devise-sqrl 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f0f71964bae04a2a020056cfe296a40e14a3e8c01ab3709119f274f1b8d7c253
+  data.tar.gz: 519784d0cc906b24fb2b70ac0159b583ea1ef0d89602cd58ef1a934eb13354df
+SHA512:
+  metadata.gz: 3c17c54774d7953a2e0c4d4681c9b596e05f0726582742be9ae42d7e25ff91a01a82b39777823229592e4be3fb2cb277a7a47edec3605a8dd8983a577431796e
+  data.tar.gz: 48090a83d016885227aa0ebe5c3cdda318e20e02b9c99332e072617234c815a65482acd7ab1e60be377e6949734a1f58abe65a5b007b626b1555321618f349b6

data/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## 0.1.0 — 2026-10-20
+
+First release.
+
+- `devise :sqrl_authenticatable`: routes under the mapping (`/users/sqrl`, `cli`, `status`,
+  `callback`, `sqrl.js`, `refresh`, `identities`), a Warden strategy that signs in through
+  Devise's own hooks (trackable, rememberable, activatable), a controller, views and a
+  shared partial for `sessions/new`.
+- `bin/rails generate devise:sqrl:install`.
+- `sqrlonly` users cannot log in with a password (configurable blocked strategies);
+  `hardlock` users cannot reset passwords.
+- Identity management under the mapping; `ask` with deny button; 429/400 handling for
+  rate-limit hooks and disallowed hosts.
+- Requires Ruby 3.2+, Devise 4.9 or 5.0, Rails 7.1 to 8.1, and `sqrl-rails`.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel P. Clark
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,158 @@
+# devise-sqrl
+
+SQRL (Secure Quick Reliable Login) for [Devise](https://github.com/heartcombo/devise):
+one module, and your Devise models can sign in with SQRL next to (or instead of) a
+password.
+
+```ruby
+# Gemfile
+gem "devise-sqrl"
+```
+
+```sh
+bin/rails generate devise:sqrl:install        # or: devise:sqrl:install Admin
+bin/rails db:migrate
+```
+
+The generator
+
+- copies the `sqrl_identities` / `sqrl_nuts` / `sqrl_pending_logins` migration (shared
+  with [sqrl-rails](../sqrl-rails)),
+- adds `:sqrl_authenticatable` to the model's `devise` call,
+- writes `config/initializers/devise_sqrl.rb`,
+- appends `<%= render "devise/shared/sqrl", resource_name: resource_name %>` to
+  `app/views/devise/sessions/new.html.erb` when you have generated Devise's views.
+
+```ruby
+class User < ApplicationRecord
+  devise :database_authenticatable, :registerable, :rememberable, :sqrl_authenticatable
+end
+```
+
+`devise_for :users` then routes:
+
+| Route | Purpose |
+| --- | --- |
+| `GET  /users/sqrl` | stand-alone SQRL login page (`new_user_sqrl_path`); `.json` gives the URL |
+| `POST /users/sqrl/cli` | the SQRL protocol endpoint (no CSRF token: authenticated by signatures) |
+| `GET  /users/sqrl/status` | cookie-bound poll for logins made from another device |
+| `GET  /users/sqrl/callback` | login completion (CPS `url=` or poll), signs the user in |
+| `GET  /users/sqrl/sqrl.js` | the browser-side script |
+| `GET  /users/sqrl/refresh` | a fresh login URL for the page (JSON) |
+| `GET  /users/sqrl/identities` | the signed-in user's identities, with Unlink |
+
+## How a login completes
+
+The callback runs the `:sqrl_authenticatable` Warden strategy, which claims the one-time
+CPS token (or the browser's own pending login after the poller saw it authenticated),
+finds the resource the identity belongs to, applies the unknown-identity policy, checks
+`active_for_authentication?` and calls `success!`. The controller then does
+`sign_in_and_redirect(resource_name, resource, event: :authentication)`, so
+`:trackable`, `:rememberable`, `:confirmable`, `:lockable` and your
+`after_sign_in_path_for` all behave exactly as with a password login.
+
+## Views
+
+Inside your own sign-in page:
+
+```erb
+<%= render "devise/shared/sqrl", resource_name: resource_name %>
+```
+
+or directly:
+
+```erb
+<%= sqrl_login_block_for(resource_name, return_to: "/dashboard", link_text: "Use SQRL") %>
+```
+
+`sqrl_login_url_for(:user)` and `sqrl_script_tag_for(:user)` are available for custom
+markup. The markup follows the `sqrl.js` contract of `sqrl-rack`.
+
+## Configuration
+
+Protocol and storage settings live in `Rails.application.config.sqrl` (see
+[sqrl-rails](../sqrl-rails): `host`, `insecure_http`, `require_ip_match`, `poll_requires_ip_match`, `nut_ttl`, `cps_token_ttl`,
+`ask`, `sin`, `stores`). The Devise-specific options go in `Devise.setup`:
+
+```ruby
+Devise.setup do |config|
+  config.sqrl_on_unknown_identity = :create   # :create (default), :link or :refuse
+  config.sqrl_create_resource = ->(identity, klass) { klass.new(email: "...", password: SecureRandom.hex(32)) }
+  config.sqrl_remember_me = false             # treat SQRL logins as "remember me"
+  config.sqrl_login_block = { link_text: "Sign in with SQRL" }
+  config.sqrl_failure_path = nil              # default: the scope's SQRL login page
+end
+```
+
+- `:create` builds a record with `SQRL::Rails::UserFactory` (placeholder email, random
+  password, so `:validatable` passes) and links the identity to it.
+- `:link` only accepts unknown identities while a user of that scope is signed in, and
+  attaches the identity to them (`user.link_sqrl_identity!`). Use it for "add SQRL to my
+  account" pages.
+- `:refuse` rejects unknown identities at the protocol level.
+
+Model API: `user.sqrl_identities`, `user.sqrl_linked?`, `user.sqrl_identity_for(idk)`,
+`user.link_sqrl_identity!(identity)`, `user.unlink_sqrl_identity!(idk)`,
+`User.find_for_sqrl(identity)`, `User.create_for_sqrl!(identity)`.
+
+Failure messages are Devise translations under `devise.failure`: `sqrl_invalid`,
+`sqrl_disabled`, `sqrl_unknown`, `sqrl_link_required`.
+
+## Account policies: `sqrlonly` and `hardlock`
+
+An identity that asked for `sqrlonly` makes `user.sqrl_only?` true: Devise's password
+strategy (and any strategy in `Devise.sqrl_only_blocked_strategies`) is then refused
+with the `devise.failure.sqrl_only` message, while SQRL logins, remember-me cookies and
+restored sessions keep working. An identity that asked for `hardlock` makes
+`user.hard_locked?` true: `send_reset_password_instructions` and `reset_password`
+(`:recoverable`) add the `errors.messages.sqrl_hard_locked` error instead of acting.
+
+## Identity management
+
+`GET /users/sqrl/identities` (`identities_user_sqrl_path`) lists the signed-in user's
+identities with an Unlink button (`DELETE /users/sqrl/identities/:id`,
+`unlink_identity_user_sqrl_path`). Unlinking calls `unlink_sqrl_identity!`.
+
+## `ask`, `sin`, hooks and the refresh route
+
+Protocol settings come from `Rails.application.config.sqrl` exactly as in `sqrl-rails`:
+`ask` (with `accept:` and `ask_deny_button`), `sin`, `rate_limit`, `before_issue`,
+`before_handle`, `allowed_hosts`, `host_cache_limit`, `prune_every`. A hook that raises
+`SQRL::Server::RateLimited` gets a 429; a disallowed host a 400. `GET /users/sqrl/refresh`
+hands the page a fresh login URL when a nut expires.
+
+## Custom controller
+
+```ruby
+devise_for :users, controllers: { sqrl: "users/sqrl" }
+
+class Users::SQRLController < Devise::SQRLController
+  def callback
+    super
+  end
+end
+```
+
+## OmniAuth instead?
+
+If you already route social logins through OmniAuth, `devise :omniauthable,
+omniauth_providers: [:sqrl]` with the [omniauth-sqrl](../omniauth-sqrl) gem works too.
+`devise-sqrl` is the lighter path: no OmniAuth middleware, and the SQRL endpoint lives
+under the Devise scope.
+
+## Testing your app
+
+The [sqrl-client](../sqrl-client) gem logs in without a browser:
+
+```ruby
+agent = SQRL::Client::Agent.new(identity: SQRL::Client::Identity.ephemeral)
+result = agent.login("http://127.0.0.1:3000/users/sign_in")
+result.authenticated? # => true; result.cookies carries the Devise session
+```
+
+See [`examples/devise-app`](../../examples/devise-app) for a complete application;
+`bundle exec rake spec:devise-sqrl` runs this gem's specs against an in-gem dummy app.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/app/controllers/devise/sqrl_controller.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+# The SQRL routes of a Devise mapping: the login page, the protocol endpoint, the
+# cookie-bound status poll, the login callback and the browser script.
+#
+# Override it like any Devise controller:
+#
+#   devise_for :users, controllers: { sqrl: "users/sqrl" }
+class Devise::SQRLController < DeviseController
+  # The protocol endpoint is authenticated by SQRL's own signatures; the client is not a
+  # browser and carries no CSRF token.
+  skip_forgery_protection only: %i[cli script]
+  # Polls and protocol requests must not count as user activity for :timeoutable.
+  prepend_before_action(only: %i[cli status script refresh]) { request.env["devise.skip_timeout"] = true }
+
+  # A before_issue / before_handle hook refused the request.
+  rescue_from ::SQRL::Server::RateLimited do |error|
+    render_sqrl_rack(sqrl_endpoint.rate_limited(error, json: request.format.json?))
+  end
+
+  # The request host may not be used to issue SQRL URLs.
+  rescue_from ::SQRL::Rack::HostNotAllowed do |error|
+    render plain: error.message, status: :bad_request
+  end
+  # Identity management is for the signed-in resource of this scope.
+  prepend_before_action :authenticate_scope!, only: %i[identities unlink]
+
+  # GET /users/sqrl : a stand-alone SQRL login page (the view issues the login URL
+  # through +sqrl_login_block_for+; the JSON form issues it here).
+  def new
+    respond_to do |format|
+      format.html
+      format.json do
+        login = sqrl_login_url_for(resource_name, return_to: sqrl_return_to)
+        render json: { url: login.url, nut: login.nut, status: sqrl_endpoint.status_url(request),
+                       callback: sqrl_endpoint.callback_url(request) }
+      end
+    end
+  end
+
+  # POST /users/sqrl/cli : the SQRL client's signed requests.
+  def cli
+    render_sqrl_rack(sqrl_endpoint.cli(request))
+  end
+
+  # GET /users/sqrl/status : {"authenticated": bool, "next": url}
+  def status
+    render_sqrl_rack(sqrl_endpoint.status(request))
+  end
+
+  # GET /users/sqrl/refresh : a fresh login URL for this browser session, as JSON.
+  def refresh
+    render_sqrl_rack(sqrl_endpoint.refresh(request))
+  end
+
+  # GET /users/sqrl/sqrl.js
+  def script
+    status, headers, body = sqrl_endpoint.script(request)
+    headers.each { |k, v| response.set_header(k, v) }
+    if status == 304
+      head :not_modified
+    else
+      render body: body.join, status: status, content_type: "application/javascript"
+    end
+  end
+
+  # GET /users/sqrl/callback[?t=TOKEN] : completes the login through the
+  # :sqrl_authenticatable Warden strategy and signs the resource in like Devise's
+  # sessions controller does. The strategy is run explicitly (not through
+  # +warden.authenticate!+) so that the one-time token is verified even when this
+  # browser already has a signed-in user, for example when linking a second identity.
+  def callback
+    strategy = Warden::Strategies[:sqrl_authenticatable].new(request.env, resource_name)
+    strategy._run!
+    return failure(strategy.message || :sqrl_invalid) unless strategy.successful?
+
+    self.resource = strategy.user
+    completion = request.env["devise.sqrl.completion"]
+    return_to = completion&.return_to
+    store_location_for(resource_name, return_to) if same_site_path?(return_to)
+    set_flash_message!(:notice, :signed_in)
+    sign_in_and_redirect(resource_name, resource, event: :authentication)
+  end
+
+  # GET /users/sqrl/identities : the SQRL identities linked to the signed-in resource.
+  def identities
+    @identities = resource.sqrl_identities.order(:created_at)
+    @current_idk = sqrl_endpoint.current_identity(request)&.idk_b64
+  end
+
+  # DELETE /users/sqrl/identities/:id : detach one identity from the signed-in resource.
+  # The site keeps the protocol association; the next login with that identity is
+  # treated as an unknown identity again.
+  def unlink
+    identity = resource.sqrl_identities.find_by(id: params[:id])
+    if identity
+      current = sqrl_endpoint.current_identity(request)&.idk_b64
+      resource.unlink_sqrl_identity!(identity)
+      sqrl_endpoint.logout(request) if current && current == identity.idk
+      set_flash_message!(:notice, :identity_unlinked)
+    else
+      set_flash_message!(:alert, :identity_not_found)
+    end
+    redirect_to identities_sqrl_path(resource_name), status: :see_other
+  end
+
+  protected
+
+  # Like Devise's registrations controller: the signed-in resource of this scope.
+  def authenticate_scope!
+    send(:"authenticate_#{resource_name}!", force: true)
+    self.resource = send(:"current_#{resource_name}")
+  end
+
+  # Redirect to the SQRL login page (or +Devise.sqrl_failure_path+) with the reason.
+  def failure(reason)
+    message = reason.is_a?(Symbol) ? I18n.t("devise.failure.#{reason}", default: reason.to_s.humanize) : reason.to_s
+    flash[:alert] = message if is_flashing_format?
+    redirect_to sqrl_failure_path, allow_other_host: false
+  end
+
+  def sqrl_endpoint
+    @sqrl_endpoint ||= Devise::SQRL.endpoint_for(devise_mapping, request)
+  end
+
+  def sqrl_failure_path
+    Devise.sqrl_failure_path || new_sqrl_path(resource_name)
+  end
+
+  def sqrl_return_to
+    candidate = params[:return_to].presence
+    same_site_path?(candidate) ? candidate : nil
+  end
+
+  # The signed-in resource a new identity may be linked to (policy :link).
+  def sqrl_link_user_ref
+    return nil unless Devise::SQRL.on_unknown_identity == :link
+
+    current = warden.user(resource_name)
+    current && ::SQRL::Rails.user_ref(current)
+  end
+
+  def same_site_path?(path)
+    ::SQRL::Rails::SignIn.same_site_path?(path)
+  end
+
+  def render_sqrl_rack(triple)
+    status, headers, body = triple
+    headers.each { |k, v| response.set_header(k, v) }
+    render body: body.join, status: status, content_type: headers["content-type"]
+  end
+
+  def translation_scope
+    "devise.sqrl"
+  end
+
+  include DeviseSQRLHelper
+end

data/app/helpers/devise_sqrl_helper.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# View helpers for the SQRL login block of a Devise mapping.
+module DeviseSQRLHelper
+  # The complete SQRL login markup (link, QR code, status text and script tag) for a
+  # Devise scope, wired to that scope's +/…/sqrl/*+ routes. Each render issues a fresh
+  # login URL.
+  #
+  #   <%= sqrl_login_block_for(resource_name) %>
+  #
+  # @param resource_or_scope [Symbol, Object] +:user+, +resource_name+ or a record
+  # @param return_to [String, nil] same-site path to land on after login
+  # @param script [Boolean] append the +sqrl.js+ script tag
+  # @param options [Hash] passed to +SQRL::Rack::LoginBlock.render+ (merged over
+  #   +Devise.sqrl_login_block+)
+  # @return [ActiveSupport::SafeBuffer]
+  def sqrl_login_block_for(resource_or_scope, return_to: nil, script: true, **options)
+    mapping = sqrl_devise_mapping(resource_or_scope)
+    endpoint = Devise::SQRL.endpoint_for(mapping, request)
+    login = sqrl_login_url_for(mapping.name, return_to: return_to)
+    opts = Devise.sqrl_login_block.to_h.merge(options)
+    ::SQRL::Rack::LoginBlock.render(login_url: login.url, status_url: endpoint.status_url(request),
+                                    script_url: (endpoint.script_url(request) if script),
+                                    refresh_url: endpoint.refresh_url(request), **opts).html_safe
+  end
+
+  # The +sqrl://+ login URL issued for a scope (one per request per scope).
+  #
+  # @return [SQRL::Server::LoginURL]
+  def sqrl_login_url_for(resource_or_scope, return_to: nil)
+    mapping = sqrl_devise_mapping(resource_or_scope)
+    @_devise_sqrl_logins ||= {}
+    @_devise_sqrl_logins[mapping.name] ||= Devise::SQRL.endpoint_for(mapping, request)
+                                                       .issue(request, return_to: sqrl_devise_return_to(return_to),
+                                                                       link_user_ref: sqrl_devise_link_user_ref(mapping))
+  end
+
+  # +<script src="/users/sqrl/sqrl.js" defer>+ for a scope.
+  def sqrl_script_tag_for(resource_or_scope)
+    mapping = sqrl_devise_mapping(resource_or_scope)
+    src = Devise::SQRL.endpoint_for(mapping, request).script_url(request)
+    ::SQRL::Rack::LoginBlock.script_tag(src: src).html_safe
+  end
+
+  private
+
+  def sqrl_devise_mapping(resource_or_scope)
+    Devise.mappings.fetch(Devise::Mapping.find_scope!(resource_or_scope))
+  end
+
+  def sqrl_devise_return_to(explicit)
+    candidate = explicit.presence || (params[:return_to].presence if respond_to?(:params))
+    ::SQRL::Rails::SignIn.same_site_path?(candidate) ? candidate : nil
+  rescue StandardError
+    nil
+  end
+
+  def sqrl_devise_link_user_ref(mapping)
+    return nil unless Devise::SQRL.on_unknown_identity == :link
+
+    warden = request.env["warden"]
+    current = warden&.user(mapping.name)
+    current && ::SQRL::Rails.user_ref(current)
+  rescue StandardError
+    nil
+  end
+end

data/app/views/devise/shared/_sqrl.html.erb

@@ -0,0 +1,6 @@
+<%# Drop this partial into devise/sessions/new.html.erb:
+    <%= render "devise/shared/sqrl", resource_name: resource_name %> %>
+<div class="devise-sqrl">
+  <h3>Or sign in with SQRL</h3>
+  <%= sqrl_login_block_for(local_assigns.fetch(:resource_name) { resource_name }) %>
+</div>

data/app/views/devise/sqrl/identities.html.erb

@@ -0,0 +1,29 @@
+<h2>Your SQRL identities</h2>
+
+<% if flash[:alert].present? %><p class="alert"><%= flash[:alert] %></p><% end %>
+<% if flash[:notice].present? %><p class="notice"><%= flash[:notice] %></p><% end %>
+
+<% if @identities.empty? %>
+  <p id="sqrl-no-identities">No SQRL identity is linked to your account yet.</p>
+<% else %>
+  <table class="sqrl-identities">
+    <thead>
+      <tr><th>Identity</th><th>Linked</th><th>Last login</th><th>Logins</th><th>Flags</th><th></th></tr>
+    </thead>
+    <tbody>
+      <% @identities.each do |identity| %>
+        <tr id="sqrl-identity-<%= identity.id %>" data-sqrl-idk="<%= identity.idk %>">
+          <td><code><%= identity.short_idk %></code><% if identity.idk == @current_idk %> <em>(this session)</em><% end %></td>
+          <td><%= identity.created_at&.to_fs(:short) %></td>
+          <td><%= identity.last_login_at&.to_fs(:short) || "never" %></td>
+          <td><%= identity.logins %></td>
+          <td><%= identity.flags.join(", ") %></td>
+          <td><%= button_to "Unlink", unlink_identity_sqrl_path(resource_name, identity), method: :delete,
+                            form: { data: { turbo_confirm: "Unlink this SQRL identity?" } } %></td>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+<% end %>
+
+<p><%= link_to "Add another SQRL identity", new_sqrl_path(resource_name) if Devise::SQRL.on_unknown_identity == :link %></p>

data/app/views/devise/sqrl/new.html.erb

@@ -0,0 +1,9 @@
+<h2>Sign in with SQRL</h2>
+
+<% if flash[:alert].present? %>
+  <p class="alert"><%= flash[:alert] %></p>
+<% end %>
+
+<%= sqrl_login_block_for(resource_name, return_to: params[:return_to]) %>
+
+<%= render "devise/shared/links" if lookup_context.exists?("devise/shared/_links") %>

data/config/locales/en.yml

@@ -0,0 +1,16 @@
+en:
+  devise:
+    failure:
+      sqrl_invalid: "SQRL login failed or expired. Please try again."
+      sqrl_disabled: "SQRL login is disabled for this account."
+      sqrl_unknown: "This SQRL identity is not linked to an account."
+      sqrl_link_required: "Sign in first, then link your SQRL identity to your account."
+      sqrl_declined: "You declined the SQRL login."
+      sqrl_only: "This account signs in with SQRL only."
+    sqrl:
+      signed_in: "Signed in successfully."
+      identity_unlinked: "SQRL identity unlinked."
+      identity_not_found: "That SQRL identity is not linked to your account."
+  errors:
+    messages:
+      sqrl_hard_locked: "Password recovery is disabled for this account; sign in with SQRL instead."

data/lib/devise/models/sqrl_authenticatable.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Devise
+  # Devise's model-module namespace.
+  module Models
+    # Adds SQRL login to a Devise model.
+    #
+    #   class User < ApplicationRecord
+    #     devise :database_authenticatable, :sqrl_authenticatable
+    #   end
+    #
+    # The model gets +sqrl_identities+ (rows of the +sqrl_identities+ table from the
+    # sqrl-rails migration) and the lookup and linking methods the
+    # +:sqrl_authenticatable+ strategy relies on. No columns are needed on the model.
+    module SQRLAuthenticatable
+      extend ActiveSupport::Concern
+
+      included do
+        if respond_to?(:has_many)
+          has_many :sqrl_identities, -> { where(superseded_by: nil) },
+                   class_name: "SQRL::Rails::Identity", as: :user, dependent: :destroy
+        end
+      end
+
+      # @return [Array<Symbol>] columns the module needs on the model (none)
+      def self.required_fields(_klass)
+        []
+      end
+
+      # The SQRL identity record (+SQRL::Rails::Identity+) for an identity key, or nil.
+      #
+      # @param idk [String] base64url identity key
+      def sqrl_identity_for(idk)
+        sqrl_identities.find_by(idk: idk)
+      end
+
+      # Whether at least one SQRL identity is attached.
+      def sqrl_linked?
+        sqrl_identities.exists?
+      end
+
+      # Whether a SQRL identity of this record asked the site to refuse every non-SQRL
+      # way of signing in (+opt=sqrlonly+). Password logins are then refused by the
+      # Warden hook devise-sqrl installs (see +Devise.sqrl_only_blocked_strategies+).
+      def sqrl_only?
+        sqrl_identities.where(sqrlonly: true).exists?
+      end
+
+      # Whether a SQRL identity of this record asked the site to refuse every non-SQRL
+      # way of recovering the account (+opt=hardlock+). Password resets are then
+      # refused (+:recoverable+).
+      def hard_locked?
+        sqrl_identities.where(hardlock: true).exists?
+      end
+
+      # :recoverable – refuse to mail reset instructions to a hard-locked account. The
+      # record comes back with an error, which Devise's passwords controller renders.
+      def send_reset_password_instructions
+        return super unless hard_locked?
+
+        errors.add(:base, :sqrl_hard_locked)
+        nil
+      end
+
+      # :recoverable – refuse to set a new password through a reset token for a
+      # hard-locked account.
+      def reset_password(new_password, new_password_confirmation)
+        return super unless hard_locked?
+
+        errors.add(:base, :sqrl_hard_locked)
+        false
+      end
+
+      # Attach an identity (an +SQRL::Server::Identity+ from the protocol handler, an
+      # +SQRL::Rails::Identity+ row, or a base64url idk) to this record.
+      def link_sqrl_identity!(identity)
+        ::SQRL::Rails.stores.identities.update(sqrl_identity_idk_bytes(identity), user_ref: ::SQRL::Rails.user_ref(self))
+        self
+      end
+
+      # Detach an identity from this record (the site association stays; the identity can
+      # no longer sign in as this user).
+      def unlink_sqrl_identity!(identity)
+        row = sqrl_identity_for(sqrl_identity_idk_b64(identity))
+        row&.update!(user: nil)
+        self
+      end
+
+      private
+
+      def sqrl_identity_idk_b64(identity)
+        case identity
+        when String then identity
+        when ::SQRL::Rails::Identity then identity.idk
+        else identity.idk_b64
+        end
+      end
+
+      def sqrl_identity_idk_bytes(identity)
+        ::SQRL::Util.b64u_decode(sqrl_identity_idk_b64(identity))
+      end
+
+      # Class-level API added to the model.
+      module ClassMethods
+        # The record a SQRL identity belongs to, when it belongs to this model.
+        #
+        # @param identity [SQRL::Server::Identity]
+        # @return [Object, nil]
+        def find_for_sqrl(identity)
+          user = ::SQRL::Rails.user_from_ref(identity.user_ref)
+          return user if user.is_a?(self)
+
+          row = ::SQRL::Rails::Identity.active.find_by(idk: identity.idk_b64)
+          owner = row&.user
+          owner.is_a?(self) ? owner : nil
+        end
+
+        # Create a record for a brand-new identity and attach the identity to it.
+        #
+        # @param identity [SQRL::Server::Identity]
+        # @return [Object] the saved record
+        def create_for_sqrl!(identity)
+          factory = Devise.sqrl_create_resource
+          resource = factory ? factory.call(identity, self) : ::SQRL::Rails::UserFactory.call(identity, self)
+          raise Devise::SQRL::Error, "sqrl_create_resource returned no record" unless resource
+
+          resource.save! if resource.respond_to?(:new_record?) && resource.new_record?
+          resource.link_sqrl_identity!(identity)
+          resource
+        end
+      end
+    end
+  end
+end

data/lib/devise/sqrl/engine.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Devise
+  module SQRL
+    # Loads the controller, views, helper and translations into the host application.
+    class Engine < ::Rails::Engine
+      engine_name "devise_sqrl"
+
+      initializer "devise_sqrl.helpers" do
+        ActiveSupport.on_load(:action_controller_base) do
+          helper DeviseSQRLHelper
+        end
+        ActiveSupport.on_load(:action_view) do
+          include DeviseSQRLHelper
+        end
+      end
+
+      initializer "devise_sqrl.reset_on_reload" do |app|
+        app.reloader.to_prepare { Devise::SQRL.reset! } if app.respond_to?(:reloader)
+      end
+    end
+  end
+end

data/lib/devise/sqrl/hooks.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Enforces +sqrlonly+: a record whose SQRL identity asked the site to refuse non-SQRL
+# authentication is not allowed to sign in through a password strategy. The hook runs
+# like Devise's own activatable hook, after Warden set the user, and only when the
+# login came through one of +Devise.sqrl_only_blocked_strategies+ (the password
+# strategy by default). SQRL logins, remember-me cookies and sessions restored from the
+# cookie are untouched.
+Warden::Manager.after_set_user except: :fetch do |record, warden, options|
+  if record.respond_to?(:sqrl_only?) && Devise::SQRL.blocked_strategy?(warden.winning_strategy) && record.sqrl_only?
+    scope = options[:scope]
+    warden.logout(scope)
+    throw :warden, scope: scope, message: :sqrl_only
+  end
+end

data/lib/devise/sqrl/routes.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+# Rails routing namespace, reopened to add +devise_sqrl+.
+module ActionDispatch
+  # Rails routing namespace.
+  module Routing
+    # Devise calls +devise_sqrl+ for every mapping whose model declares
+    # +:sqrl_authenticatable+. The routes live under the mapping's path (+/users/sqrl+)
+    # and get the helpers +new_user_sqrl_path+, +cli_user_sqrl_path+,
+    # +status_user_sqrl_path+, +callback_user_sqrl_path+, +script_user_sqrl_path+,
+    # +identities_user_sqrl_path+ and +unlink_identity_user_sqrl_path(id)+.
+    class Mapper
+      protected
+
+      def devise_sqrl(mapping, controllers) # :nodoc:
+        resource :sqrl, only: [], controller: controllers[:sqrl], path: mapping.path_names[:sqrl] do
+          get :new, path: "", as: "new"
+          post :cli
+          get :status
+          get :callback
+          get :script, path: "sqrl.js"
+          get :refresh
+          get :identities
+          delete "identities/:id", action: :unlink, as: :unlink_identity
+        end
+      end
+    end
+  end
+end

data/lib/devise/sqrl.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "devise"
+require "sqrl-rails"
+
+# Devise namespace, reopened to add the SQRL module.
+module Devise
+  # SQRL login for Devise.
+  #
+  #   # Gemfile
+  #   gem "devise-sqrl"
+  #
+  #   class User < ApplicationRecord
+  #     devise :database_authenticatable, :sqrl_authenticatable
+  #   end
+  #
+  # `devise_for :users` then routes +/users/sqrl+ (login page), +POST /users/sqrl/cli+ (the
+  # SQRL endpoint), +/users/sqrl/status+ (cookie-bound poll), +/users/sqrl/callback+
+  # (login completion, through the +:sqrl_authenticatable+ Warden strategy) and
+  # +/users/sqrl/sqrl.js+. Render the login block inside your sign-in page with
+  # +<%= render "devise/shared/sqrl", resource_name: resource_name %>+.
+  #
+  # Protocol and storage settings come from +Rails.application.config.sqrl+ (the sqrl-rails
+  # gem); the Devise-specific choices are the +sqrl_*+ options below, set in
+  # +Devise.setup+.
+  module SQRL
+    # Same as SQRL::VERSION; the gems release in lockstep.
+    VERSION = ::SQRL::VERSION
+
+    # Raised for configuration problems.
+    class Error < ::SQRL::Error; end
+
+    @mutex = Mutex.new
+    @resolver = nil
+
+    class << self
+      # The {::SQRL::Rack::Endpoint} serving a Devise mapping for a request's host and
+      # scheme. Memoized per [host, scheme, mapping] in a bounded
+      # {::SQRL::Rack::HostResolver} cache; the stores are shared with sqrl-rails
+      # (+config.sqrl.stores+).
+      #
+      # @param mapping [Devise::Mapping]
+      # @param request [ActionDispatch::Request, Rack::Request]
+      # @return [::SQRL::Rack::Endpoint]
+      # @raise [::SQRL::Rack::HostNotAllowed] when the request host may not be used
+      def endpoint_for(mapping, request)
+        resolver = host_resolver
+        host, scheme = resolver.resolve(request)
+        resolver.fetch([host, scheme, mapping.name, mapping.fullpath]) { build_endpoint(mapping, host, scheme) }
+      end
+
+      # The host resolver built from +config.sqrl+ (host, scheme, allowed_hosts,
+      # host_cache_limit).
+      def host_resolver
+        config = ::SQRL::Rails.config
+        @mutex.synchronize do
+          scheme = config.scheme.presence || (config.insecure_http ? "qrl" : nil)
+          @resolver ||= ::SQRL::Rack::HostResolver.new(host: config.host.presence, scheme: scheme,
+                                                       allowed_hosts: config.allowed_hosts,
+                                                       limit: config.host_cache_limit,
+                                                       logger: config.logger || ::Rails.logger)
+        end
+      end
+
+      # Forget memoized endpoints (tests, configuration changes).
+      def reset!
+        @mutex.synchronize { @resolver = nil }
+        ::SQRL::Rails.reset!
+      end
+
+      # Devise-level paths of a mapping's SQRL routes.
+      #
+      # @return [Hash{Symbol => String}]
+      def paths_for(mapping)
+        base = "#{mapping.fullpath}/sqrl".squeeze("/")
+        { new: base, cli: "#{base}/cli", status: "#{base}/status", callback: "#{base}/callback",
+          script: "#{base}/sqrl.js", identities: "#{base}/identities", refresh: "#{base}/refresh" }
+      end
+
+      # Whether +strategy+ (a Warden strategy instance or name) is one that a
+      # +sqrlonly+ account must not sign in through.
+      def blocked_strategy?(strategy)
+        name = strategy.is_a?(Symbol) || strategy.is_a?(String) ? strategy.to_sym : strategy_name(strategy)
+        Array(Devise.sqrl_only_blocked_strategies).map(&:to_sym).include?(name)
+      end
+
+      # @return [Symbol] the Warden name of a strategy class
+      def strategy_name(strategy)
+        return nil if strategy.nil?
+
+        Warden::Strategies.send(:_strategies).key(strategy.class)
+      end
+
+      # The effective unknown-identity policy: Devise's +sqrl_on_unknown_identity+ when
+      # set, otherwise +config.sqrl.on_unknown_identity+.
+      #
+      # @return [Symbol] +:create+, +:link+ or +:refuse+
+      def on_unknown_identity
+        (Devise.sqrl_on_unknown_identity || ::SQRL::Rails.config.on_unknown_identity || :create).to_sym
+      end
+
+      private
+
+      def build_endpoint(mapping, host, scheme)
+        rails_config = ::SQRL::Rails.config
+        paths = paths_for(mapping)
+        options = rails_config.server_options.merge(on_unknown_identity: on_unknown_identity)
+        server_config = ::SQRL::Server::Config.new(**options, host: host, scheme: scheme,
+                                                              path: paths[:cli], callback_path: paths[:callback])
+        handler = ::SQRL::Server::Handler.new(config: server_config, stores: ::SQRL::Rails.stores)
+        ::SQRL::Rack::Endpoint.new(handler: handler,
+                                   session_key: "devise.sqrl.#{mapping.name}.pending_login",
+                                   identity_key: "devise.sqrl.#{mapping.name}.identity",
+                                   status_path: paths[:status], callback_path: paths[:callback],
+                                   script_path: paths[:script], refresh_path: paths[:refresh],
+                                   poll_requires_ip_match: rails_config.poll_requires_ip_match ? true : false,
+                                   ip: rails_config.ip || method(:client_ip))
+      end
+
+      def client_ip(request)
+        request.respond_to?(:remote_ip) ? request.remote_ip : request.ip
+      end
+    end
+  end
+
+  # --- Devise.setup options -------------------------------------------------------------
+
+  # What to do when an unknown SQRL identity completes a login: +:create+ an account,
+  # +:link+ it to the signed-in user only, or +:refuse+. +nil+ (the default) defers to
+  # +Rails.application.config.sqrl.on_unknown_identity+ (+:create+).
+  mattr_accessor :sqrl_on_unknown_identity
+  @@sqrl_on_unknown_identity = nil
+
+  # Callable +(identity, resource_class) -> resource+ used to build the account for a new
+  # identity under +:create+. Defaults to +SQRL::Rails::UserFactory+, which fills in a
+  # non-routable email and a random password so +:validatable+ passes.
+  mattr_accessor :sqrl_create_resource
+  @@sqrl_create_resource = nil
+
+  # Mark SQRL logins as "remember me" (needs +:rememberable+ on the model).
+  mattr_accessor :sqrl_remember_me
+  @@sqrl_remember_me = false
+
+  # Options passed to +SQRL::Rack::LoginBlock.render+ (link text, QR size, texts...).
+  mattr_accessor :sqrl_login_block
+  @@sqrl_login_block = {}
+
+  # Where to send the browser after a failed SQRL login; +nil+ means the mapping's SQRL
+  # login page.
+  mattr_accessor :sqrl_failure_path
+  @@sqrl_failure_path = nil
+
+  # Warden strategies a +sqrlonly+ account may not sign in through. The default blocks
+  # Devise's password strategy; add your own password-like strategies here. Remember-me
+  # cookies and the SQRL strategy itself are never blocked.
+  mattr_accessor :sqrl_only_blocked_strategies
+  @@sqrl_only_blocked_strategies = [:database_authenticatable]
+end
+
+Devise.add_module :sqrl_authenticatable,
+                  strategy: true,
+                  controller: :sqrl,
+                  route: { sqrl: %i[new cli status callback script refresh identities unlink_identity] },
+                  model: "devise/models/sqrl_authenticatable",
+                  no_input: true
+
+require_relative "sqrl/routes"
+require_relative "strategies/sqrl_authenticatable"
+require_relative "sqrl/hooks"
+require_relative "sqrl/engine"

data/lib/devise/strategies/sqrl_authenticatable.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "devise/strategies/base"
+
+module Devise
+  # Devise's Warden strategy namespace.
+  module Strategies
+    # Completes a SQRL login on the mapping's callback route: claims the one-time CPS
+    # token (or the browser's own, cookie-bound pending login after the poller saw it
+    # authenticated), resolves or creates the resource and signs it in.
+    class SQRLAuthenticatable < Base
+      # Only the callback route of this mapping is handled.
+      def valid?
+        request.get? && request.path_info == Devise::SQRL.paths_for(mapping)[:callback]
+      rescue StandardError
+        false
+      end
+
+      # Claim the CPS token or the browser's pending login, apply the unknown-identity policy and
+      # sign the resource in, or fail with a Devise failure key.
+      def authenticate!
+        endpoint = Devise::SQRL.endpoint_for(mapping, request)
+        completion = endpoint.callback(request)
+        return fail!(:sqrl_invalid) unless completion
+
+        identity = completion.identity
+        return fail!(:sqrl_disabled) if identity.disabled?
+        return fail!(:sqrl_declined) if declined?(completion)
+
+        resource = mapping.to.find_for_sqrl(identity) || resource_for_unknown(identity)
+        return if halted?
+        return fail!(:sqrl_unknown) unless resource
+        return fail!(resource.inactive_message) unless resource.active_for_authentication?
+
+        resource.remember_me = true if Devise.sqrl_remember_me && resource.respond_to?(:remember_me=)
+        env["devise.sqrl.completion"] = completion
+        success!(resource)
+      end
+
+      # Clearing CSRF data would log out any other scope; a SQRL callback is a fresh,
+      # signed login so the default behaviour is kept.
+      def clean_up_csrf?
+        true
+      end
+
+      private
+
+      # The client answered the site's +ask+ with the configured "deny" button.
+      def declined?(completion)
+        deny = ::SQRL::Rails.config.ask_deny_button
+        !deny.nil? && completion.pending_login.btn == deny.to_i
+      end
+
+      def resource_for_unknown(identity)
+        case Devise::SQRL.on_unknown_identity
+        when :refuse
+          nil
+        when :link
+          current = env["warden"].user(scope)
+          return fail!(:sqrl_link_required) unless current.is_a?(mapping.to)
+
+          current.link_sqrl_identity!(identity)
+          current
+        else
+          mapping.to.create_for_sqrl!(identity)
+        end
+      end
+    end
+  end
+end
+
+Warden::Strategies.add(:sqrl_authenticatable, Devise::Strategies::SQRLAuthenticatable)

data/lib/devise-sqrl.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "devise/sqrl"

data/lib/generators/devise/sqrl/install/install_generator.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+require "sqrl/rails"
+
+module Devise
+  module SQRL
+    # Generator namespace (+bin/rails generate devise:sqrl:install+).
+    module Generators
+      # `bin/rails generate devise:sqrl:install [MODEL]`
+      #
+      # Adds the SQRL tables (the sqrl-rails migration), declares +:sqrl_authenticatable+
+      # on the Devise model, writes +config/initializers/devise_sqrl.rb+ and drops the
+      # SQRL block into +devise/sessions/new.html.erb+ when the app has it. Idempotent.
+      class InstallGenerator < ::Rails::Generators::Base
+        include ::ActiveRecord::Generators::Migration
+
+        # The migration is the sqrl-rails one, so both gems create identical tables.
+        SQRL_RAILS_TEMPLATES = File.join(::SQRL::Rails::Engine.root, "lib/generators/sqrl/install/templates")
+
+        source_root File.expand_path("templates", __dir__)
+        source_paths << SQRL_RAILS_TEMPLATES
+
+        argument :model_name, type: :string, default: "User", desc: "The Devise model"
+
+        class_option :skip_migration, type: :boolean, default: false, desc: "Do not copy the migration"
+        class_option :skip_views, type: :boolean, default: false,
+                                  desc: "Do not touch app/views/devise/sessions/new.html.erb"
+        class_option :host, type: :string, default: nil, desc: "Public host for sqrl:// URLs (default: request host)"
+
+        # @return [String] the generator's name (+devise:sqrl:install+)
+        def self.namespace(name = nil)
+          name ? super : "devise:sqrl:install"
+        end
+
+        # Copy the +create_sqrl_tables+ migration unless one exists.
+        def copy_migration
+          return if options[:skip_migration]
+          if Dir[File.join(destination_root, "db/migrate/*_create_sqrl_tables.rb")].any?
+            return say_status(:identical, "db/migrate/*_create_sqrl_tables.rb", :blue)
+          end
+
+          migration_template "create_sqrl_tables.rb.tt", "db/migrate/create_sqrl_tables.rb"
+        end
+
+        # Add +:sqrl_authenticatable+ to the model's +devise+ call (idempotent).
+        def add_module_to_model
+          path = "app/models/#{model_name.underscore}.rb"
+          full = File.expand_path(path, destination_root)
+          unless File.exist?(full)
+            return say_status(:skip, "#{path} not found; add :sqrl_authenticatable to its devise call", :yellow)
+          end
+
+          content = File.read(full)
+          return say_status(:identical, path, :blue) if content.include?("sqrl_authenticatable")
+
+          if content.match?(/^\s*devise\s+:/)
+            inject_into_file path, ":sqrl_authenticatable, ", after: /^\s*devise\s+(?=:)/
+          else
+            inject_into_class path, model_name.classify, "  devise :sqrl_authenticatable\n"
+          end
+        end
+
+        # Write +config/initializers/devise_sqrl.rb+.
+        def create_initializer
+          template "devise_sqrl.rb.tt", "config/initializers/devise_sqrl.rb"
+        end
+
+        # Render the shared SQRL partial in +devise/sessions/new+ when it exists (idempotent).
+        def add_partial_to_sessions_view
+          return if options[:skip_views]
+
+          path = "app/views/devise/sessions/new.html.erb"
+          full = File.expand_path(path, destination_root)
+          unless File.exist?(full)
+            return say_status(:skip, "#{path} not found (run `bin/rails g devise:views -v sessions`); " \
+                                     "render \"devise/shared/sqrl\" in your sign-in page", :yellow)
+          end
+
+          if File.read(full).include?("devise/shared/sqrl")
+            say_status(:identical, path, :blue)
+          else
+            append_to_file path, %(\n<%= render "devise/shared/sqrl", resource_name: resource_name %>\n)
+          end
+        end
+
+        # Print what to do next.
+        def show_next_steps
+          say <<~TEXT
+
+            SQRL login is set up for #{model_name.classify}. Next:
+
+              bin/rails db:migrate
+
+            Then open the sign-in page: the SQRL block (link, QR code) is rendered by the
+            devise/shared/sqrl partial. Settings: config/initializers/devise_sqrl.rb.
+          TEXT
+        end
+
+        private
+
+        def host_option
+          options[:host]
+        end
+
+        def migration_version
+          "[#{::ActiveRecord::Migration.current_version}]"
+        end
+      end
+    end
+  end
+end

data/lib/generators/devise/sqrl/install/templates/devise_sqrl.rb.tt

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+# SQRL login for Devise (devise-sqrl). Protocol and storage settings are those of the
+# sqrl-rails gem (SQRL::Rails::Configuration); the Devise-specific choices follow.
+
+Rails.application.config.sqrl.tap do |sqrl|
+  # The public host (and port, when not the default) placed in the sqrl:// login URLs.
+  # SQRL identities are derived from this host, so it must be the name users see.
+  # When nil, the host of each request is used.
+<% if host_option -%>
+  sqrl.host = <%= host_option.inspect %>
+<% else -%>
+  sqrl.host = ENV["SQRL_HOST"].presence
+<% end -%>
+
+  # Storage: :active_record (default; tables from the create_sqrl_tables migration).
+  sqrl.stores = :active_record
+
+  # Protocol options: sqrl.require_ip_match (true), sqrl.nut_ttl (300 s),
+  # sqrl.cps_token_ttl (60 s), sqrl.path_extension, sqrl.poll_requires_ip_match (false;
+  # optional hardening for poll completions) and sqrl.insecure_http (false; loopback-only
+  # qrl:// testing mode, not part of SQRL).
+
+  # Ask the user a question on every login; ask_deny_button is the button that refuses
+  # it. SQRL_ASK=1 turns the example question on for testing.
+  if ENV["SQRL_ASK"].present?
+    sqrl.ask = SQRL::Ask.new(message: "Allow this login?", buttons: [{ label: "Allow" }, { label: "Deny" }],
+                             accept: [1])   # only "Allow" lets the ident proceed
+    sqrl.ask_deny_button = 2               # and a "Deny" that slips through is refused at the callback
+  end
+
+  # Secret index challenge (sin=/ins=). SQRL_SIN=1 turns it on for testing.
+  sqrl.sin = "0" if ENV["SQRL_SIN"].present?
+
+  # Rate limit for the protocol endpoint and login page (per IP, in Rails.cache).
+  # sqrl.rate_limit = { to: 60, within: 1.minute }
+end
+
+Devise.setup do |config|
+  # What to do when an unknown SQRL identity completes a login:
+  #   :create  create a <%= model_name.classify %> for it (default; see sqrl_create_resource)
+  #   :link    only accept it while a user is signed in, and attach it to that user
+  #   :refuse  reject it
+  config.sqrl_on_unknown_identity = :create
+
+  # How the record is built under :create. The default fills in a non-routable email
+  # and a random password so :validatable passes; replace it to collect real details.
+  # config.sqrl_create_resource = ->(identity, klass) { klass.new(email: "...", password: SecureRandom.hex(32)) }
+
+  # Treat SQRL logins as "remember me" (needs :rememberable).
+  config.sqrl_remember_me = false
+
+  # Options for the login block (SQRL::Rack::LoginBlock.render): link text, QR size...
+  # config.sqrl_login_block = { link_text: "Sign in with SQRL", qr_options: { size: 200 } }
+
+  # Where to go after a failed SQRL login (default: the scope's SQRL login page).
+  # config.sqrl_failure_path = "/users/sign_in"
+
+  # Account policies: an identity that asked for "sqrlonly" cannot sign in through these
+  # strategies (password logins), one that asked for "hardlock" cannot reset its
+  # password. Users manage their identities at /<scope>/sqrl/identities.
+  # config.sqrl_only_blocked_strategies = [:database_authenticatable]
+end

metadata

@@ -0,0 +1,97 @@
+--- !ruby/object:Gem::Specification
+name: devise-sqrl
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Daniel P. Clark
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: devise
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.9'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.9'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
+- !ruby/object:Gem::Dependency
+  name: sqrl-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+email:
+- 6ftdan@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- app/controllers/devise/sqrl_controller.rb
+- app/helpers/devise_sqrl_helper.rb
+- app/views/devise/shared/_sqrl.html.erb
+- app/views/devise/sqrl/identities.html.erb
+- app/views/devise/sqrl/new.html.erb
+- config/locales/en.yml
+- lib/devise-sqrl.rb
+- lib/devise/models/sqrl_authenticatable.rb
+- lib/devise/sqrl.rb
+- lib/devise/sqrl/engine.rb
+- lib/devise/sqrl/hooks.rb
+- lib/devise/sqrl/routes.rb
+- lib/devise/strategies/sqrl_authenticatable.rb
+- lib/generators/devise/sqrl/install/install_generator.rb
+- lib/generators/devise/sqrl/install/templates/devise_sqrl.rb.tt
+homepage: https://github.com/danielpclark/sqrl-ruby
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/danielpclark/sqrl-ruby
+  source_code_uri: https://github.com/danielpclark/sqrl-ruby/tree/main/gems/devise-sqrl
+  changelog_uri: https://github.com/danielpclark/sqrl-ruby/blob/main/gems/devise-sqrl/CHANGELOG.md
+  bug_tracker_uri: https://github.com/danielpclark/sqrl-ruby/issues
+  documentation_uri: https://github.com/danielpclark/sqrl-ruby/blob/main/gems/devise-sqrl/README.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Devise module adding SQRL login (devise :sqrl_authenticatable)
+test_files: []