maquina-generators 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8127a7f3efbfaea2bb59f4c0b0977476fd7bc4d176d634d294d9520dd3a10f83
-  data.tar.gz: ef59f91d08b1f3bb99343f28564e5d4c07972201724e3c58a7ee37b1ab93c07f
+  metadata.gz: 7e7ab2221409345c84231d6908e18f5f14b265d32a10229f288f23d4c5a03006
+  data.tar.gz: b4966e9de4099d0664da18fd6ba2818b560770cdb2dab121a9f06265e38b4769
 SHA512:
-  metadata.gz: 61d953a6567afb896d605dcf653bd8cd71d192fa81d043262157b32f915847f70e22bc74575cc35468f093b00532a0d910e39108fc6d0224ae7a6b5813fe832b
-  data.tar.gz: 7e65996ad9c0e7e61bbd8ce5774432df06a8176005741b68ba2c3757cbaffa42439e1bacae486b5966e4b3801470d8d506e5a6c019c2bb4d95e9615cb2beb7a2
+  metadata.gz: f7b0d031778c2aa4b8cc03079e08f049a79d499500dfe0bb8b44b5e94e7743afdfc0ea6d0625d97b0128c937628980c9eb5317eef5bfe9ea62d68cd25f3e0487
+  data.tar.gz: 2ccfde4751e49534fb7c36149c623ea8fd93849a8e26e860fae0566556f2832173f8f488b708dca6e23f8890e8a6b4243571e61c6811723a325c1535f2a5dde5

data/lib/generators/maquina/passkeys/passkeys_generator.rb

@@ -248,9 +248,10 @@ module Maquina
         <<~RUBY
 
           # Passkey sign-in (maquina:passkeys): the challenge and the assertion,
-          # counted like the email-code login above.
+          # counted like the email-code login above. Keyed on the address Rails
+          # resolves through trusted proxies, not the proxy hop in req.ip.
           Rack::Attack.throttle("passkey/ip", limit: #{THROTTLE_LIMIT}, period: #{THROTTLE_PERIOD}) do |req|
-            req.ip if req.path.start_with?("/session/passkey") && req.post?
+            (req.env["action_dispatch.remote_ip"]&.to_s || req.ip) if req.path.start_with?("/session/passkey") && req.post?
           end
         RUBY
       end

data/lib/generators/maquina/passkeys/templates/app/controllers/passkeys_controller.rb

@@ -43,9 +43,9 @@ class PasskeysController < ApplicationController
   # PATCH /passkeys/:id
   def update
     if @passkey.update(params.expect(passkey: [:name]))
-      redirect_to passkeys_path, notice: t("flash.passkeys.updated")
+      redirect_to passkeys_path, notice: t("flash.passkeys.updated"), status: :see_other
     else
-      redirect_to passkeys_path, alert: @passkey.errors.full_messages.to_sentence
+      redirect_to passkeys_path, alert: @passkey.errors.full_messages.to_sentence, status: :see_other
     end
   end
 

data/lib/generators/maquina/passkeys/templates/app/views/passkeys/index.html.erb

@@ -61,7 +61,7 @@
 
             <%= button_to t(".remove"), passkey_path(passkey), method: :delete,
                   form: { data: { turbo_confirm: t(".remove_confirm") } },
-                  data: { component: "button", variant: "destructive" },
+                  data: { component: "button", variant: "ghost" },
                   class: "px-3 py-2 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg cursor-pointer" %>
           </li>
         <% end %>

data/lib/maquina_generators/version.rb

@@ -1,3 +1,3 @@
 module MaquinaGenerators
-  VERSION = "0.8.0"
+  VERSION = "0.8.1"
 end

data/test/generators/maquina/passkeys_generator_test.rb

@@ -124,6 +124,19 @@ class Maquina::Generators::PasskeysGeneratorTest < Rails::Generators::TestCase
     end
   end
 
+  test "renaming and removing redirect with 303 and the remove button stays readable" do
+    run_generator
+
+    assert_file "app/controllers/passkeys_controller.rb" do |content|
+      assert_equal 3, content.scan(/redirect_to passkeys_path, .*status: :see_other$/).size
+      assert_no_match(/redirect_to(?!.*see_other)/, content)
+    end
+    assert_file "app/views/passkeys/index.html.erb" do |content|
+      assert_no_match(/variant: "destructive"/, content)
+      assert_match(/variant: "ghost" },\n\s+class: "[^"]*text-destructive hover:bg-destructive\/10/, content)
+    end
+  end
+
   test "adds the passkey button and autofill to the sign-in page" do
     run_generator
 
@@ -197,6 +210,7 @@ class Maquina::Generators::PasskeysGeneratorTest < Rails::Generators::TestCase
     run_generator
 
     assert_file "config/initializers/rack_attack.rb", /Rack::Attack\.throttle\("passkey\/ip", limit: 20, period: 1\.minute\)/
+    assert_file "config/initializers/rack_attack.rb", /\(req\.env\["action_dispatch\.remote_ip"\]&\.to_s \|\| req\.ip\) if req\.path\.start_with\?\("\/session\/passkey"\)/
   end
 
   test "running twice changes nothing" do

data/test/tmp/Gemfile

@@ -1,2 +1,3 @@
 source "https://rubygems.org"
-# gem "bcrypt"
+
+gem "webauthn", "~> 3.4"

data/test/tmp/app/controllers/concerns/authentication.rb

@@ -1,63 +1,2 @@
 module Authentication
-  extend ActiveSupport::Concern
-
-  included do
-    before_action :require_authentication
-    helper_method :authenticated?, :session_expires_at
-  end
-
-  class_methods do
-    def allow_unauthenticated_access(**options)
-      skip_before_action :require_authentication, **options
-    end
-  end
-
-  private
-
-  def authenticated?
-    resume_session
-  end
-
-  def require_authentication
-    resume_session || request_authentication
-  end
-
-  def resume_session
-    Current.session ||= find_session_by_cookie
-  end
-
-  def find_session_by_cookie
-    return nil unless cookies.signed[:session_id]
-
-    Session.active.find_by(id: cookies.signed[:session_id])
-  end
-
-  def request_authentication
-    session[:return_to_after_authenticating] = request.url
-    redirect_to new_session_path
-  end
-
-  def after_authentication_url
-    session.delete(:return_to_after_authenticating) || root_url
-  end
-
-  def start_new_session_for(user)
-    user.sessions.create!(
-      user_agent: request.user_agent,
-      ip_address: request.remote_ip,
-      expires_at: 30.days.from_now
-    ).tap do |session|
-      Current.session = session
-      cookies.signed.permanent[:session_id] = {value: session.id, httponly: true, same_site: :lax}
-    end
-  end
-
-  def terminate_session
-    Current.session.destroy
-    cookies.delete(:session_id)
-  end
-
-  def session_expires_at
-    Current.session&.expires_at
-  end
 end

data/test/tmp/app/controllers/concerns/passkey_challenge.rb

@@ -0,0 +1,42 @@
+# One WebAuthn challenge per ceremony, kept in the session (generated by
+# maquina:passkeys).
+#
+# The browser signs the challenge, so a stored one that could be used twice
+# would let a captured response be replayed. take_passkey_challenge removes it
+# before anything is verified, and a challenge older than CHALLENGE_TTL is
+# refused. Registration and sign-in keep theirs under separate keys, so one
+# ceremony never consumes the other's.
+module PasskeyChallenge
+  extend ActiveSupport::Concern
+
+  CHALLENGE_TTL = 5.minutes
+
+  private
+
+  def store_passkey_challenge(purpose, challenge)
+    session[passkey_challenge_key(purpose)] = {
+      "challenge" => challenge,
+      "expires_at" => CHALLENGE_TTL.from_now.to_i
+    }
+  end
+
+  def take_passkey_challenge(purpose)
+    stored = session.delete(passkey_challenge_key(purpose))
+    stored["challenge"] if stored && stored["expires_at"].to_i > Time.current.to_i
+  end
+
+  def passkey_challenge_key(purpose)
+    :"passkey_#{purpose}_challenge"
+  end
+
+  # The browser's PublicKeyCredential#toJSON(). It is checked by signature, not
+  # assigned to a record, so only the shape is permitted here.
+  def passkey_credential_params
+    params.require(:credential).permit(
+      :id, :rawId, :type, :authenticatorAttachment,
+      response: [:clientDataJSON, :attestationObject, :authenticatorData, :signature, :userHandle,
+        :publicKey, :publicKeyAlgorithm, transports: []],
+      clientExtensionResults: {}
+    ).to_h
+  end
+end

data/test/tmp/app/controllers/concerns/passkey_reauthentication.rb

@@ -0,0 +1,26 @@
+# Adding or removing a passkey asks for a recent sign-in (generated by
+# maquina:passkeys).
+#
+# A passkey added from a stolen session cookie would outlive the cookie, so
+# a session older than REAUTHENTICATE_AFTER is ended and the person signs in
+# again (email code or passkey), coming back to the passkeys page after.
+module PasskeyReauthentication
+  extend ActiveSupport::Concern
+
+  REAUTHENTICATE_AFTER = 30.minutes
+
+  private
+
+  def require_recent_sign_in
+    return if Current.session.created_at.after?(REAUTHENTICATE_AFTER.ago)
+
+    terminate_session
+    session[:return_to_after_authenticating] = passkeys_url
+    flash[:alert] = t("flash.passkeys.reauthenticate")
+
+    respond_to do |format|
+      format.html { redirect_to new_session_path }
+      format.json { render json: {redirect_url: new_session_url}, status: :unauthorized }
+    end
+  end
+end

data/test/tmp/app/controllers/passkey_challenges_controller.rb

@@ -0,0 +1,24 @@
+class PasskeyChallengesController < ApplicationController
+  include PasskeyChallenge
+  include PasskeyReauthentication
+
+  before_action :require_recent_sign_in
+
+  # POST /passkey_challenge
+  #
+  # Options for navigator.credentials.create(). A discoverable credential
+  # (resident key) is what makes it a passkey: the device keeps the account,
+  # so sign-in needs no email. The user's existing passkeys are excluded so the
+  # same authenticator is not registered twice.
+  def create
+    user = Current.user
+    options = WebAuthn::Credential.options_for_create(
+      user: {id: user.webauthn_id, name: user.email_address, display_name: user.name.presence || user.email_address},
+      exclude: user.passkeys.pluck(:credential_id),
+      authenticator_selection: {resident_key: "required", user_verification: "required"}
+    )
+    store_passkey_challenge(:registration, options.challenge)
+
+    render json: options
+  end
+end

data/test/tmp/app/controllers/passkeys_controller.rb

@@ -0,0 +1,68 @@
+class PasskeysController < ApplicationController
+  include PasskeyChallenge
+  include PasskeyReauthentication
+
+  before_action :require_recent_sign_in, only: %i[create destroy]
+  before_action :set_passkey, only: %i[update destroy]
+
+  # GET /passkeys
+  def index
+    @passkeys = Current.user.passkeys.order(:created_at)
+  end
+
+  # POST /passkeys
+  def create
+    challenge = take_passkey_challenge(:registration)
+    return render_failure(t("flash.passkeys.challenge_expired")) unless challenge
+
+    credential = WebAuthn::Credential.from_create(passkey_credential_params)
+    # Checks the challenge, the origin, the relying party and that the person
+    # was verified on the device, not just present.
+    credential.verify(challenge, user_verification: true)
+
+    aaguid = credential.response.authenticator_data.aaguid
+    Current.user.passkeys.create!(
+      credential_id: credential.id,
+      public_key: credential.public_key,
+      sign_count: credential.sign_count,
+      transports: credential.response.transports,
+      aaguid: aaguid,
+      backup_eligible: credential.backup_eligible?,
+      backed_up: credential.backed_up?,
+      name: Passkey.default_name(aaguid)
+    )
+
+    Rails.logger.info "[AUTH] Passkey added for #{Current.user.email_address} from #{request.remote_ip}"
+    flash[:notice] = t("flash.passkeys.created")
+    render json: {redirect_url: passkeys_url}, status: :created
+  rescue WebAuthn::Error, ActiveRecord::RecordInvalid => error
+    Rails.logger.info "[AUTH] Passkey registration failed (#{error.class.name.demodulize}) for #{Current.user.email_address}"
+    render_failure(t("flash.passkeys.registration_failed"))
+  end
+
+  # PATCH /passkeys/:id
+  def update
+    if @passkey.update(params.expect(passkey: [:name]))
+      redirect_to passkeys_path, notice: t("flash.passkeys.updated"), status: :see_other
+    else
+      redirect_to passkeys_path, alert: @passkey.errors.full_messages.to_sentence, status: :see_other
+    end
+  end
+
+  # DELETE /passkeys/:id
+  def destroy
+    @passkey.destroy
+    Rails.logger.info "[AUTH] Passkey removed for #{Current.user.email_address} from #{request.remote_ip}"
+    redirect_to passkeys_path, notice: t("flash.passkeys.destroyed"), status: :see_other
+  end
+
+  private
+
+  def set_passkey
+    @passkey = Current.user.passkeys.find(params[:id])
+  end
+
+  def render_failure(message)
+    render json: {error: message}, status: :unprocessable_entity
+  end
+end

data/test/tmp/app/controllers/session/passkey_challenges_controller.rb

@@ -0,0 +1,18 @@
+class Session::PasskeyChallengesController < ApplicationController
+  include PasskeyChallenge
+
+  allow_unauthenticated_access
+
+  # POST /session/passkey_challenge
+  #
+  # Options for navigator.credentials.get(). No allowCredentials: the browser
+  # offers every passkey it holds for this site, so nobody types an email and
+  # the response says nothing about which accounts exist. It is a POST so a
+  # Turbo-cached page never reuses a challenge.
+  def create
+    options = WebAuthn::Credential.options_for_get(user_verification: "required")
+    store_passkey_challenge(:authentication, options.challenge)
+
+    render json: options
+  end
+end

data/test/tmp/app/controllers/session/passkeys_controller.rb

@@ -0,0 +1,55 @@
+class Session::PasskeysController < ApplicationController
+  include PasskeyChallenge
+
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { render json: {error: t("flash.general.rate_limited")}, status: :too_many_requests }
+
+  # POST /session/passkey
+  def create
+    challenge = take_passkey_challenge(:authentication)
+    return render_failure(t("flash.passkeys.challenge_expired")) unless challenge
+
+    credential = WebAuthn::Credential.from_get(passkey_credential_params)
+    passkey = Passkey.includes(:user).find_by(credential_id: credential.id)
+
+    # Deleted here but still saved on the device: the browser can be told to
+    # forget it (PublicKeyCredential.signalUnknownCredential).
+    unless passkey
+      Rails.logger.info "[AUTH] Passkey sign-in with an unknown credential from #{request.remote_ip}"
+      render json: {error: t("flash.passkeys.unknown"), credential_id: credential.id, rp_id: WebAuthn.configuration.rp_id},
+        status: :not_found
+      return
+    end
+
+    user = passkey.user
+    if user.blocked? || credential.user_handle != user.webauthn_id
+      Rails.logger.info "[AUTH] Passkey sign-in refused for #{user.email_address} from #{request.remote_ip}"
+      return render_failure(t("flash.passkeys.failed"))
+    end
+
+    # Checks the challenge, the origin, the signature with the stored public
+    # key, user verification (Face ID, fingerprint, device PIN) and that the
+    # signature counter moved forward.
+    credential.verify(challenge, public_key: passkey.public_key, sign_count: passkey.sign_count, user_verification: true)
+    passkey.record_use!(credential.sign_count)
+
+    Rails.logger.info "[AUTH] Successful passkey login for #{user.email_address} from #{request.remote_ip}"
+    start_new_session_for(user)
+    flash[:notice] = t("flash.sessions.create.success")
+    render json: {redirect_url: after_authentication_url}
+  rescue WebAuthn::SignCountVerificationError
+    # A valid signature with a counter that went backwards: possibly a cloned
+    # authenticator. Synced passkeys always report 0 and never land here.
+    Rails.logger.warn "[AUTH] Passkey sign count went backwards for #{passkey.user.email_address} from #{request.remote_ip}"
+    render_failure(t("flash.passkeys.failed"))
+  rescue WebAuthn::Error => error
+    Rails.logger.info "[AUTH] Passkey sign-in failed (#{error.class.name.demodulize}) from #{request.remote_ip}"
+    render_failure(t("flash.passkeys.failed"))
+  end
+
+  private
+
+  def render_failure(message)
+    render json: {error: message}, status: :unprocessable_entity
+  end
+end

data/test/tmp/app/javascript/controllers/passkey_registration_controller.js

@@ -0,0 +1,109 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Passkey registration and upkeep (maquina:passkeys).
+//
+// The button creates a passkey with the browser's own JSON helpers. On
+// connect the page tells the passkey provider which passkeys this account
+// still has and how it is named, so one removed here disappears from the
+// device's list too. Both signals are skipped where unsupported.
+//
+// The button is rendered visible and only hidden where passkeys are not
+// supported. A Turbo morph puts the server's attributes back without
+// reconnecting this controller, so the view calls refresh on turbo:morph.
+export default class extends Controller {
+  static targets = ["button", "error", "unsupported"]
+  static values = {
+    challengeUrl: String,
+    url: String,
+    errorMessage: String,
+    duplicateMessage: String,
+    rpId: String,
+    userId: String,
+    userName: String,
+    displayName: String,
+    credentialIds: Array
+  }
+
+  connect() {
+    this.refresh()
+    if (supported()) this.#signalAccountState()
+  }
+
+  refresh() {
+    this.buttonTarget.hidden = !supported()
+    this.unsupportedTarget.hidden = supported()
+  }
+
+  async register() {
+    this.buttonTarget.disabled = true
+    this.#showError(null)
+
+    try {
+      const options = await post(this.challengeUrlValue)
+      // Sign in again first: a full load, so the new session gets a fresh page.
+      if (options.body.redirect_url) return window.location.assign(options.body.redirect_url)
+      if (!options.ok) return this.#showError(options.body.error)
+
+      let credential
+      try {
+        credential = await navigator.credentials.create({
+          publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options.body)
+        })
+      } catch (error) {
+        // Cancelled, or this device already holds a passkey for the account.
+        if (error.name === "NotAllowedError") return
+        if (error.name === "InvalidStateError") return this.#showError(this.duplicateMessageValue)
+        return this.#showError()
+      }
+
+      const result = await post(this.urlValue, { credential: credential.toJSON() })
+      if (result.body.redirect_url) return visit(result.body.redirect_url)
+      this.#showError(result.body.error)
+    } finally {
+      this.buttonTarget.disabled = false
+    }
+  }
+
+  #signalAccountState() {
+    const { rpIdValue: rpId, userIdValue: userId } = this
+
+    PublicKeyCredential.signalAllAcceptedCredentials?.({
+      rpId, userId, allAcceptedCredentialIds: this.credentialIdsValue
+    }).catch(() => {})
+    PublicKeyCredential.signalCurrentUserDetails?.({
+      rpId, userId, name: this.userNameValue, displayName: this.displayNameValue
+    }).catch(() => {})
+  }
+
+  #showError(message = this.errorMessageValue) {
+    this.errorTarget.textContent = message || ""
+    this.errorTarget.hidden = !message
+  }
+}
+
+// JSON POST with the CSRF token; a network failure reads as an empty error.
+async function post(url, body) {
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-CSRF-Token": document.querySelector("meta[name=csrf-token]")?.content
+      },
+      body: body && JSON.stringify(body)
+    })
+    return { ok: response.ok, status: response.status, body: await response.json().catch(() => ({})) }
+  } catch {
+    return { ok: false, status: 0, body: {} }
+  }
+}
+
+function visit(url) {
+  window.Turbo ? window.Turbo.visit(url) : window.location.assign(url)
+}
+
+function supported() {
+  return typeof PublicKeyCredential !== "undefined" &&
+    typeof PublicKeyCredential.parseCreationOptionsFromJSON === "function"
+}

data/test/tmp/app/javascript/controllers/passkey_sign_in_controller.js

@@ -0,0 +1,113 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Passkey sign-in (maquina:passkeys).
+//
+// On connect it starts a conditional request: the browser offers saved
+// passkeys in the email field's autofill (autocomplete="username webauthn").
+// The button starts a modal request instead. Both use the browser's own JSON
+// helpers, so no WebAuthn library is needed. Cancelling the prompt is a
+// normal outcome, not an error.
+//
+// The block is rendered visible and only hidden where passkeys are not
+// supported; the view calls refresh on turbo:morph, which puts the server's
+// attributes back without reconnecting this controller. A successful sign-in
+// loads the next page in full, so it starts with the new session's CSRF token
+// and no Turbo snapshot of the signed-out page.
+export default class extends Controller {
+  static targets = ["button", "error"]
+  static values = { challengeUrl: String, url: String, errorMessage: String }
+
+  connect() {
+    this.refresh()
+    if (supported()) this.#autofill()
+  }
+
+  refresh() {
+    this.element.hidden = !supported()
+  }
+
+  disconnect() {
+    this.#abort()
+  }
+
+  async signIn() {
+    this.buttonTarget.disabled = true
+    try {
+      await this.#authenticate()
+    } finally {
+      this.buttonTarget.disabled = false
+    }
+  }
+
+  async #autofill() {
+    if (!(await PublicKeyCredential.isConditionalMediationAvailable?.())) return
+
+    await this.#authenticate("conditional")
+  }
+
+  async #authenticate(mediation) {
+    this.#abort()
+    const abortController = this.abortController = new AbortController()
+    if (!mediation) this.#showError(null)
+
+    let credential
+    try {
+      const options = await post(this.challengeUrlValue)
+      if (!options.ok) return this.#showError(options.body.error)
+
+      credential = await navigator.credentials.get({
+        publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options.body),
+        signal: abortController.signal,
+        ...(mediation && { mediation })
+      })
+    } catch (error) {
+      if (abortController.signal.aborted) return
+      if (error.name !== "NotAllowedError") return this.#showError()
+      // The modal prompt was cancelled: offer passkeys in autofill again.
+      if (!mediation) this.#autofill()
+      return
+    }
+
+    const result = await post(this.urlValue, { credential: credential.toJSON() })
+    if (result.body.redirect_url) return window.location.assign(result.body.redirect_url)
+
+    if (result.status === 404 && result.body.credential_id) {
+      // Deleted on the server: ask the passkey provider to drop it too.
+      PublicKeyCredential.signalUnknownCredential?.({ rpId: result.body.rp_id, credentialId: result.body.credential_id })
+    }
+    this.#showError(result.body.error)
+    this.#autofill()
+  }
+
+  #abort() {
+    this.abortController?.abort()
+  }
+
+  #showError(message = this.errorMessageValue) {
+    this.errorTarget.textContent = message || ""
+    this.errorTarget.hidden = !message
+  }
+}
+
+// JSON POST with the CSRF token; a network failure reads as an empty error.
+async function post(url, body) {
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-CSRF-Token": document.querySelector("meta[name=csrf-token]")?.content
+      },
+      body: body && JSON.stringify(body)
+    })
+    return { ok: response.ok, status: response.status, body: await response.json().catch(() => ({})) }
+  } catch {
+    return { ok: false, status: 0, body: {} }
+  }
+}
+
+function supported() {
+  return typeof PublicKeyCredential !== "undefined" &&
+    typeof PublicKeyCredential.parseRequestOptionsFromJSON === "function"
+}

data/test/tmp/app/models/email_verification.rb

@@ -1,58 +1,2 @@
 class EmailVerification < ApplicationRecord
-  VERIFICATION_TYPES = %w[signup login].freeze
-  COOLDOWN_MINUTES = 15
-  MAX_ATTEMPTS = 5
-
-  validates :email, presence: true, format: {with: URI::MailTo::EMAIL_REGEXP}
-  validates :code, presence: true
-  validates :verification_type, presence: true, inclusion: {in: VERIFICATION_TYPES}
-  validates :expires_at, presence: true
-
-  normalizes :email, with: ->(email) { email.strip.downcase }
-  normalizes :code, with: ->(code) { code.strip.upcase }
-
-  # Encrypted at rest, not digested: the mail goes out through deliver_later,
-  # whose job reloads this row by GlobalID and must read the code back.
-  encrypts :code
-
-  scope :pending, -> { where(verified_at: nil) }
-  scope :expired, -> { where("expires_at < ?", Time.current) }
-  scope :active, -> { pending.where("expires_at >= ?", Time.current) }
-  scope :for_email, ->(email) { where("LOWER(email) = ?", email.to_s.downcase) }
-  scope :recent, -> { pending.where("created_at > ?", COOLDOWN_MINUTES.minutes.ago) }
-
-  def expired?
-    expires_at < Time.current
-  end
-
-  # A code is single-use against a bounded number of guesses: once the wrong-code
-  # count hits the ceiling the record is dead regardless of how many IPs an
-  # attacker rotates through, since each code only ever maps to one row.
-  def locked?
-    attempts >= MAX_ATTEMPTS
-  end
-
-  # Constant-time, so response timing reveals nothing about how close a guess
-  # came. Normalized the same way the stored code is.
-  def code_matches?(candidate)
-    ActiveSupport::SecurityUtils.secure_compare(code, candidate.to_s.strip.upcase)
-  end
-
-  def verified?
-    verified_at.present?
-  end
-
-  def can_resend?
-    created_at <= COOLDOWN_MINUTES.minutes.ago
-  end
-
-  def minutes_until_resend
-    return 0 if can_resend?
-
-    ((created_at + COOLDOWN_MINUTES.minutes - Time.current) / 60).ceil
-  end
-
-  def mark_verified!
-    update!(verified_at: Time.current)
-  end
 end