maquina-generators 0.7.0 → 0.8.0

data/lib/generators/maquina/passkeys/templates/app/javascript/controllers/passkey_registration_controller.js

@@ -0,0 +1,109 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Passkey registration and upkeep (maquina:passkeys).
+//
+// The button creates a passkey with the browser's own JSON helpers. On
+// connect the page tells the passkey provider which passkeys this account
+// still has and how it is named, so one removed here disappears from the
+// device's list too. Both signals are skipped where unsupported.
+//
+// The button is rendered visible and only hidden where passkeys are not
+// supported. A Turbo morph puts the server's attributes back without
+// reconnecting this controller, so the view calls refresh on turbo:morph.
+export default class extends Controller {
+  static targets = ["button", "error", "unsupported"]
+  static values = {
+    challengeUrl: String,
+    url: String,
+    errorMessage: String,
+    duplicateMessage: String,
+    rpId: String,
+    userId: String,
+    userName: String,
+    displayName: String,
+    credentialIds: Array
+  }
+
+  connect() {
+    this.refresh()
+    if (supported()) this.#signalAccountState()
+  }
+
+  refresh() {
+    this.buttonTarget.hidden = !supported()
+    this.unsupportedTarget.hidden = supported()
+  }
+
+  async register() {
+    this.buttonTarget.disabled = true
+    this.#showError(null)
+
+    try {
+      const options = await post(this.challengeUrlValue)
+      // Sign in again first: a full load, so the new session gets a fresh page.
+      if (options.body.redirect_url) return window.location.assign(options.body.redirect_url)
+      if (!options.ok) return this.#showError(options.body.error)
+
+      let credential
+      try {
+        credential = await navigator.credentials.create({
+          publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options.body)
+        })
+      } catch (error) {
+        // Cancelled, or this device already holds a passkey for the account.
+        if (error.name === "NotAllowedError") return
+        if (error.name === "InvalidStateError") return this.#showError(this.duplicateMessageValue)
+        return this.#showError()
+      }
+
+      const result = await post(this.urlValue, { credential: credential.toJSON() })
+      if (result.body.redirect_url) return visit(result.body.redirect_url)
+      this.#showError(result.body.error)
+    } finally {
+      this.buttonTarget.disabled = false
+    }
+  }
+
+  #signalAccountState() {
+    const { rpIdValue: rpId, userIdValue: userId } = this
+
+    PublicKeyCredential.signalAllAcceptedCredentials?.({
+      rpId, userId, allAcceptedCredentialIds: this.credentialIdsValue
+    }).catch(() => {})
+    PublicKeyCredential.signalCurrentUserDetails?.({
+      rpId, userId, name: this.userNameValue, displayName: this.displayNameValue
+    }).catch(() => {})
+  }
+
+  #showError(message = this.errorMessageValue) {
+    this.errorTarget.textContent = message || ""
+    this.errorTarget.hidden = !message
+  }
+}
+
+// JSON POST with the CSRF token; a network failure reads as an empty error.
+async function post(url, body) {
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-CSRF-Token": document.querySelector("meta[name=csrf-token]")?.content
+      },
+      body: body && JSON.stringify(body)
+    })
+    return { ok: response.ok, status: response.status, body: await response.json().catch(() => ({})) }
+  } catch {
+    return { ok: false, status: 0, body: {} }
+  }
+}
+
+function visit(url) {
+  window.Turbo ? window.Turbo.visit(url) : window.location.assign(url)
+}
+
+function supported() {
+  return typeof PublicKeyCredential !== "undefined" &&
+    typeof PublicKeyCredential.parseCreationOptionsFromJSON === "function"
+}

data/lib/generators/maquina/passkeys/templates/app/javascript/controllers/passkey_sign_in_controller.js

@@ -0,0 +1,113 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Passkey sign-in (maquina:passkeys).
+//
+// On connect it starts a conditional request: the browser offers saved
+// passkeys in the email field's autofill (autocomplete="username webauthn").
+// The button starts a modal request instead. Both use the browser's own JSON
+// helpers, so no WebAuthn library is needed. Cancelling the prompt is a
+// normal outcome, not an error.
+//
+// The block is rendered visible and only hidden where passkeys are not
+// supported; the view calls refresh on turbo:morph, which puts the server's
+// attributes back without reconnecting this controller. A successful sign-in
+// loads the next page in full, so it starts with the new session's CSRF token
+// and no Turbo snapshot of the signed-out page.
+export default class extends Controller {
+  static targets = ["button", "error"]
+  static values = { challengeUrl: String, url: String, errorMessage: String }
+
+  connect() {
+    this.refresh()
+    if (supported()) this.#autofill()
+  }
+
+  refresh() {
+    this.element.hidden = !supported()
+  }
+
+  disconnect() {
+    this.#abort()
+  }
+
+  async signIn() {
+    this.buttonTarget.disabled = true
+    try {
+      await this.#authenticate()
+    } finally {
+      this.buttonTarget.disabled = false
+    }
+  }
+
+  async #autofill() {
+    if (!(await PublicKeyCredential.isConditionalMediationAvailable?.())) return
+
+    await this.#authenticate("conditional")
+  }
+
+  async #authenticate(mediation) {
+    this.#abort()
+    const abortController = this.abortController = new AbortController()
+    if (!mediation) this.#showError(null)
+
+    let credential
+    try {
+      const options = await post(this.challengeUrlValue)
+      if (!options.ok) return this.#showError(options.body.error)
+
+      credential = await navigator.credentials.get({
+        publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options.body),
+        signal: abortController.signal,
+        ...(mediation && { mediation })
+      })
+    } catch (error) {
+      if (abortController.signal.aborted) return
+      if (error.name !== "NotAllowedError") return this.#showError()
+      // The modal prompt was cancelled: offer passkeys in autofill again.
+      if (!mediation) this.#autofill()
+      return
+    }
+
+    const result = await post(this.urlValue, { credential: credential.toJSON() })
+    if (result.body.redirect_url) return window.location.assign(result.body.redirect_url)
+
+    if (result.status === 404 && result.body.credential_id) {
+      // Deleted on the server: ask the passkey provider to drop it too.
+      PublicKeyCredential.signalUnknownCredential?.({ rpId: result.body.rp_id, credentialId: result.body.credential_id })
+    }
+    this.#showError(result.body.error)
+    this.#autofill()
+  }
+
+  #abort() {
+    this.abortController?.abort()
+  }
+
+  #showError(message = this.errorMessageValue) {
+    this.errorTarget.textContent = message || ""
+    this.errorTarget.hidden = !message
+  }
+}
+
+// JSON POST with the CSRF token; a network failure reads as an empty error.
+async function post(url, body) {
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-CSRF-Token": document.querySelector("meta[name=csrf-token]")?.content
+      },
+      body: body && JSON.stringify(body)
+    })
+    return { ok: response.ok, status: response.status, body: await response.json().catch(() => ({})) }
+  } catch {
+    return { ok: false, status: 0, body: {} }
+  }
+}
+
+function supported() {
+  return typeof PublicKeyCredential !== "undefined" &&
+    typeof PublicKeyCredential.parseRequestOptionsFromJSON === "function"
+}

data/lib/generators/maquina/passkeys/templates/app/models/passkey.rb

@@ -0,0 +1,36 @@
+# A WebAuthn credential that signs its owner in (generated by maquina:passkeys).
+#
+# Only the public key is stored; the private key never leaves the device or
+# the password manager, so a leaked table cannot be used to sign in.
+class Passkey < ApplicationRecord
+  # AAGUIDs of common passkey providers, to give a new passkey a useful
+  # default name. Providers that send no AAGUID fall back to "Passkey".
+  PROVIDERS = {
+    "fbfc3007-154e-4ecc-8c0b-6e020557d7bd" => "iCloud Keychain",
+    "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4" => "Google Password Manager",
+    "adce0002-35bc-c60a-648b-0b25f1f05503" => "Chrome on Mac",
+    "08987058-cadc-4b81-b6e1-30de50dcbe96" => "Windows Hello",
+    "bada5566-a7aa-401f-bd96-45619a55120d" => "1Password",
+    "d548826e-79b4-db40-a3d8-11116f7e8349" => "Bitwarden"
+  }.freeze
+
+  belongs_to :user
+
+  validates :credential_id, presence: true, uniqueness: true
+  validates :public_key, presence: true
+  validates :name, presence: true, length: {maximum: 100}
+
+  def self.default_name(aaguid)
+    PROVIDERS.fetch(aaguid, "Passkey")
+  end
+
+  def record_use!(sign_count)
+    update!(sign_count: sign_count, last_used_at: Time.current)
+  end
+
+  # Synced through a provider (iCloud Keychain, Google Password Manager, a
+  # password manager) rather than bound to one device.
+  def synced?
+    backed_up?
+  end
+end

data/lib/generators/maquina/passkeys/templates/app/views/passkeys/index.html.erb

@@ -0,0 +1,77 @@
+<div class="flex flex-1 justify-center px-4 py-8">
+  <div class="w-full max-w-2xl space-y-6"
+       data-controller="passkey-registration"
+       data-action="turbo:morph@document->passkey-registration#refresh"
+       data-passkey-registration-challenge-url-value="<%= passkey_challenge_path %>"
+       data-passkey-registration-url-value="<%= passkeys_path %>"
+       data-passkey-registration-error-message-value="<%= t(".error") %>"
+       data-passkey-registration-duplicate-message-value="<%= t(".duplicate") %>"
+       data-passkey-registration-rp-id-value="<%= WebAuthn.configuration.rp_id %>"
+       data-passkey-registration-user-id-value="<%= Current.user.webauthn_id %>"
+       data-passkey-registration-user-name-value="<%= Current.user.email_address %>"
+       data-passkey-registration-display-name-value="<%= Current.user.name.presence || Current.user.email_address %>"
+       data-passkey-registration-credential-ids-value="<%= @passkeys.map(&:credential_id).to_json %>">
+    <div class="flex flex-wrap items-start justify-between gap-4">
+      <div>
+        <h1 class="text-2xl font-bold text-foreground"><%= t(".title") %></h1>
+        <p class="mt-1 text-sm text-muted-foreground"><%= t(".description") %></p>
+      </div>
+
+      <button type="button"
+              data-action="passkey-registration#register"
+              data-passkey-registration-target="button"
+              data-component="button"
+              data-variant="primary"
+              class="px-4 py-2 text-sm font-medium text-primary-foreground bg-primary hover:bg-primary/90 rounded-lg transition-colors cursor-pointer disabled:opacity-50">
+        <%= t(".add") %>
+      </button>
+    </div>
+
+    <p data-passkey-registration-target="error" class="text-sm text-destructive" role="alert" hidden></p>
+    <p data-passkey-registration-target="unsupported" class="text-sm text-muted-foreground" hidden><%= t(".unsupported") %></p>
+
+    <% if @passkeys.empty? %>
+      <div class="bg-card rounded-xl border border-border p-8 text-center">
+        <p class="text-sm text-muted-foreground"><%= t(".empty") %></p>
+      </div>
+    <% else %>
+      <ul class="bg-card rounded-xl border border-border divide-y divide-border">
+        <% @passkeys.each do |passkey| %>
+          <li id="<%= dom_id(passkey) %>" class="flex flex-wrap items-center gap-4 p-4">
+            <%= form_with model: passkey, class: "flex flex-1 items-center gap-2 min-w-0" do |form| %>
+              <%= form.text_field :name, required: true, maxlength: 100,
+                    aria: { label: Passkey.human_attribute_name(:name) },
+                    data: { component: "input" },
+                    class: "min-w-0 flex-1 px-3 py-2 text-sm border border-input rounded-lg focus:ring-2 focus:ring-ring focus:border-ring" %>
+              <%= form.submit t(".rename"), data: { component: "button", variant: "ghost" },
+                    class: "px-3 py-2 text-sm font-medium text-foreground hover:bg-accent rounded-lg cursor-pointer" %>
+            <% end %>
+
+            <div class="text-xs text-muted-foreground space-y-1">
+              <p>
+                <%= t(".created", date: l(passkey.created_at.to_date, format: :long)) %>
+                <% if passkey.synced? %>
+                  · <span data-component="badge" class="font-medium"><%= t(".synced") %></span>
+                <% end %>
+              </p>
+              <p>
+                <%= passkey.last_used_at ? t(".last_used", time: time_ago_in_words(passkey.last_used_at)) : t(".never_used") %>
+              </p>
+            </div>
+
+            <%= button_to t(".remove"), passkey_path(passkey), method: :delete,
+                  form: { data: { turbo_confirm: t(".remove_confirm") } },
+                  data: { component: "button", variant: "destructive" },
+                  class: "px-3 py-2 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg cursor-pointer" %>
+          </li>
+        <% end %>
+      </ul>
+
+      <% if @passkeys.one? && !@passkeys.first.synced? %>
+        <p class="text-sm text-muted-foreground"><%= t(".add_another") %></p>
+      <% end %>
+    <% end %>
+
+    <p class="text-sm text-muted-foreground"><%= t(".fallback") %></p>
+  </div>
+</div>

data/lib/generators/maquina/passkeys/templates/app/views/sessions/_passkey.html.erb

@@ -0,0 +1,23 @@
+<div data-controller="passkey-sign-in"
+     data-action="turbo:morph@document->passkey-sign-in#refresh"
+     data-passkey-sign-in-challenge-url-value="<%= session_passkey_challenge_path %>"
+     data-passkey-sign-in-url-value="<%= session_passkey_path %>"
+     data-passkey-sign-in-error-message-value="<%= t("sessions.passkey.error") %>"
+     class="mt-6 space-y-4">
+  <div class="flex items-center gap-3 text-sm text-muted-foreground">
+    <span class="h-px flex-1 bg-border"></span>
+    <%= t("sessions.passkey.or") %>
+    <span class="h-px flex-1 bg-border"></span>
+  </div>
+
+  <button type="button"
+          data-action="passkey-sign-in#signIn"
+          data-passkey-sign-in-target="button"
+          data-component="button"
+          data-variant="outline"
+          class="w-full px-4 py-3 text-base font-medium text-foreground bg-background border border-input hover:bg-accent rounded-lg transition-colors cursor-pointer disabled:opacity-50">
+    <%= t("sessions.passkey.sign_in") %>
+  </button>
+
+  <p data-passkey-sign-in-target="error" class="text-sm text-destructive text-center" role="alert" hidden></p>
+</div>

data/lib/generators/maquina/passkeys/templates/config/initializers/webauthn.rb

@@ -0,0 +1,23 @@
+# Passkeys (maquina:passkeys)
+#
+# A passkey is bound to its relying party: rp_id is the domain it belongs to,
+# and the browser only offers it on pages from allowed_origins. rp_id can be
+# a parent of the origins' host (example.com for https://app.example.com),
+# never another domain. Changing rp_id later orphans every saved passkey.
+#
+# Development and test use localhost; production reads WEBAUTHN_RP_ID and
+# WEBAUTHN_ORIGINS (comma-separated), or webauthn: {rp_id:, origins:} in the
+# credentials.
+webauthn = Rails.application.credentials.webauthn || {}
+
+WebAuthn.configure do |config|
+  config.rp_name = ENV.fetch("WEBAUTHN_RP_NAME") { Rails.application.class.module_parent_name.titleize }
+  config.rp_id = ENV["WEBAUTHN_RP_ID"] || webauthn[:rp_id] || "localhost"
+  config.allowed_origins = Array(ENV["WEBAUTHN_ORIGINS"]&.split(",") || webauthn[:origins] || "http://localhost:3000")
+end
+
+# A production app still on localhost would accept no passkey at all. The
+# asset build runs in production without the real settings, so it is spared.
+if Rails.env.production? && WebAuthn.configuration.rp_id == "localhost" && ENV["SECRET_KEY_BASE_DUMMY"].blank?
+  raise "Passkeys: set WEBAUTHN_RP_ID and WEBAUTHN_ORIGINS (see config/initializers/webauthn.rb)"
+end

data/lib/generators/maquina/passkeys/templates/config/locales/passkeys.en.yml

@@ -0,0 +1,46 @@
+en:
+  flash:
+    passkeys:
+      created: "Passkey added. You can now sign in with it."
+      updated: "Passkey renamed."
+      destroyed: "Passkey removed."
+      failed: "We couldn't sign you in with that passkey. Try again or use your email."
+      unknown: "That passkey is no longer linked to an account. Sign in with your email instead."
+      challenge_expired: "The request expired. Please try again."
+      registration_failed: "We couldn't add that passkey. Please try again."
+      reauthenticate: "Sign in again to manage your passkeys."
+
+  sessions:
+    passkey:
+      or: "or"
+      sign_in: "Sign in with a passkey"
+      error: "Something went wrong with the passkey. Please try again."
+
+  passkeys:
+    index:
+      title: "Passkeys"
+      description: "Sign in with Face ID, a fingerprint or your device PIN instead of an email code."
+      add: "Add a passkey"
+      empty: "You don't have any passkeys yet."
+      rename: "Save"
+      remove: "Remove"
+      remove_confirm: "Remove this passkey? You won't be able to sign in with it anymore."
+      created: "Added %{date}"
+      synced: "Synced"
+      last_used: "Last used %{time} ago"
+      never_used: "Not used yet"
+      add_another: "This passkey lives on one device. Add another so you can still sign in if you lose it."
+      fallback: "You can always sign in with a code sent to your email."
+      unsupported: "This browser doesn't support passkeys."
+      error: "Something went wrong with the passkey. Please try again."
+      duplicate: "This device already has a passkey for your account."
+
+  activerecord:
+    models:
+      passkey:
+        one: "Passkey"
+        other: "Passkeys"
+    attributes:
+      passkey:
+        name: "Name"
+        last_used_at: "Last used"

data/lib/generators/maquina/passkeys/templates/config/locales/passkeys.es.yml

@@ -0,0 +1,46 @@
+es:
+  flash:
+    passkeys:
+      created: "Llave de acceso agregada. Ya puedes iniciar sesión con ella."
+      updated: "Llave de acceso renombrada."
+      destroyed: "Llave de acceso eliminada."
+      failed: "No pudimos iniciar tu sesión con esa llave de acceso. Inténtalo de nuevo o usa tu correo."
+      unknown: "Esa llave de acceso ya no está vinculada a una cuenta. Inicia sesión con tu correo."
+      challenge_expired: "La solicitud expiró. Inténtalo de nuevo."
+      registration_failed: "No pudimos agregar esa llave de acceso. Inténtalo de nuevo."
+      reauthenticate: "Inicia sesión de nuevo para administrar tus llaves de acceso."
+
+  sessions:
+    passkey:
+      or: "o"
+      sign_in: "Iniciar sesión con llave de acceso"
+      error: "Algo salió mal con la llave de acceso. Inténtalo de nuevo."
+
+  passkeys:
+    index:
+      title: "Llaves de acceso"
+      description: "Inicia sesión con Face ID, tu huella o el PIN de tu dispositivo en lugar de un código por correo."
+      add: "Agregar llave de acceso"
+      empty: "Todavía no tienes llaves de acceso."
+      rename: "Guardar"
+      remove: "Eliminar"
+      remove_confirm: "¿Eliminar esta llave de acceso? Ya no podrás iniciar sesión con ella."
+      created: "Agregada el %{date}"
+      synced: "Sincronizada"
+      last_used: "Usada hace %{time}"
+      never_used: "Sin usar"
+      add_another: "Esta llave de acceso vive en un solo dispositivo. Agrega otra para no perder el acceso si lo pierdes."
+      fallback: "Siempre puedes iniciar sesión con un código enviado a tu correo."
+      unsupported: "Este navegador no es compatible con llaves de acceso."
+      error: "Algo salió mal con la llave de acceso. Inténtalo de nuevo."
+      duplicate: "Este dispositivo ya tiene una llave de acceso para tu cuenta."
+
+  activerecord:
+    models:
+      passkey:
+        one: "Llave de acceso"
+        other: "Llaves de acceso"
+    attributes:
+      passkey:
+        name: "Nombre"
+        last_used_at: "Último uso"

data/lib/generators/maquina/passkeys/templates/migration_add_webauthn_id_to_users.rb.tt

@@ -0,0 +1,6 @@
+class AddWebauthnIdToUsers < ActiveRecord::Migration<%= migration_version %>
+  def change
+    add_column :users, :webauthn_id, :string
+    add_index :users, :webauthn_id, unique: true
+  end
+end

data/lib/generators/maquina/passkeys/templates/migration_create_passkeys.rb.tt

@@ -0,0 +1,20 @@
+class CreatePasskeys < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :passkeys do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :credential_id, null: false
+      t.text :public_key, null: false
+      t.bigint :sign_count, null: false, default: 0
+      t.string :name, null: false
+      t.json :transports
+      t.string :aaguid, limit: 36
+      t.boolean :backup_eligible, null: false, default: false
+      t.boolean :backed_up, null: false, default: false
+      t.datetime :last_used_at
+
+      t.timestamps
+    end
+
+    add_index :passkeys, :credential_id, unique: true
+  end
+end

data/lib/generators/maquina/passkeys/templates/test/integration/passkeys_test.rb

@@ -0,0 +1,99 @@
+require "test_helper"
+require_relative "../test_helpers/session_test_helper"
+
+# The passkey flow end to end (generated by maquina:passkeys), with
+# WebAuthn::FakeClient as the browser and the authenticator.
+class PasskeysTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = User.create!(account: Account.create!(name: "Acme"), email_address: "passkey@example.com")
+  end
+
+  test "adds a passkey and signs in with it" do
+    sign_in_as @user
+    register_passkey
+    assert_response :created
+    passkey = @user.passkeys.sole
+
+    sign_out
+    sign_in_with_passkey(@user)
+
+    assert_response :success
+    assert response.parsed_body["redirect_url"].present?
+    assert cookies["session_id"].present?
+    assert passkey.reload.last_used_at
+  end
+
+  test "a challenge signs in once" do
+    sign_in_as @user
+    register_passkey
+    sign_out
+
+    post session_passkey_challenge_path, as: :json
+    assertion = webauthn_client.get(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: true, user_handle: Base64.urlsafe_decode64(@user.reload.webauthn_id))
+    post session_passkey_path, params: {credential: assertion}, as: :json
+    assert_response :success
+
+    post session_passkey_path, params: {credential: assertion}, as: :json
+    assert_response :unprocessable_entity
+  end
+
+  test "a passkey needs user verification" do
+    sign_in_as @user
+    post passkey_challenge_path, as: :json
+    credential = webauthn_client.create(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: false)
+
+    post passkeys_path, params: {credential: credential}, as: :json
+
+    assert_response :unprocessable_entity
+    assert_empty @user.passkeys
+  end
+
+  test "a removed passkey no longer signs in" do
+    sign_in_as @user
+    register_passkey
+    @user.passkeys.destroy_all
+    sign_out
+
+    sign_in_with_passkey(@user)
+
+    assert_response :not_found
+    assert response.parsed_body["credential_id"].present?
+  end
+
+  test "a blocked user cannot sign in with a passkey" do
+    sign_in_as @user
+    register_passkey
+    sign_out
+    @user.block!
+
+    sign_in_with_passkey(@user)
+
+    assert_response :unprocessable_entity
+  end
+
+  test "adding a passkey needs a recent sign-in" do
+    sign_in_as @user
+    Current.session.update_column(:created_at, 2.hours.ago)
+
+    post passkey_challenge_path, as: :json
+
+    assert_response :unauthorized
+    assert_equal new_session_url, response.parsed_body["redirect_url"]
+  end
+
+  test "renames and removes a passkey" do
+    sign_in_as @user
+    register_passkey
+    passkey = @user.passkeys.sole
+
+    patch passkey_path(passkey), params: {passkey: {name: "Work laptop"}}
+    assert_redirected_to passkeys_path
+    assert_equal "Work laptop", passkey.reload.name
+
+    delete passkey_path(passkey)
+    assert_redirected_to passkeys_path
+    assert_empty @user.passkeys.reload
+  end
+end

data/lib/generators/maquina/passkeys/templates/test/test_helpers/webauthn_test_helper.rb

@@ -0,0 +1,38 @@
+# Passkeys in integration tests (generated by maquina:passkeys).
+#
+# WebAuthn::FakeClient plays the browser and the authenticator, so tests go
+# through the real endpoints: register_passkey needs a signed-in user
+# (sign_in_as), sign_in_with_passkey needs a passkey the same client made.
+#
+#   sign_in_as users(:one)
+#   register_passkey
+#   sign_out
+#   sign_in_with_passkey(users(:one))
+#   assert_response :success
+require "webauthn/fake_client"
+
+module WebauthnTestHelper
+  def webauthn_client
+    @webauthn_client ||= WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
+  end
+
+  def register_passkey(client: webauthn_client)
+    post passkey_challenge_path, as: :json
+    credential = client.create(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: true)
+
+    post passkeys_path, params: {credential: credential}, as: :json
+  end
+
+  def sign_in_with_passkey(user, client: webauthn_client)
+    post session_passkey_challenge_path, as: :json
+    assertion = client.get(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: true, user_handle: Base64.urlsafe_decode64(user.reload.webauthn_id))
+
+    post session_passkey_path, params: {credential: assertion}, as: :json
+  end
+end
+
+ActiveSupport.on_load(:action_dispatch_integration_test) do
+  include WebauthnTestHelper
+end

data/lib/maquina_generators/version.rb

@@ -1,3 +1,3 @@
 module MaquinaGenerators
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 end