maquina-generators 0.7.0 → 0.8.0

data/test/generators/maquina/clave_generator_test.rb

@@ -130,6 +130,13 @@ class Maquina::Generators::ClaveGeneratorTest < Rails::Generators::TestCase
     assert_file "app/models/user.rb"
   end
 
+  test "sign-in page links to sign-up" do
+    run_generator
+
+    assert_file "app/views/sessions/new.html.erb",
+      /<% end %>\n\n      <p class="mt-6 text-center text-sm text-muted-foreground">\n        <%= t\("\.no_account"\) %>\n        <%= link_to t\("\.sign_up"\), new_registration_path/
+  end
+
   test "skips registration with --skip-registration" do
     run_generator %w[--skip-registration]
 
@@ -139,9 +146,13 @@ class Maquina::Generators::ClaveGeneratorTest < Rails::Generators::TestCase
     assert_no_file "app/views/registrations/new.html.erb"
     assert_no_file "app/views/registration/verifications/new.html.erb"
 
-    # Session should still be generated
+    # Session should still be generated, without a link to the missing sign-up
     assert_file "app/controllers/sessions_controller.rb"
-    assert_file "app/views/sessions/new.html.erb"
+    assert_file "app/views/sessions/new.html.erb" do |content|
+      assert_no_match(/registration_path/, content)
+      assert_no_match(/t\("\.sign_up"\)/, content)
+      assert_match(/<% end %>\n    <\/div>\n  <\/div>\n<\/div>\n\z/, content)
+    end
 
     # Routes should not include registration
     assert_file "config/routes.rb" do |routes|

data/test/generators/maquina/passkeys_generator_test.rb

@@ -0,0 +1,253 @@
+require "test_helper"
+require "generators/maquina/passkeys/passkeys_generator"
+
+class Maquina::Generators::PasskeysGeneratorTest < Rails::Generators::TestCase
+  tests Maquina::Generators::PasskeysGenerator
+  destination File.expand_path("../../tmp", __dir__)
+
+  CLAVE_TEMPLATES = File.expand_path("../../../lib/generators/maquina/clave/templates", __dir__)
+
+  setup do
+    prepare_destination
+    write "config/routes.rb", "Rails.application.routes.draw do\nend\n"
+    write "Gemfile", "source \"https://rubygems.org\"\n"
+    write "app/models/email_verification.rb", "class EmailVerification < ApplicationRecord\nend\n"
+    write "app/controllers/concerns/authentication.rb", "module Authentication\nend\n"
+    # The files clave generates, as clave generates them.
+    write "app/models/user.rb", File.read(File.join(CLAVE_TEMPLATES, "app/models/user.rb.tt"))
+    write "app/views/sessions/new.html.erb", clave_sign_in_page
+    write "config/initializers/rack_attack.rb", "class Rack::Attack\nend\n"
+    write "test/test_helper.rb", TEST_HELPER
+  end
+
+  TEST_HELPER = <<~RUBY
+    ENV["RAILS_ENV"] ||= "test"
+    require_relative "../config/environment"
+    require "rails/test_help"
+  RUBY
+
+  test "refuses to run without clave" do
+    File.delete(File.join(destination_root, "app/models/email_verification.rb"))
+
+    output = capture(:stderr) { run_generator }
+
+    assert_match(/Run `rails g maquina:clave` first/, output)
+    assert_no_file "app/models/passkey.rb"
+  end
+
+  test "adds the webauthn gem" do
+    run_generator
+
+    assert_file "Gemfile", /^gem "webauthn", "~> 3\.4"$/
+  end
+
+  test "creates the relying party initializer" do
+    run_generator
+
+    assert_file "config/initializers/webauthn.rb" do |content|
+      assert_match(/config\.rp_id = ENV\["WEBAUTHN_RP_ID"\]/, content)
+      assert_match(/config\.allowed_origins = /, content)
+      assert_match(/raise "Passkeys: set WEBAUTHN_RP_ID/, content)
+    end
+  end
+
+  test "creates the passkey model and wires it into the user" do
+    run_generator
+
+    assert_file "app/models/passkey.rb", /class Passkey < ApplicationRecord/
+    assert_file "app/models/user.rb" do |content|
+      assert_match(/has_many :sessions, dependent: :destroy\n  has_many :passkeys, dependent: :destroy\n/, content)
+      assert_match(/def webauthn_id\n    super \|\| begin\n      update_column\(:webauthn_id, WebAuthn\.generate_user_id\)/, content)
+      assert_operator content.index("def webauthn_id"), :<, content.index("  private")
+    end
+  end
+
+  test "creates the migrations" do
+    run_generator
+
+    assert_migration "db/migrate/add_webauthn_id_to_users.rb", /add_index :users, :webauthn_id, unique: true/
+    assert_migration "db/migrate/create_passkeys.rb" do |content|
+      assert_match(/t\.string :credential_id, null: false/, content)
+      assert_match(/t\.text :public_key, null: false/, content)
+      assert_match(/t\.bigint :sign_count, null: false, default: 0/, content)
+      assert_match(/add_index :passkeys, :credential_id, unique: true/, content)
+    end
+  end
+
+  test "creates the controllers and routes" do
+    run_generator
+
+    assert_file "app/controllers/session/passkey_challenges_controller.rb", /class Session::PasskeyChallengesController/
+    assert_file "app/controllers/session/passkeys_controller.rb", /class Session::PasskeysController/
+    assert_file "app/controllers/passkey_challenges_controller.rb", /class PasskeyChallengesController/
+    assert_file "app/controllers/passkeys_controller.rb", /class PasskeysController/
+    assert_file "app/controllers/concerns/passkey_challenge.rb", /module PasskeyChallenge/
+    assert_file "app/controllers/concerns/passkey_reauthentication.rb", /module PasskeyReauthentication/
+    assert_file "config/routes.rb" do |content|
+      assert_match(/resource :passkey_challenge, only: :create, controller: "session\/passkey_challenges"/, content)
+      assert_match(/resource :passkey, only: :create, controller: "session\/passkeys"/, content)
+      assert_match(/resources :passkeys, only: \[:index, :create, :update, :destroy\]/, content)
+    end
+  end
+
+  test "sign-in offers every passkey and requires user verification" do
+    run_generator
+
+    assert_file "app/controllers/session/passkey_challenges_controller.rb" do |content|
+      assert_match(/options_for_get\(user_verification: "required"\)/, content)
+      assert_no_match(/allow:/, content)
+    end
+    assert_file "app/controllers/session/passkeys_controller.rb" do |content|
+      assert_match(/allow_unauthenticated_access/, content)
+      assert_match(/rate_limit to:/, content)
+      assert_match(/sign_count: passkey\.sign_count, user_verification: true\)/, content)
+      assert_match(/credential\.user_handle != user\.webauthn_id/, content)
+      assert_match(/start_new_session_for\(user\)/, content)
+      # The challenge is gone from the session before anything is verified.
+      assert_operator content.index("take_passkey_challenge"), :<, content.index("credential.verify")
+    end
+    assert_file "app/controllers/concerns/passkey_challenge.rb", /stored = session\.delete\(passkey_challenge_key\(purpose\)\)/
+  end
+
+  test "registration makes discoverable passkeys behind a recent sign-in" do
+    run_generator
+
+    assert_file "app/controllers/passkey_challenges_controller.rb" do |content|
+      assert_match(/include PasskeyReauthentication/, content)
+      assert_match(/resident_key: "required", user_verification: "required"/, content)
+      assert_match(/exclude: user\.passkeys\.pluck\(:credential_id\)/, content)
+    end
+    assert_file "app/controllers/passkeys_controller.rb" do |content|
+      assert_match(/include PasskeyReauthentication/, content)
+      assert_match(/credential\.verify\(challenge, user_verification: true\)/, content)
+      assert_match(/Current\.user\.passkeys\.find\(params\[:id\]\)/, content)
+    end
+  end
+
+  test "adds the passkey button and autofill to the sign-in page" do
+    run_generator
+
+    # Visible as rendered, refreshed after a Turbo morph (which doesn't reconnect).
+    assert_file "app/views/sessions/_passkey.html.erb" do |content|
+      assert_match(/data-action="turbo:morph@document->passkey-sign-in#refresh"/, content)
+      assert_match(/class="mt-6 space-y-4">/, content)
+    end
+    assert_file "app/views/passkeys/index.html.erb" do |content|
+      assert_match(/data-action="turbo:morph@document->passkey-registration#refresh"/, content)
+      assert_no_match(/disabled:opacity-50"\s+hidden>/, content)
+    end
+    assert_file "app/javascript/controllers/passkey_sign_in_controller.js", /mediation: "conditional"|\{ mediation \}/
+    assert_file "app/javascript/controllers/passkey_registration_controller.js", /parseCreationOptionsFromJSON/
+    assert_file "app/views/sessions/new.html.erb" do |content|
+      assert_match(/autocomplete: "username webauthn"/, content)
+      assert_match(/<% end %>\n\n      <%= render "sessions\/passkey" %>\n/, content)
+    end
+  end
+
+  test "the JavaScript needs no WebAuthn library" do
+    run_generator
+
+    %w[passkey_sign_in_controller.js passkey_registration_controller.js].each do |file|
+      assert_file "app/javascript/controllers/#{file}" do |content|
+        assert_equal ['import { Controller } from "@hotwired/stimulus"'], content.scan(/^import .*$/)
+      end
+    end
+  end
+
+  test "adds the passkey button to a sign-in page without sign-up" do
+    write "app/views/sessions/new.html.erb", clave_sign_in_page(skip_registration: true)
+
+    run_generator
+
+    assert_file "app/views/sessions/new.html.erb" do |content|
+      assert_match(/<% end %>\n\n      <%= render "sessions\/passkey" %>\n    <\/div>/, content)
+      assert_match(/autocomplete: "username webauthn"/, content)
+    end
+  end
+
+  test "skip-views leaves the pages and the sign-in form alone" do
+    run_generator ["--skip-views"]
+
+    assert_no_file "app/views/passkeys/index.html.erb"
+    assert_no_file "app/javascript/controllers/passkey_sign_in_controller.js"
+    assert_file "app/views/sessions/new.html.erb" do |content|
+      assert_no_match(/passkey/, content)
+    end
+  end
+
+  test "creates locales and the test helper" do
+    run_generator
+
+    assert_file "config/locales/passkeys.en.yml", /sign_in: "Sign in with a passkey"/
+    assert_file "config/locales/passkeys.es.yml", /sign_in: "Iniciar sesión con llave de acceso"/
+    assert_file "test/test_helpers/webauthn_test_helper.rb", /require "webauthn\/fake_client"/
+    assert_file "test/integration/passkeys_test.rb", /sign_in_with_passkey\(@user\)/
+    assert_file "test/test_helper.rb", /require "rails\/test_help"\nrequire_relative "test_helpers\/webauthn_test_helper"\n/
+  end
+
+  test "locales share the same keys" do
+    run_generator
+
+    en = YAML.load_file(File.join(destination_root, "config/locales/passkeys.en.yml"))["en"]
+    es = YAML.load_file(File.join(destination_root, "config/locales/passkeys.es.yml"))["es"]
+    assert_equal keys(en), keys(es)
+  end
+
+  test "throttles passkey sign-in in rack attack" do
+    run_generator
+
+    assert_file "config/initializers/rack_attack.rb", /Rack::Attack\.throttle\("passkey\/ip", limit: 20, period: 1\.minute\)/
+  end
+
+  test "running twice changes nothing" do
+    run_generator
+    files = %w[Gemfile config/routes.rb app/models/user.rb app/views/sessions/new.html.erb config/initializers/rack_attack.rb
+      test/test_helper.rb]
+    before = files.to_h { |f| [f, File.read(File.join(destination_root, f))] }
+
+    run_generator
+
+    files.each { |f| assert_equal before[f], File.read(File.join(destination_root, f)), f }
+  end
+
+  test "lists what it could not place" do
+    write "app/models/user.rb", "class User < ApplicationRecord\nend\n"
+    write "app/views/sessions/new.html.erb", "<h1>Sign in</h1>\n"
+    File.delete(File.join(destination_root, "config/initializers/rack_attack.rb"))
+    write "test/test_helper.rb", "# custom\n"
+
+    output = run_generator
+
+    assert_match(/Add to app\/models\/user\.rb:.*has_many :passkeys/m, output)
+    assert_match(/Offer passkeys on the sign-in page/, output)
+    assert_match(/Throttle passkey sign-in in config\/initializers\/rack_attack\.rb/, output)
+    assert_match(/Load the passkey test helper in test\/test_helper\.rb/, output)
+    assert_file "app/models/user.rb", "class User < ApplicationRecord\nend\n"
+    assert_file "app/views/sessions/new.html.erb", "<h1>Sign in</h1>\n"
+  end
+
+  test "quiet hides the post-install message" do
+    output = run_generator ["--quiet"]
+
+    assert_no_match(/Passkeys have been installed/, output)
+  end
+
+  private
+
+  # Clave's sign-in page as `rails g maquina:clave` renders it.
+  def clave_sign_in_page(skip_registration: false)
+    template = File.read(File.join(CLAVE_TEMPLATES, "app/views/sessions/new.html.erb.tt"))
+    options = {skip_registration: skip_registration}
+    ERB.new(template, trim_mode: "-").result(binding)
+  end
+
+  def write(path, content)
+    full_path = File.join(destination_root, path)
+    FileUtils.mkdir_p(File.dirname(full_path))
+    File.write(full_path, content)
+  end
+
+  def keys(hash, prefix = nil)
+    hash.flat_map { |k, v| v.is_a?(Hash) ? keys(v, "#{prefix}#{k}.") : ["#{prefix}#{k}"] }.sort
+  end
+end

data/test/tmp/Gemfile

@@ -1,15 +1,2 @@
 source "https://rubygems.org"
-
-gem "brakeman", group: :development
-
-gem "bundle-audit", group: :development
-
-gem "letter_opener", group: :development
-
-gem "standard", ">= 1.54", group: :development
-
-gem "rails-i18n"
-
-gem "maquina-components"
-
-gem "aws-sdk-s3", group: :production
+# gem "bcrypt"

data/test/tmp/app/controllers/application_controller.rb

@@ -0,0 +1,3 @@
+class ApplicationController < ActionController::Base
+  include Authentication
+end

data/test/tmp/app/controllers/concerns/authentication.rb

@@ -0,0 +1,63 @@
+module Authentication
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_authentication
+    helper_method :authenticated?, :session_expires_at
+  end
+
+  class_methods do
+    def allow_unauthenticated_access(**options)
+      skip_before_action :require_authentication, **options
+    end
+  end
+
+  private
+
+  def authenticated?
+    resume_session
+  end
+
+  def require_authentication
+    resume_session || request_authentication
+  end
+
+  def resume_session
+    Current.session ||= find_session_by_cookie
+  end
+
+  def find_session_by_cookie
+    return nil unless cookies.signed[:session_id]
+
+    Session.active.find_by(id: cookies.signed[:session_id])
+  end
+
+  def request_authentication
+    session[:return_to_after_authenticating] = request.url
+    redirect_to new_session_path
+  end
+
+  def after_authentication_url
+    session.delete(:return_to_after_authenticating) || root_url
+  end
+
+  def start_new_session_for(user)
+    user.sessions.create!(
+      user_agent: request.user_agent,
+      ip_address: request.remote_ip,
+      expires_at: 30.days.from_now
+    ).tap do |session|
+      Current.session = session
+      cookies.signed.permanent[:session_id] = {value: session.id, httponly: true, same_site: :lax}
+    end
+  end
+
+  def terminate_session
+    Current.session.destroy
+    cookies.delete(:session_id)
+  end
+
+  def session_expires_at
+    Current.session&.expires_at
+  end
+end

data/test/tmp/app/controllers/registration/verification_resends_controller.rb

@@ -0,0 +1,38 @@
+class Registration::VerificationResendsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 5, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_verification_path, alert: t("flash.general.rate_limited") }
+
+  # POST /registration/verification_resend
+  def create
+    old_verification = EmailVerification.find_by(id: session[:pending_verification_id])
+
+    unless old_verification
+      redirect_to new_registration_path
+      return
+    end
+
+    email = old_verification.email
+
+    if EmailVerification.for_email(email).recent.exists?
+      recent = EmailVerification.for_email(email).recent.first
+      redirect_to new_registration_verification_path,
+        alert: t("flash.registrations.cooldown", minutes: recent.minutes_until_resend)
+      return
+    end
+
+    verification = EmailVerification.create!(
+      email: email,
+      code: SecureRandom.hex(3).upcase,
+      verification_type: "signup",
+      locale: old_verification.locale || I18n.locale.to_s,
+      expires_at: 15.minutes.from_now
+    )
+
+    Rails.logger.info "[AUTH] Verification code resent for registration #{email} from #{request.remote_ip}"
+    VerificationMailer.verification_code(verification).deliver_later
+    session[:pending_verification_id] = verification.id
+
+    redirect_to new_registration_verification_path,
+      notice: t("flash.registrations.code_resent")
+  end
+end

data/test/tmp/app/controllers/registration/verifications_controller.rb

@@ -0,0 +1,64 @@
+class Registration::VerificationsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_verification_path, alert: t("flash.general.rate_limited") }
+
+  # GET /registration/verification/new
+  def new
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_signup_email]
+    redirect_to new_registration_path unless @email
+  end
+
+  # POST /registration/verification
+  def create
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_signup_email]
+
+    unless @verification
+      flash.now[:alert] = t("flash.registrations.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    if @verification.expired?
+      flash.now[:alert] = t("flash.registrations.code_expired")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    # Too many wrong guesses: kill the code so a fresh one is required.
+    if @verification.locked?
+      @verification.update!(expires_at: Time.current)
+      Rails.logger.warn "[AUTH] Verification locked after #{@verification.attempts} attempts for #{@email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.registrations.code_locked")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    unless @verification.code_matches?(params[:code])
+      @verification.increment!(:attempts)
+      Rails.logger.warn "[AUTH] Invalid verification code attempt for #{@email} from #{request.remote_ip} (attempt #{@verification.attempts})"
+      flash.now[:alert] = t("flash.registrations.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    user = nil
+    ActiveRecord::Base.transaction do
+      account = Account.create!
+      user = account.users.create!(
+        email_address: @verification.email,
+        locale: @verification.locale || I18n.default_locale.to_s,
+        role: :admin
+      )
+    end
+
+    @verification.mark_verified!
+    session.delete(:pending_verification_id)
+    session.delete(:pending_signup_email)
+
+    Rails.logger.info "[AUTH] Successful registration for #{user.email_address} from #{request.remote_ip}"
+    start_new_session_for(user)
+    redirect_to root_path, notice: t("flash.registrations.create.success")
+  end
+end

data/test/tmp/app/controllers/registrations_controller.rb

@@ -0,0 +1,63 @@
+class RegistrationsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_path, alert: t("flash.general.rate_limited") }
+
+  def new
+  end
+
+  def create
+    email = registration_params[:email_address]&.downcase&.strip
+
+    if email&.include?("+")
+      Rails.logger.warn "[AUTH] Registration attempted with + in email #{email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.registrations.email_plus_not_allowed")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    existing_user = User.find_by(email_address: email)
+
+    if existing_user
+      if existing_user.blocked?
+        # Fail silently - show same UI but don't send email
+        Rails.logger.info "[AUTH] Registration attempted for blocked user #{email} from #{request.remote_ip}"
+        session[:pending_signup_email] = email
+        redirect_to new_registration_verification_path
+      else
+        Rails.logger.info "[AUTH] Registration attempted for existing email #{email} from #{request.remote_ip}"
+        flash.now[:alert] = t("flash.registrations.email_taken")
+        render :new, status: :unprocessable_entity
+      end
+      return
+    end
+
+    recent_verification = EmailVerification.for_email(email).recent.first
+    if recent_verification
+      session[:pending_verification_id] = recent_verification.id
+      session[:pending_signup_email] = email
+      redirect_to new_registration_verification_path,
+        notice: t("flash.registrations.code_already_sent", minutes: recent_verification.minutes_until_resend)
+      return
+    end
+
+    verification = EmailVerification.create!(
+      email: email,
+      code: SecureRandom.hex(3).upcase,
+      verification_type: "signup",
+      locale: I18n.locale.to_s,
+      expires_at: 15.minutes.from_now
+    )
+
+    Rails.logger.info "[AUTH] Verification code sent for new registration #{email} from #{request.remote_ip}"
+    VerificationMailer.verification_code(verification).deliver_later
+    session[:pending_verification_id] = verification.id
+
+    redirect_to new_registration_verification_path
+  end
+
+  private
+
+  def registration_params
+    params.permit(:email_address)
+  end
+end

data/test/tmp/app/controllers/session/verification_resends_controller.rb

@@ -0,0 +1,44 @@
+class Session::VerificationResendsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 5, within: 3.minutes, only: :create, with: -> { redirect_to new_session_verification_path, alert: t("flash.general.rate_limited") }
+
+  # POST /session/verification_resend
+  def create
+    old_verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    email = old_verification&.email || session[:pending_login_email]
+
+    unless email
+      redirect_to new_session_path
+      return
+    end
+
+    if EmailVerification.for_email(email).recent.exists?
+      recent = EmailVerification.for_email(email).recent.first
+      redirect_to new_session_verification_path,
+        alert: t("flash.sessions.cooldown", minutes: recent.minutes_until_resend)
+      return
+    end
+
+    user = User.find_by(email_address: email)
+
+    if user && !user.blocked?
+      verification = EmailVerification.create!(
+        email: email,
+        code: SecureRandom.hex(3).upcase,
+        verification_type: "login",
+        locale: user.locale || I18n.default_locale.to_s,
+        expires_at: 15.minutes.from_now
+      )
+
+      Rails.logger.info "[AUTH] Verification code resent for login #{email} from #{request.remote_ip}"
+      VerificationMailer.verification_code(verification).deliver_later
+      session[:pending_verification_id] = verification.id
+    else
+      Rails.logger.info "[AUTH] Verification resend attempted for non-existent/blocked email #{email} from #{request.remote_ip}"
+    end
+
+    # Always show success (don't reveal if user exists)
+    redirect_to new_session_verification_path,
+      notice: t("flash.sessions.code_resent")
+  end
+end

data/test/tmp/app/controllers/session/verifications_controller.rb

@@ -0,0 +1,64 @@
+class Session::VerificationsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_verification_path, alert: t("flash.general.rate_limited") }
+
+  # GET /session/verification/new
+  def new
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_login_email]
+    redirect_to new_session_path unless @email
+  end
+
+  # POST /session/verification
+  def create
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_login_email]
+
+    # Generic error if no verification (user doesn't exist or blocked)
+    unless @verification
+      flash.now[:alert] = t("flash.sessions.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    if @verification.expired?
+      flash.now[:alert] = t("flash.sessions.code_expired")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    # Too many wrong guesses: kill the code so a fresh one is required.
+    if @verification.locked?
+      @verification.update!(expires_at: Time.current)
+      Rails.logger.warn "[AUTH] Verification locked after #{@verification.attempts} attempts for #{@email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.sessions.code_locked")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    unless @verification.code_matches?(params[:code])
+      @verification.increment!(:attempts)
+      Rails.logger.warn "[AUTH] Invalid verification code attempt for #{@email} from #{request.remote_ip} (attempt #{@verification.attempts})"
+      flash.now[:alert] = t("flash.sessions.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    user = User.find_by(email_address: @verification.email)
+
+    # Double-check user exists and not blocked
+    if user.nil? || user.blocked?
+      flash.now[:alert] = t("flash.sessions.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    @verification.mark_verified!
+    session.delete(:pending_verification_id)
+    session.delete(:pending_login_email)
+
+    Rails.logger.info "[AUTH] Successful login for #{user.email_address} from #{request.remote_ip}"
+    start_new_session_for(user)
+    redirect_to after_authentication_url, notice: t("flash.sessions.create.success")
+  end
+end