lato 3.16.0 → 3.18.0

data/config/routes.rb

@@ -27,8 +27,12 @@ Lato::Engine.routes.draw do
     patch 'update_password_action', to: 'authentication#update_password_action', as: :authentication_update_password_action
     get 'accept_invitation', to: 'authentication#accept_invitation', as: :authentication_accept_invitation
     post 'accept_invitation_action', to: 'authentication#accept_invitation_action', as: :authentication_accept_invitation_action
+    get 'authentication_method', to: 'authentication#authentication_method', as: :authentication_authentication_method
+    post 'authentication_method_action', to: 'authentication#authentication_method_action', as: :authentication_authentication_method_action
     get 'authenticator', to: 'authentication#authenticator', as: :authentication_authenticator
     post 'authenticator_action', to: 'authentication#authenticator_action', as: :authentication_authenticator_action
+    get 'webauthn', to: 'authentication#webauthn', as: :authentication_webauthn
+    post 'webauthn_action', to: 'authentication#webauthn_action', as: :authentication_webauthn_action
   end
 
   # Account
@@ -37,8 +41,9 @@ Lato::Engine.routes.draw do
   scope :account do
     get '', to: 'account#index', as: :account
     patch 'update_user_action', to: 'account#update_user_action', as: :account_update_user_action
-    patch 'update_web3_action', to: 'account#update_web3_action', as: :account_update_web3_action
     patch 'update_authenticator_action', to: 'account#update_authenticator_action', as: :account_update_authenticator_action
+    patch 'update_webauthn_action', to: 'account#update_webauthn_action', as: :account_update_webauthn_action
+    patch 'update_web3_action', to: 'account#update_web3_action', as: :account_update_web3_action
     patch 'request_verify_email_action', to: 'account#request_verify_email_action', as: :account_request_verify_email_action
     patch 'update_password_action', to: 'account#update_password_action', as: :account_update_password_action
     delete 'destroy_action', to: 'account#destroy_action', as: :account_destroy_action

data/db/migrate/20251206170443_add_webauthn_id_to_user.rb

@@ -0,0 +1,6 @@
+class AddWebauthnIdToUser < ActiveRecord::Migration[8.1]
+  def change
+    add_column :lato_users, :webauthn_id, :string
+    add_column :lato_users, :webauthn_public_key, :text
+  end
+end

data/lib/lato/config.rb

@@ -10,7 +10,7 @@ module Lato
     attr_accessor :session_lifetime, :session_root_path
 
     # Authentication configs
-    attr_accessor :auth_disable_signup, :auth_disable_recover_password, :auth_disable_web3, :auth_disable_authenticator
+    attr_accessor :auth_disable_signup, :auth_disable_recover_password, :auth_disable_web3, :auth_disable_authenticator, :auth_disable_webauthn
 
     # Hcaptcha configs
     attr_accessor :hcaptcha_site_key, :hcaptcha_secret
@@ -25,12 +25,16 @@ module Lato
     # Legal settings
     attr_accessor :legal_privacy_policy_url, :legal_privacy_policy_version, :legal_terms_and_conditions_url, :legal_terms_and_conditions_version
 
+    # Authenticator connection
+    attr_accessor :authenticator_connection
+
+    # Webauth connection
+    attr_accessor :webauthn_connection, :webauthn_origin, :webauthn_rp_name
+
     # Web3 connection
     # NOTE: It requires the gem 'eth' to be installed in the application Gemfile
     attr_accessor :web3_connection
 
-    # Authenticator connection
-    attr_accessor :authenticator_connection
 
     def initialize
       @application_title = 'Lato'
@@ -43,6 +47,7 @@ module Lato
       @auth_disable_recover_password = false
       @auth_disable_web3 = false
       @auth_disable_authenticator = false
+      @auth_disable_webauthn = false
       
       @hcaptcha_site_key = nil
       @hcaptcha_secret = nil
@@ -62,6 +67,9 @@ module Lato
 
       @web3_connection = false
       @authenticator_connection = false
+      @webauthn_connection = false
+      @webauthn_origin = 'http://localhost:3000'
+      @webauthn_rp_name = 'Lato Application'
     end
   end
 end

data/lib/lato/engine.rb

@@ -1,3 +1,5 @@
+require 'webauthn'
+
 module Lato
   class Engine < ::Rails::Engine
     isolate_namespace Lato
@@ -9,5 +11,14 @@ module Lato
     initializer "lato.precompile" do |app|
       app.config.assets.precompile << "lato_manifest.js"
     end
+
+    config.after_initialize do
+      if Lato.config.webauthn_connection
+        WebAuthn.configure do |config|
+          config.allowed_origins = Lato.config.webauthn_origin.is_a?(Array) ? Lato.config.webauthn_origin : [Lato.config.webauthn_origin]
+          config.rp_name = Lato.config.webauthn_rp_name
+        end
+      end
+    end
   end
 end

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.16.0"
+  VERSION = "3.18.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.16.0
+  version: 3.18.0
 platform: ruby
 authors:
 - Gregorio Galante
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-11-26 00:00:00.000000000 Z
+date: 2025-12-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -122,6 +122,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: webauthn
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: eth
   requirement: !ruby/object:Gem::Requirement
@@ -155,6 +169,7 @@ files:
 - app/assets/javascripts/lato/controllers/application.js
 - app/assets/javascripts/lato/controllers/index.js
 - app/assets/javascripts/lato/controllers/lato_account_form_user_controller.js
+- app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js
 - app/assets/javascripts/lato/controllers/lato_action_controller.js
 - app/assets/javascripts/lato/controllers/lato_aside_opener_controller.js
 - app/assets/javascripts/lato/controllers/lato_confirm_controller.js
@@ -172,6 +187,7 @@ files:
 - app/assets/javascripts/lato/controllers/lato_network_controller.js
 - app/assets/javascripts/lato/controllers/lato_operation_controller.js
 - app/assets/javascripts/lato/controllers/lato_tooltip_controller.js
+- app/assets/javascripts/lato/controllers/lato_webauthn_auth_controller.js
 - app/assets/stylesheets/lato/application.scss
 - app/controllers/concerns/lato/componentable.rb
 - app/controllers/concerns/lato/layoutable.rb
@@ -204,9 +220,11 @@ files:
 - app/views/lato/account/_form-password.html.erb
 - app/views/lato/account/_form-user.html.erb
 - app/views/lato/account/_form-web3.html.erb
+- app/views/lato/account/_form-webauthn.html.erb
 - app/views/lato/account/index.html.erb
 - app/views/lato/authentication/_fields-registration.html.erb
 - app/views/lato/authentication/_form-accept-invitation.html.erb
+- app/views/lato/authentication/_form-authentication-method.html.erb
 - app/views/lato/authentication/_form-authenticator.html.erb
 - app/views/lato/authentication/_form-recover-password.html.erb
 - app/views/lato/authentication/_form-signin.html.erb
@@ -214,8 +232,10 @@ files:
 - app/views/lato/authentication/_form-update-password.html.erb
 - app/views/lato/authentication/_form-verify-email.html.erb
 - app/views/lato/authentication/_form-web3-signin.html.erb
+- app/views/lato/authentication/_form-webauthn.html.erb
 - app/views/lato/authentication/_hcaptcha.html.erb
 - app/views/lato/authentication/accept_invitation.html.erb
+- app/views/lato/authentication/authentication_method.html.erb
 - app/views/lato/authentication/authenticator.html.erb
 - app/views/lato/authentication/recover_password.html.erb
 - app/views/lato/authentication/signin.html.erb
@@ -224,6 +244,7 @@ files:
 - app/views/lato/authentication/update_password.html.erb
 - app/views/lato/authentication/verify_email.html.erb
 - app/views/lato/authentication/web3_signin.html.erb
+- app/views/lato/authentication/webauthn.html.erb
 - app/views/lato/components/_form_item_input_file_dropzone.html.erb
 - app/views/lato/components/_form_item_input_list.html.erb
 - app/views/lato/components/_index.html.erb
@@ -274,6 +295,7 @@ files:
 - db/migrate/20240222125124_add_web3_to_lato_users.rb
 - db/migrate/20240222171418_add_indexes_on_lato_users_email.rb
 - db/migrate/20240318074025_add_authenticator_secret_to_user.rb
+- db/migrate/20251206170443_add_webauthn_id_to_user.rb
 - lib/lato.rb
 - lib/lato/btstrap.rb
 - lib/lato/config.rb