maquina-generators 0.8.0 → 0.8.1

data/test/tmp/app/models/passkey.rb

@@ -0,0 +1,36 @@
+# A WebAuthn credential that signs its owner in (generated by maquina:passkeys).
+#
+# Only the public key is stored; the private key never leaves the device or
+# the password manager, so a leaked table cannot be used to sign in.
+class Passkey < ApplicationRecord
+  # AAGUIDs of common passkey providers, to give a new passkey a useful
+  # default name. Providers that send no AAGUID fall back to "Passkey".
+  PROVIDERS = {
+    "fbfc3007-154e-4ecc-8c0b-6e020557d7bd" => "iCloud Keychain",
+    "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4" => "Google Password Manager",
+    "adce0002-35bc-c60a-648b-0b25f1f05503" => "Chrome on Mac",
+    "08987058-cadc-4b81-b6e1-30de50dcbe96" => "Windows Hello",
+    "bada5566-a7aa-401f-bd96-45619a55120d" => "1Password",
+    "d548826e-79b4-db40-a3d8-11116f7e8349" => "Bitwarden"
+  }.freeze
+
+  belongs_to :user
+
+  validates :credential_id, presence: true, uniqueness: true
+  validates :public_key, presence: true
+  validates :name, presence: true, length: {maximum: 100}
+
+  def self.default_name(aaguid)
+    PROVIDERS.fetch(aaguid, "Passkey")
+  end
+
+  def record_use!(sign_count)
+    update!(sign_count: sign_count, last_used_at: Time.current)
+  end
+
+  # Synced through a provider (iCloud Keychain, Google Password Manager, a
+  # password manager) rather than bound to one device.
+  def synced?
+    backed_up?
+  end
+end

data/test/tmp/app/models/user.rb

@@ -1,6 +1,7 @@
 class User < ApplicationRecord
   belongs_to :account
   has_many :sessions, dependent: :destroy
+  has_many :passkeys, dependent: :destroy
 
   enum :role, {member: "member", admin: "admin"}, default: "member"
 
@@ -25,6 +26,15 @@ class User < ApplicationRecord
     update!(blocked_at: nil, blocked_reason: nil)
   end
 
+  # The WebAuthn user handle: random and stable, never the id or the email,
+  # since authenticators store it and hand it back on every sign-in.
+  def webauthn_id
+    super || begin
+      update_column(:webauthn_id, WebAuthn.generate_user_id)
+      super
+    end
+  end
+
   private
 
   def email_cannot_contain_plus

data/test/tmp/app/views/passkeys/index.html.erb

@@ -0,0 +1,77 @@
+<div class="flex flex-1 justify-center px-4 py-8">
+  <div class="w-full max-w-2xl space-y-6"
+       data-controller="passkey-registration"
+       data-action="turbo:morph@document->passkey-registration#refresh"
+       data-passkey-registration-challenge-url-value="<%= passkey_challenge_path %>"
+       data-passkey-registration-url-value="<%= passkeys_path %>"
+       data-passkey-registration-error-message-value="<%= t(".error") %>"
+       data-passkey-registration-duplicate-message-value="<%= t(".duplicate") %>"
+       data-passkey-registration-rp-id-value="<%= WebAuthn.configuration.rp_id %>"
+       data-passkey-registration-user-id-value="<%= Current.user.webauthn_id %>"
+       data-passkey-registration-user-name-value="<%= Current.user.email_address %>"
+       data-passkey-registration-display-name-value="<%= Current.user.name.presence || Current.user.email_address %>"
+       data-passkey-registration-credential-ids-value="<%= @passkeys.map(&:credential_id).to_json %>">
+    <div class="flex flex-wrap items-start justify-between gap-4">
+      <div>
+        <h1 class="text-2xl font-bold text-foreground"><%= t(".title") %></h1>
+        <p class="mt-1 text-sm text-muted-foreground"><%= t(".description") %></p>
+      </div>
+
+      <button type="button"
+              data-action="passkey-registration#register"
+              data-passkey-registration-target="button"
+              data-component="button"
+              data-variant="primary"
+              class="px-4 py-2 text-sm font-medium text-primary-foreground bg-primary hover:bg-primary/90 rounded-lg transition-colors cursor-pointer disabled:opacity-50">
+        <%= t(".add") %>
+      </button>
+    </div>
+
+    <p data-passkey-registration-target="error" class="text-sm text-destructive" role="alert" hidden></p>
+    <p data-passkey-registration-target="unsupported" class="text-sm text-muted-foreground" hidden><%= t(".unsupported") %></p>
+
+    <% if @passkeys.empty? %>
+      <div class="bg-card rounded-xl border border-border p-8 text-center">
+        <p class="text-sm text-muted-foreground"><%= t(".empty") %></p>
+      </div>
+    <% else %>
+      <ul class="bg-card rounded-xl border border-border divide-y divide-border">
+        <% @passkeys.each do |passkey| %>
+          <li id="<%= dom_id(passkey) %>" class="flex flex-wrap items-center gap-4 p-4">
+            <%= form_with model: passkey, class: "flex flex-1 items-center gap-2 min-w-0" do |form| %>
+              <%= form.text_field :name, required: true, maxlength: 100,
+                    aria: { label: Passkey.human_attribute_name(:name) },
+                    data: { component: "input" },
+                    class: "min-w-0 flex-1 px-3 py-2 text-sm border border-input rounded-lg focus:ring-2 focus:ring-ring focus:border-ring" %>
+              <%= form.submit t(".rename"), data: { component: "button", variant: "ghost" },
+                    class: "px-3 py-2 text-sm font-medium text-foreground hover:bg-accent rounded-lg cursor-pointer" %>
+            <% end %>
+
+            <div class="text-xs text-muted-foreground space-y-1">
+              <p>
+                <%= t(".created", date: l(passkey.created_at.to_date, format: :long)) %>
+                <% if passkey.synced? %>
+                  · <span data-component="badge" class="font-medium"><%= t(".synced") %></span>
+                <% end %>
+              </p>
+              <p>
+                <%= passkey.last_used_at ? t(".last_used", time: time_ago_in_words(passkey.last_used_at)) : t(".never_used") %>
+              </p>
+            </div>
+
+            <%= button_to t(".remove"), passkey_path(passkey), method: :delete,
+                  form: { data: { turbo_confirm: t(".remove_confirm") } },
+                  data: { component: "button", variant: "ghost" },
+                  class: "px-3 py-2 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg cursor-pointer" %>
+          </li>
+        <% end %>
+      </ul>
+
+      <% if @passkeys.one? && !@passkeys.first.synced? %>
+        <p class="text-sm text-muted-foreground"><%= t(".add_another") %></p>
+      <% end %>
+    <% end %>
+
+    <p class="text-sm text-muted-foreground"><%= t(".fallback") %></p>
+  </div>
+</div>

data/test/tmp/app/views/sessions/_passkey.html.erb

@@ -0,0 +1,23 @@
+<div data-controller="passkey-sign-in"
+     data-action="turbo:morph@document->passkey-sign-in#refresh"
+     data-passkey-sign-in-challenge-url-value="<%= session_passkey_challenge_path %>"
+     data-passkey-sign-in-url-value="<%= session_passkey_path %>"
+     data-passkey-sign-in-error-message-value="<%= t("sessions.passkey.error") %>"
+     class="mt-6 space-y-4">
+  <div class="flex items-center gap-3 text-sm text-muted-foreground">
+    <span class="h-px flex-1 bg-border"></span>
+    <%= t("sessions.passkey.or") %>
+    <span class="h-px flex-1 bg-border"></span>
+  </div>
+
+  <button type="button"
+          data-action="passkey-sign-in#signIn"
+          data-passkey-sign-in-target="button"
+          data-component="button"
+          data-variant="outline"
+          class="w-full px-4 py-3 text-base font-medium text-foreground bg-background border border-input hover:bg-accent rounded-lg transition-colors cursor-pointer disabled:opacity-50">
+    <%= t("sessions.passkey.sign_in") %>
+  </button>
+
+  <p data-passkey-sign-in-target="error" class="text-sm text-destructive text-center" role="alert" hidden></p>
+</div>

data/test/tmp/app/views/sessions/new.html.erb

@@ -0,0 +1,37 @@
+<div class="flex flex-1 items-center justify-center px-4 py-8">
+  <div class="w-full max-w-md">
+    <div class="bg-card rounded-xl shadow-sm border border-border p-8">
+      <h1 class="text-2xl font-bold text-foreground text-center mb-8">
+        <%= t(".title") %>
+      </h1>
+
+      <%= form_with url: session_path, method: :post, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :email_address, t(".email"), class: "block text-sm font-medium text-foreground mb-2", data: { component: "label" } %>
+          <%= form.email_field :email_address,
+                               required: true,
+                               autofocus: true,
+                               autocomplete: "username webauthn",
+                               placeholder: t(".email_placeholder"),
+                               value: params[:email_address],
+                               data: { component: "input" },
+                               class: "w-full px-4 py-3 border border-input rounded-lg focus:ring-2 focus:ring-ring focus:border-ring transition-colors" %>
+        </div>
+
+        <p class="text-sm text-muted-foreground">
+          <%= t(".email_instructions") %>
+        </p>
+
+        <p class="text-sm text-muted-foreground">
+          <%= t(".spam_note") %>
+        </p>
+
+        <div>
+          <%= form.submit t(".submit"), data: { component: "button", variant: "primary" }, class: "w-full px-4 py-3 text-base font-medium text-primary-foreground bg-primary hover:bg-primary/90 rounded-lg transition-colors cursor-pointer" %>
+        </div>
+      <% end %>
+
+      <%= render "sessions/passkey" %>
+    </div>
+  </div>
+</div>

data/test/tmp/config/initializers/rack_attack.rb

@@ -0,0 +1,9 @@
+class Rack::Attack
+end
+
+# Passkey sign-in (maquina:passkeys): the challenge and the assertion,
+# counted like the email-code login above. Keyed on the address Rails
+# resolves through trusted proxies, not the proxy hop in req.ip.
+Rack::Attack.throttle("passkey/ip", limit: 20, period: 1.minute) do |req|
+  (req.env["action_dispatch.remote_ip"]&.to_s || req.ip) if req.path.start_with?("/session/passkey") && req.post?
+end

data/test/tmp/config/initializers/webauthn.rb

@@ -0,0 +1,23 @@
+# Passkeys (maquina:passkeys)
+#
+# A passkey is bound to its relying party: rp_id is the domain it belongs to,
+# and the browser only offers it on pages from allowed_origins. rp_id can be
+# a parent of the origins' host (example.com for https://app.example.com),
+# never another domain. Changing rp_id later orphans every saved passkey.
+#
+# Development and test use localhost; production reads WEBAUTHN_RP_ID and
+# WEBAUTHN_ORIGINS (comma-separated), or webauthn: {rp_id:, origins:} in the
+# credentials.
+webauthn = Rails.application.credentials.webauthn || {}
+
+WebAuthn.configure do |config|
+  config.rp_name = ENV.fetch("WEBAUTHN_RP_NAME") { Rails.application.class.module_parent_name.titleize }
+  config.rp_id = ENV["WEBAUTHN_RP_ID"] || webauthn[:rp_id] || "localhost"
+  config.allowed_origins = Array(ENV["WEBAUTHN_ORIGINS"]&.split(",") || webauthn[:origins] || "http://localhost:3000")
+end
+
+# A production app still on localhost would accept no passkey at all. The
+# asset build runs in production without the real settings, so it is spared.
+if Rails.env.production? && WebAuthn.configuration.rp_id == "localhost" && ENV["SECRET_KEY_BASE_DUMMY"].blank?
+  raise "Passkeys: set WEBAUTHN_RP_ID and WEBAUTHN_ORIGINS (see config/initializers/webauthn.rb)"
+end

data/test/tmp/config/locales/passkeys.en.yml

@@ -0,0 +1,46 @@
+en:
+  flash:
+    passkeys:
+      created: "Passkey added. You can now sign in with it."
+      updated: "Passkey renamed."
+      destroyed: "Passkey removed."
+      failed: "We couldn't sign you in with that passkey. Try again or use your email."
+      unknown: "That passkey is no longer linked to an account. Sign in with your email instead."
+      challenge_expired: "The request expired. Please try again."
+      registration_failed: "We couldn't add that passkey. Please try again."
+      reauthenticate: "Sign in again to manage your passkeys."
+
+  sessions:
+    passkey:
+      or: "or"
+      sign_in: "Sign in with a passkey"
+      error: "Something went wrong with the passkey. Please try again."
+
+  passkeys:
+    index:
+      title: "Passkeys"
+      description: "Sign in with Face ID, a fingerprint or your device PIN instead of an email code."
+      add: "Add a passkey"
+      empty: "You don't have any passkeys yet."
+      rename: "Save"
+      remove: "Remove"
+      remove_confirm: "Remove this passkey? You won't be able to sign in with it anymore."
+      created: "Added %{date}"
+      synced: "Synced"
+      last_used: "Last used %{time} ago"
+      never_used: "Not used yet"
+      add_another: "This passkey lives on one device. Add another so you can still sign in if you lose it."
+      fallback: "You can always sign in with a code sent to your email."
+      unsupported: "This browser doesn't support passkeys."
+      error: "Something went wrong with the passkey. Please try again."
+      duplicate: "This device already has a passkey for your account."
+
+  activerecord:
+    models:
+      passkey:
+        one: "Passkey"
+        other: "Passkeys"
+    attributes:
+      passkey:
+        name: "Name"
+        last_used_at: "Last used"

data/test/tmp/config/locales/passkeys.es.yml

@@ -0,0 +1,46 @@
+es:
+  flash:
+    passkeys:
+      created: "Llave de acceso agregada. Ya puedes iniciar sesión con ella."
+      updated: "Llave de acceso renombrada."
+      destroyed: "Llave de acceso eliminada."
+      failed: "No pudimos iniciar tu sesión con esa llave de acceso. Inténtalo de nuevo o usa tu correo."
+      unknown: "Esa llave de acceso ya no está vinculada a una cuenta. Inicia sesión con tu correo."
+      challenge_expired: "La solicitud expiró. Inténtalo de nuevo."
+      registration_failed: "No pudimos agregar esa llave de acceso. Inténtalo de nuevo."
+      reauthenticate: "Inicia sesión de nuevo para administrar tus llaves de acceso."
+
+  sessions:
+    passkey:
+      or: "o"
+      sign_in: "Iniciar sesión con llave de acceso"
+      error: "Algo salió mal con la llave de acceso. Inténtalo de nuevo."
+
+  passkeys:
+    index:
+      title: "Llaves de acceso"
+      description: "Inicia sesión con Face ID, tu huella o el PIN de tu dispositivo en lugar de un código por correo."
+      add: "Agregar llave de acceso"
+      empty: "Todavía no tienes llaves de acceso."
+      rename: "Guardar"
+      remove: "Eliminar"
+      remove_confirm: "¿Eliminar esta llave de acceso? Ya no podrás iniciar sesión con ella."
+      created: "Agregada el %{date}"
+      synced: "Sincronizada"
+      last_used: "Usada hace %{time}"
+      never_used: "Sin usar"
+      add_another: "Esta llave de acceso vive en un solo dispositivo. Agrega otra para no perder el acceso si lo pierdes."
+      fallback: "Siempre puedes iniciar sesión con un código enviado a tu correo."
+      unsupported: "Este navegador no es compatible con llaves de acceso."
+      error: "Algo salió mal con la llave de acceso. Inténtalo de nuevo."
+      duplicate: "Este dispositivo ya tiene una llave de acceso para tu cuenta."
+
+  activerecord:
+    models:
+      passkey:
+        one: "Llave de acceso"
+        other: "Llaves de acceso"
+    attributes:
+      passkey:
+        name: "Nombre"
+        last_used_at: "Último uso"

data/test/tmp/config/routes.rb

@@ -1,12 +1,9 @@
 Rails.application.routes.draw do
-  # Authentication routes (generated by maquina:clave)
-  resource :session, only: [:new, :create, :destroy] do
-    resource :verification, only: [:new, :create], controller: "session/verifications"
-    resource :verification_resend, only: [:create], controller: "session/verification_resends"
-  end
-
-  resource :registration, only: [:new, :create] do
-    resource :verification, only: [:new, :create], controller: "registration/verifications"
-    resource :verification_resend, only: [:create], controller: "registration/verification_resends"
+  # Passkeys (generated by maquina:passkeys)
+  resource :session, only: [] do
+    resource :passkey_challenge, only: :create, controller: "session/passkey_challenges"
+    resource :passkey, only: :create, controller: "session/passkeys"
   end
+  resource :passkey_challenge, only: :create
+  resources :passkeys, only: [:index, :create, :update, :destroy]
 end

data/test/tmp/db/migrate/20261014213621_add_webauthn_id_to_users.rb

@@ -0,0 +1,6 @@
+class AddWebauthnIdToUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :users, :webauthn_id, :string
+    add_index :users, :webauthn_id, unique: true
+  end
+end

data/test/tmp/db/migrate/20261014213622_create_passkeys.rb

@@ -0,0 +1,20 @@
+class CreatePasskeys < ActiveRecord::Migration[8.1]
+  def change
+    create_table :passkeys do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :credential_id, null: false
+      t.text :public_key, null: false
+      t.bigint :sign_count, null: false, default: 0
+      t.string :name, null: false
+      t.json :transports
+      t.string :aaguid, limit: 36
+      t.boolean :backup_eligible, null: false, default: false
+      t.boolean :backed_up, null: false, default: false
+      t.datetime :last_used_at
+
+      t.timestamps
+    end
+
+    add_index :passkeys, :credential_id, unique: true
+  end
+end

data/test/tmp/test/integration/passkeys_test.rb

@@ -0,0 +1,99 @@
+require "test_helper"
+require_relative "../test_helpers/session_test_helper"
+
+# The passkey flow end to end (generated by maquina:passkeys), with
+# WebAuthn::FakeClient as the browser and the authenticator.
+class PasskeysTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = User.create!(account: Account.create!(name: "Acme"), email_address: "passkey@example.com")
+  end
+
+  test "adds a passkey and signs in with it" do
+    sign_in_as @user
+    register_passkey
+    assert_response :created
+    passkey = @user.passkeys.sole
+
+    sign_out
+    sign_in_with_passkey(@user)
+
+    assert_response :success
+    assert response.parsed_body["redirect_url"].present?
+    assert cookies["session_id"].present?
+    assert passkey.reload.last_used_at
+  end
+
+  test "a challenge signs in once" do
+    sign_in_as @user
+    register_passkey
+    sign_out
+
+    post session_passkey_challenge_path, as: :json
+    assertion = webauthn_client.get(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: true, user_handle: Base64.urlsafe_decode64(@user.reload.webauthn_id))
+    post session_passkey_path, params: {credential: assertion}, as: :json
+    assert_response :success
+
+    post session_passkey_path, params: {credential: assertion}, as: :json
+    assert_response :unprocessable_entity
+  end
+
+  test "a passkey needs user verification" do
+    sign_in_as @user
+    post passkey_challenge_path, as: :json
+    credential = webauthn_client.create(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: false)
+
+    post passkeys_path, params: {credential: credential}, as: :json
+
+    assert_response :unprocessable_entity
+    assert_empty @user.passkeys
+  end
+
+  test "a removed passkey no longer signs in" do
+    sign_in_as @user
+    register_passkey
+    @user.passkeys.destroy_all
+    sign_out
+
+    sign_in_with_passkey(@user)
+
+    assert_response :not_found
+    assert response.parsed_body["credential_id"].present?
+  end
+
+  test "a blocked user cannot sign in with a passkey" do
+    sign_in_as @user
+    register_passkey
+    sign_out
+    @user.block!
+
+    sign_in_with_passkey(@user)
+
+    assert_response :unprocessable_entity
+  end
+
+  test "adding a passkey needs a recent sign-in" do
+    sign_in_as @user
+    Current.session.update_column(:created_at, 2.hours.ago)
+
+    post passkey_challenge_path, as: :json
+
+    assert_response :unauthorized
+    assert_equal new_session_url, response.parsed_body["redirect_url"]
+  end
+
+  test "renames and removes a passkey" do
+    sign_in_as @user
+    register_passkey
+    passkey = @user.passkeys.sole
+
+    patch passkey_path(passkey), params: {passkey: {name: "Work laptop"}}
+    assert_redirected_to passkeys_path
+    assert_equal "Work laptop", passkey.reload.name
+
+    delete passkey_path(passkey)
+    assert_redirected_to passkeys_path
+    assert_empty @user.passkeys.reload
+  end
+end

data/test/tmp/test/test_helper.rb

@@ -0,0 +1,4 @@
+ENV["RAILS_ENV"] ||= "test"
+require_relative "../config/environment"
+require "rails/test_help"
+require_relative "test_helpers/webauthn_test_helper"

data/test/tmp/test/test_helpers/webauthn_test_helper.rb

@@ -0,0 +1,38 @@
+# Passkeys in integration tests (generated by maquina:passkeys).
+#
+# WebAuthn::FakeClient plays the browser and the authenticator, so tests go
+# through the real endpoints: register_passkey needs a signed-in user
+# (sign_in_as), sign_in_with_passkey needs a passkey the same client made.
+#
+#   sign_in_as users(:one)
+#   register_passkey
+#   sign_out
+#   sign_in_with_passkey(users(:one))
+#   assert_response :success
+require "webauthn/fake_client"
+
+module WebauthnTestHelper
+  def webauthn_client
+    @webauthn_client ||= WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
+  end
+
+  def register_passkey(client: webauthn_client)
+    post passkey_challenge_path, as: :json
+    credential = client.create(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: true)
+
+    post passkeys_path, params: {credential: credential}, as: :json
+  end
+
+  def sign_in_with_passkey(user, client: webauthn_client)
+    post session_passkey_challenge_path, as: :json
+    assertion = client.get(challenge: response.parsed_body["challenge"], rp_id: WebAuthn.configuration.rp_id,
+      user_verified: true, user_handle: Base64.urlsafe_decode64(user.reload.webauthn_id))
+
+    post session_passkey_path, params: {credential: assertion}, as: :json
+  end
+end
+
+ActiveSupport.on_load(:action_dispatch_integration_test) do
+  include WebauthnTestHelper
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: maquina-generators
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - Mario Alberto Chavez
@@ -291,30 +291,31 @@ files:
 - test/generators/maquina/solid_queue_generator_test.rb
 - test/test_helper.rb
 - test/tmp/Gemfile
-- test/tmp/app/controllers/application_controller.rb
 - test/tmp/app/controllers/concerns/authentication.rb
-- test/tmp/app/controllers/registration/verification_resends_controller.rb
-- test/tmp/app/controllers/registration/verifications_controller.rb
-- test/tmp/app/controllers/registrations_controller.rb
-- test/tmp/app/controllers/session/verification_resends_controller.rb
-- test/tmp/app/controllers/session/verifications_controller.rb
-- test/tmp/app/controllers/sessions_controller.rb
-- test/tmp/app/helpers/authentication_helper.rb
-- test/tmp/app/jobs/authentication_cleanup_job.rb
-- test/tmp/app/mailers/verification_mailer.rb
-- test/tmp/app/models/account.rb
-- test/tmp/app/models/current.rb
+- test/tmp/app/controllers/concerns/passkey_challenge.rb
+- test/tmp/app/controllers/concerns/passkey_reauthentication.rb
+- test/tmp/app/controllers/passkey_challenges_controller.rb
+- test/tmp/app/controllers/passkeys_controller.rb
+- test/tmp/app/controllers/session/passkey_challenges_controller.rb
+- test/tmp/app/controllers/session/passkeys_controller.rb
+- test/tmp/app/javascript/controllers/passkey_registration_controller.js
+- test/tmp/app/javascript/controllers/passkey_sign_in_controller.js
 - test/tmp/app/models/email_verification.rb
-- test/tmp/app/models/session.rb
+- test/tmp/app/models/passkey.rb
 - test/tmp/app/models/user.rb
-- test/tmp/config/locales/clave.en.yml
-- test/tmp/config/locales/clave.es.yml
+- test/tmp/app/views/passkeys/index.html.erb
+- test/tmp/app/views/sessions/_passkey.html.erb
+- test/tmp/app/views/sessions/new.html.erb
+- test/tmp/config/initializers/rack_attack.rb
+- test/tmp/config/initializers/webauthn.rb
+- test/tmp/config/locales/passkeys.en.yml
+- test/tmp/config/locales/passkeys.es.yml
 - test/tmp/config/routes.rb
-- test/tmp/db/migrate/20261014212613_create_accounts.rb
-- test/tmp/db/migrate/20261014212614_create_users.rb
-- test/tmp/db/migrate/20261014212615_create_sessions.rb
-- test/tmp/db/migrate/20261014212616_create_email_verifications.rb
-- test/tmp/test/test_helpers/session_test_helper.rb
+- test/tmp/db/migrate/20261014213621_add_webauthn_id_to_users.rb
+- test/tmp/db/migrate/20261014213622_create_passkeys.rb
+- test/tmp/test/integration/passkeys_test.rb
+- test/tmp/test/test_helper.rb
+- test/tmp/test/test_helpers/webauthn_test_helper.rb
 homepage: https://maquina.app
 licenses:
 - MIT

data/test/tmp/app/controllers/application_controller.rb

@@ -1,3 +0,0 @@
-class ApplicationController < ActionController::Base
-  include Authentication
-end

data/test/tmp/app/controllers/registration/verification_resends_controller.rb

@@ -1,38 +0,0 @@
-class Registration::VerificationResendsController < ApplicationController
-  allow_unauthenticated_access
-  rate_limit to: 5, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_verification_path, alert: t("flash.general.rate_limited") }
-
-  # POST /registration/verification_resend
-  def create
-    old_verification = EmailVerification.find_by(id: session[:pending_verification_id])
-
-    unless old_verification
-      redirect_to new_registration_path
-      return
-    end
-
-    email = old_verification.email
-
-    if EmailVerification.for_email(email).recent.exists?
-      recent = EmailVerification.for_email(email).recent.first
-      redirect_to new_registration_verification_path,
-        alert: t("flash.registrations.cooldown", minutes: recent.minutes_until_resend)
-      return
-    end
-
-    verification = EmailVerification.create!(
-      email: email,
-      code: SecureRandom.hex(3).upcase,
-      verification_type: "signup",
-      locale: old_verification.locale || I18n.locale.to_s,
-      expires_at: 15.minutes.from_now
-    )
-
-    Rails.logger.info "[AUTH] Verification code resent for registration #{email} from #{request.remote_ip}"
-    VerificationMailer.verification_code(verification).deliver_later
-    session[:pending_verification_id] = verification.id
-
-    redirect_to new_registration_verification_path,
-      notice: t("flash.registrations.code_resent")
-  end
-end