions = <%= identity.current_class %>.user.sessions.active
+<%- else -%>
+    @sessions = <%= identity.current_class %>.user.sessions
+<%- end -%>
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/settings/users_controller.rb.tt

@@ -0,0 +1,42 @@
+class <%= identity.settings_module %>::UsersController < <%= identity.settings_controller %>
+<%- if sudoable? -%>
+  require_sudo message: "Please confirm it's you before deleting your account.", only: :destroy
+<%- elsif password? -%>
+  rate_limit(**<%= identity.config_reference %>.rate_limits.password_challenge, only: :destroy, name: "password_challenge",
+    with: -> { redirect_to <%= identity.settings_helper_prefix %>_user_path, alert: "Too many attempts. Please try again later.", status: :see_other })
+  before_action :require_password_challenge, only: :destroy
+<%- end -%>
+  before_action :require_confirmation, only: :destroy
+
+  def show
+  end
+
+  def destroy
+    user = <%= identity.current_class %>.user
+<%- if security_notifications? -%>
+    email = user.email
+<%- end -%>
+    user.destroy!
+<%- if security_notifications? -%>
+    <%= identity.mailer_class %>.send_security_notification(:account_deleted, to: email)
+<%- end -%>
+    <%= identity.current_class %>.session = nil
+    redirect_to root_path, notice: "Your account has been deleted.", status: :see_other
+  end
+
+  private
+
+  def require_confirmation
+    return if params[:confirmation] == "DELETE ACCOUNT"
+
+    redirect_to <%= identity.settings_helper_prefix %>_user_path, alert: "Type DELETE ACCOUNT to confirm.", status: :see_other
+  end
+<%- if !sudoable? && password? -%>
+
+  def require_password_challenge
+    return if <%= identity.current_class %>.user.authenticate(params[:password_challenge].to_s)
+
+    redirect_to <%= identity.settings_helper_prefix %>_user_path, alert: "Password challenge is invalid.", status: :see_other
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/settings_controller.rb.tt

@@ -0,0 +1,5 @@
+class <%= identity.settings_controller %> < <%= identity.controller_superclass %>
+<%- if teams? -%>
+  skip_before_action :require_team
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/controllers/teams_controller.rb.tt

@@ -0,0 +1,38 @@
+class <%= identity.nested_module("TeamsController") %> < <%= identity.controller_superclass %>
+  skip_impediments<%= " only: %i[index new create]" if scope_teams? %>
+
+  def index
+    @teams = <%= identity.current_class %>.user.teams
+  end
+<%- if scope_teams? -%>
+
+  def show
+  end
+<%- end -%>
+
+  def new
+    @team = <%= identity.team_class %>.new
+  end
+
+  def create
+    @team = <%= identity.team_class %>.new(team_params)
+    @team.memberships.build(<%= identity.singular %>: <%= identity.current_class %>.user)
+
+    if @team.save
+<%- if session_carries_team? -%>
+      set_session_team!(@team)
+      redirect_to interrupted_destination(otherwise: <%= identity.nested_helper("root_path") %>), notice: "#{@team.name} created.", status: :see_other
+<%- elsif scope_teams? -%>
+      redirect_to <%= team_root_helper %>(team_id: @team), notice: "#{@team.name} created."
+<%- else -%>
+      redirect_to root_url(script_name: "/#{@team.id}"), notice: "#{@team.name} created."
+<%- end -%>
+    else
+      render :new, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def team_params = params.expect(<%= identity.teams_table.singularize %>: [ :name ])
+end

data/lib/generators/authnz_eleven/templates/controllers/users/credential_enrollments/passkeys_controller.rb.tt

@@ -0,0 +1,36 @@
+class <%= identity.module_name %>::CredentialEnrollments::PasskeysController < <%= identity.controller_superclass %>
+  include <%= identity.authentication_concern %>::Registering
+
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sign_up, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_new_registration_passkey_path, alert: "Too many attempts. Please try again later." })
+  before_action :set_registration
+
+  def new
+    respond_to do |format|
+      format.html
+      format.json do
+        options = WebAuthn::Credential.options_for_create(
+          user: { id: @registration.webauthn_handle, name: @registration.<%= principals.display.column %> },
+          authenticator_selection: { resident_key: "required", user_verification: "required" }
+        )
+        issue_webauthn_challenge(options)
+      end
+    end
+  end
+
+  def create
+    @registration.passkey = verify_webauthn_registration(JSON.parse(params[:credential].to_s), user_verification: true)
+    advance(@registration)
+  rescue WebAuthn::Error, JSON::ParserError
+    flash.now[:alert] = "We couldn't add that passkey. Please try again."
+    render :new, status: :unprocessable_entity
+  end
+
+  private
+
+  def set_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    redirect_to <%= registration_entry_path %> unless @registration
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/credential_enrollments/passwords_controller.rb.tt

@@ -0,0 +1,28 @@
+class <%= identity.module_name %>::CredentialEnrollments::PasswordsController < <%= identity.controller_superclass %>
+  include <%= identity.authentication_concern %>::Registering
+
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.sign_up, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_new_registration_password_path, alert: "Too many attempts. Please try again later." })
+  before_action :set_registration
+
+  def new
+  end
+
+  def create
+    return render :new, status: :unprocessable_entity unless @registration.update(password_params)
+
+    advance(@registration)
+  end
+
+  private
+
+  def set_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    redirect_to <%= identity.route_scope %>_sign_up_path unless @registration
+  end
+
+  def password_params
+    params.permit(:password, :password_confirmation)
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/credential_enrollments_controller.rb.tt

@@ -0,0 +1,14 @@
+class <%= identity.module_name %>::CredentialEnrollmentsController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  before_action :set_registration
+
+  def show
+  end
+
+  private
+
+  def set_registration
+    @registration = <%= identity.pending_registration_class %>.unexpired.find_by(id: session[:<%= pending_registration_session_key %>])
+    redirect_to <%= identity.route_scope %>_sign_up_path unless @registration
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/easy_dev_logins_controller.rb.tt

@@ -0,0 +1,19 @@
+class <%= identity.module_name %>::EasyDevLoginsController < <%= identity.controller_superclass %>
+  allow_unauthenticated_access
+  before_action :ensure_development
+
+  def create
+    user = <%= find_by_login_expr("params[:#{sign_in_field}]") %>
+    return redirect_to <%= identity.route_scope %>_sign_in_path(<%= login_hint_param %>: params[:<%= sign_in_field %>]), alert: "No user with that <%= login_keys_phrase %>." unless user
+
+    <%= sign_in_call("user", via: :easy_dev_login, may_challenge: false) %>
+    redirect_to after_authentication_url, notice: "Now signed in as #{user.<%= principals.display.column %>}.", status: :see_other
+  end
+
+  private
+
+  def ensure_development
+    return if Rails.env.development?
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Easy dev login is only available in development."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/email_verifications_controller.rb.tt

@@ -0,0 +1,36 @@
+class <%= identity.module_name %>::EmailVerificationsController < <%= identity.controller_superclass %>
+  allow_unauthenticated_access
+  before_action :set_<%= identity.singular %>
+
+  def show
+  end
+
+  def update
+<%- if security_notifications? -%>
+    old_email = @<%= identity.singular %>.email
+<%- end -%>
+    return redirect_to_rejection unless @<%= identity.singular %>.verify_pending_email
+<%- if security_notifications? -%>
+
+    <%= identity.mailer_class %>.send_security_notification(:email_changed, to: old_email)
+<%- end -%>
+
+    if authenticated?
+      redirect_to edit_<%= identity.settings_helper_prefix %>_email_path, notice: "Your email has been confirmed."
+    else
+      redirect_to <%= identity.route_scope %>_sign_in_path, notice: "Your email has been confirmed. Please sign in."
+    end
+  end
+
+  private
+
+  def set_<%= identity.singular %>
+    @<%= identity.singular %> = <%= identity.class_name %>.find_by_token_for(:email_change_verification, params.expect(:sid))
+
+    redirect_to_rejection unless @<%= identity.singular %>
+  end
+
+  def redirect_to_rejection
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "That confirmation link is invalid or has expired."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/magic_link_controller.rb.tt

@@ -0,0 +1,53 @@
+class <%= identity.module_name %>::MagicLinkController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.magic_link, only: :create,
+    with: -> { redirect_to <%= identity.route_scope %>_new_magic_link_path, alert: "Too many sign-in links requested. Please try again later." })
+  before_action :set_user, only: :edit
+
+  def new
+  end
+
+  def edit
+  end
+
+  def update
+    @user = <%= identity.class_name %>.consume_magic_link(params.expect(:sid))
+    return redirect_to_rejection unless @user
+
+    <%= sign_in_call("@user", via: :magic_link) %>
+    redirect_to after_authentication_url, status: :see_other
+  end
+
+  def create
+<%- if captchable? -%>
+    unless captcha_verified?
+      flash.now[:alert] = "Captcha verification failed. Please try again."
+      return render :new, status: :unprocessable_entity
+    end
+
+<%- end -%>
+<%- if coy? -%>
+    <%= deferred_call(identity.class_name, :request_magic_link, "params[:email].to_s") %>
+    redirect_to <%= identity.route_scope %>_sign_in_path, notice: "Check your email for a sign in link."
+<%- else -%>
+    if <%= identity.class_name %>.request_magic_link(params[:email])
+      redirect_to <%= identity.route_scope %>_sign_in_path, notice: "Check your email for a sign in link."
+    else
+      redirect_to <%= identity.route_scope %>_new_magic_link_path, alert: "No account was found for that email."
+    end
+<%- end -%>
+  end
+
+  private
+
+  def set_user
+    token = params.expect(:sid)
+    @user = <%= identity.class_name %>.find_by_token_for(:magic_link, token)
+
+    redirect_to_rejection unless @user && Rails.cache.exist?(@user.magic_link_nonce_key)
+  end
+
+  def redirect_to_rejection
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "That magic link is invalid or has expired."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/multi_factor_authentication/challenge/recovery_codes_controller.rb.tt

@@ -0,0 +1,30 @@
+class <%= identity.module_name %>::MultiFactorAuthentication::Challenge::RecoveryCodesController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  rate_limit(**<%= identity.config_reference %>.rate_limits.recovery_code_challenge, only: :create,
+    with: -> { redirect_to new_<%= identity.route_scope %>_mfa_challenge_recovery_codes_path, alert: "Too many attempts. Please try again later." })
+  before_action :set_user
+
+  def new
+  end
+
+  def create
+    if <%= identity.recovery_code_class %>.redeem(user: @user, code: params[:code])
+<%- if rememberable? -%>
+      start_new_session_for(@user, via: :second_factor, remember: session.delete(:<%= session_key(:remember_me) %>)) # Keep recovery-code sign-in in the shared session funnel so bans, invitation claims, and session policy still apply.
+<%- else -%>
+      start_new_session_for(@user, via: :second_factor) # Keep recovery-code sign-in in the shared session funnel so bans, invitation claims, and session policy still apply.
+<%- end -%>
+      redirect_to after_authentication_url, status: :see_other
+    else
+      redirect_to new_<%= identity.route_scope %>_mfa_challenge_recovery_codes_path, alert: "That code is incorrect."
+    end
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.class_name %>.find_by_token_for!(:authentication_challenge, session[:<%= session_key(:challenge_token) %>])
+  rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Your sign-in challenge has expired. Please sign in again."
+  end
+end

data/lib/generators/authnz_eleven/templates/controllers/users/multi_factor_authentication/challenge/security_keys_controller.rb.tt

@@ -0,0 +1,34 @@
+class <%= identity.module_name %>::MultiFactorAuthentication::Challenge::SecurityKeysController < <%= identity.controller_superclass %>
+  require_unauthenticated_access
+  before_action :set_user
+
+  def new
+    respond_to do |format|
+      format.html
+      format.json do
+        issue_webauthn_challenge(WebAuthn::Credential.options_for_get(allow: <%= second_factor_keys_expr("@user") %>.pluck(:external_id)))
+      end
+    end
+  end
+
+  def create
+    verify_webauthn_assertion(params.expect(credential: {}), from: <%= second_factor_keys_expr("@user") %>)
+
+<%- if rememberable? -%>
+    start_new_session_for(@user, via: :second_factor, remember: session.delete(:<%= session_key(:remember_me) %>))
+<%- else -%>
+    start_new_session_for(@user, via: :second_factor)
+<%- end -%>
+    render json: { status: "ok", location: after_authentication_url }, status: :created
+  rescue WebAuthn::Error, ActiveRecord::RecordNotFound
+    render json: { error: "We couldn't verify that security key. Please try again." }, status: :unprocessable_entity
+  end
+
+  private
+
+  def set_user
+    @user = <%= identity.class_name %>.find_by_token_for!(:authentication_challenge, session[:<%= session_key(:challenge_token) %>])
+  rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound
+    redirect_to <%= identity.route_scope %>_sign_in_path, alert: "Your sign-in challenge has expired. Please sign in again."
+  end
+end