maquina-generators 0.8.1 → 0.9.0

data/test/tmp/app/models/email_verification.rb

@@ -1,2 +1,58 @@
 class EmailVerification < ApplicationRecord
+  VERIFICATION_TYPES = %w[signup login].freeze
+  COOLDOWN_MINUTES = 15
+  MAX_ATTEMPTS = 5
+
+  validates :email, presence: true, format: {with: URI::MailTo::EMAIL_REGEXP}
+  validates :code, presence: true
+  validates :verification_type, presence: true, inclusion: {in: VERIFICATION_TYPES}
+  validates :expires_at, presence: true
+
+  normalizes :email, with: ->(email) { email.strip.downcase }
+  normalizes :code, with: ->(code) { code.strip.upcase }
+
+  # Encrypted at rest, not digested: the mail goes out through deliver_later,
+  # whose job reloads this row by GlobalID and must read the code back.
+  encrypts :code
+
+  scope :pending, -> { where(verified_at: nil) }
+  scope :expired, -> { where("expires_at < ?", Time.current) }
+  scope :active, -> { pending.where("expires_at >= ?", Time.current) }
+  scope :for_email, ->(email) { where("LOWER(email) = ?", email.to_s.downcase) }
+  scope :recent, -> { pending.where("created_at > ?", COOLDOWN_MINUTES.minutes.ago) }
+
+  def expired?
+    expires_at < Time.current
+  end
+
+  # A code is single-use against a bounded number of guesses: once the wrong-code
+  # count hits the ceiling the record is dead regardless of how many IPs an
+  # attacker rotates through, since each code only ever maps to one row.
+  def locked?
+    attempts >= MAX_ATTEMPTS
+  end
+
+  # Constant-time, so response timing reveals nothing about how close a guess
+  # came. Normalized the same way the stored code is.
+  def code_matches?(candidate)
+    ActiveSupport::SecurityUtils.secure_compare(code, candidate.to_s.strip.upcase)
+  end
+
+  def verified?
+    verified_at.present?
+  end
+
+  def can_resend?
+    created_at <= COOLDOWN_MINUTES.minutes.ago
+  end
+
+  def minutes_until_resend
+    return 0 if can_resend?
+
+    ((created_at + COOLDOWN_MINUTES.minutes - Time.current) / 60).ceil
+  end
+
+  def mark_verified!
+    update!(verified_at: Time.current)
+  end
 end

data/test/tmp/app/models/session.rb

@@ -0,0 +1,18 @@
+class Session < ApplicationRecord
+  belongs_to :user
+
+  scope :active, -> { where("expires_at > ? OR expires_at IS NULL", Time.current) }
+  scope :expired, -> { where("expires_at <= ? AND expires_at IS NOT NULL", Time.current) }
+
+  def self.cleanup_expired!
+    expired.delete_all
+  end
+
+  def expired?
+    expires_at.present? && expires_at < Time.current
+  end
+
+  def active?
+    !expired?
+  end
+end

data/test/tmp/app/models/user.rb

@@ -1,7 +1,6 @@
 class User < ApplicationRecord
   belongs_to :account
   has_many :sessions, dependent: :destroy
-  has_many :passkeys, dependent: :destroy
 
   enum :role, {member: "member", admin: "admin"}, default: "member"
 
@@ -26,15 +25,6 @@ class User < ApplicationRecord
     update!(blocked_at: nil, blocked_reason: nil)
   end
 
-  # The WebAuthn user handle: random and stable, never the id or the email,
-  # since authenticators store it and hand it back on every sign-in.
-  def webauthn_id
-    super || begin
-      update_column(:webauthn_id, WebAuthn.generate_user_id)
-      super
-    end
-  end
-
   private
 
   def email_cannot_contain_plus

data/test/tmp/app/views/registration/verifications/new.html.erb

@@ -0,0 +1,43 @@
+<div class="flex flex-1 items-center justify-center px-4 py-8">
+  <div class="w-full max-w-md">
+    <div class="bg-card rounded-xl shadow-sm border border-border p-8">
+      <h1 class="text-2xl font-bold text-foreground text-center mb-4">
+        <%= t(".title") %>
+      </h1>
+
+      <p class="text-center text-muted-foreground mb-8">
+        <%= t(".sent_to", email: mask_email(@email)) %>
+      </p>
+
+      <%= form_with url: registration_verification_path, method: :post, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :code, t(".enter_code"), class: "block text-sm font-medium text-foreground mb-2 text-center", data: { component: "label" } %>
+          <%= form.text_field :code,
+                              required: true,
+                              autofocus: true,
+                              maxlength: 6,
+                              autocomplete: "one-time-code",
+                              inputmode: "text",
+                              placeholder: "ABC123",
+                              data: { component: "input" },
+                              class: "w-full px-4 py-4 text-center text-2xl font-mono tracking-widest uppercase border border-input rounded-lg focus:ring-2 focus:ring-ring focus:border-ring transition-colors" %>
+        </div>
+
+        <p class="text-sm text-muted-foreground text-center">
+          <%= t(".check_spam") %>
+        </p>
+
+        <div>
+          <%= form.submit t(".submit"), data: { component: "button", variant: "primary" }, class: "w-full px-4 py-3 text-base font-medium text-primary-foreground bg-primary hover:bg-primary/90 rounded-lg transition-colors cursor-pointer" %>
+        </div>
+      <% end %>
+
+      <div class="mt-6 text-center">
+        <p class="text-sm text-muted-foreground mb-2">
+          <%= t(".didnt_receive") %>
+        </p>
+        <%= button_to t(".resend"), registration_verification_resend_path, method: :post, class: "text-sm font-medium text-primary hover:text-primary/80" %>
+      </div>
+    </div>
+  </div>
+</div>

data/test/tmp/app/views/registrations/new.html.erb

@@ -0,0 +1,39 @@
+<div class="flex flex-1 items-center justify-center px-4 py-8">
+  <div class="w-full max-w-md">
+    <div class="bg-card rounded-xl shadow-sm border border-border p-8">
+      <h1 class="text-2xl font-bold text-foreground text-center mb-8">
+        <%= t(".title") %>
+      </h1>
+
+      <%= form_with url: registration_path, method: :post, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :email_address, t(".email"), class: "block text-sm font-medium text-foreground mb-2", data: { component: "label" } %>
+          <%= form.email_field :email_address,
+                               required: true,
+                               autofocus: true,
+                               autocomplete: "email",
+                               placeholder: t(".email_placeholder"),
+                               data: { component: "input" },
+                               class: "w-full px-4 py-3 border border-input rounded-lg focus:ring-2 focus:ring-ring focus:border-ring transition-colors" %>
+        </div>
+
+        <p class="text-sm text-muted-foreground">
+          <%= t(".email_instructions") %>
+        </p>
+
+        <p class="text-sm text-muted-foreground">
+          <%= t(".spam_note") %>
+        </p>
+
+        <div>
+          <%= form.submit t(".submit"), data: { component: "button", variant: "primary" }, class: "w-full px-4 py-3 text-base font-medium text-primary-foreground bg-primary hover:bg-primary/90 rounded-lg transition-colors cursor-pointer" %>
+        </div>
+      <% end %>
+
+      <p class="mt-6 text-center text-sm text-muted-foreground">
+        <%= t(".have_account") %>
+        <%= link_to t(".sign_in"), new_session_path, class: "font-medium text-primary hover:text-primary/80" %>
+      </p>
+    </div>
+  </div>
+</div>

data/test/tmp/app/views/session/verifications/new.html.erb

@@ -0,0 +1,43 @@
+<div class="flex flex-1 items-center justify-center px-4 py-8">
+  <div class="w-full max-w-md">
+    <div class="bg-card rounded-xl shadow-sm border border-border p-8">
+      <h1 class="text-2xl font-bold text-foreground text-center mb-4">
+        <%= t(".title") %>
+      </h1>
+
+      <p class="text-center text-muted-foreground mb-8">
+        <%= t(".sent_to", email: mask_email(@email)) %>
+      </p>
+
+      <%= form_with url: session_verification_path, method: :post, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :code, t(".enter_code"), class: "block text-sm font-medium text-foreground mb-2 text-center", data: { component: "label" } %>
+          <%= form.text_field :code,
+                              required: true,
+                              autofocus: true,
+                              maxlength: 6,
+                              autocomplete: "one-time-code",
+                              inputmode: "text",
+                              placeholder: "ABC123",
+                              data: { component: "input" },
+                              class: "w-full px-4 py-4 text-center text-2xl font-mono tracking-widest uppercase border border-input rounded-lg focus:ring-2 focus:ring-ring focus:border-ring transition-colors" %>
+        </div>
+
+        <p class="text-sm text-muted-foreground text-center">
+          <%= t(".check_spam") %>
+        </p>
+
+        <div>
+          <%= form.submit t(".submit"), data: { component: "button", variant: "primary" }, class: "w-full px-4 py-3 text-base font-medium text-primary-foreground bg-primary hover:bg-primary/90 rounded-lg transition-colors cursor-pointer" %>
+        </div>
+      <% end %>
+
+      <div class="mt-6 text-center">
+        <p class="text-sm text-muted-foreground mb-2">
+          <%= t(".didnt_receive") %>
+        </p>
+        <%= button_to t(".resend"), session_verification_resend_path, method: :post, class: "text-sm font-medium text-primary hover:text-primary/80" %>
+      </div>
+    </div>
+  </div>
+</div>

data/test/tmp/app/views/sessions/new.html.erb

@@ -11,7 +11,7 @@
           <%= form.email_field :email_address,
                                required: true,
                                autofocus: true,
-                               autocomplete: "username webauthn",
+                               autocomplete: "email",
                                placeholder: t(".email_placeholder"),
                                value: params[:email_address],
                                data: { component: "input" },
@@ -31,7 +31,10 @@
         </div>
       <% end %>
 
-      <%= render "sessions/passkey" %>
+      <p class="mt-6 text-center text-sm text-muted-foreground">
+        <%= t(".no_account") %>
+        <%= link_to t(".sign_up"), new_registration_path, class: "font-medium text-primary hover:text-primary/80" %>
+      </p>
     </div>
   </div>
 </div>

data/test/tmp/app/views/verification_mailer/verification_code.html.erb

@@ -0,0 +1,37 @@
+<div style="max-width: 600px; margin: 0 auto; padding: 40px 20px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;">
+  <div style="background-color: #ffffff; border-radius: 8px; padding: 40px; box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);">
+    <!-- Logo -->
+    <div style="text-align: center; margin-bottom: 32px;">
+      <span style="font-size: 28px; font-weight: 700; color: #ff2058;"><%= Rails.application.class.module_parent_name %></span>
+    </div>
+
+    <!-- Title -->
+    <h1 style="text-align: center; font-size: 24px; font-weight: 600; color: #0a0a0a; margin-bottom: 24px;">
+      <%= t("verification_mailer.verification_code.title") %>
+    </h1>
+
+    <!-- Instructions -->
+    <p style="text-align: center; font-size: 16px; color: #737373; margin-bottom: 32px;">
+      <%= t("verification_mailer.verification_code.instructions") %>
+    </p>
+
+    <!-- Code Display -->
+    <div style="background-color: #f5f5f5; border-radius: 8px; padding: 24px; text-align: center; margin-bottom: 32px;">
+      <span style="font-family: 'Courier New', Courier, monospace; font-size: 36px; font-weight: 700; letter-spacing: 8px; color: #0a0a0a;">
+        <%= @verification.code %>
+      </span>
+    </div>
+
+    <!-- Expiry Note -->
+    <p style="text-align: center; font-size: 14px; color: #737373; margin-bottom: 32px;">
+      <%= t("verification_mailer.verification_code.expires_in") %>
+    </p>
+
+    <!-- Ignore Note -->
+    <div style="border-top: 1px solid #e5e5e5; padding-top: 24px;">
+      <p style="text-align: center; font-size: 13px; color: #737373;">
+        <%= t("verification_mailer.verification_code.ignore_if_not_you") %>
+      </p>
+    </div>
+  </div>
+</div>

data/test/tmp/app/views/verification_mailer/verification_code.text.erb

@@ -0,0 +1,11 @@
+<%= t("verification_mailer.verification_code.title") %>
+
+<%= t("verification_mailer.verification_code.instructions") %>
+
+<%= @verification.code %>
+
+<%= t("verification_mailer.verification_code.expires_in") %>
+
+---
+
+<%= t("verification_mailer.verification_code.ignore_if_not_you") %>

data/test/tmp/config/locales/clave.en.yml

@@ -0,0 +1,102 @@
+en:
+  flash:
+    sessions:
+      create:
+        success: "You have signed in successfully."
+      destroy:
+        success: "You have signed out successfully."
+      code_sent: "We sent you a verification code."
+      invalid_code: "The code is incorrect. Please try again."
+      code_expired: "The code has expired. Request a new one."
+      code_locked: "Too many incorrect tries. Request a new code to keep going."
+      code_resent: "We sent you a new code."
+      cooldown: "You must wait %{minutes} minutes before requesting another code."
+      code_already_sent: "We already sent you a code. Check your email (including spam). You can request a new one in %{minutes} minutes."
+    registrations:
+      create:
+        success: "Your account has been created. Welcome!"
+      code_sent: "We sent a verification code to your email."
+      email_plus_not_allowed: "Email addresses with '+' are not allowed. Use your main email without aliases."
+      email_taken: "An account with this email already exists. Would you like to sign in?"
+      invalid_code: "The code is incorrect. Please try again."
+      code_expired: "The code has expired. Request a new one."
+      code_locked: "Too many incorrect tries. Request a new code to keep going."
+      code_resent: "We sent you a new code."
+      cooldown: "You must wait %{minutes} minutes before requesting another code."
+      code_already_sent: "We already sent you a code. Check your email (including spam). You can request a new one in %{minutes} minutes."
+    general:
+      unauthorized: "You must sign in to access this page."
+      forbidden: "You are not authorized to perform this action."
+      not_found: "The resource you're looking for doesn't exist."
+      rate_limited: "Too many attempts. Please wait a few minutes and try again."
+
+  sessions:
+    new:
+      title: "Sign in"
+      email: "Email address"
+      email_placeholder: "you@example.com"
+      email_instructions: "Enter your email and we'll send you a 6-digit code."
+      spam_note: "Check your spam folder if you don't receive the email."
+      submit: "Send code"
+      no_account: "Don't have an account?"
+      sign_up: "Sign up"
+
+  session:
+    verifications:
+      new:
+        title: "Verify your identity"
+        sent_to: "If you have an account, we sent a code to %{email}"
+        enter_code: "Enter the code"
+        submit: "Sign in"
+        check_spam: "Check your spam folder."
+        didnt_receive: "Didn't receive the code?"
+        resend: "Resend code"
+
+  registrations:
+    new:
+      title: "Create account"
+      email: "Email address"
+      email_placeholder: "you@example.com"
+      email_instructions: "Enter your email address. We'll send you a 6-digit code to verify your account."
+      spam_note: "Check your spam folder if you don't receive the email."
+      submit: "Send code"
+      have_account: "Already have an account?"
+      sign_in: "Sign in"
+
+  registration:
+    verifications:
+      new:
+        title: "Verify your email"
+        sent_to: "We sent a 6-digit code to %{email}"
+        enter_code: "Enter the code"
+        submit: "Verify"
+        check_spam: "Check your spam folder if you don't receive it."
+        didnt_receive: "Didn't receive the code?"
+        resend: "Resend code"
+
+  verification_mailer:
+    verification_code:
+      subject: "Your verification code"
+      title: "Verification code"
+      instructions: "Enter this code to continue:"
+      expires_in: "This code expires in 15 minutes."
+      ignore_if_not_you: "If you didn't request this code, you can ignore this email."
+
+  activerecord:
+    models:
+      user:
+        one: "User"
+        other: "Users"
+    attributes:
+      user:
+        email_address: "Email address"
+        name: "Name"
+        locale: "Language"
+        blocked_at: "Blocked at"
+        blocked_reason: "Blocked reason"
+    errors:
+      models:
+        user:
+          attributes:
+            email_address:
+              plus_not_allowed: "Email addresses with '+' are not allowed. Please use your main email without aliases."

data/test/tmp/config/locales/clave.es.yml

@@ -0,0 +1,102 @@
+es:
+  flash:
+    sessions:
+      create:
+        success: "Has iniciado sesion correctamente."
+      destroy:
+        success: "Has cerrado sesion correctamente."
+      code_sent: "Te enviamos un codigo de verificacion."
+      invalid_code: "El codigo es incorrecto. Por favor, intenta de nuevo."
+      code_expired: "El codigo ha expirado. Solicita uno nuevo."
+      code_locked: "Demasiados intentos incorrectos. Solicita un codigo nuevo para continuar."
+      code_resent: "Te enviamos un nuevo codigo."
+      cooldown: "Debes esperar %{minutes} minutos antes de solicitar otro codigo."
+      code_already_sent: "Ya te enviamos un codigo. Revisa tu correo (incluyendo spam). Podras solicitar uno nuevo en %{minutes} minutos."
+    registrations:
+      create:
+        success: "Tu cuenta ha sido creada. Bienvenido!"
+      code_sent: "Te enviamos un codigo de verificacion a tu correo."
+      email_plus_not_allowed: "No se permiten correos con '+'. Usa tu direccion principal sin alias."
+      email_taken: "Ya existe una cuenta con este correo. Quieres iniciar sesion?"
+      invalid_code: "El codigo es incorrecto. Por favor, intenta de nuevo."
+      code_expired: "El codigo ha expirado. Solicita uno nuevo."
+      code_locked: "Demasiados intentos incorrectos. Solicita un codigo nuevo para continuar."
+      code_resent: "Te enviamos un nuevo codigo."
+      cooldown: "Debes esperar %{minutes} minutos antes de solicitar otro codigo."
+      code_already_sent: "Ya te enviamos un codigo. Revisa tu correo (incluyendo spam). Podras solicitar uno nuevo en %{minutes} minutos."
+    general:
+      unauthorized: "Debes iniciar sesion para acceder a esta pagina."
+      forbidden: "No tienes permiso para realizar esta accion."
+      not_found: "El recurso que buscas no existe."
+      rate_limited: "Demasiados intentos. Por favor, espera unos minutos e intenta de nuevo."
+
+  sessions:
+    new:
+      title: "Iniciar sesion"
+      email: "Correo electronico"
+      email_placeholder: "tu@correo.com"
+      email_instructions: "Ingresa tu correo y te enviaremos un codigo de 6 digitos."
+      spam_note: "Revisa tu carpeta de spam si no recibes el correo."
+      submit: "Enviar codigo"
+      no_account: "No tienes cuenta?"
+      sign_up: "Registrate"
+
+  session:
+    verifications:
+      new:
+        title: "Verifica tu identidad"
+        sent_to: "Si tienes cuenta, enviamos un codigo a %{email}"
+        enter_code: "Ingresa el codigo"
+        submit: "Iniciar sesion"
+        check_spam: "Revisa tu carpeta de spam."
+        didnt_receive: "No recibiste el codigo?"
+        resend: "Reenviar codigo"
+
+  registrations:
+    new:
+      title: "Crear cuenta"
+      email: "Correo electronico"
+      email_placeholder: "tu@correo.com"
+      email_instructions: "Ingresa tu correo electronico. Te enviaremos un codigo de 6 digitos para verificar tu cuenta."
+      spam_note: "Revisa tu carpeta de spam si no recibes el correo."
+      submit: "Enviar codigo"
+      have_account: "Ya tienes cuenta?"
+      sign_in: "Inicia sesion"
+
+  registration:
+    verifications:
+      new:
+        title: "Verifica tu correo"
+        sent_to: "Enviamos un codigo de 6 digitos a %{email}"
+        enter_code: "Ingresa el codigo"
+        submit: "Verificar"
+        check_spam: "Revisa tu carpeta de spam si no lo recibes."
+        didnt_receive: "No recibiste el codigo?"
+        resend: "Reenviar codigo"
+
+  verification_mailer:
+    verification_code:
+      subject: "Tu codigo de verificacion"
+      title: "Codigo de verificacion"
+      instructions: "Ingresa este codigo para continuar:"
+      expires_in: "Este codigo expira en 15 minutos."
+      ignore_if_not_you: "Si no solicitaste este codigo, puedes ignorar este correo."
+
+  activerecord:
+    models:
+      user:
+        one: "Usuario"
+        other: "Usuarios"
+    attributes:
+      user:
+        email_address: "Correo electronico"
+        name: "Nombre"
+        locale: "Idioma"
+        blocked_at: "Bloqueado en"
+        blocked_reason: "Razon de bloqueo"
+    errors:
+      models:
+        user:
+          attributes:
+            email_address:
+              plus_not_allowed: "No se permiten direcciones con '+'. Por favor, usa tu correo principal sin alias."

data/test/tmp/config/routes.rb

@@ -1,9 +1,12 @@
 Rails.application.routes.draw do
-  # Passkeys (generated by maquina:passkeys)
-  resource :session, only: [] do
-    resource :passkey_challenge, only: :create, controller: "session/passkey_challenges"
-    resource :passkey, only: :create, controller: "session/passkeys"
+  # Authentication routes (generated by maquina:clave)
+  resource :session, only: [:new, :create, :destroy] do
+    resource :verification, only: [:new, :create], controller: "session/verifications"
+    resource :verification_resend, only: [:create], controller: "session/verification_resends"
+  end
+
+  resource :registration, only: [:new, :create] do
+    resource :verification, only: [:new, :create], controller: "registration/verifications"
+    resource :verification_resend, only: [:create], controller: "registration/verification_resends"
   end
-  resource :passkey_challenge, only: :create
-  resources :passkeys, only: [:index, :create, :update, :destroy]
 end

data/test/tmp/db/migrate/20261019191386_create_accounts.rb

@@ -0,0 +1,9 @@
+class CreateAccounts < ActiveRecord::Migration[8.1]
+  def change
+    create_table :accounts do |t|
+      t.string :name, null: false
+
+      t.timestamps
+    end
+  end
+end

data/test/tmp/db/migrate/20261019191387_create_users.rb

@@ -0,0 +1,17 @@
+class CreateUsers < ActiveRecord::Migration[8.1]
+  def change
+    create_table :users do |t|
+      t.references :account, null: false, foreign_key: true
+      t.string :email_address, null: false
+      t.string :name
+      t.string :role, null: false, default: "member"
+      t.string :locale
+      t.datetime :blocked_at
+      t.text :blocked_reason
+
+      t.timestamps
+    end
+
+    add_index :users, :email_address, unique: true
+  end
+end

data/test/tmp/db/migrate/20261019191388_create_sessions.rb

@@ -0,0 +1,12 @@
+class CreateSessions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :sessions do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :ip_address
+      t.string :user_agent
+      t.datetime :expires_at
+
+      t.timestamps
+    end
+  end
+end

data/test/tmp/db/migrate/20261019191389_create_email_verifications.rb

@@ -0,0 +1,17 @@
+class CreateEmailVerifications < ActiveRecord::Migration[8.1]
+  def change
+    create_table :email_verifications do |t|
+      t.string :email, null: false
+      t.string :code, null: false
+      t.string :verification_type, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :verified_at
+      t.integer :attempts, default: 0
+      t.string :locale
+
+      t.timestamps
+    end
+
+    add_index :email_verifications, [:email, :created_at]
+  end
+end

data/test/tmp/test/test_helpers/session_test_helper.rb

@@ -0,0 +1,19 @@
+module SessionTestHelper
+  def sign_in_as(user)
+    Current.session = user.sessions.create!
+
+    ActionDispatch::TestRequest.create.cookie_jar.tap do |cookie_jar|
+      cookie_jar.signed[:session_id] = Current.session.id
+      cookies["session_id"] = cookie_jar[:session_id]
+    end
+  end
+
+  def sign_out
+    Current.session&.destroy!
+    cookies.delete("session_id")
+  end
+end
+
+ActiveSupport.on_load(:action_dispatch_integration_test) do
+  include SessionTestHelper
+end