nopassword 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8051bdffe33d49f7ced54bf1c25ea4d0c4c92f19f17aa33883e82863d2290535
+  data.tar.gz: 792216909882739608c8ef544ef7b13de5bcc6467cad9ef2ca62b35efef10d0e
+SHA512:
+  metadata.gz: bb7c8f299449f03f3c085b97310a387d3647e17a114a877d77340ca3ca55d2e66f61448319081314cee10c10f09abc1cb92b7f8c6e3ac27ead1b635df6912033
+  data.tar.gz: 175565727c2ae0b66cd236673f0635ce4df4fa5288750dbdde41c49ce6ad13252d471d107365552b43ff81411e710178ba944da7c3203d257701d6ea45acb91c

data/README.md

@@ -0,0 +1,164 @@
+# NoPassword
+
+[![Ruby](https://github.com/rocketshipio/nopassword/actions/workflows/ruby.yml/badge.svg)](https://github.com/rocketshipio/nopassword/actions/workflows/ruby.yml) [![Maintainability](https://api.codeclimate.com/v1/badges/1dab74df8828deddd5f3/maintainability)](https://codeclimate.com/github/rocketshipio/nopassword/maintainability)
+
+NoPassword is a toolkit that makes it easy to implement temporary, secure login codes initiated from peoples' web browsers so they can login via email, SMS, CLI, QR Codes, or any other side-channel. NoPassword also comes with a pre-built "Login with Email" flow so you can start using it right away in your Rails application.
+
+## Installation
+
+Add this line to your Rails application's Gemfile by executing:
+
+```bash
+$ bundle add nopassword
+```
+
+Next copy over the migrations, controllers, and views that you'll customize later:
+
+```bash
+$ bundle exec rails generate nopassword:install
+```
+
+Then run the migrations:
+
+```bash
+$ rake db:migrate
+```
+
+Finally, restart the development server and head to `http://localhost:3000/email_authentication/new`.
+
+## Usage
+
+Once NoPassword is installed, it can be customized directly from the controller and views that were installed. Start by openining the `app/controllers/email_authentications_controller.rb` file and you'll see code that looks like:
+
+```ruby
+class EmailAuthenticationsController < NoPassword::EmailAuthenticationsController
+    # Override with your own logic to do something with the valid data. For
+    # example, you might setup the current user session here via:
+    #
+    # ```
+    # def verification_succeeded(email)
+    #   self.current_user = User.find_or_create_by! email: email
+    #   redirect_to dashboard_url
+    # end
+    # ```
+    def verification_succeeded(email)
+      redirect_to root_url
+    end
+
+    # ...
+end
+```
+
+You'll want to customize this for your application. For example, if you already have an application that uses a library like `devise`, you could setup a login-by-email flow like this:
+
+```ruby
+class EmailAuthenticationsController < NoPassword::EmailAuthenticationsController
+    def verification_succeeded(email)
+      self.current_user = User.find_or_create_by! email: email
+      redirect_to root_url
+    end
+
+    # ...
+end
+```
+
+## Why bother?
+
+Passwords are a huge pain. How you ask?
+
+1. **People choose weak passwords** - Most people choose weak passwords that are easy to remember and type. In a stupid game of cat and mouse, the world has fought back with password complexity validations that drive people insane and make passwords really hard to remember.
+
+2. **People forget passwords** - When people forget their passwords they have to go through a whole reset process that sends people some sort of code via Email, SMS, or any other side-channel. Why not just authenticate this way?
+
+3. **Password fatigue** - People get tired of creating passwords for a website. Its a breath of fresh air when they can plugin an email address, get a code, and not have to manage yet another password.
+
+## Security
+
+It's paramount to understand how your authentication systems are working so you can assess whether or not the risks they present are worth it. NoPassword is no different; it makes certain trade-offs that you need to assess for your application.
+
+### How it works
+
+1. User requests a code by entering an email address. The email address is validated based on if its well-formed or not. No other validations take place.
+
+2. If the email address is well-formed, Rails generates a random 6 digit number and a salt. The 6 digit number is emailed to the end-user and the salt is persisted in the browser they're using to login to the application.
+
+3. Rails also encrypts the email address via a `NoPassword::Secret`, The combination of the code and the salt, provided by the user, is what's needed to unlock the secret.
+
+4. The user receives the email, views the code, and enters it into the open browser window.
+  1. If they enter the wrong code, the `remaining_attempts` field is decremented. If they exhaust all attempts, they have to request a new code and start the process over.
+  2. If the end-user waits until after the `expires_at` field to enter the, they have to request a new code and start the process over.
+  3. If the user enters the correct code within the alloted `remaining_attempts` and `expires_at`, the `data` from the `Secret` is decrypted and made available to your application.
+
+Worth noting; none of the steps above require a cookie to function properly.
+
+### Features
+
+NoPassword deploys the following features to mitigate brute force attacks:
+
+#### Limit the number of times a code can be entered
+
+NoPassword ships with `NoPassword::Secret#remaining_attempts`, which is decremented each time the user enters a code. When there's 0 remaining attempts, the secret is destroyed and the user has to request a new, uniquely generated code. By default, NoPassword gives end-users 3 attempts to try the code.
+
+#### A randomly generated salt must also be provided with the code
+
+The salt is hidden from the user by embedding it into the form payload that's posted back to the server with the code. This means an attack would have to somehow get this salt, in addition to the code, to successfully verify the secret.
+
+The salt is not emailed or distributed to the end-user: it is kept in the browser they're using to authenticate. If an attacker intercepted the code from the side-channel, they would also need access to the salt.
+
+#### Secrets expire
+
+In addition to the salt and remaining attempts, a secret also has `NoPassword::Secret#expires_at`, which limits the amount of time a user has to guess the secret. By default, NoPassword gives end-users 5 minutes to enter the code.
+
+#### Does not store personally identifying information ("PII")
+
+NoPassword makes a best effort to prevent PII from being stored on the server during the authentication & authorization process. Instead the data is persisted on the client via a `data` key, and is verified on each request to ensure the client did not tamper with the orignal PII for the final authentication request. The PII is revealed after the user successfully verifies their email address.
+
+NoPassword does not prevent other pieces of your infrastructure from logging PII, so you'll need to do your dilligence to ensure nothing is logged if your goal is to provide your users with strong privacy garauntees.
+
+#### No session or cookies required
+
+NoPassword persists its state on the client and in an encrypted format on the server; thus a session or cookie is not required for the verification process. This serves two purposes:
+
+1. **Privacy** - The initial authorization and verification process doesn't use cookies, so in theory if you run a tight ship, you won't have to display cookie banners during the authorization and verification process.
+
+2. **API compatibility** - The main reason NoPassword doesn't use cookies or sessions is so it can be used to authenticate via an API. This is useful for hybrid mobile app scenarios where a user may request a login code via a native UI.
+
+## Architecture
+
+NoPassword takes a PORO approach to its architecture, meaning you can extend its behavior via compositions and inheritence. Because of this PORO approach, most of the configuration happens on the objects themselves via inheritance instead of a configuration file. This is a similar approach to how [authologic](https://github.com/binarylogic/authlogic) implements their authentication framework for users.
+
+Because of this modular approach, NoPassword can be used out of the box for many use cases including:
+
+* Login via Email
+* Verify emails for logged in users
+* Reset passwords for logged in users
+
+NoPassword could be extended to work for other side-channel use cases too like login via SMS, QR code, etc.
+
+## Motivations
+
+Understanding why something was created is important to understanding it better.
+
+### Why was NoPassword created?
+
+The gems I evaluated all did more than I wanted them to:
+
+1. [passwordless](https://rubygems.org/gems/passwordless) - Same idea as this gem, but it tries to do too much by including `current_user` and all of the before_action callbacks. Ultimately this gem wasn't suitable for me because I found they way its architected makes it difficult to extend or plug into existing application code.
+
+2. [devise-passwordless](https://rubygems.org/gems/devise-passwordless) - This would be a good solution if you're already using devise, but like passwordless, I didn't want a gem that got into the business of `current_user`. Additionally, for new passwordless-only applications, it doesn't make sense to start with devise since it makes many assumptions about requiring a username and password.
+
+NoPassword only worries about generating codes and creating a secure environment for end-users to validate the codes.
+
+### Why was it not built on devise, warden, or ominauth?
+
+I initially thought this would make for a great OmniAuth strategy, but quickly realized OmniAuth has a goal of being agnostic to rails and ships Rack middleware. I needed something more integrated into Rails controllers and views so that I could more easily extend in various projects.
+
+Devise already has [devise-passwordless](https://rubygems.org/gems/devise-passwordless), but it tries to do too much for my purposes by managing user authorization. I needed something that stopped short of managing user authorization.
+
+## Contributing
+
+I'd like to build out a set of controllers, views, etc. for common use cases for codes, like SMS, QRCode, and email. If you'd like to contribute, lets talk about it at https://github.com/rocketshipio/nopassword/discussions/categories/ideas before you code anything and go over architectural principals, how to distribute, etc.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,15 @@
+require "bundler/setup"
+require "bundler/gem_tasks"
+
+APP_RAKEFILE = File.expand_path("spec/dummy/Rakefile", __dir__)
+
+load "rails/tasks/engine.rake"
+load "rails/tasks/statistics.rake"
+
+begin
+  require 'rspec/core/rake_task'
+  RSpec::Core::RakeTask.new(:spec)
+  task :default => :spec
+rescue LoadError
+  abort "rspec could not be loaded"
+end

data/app/controllers/nopassword/email_authentications_controller.rb

@@ -0,0 +1,105 @@
+class NoPassword::EmailAuthenticationsController < ApplicationController
+  before_action :assign_verification, only: %i[edit update destroy]
+  before_action :assign_email_authentication, only: :create
+  before_action :initialize_and_assign_email_authentication, only: :new
+
+  # These are needed to make wiring up forms a little easier for the developer.
+  helper_method :update_url, :create_url
+
+  def new
+  end
+
+  def show
+    redirect_to url_for(action: :new)
+  end
+
+  def create
+    if @email_authentication.valid?
+      deliver_authentication @email_authentication
+      @verification = @email_authentication.verification
+      render :edit
+    else
+      render :new, status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    @verification.destroy!
+  end
+
+  def update
+    if @verification.valid?
+      verification_succeeded @verification.data
+    elsif @verification.has_expired?
+      verification_expired @verification
+    elsif @verification.has_exceeded_attempts?
+      verification_exceeded_attempts @verification
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  end
+
+  protected
+    # Override with your own logic to do something with the valid data. For
+    # example, you might setup the current user session here via:
+    #
+    # ```
+    # def valid(email)
+    #   session[:user_id] = User.find_or_create_by(email: email)
+    #   redirect_to dashboard_url
+    # end
+    # ```
+    def verification_succeeded(email)
+      redirect_to root_url
+    end
+
+    # Override with your own logic to deliver a code to the user.
+    def deliver_authentication(authentication)
+      NoPassword::EmailAuthenticationMailer.with(authentication: authentication).notification_email.deliver
+    end
+
+    # Override with logic for when verification attempts are exceeded. For
+    # example, you might want to tweak the flash message that's displayed
+    # or redirect them to a page other than the one where they'd re-verify.
+    def verification_exceeded_attempts(verification)
+      flash[:nopassword_status] =  "The number of times the code can be tried has been exceeded."
+      redirect_to url_for(action: :new)
+    end
+
+    # Override with logic for when verification has expired. For
+    # example, you might want to tweak the flash message that's displayed
+    # or redirect them to a page other than the one where they'd re-verify.
+    def verification_expired(verification)
+      flash[:nopassword_status] =  "The code has expired."
+      redirect_to url_for(action: :new)
+    end
+
+    def create_url
+      url_for(action: :create)
+    end
+
+    def update_url
+      url_for(action: :update)
+    end
+
+  private
+    def email_authentication_params
+      params.require(:nopassword_email_authentication).permit(:email)
+    end
+
+    def verification_params
+      params.require(:nopassword_verification).permit(:code, :salt, :data)
+    end
+
+    def assign_verification
+      @verification = NoPassword::Verification.new(verification_params)
+    end
+
+    def assign_email_authentication
+      @email_authentication = NoPassword::EmailAuthentication.new(email_authentication_params)
+    end
+
+    def initialize_and_assign_email_authentication
+      @email_authentication = NoPassword::EmailAuthentication.new
+    end
+end

data/app/mailers/application_mailer.rb

@@ -0,0 +1,5 @@
+class ApplicationMailer < ActionMailer::Base
+  default from: 'from@example.com'
+  layout 'mailer'
+end
+

data/app/mailers/nopassword/email_authentication_mailer.rb

@@ -0,0 +1,6 @@
+class NoPassword::EmailAuthenticationMailer < ApplicationMailer
+  def notification_email
+    @authentication = params[:authentication]
+    mail(to: @authentication.email, subject: "Verification code: #{@authentication.code}")
+  end
+end

data/app/models/nopassword/email_authentication.rb

@@ -0,0 +1,30 @@
+require "uri"
+
+class NoPassword::EmailAuthentication < NoPassword::Model
+  attr_accessor :email
+  validates :email,
+    presence: true,
+    format: { with: URI::MailTo::EMAIL_REGEXP }
+
+  def verification
+    # We don't want the code in the verification, otherwise
+    # the user will set it on the subsequent request, which
+    # would undermine the whole thing.
+    NoPassword::Verification.new(salt: salt, data: email) if valid?
+  end
+
+  def destroy!
+    secret.destroy!
+  end
+
+  private
+    delegate :code, :salt, to: :secret
+
+    def secret
+      @secret ||= create_secret
+    end
+
+    def create_secret
+      NoPassword::Secret.create!(data: email)
+    end
+end

data/app/models/nopassword/model.rb

@@ -0,0 +1,21 @@
+class NoPassword::Model
+  include ActiveModel::Model
+  include ActiveModel::Validations::Callbacks
+  extend ActiveModel::Naming
+
+  def initialize(*args, **kwargs)
+    super(*args, **kwargs)
+    assign_defaults
+  end
+
+  protected
+  # Subclasses would implement default assignments in the subclass.
+  def assign_defaults
+  end
+
+  # When we're dealing with t/f values, the ||= doesn't work, so we set those
+  # defaults up here.
+  def assign_default(attr, val)
+    self.send("#{attr}=", val) if self.send(attr).nil?
+  end
+end

data/app/models/nopassword/secret.rb

@@ -0,0 +1,122 @@
+class NoPassword::Secret < ApplicationRecord
+  self.table_name = "nopassword_secrets"
+
+  # Initialize new models with all the stuff needed to encrypt
+  # and store the data.
+  after_initialize :assign_defaults, unless: :persisted?
+
+  validates :data_digest, presence: true
+  validates :code_digest, presence: true
+  before_validation :assign_digests, on: :create
+
+  # This is used to derive the `data_digest`, which finds the secret.
+  attr_accessor :salt
+  validates :salt, presence: true
+
+  # Maximum number of times that a verification can be attempted.
+  DEFAULT_REMAINING_ATTEMPTS = 3
+
+  validates :expires_at, presence: true
+  validate :expiration
+
+  validates :remaining_attempts,
+    presence: true,
+    numericality: {
+      only_integer: true,
+      greater_than: 0 }
+
+  # How long can the code live until it expires a new
+  # code verification must be created
+  DEFAULT_TIME_TO_LIVE = 5.minutes
+
+  attr_reader :code
+  validate :code_authenticity
+  # Ensure the code is a non-empty string. The nil will
+  # trigger validations and blow up the downstream Encryptor.
+  def code=(code)
+    @code = code.to_s if code.present?
+  end
+
+  attr_accessor :data
+  validates :data, presence: true
+  validate :data_tampering, on: :update
+
+  def has_expired?
+    Time.current > expires_at
+  end
+
+  def has_exceeded_attempts?
+    not remaining_attempts.positive?
+  end
+
+  def has_tampered_data?
+    self.data_digest != digest_data if persisted?
+  end
+
+  def has_authentic_code?
+    self.code_digest == digest_code
+  end
+
+  def decrement_remaining_attempts
+    decrement! :remaining_attempts
+  end
+
+  def self.find_by_digest(salt:, data:)
+    return if salt.nil?
+    return if data.nil?
+
+    find_by(data_digest: digest_data(salt: salt, data: data)).tap do |secret|
+      if secret
+        secret.data = data
+        secret.salt = salt
+      end
+    end
+  end
+
+  def self.digest_data(salt:, data:)
+    return if salt.nil?
+    return if data.nil?
+
+    Digest::SHA256.hexdigest(salt + data)
+  end
+
+  def self.digest_code(data_digest:, code:)
+    return if code.nil?
+    return if data_digest.nil?
+
+    Digest::SHA256.hexdigest(data_digest + code)
+  end
+
+  private
+    def assign_defaults
+      self.salt = NoPassword::Encryptor.generate_salt
+      self.code ||= NoPassword::RandomCodeGenerator.generate_numeric_code
+      self.expires_at ||= DEFAULT_TIME_TO_LIVE.from_now
+      self.remaining_attempts ||= DEFAULT_REMAINING_ATTEMPTS
+    end
+
+    def assign_digests
+      self.data_digest = digest_data
+      self.code_digest = digest_code
+    end
+
+    def digest_data
+      self.class.digest_data(salt: salt, data: data)
+    end
+
+    def digest_code
+      self.class.digest_code(data_digest: data_digest, code: code)
+    end
+
+    def expiration
+      errors.add(:expires_at, "has been exceeded") if has_expired?
+    end
+
+    def data_tampering
+      errors.add(:data, "has been tampered") if has_tampered_data?
+    end
+
+    def code_authenticity
+      errors.add(:code, "is incorrect") unless has_authentic_code?
+    end
+end

data/app/models/nopassword/verification.rb

@@ -0,0 +1,50 @@
+class NoPassword::Verification < NoPassword::Model
+  delegate \
+      :has_expired?,
+      :has_exceeded_attempts?,
+      :has_authentic_code?,
+      :expires_at,
+      :remaining_attempts,
+      :decrement_remaining_attempts,
+      :persisted?,
+    to: :secret,
+    allow_nil: true
+
+  attr_accessor :salt
+  validates :salt, presence: true
+
+  attr_accessor :code
+  validates :code, presence: true
+  validate :code_expiration
+  validate :code_verification_attempts
+  validate :code_authenticity
+
+  attr_accessor :data
+  validates :data, presence: true
+
+  # This fires, even if the validation fails.
+  after_validation :decrement_remaining_attempts
+
+  def has_incorrect_code?
+    not has_authentic_code?
+  end
+
+  private
+    def code_authenticity
+      errors.add(:code, "is incorrect") if has_incorrect_code?
+    end
+
+    def code_expiration
+      errors.add(:code, "has expired") if has_expired?
+    end
+
+    def code_verification_attempts
+      errors.add(:code, "verification attempts have been exceeded") if has_exceeded_attempts?
+    end
+
+    def secret
+      @secret ||= NoPassword::Secret.find_by_digest(salt: salt, data: data).tap do |secret|
+        secret.code = code if secret
+      end
+    end
+end

data/app/models/nopassword.rb

@@ -0,0 +1,5 @@
+module NoPassword
+  def self.table_name_prefix
+    "nopassword_"
+  end
+end

data/app/views/layouts/nopassword/mailer.html.erb

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <style>
+      /* Email styles need to be inline */
+    </style>
+  </head>
+
+  <body>
+    <%= yield %>
+  </body>
+</html>

data/app/views/layouts/nopassword/mailer.text.erb

@@ -0,0 +1 @@
+<%= yield %>

data/app/views/nopassword/email_authentication_mailer/notification_email.html.erb

@@ -0,0 +1,5 @@
+<h1>Verify your email address</h1>
+
+<p>Enter the code below into your open browser window to verify your email address.</p>
+
+<code style="font-size: 3em; background-color: rgba(0.5, 0.5, 0.5, 0.05); padding: 1em 2em; text-align: center; font-family: monospace; font-weight: bold; display: inline-block; border-radius: 0.25em;"><%= @authentication.code %></code>

data/app/views/nopassword/email_authentication_mailer/notification_email.html.txt

@@ -0,0 +1,3 @@
+Enter the code below into your open browser window to verify your email address.
+
+<%= @authentication.code %>

data/app/views/nopassword/email_authentications/edit.html.erb

@@ -0,0 +1,24 @@
+<h1>Verify login code</h1>
+
+<p>Look for a 6 digit code in the inbox or spam folder.</p>
+
+<%= form_with model: @verification, url: url_for(action: :update), data: { turbo: false }, method: :patch do |f| %>
+  <%= f.hidden_field :salt %>
+  <%= f.hidden_field :data %>
+  <%= f.label :code %>
+  <%= f.text_field :code, autofocus: true %>
+  <%= f.submit "Continue" %>
+<% end %>
+
+<% if @verification.errors.any? %>
+  <p><%= @verification.errors.full_messages.to_sentence %></p>
+<% end %>
+
+<p>
+  Launch
+  <%= link_to "Gmail", "https://gmail.com/", target: "_blank" %>
+  |
+  <%= link_to "Outlook", "https://outlook.live.com/", target: "_blank" %>
+  |
+  <%= link_to "Yahoo Mail", "https://mail.yahoo.com/", target: "_blank" %>
+</p>

data/app/views/nopassword/email_authentications/new.html.erb

@@ -0,0 +1,13 @@
+<h1>Get a login code</h1>
+
+<% if message = flash[:nopassword_status] %>
+  <p><%= message %> Enter an email address to request a new login code and try again.</p>
+<% else %>
+  <p>We'll email you a login code so we can securely get you to your account</p>
+<% end %>
+
+<%= form_with model: @email_authentication, url: url_for(action: :create), data: { turbo: false } do |f| %>
+  <%= f.label :email %>
+  <%= f.email_field :email, autofocus: true %>
+  <%= f.submit "Continue" %>
+<% end %>

data/config/initializers/inflections.rb

@@ -0,0 +1,3 @@
+ActiveSupport::Inflector.inflections(:en) do |inflect|
+  inflect.acronym "NoPassword"
+end

data/config/routes.rb

@@ -0,0 +1,2 @@
+Rails.application.routes.draw do
+end

data/db/migrate/20220210203235_create_nopassword_secrets.rb

@@ -0,0 +1,14 @@
+class CreateNoPasswordSecrets < ActiveRecord::Migration[7.0]
+  def change
+    create_table :nopassword_secrets do |t|
+      t.string :data_digest, null: false
+      t.string :code_digest, null: false
+
+      t.datetime :expires_at, null: false
+      t.integer :remaining_attempts, null: false
+
+      t.index :data_digest, unique: true
+      t.timestamps
+    end
+  end
+end

data/lib/generators/nopassword/install/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Installs NoPassword in application by generating basic controller files
+
+Example:
+    bin/rails generate install EmailAuthentication
+
+    This will create:
+        app/controllers/email_authentication.rb

data/lib/generators/nopassword/install/install_generator.rb

@@ -0,0 +1,20 @@
+class NoPassword::InstallGenerator < Rails::Generators::Base
+  source_root File.expand_path("templates", __dir__)
+
+  def copy_controller_file
+    copy_file "controller.rb", "app/controllers/email_authentications_controller.rb"
+  end
+
+  def copy_view_files
+    directory NoPassword.root.join("app/views/nopassword/email_authentication_mailer"), 'app/views/email_authentication_mailer'
+    directory NoPassword.root.join("app/views/nopassword/email_authentications"), 'app/views/email_authentications'
+  end
+
+  def add_nopassword_routes
+    route "resource :email_authentication"
+  end
+
+  def copy_migration_file
+    rake "nopassword_engine:install:migrations"
+  end
+end

data/lib/generators/nopassword/install/templates/controller.rb

@@ -0,0 +1,35 @@
+class EmailAuthenticationsController < NoPassword::EmailAuthenticationsController
+    # Override with your own logic to do something with the valid data. For
+    # example, you might setup the current user session here via:
+    #
+    # ```
+    # def verification_succeeded(email)
+    #   self.current_user = User.find_or_create_by(email: email)
+    #   redirect_to dashboard_url
+    # end
+    # ```
+    def verification_succeeded(email)
+      redirect_to root_url
+    end
+
+    # Override with logic for when verification attempts are exceeded. For
+    # example, you might want to tweak the flash message that's displayed
+    # or redirect them to a page other than the one where they'd re-verify.
+    def verification_exceeded_attempts(verification)
+      flash[:nopassword_status] =  "The number of times the code can be tried has been exceeded."
+      redirect_to url_for(action: :new)
+    end
+
+    # Override with logic for when verification has expired. For
+    # example, you might want to tweak the flash message that's displayed
+    # or redirect them to a page other than the one where they'd re-verify.
+    def verification_expired(verification)
+      flash[:nopassword_status] =  "The code has expired."
+      redirect_to url_for(action: :new)
+    end
+
+    # Override with your own logic to deliver a code to the user.
+    def deliver_authentication(authentication)
+      NoPassword::EmailAuthenticationMailer.with(authentication: authentication).notification_email.deliver
+    end
+end

data/lib/nopassword/encryptor.rb

@@ -0,0 +1,27 @@
+module NoPassword
+  # Handle encrypting and decrypting secrets.
+  class Encryptor
+    KEY_LENGTH = ActiveSupport::MessageEncryptor.key_len
+
+    def initialize(secret_key:, salt: self.class.generate_salt, key_length: KEY_LENGTH)
+      raise "salt can't be nil" if salt.nil?
+      raise "secret_key can't be nil" if secret_key.nil?
+
+      # binding.pry if secret_key.nil?
+      key = ActiveSupport::KeyGenerator.new(secret_key).generate_key(salt, key_length)
+      @crypt = ActiveSupport::MessageEncryptor.new(key)
+    end
+
+    def encrypt_and_sign(decrypted_data, *args, **kwargs)
+      @crypt.encrypt_and_sign(decrypted_data, *args, **kwargs)
+    end
+
+    def decrypt_and_verify(encrypted_data, *args, **kwargs)
+      @crypt.decrypt_and_verify(encrypted_data, *args, **kwargs)
+    end
+
+    def self.generate_salt(key_length: KEY_LENGTH)
+      SecureRandom.urlsafe_base64 key_length
+    end
+  end
+end

data/lib/nopassword/engine.rb

@@ -0,0 +1,7 @@
+require "nopassword"
+
+module NoPassword
+  class Engine < ::Rails::Engine
+    config.action_mailer.preview_path = NoPassword.root.join("spec/mailers/previews")
+  end
+end

data/lib/nopassword/random_code_generator.rb

@@ -0,0 +1,43 @@
+class NoPassword::RandomCodeGenerator
+  # 6 digit random code by default.
+  CODE_LENGTH = 6
+
+  # Numeric to make input a tad easier with a number pad.
+  NUMERIC_CHARACTERS = [*'0'..'9']
+
+  # Alphanumeric, which excludes lowercase because people would typo that.
+  ALPHANUMERIC_CHARACTERS = [*'A'..'Z', *'0'..'9']
+
+  def initialize(length:, characters:)
+    @length = length
+    @characters = characters
+  end
+
+  def generate
+    # Why not `SecureRandom#rand`? I don't actually want a number; I want a code, with
+    # leading zeros, that's a string. This is the easiest way to generate that and pad it.
+    #
+    # This really should be a public API, but alas, its not, so I have to call
+    # it privately and pass it the characters I want this to generate for the code.
+    SecureRandom.send :choose, @characters, @length
+  end
+
+  # Convinence methods for generating codes throughout the application.
+  class << self
+    def numeric
+      new length: CODE_LENGTH, characters: NUMERIC_CHARACTERS
+    end
+
+    def generate_numeric_code
+      numeric.generate
+    end
+
+    def alphanumeric
+      new length: CODE_LENGTH, characters: ALPHANUMERIC_CHARACTERS
+    end
+
+    def generate_alphanumeric_code
+      alphanumeric.generate
+    end
+  end
+end

data/lib/nopassword/version.rb

@@ -0,0 +1,3 @@
+module NoPassword
+  VERSION = "0.1.0"
+end

data/lib/nopassword.rb

@@ -0,0 +1,12 @@
+require "nopassword/version"
+require "nopassword/encryptor"
+require "nopassword/random_code_generator"
+require "pathname"
+
+module NoPassword
+  def self.root
+    Pathname.new(__dir__).join("..")
+  end
+end
+
+require "nopassword/engine"

data/lib/tasks/nopassword_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :nopassword do
+#   # Task goes here
+# end

metadata

@@ -0,0 +1,107 @@
+--- !ruby/object:Gem::Specification
+name: nopassword
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Brad Gessler
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2022-03-01 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.0.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.0.1
+- !ruby/object:Gem::Dependency
+  name: rspec-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: NoPassword is a toolkit that makes it easy to implement temporary, secure
+  login codes initiated from peoples' web browsers so they can login to Rails applications
+  via email, SMS, CLI, QR Codes, or any other side-channel.
+email:
+- brad@rocketship.io
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- Rakefile
+- app/assets/config/nopassword_manifest.js
+- app/controllers/nopassword/email_authentications_controller.rb
+- app/mailers/application_mailer.rb
+- app/mailers/nopassword/email_authentication_mailer.rb
+- app/models/nopassword.rb
+- app/models/nopassword/email_authentication.rb
+- app/models/nopassword/model.rb
+- app/models/nopassword/secret.rb
+- app/models/nopassword/verification.rb
+- app/views/layouts/nopassword/mailer.html.erb
+- app/views/layouts/nopassword/mailer.text.erb
+- app/views/nopassword/email_authentication_mailer/notification_email.html.erb
+- app/views/nopassword/email_authentication_mailer/notification_email.html.txt
+- app/views/nopassword/email_authentications/edit.html.erb
+- app/views/nopassword/email_authentications/new.html.erb
+- config/initializers/inflections.rb
+- config/routes.rb
+- db/migrate/20220210203235_create_nopassword_secrets.rb
+- db/test.sqlite3
+- lib/generators/nopassword/install/USAGE
+- lib/generators/nopassword/install/install_generator.rb
+- lib/generators/nopassword/install/templates/controller.rb
+- lib/nopassword.rb
+- lib/nopassword/encryptor.rb
+- lib/nopassword/engine.rb
+- lib/nopassword/random_code_generator.rb
+- lib/nopassword/version.rb
+- lib/tasks/nopassword_tasks.rake
+homepage: https://github.com/rocketshipio/nopassword
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  homepage_uri: https://github.com/rocketshipio/nopassword
+  source_code_uri: https://github.com/rocketshipio/nopassword
+  changelog_uri: https://github.com/rocketshipio/nopassword/releases
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.2.3
+signing_key:
+specification_version: 4
+summary: Passwordless login to Rails applications via email
+test_files: []