door_check 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8ca6d62944588e5c6daf6940fea53510118c992ee376e7e08a803740c4c50f4
-  data.tar.gz: 19191202b55fc41342a1724c8ada168cd336b45c8820c53da271e00c04b9bd2d
+  metadata.gz: 809331dc702d546a27776ecd87d0ad8a7f169defb4814ee895a49f1af926c934
+  data.tar.gz: e738576ea8756212978c60542adf296319761e95bfd38442f3f4274ccd80858a
 SHA512:
-  metadata.gz: 97711a6615bd149c32ef35881b95051a0c7939a1c6c412a94d1964d059b125bd748cf375cc1a232fb349e7fa935186174866d0365e1db9e053af9ab8bfc8ad11
-  data.tar.gz: 0dacebc7827611237e1fd36a33a6b29d2d42bf1ef02706a23660cffe398dfb8144f953caef27177d1959fe4c7aacf964aa2c0966104510520c213d0ad55f2d39
+  metadata.gz: 3a414ec12f431ce25dab37699c546700c9f5c9bbc34dc333bd2cdf092f3ba03e4dfb118709aab29c5ade9f233ba2b535e7ce0798c4564a16bfb38204937bbaf6
+  data.tar.gz: b1a90170eeb48463e613b2a680e289cc50b1d4f4781d15e426b2d5adc9a950f3481a584be36ee72c2a7fa197a2398a51137d69c1eb290bdeb7a0665b121780a7

data/app/controllers/concerns/door_check/entry_check.rb

@@ -27,7 +27,7 @@ module DoorCheck
       proved = door_check_proved_by.map(&:first)
       proved += [ :trusted_device ] if door_check_trusted_browser?(person)
       account = door_check_account
-      PersonRule.for(person).met_by?(proved) && (account.nil? || AccountRule.for(account).met_by?(proved))
+      PersonRule.for(person).met_by?(proved, account: account) && (account.nil? || AccountRule.for(account).met_by?(proved))
     end
 
     def door_check_trusted_browser?(person)

data/app/controllers/door_check/second_steps_controller.rb

@@ -31,7 +31,7 @@ module DoorCheck
       @person = door_check_person
       @authenticator = DoorCheck.configuration.authenticator
       @second_step_set_up = SecondStep.set_up?(@person)
-      @setups = SecondStep.offered_setups(door_check_account)
+      @setups = SecondStep.setups_before_second_step(door_check_account)
     end
 
     def prepare_passkey

data/app/models/door_check/person_rule.rb

@@ -6,8 +6,16 @@ module DoorCheck
       find_or_initialize_by(person: person)
     end
 
-    def met_by?(method_names)
-      !second_step_required || method_names.any? { |name| Methods.roles(name).include?(:second_step) }
+    def met_by?(method_names, account: nil)
+      !in_force_in?(account) || method_names.any? { |name| Methods.roles(name).include?(:second_step) }
+    end
+
+    def in_force_in?(account)
+      second_step_required && may_choose_in?(account)
+    end
+
+    def may_choose_in?(account)
+      DoorCheck.configuration.people_choose_second_step && (account.nil? || AccountRule.for(account).members_choose_second_step)
     end
   end
 end

data/app/models/door_check/require_own_second_step.rb

@@ -7,8 +7,18 @@ module DoorCheck
     end
 
     def call
+      return Result.new(ok: false, message: refusal) unless PersonRule.for(@person).may_choose_in?(@account)
+
       PersonRule.for(@person).update!(second_step_required: @values[:second_step_required] == "1")
       Result.new(ok: true)
     end
+
+    private
+
+    def refusal
+      return "This app decides when you are asked for a second step." unless DoorCheck.configuration.people_choose_second_step
+
+      "Your account decides whether you are asked for a second step."
+    end
   end
 end

data/app/models/door_check/require_second_step.rb

@@ -8,13 +8,24 @@ module DoorCheck
 
     def call
       return Result.new(ok: false, message: "Pick only methods this app offers.") if picks_unoffered_method?
+      return Result.new(ok: false, message: "This app decides when members are asked for a second step.") if sets_forbidden_members_choice?
 
-      AccountRule.for(@account).update!(second_step_required: @values[:second_step_required] == "1", accepted_methods: @values[:accepted_methods])
+      AccountRule.for(@account).update!(saved_values)
       Result.new(ok: true)
     end
 
     private
 
+    def saved_values
+      saved = { second_step_required: @values[:second_step_required] == "1", accepted_methods: @values[:accepted_methods] }
+      saved[:members_choose_second_step] = @values[:members_choose_second_step] == "1" if @values.key?(:members_choose_second_step)
+      saved
+    end
+
+    def sets_forbidden_members_choice?
+      @values.key?(:members_choose_second_step) && !DoorCheck.configuration.people_choose_second_step
+    end
+
     def picks_unoffered_method?
       picked = Array(@values[:accepted_methods]).map(&:to_sym)
       (picked - DoorCheck.configuration.offered_methods).any?

data/app/models/door_check/second_step.rb

@@ -1,14 +1,24 @@
 module DoorCheck
   module SecondStep
-    SETUP_PAGES = { authenticator_app: :new_authenticator_path }.freeze
+    Setup = Data.define(:method_name, :label, :page, :request_method, :before_second_step)
+
+    SETUPS = [
+      Setup.new(:authenticator_app, "Set up an authenticator app", :new_authenticator_path, :get, true),
+      Setup.new(:passkey, "Add a passkey or hardware key", :new_passkey_path, :get, false),
+      Setup.new(:backup_codes, "Make new backup codes", :backup_codes_path, :post, false)
+    ].freeze
 
     def self.set_up?(person)
       Credential.exists?(person: person, method_name: %w[authenticator_app backup_codes passkey]) || DoorCheck.configuration.authenticator&.set_up?(person)
     end
 
-    def self.offered_setups(account)
+    def self.offered_setups
+      SETUPS.select { |setup| DoorCheck.configuration.offered_methods.include?(setup.method_name) }
+    end
+
+    def self.setups_before_second_step(account)
       rule = account && AccountRule.for(account)
-      SETUP_PAGES.select { |method_name, _| DoorCheck.configuration.offered_methods.include?(method_name) && (rule.nil? || rule.accepts?(method_name)) }
+      offered_setups.select { |setup| setup.before_second_step && (rule.nil? || rule.accepts?(setup.method_name)) }
     end
   end
 end

data/app/views/door_check/second_steps/new.html.erb

@@ -21,8 +21,8 @@
   <% else %>
     <%= ui_section(title: "Set up a second step", subtitle: "A second step is required here, and you have none set up yet.") do %>
       <%= ui_grid(gap: :sm) do %>
-        <% @setups.each do |method_name, setup_page| %>
-          <%= ui_button(label: "Set up #{method_name.to_s.humanize.downcase}", href: door_check.public_send(setup_page), full_width: true) %>
+        <% @setups.each do |setup| %>
+          <%= ui_button(label: "Set up #{setup.method_name.to_s.humanize.downcase}", href: door_check.public_send(setup.page), full_width: true) %>
         <% end %>
       <% end %>
     <% end %>

data/app/views/door_check/settings/_sign_in_methods.html.erb

@@ -1,40 +1,65 @@
-<%= ui_data_table(items: DoorCheck::Credential.where(person: person),
-                  columns: [ { label: "Method" }, { last_used: "Last used" }, { accepted_by: "Accepted by" } ],
-                  empty_message: "No sign-in methods set up yet.") do |table| %>
-  <% table.actions do |credential| %>
-    <%= ui_action_menu_item(label: "Remove", href: "#{submit_urls[:remove]}?credential_id=#{credential.id}", method: :patch,
-                            confirm: "Remove this sign-in method?") %>
+<%= ui_section(title: "Sign-in methods") do %>
+  <%= ui_panel do %>
+    <%= ui_data_table(items: DoorCheck::Credential.where(person: person),
+                      columns: [ { label: "Method" }, { last_used: "Last used" }, { accepted_by: "Accepted by" } ],
+                      empty_message: "No sign-in methods set up yet.", phone_list: true) do |table| %>
+      <% table.actions do |credential| %>
+        <%= ui_action_menu_item(label: "Remove", href: "#{submit_urls[:remove]}?credential_id=#{credential.id}", method: :patch,
+                                confirm: "Remove this sign-in method?") %>
+      <% end %>
+    <% end %>
+    <%= ui_section(spacing: :sm) do %>
+      <%= ui_grid(cols: { default: 1, sm: 3 }, gap: :sm) do %>
+        <% DoorCheck::SecondStep.offered_setups.each do |setup| %>
+          <%= ui_button(label: setup.label, href: door_check.public_send(setup.page), method: setup.request_method, variant: :secondary, full_width: true) %>
+        <% end %>
+      <% end %>
+    <% end %>
   <% end %>
 <% end %>
-<%= ui_data_table(items: DoorCheck::SignedInSession.where(person: person, signed_out_at: nil).order(last_used_at: :desc),
-                  columns: [ { device: "Signed in on" }, { last_used: "Last used" } ],
-                  empty_message: "No signed-in sessions.") do |table| %>
-  <% table.actions do |signed_in_session| %>
-    <%= ui_action_menu_item(label: "Sign out", href: "#{submit_urls[:sign_out_session]}?signed_in_session_id=#{signed_in_session.id}", method: :patch,
-                            confirm: "Sign out this session?") %>
+<%= ui_section(title: "Signed-in sessions") do %>
+  <%= ui_panel do %>
+    <%= ui_data_table(items: DoorCheck::SignedInSession.where(person: person, signed_out_at: nil).order(last_used_at: :desc),
+                      columns: [ { device: "Signed in on" }, { last_used: "Last used" } ],
+                      empty_message: "No signed-in sessions.", phone_list: true) do |table| %>
+      <% table.actions do |signed_in_session| %>
+        <%= ui_action_menu_item(label: "Sign out", href: "#{submit_urls[:sign_out_session]}?signed_in_session_id=#{signed_in_session.id}", method: :patch,
+                                confirm: "Sign out this session?") %>
+      <% end %>
+    <% end %>
   <% end %>
 <% end %>
 <% if DoorCheck.configuration.offered_methods.include?(:trusted_device) %>
-  <%= ui_data_table(items: DoorCheck::TrustedDevice.where(person: person).where("expires_at > ?", Time.current),
-                    columns: [ { device: "Trusted browser" }, { trusted_until: "Trusted until" } ],
-                    empty_message: "No trusted browsers.") do |table| %>
-    <% table.actions do |trusted_device| %>
-      <%= ui_action_menu_item(label: "Remove", href: "#{submit_urls[:remove_trusted_browser]}?trusted_device_id=#{trusted_device.id}", method: :patch,
-                              confirm: "Remove this trusted browser?") %>
+  <%= ui_section(title: "Trusted browsers") do %>
+    <%= ui_panel do %>
+      <%= ui_data_table(items: DoorCheck::TrustedDevice.where(person: person).where("expires_at > ?", Time.current),
+                        columns: [ { device: "Trusted browser" }, { trusted_until: "Trusted until" } ],
+                        empty_message: "No trusted browsers.", phone_list: true) do |table| %>
+        <% table.actions do |trusted_device| %>
+          <%= ui_action_menu_item(label: "Remove", href: "#{submit_urls[:remove_trusted_browser]}?trusted_device_id=#{trusted_device.id}", method: :patch,
+                                  confirm: "Remove this trusted browser?") %>
+        <% end %>
+      <% end %>
     <% end %>
   <% end %>
 <% end %>
-<% if DoorCheck.configuration.offered_methods.include?(:authenticator_app) %>
-  <%= ui_button(label: "Set up an authenticator app", href: door_check.new_authenticator_path, variant: :secondary) %>
-<% end %>
-<% if DoorCheck.configuration.offered_methods.include?(:passkey) %>
-  <%= ui_button(label: "Add a passkey or hardware key", href: door_check.new_passkey_path, variant: :secondary) %>
-<% end %>
-<% if DoorCheck.configuration.offered_methods.include?(:backup_codes) %>
-  <%= ui_button(label: "Make new backup codes", href: door_check.backup_codes_path, method: :post, variant: :secondary) %>
-<% end %>
-<%= ui_form(action: submit_urls[:own_second_step], method: :patch) do %>
-  <%= ui_form_field(attribute: "second_step_required", label: "Ask me for a second step every time I sign in",
-                    type: :checkbox, value: (DoorCheck::PersonRule.for(person).second_step_required ? "1" : "0")) %>
-  <%= ui_button(label: "Save") %>
+<%= ui_section(title: "Second step") do %>
+  <%= ui_panel do %>
+    <%= ui_grid(gap: :md) do %>
+      <% if local_assigns[:account] && DoorCheck::AccountRule.for(local_assigns[:account]).second_step_required %>
+        <%= ui_alert(message: "Your account asks everyone for a second step.") %>
+      <% end %>
+      <% if !DoorCheck.configuration.people_choose_second_step %>
+        <%= ui_alert(message: "This app decides when you are asked for a second step.") %>
+      <% elsif DoorCheck::PersonRule.for(person).may_choose_in?(local_assigns[:account]) %>
+        <%= ui_form(action: submit_urls[:own_second_step], method: :patch) do %>
+          <%= ui_form_field(attribute: "second_step_required", label: "Ask me for a second step every time I sign in",
+                            type: :checkbox, value: (DoorCheck::PersonRule.for(person).second_step_required ? "1" : "0")) %>
+          <%= ui_button(label: "Save") %>
+        <% end %>
+      <% else %>
+        <%= ui_alert(message: "Your account decides whether you are asked for a second step.") %>
+      <% end %>
+    <% end %>
+  <% end %>
 <% end %>

data/app/views/door_check/settings/_sign_in_rules.html.erb

@@ -1,10 +1,24 @@
 <% rule = DoorCheck::AccountRule.for(account) %>
-<%= ui_form(action: submit_url, method: :patch) do %>
-  <% DoorCheck.configuration.offered_methods.each do |method_name| %>
-    <%= ui_checkbox_row(name: "accepted_methods[]", value: method_name, label: method_name.to_s.humanize, checked: rule.accepts?(method_name)) %>
+<%= ui_panel do %>
+  <%= ui_form(action: submit_url, method: :patch) do %>
+    <%= ui_section(title: "Accepted methods", subtitle: "Members enter this account only after using one of the ticked methods.", spacing: :sm) do %>
+      <% DoorCheck.configuration.offered_methods.each do |method_name| %>
+        <%= ui_checkbox_row(name: "accepted_methods[]", value: method_name, label: method_name.to_s.humanize, checked: rule.accepts?(method_name)) %>
+      <% end %>
+    <% end %>
+    <%= ui_section(title: "Second step", subtitle: "When ticked, members who signed in with only a password are asked for a second step before they enter.", spacing: :sm) do %>
+      <%= ui_form_field(attribute: "second_step_required", label: "Require a second step to enter this account",
+                        type: :checkbox, value: (rule.second_step_required ? "1" : "0")) %>
+    <% end %>
+    <% people_choose = DoorCheck.configuration.people_choose_second_step %>
+    <%= ui_section(title: "Members", subtitle: (people_choose ? "When ticked, a member who asks for a second step every time they sign in is asked for it in this account." : nil), spacing: :sm) do %>
+      <% if people_choose %>
+        <%= ui_form_field(attribute: "members_choose_second_step", label: "Members choose their own second step",
+                          type: :checkbox, value: (rule.members_choose_second_step ? "1" : "0")) %>
+      <% else %>
+        <%= ui_alert(message: "This app decides when members are asked for a second step.") %>
+      <% end %>
+    <% end %>
+    <%= ui_button(label: "Save") %>
   <% end %>
-  <%= ui_form_field(attribute: "second_step_required", label: "Require a second step to enter this account",
-                    type: :checkbox, value: (rule.second_step_required ? "1" : "0"),
-                    hint: "Members who signed in with only a password are asked for their authenticator code when they enter.") %>
-  <%= ui_button(label: "Save") %>
 <% end %>

data/db/migrate/20261113191736_add_members_choose_second_step_to_door_check_account_rules.rb

@@ -0,0 +1,5 @@
+class AddMembersChooseSecondStepToDoorCheckAccountRules < ActiveRecord::Migration[8.1]
+  def change
+    add_column :door_check_account_rules, :members_choose_second_step, :boolean, default: true, null: false
+  end
+end

data/lib/door_check/configuration.rb

@@ -7,12 +7,14 @@ module DoorCheck
     attr_reader :offered_methods
     attr_writer :authenticator_issuer
     attr_accessor :person_method, :account_method, :parent_controller, :parent_mailer, :existing_authenticator, :person_accounts,
-                  :find_person_by_email, :sign_in_person, :sign_out_person, :passkey_domain, :locate_ip, :stylesheet, :head_partial
+                  :find_person_by_email, :sign_in_person, :sign_out_person, :passkey_domain, :locate_ip, :stylesheet, :head_partial,
+                  :people_choose_second_step
 
     def initialize
       @parent_controller = "::ApplicationController"
       @parent_mailer = "::ApplicationMailer"
       @stylesheet = "application"
+      @people_choose_second_step = true
     end
 
     def offered_methods=(names)

data/lib/door_check/version.rb

@@ -1,3 +1,3 @@
 module DoorCheck
-  VERSION = "0.3.2"
+  VERSION = "0.4.0"
 end

data/the_local/agents/door_check-develop.md

@@ -34,7 +34,7 @@ Method names:
 Rule and session actions. Each is built with `person:`, `account:` and
 `values:`, all three required, and `call` returns a `DoorCheck::Result`:
 
-- `DoorCheck::RequireSecondStep` — saves the account's rule: the methods it accepts from `values[:accepted_methods]`, and whether it requires a second step from `values[:second_step_required]`.
+- `DoorCheck::RequireSecondStep` — saves the account's rule: the methods it accepts from `values[:accepted_methods]`, whether it requires a second step from `values[:second_step_required]`, and whether its members choose their own second step from `values[:members_choose_second_step]`.
 - `DoorCheck::RequireOwnSecondStep` — saves the person's own rule: whether they require a second step, from `values[:second_step_required]`.
 - `DoorCheck::RemoveMethod` — removes the person's saved method whose id is `values[:credential_id]`.
 - `DoorCheck::SignOutSession` — signs out the person's signed-in session whose id is `values[:signed_in_session_id]`.
@@ -133,7 +133,8 @@ class SettingsController < ApplicationController
 
   def sign_in_rules
     finish DoorCheck::RequireSecondStep.new(person: current_user, account: door_check_account,
-                                            values: params.permit(:second_step_required, accepted_methods: [])).call
+                                            values: params.permit(:second_step_required, :members_choose_second_step,
+                                                                  accepted_methods: [])).call
   end
 
   private
@@ -151,11 +152,41 @@ end
 `current_user` stands for the host's person method. Use the same method the
 install local gave door_check as the person method.
 
+The person section shows titled groups, in this order: Sign-in methods,
+Signed-in sessions, Trusted browsers and Second step. It leaves out the Trusted
+browsers group when the app does not offer `trusted_device`, so the trusted
+browser route is only reached when `trusted_device` is offered. Ask the
+developer whether to write that route when it is not offered.
+
+The account section is one panel holding one form, with titled groups in this
+order: Accepted methods, Second step and Members, then a single Save button.
+That one Save sends every group's values together to the `sign_in_rules`
+route.
+
 What each section sends, and what the action does with it:
 
+- The Second step group shows the alert "Your account asks everyone for a
+  second step." when it was rendered with an account whose rule requires a
+  second step. It shows this as well as the checkbox or the alerts below.
+- When the app is set so people do not choose their own second step, the
+  person section shows the alert "This app decides when you are asked for a
+  second step." in place of the second-step checkbox, whatever the account
+  allows, and sends nothing to the own second-step route.
+- Otherwise the person section shows its second-step checkbox only while the
+  account it was rendered with lets members choose, or when it was rendered
+  with no account. When the account does not let members choose, it shows the
+  alert "Your account decides whether you are asked for a second step." in
+  place of the checkbox, and sends nothing to the own second-step route.
 - The person section's second-step form sends `second_step_required`.
   `RequireOwnSecondStep` saves the rule as on when the value is `"1"` and off
   for any other value.
+- `RequireOwnSecondStep` refuses the save, keeps the person's earlier choice,
+  and returns a result whose `ok?` is false when the person may not choose
+  with the `account` it was given:
+  - When the app is set so people do not choose their own second step, the
+    `message` is `"This app decides when you are asked for a second step."`.
+  - Otherwise, when `account` is not nil and does not let members choose, the
+    `message` is `"Your account decides whether you are asked for a second step."`.
 - The person section's Remove on a saved method sends `credential_id`.
   `RemoveMethod` removes that method only when it belongs to `person`.
 - The person section's Sign out on a session sends `signed_in_session_id`.
@@ -166,11 +197,28 @@ What each section sends, and what the action does with it:
   `RemoveTrustedBrowser` forgets that browser only when it belongs to `person`,
   and the browser is asked for a second step again.
 - The account section sends `accepted_methods[]`, one value per ticked method,
-  and `second_step_required`. `RequireSecondStep` refuses the save when a
-  ticked method is not one the app offers, and returns a result whose `ok?` is
-  false and whose `message` is `"Pick only methods this app offers."`.
-  Otherwise it saves both values to the rule of the `account` it was given, with
-  the second step on only when `second_step_required` is `"1"`.
+  `second_step_required` and `members_choose_second_step`. `RequireSecondStep`
+  refuses the save when a ticked method is not one the app offers, and returns
+  a result whose `ok?` is false and whose `message` is
+  `"Pick only methods this app offers."`. Otherwise it saves the values to the
+  rule of the `account` it was given, with the second step on only when
+  `second_step_required` is `"1"` and members choosing only when
+  `members_choose_second_step` is `"1"`.
+- When the app is set so people do not choose their own second step, the
+  account section shows the alert "This app decides when members are asked for
+  a second step." in place of the members checkbox, and sends no
+  `members_choose_second_step`.
+- When the app is set so people do not choose their own second step and
+  `values` has a `members_choose_second_step` key, whatever its value,
+  `RequireSecondStep` refuses the save, keeps the account's earlier rule, and
+  returns a result whose `ok?` is false and whose `message` is
+  `"This app decides when members are asked for a second step."`. A save that
+  ticks a method the app does not offer is refused with the offered-methods
+  message first.
+- Permit `members_choose_second_step` in the `sign_in_rules` action. When
+  `values` has no `members_choose_second_step` key, `RequireSecondStep` leaves
+  the account's setting as it was, so an action that does not permit it never
+  changes it.
 
 Ask the developer who may save the account's rules. door_check does not check
 it, so the `sign_in_rules` action must refuse anyone the host does not allow,
@@ -202,22 +250,26 @@ before building `RequireSecondStep`.
 3. The sign-in email always carries both a code and a link. The link returns
    not found unless `email_link` is offered, so ask the developer whether to
    offer `email_link` whenever `email_code` is offered.
-4. Put the sign-in links on the host's sign-in page, for a person who is not
+4. The person section's Sign-in methods group already shows buttons to set up
+   an authenticator app, add a passkey and make new backup codes, each only
+   when its method is offered. Add those links elsewhere only when the
+   developer asks for them outside the settings page.
+5. Put the sign-in links on the host's sign-in page, for a person who is not
    signed in. The approvals, authenticator, passkey and backup codes links are
    for a signed-in person only.
-5. Link to `backup_codes_path` with a form that sends a `POST`, such as
+6. Link to `backup_codes_path` with a form that sends a `POST`, such as
    `button_to`, never a plain link.
-6. When the person already has a second step set up, the authenticator, passkey
+7. When the person already has a second step set up, the authenticator, passkey
    and backup codes pages first ask for it if this session has not passed one,
    then send the person back.
-7. The authenticator page keeps showing the same secret key in this browser
+8. The authenticator page keeps showing the same secret key in this browser
    session until setup succeeds, so reloading it or entering a wrong code does
    not change the key the person already scanned. A wrong code shows an error on
    the same page and saves nothing.
-8. When the browser session no longer holds the key, such as after the person
+9. When the browser session no longer holds the key, such as after the person
    signed out and back in, saving a code sends the person back to the
    authenticator page with a new key and a warning to scan it again.
-9. A right code saves the authenticator app, counts as this session's second
+10. A right code saves the authenticator app, counts as this session's second
    step, and sends the person to the page they were on before door_check asked
    for a second step, or to `/` when there was none. The app lists the account
    under the person's email when the person responds to `email`.
@@ -227,15 +279,34 @@ before building `RequireSecondStep`.
 - Never edit door_check's records directly. Change rules, sessions, saved methods
   and trusted browsers through the five actions above.
 - Pass the five actions the person from the host's person method and the
-  account from `door_check_account`. `RequireOwnSecondStep`, `RemoveMethod`,
+  account from `door_check_account`. `RequireOwnSecondStep` decides from that
+  account whether the person may choose, so passing another account gives a
+  different answer than the settings section showed. `RemoveMethod`,
   `SignOutSession` and `RemoveTrustedBrowser` take `account:` but do not use it.
-- `RequireOwnSecondStep`, `RemoveMethod`, `SignOutSession` and
-  `RemoveTrustedBrowser` always return a result whose `ok?` is true. An id
-  that does not belong to the person changes nothing and still returns true.
+- Show `result.message` whenever `ok?` is false, since `RequireSecondStep` and
+  `RequireOwnSecondStep` can both refuse a save.
+- `RemoveMethod`, `SignOutSession` and `RemoveTrustedBrowser` always return a
+  result whose `ok?` is true. An id that does not belong to the person changes
+  nothing and still returns true.
 - When no `accepted_methods[]` box is ticked, the form sends none and the
   account's rule is saved as accepting every offered method.
-- A person's rule and an account's rule both apply. A person who requires a
-  second step is asked for one whatever their account's rule says.
+- An account lets its members choose their own second step until its rule is
+  saved with `members_choose_second_step` off.
+- While the app lets people choose and the current account lets members
+  choose, a person's rule and the account's rule both apply, so a person who requires a second step is asked
+  for one whatever the account requires.
+- While the current account does not let members choose, the person's own rule
+  is not in force there, and only the account's rule decides whether a second
+  step is asked for. The person's saved choice is kept, and it applies again
+  once the account lets members choose.
+- When `door_check_account` is nil, the person's own rule is in force unless
+  the app is set so people do not choose their own second step.
+- While the app is set so people do not choose their own second step, no
+  person's own rule is in force in any account or with no account, and only
+  the account's rule decides whether a second step is asked for. Each person's
+  saved choice is kept, and it applies again once the app lets people choose.
+  Read the host's door_check initializer, or ask the developer, to learn which
+  way the app is set.
 - Out of scope: adding the gem, its migrations, its routes, its settings, the
   host controller's tracking and second-step check, and placing the settings
   sections. Those belong to the install local.

data/the_local/agents/door_check-info.md

@@ -62,12 +62,56 @@ door_check declares nothing for this local to document.
 - **Offered methods** — the subset of known methods this app turns on. Naming a
   method door_check does not know is an error at boot. A page for a method the
   app does not offer returns not found.
-- **Account rule** — whether an account requires a second step, and which of the
-  offered methods it accepts. An account can only narrow what the app offers.
-- **Person rule** — whether a person requires a second step on their own login,
-  whatever their account says.
+- **People choosing their own second step** — an app-wide switch, on by
+  default. When the app turns it off, no person rule is in force anywhere, and
+  only account rules decide when a second step is asked for.
+- **Account rule** — whether an account requires a second step, which of the
+  offered methods it accepts, and whether its members choose their own second
+  step. An account can only narrow what the app offers. Members choose by
+  default, and only while the app lets people choose.
+- **Refused account rule save** — saving an account rule that accepts a method
+  the app does not offer is refused with "Pick only methods this app offers."
+  Saving one that sets whether members choose, while the app does not let people
+  choose, is refused with "This app decides when members are asked for a second
+  step." A refused save changes nothing, and the account keeps its earlier rule.
+- **Person rule** — whether a person requires a second step on their own login.
+  It is in force only while the app lets people choose, and then with no
+  account or in an account that lets members choose. Elsewhere only the
+  account's rule decides, and the person's saved choice is kept and applies
+  again once both the app and the account let them choose.
+- **Refused person rule save** — saving a person rule where the person may not
+  choose is refused. The message is "This app decides when you are asked for a
+  second step." when the app does not let people choose, and "Your account
+  decides whether you are asked for a second step." when the person's account
+  does not let members choose. A refused save changes nothing, and the person
+  keeps their earlier choice.
+- **Personal settings section** — the section where a person sees their saved
+  methods, signed-in sessions and trusted browsers, and sets their person rule.
+  It shows four titled groups, each in its own panel: Sign-in methods, with the
+  buttons to add one; Signed-in sessions; Trusted browsers, left out when the
+  app does not offer trusted browsers; and Second step. On a phone each table
+  shows as a list and the add buttons stack at full width.
+- **Second step group** — the part of the personal settings section that holds
+  the person rule's checkbox. When the person's current account requires a
+  second step, it shows the note "Your account asks everyone for a second
+  step." above the rest. When the app does not let people choose, it shows the
+  note "This app decides when you are asked for a second step." in place of the
+  checkbox. When the person's current account does not let members choose, it
+  shows the note "Your account decides whether you are asked for a second
+  step." instead.
+- **Account settings section** — the section where an account's rule is set,
+  in one panel with one Save button. It shows three titled groups, each with a
+  line saying what ticking it does. Accepted methods lists every offered method,
+  and members enter the account only after using one of the ticked methods.
+  Second step holds the checkbox that makes members who signed in with only a
+  password take a second step before they enter. Members holds the checkbox that
+  lets a member's own second-step choice apply in this account. When the app
+  does not let people choose, the Members group shows the note "This app
+  decides when members are asked for a second step." in place of its checkbox
+  and line.
 - **Proof** — a method a session has passed. A person may enter a page once the
-  session's proofs meet both their person rule and their current account's rule.
+  session's proofs meet their current account's rule and, where it is in force,
+  their person rule.
   Otherwise they are sent to the second step page and returned afterwards.
 - **Signed-in session** — one sign-in on one device, with its device, IP address
   and last use. Ending one signs that device out on its next request.

data/the_local/agents/door_check-install.md

@@ -1,6 +1,6 @@
 ---
 name: door_check-install
-description: Use to hook door_check into a project — adding the gem, copying its migrations, mounting its routes, configuring the offered methods and the host's person, account, sign-in and sign-out hooks, the parent controller and mailer, the passkey domain, the IP lookup, the stylesheet and head partial, the name shown in authenticator apps, adding the sign-in tracking and second-step check to the host's controller, and placing the two settings sections.
+description: Use to hook door_check into a project — adding the gem, copying its migrations, mounting its routes, configuring the offered methods and the host's person, account, sign-in and sign-out hooks, the parent controller and mailer, the passkey domain, the IP lookup, the stylesheet and head partial, the name shown in authenticator apps, whether people may choose their own second step, adding the sign-in tracking and second-step check to the host's controller, and placing the two settings sections.
 tools: Bash, Read, Edit
 scope: sign-in — the sign-in methods and second steps an app offers, each account narrows, and each person chooses from
 ---
@@ -36,11 +36,12 @@ trusted browsers.
 - `config.stylesheet` — the stylesheet door_check's pages link.
 - `config.head_partial` — a host partial rendered at the end of the head of door_check's pages.
 - `config.authenticator_issuer` — the name an authenticator app shows above the account it adds during setup.
+- `config.people_choose_second_step` — whether people may require a second step on their own login, true or false.
 - `include DoorCheck::Tracking` — adds sign-in recording and the reads of proofs and the current account to the host's controller.
 - `include DoorCheck::EntryCheck` — adds the second-step check to the host's controller.
 - `before_action :door_check_check_entry` — runs that check on every host request.
 - `door_check/settings/sign_in_methods` — the partial a person uses to see and remove their methods, sessions and trusted browsers, set up new ones, and require a second step on their own login.
-- `door_check/settings/sign_in_rules` — the partial an account admin uses to choose which offered methods the account accepts and whether it requires a second step.
+- `door_check/settings/sign_in_rules` — the partial an account admin uses to choose which offered methods the account accepts, whether it requires a second step, and whether its members' own second-step choice applies inside it.
 
 ## How to use it
 
@@ -139,6 +140,17 @@ trusted browsers.
      application's module, such as `"Shop"` for `Shop::Application`. Set it when
      people should see another name in their authenticator app. Changing it does
      not rename accounts people already added.
+   - `config.people_choose_second_step = false` — defaults to true. Set it to
+     false when only the app and its accounts' rules decide who is asked for a
+     second step. While it is false, no person's saved choice is applied in any
+     account, the personal section shows "This app decides when you are asked
+     for a second step." in place of its checkbox, and the account section
+     shows "This app decides when members are asked for a second step." in
+     place of its members checkbox. While it is false, door_check also refuses
+     a save of a person's own second-step choice with the first message, and a
+     save of the account section that carries the members choice with the
+     second. A refused save leaves the earlier value in place. Saved choices
+     are kept, and apply again if it is set back to true.
 
 8. Add the tracking and the second-step check to the host's
    `app/controllers/application_controller.rb`, or to the controller named in
@@ -164,6 +176,7 @@ trusted browsers.
     ```erb
     <%= render "door_check/settings/sign_in_methods",
                person: current_user,
+               account: current_account,
                submit_urls: {
                  own_second_step: own_second_step_settings_path,
                  remove: remove_sign_in_method_settings_path,
@@ -181,7 +194,54 @@ trusted browsers.
     - `remove` receives `credential_id`.
     - `sign_out_session` receives `signed_in_session_id`.
     - `remove_trusted_browser` receives `trusted_device_id`.
-    - The account section's URL receives `accepted_methods[]` and `second_step_required`.
+    - The account section's URL receives `accepted_methods[]`,
+      `second_step_required` and `members_choose_second_step`. While
+      `people_choose_second_step` is false it does not send
+      `members_choose_second_step`.
+    - The host action behind the account section's URL must pass
+      `members_choose_second_step` on only when the request carries it.
+      door_check keeps the account's earlier value when the parameter is
+      missing, and refuses the save when it is present while
+      `people_choose_second_step` is false.
+
+    The personal section renders its own titled groups, so place it on the page
+    without a heading or panel around it:
+    - **Sign-in methods** — the person's saved methods, with a button to set up
+      an authenticator app, a passkey or new backup codes for each of those
+      that `offered_methods` includes.
+    - **Signed-in sessions** — the person's sessions that are still signed in.
+    - **Trusted browsers** — shown only when `trusted_device` is offered.
+    - **Second step** — the person's own second-step checkbox, or a note in its
+      place.
+
+    On a phone-width screen each table shows as a list and the setup buttons
+    stack at full width.
+
+    The account section renders its own panel, holding three titled groups and
+    one Save button, so place it on the page without a heading or panel around
+    it either:
+    - **Accepted methods** — a checkbox for each method in `offered_methods`.
+      Members enter the account only after using one of the ticked methods.
+    - **Second step** — the checkbox that asks members who signed in with only
+      a password for a second step before they enter.
+    - **Members** — the checkbox that lets a member's own second-step choice
+      apply in this account, or, while `people_choose_second_step` is false,
+      the note "This app decides when members are asked for a second step." in
+      its place.
+
+    Every account starts out letting its members choose their own second step.
+    While an account does not, a person's own choice is not applied inside that
+    account, and only the account's own rule decides.
+
+    Pass the person's current account as `account:` to the personal section.
+    When that account requires a second step, the Second step group shows
+    "Your account asks everyone for a second step." above the checkbox or note.
+    When that account does not let members choose, the group shows the note
+    "Your account decides whether you are asked for a second step." in place of
+    the checkbox. A save of the person's own choice in that account is refused
+    with the same note, and the person's earlier choice is kept. Leave
+    `account:` out only when the host has no accounts, since without it the
+    checkbox always shows and no account note appears.
 
     The controller actions behind those routes are the develop local's to
     write. Ask the developer which settings page each section goes on, and who

data/the_local/interface.yml

@@ -20,6 +20,7 @@ install:
   - config.stylesheet
   - config.head_partial
   - config.authenticator_issuer
+  - config.people_choose_second_step
   - include DoorCheck::Tracking
   - include DoorCheck::EntryCheck
   - before_action :door_check_check_entry
@@ -68,6 +69,7 @@ sources:
   - app/models/door_check/challenge.rb
   - app/models/door_check/require_second_step.rb
   - app/models/door_check/require_own_second_step.rb
+  - app/models/door_check/person_rule.rb
   - app/models/door_check/remove_method.rb
   - app/models/door_check/sign_out_session.rb
   - app/models/door_check/remove_trusted_browser.rb

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: door_check
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Tyler Schneider
@@ -174,6 +174,7 @@ files:
 - db/migrate/20261111162243_create_door_check_trusted_devices.rb
 - db/migrate/20261111170231_add_device_to_door_check_signed_in_sessions.rb
 - db/migrate/20261111170432_add_approval_to_door_check_challenges.rb
+- db/migrate/20261113191736_add_members_choose_second_step_to_door_check_account_rules.rb
 - lib/door_check.rb
 - lib/door_check/configuration.rb
 - lib/door_check/engine.rb