maquina-generators 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e7ab2221409345c84231d6908e18f5f14b265d32a10229f288f23d4c5a03006
-  data.tar.gz: b4966e9de4099d0664da18fd6ba2818b560770cdb2dab121a9f06265e38b4769
+  metadata.gz: 76d3dc4690cd7ff89b935e2289d7032084e426bda2e2f2998ed0aa81c0bb5fef
+  data.tar.gz: d983ec5b7183219b998a4447215808edf1d492c01cd344c957e9e9674036a3c7
 SHA512:
-  metadata.gz: f7b0d031778c2aa4b8cc03079e08f049a79d499500dfe0bb8b44b5e94e7743afdfc0ea6d0625d97b0128c937628980c9eb5317eef5bfe9ea62d68cd25f3e0487
-  data.tar.gz: 2ccfde4751e49534fb7c36149c623ea8fd93849a8e26e860fae0566556f2832173f8f488b708dca6e23f8890e8a6b4243571e61c6811723a325c1535f2a5dde5
+  metadata.gz: ea8c573e01d55f1504c0d1b647e805847f67c48042b13580cfec8e301b61151f6ebecb8f3c645a57d937168c48b33f72b1e4e8f35ced0c0bd3a5c36e79d105cd
+  data.tar.gz: 329c7a172d226fc0bca18c5cc807c869dd1a3937bb9e6d2f66d315c9ac0b41ef082e44159ae7e2c378cf97f8cfeada7d8cadd9a90afb8465aad0e087101a03b7

data/README.md

@@ -423,7 +423,7 @@ Watch the Security page while the policy is report-only, then set `content_secur
 9. Adds turbo morphing, `yield :head`, and simplifies `<main>` tag in layout
 10. Optionally installs authentication (`maquina:clave` or `maquina:registration`)
 11. Invokes sub-generators: `maquina:mission_control_jobs`, `maquina:solid_errors`
-12. Runs external installers: `solid_queue:install`, `solid_errors:install`, `solid_cache:install`, `solid_cable:install`, `maquina_components:install`, then `maquina:security` (which installs the `maquina:rack_attack` rules)
+12. Runs external installers: `solid_queue:install`, `solid_errors:install`, `solid_cache:install`, `solid_cable:install`, `maquina_components:install`, then `maquina:security` (which installs the `maquina:rack_attack` rules), and `maquina:passkeys` with `--passkeys`
 13. Restores custom layouts overwritten by gem installers
 14. Configures multi-database `database.yml` (primary, queue, cache, cable, errors, security)
 15. Creates a HomeController with root route
@@ -436,6 +436,7 @@ Watch the Security page while the policy is report-only, then set `content_secur
 rails g maquina:app
 rails g maquina:app --prefix /backstage --port 3100
 rails g maquina:app --auth registration
+rails g maquina:app --auth clave --passkeys
 ```
 
 #### Options
@@ -443,6 +444,7 @@ rails g maquina:app --auth registration
 - `--prefix` (default: `/admin`) -- Base path prefix for backstage tools (Solid Errors, Mission Control Jobs, Security)
 - `--port` (default: `3000`) -- Default port for the development server
 - `--auth` (default: `none`) -- Authentication type: `none`, `clave`, or `registration`
+- `--passkeys` (default: `false`) -- Adds passkey sign-in with `maquina:passkeys`. It needs `--auth clave` and refuses to run without it. The passkey origin follows `--port`, and the home page links to `/passkeys`.
 
 #### After running
 

data/Rakefile

@@ -4,7 +4,7 @@ require "rake/testtask"
 Rake::TestTask.new(:test) do |t|
   t.libs << "test"
   t.libs << "lib"
-  t.test_files = FileList["test/**/*_test.rb"]
+  t.test_files = FileList["test/**/*_test.rb"].exclude("test/tmp/**/*")
 end
 
 task default: :test

data/lib/generators/maquina/app/USAGE

@@ -9,3 +9,5 @@ Examples:
   rails g maquina:app
 
   rails g maquina:app --prefix /backstage --port 3100
+
+  rails g maquina:app --auth clave --passkeys

data/lib/generators/maquina/app/app_generator.rb

@@ -11,6 +11,15 @@ module Maquina
         desc: "Default port for development server"
       class_option :auth, type: :string, default: "none",
         desc: "Authentication type: none, clave, or registration"
+      class_option :passkeys, type: :boolean, default: false,
+        desc: "Add passkey sign-in on top of clave (requires --auth clave)"
+
+      # 0. Check options before touching anything
+      def check_options
+        return unless options[:passkeys] && options[:auth] != "clave"
+
+        raise Thor::Error, "--passkeys builds on clave. Run with `--auth clave --passkeys`."
+      end
 
       # 1. Add gems
       def add_gems
@@ -215,6 +224,24 @@ module Maquina
         generate "maquina:security", "--prefix", options[:prefix], "--quiet"
       end
 
+      # 12b. Install passkeys (after security, so its Rack::Attack throttle lands)
+      def install_passkeys
+        return unless options[:passkeys] && rails_app?
+
+        generate "maquina:passkeys", "--quiet"
+      end
+
+      # 12c. Point the passkey origin at the development port
+      def configure_passkeys_origin
+        return unless options[:passkeys] && options[:port] != "3000"
+
+        initializer = File.join(destination_root, "config/initializers/webauthn.rb")
+        return unless File.exist?(initializer)
+
+        gsub_file "config/initializers/webauthn.rb",
+          '"http://localhost:3000"', %("http://localhost:#{options[:port]}")
+      end
+
       # 13. Restore custom layouts overwritten by gem installers
       def restore_custom_layouts
         return unless rails_app?
@@ -339,6 +366,10 @@ module Maquina
           say "  - Visit /session/new to sign in"
           say "  - Visit /registrations/new to sign up" if options[:auth] == "registration"
           say "  - Visit /registration/new to sign up" if options[:auth] == "clave"
+          if options[:passkeys]
+            say "  - Visit /passkeys to add a passkey"
+            say "  - Production: set WEBAUTHN_RP_ID and WEBAUTHN_ORIGINS before the first passkey"
+          end
           say "  - Customize: app/controllers/concerns/authentication.rb"
           say "  - Locales: config/locales/"
         end

data/lib/generators/maquina/app/templates/README.md.erb

@@ -26,6 +26,9 @@ Your app will be running at **http://localhost:<%= options[:port] %>**.
 <% if options[:auth] != "none" -%>
 | **Authentication** | <%= options[:auth] == "clave" ? "Clave passwordless email-code authentication" : "Registration-based email/password authentication" %> |
 <% end -%>
+<% if options[:passkeys] -%>
+| **Passkeys** | Passkey sign-in with Face ID, a fingerprint or a device PIN; the email code stays as the way in without one |
+<% end -%>
 | **Background Jobs** | Solid Queue with Mission Control Jobs dashboard |
 | **Error Tracking** | Solid Errors with custom UI |
 | **Rate Limiting** | Rack::Attack with sensible defaults |
@@ -52,6 +55,9 @@ Your app will be running at **http://localhost:<%= options[:port] %>**.
 <% elsif options[:auth] == "clave" -%>
 | http://localhost:<%= options[:port] %>/registration/new | Sign up |
 <% end -%>
+<% if options[:passkeys] -%>
+| http://localhost:<%= options[:port] %>/passkeys | Passkeys |
+<% end -%>
 <% end -%>
 
 ## Scripts

data/lib/generators/maquina/app/templates/app/views/home/index.html.erb

@@ -15,6 +15,9 @@
         <p class="text-sm text-muted-foreground">
           Signed in as <span class="font-medium text-foreground"><%%= Current.user.email_address %></span>
         </p>
+<% if options[:passkeys] -%>
+        <%%= link_to "Passkeys", passkeys_path, data: { component: "button", variant: "outline", size: "sm" } %>
+<% end -%>
         <%%= button_to t(".sign_out", default: "Sign Out"), session_path, method: :delete, data: { component: "button", variant: "outline", size: "sm" } %>
       </div>
     <%% else %>

data/lib/maquina_generators/version.rb

@@ -1,3 +1,3 @@
 module MaquinaGenerators
-  VERSION = "0.8.1"
+  VERSION = "0.9.0"
 end

data/test/generators/maquina/app_generator_test.rb

@@ -364,6 +364,47 @@ class Maquina::Generators::AppGeneratorTest < Rails::Generators::TestCase
     assert_match(/registrations\/new/, output)
   end
 
+  test "passkeys need clave" do
+    %w[none registration].each do |auth|
+      error = assert_raises(Thor::Error) { run_generator ["--auth", auth, "--passkeys"], debug: true }
+      assert_match(/--auth clave --passkeys/, error.message)
+    end
+    assert_no_file "Procfile.dev"
+  end
+
+  test "passkeys show up in the home page, README and post-install" do
+    output = run_generator %w[--auth clave --passkeys]
+
+    assert_file "app/views/home/index.html.erb", /link_to "Passkeys", passkeys_path/
+    assert_file "README.md" do |content|
+      assert_match(/\*\*Passkeys\*\*/, content)
+      assert_match(%r{localhost:3000/passkeys \| Passkeys}, content)
+    end
+    assert_match(%r{Visit /passkeys to add a passkey}, output)
+    assert_match(/WEBAUTHN_RP_ID and WEBAUTHN_ORIGINS/, output)
+  end
+
+  test "without passkeys nothing mentions them" do
+    output = run_generator %w[--auth clave]
+
+    assert_file "app/views/home/index.html.erb" do |content|
+      assert_no_match(/passkeys_path/, content)
+    end
+    assert_file "README.md" do |content|
+      assert_no_match(/Passkeys/, content)
+    end
+    assert_no_match(/passkey/, output)
+  end
+
+  test "points the passkey origin at a custom development port" do
+    initializer = File.join(destination_root, "config/initializers/webauthn.rb")
+    File.write(initializer, %(config.allowed_origins = Array(ENV["WEBAUTHN_ORIGINS"]&.split(",") || "http://localhost:3000")\n))
+
+    run_generator %w[--auth clave --passkeys --port 3100]
+
+    assert_match(/"http:\/\/localhost:3100"\)\n\z/, File.read(initializer))
+  end
+
   test "injects database.yml restore into bin/setup" do
     write_bin_setup
 

data/test/tmp/Gemfile

@@ -1,3 +1,2 @@
 source "https://rubygems.org"
-
-gem "webauthn", "~> 3.4"
+# gem "bcrypt"

data/test/tmp/app/controllers/application_controller.rb

@@ -0,0 +1,3 @@
+class ApplicationController < ActionController::Base
+  include Authentication
+end

data/test/tmp/app/controllers/concerns/authentication.rb

@@ -1,2 +1,63 @@
 module Authentication
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_authentication
+    helper_method :authenticated?, :session_expires_at
+  end
+
+  class_methods do
+    def allow_unauthenticated_access(**options)
+      skip_before_action :require_authentication, **options
+    end
+  end
+
+  private
+
+  def authenticated?
+    resume_session
+  end
+
+  def require_authentication
+    resume_session || request_authentication
+  end
+
+  def resume_session
+    Current.session ||= find_session_by_cookie
+  end
+
+  def find_session_by_cookie
+    return nil unless cookies.signed[:session_id]
+
+    Session.active.find_by(id: cookies.signed[:session_id])
+  end
+
+  def request_authentication
+    session[:return_to_after_authenticating] = request.url
+    redirect_to new_session_path
+  end
+
+  def after_authentication_url
+    session.delete(:return_to_after_authenticating) || root_url
+  end
+
+  def start_new_session_for(user)
+    user.sessions.create!(
+      user_agent: request.user_agent,
+      ip_address: request.remote_ip,
+      expires_at: 30.days.from_now
+    ).tap do |session|
+      Current.session = session
+      cookies.signed.permanent[:session_id] = {value: session.id, httponly: true, same_site: :lax}
+    end
+  end
+
+  def terminate_session
+    Current.session.destroy
+    cookies.delete(:session_id)
+  end
+
+  def session_expires_at
+    Current.session&.expires_at
+  end
 end

data/test/tmp/app/controllers/registration/verification_resends_controller.rb

@@ -0,0 +1,38 @@
+class Registration::VerificationResendsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 5, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_verification_path, alert: t("flash.general.rate_limited") }
+
+  # POST /registration/verification_resend
+  def create
+    old_verification = EmailVerification.find_by(id: session[:pending_verification_id])
+
+    unless old_verification
+      redirect_to new_registration_path
+      return
+    end
+
+    email = old_verification.email
+
+    if EmailVerification.for_email(email).recent.exists?
+      recent = EmailVerification.for_email(email).recent.first
+      redirect_to new_registration_verification_path,
+        alert: t("flash.registrations.cooldown", minutes: recent.minutes_until_resend)
+      return
+    end
+
+    verification = EmailVerification.create!(
+      email: email,
+      code: SecureRandom.hex(3).upcase,
+      verification_type: "signup",
+      locale: old_verification.locale || I18n.locale.to_s,
+      expires_at: 15.minutes.from_now
+    )
+
+    Rails.logger.info "[AUTH] Verification code resent for registration #{email} from #{request.remote_ip}"
+    VerificationMailer.verification_code(verification).deliver_later
+    session[:pending_verification_id] = verification.id
+
+    redirect_to new_registration_verification_path,
+      notice: t("flash.registrations.code_resent")
+  end
+end

data/test/tmp/app/controllers/registration/verifications_controller.rb

@@ -0,0 +1,64 @@
+class Registration::VerificationsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_verification_path, alert: t("flash.general.rate_limited") }
+
+  # GET /registration/verification/new
+  def new
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_signup_email]
+    redirect_to new_registration_path unless @email
+  end
+
+  # POST /registration/verification
+  def create
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_signup_email]
+
+    unless @verification
+      flash.now[:alert] = t("flash.registrations.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    if @verification.expired?
+      flash.now[:alert] = t("flash.registrations.code_expired")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    # Too many wrong guesses: kill the code so a fresh one is required.
+    if @verification.locked?
+      @verification.update!(expires_at: Time.current)
+      Rails.logger.warn "[AUTH] Verification locked after #{@verification.attempts} attempts for #{@email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.registrations.code_locked")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    unless @verification.code_matches?(params[:code])
+      @verification.increment!(:attempts)
+      Rails.logger.warn "[AUTH] Invalid verification code attempt for #{@email} from #{request.remote_ip} (attempt #{@verification.attempts})"
+      flash.now[:alert] = t("flash.registrations.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    user = nil
+    ActiveRecord::Base.transaction do
+      account = Account.create!
+      user = account.users.create!(
+        email_address: @verification.email,
+        locale: @verification.locale || I18n.default_locale.to_s,
+        role: :admin
+      )
+    end
+
+    @verification.mark_verified!
+    session.delete(:pending_verification_id)
+    session.delete(:pending_signup_email)
+
+    Rails.logger.info "[AUTH] Successful registration for #{user.email_address} from #{request.remote_ip}"
+    start_new_session_for(user)
+    redirect_to root_path, notice: t("flash.registrations.create.success")
+  end
+end

data/test/tmp/app/controllers/registrations_controller.rb

@@ -0,0 +1,63 @@
+class RegistrationsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_registration_path, alert: t("flash.general.rate_limited") }
+
+  def new
+  end
+
+  def create
+    email = registration_params[:email_address]&.downcase&.strip
+
+    if email&.include?("+")
+      Rails.logger.warn "[AUTH] Registration attempted with + in email #{email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.registrations.email_plus_not_allowed")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    existing_user = User.find_by(email_address: email)
+
+    if existing_user
+      if existing_user.blocked?
+        # Fail silently - show same UI but don't send email
+        Rails.logger.info "[AUTH] Registration attempted for blocked user #{email} from #{request.remote_ip}"
+        session[:pending_signup_email] = email
+        redirect_to new_registration_verification_path
+      else
+        Rails.logger.info "[AUTH] Registration attempted for existing email #{email} from #{request.remote_ip}"
+        flash.now[:alert] = t("flash.registrations.email_taken")
+        render :new, status: :unprocessable_entity
+      end
+      return
+    end
+
+    recent_verification = EmailVerification.for_email(email).recent.first
+    if recent_verification
+      session[:pending_verification_id] = recent_verification.id
+      session[:pending_signup_email] = email
+      redirect_to new_registration_verification_path,
+        notice: t("flash.registrations.code_already_sent", minutes: recent_verification.minutes_until_resend)
+      return
+    end
+
+    verification = EmailVerification.create!(
+      email: email,
+      code: SecureRandom.hex(3).upcase,
+      verification_type: "signup",
+      locale: I18n.locale.to_s,
+      expires_at: 15.minutes.from_now
+    )
+
+    Rails.logger.info "[AUTH] Verification code sent for new registration #{email} from #{request.remote_ip}"
+    VerificationMailer.verification_code(verification).deliver_later
+    session[:pending_verification_id] = verification.id
+
+    redirect_to new_registration_verification_path
+  end
+
+  private
+
+  def registration_params
+    params.permit(:email_address)
+  end
+end

data/test/tmp/app/controllers/session/verification_resends_controller.rb

@@ -0,0 +1,44 @@
+class Session::VerificationResendsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 5, within: 3.minutes, only: :create, with: -> { redirect_to new_session_verification_path, alert: t("flash.general.rate_limited") }
+
+  # POST /session/verification_resend
+  def create
+    old_verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    email = old_verification&.email || session[:pending_login_email]
+
+    unless email
+      redirect_to new_session_path
+      return
+    end
+
+    if EmailVerification.for_email(email).recent.exists?
+      recent = EmailVerification.for_email(email).recent.first
+      redirect_to new_session_verification_path,
+        alert: t("flash.sessions.cooldown", minutes: recent.minutes_until_resend)
+      return
+    end
+
+    user = User.find_by(email_address: email)
+
+    if user && !user.blocked?
+      verification = EmailVerification.create!(
+        email: email,
+        code: SecureRandom.hex(3).upcase,
+        verification_type: "login",
+        locale: user.locale || I18n.default_locale.to_s,
+        expires_at: 15.minutes.from_now
+      )
+
+      Rails.logger.info "[AUTH] Verification code resent for login #{email} from #{request.remote_ip}"
+      VerificationMailer.verification_code(verification).deliver_later
+      session[:pending_verification_id] = verification.id
+    else
+      Rails.logger.info "[AUTH] Verification resend attempted for non-existent/blocked email #{email} from #{request.remote_ip}"
+    end
+
+    # Always show success (don't reveal if user exists)
+    redirect_to new_session_verification_path,
+      notice: t("flash.sessions.code_resent")
+  end
+end

data/test/tmp/app/controllers/session/verifications_controller.rb

@@ -0,0 +1,64 @@
+class Session::VerificationsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_verification_path, alert: t("flash.general.rate_limited") }
+
+  # GET /session/verification/new
+  def new
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_login_email]
+    redirect_to new_session_path unless @email
+  end
+
+  # POST /session/verification
+  def create
+    @verification = EmailVerification.find_by(id: session[:pending_verification_id])
+    @email = @verification&.email || session[:pending_login_email]
+
+    # Generic error if no verification (user doesn't exist or blocked)
+    unless @verification
+      flash.now[:alert] = t("flash.sessions.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    if @verification.expired?
+      flash.now[:alert] = t("flash.sessions.code_expired")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    # Too many wrong guesses: kill the code so a fresh one is required.
+    if @verification.locked?
+      @verification.update!(expires_at: Time.current)
+      Rails.logger.warn "[AUTH] Verification locked after #{@verification.attempts} attempts for #{@email} from #{request.remote_ip}"
+      flash.now[:alert] = t("flash.sessions.code_locked")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    unless @verification.code_matches?(params[:code])
+      @verification.increment!(:attempts)
+      Rails.logger.warn "[AUTH] Invalid verification code attempt for #{@email} from #{request.remote_ip} (attempt #{@verification.attempts})"
+      flash.now[:alert] = t("flash.sessions.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    user = User.find_by(email_address: @verification.email)
+
+    # Double-check user exists and not blocked
+    if user.nil? || user.blocked?
+      flash.now[:alert] = t("flash.sessions.invalid_code")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
+    @verification.mark_verified!
+    session.delete(:pending_verification_id)
+    session.delete(:pending_login_email)
+
+    Rails.logger.info "[AUTH] Successful login for #{user.email_address} from #{request.remote_ip}"
+    start_new_session_for(user)
+    redirect_to after_authentication_url, notice: t("flash.sessions.create.success")
+  end
+end

data/test/tmp/app/controllers/sessions_controller.rb

@@ -0,0 +1,56 @@
+class SessionsController < ApplicationController
+  allow_unauthenticated_access only: %i[new create]
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: t("flash.general.rate_limited") }
+
+  # GET /session/new
+  def new
+  end
+
+  # POST /session
+  def create
+    email = params[:email_address]&.downcase&.strip
+    user = User.find_by(email_address: email)
+
+    # Check cooldown regardless of user existence
+    recent_verification = EmailVerification.for_email(email).recent.first
+    if recent_verification
+      session[:pending_verification_id] = recent_verification.id
+      session[:pending_login_email] = email
+      redirect_to new_session_verification_path,
+        notice: t("flash.sessions.code_already_sent", minutes: recent_verification.minutes_until_resend)
+      return
+    end
+
+    if user && !user.blocked?
+      # User exists and not blocked - send verification
+      verification = EmailVerification.create!(
+        email: email,
+        code: SecureRandom.hex(3).upcase,
+        verification_type: "login",
+        locale: user.locale || I18n.default_locale.to_s,
+        expires_at: 15.minutes.from_now
+      )
+
+      Rails.logger.info "[AUTH] Verification code sent for login #{email} from #{request.remote_ip}"
+      VerificationMailer.verification_code(verification).deliver_later
+      session[:pending_verification_id] = verification.id
+    else
+      # No user OR blocked - don't send email, but show same UI
+      if user&.blocked?
+        Rails.logger.info "[AUTH] Login attempted for blocked user #{email} from #{request.remote_ip}"
+      else
+        Rails.logger.info "[AUTH] Login attempted for non-existent email #{email} from #{request.remote_ip}"
+      end
+      session[:pending_login_email] = email
+    end
+
+    redirect_to new_session_verification_path
+  end
+
+  # DELETE /session
+  def destroy
+    Rails.logger.info "[AUTH] Logout for user #{Current.session.user.email_address} from #{request.remote_ip}"
+    terminate_session
+    redirect_to new_session_path, notice: t("flash.sessions.destroy.success"), status: :see_other
+  end
+end

data/test/tmp/app/helpers/authentication_helper.rb

@@ -0,0 +1,20 @@
+module AuthenticationHelper
+  # Masks an email address for privacy display
+  # "mario@example.com" -> "ma***@example.com"
+  # "jo@example.com" -> "j*@example.com"
+  # "a@example.com" -> "a@example.com"
+  def mask_email(email)
+    return "" if email.blank?
+
+    local, domain = email.split("@")
+    return email if local.nil? || domain.nil?
+
+    masked_local = if local.length <= 2
+      local[0] + "*" * (local.length - 1)
+    else
+      local[0..1] + "*" * (local.length - 2)
+    end
+
+    "#{masked_local}@#{domain}"
+  end
+end

data/test/tmp/app/jobs/authentication_cleanup_job.rb

@@ -0,0 +1,13 @@
+class AuthenticationCleanupJob < ApplicationJob
+  queue_as :default
+
+  def perform
+    # Delete email verifications older than 24 hours
+    old_verifications_count = EmailVerification.where("created_at < ?", 24.hours.ago).delete_all
+    Rails.logger.info "AuthenticationCleanupJob: Deleted #{old_verifications_count} old email verifications"
+
+    # Delete expired sessions
+    expired_sessions_count = Session.cleanup_expired!
+    Rails.logger.info "AuthenticationCleanupJob: Deleted #{expired_sessions_count} expired sessions"
+  end
+end

data/test/tmp/app/mailers/verification_mailer.rb

@@ -0,0 +1,15 @@
+class VerificationMailer < ApplicationMailer
+  default from: "App <noreply@example.com>"
+
+  def verification_code(email_verification)
+    @verification = email_verification
+    locale = email_verification.locale || I18n.default_locale.to_s
+
+    I18n.with_locale(locale) do
+      mail(
+        to: email_verification.email,
+        subject: I18n.t("verification_mailer.verification_code.subject")
+      )
+    end
+  end
+end

data/test/tmp/app/models/account.rb

@@ -0,0 +1,5 @@
+class Account < ApplicationRecord
+  has_many :users, dependent: :destroy
+
+  validates :name, allow_blank: true, length: { maximum: 100 }
+end

data/test/tmp/app/models/current.rb

@@ -0,0 +1,5 @@
+class Current < ActiveSupport::CurrentAttributes
+  attribute :session
+  delegate :user, to: :session, allow_nil: true
+  delegate :account, to: :user, allow_nil: true
+end