maquina-generators 0.6.0 → 0.8.0

data/lib/generators/maquina/csp_reports/templates/app/models/security/csp_violation.rb

@@ -0,0 +1,89 @@
+# One Content Security Policy violation a browser reported to CspReportsController.
+# Rows are written once and never updated; they are what tells you whether the
+# policy is ready to enforce (report-only) or what it is breaking (enforced).
+#
+# Browsers send two shapes. The legacy `report-uri` one is a single object,
+# `{"csp-report": {"blocked-uri": ..., ...}}` (Content-Type application/csp-report);
+# the Reporting API one is an array of `{"type": "csp-violation", "body": {...}}`
+# (application/reports+json) with camelCase keys. Both normalize to the same row.
+class Security::CspViolation < Security::Record
+  RETENTION = 30.days
+
+  # Violations caused by the reader's own browser extensions say nothing about
+  # the app, and they are most of the volume.
+  NOISE_SCHEMES = %w[chrome-extension moz-extension safari-extension safari-web-extension ms-browser-extension].freeze
+
+  FIELD_LIMIT = 1024
+  SAMPLE_LIMIT = 256
+
+  LEGACY_KEYS = {
+    "document-uri" => :document_uri, "blocked-uri" => :blocked_uri,
+    "effective-directive" => :effective_directive, "violated-directive" => :effective_directive,
+    "disposition" => :disposition, "source-file" => :source_file,
+    "line-number" => :line_number, "column-number" => :column_number, "script-sample" => :sample
+  }.freeze
+
+  REPORTING_API_KEYS = {
+    "documentURL" => :document_uri, "blockedURL" => :blocked_uri,
+    "effectiveDirective" => :effective_directive, "disposition" => :disposition,
+    "sourceFile" => :source_file, "lineNumber" => :line_number,
+    "columnNumber" => :column_number, "sample" => :sample
+  }.freeze
+
+  validates :effective_directive, presence: true
+
+  scope :recent, -> { order(created_at: :desc, id: :desc) }
+  scope :within, ->(window) { where(created_at: window.ago..) }
+  scope :expired, -> { where(created_at: ...RETENTION.ago) }
+
+  # Records every violation in a raw report body; returns how many were kept.
+  # Raises JSON::ParserError on a body that isn't JSON.
+  def self.record_report!(raw, ip:, user_agent:)
+    violations = parse(raw).reject { |attrs| noise?(attrs) }
+    violations.each do |attrs|
+      create!(attrs.merge(ip:, user_agent: user_agent&.truncate(FIELD_LIMIT, omission: "")))
+    end
+    violations.size
+  end
+
+  def self.parse(raw)
+    payload = JSON.parse(raw)
+    reports = payload.is_a?(Array) ? payload : [payload]
+
+    reports.filter_map do |report|
+      next unless report.is_a?(Hash)
+
+      if report.key?("csp-report")
+        normalize(report["csp-report"], LEGACY_KEYS)
+      elsif report["type"] == "csp-violation"
+        normalize(report["body"], REPORTING_API_KEYS)
+      end
+    end
+  end
+
+  def self.noise?(attrs)
+    [attrs[:blocked_uri], attrs[:source_file]].compact.any? do |uri|
+      NOISE_SCHEMES.any? { |scheme| uri.start_with?("#{scheme}:") }
+    end
+  end
+
+  def self.normalize(body, keys)
+    return unless body.is_a?(Hash)
+
+    attrs = keys.each_with_object({}) do |(key, attribute), acc|
+      acc[attribute] ||= body[key] if body.key?(key)
+    end
+    # The directive alone (`script-src`), not the whole violated policy line.
+    attrs[:effective_directive] = attrs[:effective_directive].to_s.split.first
+    # URLs lose their query and fragment: a reported URL can carry a token.
+    %i[document_uri blocked_uri source_file].each { |key| attrs[key] = strip_url(attrs[key]) }
+    attrs[:sample] = attrs[:sample]&.to_s&.truncate(SAMPLE_LIMIT, omission: "")
+    %i[line_number column_number].each { |key| attrs[key] = attrs[key]&.to_i }
+    attrs.transform_values { |value| value.is_a?(String) ? value.truncate(FIELD_LIMIT, omission: "") : value }
+  end
+
+  def self.strip_url(value)
+    value&.to_s&.split(/[?#]/, 2)&.first
+  end
+  private_class_method :normalize, :strip_url
+end

data/lib/generators/maquina/csp_reports/templates/app/models/security/csp_violation_report.rb

@@ -0,0 +1,30 @@
+# What the Security page shows about Content Security Policy: the last `window`
+# of reported violations, grouped by what was blocked, where and why.
+class Security::CspViolationReport
+  Group = Data.define(:effective_directive, :blocked_uri, :document_uri, :count, :last_seen)
+
+  attr_reader :window, :limit
+
+  def initialize(window: 7.days, limit: 10)
+    @window = window
+    @limit = limit
+  end
+
+  def violations = Security::CspViolation.within(window)
+
+  def empty? = violations.none?
+
+  def total = violations.count
+
+  # The same blocked resource on the same page under the same directive, most
+  # frequent first — one row per thing to fix, however many readers hit it.
+  def top
+    violations.group(:effective_directive, :blocked_uri, :document_uri)
+      .order(Arel.sql("COUNT(*) DESC, MAX(created_at) DESC")).limit(limit)
+      .pluck(:effective_directive, :blocked_uri, :document_uri, Arel.sql("COUNT(*)"), Arel.sql("MAX(created_at)"))
+      .map do |directive, blocked, document, count, last|
+        Group.new(effective_directive: directive, blocked_uri: blocked, document_uri: document,
+          count:, last_seen: last.is_a?(String) ? ActiveSupport::TimeZone["UTC"].parse(last) : last)
+      end
+  end
+end

data/lib/generators/maquina/csp_reports/templates/app/views/backstage/security/_csp_violations.html.erb

@@ -0,0 +1,42 @@
+<%# locals: (report:) %>
+<%# Content Security Policy violations browsers reported to /csp-reports
+    (maquina:csp_reports), grouped so each row is one thing to fix. %>
+<%= render "components/card" do %>
+  <%= render "components/card/header" do %>
+    <%= render "components/card/title", text: "Content Security Policy violations" %>
+    <%= render "components/card/description",
+          text: "#{number_with_delimiter(report.total)} reported in the last #{report.window.inspect}, kept for #{Security::CspViolation::RETENTION.inspect}. Most frequent first." %>
+  <% end %>
+  <%= render "components/card/content", spacing: :full do %>
+    <% if report.empty? %>
+      <%= empty_state(title: "No violation was reported.", icon: :check_circle, size: :compact) %>
+    <% else %>
+      <div class="overflow-x-auto">
+        <%= render "components/table", container: false, "aria-label": "Content Security Policy violations" do %>
+          <%= render "components/table/header" do %>
+            <%= render "components/table/row" do %>
+              <%= render "components/table/head", text: "Directive" %>
+              <%= render "components/table/head", text: "Blocked" %>
+              <%= render "components/table/head", text: "Page" %>
+              <%= render "components/table/head", text: "Reports", css_classes: "text-right" %>
+              <%= render "components/table/head", text: "Last seen" %>
+            <% end %>
+          <% end %>
+          <%= render "components/table/body" do %>
+            <% report.top.each do |group| %>
+              <%= render "components/table/row" do %>
+                <%= render "components/table/cell", css_classes: "font-mono", text: group.effective_directive %>
+                <%= render "components/table/cell", css_classes: "font-mono whitespace-normal break-all", text: group.blocked_uri.presence || "—" %>
+                <%= render "components/table/cell", css_classes: "font-mono whitespace-normal break-all", text: group.document_uri.presence || "—" %>
+                <%= render "components/table/cell", css_classes: "text-right tabular-nums", text: number_with_delimiter(group.count) %>
+                <%= render "components/table/cell" do %>
+                  <%= render "backstage/security/utc_time", time: group.last_seen %>
+                <% end %>
+              <% end %>
+            <% end %>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>

data/lib/generators/maquina/csp_reports/templates/db/create_csp_violations.rb.tt

@@ -0,0 +1,23 @@
+# Content Security Policy violation reports (maquina:csp_reports). Lives in the
+# `security` database next to abuse_events; db/security_schema.rb carries the same
+# table for a fresh database, this migration adds it to an existing one.
+class CreateCspViolations < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :csp_violations do |t|
+      t.string :effective_directive, null: false
+      t.string :blocked_uri
+      t.string :document_uri
+      t.string :source_file
+      t.integer :line_number
+      t.integer :column_number
+      t.string :disposition
+      t.string :sample
+      t.string :ip
+      t.string :user_agent
+      t.datetime :created_at, null: false
+    end
+
+    add_index :csp_violations, :created_at
+    add_index :csp_violations, [:effective_directive, :created_at]
+  end
+end

data/lib/generators/maquina/passkeys/USAGE

@@ -0,0 +1,18 @@
+Description:
+  Adds passkey (WebAuthn) sign-in on top of Clave's email-code login. Needs
+  maquina:clave; the email code stays as the way in without a passkey.
+
+  Adds the webauthn gem, which only verifies the ceremonies; the flow is
+  generated into the app. Installs the Passkey model and a webauthn_id on
+  users, sign-in endpoints (POST /session/passkey_challenge and
+  /session/passkey) that ask for no email, a /passkeys page to add, rename
+  and remove passkeys (adding or removing needs a sign-in from the last 30
+  minutes), two Stimulus controllers that use the browser's own WebAuthn JSON
+  helpers (no JavaScript library), a passkey button and autofill on the
+  sign-in page, config/initializers/webauthn.rb, EN/ES locales, a
+  Rack::Attack throttle and a FakeClient test helper. Anything it cannot
+  place safely is listed after the install instead of being forced.
+
+Examples:
+  rails g maquina:passkeys
+  rails g maquina:passkeys --skip-views    # Endpoints only; bring your own UI

data/lib/generators/maquina/passkeys/passkeys_generator.rb

@@ -0,0 +1,259 @@
+require "rails/generators"
+require "rails/generators/migration"
+
+module Maquina
+  module Generators
+    class PasskeysGenerator < Rails::Generators::Base
+      include Rails::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      GEM_LINE = %(gem "webauthn", "~> 3.4")
+      USER_SESSIONS = /^  has_many :sessions, dependent: :destroy\n/
+      USER_PRIVATE = /^  private\n/
+      SIGN_IN_FORM_END = /^      <% end %>\n/
+      EMAIL_AUTOCOMPLETE = %(autocomplete: "email")
+      TEST_HELP = /^require "rails\/test_help"\n/
+      THROTTLE_LIMIT = 20
+      THROTTLE_PERIOD = "1.minute"
+
+      class_option :skip_views, type: :boolean, default: false,
+        desc: "Skip view templates and Stimulus controllers"
+      class_option :quiet, type: :boolean, default: false,
+        desc: "Suppress post-install instructions"
+
+      def self.next_migration_number(dirname)
+        current = Time.now.utc.strftime("%Y%m%d%H%M%S")
+        existing = Dir.glob("#{dirname}/[0-9]*_*.rb").map { |f| File.basename(f).split("_", 2).first }.max
+        (existing && existing >= current) ? existing.succ : current
+      end
+
+      # 1. Passkeys sign people in through clave's sessions; the email code
+      #    stays as the way to get in without one.
+      def require_clave
+        return if %w[app/models/email_verification.rb app/controllers/concerns/authentication.rb]
+          .all? { |path| File.exist?(File.join(destination_root, path)) }
+
+        raise Thor::Error, "maquina:passkeys adds passkeys to Clave's email-code sign-in. Run `rails g maquina:clave` first."
+      end
+
+      # 2. The webauthn gem verifies the ceremonies; the flow stays in the app.
+      def add_gem
+        gemfile = File.join(destination_root, "Gemfile")
+        return unless File.exist?(gemfile)
+        return if File.read(gemfile).match?(/^\s*gem ["']webauthn["']/)
+
+        append_to_file "Gemfile", "\n#{GEM_LINE}\n"
+      end
+
+      def run_bundle_install
+        return unless rails_app?
+
+        Bundler.with_unbundled_env do
+          system("bundle install", chdir: destination_root)
+        end
+      end
+
+      # 3. Relying party
+      def create_initializer
+        copy_file "config/initializers/webauthn.rb", "config/initializers/webauthn.rb"
+      end
+
+      # 4. Models
+      def create_models
+        copy_file "app/models/passkey.rb", "app/models/passkey.rb"
+
+        path = "app/models/user.rb"
+        content = File.read(File.join(destination_root, path))
+        return if content.include?("has_many :passkeys")
+
+        if content.match?(USER_SESSIONS) && content.scan(USER_PRIVATE).one?
+          inject_into_file path, user_association, after: USER_SESSIONS
+          inject_into_file path, user_webauthn_id, before: USER_PRIVATE
+        else
+          @user_pending = true
+        end
+      end
+
+      # 5. Controllers
+      def create_controllers
+        copy_file "app/controllers/concerns/passkey_challenge.rb", "app/controllers/concerns/passkey_challenge.rb"
+        copy_file "app/controllers/concerns/passkey_reauthentication.rb", "app/controllers/concerns/passkey_reauthentication.rb"
+        copy_file "app/controllers/session/passkey_challenges_controller.rb", "app/controllers/session/passkey_challenges_controller.rb"
+        copy_file "app/controllers/session/passkeys_controller.rb", "app/controllers/session/passkeys_controller.rb"
+        copy_file "app/controllers/passkey_challenges_controller.rb", "app/controllers/passkey_challenges_controller.rb"
+        copy_file "app/controllers/passkeys_controller.rb", "app/controllers/passkeys_controller.rb"
+      end
+
+      # 6. Routes
+      def add_routes
+        return if File.read(File.join(destination_root, "config/routes.rb")).include?("generated by maquina:passkeys")
+
+        route <<~RUBY
+          # Passkeys (generated by maquina:passkeys)
+          resource :session, only: [] do
+            resource :passkey_challenge, only: :create, controller: "session/passkey_challenges"
+            resource :passkey, only: :create, controller: "session/passkeys"
+          end
+          resource :passkey_challenge, only: :create
+          resources :passkeys, only: [:index, :create, :update, :destroy]
+        RUBY
+      end
+
+      # 7. Migrations
+      def add_migrations
+        migration_template "migration_add_webauthn_id_to_users.rb.tt", "db/migrate/add_webauthn_id_to_users.rb"
+        migration_template "migration_create_passkeys.rb.tt", "db/migrate/create_passkeys.rb"
+      end
+
+      # 8. Views and Stimulus controllers
+      def create_views
+        return if options[:skip_views]
+
+        copy_file "app/views/passkeys/index.html.erb", "app/views/passkeys/index.html.erb"
+        copy_file "app/views/sessions/_passkey.html.erb", "app/views/sessions/_passkey.html.erb"
+        copy_file "app/javascript/controllers/passkey_sign_in_controller.js",
+          "app/javascript/controllers/passkey_sign_in_controller.js"
+        copy_file "app/javascript/controllers/passkey_registration_controller.js",
+          "app/javascript/controllers/passkey_registration_controller.js"
+
+        add_passkey_to_sign_in_page
+      end
+
+      # 9. Locale files
+      def create_locale_files
+        copy_file "config/locales/passkeys.en.yml", "config/locales/passkeys.en.yml"
+        copy_file "config/locales/passkeys.es.yml", "config/locales/passkeys.es.yml"
+      end
+
+      # 10. Test helper and the flow's integration test
+      def create_test_helper
+        copy_file "test/test_helpers/webauthn_test_helper.rb", "test/test_helpers/webauthn_test_helper.rb"
+        copy_file "test/integration/passkeys_test.rb", "test/integration/passkeys_test.rb"
+
+        path = File.join(destination_root, "test/test_helper.rb")
+        return unless File.exist?(path)
+
+        content = File.read(path)
+        return if content.include?(test_helper_require)
+        return @test_helper_pending = true unless content.match?(TEST_HELP)
+
+        inject_into_file "test/test_helper.rb", "#{test_helper_require}\n", after: TEST_HELP
+      end
+
+      # 11. Rack::Attack: the sign-in ceremony gets its own login-style throttle.
+      def configure_rack_attack
+        path = "config/initializers/rack_attack.rb"
+        full_path = File.join(destination_root, path)
+        return @rack_attack_pending = true unless File.exist?(full_path)
+        return if File.read(full_path).include?(%("passkey/ip"))
+
+        append_to_file path, passkey_throttle
+      end
+
+      # 12. Post-install message
+      def show_post_install
+        return if options[:quiet]
+
+        say ""
+        say "Passkeys have been installed!", :green
+        say ""
+        say "Next steps:", :yellow
+        say "  1. bin/rails db:migrate"
+        say "  2. Link to passkeys_path from your account or settings page"
+        say "  3. Visit /passkeys signed in, add a passkey, and sign in with it at /session/new"
+        say ""
+        say "Production: passkeys are bound to your domain. Set them before deploying:", :yellow
+        say "  WEBAUTHN_RP_ID=example.com"
+        say "  WEBAUTHN_ORIGINS=https://example.com"
+        say "  (or webauthn: {rp_id:, origins:} in credentials; see config/initializers/webauthn.rb)"
+        say ""
+        if @user_pending
+          say "Add to app/models/user.rb:", :yellow
+          say user_association
+          say user_webauthn_id
+        end
+        if @sign_in_pending
+          say "Offer passkeys on the sign-in page (app/views/sessions/new.html.erb):", :yellow
+          say "  - render the button after the email form:  <%= render \"sessions/passkey\" %>"
+          say %(  - let the email field suggest passkeys:     autocomplete: "username webauthn")
+          say ""
+        end
+        if @test_helper_pending
+          say "Load the passkey test helper in test/test_helper.rb:", :yellow
+          say "  #{test_helper_require}"
+          say ""
+        end
+        if @rack_attack_pending
+          say "Throttle passkey sign-in in config/initializers/rack_attack.rb:", :yellow
+          say passkey_throttle
+          say ""
+        end
+        say "Optional:", :yellow
+        say "  - Serving more than one domain? Publish /.well-known/webauthn (Related Origin Requests)"
+        say "  - Edit config/locales/passkeys.*.yml to customize messages"
+        say "  - Integration tests: register_passkey and sign_in_with_passkey(user) (test/test_helpers/webauthn_test_helper.rb)"
+        say ""
+      end
+
+      private
+
+      def rails_app?
+        File.exist?(File.join(destination_root, "bin/rails"))
+      end
+
+      def migration_version
+        "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
+      end
+
+      # The button goes after clave's email form, and the email field offers
+      # saved passkeys in its autofill. A page that no longer has that shape is
+      # left alone and listed after the install.
+      def add_passkey_to_sign_in_page
+        path = "app/views/sessions/new.html.erb"
+        full_path = File.join(destination_root, path)
+        return @sign_in_pending = true unless File.exist?(full_path)
+
+        content = File.read(full_path)
+        return if content.include?(%(render "sessions/passkey"))
+        return @sign_in_pending = true unless content.scan(SIGN_IN_FORM_END).one? && content.include?(EMAIL_AUTOCOMPLETE)
+
+        inject_into_file path, %(\n      <%= render "sessions/passkey" %>\n), after: SIGN_IN_FORM_END
+        gsub_file path, EMAIL_AUTOCOMPLETE, %(autocomplete: "username webauthn")
+      end
+
+      def test_helper_require
+        %(require_relative "test_helpers/webauthn_test_helper")
+      end
+
+      def user_association
+        "  has_many :passkeys, dependent: :destroy\n"
+      end
+
+      def user_webauthn_id
+        <<~RUBY.gsub(/^(?=.)/, "  ")
+          # The WebAuthn user handle: random and stable, never the id or the email,
+          # since authenticators store it and hand it back on every sign-in.
+          def webauthn_id
+            super || begin
+              update_column(:webauthn_id, WebAuthn.generate_user_id)
+              super
+            end
+          end
+
+        RUBY
+      end
+
+      def passkey_throttle
+        <<~RUBY
+
+          # Passkey sign-in (maquina:passkeys): the challenge and the assertion,
+          # counted like the email-code login above.
+          Rack::Attack.throttle("passkey/ip", limit: #{THROTTLE_LIMIT}, period: #{THROTTLE_PERIOD}) do |req|
+            req.ip if req.path.start_with?("/session/passkey") && req.post?
+          end
+        RUBY
+      end
+    end
+  end
+end

data/lib/generators/maquina/passkeys/templates/app/controllers/concerns/passkey_challenge.rb

@@ -0,0 +1,42 @@
+# One WebAuthn challenge per ceremony, kept in the session (generated by
+# maquina:passkeys).
+#
+# The browser signs the challenge, so a stored one that could be used twice
+# would let a captured response be replayed. take_passkey_challenge removes it
+# before anything is verified, and a challenge older than CHALLENGE_TTL is
+# refused. Registration and sign-in keep theirs under separate keys, so one
+# ceremony never consumes the other's.
+module PasskeyChallenge
+  extend ActiveSupport::Concern
+
+  CHALLENGE_TTL = 5.minutes
+
+  private
+
+  def store_passkey_challenge(purpose, challenge)
+    session[passkey_challenge_key(purpose)] = {
+      "challenge" => challenge,
+      "expires_at" => CHALLENGE_TTL.from_now.to_i
+    }
+  end
+
+  def take_passkey_challenge(purpose)
+    stored = session.delete(passkey_challenge_key(purpose))
+    stored["challenge"] if stored && stored["expires_at"].to_i > Time.current.to_i
+  end
+
+  def passkey_challenge_key(purpose)
+    :"passkey_#{purpose}_challenge"
+  end
+
+  # The browser's PublicKeyCredential#toJSON(). It is checked by signature, not
+  # assigned to a record, so only the shape is permitted here.
+  def passkey_credential_params
+    params.require(:credential).permit(
+      :id, :rawId, :type, :authenticatorAttachment,
+      response: [:clientDataJSON, :attestationObject, :authenticatorData, :signature, :userHandle,
+        :publicKey, :publicKeyAlgorithm, transports: []],
+      clientExtensionResults: {}
+    ).to_h
+  end
+end

data/lib/generators/maquina/passkeys/templates/app/controllers/concerns/passkey_reauthentication.rb

@@ -0,0 +1,26 @@
+# Adding or removing a passkey asks for a recent sign-in (generated by
+# maquina:passkeys).
+#
+# A passkey added from a stolen session cookie would outlive the cookie, so
+# a session older than REAUTHENTICATE_AFTER is ended and the person signs in
+# again (email code or passkey), coming back to the passkeys page after.
+module PasskeyReauthentication
+  extend ActiveSupport::Concern
+
+  REAUTHENTICATE_AFTER = 30.minutes
+
+  private
+
+  def require_recent_sign_in
+    return if Current.session.created_at.after?(REAUTHENTICATE_AFTER.ago)
+
+    terminate_session
+    session[:return_to_after_authenticating] = passkeys_url
+    flash[:alert] = t("flash.passkeys.reauthenticate")
+
+    respond_to do |format|
+      format.html { redirect_to new_session_path }
+      format.json { render json: {redirect_url: new_session_url}, status: :unauthorized }
+    end
+  end
+end

data/lib/generators/maquina/passkeys/templates/app/controllers/passkey_challenges_controller.rb

@@ -0,0 +1,24 @@
+class PasskeyChallengesController < ApplicationController
+  include PasskeyChallenge
+  include PasskeyReauthentication
+
+  before_action :require_recent_sign_in
+
+  # POST /passkey_challenge
+  #
+  # Options for navigator.credentials.create(). A discoverable credential
+  # (resident key) is what makes it a passkey: the device keeps the account,
+  # so sign-in needs no email. The user's existing passkeys are excluded so the
+  # same authenticator is not registered twice.
+  def create
+    user = Current.user
+    options = WebAuthn::Credential.options_for_create(
+      user: {id: user.webauthn_id, name: user.email_address, display_name: user.name.presence || user.email_address},
+      exclude: user.passkeys.pluck(:credential_id),
+      authenticator_selection: {resident_key: "required", user_verification: "required"}
+    )
+    store_passkey_challenge(:registration, options.challenge)
+
+    render json: options
+  end
+end

data/lib/generators/maquina/passkeys/templates/app/controllers/passkeys_controller.rb

@@ -0,0 +1,68 @@
+class PasskeysController < ApplicationController
+  include PasskeyChallenge
+  include PasskeyReauthentication
+
+  before_action :require_recent_sign_in, only: %i[create destroy]
+  before_action :set_passkey, only: %i[update destroy]
+
+  # GET /passkeys
+  def index
+    @passkeys = Current.user.passkeys.order(:created_at)
+  end
+
+  # POST /passkeys
+  def create
+    challenge = take_passkey_challenge(:registration)
+    return render_failure(t("flash.passkeys.challenge_expired")) unless challenge
+
+    credential = WebAuthn::Credential.from_create(passkey_credential_params)
+    # Checks the challenge, the origin, the relying party and that the person
+    # was verified on the device, not just present.
+    credential.verify(challenge, user_verification: true)
+
+    aaguid = credential.response.authenticator_data.aaguid
+    Current.user.passkeys.create!(
+      credential_id: credential.id,
+      public_key: credential.public_key,
+      sign_count: credential.sign_count,
+      transports: credential.response.transports,
+      aaguid: aaguid,
+      backup_eligible: credential.backup_eligible?,
+      backed_up: credential.backed_up?,
+      name: Passkey.default_name(aaguid)
+    )
+
+    Rails.logger.info "[AUTH] Passkey added for #{Current.user.email_address} from #{request.remote_ip}"
+    flash[:notice] = t("flash.passkeys.created")
+    render json: {redirect_url: passkeys_url}, status: :created
+  rescue WebAuthn::Error, ActiveRecord::RecordInvalid => error
+    Rails.logger.info "[AUTH] Passkey registration failed (#{error.class.name.demodulize}) for #{Current.user.email_address}"
+    render_failure(t("flash.passkeys.registration_failed"))
+  end
+
+  # PATCH /passkeys/:id
+  def update
+    if @passkey.update(params.expect(passkey: [:name]))
+      redirect_to passkeys_path, notice: t("flash.passkeys.updated")
+    else
+      redirect_to passkeys_path, alert: @passkey.errors.full_messages.to_sentence
+    end
+  end
+
+  # DELETE /passkeys/:id
+  def destroy
+    @passkey.destroy
+    Rails.logger.info "[AUTH] Passkey removed for #{Current.user.email_address} from #{request.remote_ip}"
+    redirect_to passkeys_path, notice: t("flash.passkeys.destroyed"), status: :see_other
+  end
+
+  private
+
+  def set_passkey
+    @passkey = Current.user.passkeys.find(params[:id])
+  end
+
+  def render_failure(message)
+    render json: {error: message}, status: :unprocessable_entity
+  end
+end

data/lib/generators/maquina/passkeys/templates/app/controllers/session/passkey_challenges_controller.rb

@@ -0,0 +1,18 @@
+class Session::PasskeyChallengesController < ApplicationController
+  include PasskeyChallenge
+
+  allow_unauthenticated_access
+
+  # POST /session/passkey_challenge
+  #
+  # Options for navigator.credentials.get(). No allowCredentials: the browser
+  # offers every passkey it holds for this site, so nobody types an email and
+  # the response says nothing about which accounts exist. It is a POST so a
+  # Turbo-cached page never reuses a challenge.
+  def create
+    options = WebAuthn::Credential.options_for_get(user_verification: "required")
+    store_passkey_challenge(:authentication, options.challenge)
+
+    render json: options
+  end
+end