rails_authentication 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c71c1a30969abed6c581c67e3447c1968176e6e25c218894e64d5317472b873e
-  data.tar.gz: 1f65cac490fae4c9f575d907bf70d4d059afdb1bcb5e8a56474b741b4eac4f3e
+  metadata.gz: f5c0f93e4dc6c9eb2562c7804920c82cff3a5a7d23d15758aaee3d63cdb60d99
+  data.tar.gz: 60ee05fafe8ffd4d9f56c10aa57c9ea5d347b801e94d3651ba2b04b258545a13
 SHA512:
-  metadata.gz: 5469da8db1ff529c5dd079b37a3499b1bc08b657560bdcd037607c407d6be292a306bcd146bcc99f30243435824a6fa9a58cb965a80edc0d7fb30435dcdc1cc3
-  data.tar.gz: '0693170a1f4bdebe7ec41bfe6088ddbbc436225aa3a09b8d3216af9cf800bd36d461a9618fd022e0b45b1662c82382b13a0bf4cc10e715a9e7247fcd1d77fb18'
+  metadata.gz: bfd4e4526f964ef0ec6f0004b85061b64b86e6885c4e383adae282396b769f50e300de8e5424bd9892b59d5bae499d428be4719c6d8cdab0ec07fd76b64f5f3a
+  data.tar.gz: d4c2cb6365fd97356977944566aa332772c751061fcf8b1ad4b9e57b6d4eb7f0cd65ee497493d79286b1efb8bf85b897933e635b914e38a8994e419af61c1961

data/README.md

@@ -18,6 +18,7 @@ gem extends that same command to also install:
 | **Lockable** | Locks the account after 5 failed attempts; unlock via email or automatically after 1 hour |
 | **Invitable** | Invite users by email; blocks sign-in until they accept by choosing their own password |
 | **MagicLink** (opt-in) | Passwordless magic link sign-in via email — DB-backed, single-use, expiring tokens |
+| **Ott** (opt-in) | Passwordless sign-in via an emailed 6-digit one-time code — replaces the password sign-in form |
 
 Everything is **generated into your app** as plain, readable code — controllers, views, mailers,
 migrations, and one model concern per feature. There is no runtime dependency on this gem: after
@@ -28,7 +29,7 @@ This gem is meant to be installed temporarily. Install it long enough to run the
 ## Installation
 
 Requires Rails >= 8.0 and, for the email-driven features (Confirmable, Recoverable, Lockable,
-Invitable, MagicLink), Action Mailer.
+Invitable, MagicLink, Ott), Action Mailer.
 
 ```ruby
 # Gemfile
@@ -56,24 +57,37 @@ Available flags: `--skip-confirmable`, `--skip-recoverable`, `--skip-registerabl
 `--skip-lockable`, `--skip-invitable`, and `--reconfirmable` (Confirmable: postpone email address
 changes until the new address is confirmed, via an `unconfirmed_email` column).
 
-MagicLink is the one **opt-in** feature — it changes the sign-in UX, so you have to ask for it:
+MagicLink and Ott are **opt-in** features — they change the sign-in UX, so you have to ask for
+them:
 
 ```sh
 bin/rails generate authentication --magic-link
+bin/rails generate authentication --ott
 ```
 
-It adds a "Sign in with magic link" link to the sign-in page, leading to an email-only form. The
-emailed link signs the user in directly; tokens are DB-backed, single-use, and expire after
-20 minutes (`MagicLinkConcern::MAGIC_LINK_EXPIRES_IN`). The magic link flow honors the other
-enabled features: locked, unconfirmed, or invitation-pending accounts still can't sign in, and
-Trackable records the attempt.
+MagicLink adds a "Sign in with magic link" link to the sign-in page, leading to an email-only
+form. The emailed link signs the user in directly; tokens are DB-backed, single-use, and expire
+after 20 minutes (`MagicLinkConcern::MAGIC_LINK_EXPIRES_IN`).
+
+Ott replaces the sign-in form: the user enters only their email address, receives a 6-digit code
+(`OttConcern::OTT_CODE_LENGTH`) by email, and enters it on a second screen — one single-digit
+input per digit with auto-advance and paste/autofill support (plain inline JavaScript, no
+framework required). A "Sign in with password
+instead" link (`/session/new?with_password=1`) toggles back to the classic password form at
+runtime. Codes are DB-backed, single-use, expire after 10 minutes (`OttConcern::OTT_EXPIRES_IN`),
+and are voided after 5 wrong entries (`OttConcern::OTT_MAX_ATTEMPTS`). The password machinery
+(SessionsController#create, Recoverable, Registerable) stays generated and functional — only the
+sign-in UI changes.
+
+Both flows honor the other enabled features: locked, unconfirmed, or invitation-pending accounts
+still can't sign in, and Trackable records the attempt.
 
 Each feature adds a single `include <Feature>Concern` line to `app/models/user.rb`; all of its
 model behavior lives in `app/models/concerns/<feature>_concern.rb`. Tunables are plain constants in
 the generated concerns — e.g. `TimeoutableConcern::TIMEOUT_IN`, `LockableConcern::MAXIMUM_ATTEMPTS`,
 `LockableConcern::UNLOCK_IN`, `ConfirmableConcern::CONFIRMATION_TOKEN_EXPIRES_IN`,
-`ValidatableConcern::PASSWORD_LENGTH`, `ValidatableConcern::PASSWORD_MINIMUM_COMPLEXITY` — edit them
-there. Concerns keep the model clean.
+`ValidatableConcern::PASSWORD_LENGTH`, `ValidatableConcern::PASSWORD_MINIMUM_COMPLEXITY`,
+`OttConcern::OTT_CODE_LENGTH` — edit them there. Concerns keep the model clean.
 
 ### Generated routes
 
@@ -83,6 +97,7 @@ resources :confirmations, only: %i[ new create show ], param: :token
 resources :unlocks,       only: %i[ new create show ], param: :token
 resources :invitations,   only: %i[ new create edit update ], param: :token
 resources :magic_links,   only: %i[ new create show ], param: :token   # with --magic-link
+resource  :ott,           only: %i[ create edit update ]               # with --ott
 resource  :session                      # from the base generator
 resources :passwords, param: :token     # from the base generator
 ```
@@ -101,7 +116,6 @@ resources :passwords, param: :token     # from the base generator
 
 ## Future Plans
 
-- OTT (Email code)
 - Passkey
 
 ## Development

data/lib/generators/authentication/authentication_generator.rb

@@ -12,6 +12,7 @@ require_relative "features/validatable"
 require_relative "features/lockable"
 require_relative "features/invitable"
 require_relative "features/magic_link"
+require_relative "features/ott"
 
 module RailsAuthentication
   module Generators
@@ -44,6 +45,7 @@ module RailsAuthentication
       include Features::Lockable
       include Features::Invitable
       include Features::MagicLink
+      include Features::Ott
 
       source_root File.expand_path("templates", __dir__)
 
@@ -60,6 +62,12 @@ module RailsAuthentication
       class_option :magic_link, type: :boolean, default: false,
         desc: "Add passwordless magic link sign-in (opt-in)"
 
+      # Also opt-in: replaces the sign-in form with an email-only form that
+      # emails a 6-digit one-time code, entered on a second screen. Password
+      # machinery stays generated and functional.
+      class_option :ott, type: :boolean, default: false,
+        desc: "Add one-time token (emailed 6-digit code) sign-in (opt-in)"
+
       def install_base_authentication
         say "Running Rails' built-in authentication generator", :green
         Rails::Generators.invoke("rails:authentication", [], behavior: behavior, destination_root: destination_root)
@@ -105,6 +113,10 @@ module RailsAuthentication
         generate_magic_link if magic_link?
       end
 
+      def install_ott
+        generate_ott if ott?
+      end
+
       # Runs after every feature install so the blank line separates the concern
       # includes (if any) from the rest of the class body, no matter which features
       # are enabled.
@@ -135,6 +147,10 @@ module RailsAuthentication
           options[:magic_link]
         end
 
+        def ott?
+          options[:ott]
+        end
+
         def include_concern_in_user(concern)
           inject_into_class "app/models/user.rb", "User", "  include #{concern}\n"
         end

data/lib/generators/authentication/features/ott.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module RailsAuthentication
+  module Generators
+    module Features
+      # Opt-in (--ott): one-time token sign-in. The sign-in page becomes an
+      # email-only form; a 6-digit code is emailed and entered on a second
+      # screen. Codes are DB-backed, single-use, expire after 10 minutes, and
+      # are voided after 5 wrong attempts. Password machinery (Recoverable,
+      # Registerable, SessionsController#create) is left intact.
+      module Ott
+        private
+          def generate_ott
+            template "app/models/concerns/ott_concern.rb"
+            include_concern_in_user "OttConcern"
+            migration_template "db/migrate/add_ott_to_users.rb", "db/migrate/add_ott_to_users.rb"
+            template "app/controllers/otts_controller.rb"
+            template "app/views/otts/edit.html.erb"
+            route "resource :ott, only: %i[ create edit update ]"
+
+            if defined?(ActionMailer::Railtie)
+              template "app/mailers/otts_mailer.rb"
+              template "app/views/otts_mailer/ott.html.erb"
+              template "app/views/otts_mailer/ott.text.erb"
+            end
+          end
+      end
+    end
+  end
+end

data/lib/generators/authentication/templates/app/controllers/otts_controller.rb.tt

@@ -0,0 +1,95 @@
+class OttsController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: %i[ create update ], with: -> { redirect_to new_session_path, alert: "Try again later." }
+
+  def create
+    email_address = params[:email_address].presence || session[:ott_email_address]
+    user = User.find_by(email_address: email_address)
+    user&.send_ott
+    session[:ott_email_address] = email_address
+
+    redirect_to edit_ott_path, notice: "We've emailed you a sign-in code (if a user with that email address exists)."
+  end
+
+  def edit
+    redirect_to new_session_path if session[:ott_email_address].blank?
+  end
+
+  def update
+    user = User.find_by(email_address: session[:ott_email_address])
+
+    case user && user.verify_ott(params[:code])
+    when nil, :expired
+      redirect_to new_session_path, alert: "Your sign-in code is invalid or has expired. Request a new one."
+    when :exhausted
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "ott_attempts_exhausted")
+<% end -%>
+      redirect_to new_session_path, alert: "Too many incorrect attempts. Request a new code."
+    when :invalid
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "invalid_ott")
+<% end -%>
+      redirect_to edit_ott_path, alert: "Incorrect code. Try again."
+    else
+      complete_ott_sign_in(user)
+    end
+  end
+
+  private
+
+  def complete_ott_sign_in(user)
+<% if lockable? -%>
+    if user.locked?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "locked")
+<% end -%>
+      return redirect_to new_session_path, alert: "Your account is locked. Check your email for unlock instructions."
+    end
+<% end -%>
+<% if confirmable? -%>
+    unless user.confirmed?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "unconfirmed")
+<% end -%>
+      return redirect_to new_session_path, alert: "You must confirm your email address before signing in."
+    end
+<% end -%>
+<% if invitable? -%>
+    if user.invitation_pending?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "invitation_pending")
+<% end -%>
+      return redirect_to new_session_path, alert: "You must accept your invitation before signing in."
+    end
+<% end -%>
+    # Add your own authentication restrictions specific to your application
+    # if user.deleted_at.present?
+<% if trackable? -%>
+    #   record_authentication_attempt(user, success: false, failure_reason: "soft_deleted")
+<% end -%>
+    #   return redirect_to new_session_path, alert: "Your account is not available."
+    # end
+
+    user.consume_ott!
+    session.delete(:ott_email_address)
+<% if lockable? -%>
+    user.reset_failed_attempts!
+<% end -%>
+<% if trackable? -%>
+    record_authentication_attempt(user, success: true)
+<% end -%>
+<% if rememberable? -%>
+    start_new_session_for user, remember: params[:remember_me] == "1"
+<% else -%>
+    start_new_session_for user
+<% end -%>
+    redirect_to after_authentication_url
+  end
+<% if trackable? -%>
+
+  def record_authentication_attempt(user, success:, failure_reason: nil)
+    UserAuth.record(user, request, success: success, failure_reason: failure_reason)
+  end
+<% end -%>
+end

data/lib/generators/authentication/templates/app/mailers/otts_mailer.rb.tt

@@ -0,0 +1,6 @@
+class OttsMailer < ApplicationMailer
+  def ott(user)
+    @user = user
+    mail subject: "Your sign-in code", to: user.email_address
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/ott_concern.rb.tt

@@ -0,0 +1,50 @@
+module OttConcern
+  extend ActiveSupport::Concern
+
+  OTT_EXPIRES_IN = 10.minutes
+  OTT_MAX_ATTEMPTS = 5
+  OTT_CODE_LENGTH = 6
+
+  def send_ott
+    generate_ott!
+    OttsMailer.ott(self).deliver_later
+  end
+
+  def generate_ott!
+    update!(ott_code: build_ott_code, ott_sent_at: Time.current, ott_attempts: 0)
+  end
+
+  # Returns :valid, :invalid, :exhausted, or :expired. Codes are single-use:
+  # consumed on successful sign-in, and voided once OTT_MAX_ATTEMPTS wrong
+  # codes have been entered.
+  def verify_ott(code)
+    return :expired unless ott_active?
+
+    if ActiveSupport::SecurityUtils.secure_compare(ott_code, code.to_s)
+      :valid
+    else
+      increment!(:ott_attempts)
+
+      if ott_attempts >= OTT_MAX_ATTEMPTS
+        consume_ott!
+        :exhausted
+      else
+        :invalid
+      end
+    end
+  end
+
+  def consume_ott!
+    update!(ott_code: nil, ott_sent_at: nil, ott_attempts: 0)
+  end
+
+  protected
+
+  def ott_active?
+    ott_code.present? && ott_sent_at&.after?(OTT_EXPIRES_IN.ago)
+  end
+
+  def build_ott_code
+    SecureRandom.random_number(10**OTT_CODE_LENGTH).to_s.rjust(OTT_CODE_LENGTH, "0")
+  end
+end

data/lib/generators/authentication/templates/app/views/otts/edit.html.erb.tt

@@ -0,0 +1,79 @@
+<h1>Enter your sign-in code</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<p>
+  We emailed a <%%= OttConcern::OTT_CODE_LENGTH %>-digit code to <%%= session[:ott_email_address] %>.
+  It expires in <%%= distance_of_time_in_words(0, OttConcern::OTT_EXPIRES_IN) %>.
+</p>
+
+<%%= form_with url: ott_path, method: :patch do |form| %>
+  <%%= form.hidden_field :code, id: "ott-code" %>
+  <div id="ott-digits">
+    <%% OttConcern::OTT_CODE_LENGTH.times do |i| %>
+      <input type="text" inputmode="numeric" pattern="[0-9]*" maxlength="<%%= OttConcern::OTT_CODE_LENGTH %>" required
+             autocomplete="<%%= i.zero? ? "one-time-code" : "off" %>"
+             aria-label="Digit <%%= i + 1 %>" <%%= "autofocus" if i.zero? %>
+             style="width:2em;text-align:center;font-size:1.5em">
+    <%% end %>
+  </div>
+  <br>
+<% if rememberable? -%>
+  <%%= form.check_box :remember_me %> <%%= form.label :remember_me, "Remember me" %><br>
+<% end -%>
+  <%%= form.submit "Sign in" %>
+<%% end %>
+<br>
+
+<%%= button_to "Resend code", ott_path, method: :post %>
+
+<script>
+  (function() {
+    var boxes = Array.prototype.slice.call(document.querySelectorAll("#ott-digits input"));
+    var hidden = document.getElementById("ott-code");
+
+    function sync() {
+      hidden.value = boxes.map(function(box) { return box.value; }).join("");
+    }
+
+    // Distributes a string of digits across the boxes, starting at `start`.
+    function fill(text, start) {
+      var digits = text.replace(/\D/g, "").slice(0, boxes.length - start).split("");
+      digits.forEach(function(digit, i) { boxes[start + i].value = digit; });
+      boxes[Math.min(start + digits.length, boxes.length - 1)].focus();
+      sync();
+    }
+
+    boxes.forEach(function(box, i) {
+      box.addEventListener("input", function() {
+        // A multi-character value means a paste or OS one-time-code autofill.
+        if (box.value.length > 1) return fill(box.value, i);
+
+        box.value = box.value.replace(/\D/g, "");
+        if (box.value && i < boxes.length - 1) boxes[i + 1].focus();
+        sync();
+      });
+
+      box.addEventListener("keydown", function(event) {
+        if (event.key === "Backspace" && !box.value && i > 0) {
+          event.preventDefault();
+          boxes[i - 1].value = "";
+          boxes[i - 1].focus();
+          sync();
+        } else if (event.key === "ArrowLeft" && i > 0) {
+          event.preventDefault();
+          boxes[i - 1].focus();
+        } else if (event.key === "ArrowRight" && i < boxes.length - 1) {
+          event.preventDefault();
+          boxes[i + 1].focus();
+        }
+      });
+
+      box.addEventListener("paste", function(event) {
+        event.preventDefault();
+        fill((event.clipboardData || window.clipboardData).getData("text"), 0);
+      });
+    });
+  })();
+</script>

data/lib/generators/authentication/templates/app/views/otts_mailer/ott.html.erb.tt

@@ -0,0 +1,8 @@
+<p>Your sign-in code is:</p>
+
+<p><strong><%%= @user.ott_code %></strong></p>
+
+<p>
+  This code will expire in <%%= distance_of_time_in_words(0, OttConcern::OTT_EXPIRES_IN) %> and can only be used once.
+  If you didn't request it, you can ignore this email.
+</p>

data/lib/generators/authentication/templates/app/views/otts_mailer/ott.text.erb.tt

@@ -0,0 +1,6 @@
+Your sign-in code is:
+
+<%%= @user.ott_code %>
+
+This code will expire in <%%= distance_of_time_in_words(0, OttConcern::OTT_EXPIRES_IN) %> and can only be used once.
+If you didn't request it, you can ignore this email.

data/lib/generators/authentication/templates/app/views/sessions/new.html.erb.tt

@@ -1,6 +1,17 @@
 <%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
 <%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
 
+<% if ott? -%>
+<%% if params[:with_password].blank? %>
+<%%= form_with url: ott_path do |form| %>
+  <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address] %><br>
+  <%%= form.submit "Email me a sign-in code" %>
+<%% end %>
+<br>
+
+<br><%%= link_to "Sign in with password instead", new_session_path(with_password: 1) %>
+<%% else %>
+<% end -%>
 <%%= form_with url: session_path do |form| %>
   <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address] %><br>
   <%%= form.password_field :password, required: true, autocomplete: "current-password", placeholder: "Enter your password", maxlength: 72 %><br>
@@ -10,6 +21,11 @@
   <%%= form.submit "Sign in" %>
 <%% end %>
 <br>
+<% if ott? -%>
+
+<br><%%= link_to "Sign in with a one-time code instead", new_session_path %>
+<%% end %>
+<% end -%>
 
 <% if magic_link? -%>
 <br><%%= link_to "Sign in with magic link", new_magic_link_path %>

data/lib/generators/authentication/templates/db/migrate/add_ott_to_users.rb.tt

@@ -0,0 +1,7 @@
+class AddOttToUsers < ActiveRecord::Migration<%= migration_version %>
+  def change
+    add_column :users, :ott_code, :string
+    add_column :users, :ott_sent_at, :datetime
+    add_column :users, :ott_attempts, :integer, default: 0, null: false
+  end
+end

data/lib/rails_authentication/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsAuthentication
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_authentication
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - David Freerksen
@@ -38,6 +38,7 @@ files:
 - lib/generators/authentication/features/invitable.rb
 - lib/generators/authentication/features/lockable.rb
 - lib/generators/authentication/features/magic_link.rb
+- lib/generators/authentication/features/ott.rb
 - lib/generators/authentication/features/recoverable.rb
 - lib/generators/authentication/features/registerable.rb
 - lib/generators/authentication/features/rememberable.rb
@@ -48,6 +49,7 @@ files:
 - lib/generators/authentication/templates/app/controllers/confirmations_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/invitations_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/magic_links_controller.rb.tt
+- lib/generators/authentication/templates/app/controllers/otts_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/passwords_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/registrations_controller.rb.tt
 - lib/generators/authentication/templates/app/controllers/sessions_controller.rb.tt
@@ -55,12 +57,14 @@ files:
 - lib/generators/authentication/templates/app/mailers/confirmations_mailer.rb.tt
 - lib/generators/authentication/templates/app/mailers/invitations_mailer.rb.tt
 - lib/generators/authentication/templates/app/mailers/magic_links_mailer.rb.tt
+- lib/generators/authentication/templates/app/mailers/otts_mailer.rb.tt
 - lib/generators/authentication/templates/app/mailers/passwords_mailer.rb.tt
 - lib/generators/authentication/templates/app/mailers/unlocks_mailer.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/confirmable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/invitable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/lockable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/magic_link_concern.rb.tt
+- lib/generators/authentication/templates/app/models/concerns/ott_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/recoverable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/rememberable_concern.rb.tt
 - lib/generators/authentication/templates/app/models/concerns/timeoutable_concern.rb.tt
@@ -77,6 +81,9 @@ files:
 - lib/generators/authentication/templates/app/views/magic_links/new.html.erb.tt
 - lib/generators/authentication/templates/app/views/magic_links_mailer/magic_link.html.erb.tt
 - lib/generators/authentication/templates/app/views/magic_links_mailer/magic_link.text.erb.tt
+- lib/generators/authentication/templates/app/views/otts/edit.html.erb.tt
+- lib/generators/authentication/templates/app/views/otts_mailer/ott.html.erb.tt
+- lib/generators/authentication/templates/app/views/otts_mailer/ott.text.erb.tt
 - lib/generators/authentication/templates/app/views/passwords_mailer/reset.html.erb.tt
 - lib/generators/authentication/templates/app/views/passwords_mailer/reset.text.erb.tt
 - lib/generators/authentication/templates/app/views/registrations/edit.html.erb.tt
@@ -89,6 +96,7 @@ files:
 - lib/generators/authentication/templates/db/migrate/add_invitable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_lockable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_magic_link_to_users.rb.tt
+- lib/generators/authentication/templates/db/migrate/add_ott_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_recoverable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/add_rememberable_to_users.rb.tt
 - lib/generators/authentication/templates/db/migrate/create_user_auths.rb.tt