rails_authentication 0.3.0 → 0.5.0

data/lib/generators/authentication/templates/app/controllers/otts_controller.rb.tt

@@ -0,0 +1,95 @@
+class OttsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: %i[ create update ], with: -> { redirect_to new_session_path, alert: "Try again later." }
+
+  def create
+    email_address = params[:email_address].presence || session[:ott_email_address]
+    user = User.find_by(email_address: email_address)
+    user&.send_ott
+    session[:ott_email_address] = email_address
+
+    redirect_to edit_ott_path, notice: "We've emailed you a sign-in code (if a user with that email address exists)."
+  end
+
+  def edit
+    redirect_to new_session_path if session[:ott_email_address].blank?
+  end
+
+  def update
+    user = User.find_by(email_address: session[:ott_email_address])
+
+    case user && user.verify_ott(params[:code])
+    when nil, :expired
+      redirect_to new_session_path, alert: "Your sign-in code is invalid or has expired. Request a new one."
+    when :exhausted
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "ott_attempts_exhausted")
+<% end -%>
+      redirect_to new_session_path, alert: "Too many incorrect attempts. Request a new code."
+    when :invalid
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "invalid_ott")
+<% end -%>
+      redirect_to edit_ott_path, alert: "Incorrect code. Try again."
+    else
+      complete_ott_sign_in(user)
+    end
+  end
+
+  private
+
+  def complete_ott_sign_in(user)
+<% if lockable? -%>
+    if user.locked?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "locked")
+<% end -%>
+      return redirect_to new_session_path, alert: "Your account is locked. Check your email for unlock instructions."
+    end
+<% end -%>
+<% if confirmable? -%>
+    unless user.confirmed?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "unconfirmed")
+<% end -%>
+      return redirect_to new_session_path, alert: "You must confirm your email address before signing in."
+    end
+<% end -%>
+<% if invitable? -%>
+    if user.invitation_pending?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "invitation_pending")
+<% end -%>
+      return redirect_to new_session_path, alert: "You must accept your invitation before signing in."
+    end
+<% end -%>
+    # Add your own authentication restrictions specific to your application
+    # if user.deleted_at.present?
+<% if trackable? -%>
+    #   record_authentication_attempt(user, success: false, failure_reason: "soft_deleted")
+<% end -%>
+    #   return redirect_to new_session_path, alert: "Your account is not available."
+    # end
+
+    user.consume_ott!
+    session.delete(:ott_email_address)
+<% if lockable? -%>
+    user.reset_failed_attempts!
+<% end -%>
+<% if trackable? -%>
+    record_authentication_attempt(user, success: true)
+<% end -%>
+<% if rememberable? -%>
+    start_new_session_for user, remember: params[:remember_me] == "1"
+<% else -%>
+    start_new_session_for user
+<% end -%>
+    redirect_to after_authentication_url
+  end
+<% if trackable? -%>
+
+  def record_authentication_attempt(user, success:, failure_reason: nil)
+    UserAuth.record(user, request, success: success, failure_reason: failure_reason)
+  end
+<% end -%>
+end

data/lib/generators/authentication/templates/app/controllers/passkey_sessions_controller.rb.tt

@@ -0,0 +1,68 @@
+class PasskeySessionsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { render json: { error: "Try again later." }, status: :too_many_requests }
+
+  def create
+    webauthn_credential = WebAuthn::Credential.from_get(params)
+    stored_credential = WebauthnCredential.find_by(external_id: webauthn_credential.id)
+
+    if stored_credential.nil?
+      return render json: { error: "Passkey not recognized." }, status: :unprocessable_content
+    end
+
+    begin
+      webauthn_credential.verify(
+        session[:webauthn_authentication_challenge],
+        public_key: stored_credential.public_key,
+        sign_count: stored_credential.sign_count
+      )
+    rescue WebAuthn::Error
+      return render json: { error: "Passkey verification failed." }, status: :unprocessable_content
+    end
+
+    stored_credential.update!(sign_count: webauthn_credential.sign_count)
+    user = stored_credential.user
+    session.delete(:webauthn_authentication_challenge)
+
+<% if lockable? -%>
+    if user.locked?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "locked")
+<% end -%>
+      return render json: { error: "Your account is locked. Check your email for unlock instructions." }, status: :unprocessable_content
+    end
+<% end -%>
+<% if confirmable? -%>
+    unless user.confirmed?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "unconfirmed")
+<% end -%>
+      return render json: { error: "You must confirm your email address before signing in." }, status: :unprocessable_content
+    end
+<% end -%>
+<% if invitable? -%>
+    if user.invitation_pending?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "invitation_pending")
+<% end -%>
+      return render json: { error: "You must accept your invitation before signing in." }, status: :unprocessable_content
+    end
+<% end -%>
+<% if lockable? -%>
+    user.reset_failed_attempts!
+<% end -%>
+<% if trackable? -%>
+    record_authentication_attempt(user, success: true)
+<% end -%>
+    start_new_session_for user
+    render json: { redirect_to: after_authentication_url }
+  end
+<% if trackable? -%>
+
+  private
+
+  def record_authentication_attempt(user, success:, failure_reason: nil)
+    UserAuth.record(user, request, success: success, failure_reason: failure_reason)
+  end
+<% end -%>
+end

data/lib/generators/authentication/templates/app/controllers/sessions_controller.rb.tt

@@ -3,6 +3,10 @@ class SessionsController < ApplicationController
   rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: "Try again later." }
 
   def new
+<% if passkey? -%>
+    @webauthn_credential_options = WebAuthn::Credential.options_for_get(user_verification: "required")
+    session[:webauthn_authentication_challenge] = @webauthn_credential_options.challenge
+<% end -%>
   end
 
   def create

data/lib/generators/authentication/templates/app/controllers/webauthn_credentials_controller.rb.tt

@@ -0,0 +1,43 @@
+class WebauthnCredentialsController < ApplicationController
+  before_action :set_webauthn_credential, only: :destroy
+
+  def index
+    @webauthn_credentials = current_user.webauthn_credentials.order(:created_at)
+  end
+
+  def new
+    @webauthn_credential_options = WebAuthn::Credential.options_for_create(
+      user: { id: current_user.webauthn_id, name: current_user.email_address },
+      exclude: current_user.webauthn_credentials.pluck(:external_id)
+    )
+    session[:webauthn_registration_challenge] = @webauthn_credential_options.challenge
+  end
+
+  def create
+    webauthn_credential = WebAuthn::Credential.from_create(params)
+    webauthn_credential.verify(session[:webauthn_registration_challenge])
+
+    current_user.webauthn_credentials.create!(
+      external_id: webauthn_credential.id,
+      public_key: webauthn_credential.public_key,
+      sign_count: webauthn_credential.sign_count,
+      nickname: params[:nickname].presence || "Passkey"
+    )
+    session.delete(:webauthn_registration_challenge)
+
+    render json: { redirect_to: webauthn_credentials_path }
+  rescue WebAuthn::Error => e
+    render json: { error: e.message }, status: :unprocessable_content
+  end
+
+  def destroy
+    @webauthn_credential.destroy
+    redirect_to webauthn_credentials_path, notice: "Passkey removed."
+  end
+
+  private
+
+  def set_webauthn_credential
+    @webauthn_credential = current_user.webauthn_credentials.find(params[:id])
+  end
+end

data/lib/generators/authentication/templates/app/mailers/otts_mailer.rb.tt

@@ -0,0 +1,6 @@
+class OttsMailer < ApplicationMailer
+  def ott(user)
+    @user = user
+    mail subject: "Your sign-in code", to: user.email_address
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/confirmable_concern.rb.tt

@@ -47,28 +47,29 @@ module ConfirmableConcern
   def generate_confirmation_token!
     update!(confirmation_token: generate_confirmable_token, confirmation_sent_at: Time.current)
   end
+
+  protected
+
+  def generate_confirmable_token
+    SecureRandom.urlsafe_base64(32)
+  end
 <% if reconfirmable? -%>
 
   private
-    def postponing_email_address_change?
-      !@confirming && email_address_changed? && confirmed?
-    end
-
-    def postpone_email_address_change
-      self.unconfirmed_email = email_address
-      self.email_address = email_address_in_database
-      self.confirmation_token = generate_confirmable_token
-      self.confirmation_sent_at = Time.current
-    end
 
-    def deliver_reconfirmation_instructions
-      ConfirmationsMailer.confirmation_instructions(self).deliver_later
-    end
-<% end -%>
+  def postponing_email_address_change?
+    !@confirming && email_address_changed? && confirmed?
+  end
 
-  protected
+  def postpone_email_address_change
+    self.unconfirmed_email = email_address
+    self.email_address = email_address_in_database
+    self.confirmation_token = generate_confirmable_token
+    self.confirmation_sent_at = Time.current
+  end
 
-  def generate_confirmable_token
-    SecureRandom.urlsafe_base64(32)
+  def deliver_reconfirmation_instructions
+    ConfirmationsMailer.confirmation_instructions(self).deliver_later
   end
+<% end -%>
 end

data/lib/generators/authentication/templates/app/models/concerns/ott_concern.rb.tt

@@ -0,0 +1,50 @@
+module OttConcern
+  extend ActiveSupport::Concern
+
+  OTT_EXPIRES_IN = 10.minutes
+  OTT_MAX_ATTEMPTS = 5
+  OTT_CODE_LENGTH = 6
+
+  def send_ott
+    generate_ott!
+    OttsMailer.ott(self).deliver_later
+  end
+
+  def generate_ott!
+    update!(ott_code: build_ott_code, ott_sent_at: Time.current, ott_attempts: 0)
+  end
+
+  # Returns :valid, :invalid, :exhausted, or :expired. Codes are single-use:
+  # consumed on successful sign-in, and voided once OTT_MAX_ATTEMPTS wrong
+  # codes have been entered.
+  def verify_ott(code)
+    return :expired unless ott_active?
+
+    if ActiveSupport::SecurityUtils.secure_compare(ott_code, code.to_s)
+      :valid
+    else
+      increment!(:ott_attempts)
+
+      if ott_attempts >= OTT_MAX_ATTEMPTS
+        consume_ott!
+        :exhausted
+      else
+        :invalid
+      end
+    end
+  end
+
+  def consume_ott!
+    update!(ott_code: nil, ott_sent_at: nil, ott_attempts: 0)
+  end
+
+  protected
+
+  def ott_active?
+    ott_code.present? && ott_sent_at&.after?(OTT_EXPIRES_IN.ago)
+  end
+
+  def build_ott_code
+    SecureRandom.random_number(10**OTT_CODE_LENGTH).to_s.rjust(OTT_CODE_LENGTH, "0")
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/passkey_concern.rb.tt

@@ -0,0 +1,19 @@
+module PasskeyConcern
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :webauthn_credentials, dependent: :destroy
+
+    before_validation :ensure_webauthn_id, on: :create
+  end
+
+  def passkeys?
+    webauthn_credentials.exists?
+  end
+
+  private
+
+  def ensure_webauthn_id
+    self.webauthn_id ||= WebAuthn.generate_user_id
+  end
+end

data/lib/generators/authentication/templates/app/models/webauthn_credential.rb.tt

@@ -0,0 +1,6 @@
+class WebauthnCredential < ApplicationRecord
+  belongs_to :user
+
+  validates :external_id, presence: true, uniqueness: true
+  validates :public_key, presence: true
+end

data/lib/generators/authentication/templates/app/views/otts/edit.html.erb.tt

@@ -0,0 +1,79 @@
+<h1>Enter your sign-in code</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<p>
+  We emailed a <%%= OttConcern::OTT_CODE_LENGTH %>-digit code to <%%= session[:ott_email_address] %>.
+  It expires in <%%= distance_of_time_in_words(0, OttConcern::OTT_EXPIRES_IN) %>.
+</p>
+
+<%%= form_with url: ott_path, method: :patch do |form| %>
+  <%%= form.hidden_field :code, id: "ott-code" %>
+  <div id="ott-digits">
+    <%% OttConcern::OTT_CODE_LENGTH.times do |i| %>
+      <input type="text" inputmode="numeric" pattern="[0-9]*" maxlength="<%%= OttConcern::OTT_CODE_LENGTH %>" required
+             autocomplete="<%%= i.zero? ? "one-time-code" : "off" %>"
+             aria-label="Digit <%%= i + 1 %>" <%%= "autofocus" if i.zero? %>
+             style="width:2em;text-align:center;font-size:1.5em">
+    <%% end %>
+  </div>
+  <br>
+<% if rememberable? -%>
+  <%%= form.check_box :remember_me %> <%%= form.label :remember_me, "Remember me" %><br>
+<% end -%>
+  <%%= form.submit "Sign in" %>
+<%% end %>
+<br>
+
+<%%= button_to "Resend code", ott_path, method: :post %>
+
+<script>
+  (function() {
+    var boxes = Array.prototype.slice.call(document.querySelectorAll("#ott-digits input"));
+    var hidden = document.getElementById("ott-code");
+
+    function sync() {
+      hidden.value = boxes.map(function(box) { return box.value; }).join("");
+    }
+
+    // Distributes a string of digits across the boxes, starting at `start`.
+    function fill(text, start) {
+      var digits = text.replace(/\D/g, "").slice(0, boxes.length - start).split("");
+      digits.forEach(function(digit, i) { boxes[start + i].value = digit; });
+      boxes[Math.min(start + digits.length, boxes.length - 1)].focus();
+      sync();
+    }
+
+    boxes.forEach(function(box, i) {
+      box.addEventListener("input", function() {
+        // A multi-character value means a paste or OS one-time-code autofill.
+        if (box.value.length > 1) return fill(box.value, i);
+
+        box.value = box.value.replace(/\D/g, "");
+        if (box.value && i < boxes.length - 1) boxes[i + 1].focus();
+        sync();
+      });
+
+      box.addEventListener("keydown", function(event) {
+        if (event.key === "Backspace" && !box.value && i > 0) {
+          event.preventDefault();
+          boxes[i - 1].value = "";
+          boxes[i - 1].focus();
+          sync();
+        } else if (event.key === "ArrowLeft" && i > 0) {
+          event.preventDefault();
+          boxes[i - 1].focus();
+        } else if (event.key === "ArrowRight" && i < boxes.length - 1) {
+          event.preventDefault();
+          boxes[i + 1].focus();
+        }
+      });
+
+      box.addEventListener("paste", function(event) {
+        event.preventDefault();
+        fill((event.clipboardData || window.clipboardData).getData("text"), 0);
+      });
+    });
+  })();
+</script>

data/lib/generators/authentication/templates/app/views/otts_mailer/ott.html.erb.tt

@@ -0,0 +1,8 @@
+<p>Your sign-in code is:</p>
+
+<p><strong><%%= @user.ott_code %></strong></p>
+
+<p>
+  This code will expire in <%%= distance_of_time_in_words(0, OttConcern::OTT_EXPIRES_IN) %> and can only be used once.
+  If you didn't request it, you can ignore this email.
+</p>

data/lib/generators/authentication/templates/app/views/otts_mailer/ott.text.erb.tt

@@ -0,0 +1,6 @@
+Your sign-in code is:
+
+<%%= @user.ott_code %>
+
+This code will expire in <%%= distance_of_time_in_words(0, OttConcern::OTT_EXPIRES_IN) %> and can only be used once.
+If you didn't request it, you can ignore this email.

data/lib/generators/authentication/templates/app/views/registrations/edit.html.erb.tt

@@ -19,4 +19,8 @@
 <%% end %>
 <br>
 
+<% if passkey? -%>
+<%%= link_to "Manage your passkeys", webauthn_credentials_path %>
+<br><br>
+<% end -%>
 <%%= button_to "Delete my account", registration_path, method: :delete, data: { turbo_confirm: "Are you sure?" } %>

data/lib/generators/authentication/templates/app/views/sessions/new.html.erb.tt

@@ -1,6 +1,17 @@
 <%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
 <%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
 
+<% if ott? -%>
+<%% if params[:with_password].blank? %>
+<%%= form_with url: ott_path do |form| %>
+  <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address] %><br>
+  <%%= form.submit "Email me a sign-in code" %>
+<%% end %>
+<br>
+
+<br><%%= link_to "Sign in with password instead", new_session_path(with_password: 1) %>
+<%% else %>
+<% end -%>
 <%%= form_with url: session_path do |form| %>
   <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address] %><br>
   <%%= form.password_field :password, required: true, autocomplete: "current-password", placeholder: "Enter your password", maxlength: 72 %><br>
@@ -10,10 +21,80 @@
   <%%= form.submit "Sign in" %>
 <%% end %>
 <br>
+<% if ott? -%>
+
+<br><%%= link_to "Sign in with a one-time code instead", new_session_path %>
+<%% end %>
+<% end -%>
 
 <% if magic_link? -%>
 <br><%%= link_to "Sign in with magic link", new_magic_link_path %>
 <% end -%>
+<% if passkey? -%>
+<br><%%= button_tag "Sign in with a passkey", type: "button", id: "passkey-sign-in-button" %>
+<%%= tag.span "", id: "passkey-sign-in-error", style: "color:red" %>
+
+<%%= javascript_tag do %>
+  (function () {
+    function bufferEncode(value) {
+      return btoa(String.fromCharCode.apply(null, new Uint8Array(value)))
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+
+    function bufferDecode(value) {
+      const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+      const raw = window.atob(padded);
+      const buffer = new Uint8Array(raw.length);
+      for (let i = 0; i < raw.length; i++) buffer[i] = raw.charCodeAt(i);
+      return buffer.buffer;
+    }
+
+    document.getElementById("passkey-sign-in-button").addEventListener("click", async function () {
+      const options = <%%= raw @webauthn_credential_options.to_json %>;
+      options.challenge = bufferDecode(options.challenge);
+      if (options.allowCredentials) {
+        options.allowCredentials = options.allowCredentials.map(function (cred) {
+          return Object.assign({}, cred, { id: bufferDecode(cred.id) });
+        });
+      }
+
+      let credential;
+      try {
+        credential = await navigator.credentials.get({ publicKey: options });
+      } catch (error) {
+        document.getElementById("passkey-sign-in-error").textContent = error.message;
+        return;
+      }
+
+      const response = await fetch("<%%= passkey_session_path %>", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-CSRF-Token": document.querySelector('meta[name="csrf-token"]').content
+        },
+        body: JSON.stringify({
+          id: credential.id,
+          rawId: bufferEncode(credential.rawId),
+          type: credential.type,
+          response: {
+            clientDataJSON: bufferEncode(credential.response.clientDataJSON),
+            authenticatorData: bufferEncode(credential.response.authenticatorData),
+            signature: bufferEncode(credential.response.signature),
+            userHandle: credential.response.userHandle ? bufferEncode(credential.response.userHandle) : null
+          }
+        })
+      });
+
+      const result = await response.json();
+      if (response.ok) {
+        window.location.href = result.redirect_to;
+      } else {
+        document.getElementById("passkey-sign-in-error").textContent = result.error || "Could not sign in with passkey.";
+      }
+    });
+  })();
+<%% end %>
+<% end -%>
 <br><%%= link_to "Forgot password?", new_password_path %>
 <% if registerable? -%>
 <br><%%= link_to "Sign up", new_registration_path %>

data/lib/generators/authentication/templates/app/views/webauthn_credentials/index.html.erb.tt

@@ -0,0 +1,19 @@
+<h1>Your passkeys</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<%% if @webauthn_credentials.empty? %>
+  <p>You haven't added a passkey yet.</p>
+<%% else %>
+  <ul>
+    <%% @webauthn_credentials.each do |credential| %>
+      <li>
+        <%%= credential.nickname %> &mdash; added <%%= credential.created_at.to_date %>
+        <%%= button_to "Remove", webauthn_credential_path(credential), method: :delete, data: { turbo_confirm: "Remove this passkey?" } %>
+      </li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<br><%%= link_to "Add a passkey", new_webauthn_credential_path %>

data/lib/generators/authentication/templates/app/views/webauthn_credentials/new.html.erb.tt

@@ -0,0 +1,71 @@
+<h1>Add a passkey</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.span "", id: "passkey-error", style: "color:red" %>
+
+<%%= label_tag :passkey_nickname, "Name this passkey (e.g. \"MacBook\" or \"iPhone\")" %>
+<%%= text_field_tag :passkey_nickname, nil, placeholder: "Passkey" %><br><br>
+
+<%%= button_tag "Create passkey", type: "button", id: "create-passkey-button" %>
+
+<%%= javascript_tag do %>
+  (function () {
+    function bufferEncode(value) {
+      return btoa(String.fromCharCode.apply(null, new Uint8Array(value)))
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+
+    function bufferDecode(value) {
+      const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+      const raw = window.atob(padded);
+      const buffer = new Uint8Array(raw.length);
+      for (let i = 0; i < raw.length; i++) buffer[i] = raw.charCodeAt(i);
+      return buffer.buffer;
+    }
+
+    document.getElementById("create-passkey-button").addEventListener("click", async function () {
+      const options = <%%= raw @webauthn_credential_options.to_json %>;
+
+      options.challenge = bufferDecode(options.challenge);
+      options.user.id = bufferDecode(options.user.id);
+      if (options.excludeCredentials) {
+        options.excludeCredentials = options.excludeCredentials.map(function (cred) {
+          return Object.assign({}, cred, { id: bufferDecode(cred.id) });
+        });
+      }
+
+      let credential;
+      try {
+        credential = await navigator.credentials.create({ publicKey: options });
+      } catch (error) {
+        document.getElementById("passkey-error").textContent = error.message;
+        return;
+      }
+
+      const response = await fetch("<%%= webauthn_credentials_path %>", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-CSRF-Token": document.querySelector('meta[name="csrf-token"]').content
+        },
+        body: JSON.stringify({
+          id: credential.id,
+          rawId: bufferEncode(credential.rawId),
+          type: credential.type,
+          nickname: document.getElementById("passkey_nickname").value,
+          response: {
+            clientDataJSON: bufferEncode(credential.response.clientDataJSON),
+            attestationObject: bufferEncode(credential.response.attestationObject)
+          }
+        })
+      });
+
+      const result = await response.json();
+      if (response.ok) {
+        window.location.href = result.redirect_to;
+      } else {
+        document.getElementById("passkey-error").textContent = result.error || "Could not save passkey.";
+      }
+    });
+  })();
+<%% end %>

data/lib/generators/authentication/templates/config/initializers/webauthn.rb.tt

@@ -0,0 +1,11 @@
+WebAuthn.configure do |config|
+  # This value needs to match `window.location.hostname` where the API is called from in
+  # your client-side (front-end) code.
+  # config.rp_id = "example.com"
+
+  # This value needs to match `window.location.origin` where the API is called from in
+  # your client-side (front-end) code.
+  # config.allowed_origins = ["https://example.com"]
+
+  config.rp_name = Rails.application.class.module_parent_name
+end

data/lib/generators/authentication/templates/db/migrate/add_ott_to_users.rb.tt

@@ -0,0 +1,7 @@
+class AddOttToUsers < ActiveRecord::Migration<%= migration_version %>
+  def change
+    add_column :users, :ott_code, :string
+    add_column :users, :ott_sent_at, :datetime
+    add_column :users, :ott_attempts, :integer, default: 0, null: false
+  end
+end