rodauth-tools 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 49ed411752d1850001a89d8be7260feef6e8b4dae04547100d75bde5c80d1afd
-  data.tar.gz: ce7e4e431d01a64f4e6a8f1847795a1df7caa529895b0aa12568543668aaca71
+  metadata.gz: 3229a291fcbbef1fa0f00904dfbb171243f21a9478cf673d33d6f747ed30cbb4
+  data.tar.gz: 25dff26d7c164d0d8a8409c626c467b5cd3c9b3b64d18771d1ccdfcb8b84c5c4
 SHA512:
-  metadata.gz: 76cec388e98fb42c5413d25ac99ee8db3351db79f6c68c57abee7049286738b7242b0afa0527bc3c1df2066d002c667687d6089fc54a20a1a3df5553d52ffee8
-  data.tar.gz: 3eface17b5e1d077bb93498c793af35d9554d9e42bf72511eb7c9569ad84fd5a2cfaf7eee84c9c91b9af5d9672ef111bee01e1bd5dbe65c4434b76df3e10c845
+  metadata.gz: 35506a929bcb7cbd354f08f592331bb6718894f9d0f0331cf337545ce06c4858c1a83ad2ad4aa4af97a9039cd0d1e85004ba8c626d34bb55215032999886e5a8
+  data.tar.gz: 13f488f19cb2794315dcf1fefb408306e15b994b40c5b03c47e21194a16a11a92e4809733ece96a0cd639af0b7ae71b1256efe9b72bc5ad6b913ea7c5852e868

data/.rubocop.yml

@@ -11,6 +11,10 @@ AllCops:
   NewCops: enable
   SuggestExtensions: false
 
+Style/OneClassPerFile:
+  Exclude:
+    - 'examples/**/*'
+
 Style/StringLiterals:
   EnforcedStyle: single_quotes
 

data/.rubocop_todo.yml

@@ -49,7 +49,7 @@ Metrics/AbcSize:
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns, inherit_mode.
 # AllowedMethods: refine
 Metrics/BlockLength:
-  Max: 509
+  Max: 532
 
 # Offense count: 1
 # Configuration parameters: CountComments, CountAsOne.
@@ -64,12 +64,12 @@ Metrics/CyclomaticComplexity:
 # Offense count: 41
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.
 Metrics/MethodLength:
-  Max: 64
+  Max: 69
 
 # Offense count: 3
 # Configuration parameters: CountComments, CountAsOne.
 Metrics/ModuleLength:
-  Max: 511
+  Max: 534
 
 # Offense count: 10
 # Configuration parameters: AllowedMethods, AllowedPatterns.
@@ -108,6 +108,8 @@ RSpec/DescribeClass:
     - '**/spec/views/**/*'
     - 'spec/rodauth/features/external_identity/external_identity_spec.rb'
     - 'spec/rodauth/features/external_identity_autocreate_integration_spec.rb'
+    - 'spec/rodauth/features/secret_guard_combined_spec.rb'
+    - 'spec/rodauth/features/table_guard/table_guard_destructive_modes_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_integration_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_simple_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_spec.rb'
@@ -154,6 +156,7 @@ Style/Documentation:
   Exclude:
     - 'spec/**/*'
     - 'test/**/*'
+    - 'lib/rodauth/features/account_id_obfuscation.rb'
     - 'lib/rodauth/features/external_identity.rb'
     - 'lib/rodauth/features/hmac_secret_guard.rb'
     - 'lib/rodauth/features/jwt_secret_guard.rb'
@@ -204,6 +207,8 @@ Style/SafeNavigation:
     - 'spec/rodauth/features/external_identity_autocreate_integration_spec.rb'
     - 'spec/rodauth/features/hmac_secret_guard/hmac_secret_guard_spec.rb'
     - 'spec/rodauth/features/jwt_secret_guard/jwt_secret_guard_spec.rb'
+    - 'spec/rodauth/features/secret_guard_combined_spec.rb'
+    - 'spec/rodauth/features/table_guard/table_guard_destructive_modes_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_simple_spec.rb'
 
 # Offense count: 1
@@ -231,6 +236,8 @@ Style/SymbolProc:
     - 'spec/rodauth/features/external_identity_autocreate_integration_spec.rb'
     - 'spec/rodauth/features/hmac_secret_guard/hmac_secret_guard_spec.rb'
     - 'spec/rodauth/features/jwt_secret_guard/jwt_secret_guard_spec.rb'
+    - 'spec/rodauth/features/secret_guard_combined_spec.rb'
+    - 'spec/rodauth/features/table_guard/table_guard_destructive_modes_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_integration_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_simple_spec.rb'
     - 'try/features/external_identity_try.rb'

data/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-07-05
+
+### Added
+
+- **Account ID Obfuscation feature** (`account_id_obfuscation`) - Keyed, reversible
+  obfuscation of the numeric `account_id` that leaks into email-link tokens (e.g.
+  `/verify-account?key=2_...`) and the remember-me cookie, with no database schema
+  change. Wraps the two `email_base` chokepoints (`token_param_value` /
+  `account_from_key`), so a single `enable` covers verify_account, reset_password,
+  email_auth, verify_login_change and lockout/unlock; also obfuscates the remember
+  cookie when `remember` is enabled. Loads a dedicated `ACCOUNT_ID_SECRET` following
+  the `hmac_secret_guard` pattern. Backward compatible with in-flight numeric links
+  and legacy cookies, with config-driven secret rotation via a version tag.
+- **`Rodauth::Tools::AccountIdCipher`** - Framework-agnostic 4-round Feistel
+  format-preserving encryption utility (stdlib `openssl` only, no new dependencies).
+
+## [0.3.1] - 2026-01-13
+
+### Changed
+
+- Dependency and development-tooling maintenance (bundled `rodauth`, `sequel`,
+  `rubocop`, and related updates).
+
 ## [0.3.0] - 2025-11-25
 
 ### Added
@@ -76,6 +99,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Namespace changed from `Rodauth::Rack::Generators::Migration` to `Rodauth::Tools::Migration`
 - Evolution from Rack adapter to framework-agnostic utilities
 
+[0.4.0]: https://github.com/delano/rodauth-tools/compare/v0.3.1...v0.4.0
+[0.3.1]: https://github.com/delano/rodauth-tools/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/delano/rodauth-tools/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/delano/rodauth-tools/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/delano/rodauth-tools/releases/tag/v0.1.0

data/CLAUDE.md

@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Framework-agnostic utilities for Rodauth authentication:
 
-1. **External Rodauth Features** - `table_guard` for database validation, `external_identity` for external service IDs, `hmac_secret_guard` for HMAC secret validation, `jwt_secret_guard` for JWT secret validation
+1. **External Rodauth Features** - `table_guard` for database validation, `external_identity` for external service IDs, `hmac_secret_guard` for HMAC secret validation, `jwt_secret_guard` for JWT secret validation, `account_id_obfuscation` for hiding numeric account ids in email links and cookies
 2. **Sequel Migration Generator** - Generate migrations for 19 Rodauth features
 
 **Not a framework adapter.** For Rails integration, use rodauth-rails. This project demonstrates Rodauth's extensibility and provides reference implementations.
@@ -42,22 +42,45 @@ bin/console
 - Uses `Rodauth::Feature.define(:hmac_secret_guard, :HmacSecretGuard)` pattern
 - Automatically loads HMAC secret from environment variable (defaults to `HMAC_SECRET`)
 - Validates secret is configured at application startup via `post_configure` hook
-- Production mode: Raises `ConfigurationError` if secret missing
-- Development mode: Logs warning and uses configurable fallback secret
-- Deletes secret from ENV after loading for security
-- Provides `production?` and `validate_secrets!` public methods
+- Production mode: Raises `ConfigurationError` if secret missing, blank, or (when `minimum_secret_length` is set) too short
+- Development mode: Logs warning and uses a fallback secret (random per-process by default)
+- Deletes secret from ENV after loading for security (strips whitespace; blank values treated as absent)
+- Provides `production?`, `validate_hmac_secret!`, and (aliased) `validate_secrets!` public methods
 
 **lib/rodauth/features/jwt_secret_guard.rb** - External Rodauth feature
 
 - Uses `Rodauth::Feature.define(:jwt_secret_guard, :JwtSecretGuard)` pattern
 - Automatically loads JWT secret from environment variable (defaults to `JWT_SECRET`)
 - Validates secret is configured at application startup via `post_configure` hook
-- Production mode: Raises `ConfigurationError` if secret missing
-- Development mode: Logs warning and uses configurable fallback secret
-- Deletes secret from ENV after loading for security
-- Provides `production?` and `validate_secrets!` public methods
+- Production mode: Raises `ConfigurationError` if secret missing, blank, or (when `minimum_secret_length` is set) too short
+- Development mode: Logs warning and uses a fallback secret (random per-process by default)
+- Deletes secret from ENV after loading for security (strips whitespace; blank values treated as absent)
+- Provides `production?`, `validate_jwt_secret!`, and (aliased) `validate_secrets!` public methods
 - Defines `jwt_secret` configuration method for standalone use
 
+**lib/rodauth/features/account_id_obfuscation.rb** - External Rodauth feature
+
+- Uses `Rodauth::Feature.define(:account_id_obfuscation, :AccountIdObfuscation)` pattern
+- Obfuscates `account_id` in email-link tokens and the remember cookie via scoped `token_param_value`/`account_from_key` (and conditional `_set_/_get_remember_cookie`) overrides
+- Never touches the global `split_token`/`convert_token_id`, so `jwt_refresh` and other token consumers are unaffected
+- Loads a dedicated `ACCOUNT_ID_SECRET` like the secret guards; `production?`/`validate_secrets!` lifecycle
+- Non-digit version tag makes legacy-vs-obfuscated deterministic and drives config-driven secret rotation
+- Delegates the crypto to the standalone `Rodauth::Tools::AccountIdCipher`
+
+**lib/rodauth/tools/account_id_cipher.rb** - Framework-agnostic utility
+
+- Keyed format-preserving obfuscation of a 64-bit integer id (4-round Feistel network, HMAC-SHA256 round function)
+- Pure `Integer <-> 13-char Crockford Base32` bijection; stdlib `openssl` only, independently testable
+- `decode` returns `nil` on malformed input so callers can pass legacy/foreign values through
+**lib/rodauth/secret_guard.rb** - Shared support module (`Rodauth::SecretGuard`)
+
+- Kind-parameterized (`:hmac`/`:jwt`) logic behind both secret-guard features
+- Plain module functions taking the Rodauth instance explicitly — no mixed-in
+  method names, so both guards can be enabled together without one shadowing the
+  other (each feature's `post_configure` validates its own secret via `kind`)
+- Handles ENV loading (`load_from_env!`), validation (`validate!`), blank/whitespace
+  detection, production detection, and minimum-length enforcement
+
 **lib/rodauth/tools/migration.rb** - Sequel migration generator
 
 - Generates database migrations for 19 Rodauth features
@@ -106,7 +129,7 @@ end
 
 ### Table Guard Implementation Details
 
-**Logger Suppression:** The `table_exists?` method temporarily suppresses Sequel's logger during table existence checks. This prevents confusing ERROR logs from Sequel when checking non-existent tables (Sequel's `table_exists?` attempts a SELECT and logs the exception before catching it).
+**Existence Checks (no logger suppression):** The `table_exists?` method matches names against the database's table/view list (`db.tables` + `db.views`) rather than probing each table with a SELECT. An earlier implementation used Sequel's `table_exists?` probe and suppressed the logger around it (clearing/restoring the shared `db.loggers` array) to hide the "no such table" ERROR that Sequel logs before catching internally — but that mutation of shared connection state was not thread-safe. Listing names avoids the failed probe entirely, so no logger suppression (and no shared-state mutation) is needed. Schema-qualified identifiers (a `Sequel::SQL::QualifiedIdentifier` or a `:schema__table` Symbol) are not present in the unqualified list, so they take a separate schema-aware `db.table_exists?` probe path.
 
 **Configuration Storage:** Uses instance variables set by `auth_value_method`:
 
@@ -129,7 +152,7 @@ end
 **Introspection Methods:**
 
 - `all_table_methods` - Finds all methods ending in `_table` using Ruby reflection
-- `missing_tables` - Checks each table method against `db.table_exists?`
+- `missing_tables` - Checks each required table against the existing table/view name set (fetched once per pass to avoid an N+1 of catalog queries)
 - `table_status` - Returns array of hashes with method, table name, and existence status
 
 ### Migration Generator Architecture

data/Gemfile

@@ -8,12 +8,12 @@ gemspec
 
 gem 'dry-inflector'
 gem 'irb'
-gem 'rake', '~> 13.3'
+gem 'rake', '~> 13.4'
 
 group :development do
   gem 'bundler-audit'
   gem 'rspec', '~> 3.0'
-  gem 'rubocop', '~> 1.81'
+  gem 'rubocop', '~> 1.88'
   gem 'rubocop-rake'
   gem 'rubocop-rspec'
 end
@@ -21,14 +21,14 @@ end
 group :test do
   gem 'bcrypt', '~> 3.1'
   gem 'capybara'
-  gem 'jwt', '~> 3.1'
+  gem 'jwt', '~> 3.2'
   gem 'rack-test', '~> 2.1'
   gem 'rails', '>= 6.0'
   gem 'rotp'
   gem 'rqrcode'
   gem 'sequel-activerecord_connection', '~> 2.0'
-  gem 'sqlite3', '~> 2.8'
-  gem 'tilt', '~> 2.4'
+  gem 'sqlite3', '~> 2.9'
+  gem 'tilt', '~> 2.7'
   gem 'tryouts', '~> 3.0'
   gem 'warning'
   gem 'webauthn' unless RUBY_ENGINE == 'jruby'

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rodauth-tools (0.3.0)
+    rodauth-tools (0.4.0)
       dry-inflector (~> 1.1)
       rodauth (~> 2.41)
       sequel (~> 5.0)
@@ -9,31 +9,31 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.15)
+    action_text-trix (2.1.18)
       railties
-    actioncable (8.1.1)
-      actionpack (= 8.1.1)
-      activesupport (= 8.1.1)
+    actioncable (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.1.1)
-      actionpack (= 8.1.1)
-      activejob (= 8.1.1)
-      activerecord (= 8.1.1)
-      activestorage (= 8.1.1)
-      activesupport (= 8.1.1)
+    actionmailbox (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
-    actionmailer (8.1.1)
-      actionpack (= 8.1.1)
-      actionview (= 8.1.1)
-      activejob (= 8.1.1)
-      activesupport (= 8.1.1)
+    actionmailer (8.1.3)
+      actionpack (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.1.1)
-      actionview (= 8.1.1)
-      activesupport (= 8.1.1)
+    actionpack (8.1.3)
+      actionview (= 8.1.3)
+      activesupport (= 8.1.3)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -41,36 +41,36 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.1.1)
+    actiontext (8.1.3)
       action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.1)
-      activerecord (= 8.1.1)
-      activestorage (= 8.1.1)
-      activesupport (= 8.1.1)
+      actionpack (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.1.1)
-      activesupport (= 8.1.1)
+    actionview (8.1.3)
+      activesupport (= 8.1.3)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.1.1)
-      activesupport (= 8.1.1)
+    activejob (8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.3.6)
-    activemodel (8.1.1)
-      activesupport (= 8.1.1)
-    activerecord (8.1.1)
-      activemodel (= 8.1.1)
-      activesupport (= 8.1.1)
+    activemodel (8.1.3)
+      activesupport (= 8.1.3)
+    activerecord (8.1.3)
+      activemodel (= 8.1.3)
+      activesupport (= 8.1.3)
       timeout (>= 0.4.0)
-    activestorage (8.1.1)
-      actionpack (= 8.1.1)
-      activejob (= 8.1.1)
-      activerecord (= 8.1.1)
-      activesupport (= 8.1.1)
+    activestorage (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activesupport (= 8.1.3)
       marcel (~> 1.0)
-    activesupport (8.1.1)
+    activesupport (8.1.3)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -83,17 +83,17 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     android_key_attestation (0.3.0)
     ast (2.4.3)
     base64 (0.3.0)
-    bcrypt (3.1.20)
-    bigdecimal (3.3.1)
+    bcrypt (3.1.22)
+    bigdecimal (4.1.2)
     bindata (2.5.1)
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -106,34 +106,35 @@ GEM
       xpath (~> 3.2)
     cbor (0.5.10.1)
     chunky_png (1.4.0)
-    concurrent-ruby (1.3.5)
-    connection_pool (2.5.4)
+    concurrent-ruby (1.3.7)
+    connection_pool (3.0.2)
     cose (1.3.1)
       cbor (~> 0.5.9)
       openssl-signature_algorithm (~> 1.0)
     crass (1.0.6)
-    date (3.5.0)
+    date (3.5.1)
     diff-lcs (1.6.2)
     drb (2.2.3)
-    dry-inflector (1.2.0)
-    erb (5.1.3)
+    dry-inflector (1.3.1)
+    erb (6.0.4)
     erubi (1.13.1)
     globalid (1.3.0)
       activesupport (>= 6.1)
-    i18n (1.14.7)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
-    io-console (0.8.1)
-    irb (1.15.3)
+    io-console (0.8.2)
+    irb (1.18.0)
       pp (>= 0.6.0)
+      prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.16.0)
-    jwt (3.1.2)
+    json (2.19.9)
+    jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
     logger (1.7.0)
-    loofah (2.24.1)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.9.0)
@@ -145,8 +146,8 @@ GEM
     marcel (1.1.0)
     matrix (0.4.3)
     mini_mime (1.1.5)
-    minitest (5.26.0)
-    net-imap (0.5.12)
+    minitest (5.27.0)
+    net-imap (0.6.4.1)
       date
       net-protocol
     net-pop (0.1.2)
@@ -156,15 +157,15 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.18.10-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
     openssl (3.3.1)
     openssl-signature_algorithm (1.3.0)
       openssl (> 2.0)
-    parallel (1.27.0)
-    parser (3.3.10.0)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     pastel (0.8.0)
@@ -172,44 +173,44 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
-    psych (5.2.6)
+    prism (1.9.0)
+    psych (5.3.1)
       date
       stringio
-    public_suffix (6.0.2)
+    public_suffix (7.0.5)
     racc (1.8.1)
-    rack (3.2.4)
-    rack-session (2.1.1)
+    rack (3.2.6)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
-    rackup (2.2.1)
+    rackup (2.3.1)
       rack (>= 3)
-    rails (8.1.1)
-      actioncable (= 8.1.1)
-      actionmailbox (= 8.1.1)
-      actionmailer (= 8.1.1)
-      actionpack (= 8.1.1)
-      actiontext (= 8.1.1)
-      actionview (= 8.1.1)
-      activejob (= 8.1.1)
-      activemodel (= 8.1.1)
-      activerecord (= 8.1.1)
-      activestorage (= 8.1.1)
-      activesupport (= 8.1.1)
+    rails (8.1.3)
+      actioncable (= 8.1.3)
+      actionmailbox (= 8.1.3)
+      actionmailer (= 8.1.3)
+      actionpack (= 8.1.3)
+      actiontext (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activemodel (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       bundler (>= 1.15.0)
-      railties (= 8.1.1)
+      railties (= 8.1.3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.1.1)
-      actionpack (= 8.1.1)
-      activesupport (= 8.1.1)
+    railties (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -217,24 +218,24 @@ GEM
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.3.1)
-    rdoc (6.15.1)
+    rake (13.4.2)
+    rdoc (7.2.0)
       erb
       psych (>= 4.0.0)
       tsort
-    regexp_parser (2.11.3)
-    reline (0.6.2)
+    regexp_parser (2.12.0)
+    reline (0.6.3)
       io-console (~> 0.5)
-    roda (3.98.0)
+    roda (3.104.0)
       rack
-    rodauth (2.41.0)
+    rodauth (2.44.0)
       roda (>= 2.6.0)
       sequel (>= 4)
     rotp (6.3.0)
-    rqrcode (3.1.0)
+    rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
+    rqrcode_core (2.1.0)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -248,41 +249,42 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.6)
-    rubocop (1.81.7)
+    rubocop (1.88.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.48.0)
+    rubocop-ast (1.49.1)
       parser (>= 3.3.7.2)
-      prism (~> 1.4)
+      prism (~> 1.7)
     rubocop-rake (0.7.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.72.1)
-    rubocop-rspec (3.8.0)
+    rubocop-rspec (3.10.2)
       lint_roller (~> 1.1)
-      rubocop (~> 1.81)
+      regexp_parser (>= 2.0)
+      rubocop (~> 1.86, >= 1.86.2)
     ruby-progressbar (1.13.0)
     safety_net_attestation (0.5.0)
       jwt (>= 2.0, < 4.0)
     securerandom (0.4.1)
-    sequel (5.98.0)
+    sequel (5.105.0)
       bigdecimal
     sequel-activerecord_connection (2.0.1)
       activerecord (>= 5.1)
       sequel (~> 5.38)
-    sqlite3 (2.8.0-arm64-darwin)
-    sqlite3 (2.8.0-x86_64-linux-gnu)
-    stringio (3.1.7)
-    thor (1.4.0)
-    tilt (2.6.1)
-    timeout (0.4.4)
+    sqlite3 (2.9.5-arm64-darwin)
+    sqlite3 (2.9.5-x86_64-linux-gnu)
+    stringio (3.2.0)
+    thor (1.5.0)
+    tilt (2.7.0)
+    timeout (0.6.1)
     tpm-key_attestation (0.14.1)
       bindata (~> 2.4)
       openssl (> 2.0)
@@ -304,10 +306,10 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
-    uri (1.1.0)
+    unicode-emoji (4.2.0)
+    uri (1.1.1)
     useragent (0.16.11)
-    warning (1.5.0)
+    warning (1.6.0)
     webauthn (3.4.3)
       android_key_attestation (~> 0.3.0)
       bindata (~> 2.4)
@@ -322,7 +324,7 @@ GEM
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.7.3)
+    zeitwerk (2.7.5)
 
 PLATFORMS
   arm64-darwin-25
@@ -334,20 +336,20 @@ DEPENDENCIES
   capybara
   dry-inflector
   irb
-  jwt (~> 3.1)
+  jwt (~> 3.2)
   rack-test (~> 2.1)
   rails (>= 6.0)
-  rake (~> 13.3)
+  rake (~> 13.4)
   rodauth-tools!
   rotp
   rqrcode
   rspec (~> 3.0)
-  rubocop (~> 1.81)
+  rubocop (~> 1.88)
   rubocop-rake
   rubocop-rspec
   sequel-activerecord_connection (~> 2.0)
-  sqlite3 (~> 2.8)
-  tilt (~> 2.4)
+  sqlite3 (~> 2.9)
+  tilt (~> 2.7)
   tryouts (~> 3.0)
   warning
   webauthn