rails_authentication 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f5c0f93e4dc6c9eb2562c7804920c82cff3a5a7d23d15758aaee3d63cdb60d99
-  data.tar.gz: 60ee05fafe8ffd4d9f56c10aa57c9ea5d347b801e94d3651ba2b04b258545a13
+  metadata.gz: 6369064c5074eb057abc1ed169b7efbe7ae0758730dc6c764b86fee19f96b0d3
+  data.tar.gz: 5bdc5cb01eb60fed2449f0a1544d29102c79f917faf345f86a1a86bca6b6adc6
 SHA512:
-  metadata.gz: bfd4e4526f964ef0ec6f0004b85061b64b86e6885c4e383adae282396b769f50e300de8e5424bd9892b59d5bae499d428be4719c6d8cdab0ec07fd76b64f5f3a
-  data.tar.gz: d4c2cb6365fd97356977944566aa332772c751061fcf8b1ad4b9e57b6d4eb7f0cd65ee497493d79286b1efb8bf85b897933e635b914e38a8994e419af61c1961
+  metadata.gz: da49badfb4b8c58c2525329479154961cb10cbd6b6d683a4dbc56171198e9ad1d1f31d097455f106d47d19332a14391ee0e4370394aa23535e85b47be6ebf0f8
+  data.tar.gz: 4407fbc0f0c7daafc4324fb1e0ba7c366c4c810fa81b579bf464fd2f2e31b7d5e3da6c6e8741b189e0399a28660b4e0a728d80b1bfec63282eee3f8c0d204756

data/README.md

@@ -19,6 +19,7 @@ gem extends that same command to also install:
 | **Invitable** | Invite users by email; blocks sign-in until they accept by choosing their own password |
 | **MagicLink** (opt-in) | Passwordless magic link sign-in via email — DB-backed, single-use, expiring tokens |
 | **Ott** (opt-in) | Passwordless sign-in via an emailed 6-digit one-time code — replaces the password sign-in form |
+| **Passkey** (opt-in) | WebAuthn passkey sign-in alongside the password form — usernameless, no email required |
 
 Everything is **generated into your app** as plain, readable code — controllers, views, mailers,
 migrations, and one model concern per feature. There is no runtime dependency on this gem: after
@@ -57,12 +58,13 @@ Available flags: `--skip-confirmable`, `--skip-recoverable`, `--skip-registerabl
 `--skip-lockable`, `--skip-invitable`, and `--reconfirmable` (Confirmable: postpone email address
 changes until the new address is confirmed, via an `unconfirmed_email` column).
 
-MagicLink and Ott are **opt-in** features — they change the sign-in UX, so you have to ask for
-them:
+MagicLink, Ott, and Passkey are **opt-in** features — they change the sign-in UX, so you have to
+ask for them:
 
 ```sh
 bin/rails generate authentication --magic-link
 bin/rails generate authentication --ott
+bin/rails generate authentication --passkey
 ```
 
 MagicLink adds a "Sign in with magic link" link to the sign-in page, leading to an email-only
@@ -79,8 +81,16 @@ and are voided after 5 wrong entries (`OttConcern::OTT_MAX_ATTEMPTS`). The passw
 (SessionsController#create, Recoverable, Registerable) stays generated and functional — only the
 sign-in UI changes.
 
-Both flows honor the other enabled features: locked, unconfirmed, or invitation-pending accounts
-still can't sign in, and Trackable records the attempt.
+Passkey adds a "Sign in with a passkey" button to the sign-in page (no email field — the
+browser's own discoverable-credential picker takes its place) plus an authenticated
+`/webauthn_credentials` section where a signed-in user can register and remove passkeys (linked
+from the account page when Registerable is enabled). Unlike every other feature here, this one
+brings a real runtime dependency: the generator adds `gem "webauthn"` to your Gemfile for you (with
+a reminder to run `bundle install`), since ceremony verification is delegated to it. A user can
+register any number of passkeys, each stored as its own row in `webauthn_credentials`.
+
+All three flows honor the other enabled features: locked, unconfirmed, or invitation-pending
+accounts still can't sign in, and Trackable records the attempt.
 
 Each feature adds a single `include <Feature>Concern` line to `app/models/user.rb`; all of its
 model behavior lives in `app/models/concerns/<feature>_concern.rb`. Tunables are plain constants in
@@ -98,6 +108,8 @@ resources :unlocks,       only: %i[ new create show ], param: :token
 resources :invitations,   only: %i[ new create edit update ], param: :token
 resources :magic_links,   only: %i[ new create show ], param: :token   # with --magic-link
 resource  :ott,           only: %i[ create edit update ]               # with --ott
+resources :webauthn_credentials, only: %i[ index new create destroy ]  # with --passkey
+resource  :passkey_session, only: %i[ create ]                         # with --passkey
 resource  :session                      # from the base generator
 resources :passwords, param: :token     # from the base generator
 ```
@@ -114,10 +126,6 @@ resources :passwords, param: :token     # from the base generator
   sessions view with versions tailored to the features you selected. Run the generator once, up
   front — re-running it after you've customized those files will prompt to overwrite them.
 
-## Future Plans
-
-- Passkey
-
 ## Development
 
 ```sh
@@ -131,6 +139,53 @@ bundle exec rspec spec/generators/lockable_spec.rb:12   # a single example
 `spec/dummy` is generated (and gitignored), never hand-maintained, so the request specs always
 exercise exactly what the templates produce.
 
+To run the app using the dummy app generated in `spec/dummy`, run `bin/dev`
+
+## Appraisal
+
+Install Appraisal dependencies or when a new Appraisal is added, generate the .gemfile
+
+```sh
+bundle exec appraisal generate-install
+```
+
+Run tests with Appraisal
+
+```sh
+bin/appraisal
+```
+
+Run a specific Appraisal test
+
+```sh
+# rails-8.0-json-2
+bundle exec appraisal rails-8.0-json-2 rake spec:generators
+bundle exec appraisal rails-8.0-json-2 rake dummy:prepare
+bundle exec appraisal rails-8.0-json-2 rake spec:requests
+# rails-8.0-json-3
+bundle exec appraisal rails-8.0-json-3 rake spec:generators
+bundle exec appraisal rails-8.0-json-3 rake dummy:prepare
+bundle exec appraisal rails-8.0-json-3 rake spec:requests
+# rails-8.1-json-2
+bundle exec appraisal rails-8.1-json-2 rake spec:generators
+bundle exec appraisal rails-8.1-json-2 rake dummy:prepare
+bundle exec appraisal rails-8.1-json-2 rake spec:requests
+# rails-8.1-json-3
+bundle exec appraisal rails-8.1-json-3 rake spec:generators
+bundle exec appraisal rails-8.1-json-3 rake dummy:prepare
+bundle exec appraisal rails-8.1-json-3 rake spec:requests
+```
+
+## json 3.0 gem compatibility
+
+`json` 3.0 gem removed the `quirks_mode:` keyword and made `JSON.generate`/`JSON.parse`'s second argument keyword-only. Rails' `ActiveSupport::JSON` still calls both with `quirks_mode: true` positionally, so every
+cookie/session read or write throws `ArgumentError` under json 3. `bin/prepare_dummy`
+writes `spec/dummy/config/initializers/json_quirks_mode_compat.rb`, which prepends a shim onto
+`JSON.generate`/`.parse` that strips `quirks_mode` and re-passes remaining options via `**opts`
+(so it works whether the resolved `JSON.parse` still takes a positional options hash, json 2.x,
+or keywords only, json 3.x). It no-ops under json 2.x (`Gem::Version.new(::JSON::VERSION) >=
+Gem::Version.new("3.0")` gates it) and is safe to delete once Rails or json fixes this upstream.
+
 ## License
 
 MIT

data/lib/generators/authentication/authentication_generator.rb

@@ -13,6 +13,7 @@ require_relative "features/lockable"
 require_relative "features/invitable"
 require_relative "features/magic_link"
 require_relative "features/ott"
+require_relative "features/passkey"
 
 module RailsAuthentication
   module Generators
@@ -46,6 +47,7 @@ module RailsAuthentication
       include Features::Invitable
       include Features::MagicLink
       include Features::Ott
+      include Features::Passkey
 
       source_root File.expand_path("templates", __dir__)
 
@@ -68,6 +70,11 @@ module RailsAuthentication
       class_option :ott, type: :boolean, default: false,
         desc: "Add one-time token (emailed 6-digit code) sign-in (opt-in)"
 
+      # Also opt-in: WebAuthn passkey sign-in alongside password sign-in.
+      # Requires the host app to add the `webauthn` gem itself.
+      class_option :passkey, type: :boolean, default: false,
+        desc: "Add WebAuthn passkey sign-in (opt-in; requires the webauthn gem)"
+
       def install_base_authentication
         say "Running Rails' built-in authentication generator", :green
         Rails::Generators.invoke("rails:authentication", [], behavior: behavior, destination_root: destination_root)
@@ -117,6 +124,10 @@ module RailsAuthentication
         generate_ott if ott?
       end
 
+      def install_passkey
+        generate_passkey if passkey?
+      end
+
       # Runs after every feature install so the blank line separates the concern
       # includes (if any) from the rest of the class body, no matter which features
       # are enabled.
@@ -151,6 +162,10 @@ module RailsAuthentication
           options[:ott]
         end
 
+        def passkey?
+          options[:passkey]
+        end
+
         def include_concern_in_user(concern)
           inject_into_class "app/models/user.rb", "User", "  include #{concern}\n"
         end

data/lib/generators/authentication/features/confirmable.rb

@@ -5,20 +5,21 @@ module RailsAuthentication
     module Features
       module Confirmable
         private
-          def generate_confirmable
-            template "app/models/concerns/confirmable_concern.rb"
-            include_concern_in_user "ConfirmableConcern"
-            migration_template "db/migrate/add_confirmable_to_users.rb", "db/migrate/add_confirmable_to_users.rb"
-            template "app/controllers/confirmations_controller.rb"
-            template "app/views/confirmations/new.html.erb"
-            route "resources :confirmations, only: %i[ new create show ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/confirmations_mailer.rb"
-              template "app/views/confirmations_mailer/confirmation_instructions.html.erb"
-              template "app/views/confirmations_mailer/confirmation_instructions.text.erb"
-            end
+        def generate_confirmable
+          template "app/models/concerns/confirmable_concern.rb"
+          include_concern_in_user "ConfirmableConcern"
+          migration_template "db/migrate/add_confirmable_to_users.rb", "db/migrate/add_confirmable_to_users.rb"
+          template "app/controllers/confirmations_controller.rb"
+          template "app/views/confirmations/new.html.erb"
+          route "resources :confirmations, only: %i[ new create show ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/confirmations_mailer.rb"
+            template "app/views/confirmations_mailer/confirmation_instructions.html.erb"
+            template "app/views/confirmations_mailer/confirmation_instructions.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/invitable.rb

@@ -5,21 +5,22 @@ module RailsAuthentication
     module Features
       module Invitable
         private
-          def generate_invitable
-            template "app/models/concerns/invitable_concern.rb"
-            include_concern_in_user "InvitableConcern"
-            migration_template "db/migrate/add_invitable_to_users.rb", "db/migrate/add_invitable_to_users.rb"
-            template "app/controllers/invitations_controller.rb"
-            template "app/views/invitations/new.html.erb"
-            template "app/views/invitations/edit.html.erb"
-            route "resources :invitations, only: %i[ new create edit update ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/invitations_mailer.rb"
-              template "app/views/invitations_mailer/invitation_instructions.html.erb"
-              template "app/views/invitations_mailer/invitation_instructions.text.erb"
-            end
+        def generate_invitable
+          template "app/models/concerns/invitable_concern.rb"
+          include_concern_in_user "InvitableConcern"
+          migration_template "db/migrate/add_invitable_to_users.rb", "db/migrate/add_invitable_to_users.rb"
+          template "app/controllers/invitations_controller.rb"
+          template "app/views/invitations/new.html.erb"
+          template "app/views/invitations/edit.html.erb"
+          route "resources :invitations, only: %i[ new create edit update ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/invitations_mailer.rb"
+            template "app/views/invitations_mailer/invitation_instructions.html.erb"
+            template "app/views/invitations_mailer/invitation_instructions.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/lockable.rb

@@ -5,20 +5,21 @@ module RailsAuthentication
     module Features
       module Lockable
         private
-          def generate_lockable
-            template "app/models/concerns/lockable_concern.rb"
-            include_concern_in_user "LockableConcern"
-            migration_template "db/migrate/add_lockable_to_users.rb", "db/migrate/add_lockable_to_users.rb"
-            template "app/controllers/unlocks_controller.rb"
-            template "app/views/unlocks/new.html.erb"
-            route "resources :unlocks, only: %i[ new create show ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/unlocks_mailer.rb"
-              template "app/views/unlocks_mailer/unlock_instructions.html.erb"
-              template "app/views/unlocks_mailer/unlock_instructions.text.erb"
-            end
+        def generate_lockable
+          template "app/models/concerns/lockable_concern.rb"
+          include_concern_in_user "LockableConcern"
+          migration_template "db/migrate/add_lockable_to_users.rb", "db/migrate/add_lockable_to_users.rb"
+          template "app/controllers/unlocks_controller.rb"
+          template "app/views/unlocks/new.html.erb"
+          route "resources :unlocks, only: %i[ new create show ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/unlocks_mailer.rb"
+            template "app/views/unlocks_mailer/unlock_instructions.html.erb"
+            template "app/views/unlocks_mailer/unlock_instructions.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/magic_link.rb

@@ -8,20 +8,21 @@ module RailsAuthentication
       # Recoverable rework.
       module MagicLink
         private
-          def generate_magic_link
-            template "app/models/concerns/magic_link_concern.rb"
-            include_concern_in_user "MagicLinkConcern"
-            migration_template "db/migrate/add_magic_link_to_users.rb", "db/migrate/add_magic_link_to_users.rb"
-            template "app/controllers/magic_links_controller.rb"
-            template "app/views/magic_links/new.html.erb"
-            route "resources :magic_links, only: %i[ new create show ], param: :token"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/magic_links_mailer.rb"
-              template "app/views/magic_links_mailer/magic_link.html.erb"
-              template "app/views/magic_links_mailer/magic_link.text.erb"
-            end
+        def generate_magic_link
+          template "app/models/concerns/magic_link_concern.rb"
+          include_concern_in_user "MagicLinkConcern"
+          migration_template "db/migrate/add_magic_link_to_users.rb", "db/migrate/add_magic_link_to_users.rb"
+          template "app/controllers/magic_links_controller.rb"
+          template "app/views/magic_links/new.html.erb"
+          route "resources :magic_links, only: %i[ new create show ], param: :token"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/magic_links_mailer.rb"
+            template "app/views/magic_links_mailer/magic_link.html.erb"
+            template "app/views/magic_links_mailer/magic_link.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/ott.rb

@@ -10,20 +10,21 @@ module RailsAuthentication
       # Registerable, SessionsController#create) is left intact.
       module Ott
         private
-          def generate_ott
-            template "app/models/concerns/ott_concern.rb"
-            include_concern_in_user "OttConcern"
-            migration_template "db/migrate/add_ott_to_users.rb", "db/migrate/add_ott_to_users.rb"
-            template "app/controllers/otts_controller.rb"
-            template "app/views/otts/edit.html.erb"
-            route "resource :ott, only: %i[ create edit update ]"
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/otts_mailer.rb"
-              template "app/views/otts_mailer/ott.html.erb"
-              template "app/views/otts_mailer/ott.text.erb"
-            end
+        def generate_ott
+          template "app/models/concerns/ott_concern.rb"
+          include_concern_in_user "OttConcern"
+          migration_template "db/migrate/add_ott_to_users.rb", "db/migrate/add_ott_to_users.rb"
+          template "app/controllers/otts_controller.rb"
+          template "app/views/otts/edit.html.erb"
+          route "resource :ott, only: %i[ create edit update ]"
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/otts_mailer.rb"
+            template "app/views/otts_mailer/ott.html.erb"
+            template "app/views/otts_mailer/ott.text.erb"
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/passkey.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module RailsAuthentication
+  module Generators
+    module Features
+      # Opt-in (--passkey): WebAuthn-based passkey sign-in, in addition to
+      # password sign-in. A user may register any number of passkeys
+      # (platform authenticators, security keys); sign-in is usernameless —
+      # the browser's discoverable-credential picker stands in for an email
+      # field. Ceremony verification is delegated to the `webauthn` gem —
+      # unlike everything else this gem generates, that's a real runtime
+      # dependency, so it's added straight to the host app's Gemfile.
+      module Passkey
+        private
+
+        def generate_passkey
+          gem "webauthn", comment: "Verifies WebAuthn passkey registration/authentication ceremonies"
+          say "Added the `webauthn` gem to your Gemfile — run `bundle install`.", :yellow
+
+          template "config/initializers/webauthn.rb"
+          template "app/models/concerns/passkey_concern.rb"
+          include_concern_in_user "PasskeyConcern"
+          template "app/models/webauthn_credential.rb"
+          migration_template "db/migrate/add_webauthn_id_to_users.rb", "db/migrate/add_webauthn_id_to_users.rb"
+          migration_template "db/migrate/create_webauthn_credentials.rb", "db/migrate/create_webauthn_credentials.rb"
+          template "app/controllers/webauthn_credentials_controller.rb"
+          template "app/controllers/passkey_sessions_controller.rb"
+          template "app/views/webauthn_credentials/index.html.erb"
+          template "app/views/webauthn_credentials/new.html.erb"
+          route "resources :webauthn_credentials, only: %i[ index new create destroy ]"
+          route "resource :passkey_session, only: %i[ create ], controller: \"passkey_sessions\""
+        end
+      end
+    end
+  end
+end

data/lib/generators/authentication/features/recoverable.rb

@@ -5,20 +5,21 @@ module RailsAuthentication
     module Features
       module Recoverable
         private
-          # Replaces the base generator's stateless generates_token_for password reset
-          # with DB-backed, revocable tokens.
-          def generate_recoverable
-            template "app/models/concerns/recoverable_concern.rb"
-            include_concern_in_user "RecoverableConcern"
-            migration_template "db/migrate/add_recoverable_to_users.rb", "db/migrate/add_recoverable_to_users.rb"
-            template "app/controllers/passwords_controller.rb", force: true
 
-            if defined?(ActionMailer::Railtie)
-              template "app/mailers/passwords_mailer.rb", force: true
-              template "app/views/passwords_mailer/reset.html.erb", force: true
-              template "app/views/passwords_mailer/reset.text.erb", force: true
-            end
+        # Replaces the base generator's stateless generates_token_for password reset
+        # with DB-backed, revocable tokens.
+        def generate_recoverable
+          template "app/models/concerns/recoverable_concern.rb"
+          include_concern_in_user "RecoverableConcern"
+          migration_template "db/migrate/add_recoverable_to_users.rb", "db/migrate/add_recoverable_to_users.rb"
+          template "app/controllers/passwords_controller.rb", force: true
+
+          if defined?(ActionMailer::Railtie)
+            template "app/mailers/passwords_mailer.rb", force: true
+            template "app/views/passwords_mailer/reset.html.erb", force: true
+            template "app/views/passwords_mailer/reset.text.erb", force: true
           end
+        end
       end
     end
   end

data/lib/generators/authentication/features/registerable.rb

@@ -5,12 +5,13 @@ module RailsAuthentication
     module Features
       module Registerable
         private
-          def generate_registerable
-            template "app/controllers/registrations_controller.rb"
-            template "app/views/registrations/new.html.erb"
-            template "app/views/registrations/edit.html.erb"
-            route "resource :registration, only: %i[ new create edit update destroy ]"
-          end
+
+        def generate_registerable
+          template "app/controllers/registrations_controller.rb"
+          template "app/views/registrations/new.html.erb"
+          template "app/views/registrations/edit.html.erb"
+          route "resource :registration, only: %i[ new create edit update destroy ]"
+        end
       end
     end
   end

data/lib/generators/authentication/features/rememberable.rb

@@ -5,11 +5,12 @@ module RailsAuthentication
     module Features
       module Rememberable
         private
-          def generate_rememberable
-            template "app/models/concerns/rememberable_concern.rb"
-            include_concern_in_user "RememberableConcern"
-            migration_template "db/migrate/add_rememberable_to_users.rb", "db/migrate/add_rememberable_to_users.rb"
-          end
+
+        def generate_rememberable
+          template "app/models/concerns/rememberable_concern.rb"
+          include_concern_in_user "RememberableConcern"
+          migration_template "db/migrate/add_rememberable_to_users.rb", "db/migrate/add_rememberable_to_users.rb"
+        end
       end
     end
   end

data/lib/generators/authentication/features/timeoutable.rb

@@ -5,12 +5,13 @@ module RailsAuthentication
     module Features
       module Timeoutable
         private
-          # No migration: inactivity is measured against sessions.updated_at, which the
-          # base generator's sessions table already has.
-          def generate_timeoutable
-            template "app/models/concerns/timeoutable_concern.rb"
-            include_concern_in_user "TimeoutableConcern"
-          end
+
+        # No migration: inactivity is measured against sessions.updated_at, which the
+        # base generator's sessions table already has.
+        def generate_timeoutable
+          template "app/models/concerns/timeoutable_concern.rb"
+          include_concern_in_user "TimeoutableConcern"
+        end
       end
     end
   end

data/lib/generators/authentication/features/trackable.rb

@@ -5,12 +5,13 @@ module RailsAuthentication
     module Features
       module Trackable
         private
-          def generate_trackable
-            template "app/models/concerns/trackable_concern.rb"
-            include_concern_in_user "TrackableConcern"
-            template "app/models/user_auth.rb"
-            migration_template "db/migrate/create_user_auths.rb", "db/migrate/create_user_auths.rb"
-          end
+
+        def generate_trackable
+          template "app/models/concerns/trackable_concern.rb"
+          include_concern_in_user "TrackableConcern"
+          template "app/models/user_auth.rb"
+          migration_template "db/migrate/create_user_auths.rb", "db/migrate/create_user_auths.rb"
+        end
       end
     end
   end

data/lib/generators/authentication/features/validatable.rb

@@ -5,10 +5,11 @@ module RailsAuthentication
     module Features
       module Validatable
         private
-          def generate_validatable
-            template "app/models/concerns/validatable_concern.rb"
-            include_concern_in_user "ValidatableConcern"
-          end
+
+        def generate_validatable
+          template "app/models/concerns/validatable_concern.rb"
+          include_concern_in_user "ValidatableConcern"
+        end
       end
     end
   end

data/lib/generators/authentication/templates/app/controllers/passkey_sessions_controller.rb.tt

@@ -0,0 +1,68 @@
+class PasskeySessionsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { render json: { error: "Try again later." }, status: :too_many_requests }
+
+  def create
+    webauthn_credential = WebAuthn::Credential.from_get(params)
+    stored_credential = WebauthnCredential.find_by(external_id: webauthn_credential.id)
+
+    if stored_credential.nil?
+      return render json: { error: "Passkey not recognized." }, status: :unprocessable_content
+    end
+
+    begin
+      webauthn_credential.verify(
+        session[:webauthn_authentication_challenge],
+        public_key: stored_credential.public_key,
+        sign_count: stored_credential.sign_count
+      )
+    rescue WebAuthn::Error
+      return render json: { error: "Passkey verification failed." }, status: :unprocessable_content
+    end
+
+    stored_credential.update!(sign_count: webauthn_credential.sign_count)
+    user = stored_credential.user
+    session.delete(:webauthn_authentication_challenge)
+
+<% if lockable? -%>
+    if user.locked?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "locked")
+<% end -%>
+      return render json: { error: "Your account is locked. Check your email for unlock instructions." }, status: :unprocessable_content
+    end
+<% end -%>
+<% if confirmable? -%>
+    unless user.confirmed?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "unconfirmed")
+<% end -%>
+      return render json: { error: "You must confirm your email address before signing in." }, status: :unprocessable_content
+    end
+<% end -%>
+<% if invitable? -%>
+    if user.invitation_pending?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "invitation_pending")
+<% end -%>
+      return render json: { error: "You must accept your invitation before signing in." }, status: :unprocessable_content
+    end
+<% end -%>
+<% if lockable? -%>
+    user.reset_failed_attempts!
+<% end -%>
+<% if trackable? -%>
+    record_authentication_attempt(user, success: true)
+<% end -%>
+    start_new_session_for user
+    render json: { redirect_to: after_authentication_url }
+  end
+<% if trackable? -%>
+
+  private
+
+  def record_authentication_attempt(user, success:, failure_reason: nil)
+    UserAuth.record(user, request, success: success, failure_reason: failure_reason)
+  end
+<% end -%>
+end

data/lib/generators/authentication/templates/app/controllers/sessions_controller.rb.tt

@@ -3,6 +3,10 @@ class SessionsController < ApplicationController
   rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: "Try again later." }
 
   def new
+<% if passkey? -%>
+    @webauthn_credential_options = WebAuthn::Credential.options_for_get(user_verification: "required")
+    session[:webauthn_authentication_challenge] = @webauthn_credential_options.challenge
+<% end -%>
   end
 
   def create

data/lib/generators/authentication/templates/app/controllers/webauthn_credentials_controller.rb.tt

@@ -0,0 +1,43 @@
+class WebauthnCredentialsController < ApplicationController
+  before_action :set_webauthn_credential, only: :destroy
+
+  def index
+    @webauthn_credentials = current_user.webauthn_credentials.order(:created_at)
+  end
+
+  def new
+    @webauthn_credential_options = WebAuthn::Credential.options_for_create(
+      user: { id: current_user.webauthn_id, name: current_user.email_address },
+      exclude: current_user.webauthn_credentials.pluck(:external_id)
+    )
+    session[:webauthn_registration_challenge] = @webauthn_credential_options.challenge
+  end
+
+  def create
+    webauthn_credential = WebAuthn::Credential.from_create(params)
+    webauthn_credential.verify(session[:webauthn_registration_challenge])
+
+    current_user.webauthn_credentials.create!(
+      external_id: webauthn_credential.id,
+      public_key: webauthn_credential.public_key,
+      sign_count: webauthn_credential.sign_count,
+      nickname: params[:nickname].presence || "Passkey"
+    )
+    session.delete(:webauthn_registration_challenge)
+
+    render json: { redirect_to: webauthn_credentials_path }
+  rescue WebAuthn::Error => e
+    render json: { error: e.message }, status: :unprocessable_content
+  end
+
+  def destroy
+    @webauthn_credential.destroy
+    redirect_to webauthn_credentials_path, notice: "Passkey removed."
+  end
+
+  private
+
+  def set_webauthn_credential
+    @webauthn_credential = current_user.webauthn_credentials.find(params[:id])
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/confirmable_concern.rb.tt

@@ -47,28 +47,29 @@ module ConfirmableConcern
   def generate_confirmation_token!
     update!(confirmation_token: generate_confirmable_token, confirmation_sent_at: Time.current)
   end
+
+  protected
+
+  def generate_confirmable_token
+    SecureRandom.urlsafe_base64(32)
+  end
 <% if reconfirmable? -%>
 
   private
-    def postponing_email_address_change?
-      !@confirming && email_address_changed? && confirmed?
-    end
-
-    def postpone_email_address_change
-      self.unconfirmed_email = email_address
-      self.email_address = email_address_in_database
-      self.confirmation_token = generate_confirmable_token
-      self.confirmation_sent_at = Time.current
-    end
 
-    def deliver_reconfirmation_instructions
-      ConfirmationsMailer.confirmation_instructions(self).deliver_later
-    end
-<% end -%>
+  def postponing_email_address_change?
+    !@confirming && email_address_changed? && confirmed?
+  end
 
-  protected
+  def postpone_email_address_change
+    self.unconfirmed_email = email_address
+    self.email_address = email_address_in_database
+    self.confirmation_token = generate_confirmable_token
+    self.confirmation_sent_at = Time.current
+  end
 
-  def generate_confirmable_token
-    SecureRandom.urlsafe_base64(32)
+  def deliver_reconfirmation_instructions
+    ConfirmationsMailer.confirmation_instructions(self).deliver_later
   end
+<% end -%>
 end

data/lib/generators/authentication/templates/app/models/concerns/passkey_concern.rb.tt

@@ -0,0 +1,19 @@
+module PasskeyConcern
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :webauthn_credentials, dependent: :destroy
+
+    before_validation :ensure_webauthn_id, on: :create
+  end
+
+  def passkeys?
+    webauthn_credentials.exists?
+  end
+
+  private
+
+  def ensure_webauthn_id
+    self.webauthn_id ||= WebAuthn.generate_user_id
+  end
+end

data/lib/generators/authentication/templates/app/models/webauthn_credential.rb.tt

@@ -0,0 +1,6 @@
+class WebauthnCredential < ApplicationRecord
+  belongs_to :user
+
+  validates :external_id, presence: true, uniqueness: true
+  validates :public_key, presence: true
+end

data/lib/generators/authentication/templates/app/views/registrations/edit.html.erb.tt

@@ -19,4 +19,8 @@
 <%% end %>
 <br>
 
+<% if passkey? -%>
+<%%= link_to "Manage your passkeys", webauthn_credentials_path %>
+<br><br>
+<% end -%>
 <%%= button_to "Delete my account", registration_path, method: :delete, data: { turbo_confirm: "Are you sure?" } %>

data/lib/generators/authentication/templates/app/views/sessions/new.html.erb.tt

@@ -30,6 +30,71 @@
 <% if magic_link? -%>
 <br><%%= link_to "Sign in with magic link", new_magic_link_path %>
 <% end -%>
+<% if passkey? -%>
+<br><%%= button_tag "Sign in with a passkey", type: "button", id: "passkey-sign-in-button" %>
+<%%= tag.span "", id: "passkey-sign-in-error", style: "color:red" %>
+
+<%%= javascript_tag do %>
+  (function () {
+    function bufferEncode(value) {
+      return btoa(String.fromCharCode.apply(null, new Uint8Array(value)))
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+
+    function bufferDecode(value) {
+      const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+      const raw = window.atob(padded);
+      const buffer = new Uint8Array(raw.length);
+      for (let i = 0; i < raw.length; i++) buffer[i] = raw.charCodeAt(i);
+      return buffer.buffer;
+    }
+
+    document.getElementById("passkey-sign-in-button").addEventListener("click", async function () {
+      const options = <%%= raw @webauthn_credential_options.to_json %>;
+      options.challenge = bufferDecode(options.challenge);
+      if (options.allowCredentials) {
+        options.allowCredentials = options.allowCredentials.map(function (cred) {
+          return Object.assign({}, cred, { id: bufferDecode(cred.id) });
+        });
+      }
+
+      let credential;
+      try {
+        credential = await navigator.credentials.get({ publicKey: options });
+      } catch (error) {
+        document.getElementById("passkey-sign-in-error").textContent = error.message;
+        return;
+      }
+
+      const response = await fetch("<%%= passkey_session_path %>", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-CSRF-Token": document.querySelector('meta[name="csrf-token"]').content
+        },
+        body: JSON.stringify({
+          id: credential.id,
+          rawId: bufferEncode(credential.rawId),
+          type: credential.type,
+          response: {
+            clientDataJSON: bufferEncode(credential.response.clientDataJSON),
+            authenticatorData: bufferEncode(credential.response.authenticatorData),
+            signature: bufferEncode(credential.response.signature),
+            userHandle: credential.response.userHandle ? bufferEncode(credential.response.userHandle) : null
+          }
+        })
+      });
+
+      const result = await response.json();
+      if (response.ok) {
+        window.location.href = result.redirect_to;
+      } else {
+        document.getElementById("passkey-sign-in-error").textContent = result.error || "Could not sign in with passkey.";
+      }
+    });
+  })();
+<%% end %>
+<% end -%>
 <br><%%= link_to "Forgot password?", new_password_path %>
 <% if registerable? -%>
 <br><%%= link_to "Sign up", new_registration_path %>

data/lib/generators/authentication/templates/app/views/webauthn_credentials/index.html.erb.tt

@@ -0,0 +1,19 @@
+<h1>Your passkeys</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<%% if @webauthn_credentials.empty? %>
+  <p>You haven't added a passkey yet.</p>
+<%% else %>
+  <ul>
+    <%% @webauthn_credentials.each do |credential| %>
+      <li>
+        <%%= credential.nickname %> &mdash; added <%%= credential.created_at.to_date %>
+        <%%= button_to "Remove", webauthn_credential_path(credential), method: :delete, data: { turbo_confirm: "Remove this passkey?" } %>
+      </li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<br><%%= link_to "Add a passkey", new_webauthn_credential_path %>

data/lib/generators/authentication/templates/app/views/webauthn_credentials/new.html.erb.tt

@@ -0,0 +1,71 @@
+<h1>Add a passkey</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.span "", id: "passkey-error", style: "color:red" %>
+
+<%%= label_tag :passkey_nickname, "Name this passkey (e.g. \"MacBook\" or \"iPhone\")" %>
+<%%= text_field_tag :passkey_nickname, nil, placeholder: "Passkey" %><br><br>
+
+<%%= button_tag "Create passkey", type: "button", id: "create-passkey-button" %>
+
+<%%= javascript_tag do %>
+  (function () {
+    function bufferEncode(value) {
+      return btoa(String.fromCharCode.apply(null, new Uint8Array(value)))
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+
+    function bufferDecode(value) {
+      const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+      const raw = window.atob(padded);
+      const buffer = new Uint8Array(raw.length);
+      for (let i = 0; i < raw.length; i++) buffer[i] = raw.charCodeAt(i);
+      return buffer.buffer;
+    }
+
+    document.getElementById("create-passkey-button").addEventListener("click", async function () {
+      const options = <%%= raw @webauthn_credential_options.to_json %>;
+
+      options.challenge = bufferDecode(options.challenge);
+      options.user.id = bufferDecode(options.user.id);
+      if (options.excludeCredentials) {
+        options.excludeCredentials = options.excludeCredentials.map(function (cred) {
+          return Object.assign({}, cred, { id: bufferDecode(cred.id) });
+        });
+      }
+
+      let credential;
+      try {
+        credential = await navigator.credentials.create({ publicKey: options });
+      } catch (error) {
+        document.getElementById("passkey-error").textContent = error.message;
+        return;
+      }
+
+      const response = await fetch("<%%= webauthn_credentials_path %>", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-CSRF-Token": document.querySelector('meta[name="csrf-token"]').content
+        },
+        body: JSON.stringify({
+          id: credential.id,
+          rawId: bufferEncode(credential.rawId),
+          type: credential.type,
+          nickname: document.getElementById("passkey_nickname").value,
+          response: {
+            clientDataJSON: bufferEncode(credential.response.clientDataJSON),
+            attestationObject: bufferEncode(credential.response.attestationObject)
+          }
+        })
+      });
+
+      const result = await response.json();
+      if (response.ok) {
+        window.location.href = result.redirect_to;
+      } else {
+        document.getElementById("passkey-error").textContent = result.error || "Could not save passkey.";
+      }
+    });
+  })();
+<%% end %>

data/lib/generators/authentication/templates/config/initializers/webauthn.rb.tt

@@ -0,0 +1,11 @@
+WebAuthn.configure do |config|
+  # This value needs to match `window.location.hostname` where the API is called from in
+  # your client-side (front-end) code.
+  # config.rp_id = "example.com"
+
+  # This value needs to match `window.location.origin` where the API is called from in
+  # your client-side (front-end) code.
+  # config.allowed_origins = ["https://example.com"]
+
+  config.rp_name = Rails.application.class.module_parent_name
+end

data/lib/generators/authentication/templates/db/migrate/add_webauthn_id_to_users.rb.tt

@@ -0,0 +1,7 @@
+class AddWebauthnIdToUsers < ActiveRecord::Migration<%= migration_version %>
+  def change
+    add_column :users, :webauthn_id, :string
+
+    add_index :users, :webauthn_id, unique: true
+  end
+end

data/lib/generators/authentication/templates/db/migrate/create_webauthn_credentials.rb.tt

@@ -0,0 +1,15 @@
+class CreateWebauthnCredentials < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :webauthn_credentials do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :external_id, null: false
+      t.string :public_key, null: false
+      t.string :nickname
+      t.bigint :sign_count, null: false, default: 0
+
+      t.timestamps
+    end
+
+    add_index :webauthn_credentials, :external_id, unique: true
+  end
+end

data/lib/rails_authentication/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsAuthentication
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_authentication
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - David Freerksen
@@ -39,6 +39,7 @@ files:
 - lib/generators/authentication/features/lockable.rb
 - lib/generators/authentication/features/magic_link.rb
 - lib/generators/authentication/features/ott.rb
+- lib/generators/authentication/features/passkey.rb
 - lib/generators/authentication/features/recoverable.rb
 - lib/generators/authentication/features/registerable.rb
 - lib/generators/authentication/features/rememberable.rb
@@ -50,10 +51,12 @@ files:
 - lib/generators/authentication/templates/app/controllers/invitations_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/magic_links_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/otts_controller.rb.tt
+- lib/generators/authentication/templates/app/controllers/passkey_sessions_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/passwords_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/registrations_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/sessions_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/unlocks_controller.rb.tt
+- lib/generators/authentication/templates/app/controllers/webauthn_credentials_controller.rb.tt
 - lib/generators/authentication/templates/app/mailers/confirmations_mailer.rb.tt
 - lib/generators/authentication/templates/app/mailers/invitations_mailer.rb.tt
 - lib/generators/authentication/templates/app/mailers/magic_links_mailer.rb.tt
@@ -65,12 +68,14 @@ files:
 - lib/generators/authentication/templates/app/models/concerns/lockable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/magic_link_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/ott_concern.rb.tt
+- lib/generators/authentication/templates/app/models/concerns/passkey_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/recoverable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/rememberable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/timeoutable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/trackable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/validatable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/user_auth.rb.tt
+- lib/generators/authentication/templates/app/models/webauthn_credential.rb.tt
 - lib/generators/authentication/templates/app/views/confirmations/new.html.erb.tt
 - lib/generators/authentication/templates/app/views/confirmations_mailer/confirmation_instructions.html.erb.tt
 - lib/generators/authentication/templates/app/views/confirmations_mailer/confirmation_instructions.text.erb.tt
@@ -92,6 +97,9 @@ files:
 - lib/generators/authentication/templates/app/views/unlocks/new.html.erb.tt
 - lib/generators/authentication/templates/app/views/unlocks_mailer/unlock_instructions.html.erb.tt
 - lib/generators/authentication/templates/app/views/unlocks_mailer/unlock_instructions.text.erb.tt
+- lib/generators/authentication/templates/app/views/webauthn_credentials/index.html.erb.tt
+- lib/generators/authentication/templates/app/views/webauthn_credentials/new.html.erb.tt
+- lib/generators/authentication/templates/config/initializers/webauthn.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_confirmable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_invitable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_lockable_to_users.rb.tt
@@ -99,7 +107,9 @@ files:
 - lib/generators/authentication/templates/db/migrate/add_ott_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_recoverable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_rememberable_to_users.rb.tt
+- lib/generators/authentication/templates/db/migrate/add_webauthn_id_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/create_user_auths.rb.tt
+- lib/generators/authentication/templates/db/migrate/create_webauthn_credentials.rb.tt
 - lib/rails_authentication.rb
 - lib/rails_authentication/version.rb
 homepage: https://github.com/dfreerksen/rails_authentication