rails_authentication 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c71c1a30969abed6c581c67e3447c1968176e6e25c218894e64d5317472b873e
-  data.tar.gz: 1f65cac490fae4c9f575d907bf70d4d059afdb1bcb5e8a56474b741b4eac4f3e
+  metadata.gz: 6369064c5074eb057abc1ed169b7efbe7ae0758730dc6c764b86fee19f96b0d3
+  data.tar.gz: 5bdc5cb01eb60fed2449f0a1544d29102c79f917faf345f86a1a86bca6b6adc6
 SHA512:
-  metadata.gz: 5469da8db1ff529c5dd079b37a3499b1bc08b657560bdcd037607c407d6be292a306bcd146bcc99f30243435824a6fa9a58cb965a80edc0d7fb30435dcdc1cc3
-  data.tar.gz: '0693170a1f4bdebe7ec41bfe6088ddbbc436225aa3a09b8d3216af9cf800bd36d461a9618fd022e0b45b1662c82382b13a0bf4cc10e715a9e7247fcd1d77fb18'
+  metadata.gz: da49badfb4b8c58c2525329479154961cb10cbd6b6d683a4dbc56171198e9ad1d1f31d097455f106d47d19332a14391ee0e4370394aa23535e85b47be6ebf0f8
+  data.tar.gz: 4407fbc0f0c7daafc4324fb1e0ba7c366c4c810fa81b579bf464fd2f2e31b7d5e3da6c6e8741b189e0399a28660b4e0a728d80b1bfec63282eee3f8c0d204756

data/README.md

@@ -18,6 +18,8 @@ gem extends that same command to also install:
 | **Lockable** | Locks the account after 5 failed attempts; unlock via email or automatically after 1 hour |
 | **Invitable** | Invite users by email; blocks sign-in until they accept by choosing their own password |
 | **MagicLink** (opt-in) | Passwordless magic link sign-in via email — DB-backed, single-use, expiring tokens |
+| **Ott** (opt-in) | Passwordless sign-in via an emailed 6-digit one-time code — replaces the password sign-in form |
+| **Passkey** (opt-in) | WebAuthn passkey sign-in alongside the password form — usernameless, no email required |
 
 Everything is **generated into your app** as plain, readable code — controllers, views, mailers,
 migrations, and one model concern per feature. There is no runtime dependency on this gem: after
@@ -28,7 +30,7 @@ This gem is meant to be installed temporarily. Install it long enough to run the
 ## Installation
 
 Requires Rails >= 8.0 and, for the email-driven features (Confirmable, Recoverable, Lockable,
-Invitable, MagicLink), Action Mailer.
+Invitable, MagicLink, Ott), Action Mailer.
 
 ```ruby
 # Gemfile
@@ -56,24 +58,46 @@ Available flags: `--skip-confirmable`, `--skip-recoverable`, `--skip-registerabl
 `--skip-lockable`, `--skip-invitable`, and `--reconfirmable` (Confirmable: postpone email address
 changes until the new address is confirmed, via an `unconfirmed_email` column).
 
-MagicLink is the one **opt-in** feature — it changes the sign-in UX, so you have to ask for it:
+MagicLink, Ott, and Passkey are **opt-in** features — they change the sign-in UX, so you have to
+ask for them:
 
 ```sh
 bin/rails generate authentication --magic-link
+bin/rails generate authentication --ott
+bin/rails generate authentication --passkey
 ```
 
-It adds a "Sign in with magic link" link to the sign-in page, leading to an email-only form. The
-emailed link signs the user in directly; tokens are DB-backed, single-use, and expire after
-20 minutes (`MagicLinkConcern::MAGIC_LINK_EXPIRES_IN`). The magic link flow honors the other
-enabled features: locked, unconfirmed, or invitation-pending accounts still can't sign in, and
-Trackable records the attempt.
+MagicLink adds a "Sign in with magic link" link to the sign-in page, leading to an email-only
+form. The emailed link signs the user in directly; tokens are DB-backed, single-use, and expire
+after 20 minutes (`MagicLinkConcern::MAGIC_LINK_EXPIRES_IN`).
+
+Ott replaces the sign-in form: the user enters only their email address, receives a 6-digit code
+(`OttConcern::OTT_CODE_LENGTH`) by email, and enters it on a second screen — one single-digit
+input per digit with auto-advance and paste/autofill support (plain inline JavaScript, no
+framework required). A "Sign in with password
+instead" link (`/session/new?with_password=1`) toggles back to the classic password form at
+runtime. Codes are DB-backed, single-use, expire after 10 minutes (`OttConcern::OTT_EXPIRES_IN`),
+and are voided after 5 wrong entries (`OttConcern::OTT_MAX_ATTEMPTS`). The password machinery
+(SessionsController#create, Recoverable, Registerable) stays generated and functional — only the
+sign-in UI changes.
+
+Passkey adds a "Sign in with a passkey" button to the sign-in page (no email field — the
+browser's own discoverable-credential picker takes its place) plus an authenticated
+`/webauthn_credentials` section where a signed-in user can register and remove passkeys (linked
+from the account page when Registerable is enabled). Unlike every other feature here, this one
+brings a real runtime dependency: the generator adds `gem "webauthn"` to your Gemfile for you (with
+a reminder to run `bundle install`), since ceremony verification is delegated to it. A user can
+register any number of passkeys, each stored as its own row in `webauthn_credentials`.
+
+All three flows honor the other enabled features: locked, unconfirmed, or invitation-pending
+accounts still can't sign in, and Trackable records the attempt.
 
 Each feature adds a single `include <Feature>Concern` line to `app/models/user.rb`; all of its
 model behavior lives in `app/models/concerns/<feature>_concern.rb`. Tunables are plain constants in
 the generated concerns — e.g. `TimeoutableConcern::TIMEOUT_IN`, `LockableConcern::MAXIMUM_ATTEMPTS`,
 `LockableConcern::UNLOCK_IN`, `ConfirmableConcern::CONFIRMATION_TOKEN_EXPIRES_IN`,
-`ValidatableConcern::PASSWORD_LENGTH`, `ValidatableConcern::PASSWORD_MINIMUM_COMPLEXITY` — edit them
-there. Concerns keep the model clean.
+`ValidatableConcern::PASSWORD_LENGTH`, `ValidatableConcern::PASSWORD_MINIMUM_COMPLEXITY`,
+`OttConcern::OTT_CODE_LENGTH` — edit them there. Concerns keep the model clean.
 
 ### Generated routes
 
@@ -83,6 +107,9 @@ resources :confirmations, only: %i[ new create show ], param: :token
 resources :unlocks,       only: %i[ new create show ], param: :token
 resources :invitations,   only: %i[ new create edit update ], param: :token
 resources :magic_links,   only: %i[ new create show ], param: :token   # with --magic-link
+resource  :ott,           only: %i[ create edit update ]               # with --ott
+resources :webauthn_credentials, only: %i[ index new create destroy ]  # with --passkey
+resource  :passkey_session, only: %i[ create ]                         # with --passkey
 resource  :session                      # from the base generator
 resources :passwords, param: :token     # from the base generator
 ```
@@ -99,11 +126,6 @@ resources :passwords, param: :token     # from the base generator
   sessions view with versions tailored to the features you selected. Run the generator once, up
   front — re-running it after you've customized those files will prompt to overwrite them.
 
-## Future Plans
-
-- OTT (Email code)
-- Passkey
-
 ## Development
 
 ```sh
@@ -117,6 +139,53 @@ bundle exec rspec spec/generators/lockable_spec.rb:12   # a single example
 `spec/dummy` is generated (and gitignored), never hand-maintained, so the request specs always
 exercise exactly what the templates produce.
 
+To run the app using the dummy app generated in `spec/dummy`, run `bin/dev`
+
+## Appraisal
+
+Install Appraisal dependencies or when a new Appraisal is added, generate the .gemfile
+
+```sh
+bundle exec appraisal generate-install
+```
+
+Run tests with Appraisal
+
+```sh
+bin/appraisal
+```
+
+Run a specific Appraisal test
+
+```sh
+# rails-8.0-json-2
+bundle exec appraisal rails-8.0-json-2 rake spec:generators
+bundle exec appraisal rails-8.0-json-2 rake dummy:prepare
+bundle exec appraisal rails-8.0-json-2 rake spec:requests
+# rails-8.0-json-3
+bundle exec appraisal rails-8.0-json-3 rake spec:generators
+bundle exec appraisal rails-8.0-json-3 rake dummy:prepare
+bundle exec appraisal rails-8.0-json-3 rake spec:requests
+# rails-8.1-json-2
+bundle exec appraisal rails-8.1-json-2 rake spec:generators
+bundle exec appraisal rails-8.1-json-2 rake dummy:prepare
+bundle exec appraisal rails-8.1-json-2 rake spec:requests
+# rails-8.1-json-3
+bundle exec appraisal rails-8.1-json-3 rake spec:generators
+bundle exec appraisal rails-8.1-json-3 rake dummy:prepare
+bundle exec appraisal rails-8.1-json-3 rake spec:requests
+```
+
+## json 3.0 gem compatibility
+
+`json` 3.0 gem removed the `quirks_mode:` keyword and made `JSON.generate`/`JSON.parse`'s second argument keyword-only. Rails' `ActiveSupport::JSON` still calls both with `quirks_mode: true` positionally, so every
+cookie/session read or write throws `ArgumentError` under json 3. `bin/prepare_dummy`
+writes `spec/dummy/config/initializers/json_quirks_mode_compat.rb`, which prepends a shim onto
+`JSON.generate`/`.parse` that strips `quirks_mode` and re-passes remaining options via `**opts`
+(so it works whether the resolved `JSON.parse` still takes a positional options hash, json 2.x,
+or keywords only, json 3.x). It no-ops under json 2.x (`Gem::Version.new(::JSON::VERSION) >=
+Gem::Version.new("3.0")` gates it) and is safe to delete once Rails or json fixes this upstream.
+
 ## License
 
 MIT

data/lib/generators/authentication/authentication_generator.rb

@@ -12,6 +12,8 @@ require_relative "features/validatable"
 require_relative "features/lockable"
 require_relative "features/invitable"
 require_relative "features/magic_link"
+require_relative "features/ott"
+require_relative "features/passkey"
 
 module RailsAuthentication
   module Generators
@@ -44,6 +46,8 @@ module RailsAuthentication
       include Features::Lockable
       include Features::Invitable
       include Features::MagicLink
+      include Features::Ott
+      include Features::Passkey
 
       source_root File.expand_path("templates", __dir__)
 
@@ -60,6 +64,17 @@ module RailsAuthentication
       class_option :magic_link, type: :boolean, default: false,
         desc: "Add passwordless magic link sign-in (opt-in)"
 
+      # Also opt-in: replaces the sign-in form with an email-only form that
+      # emails a 6-digit one-time code, entered on a second screen. Password
+      # machinery stays generated and functional.
+      class_option :ott, type: :boolean, default: false,
+        desc: "Add one-time token (emailed 6-digit code) sign-in (opt-in)"
+
+      # Also opt-in: WebAuthn passkey sign-in alongside password sign-in.
+      # Requires the host app to add the `webauthn` gem itself.
+      class_option :passkey, type: :boolean, default: false,
+        desc: "Add WebAuthn passkey sign-in (opt-in; requires the webauthn gem)"
+
       def install_base_authentication
         say "Running Rails' built-in authentication generator", :green
         Rails::Generators.invoke("rails:authentication", [], behavior: behavior, destination_root: destination_root)
@@ -105,6 +120,14 @@ module RailsAuthentication
         generate_magic_link if magic_link?
       end
 
+      def install_ott
+        generate_ott if ott?
+      end
+
+      def install_passkey
+        generate_passkey if passkey?
+      end
+
       # Runs after every feature install so the blank line separates the concern
       # includes (if any) from the rest of the class body, no matter which features
       # are enabled.
@@ -135,6 +158,14 @@ module RailsAuthentication
           options[:magic_link]
         end
 
+        def ott?
+          options[:ott]
+        end
+
+        def passkey?
+          options[:passkey]
+        end
+
         def include_concern_in_user(concern)
           inject_into_class "app/models/user.rb", "User", "  include #{concern}\n"
         end

data/lib/generators/authentication/features/confirmable.rb

@@ -5,20 +5,21 @@ module RailsAuthentication
     module Features
       module Confirmable
         private
-          def generate_confirmable
-            template "app/models/concerns/confirmable_concern.rb"
-            include_concern_in_user "ConfirmableConcern"
-            migration_template "db/migrate/add_confirmable_to_users.rb", "db/migrate/add_confirmable_to_users.rb"
-            template "app/controllers/confirmations_controller.rb"
-            template "app/views/confirmations/new.html.erb"
-            route "resources :confirmations, only: %i[ new create show ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/confirmations_mailer.rb"
-              template "app/views/confirmations_mailer/confirmation_instructions.html.erb"
-              template "app/views/confirmations_mailer/confirmation_instructions.text.erb"
-            end
+        def generate_confirmable
+          template "app/models/concerns/confirmable_concern.rb"
+          include_concern_in_user "ConfirmableConcern"
+          migration_template "db/migrate/add_confirmable_to_users.rb", "db/migrate/add_confirmable_to_users.rb"
+          template "app/controllers/confirmations_controller.rb"
+          template "app/views/confirmations/new.html.erb"
+          route "resources :confirmations, only: %i[ new create show ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/confirmations_mailer.rb"
+            template "app/views/confirmations_mailer/confirmation_instructions.html.erb"
+            template "app/views/confirmations_mailer/confirmation_instructions.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/invitable.rb

@@ -5,21 +5,22 @@ module RailsAuthentication
     module Features
       module Invitable
         private
-          def generate_invitable
-            template "app/models/concerns/invitable_concern.rb"
-            include_concern_in_user "InvitableConcern"
-            migration_template "db/migrate/add_invitable_to_users.rb", "db/migrate/add_invitable_to_users.rb"
-            template "app/controllers/invitations_controller.rb"
-            template "app/views/invitations/new.html.erb"
-            template "app/views/invitations/edit.html.erb"
-            route "resources :invitations, only: %i[ new create edit update ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/invitations_mailer.rb"
-              template "app/views/invitations_mailer/invitation_instructions.html.erb"
-              template "app/views/invitations_mailer/invitation_instructions.text.erb"
-            end
+        def generate_invitable
+          template "app/models/concerns/invitable_concern.rb"
+          include_concern_in_user "InvitableConcern"
+          migration_template "db/migrate/add_invitable_to_users.rb", "db/migrate/add_invitable_to_users.rb"
+          template "app/controllers/invitations_controller.rb"
+          template "app/views/invitations/new.html.erb"
+          template "app/views/invitations/edit.html.erb"
+          route "resources :invitations, only: %i[ new create edit update ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/invitations_mailer.rb"
+            template "app/views/invitations_mailer/invitation_instructions.html.erb"
+            template "app/views/invitations_mailer/invitation_instructions.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/lockable.rb

@@ -5,20 +5,21 @@ module RailsAuthentication
     module Features
       module Lockable
         private
-          def generate_lockable
-            template "app/models/concerns/lockable_concern.rb"
-            include_concern_in_user "LockableConcern"
-            migration_template "db/migrate/add_lockable_to_users.rb", "db/migrate/add_lockable_to_users.rb"
-            template "app/controllers/unlocks_controller.rb"
-            template "app/views/unlocks/new.html.erb"
-            route "resources :unlocks, only: %i[ new create show ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/unlocks_mailer.rb"
-              template "app/views/unlocks_mailer/unlock_instructions.html.erb"
-              template "app/views/unlocks_mailer/unlock_instructions.text.erb"
-            end
+        def generate_lockable
+          template "app/models/concerns/lockable_concern.rb"
+          include_concern_in_user "LockableConcern"
+          migration_template "db/migrate/add_lockable_to_users.rb", "db/migrate/add_lockable_to_users.rb"
+          template "app/controllers/unlocks_controller.rb"
+          template "app/views/unlocks/new.html.erb"
+          route "resources :unlocks, only: %i[ new create show ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/unlocks_mailer.rb"
+            template "app/views/unlocks_mailer/unlock_instructions.html.erb"
+            template "app/views/unlocks_mailer/unlock_instructions.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/magic_link.rb

@@ -8,20 +8,21 @@ module RailsAuthentication
       # Recoverable rework.
       module MagicLink
         private
-          def generate_magic_link
-            template "app/models/concerns/magic_link_concern.rb"
-            include_concern_in_user "MagicLinkConcern"
-            migration_template "db/migrate/add_magic_link_to_users.rb", "db/migrate/add_magic_link_to_users.rb"
-            template "app/controllers/magic_links_controller.rb"
-            template "app/views/magic_links/new.html.erb"
-            route "resources :magic_links, only: %i[ new create show ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/magic_links_mailer.rb"
-              template "app/views/magic_links_mailer/magic_link.html.erb"
-              template "app/views/magic_links_mailer/magic_link.text.erb"
-            end
+        def generate_magic_link
+          template "app/models/concerns/magic_link_concern.rb"
+          include_concern_in_user "MagicLinkConcern"
+          migration_template "db/migrate/add_magic_link_to_users.rb", "db/migrate/add_magic_link_to_users.rb"
+          template "app/controllers/magic_links_controller.rb"
+          template "app/views/magic_links/new.html.erb"
+          route "resources :magic_links, only: %i[ new create show ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/magic_links_mailer.rb"
+            template "app/views/magic_links_mailer/magic_link.html.erb"
+            template "app/views/magic_links_mailer/magic_link.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/ott.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module RailsAuthentication
+  module Generators
+    module Features
+      # Opt-in (--ott): one-time token sign-in. The sign-in page becomes an
+      # email-only form; a 6-digit code is emailed and entered on a second
+      # screen. Codes are DB-backed, single-use, expire after 10 minutes, and
+      # are voided after 5 wrong attempts. Password machinery (Recoverable,
+      # Registerable, SessionsController#create) is left intact.
+      module Ott
+        private
+
+        def generate_ott
+          template "app/models/concerns/ott_concern.rb"
+          include_concern_in_user "OttConcern"
+          migration_template "db/migrate/add_ott_to_users.rb", "db/migrate/add_ott_to_users.rb"
+          template "app/controllers/otts_controller.rb"
+          template "app/views/otts/edit.html.erb"
+          route "resource :ott, only: %i[ create edit update ]"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/otts_mailer.rb"
+            template "app/views/otts_mailer/ott.html.erb"
+            template "app/views/otts_mailer/ott.text.erb"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/generators/authentication/features/passkey.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module RailsAuthentication
+  module Generators
+    module Features
+      # Opt-in (--passkey): WebAuthn-based passkey sign-in, in addition to
+      # password sign-in. A user may register any number of passkeys
+      # (platform authenticators, security keys); sign-in is usernameless —
+      # the browser's discoverable-credential picker stands in for an email
+      # field. Ceremony verification is delegated to the `webauthn` gem —
+      # unlike everything else this gem generates, that's a real runtime
+      # dependency, so it's added straight to the host app's Gemfile.
+      module Passkey
+        private
+
+        def generate_passkey
+          gem "webauthn", comment: "Verifies WebAuthn passkey registration/authentication ceremonies"
+          say "Added the `webauthn` gem to your Gemfile — run `bundle install`.", :yellow
+
+          template "config/initializers/webauthn.rb"
+          template "app/models/concerns/passkey_concern.rb"
+          include_concern_in_user "PasskeyConcern"
+          template "app/models/webauthn_credential.rb"
+          migration_template "db/migrate/add_webauthn_id_to_users.rb", "db/migrate/add_webauthn_id_to_users.rb"
+          migration_template "db/migrate/create_webauthn_credentials.rb", "db/migrate/create_webauthn_credentials.rb"
+          template "app/controllers/webauthn_credentials_controller.rb"
+          template "app/controllers/passkey_sessions_controller.rb"
+          template "app/views/webauthn_credentials/index.html.erb"
+          template "app/views/webauthn_credentials/new.html.erb"
+          route "resources :webauthn_credentials, only: %i[ index new create destroy ]"
+          route "resource :passkey_session, only: %i[ create ], controller: \"passkey_sessions\""
+        end
+      end
+    end
+  end
+end

data/lib/generators/authentication/features/recoverable.rb

@@ -5,20 +5,21 @@ module RailsAuthentication
     module Features
       module Recoverable
         private
-          # Replaces the base generator's stateless generates_token_for password reset
-          # with DB-backed, revocable tokens.
-          def generate_recoverable
-            template "app/models/concerns/recoverable_concern.rb"
-            include_concern_in_user "RecoverableConcern"
-            migration_template "db/migrate/add_recoverable_to_users.rb", "db/migrate/add_recoverable_to_users.rb"
-            template "app/controllers/passwords_controller.rb", force: true
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/passwords_mailer.rb", force: true
-              template "app/views/passwords_mailer/reset.html.erb", force: true
-              template "app/views/passwords_mailer/reset.text.erb", force: true
-            end
+        # Replaces the base generator's stateless generates_token_for password reset
+        # with DB-backed, revocable tokens.
+        def generate_recoverable
+          template "app/models/concerns/recoverable_concern.rb"
+          include_concern_in_user "RecoverableConcern"
+          migration_template "db/migrate/add_recoverable_to_users.rb", "db/migrate/add_recoverable_to_users.rb"
+          template "app/controllers/passwords_controller.rb", force: true
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/passwords_mailer.rb", force: true
+            template "app/views/passwords_mailer/reset.html.erb", force: true
+            template "app/views/passwords_mailer/reset.text.erb", force: true
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/registerable.rb

@@ -5,12 +5,13 @@ module RailsAuthentication
     module Features
       module Registerable
         private
-          def generate_registerable
-            template "app/controllers/registrations_controller.rb"
-            template "app/views/registrations/new.html.erb"
-            template "app/views/registrations/edit.html.erb"
-            route "resource :registration, only: %i[ new create edit update destroy ]"
-          end
+
+        def generate_registerable
+          template "app/controllers/registrations_controller.rb"
+          template "app/views/registrations/new.html.erb"
+          template "app/views/registrations/edit.html.erb"
+          route "resource :registration, only: %i[ new create edit update destroy ]"
+        end
       end
     end
   end

data/lib/generators/authentication/features/rememberable.rb

@@ -5,11 +5,12 @@ module RailsAuthentication
     module Features
       module Rememberable
         private
-          def generate_rememberable
-            template "app/models/concerns/rememberable_concern.rb"
-            include_concern_in_user "RememberableConcern"
-            migration_template "db/migrate/add_rememberable_to_users.rb", "db/migrate/add_rememberable_to_users.rb"
-          end
+
+        def generate_rememberable
+          template "app/models/concerns/rememberable_concern.rb"
+          include_concern_in_user "RememberableConcern"
+          migration_template "db/migrate/add_rememberable_to_users.rb", "db/migrate/add_rememberable_to_users.rb"
+        end
       end
     end
   end

data/lib/generators/authentication/features/timeoutable.rb

@@ -5,12 +5,13 @@ module RailsAuthentication
     module Features
       module Timeoutable
         private
-          # No migration: inactivity is measured against sessions.updated_at, which the
-          # base generator's sessions table already has.
-          def generate_timeoutable
-            template "app/models/concerns/timeoutable_concern.rb"
-            include_concern_in_user "TimeoutableConcern"
-          end
+
+        # No migration: inactivity is measured against sessions.updated_at, which the
+        # base generator's sessions table already has.
+        def generate_timeoutable
+          template "app/models/concerns/timeoutable_concern.rb"
+          include_concern_in_user "TimeoutableConcern"
+        end
       end
     end
   end

data/lib/generators/authentication/features/trackable.rb

@@ -5,12 +5,13 @@ module RailsAuthentication
     module Features
       module Trackable
         private
-          def generate_trackable
-            template "app/models/concerns/trackable_concern.rb"
-            include_concern_in_user "TrackableConcern"
-            template "app/models/user_auth.rb"
-            migration_template "db/migrate/create_user_auths.rb", "db/migrate/create_user_auths.rb"
-          end
+
+        def generate_trackable
+          template "app/models/concerns/trackable_concern.rb"
+          include_concern_in_user "TrackableConcern"
+          template "app/models/user_auth.rb"
+          migration_template "db/migrate/create_user_auths.rb", "db/migrate/create_user_auths.rb"
+        end
       end
     end
   end

data/lib/generators/authentication/features/validatable.rb

@@ -5,10 +5,11 @@ module RailsAuthentication
     module Features
       module Validatable
         private
-          def generate_validatable
-            template "app/models/concerns/validatable_concern.rb"
-            include_concern_in_user "ValidatableConcern"
-          end
+
+        def generate_validatable
+          template "app/models/concerns/validatable_concern.rb"
+          include_concern_in_user "ValidatableConcern"
+        end
       end
     end
   end