spree_otp_auth 0.2.0

data/app/services/spree/otp/identity.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Spree
+  module Otp
+    # Phone/email normalisation and masking shared by the OTP services and
+    # controllers. Mobile-created accounts carry a synthetic
+    # "<digits><SpreeOtpAuth.synthetic_email_domain>" email, which counts as
+    # "no email".
+    module Identity
+      PHONE_FORMAT = /\A\+[1-9]\d{9,14}\z/
+
+      module_function
+
+      def synthetic_email_domain
+        domain = SpreeOtpAuth.synthetic_email_domain.to_s.downcase
+        domain.start_with?('@') ? domain : "@#{domain}"
+      end
+
+      def normalize_phone(raw)
+        digits = raw.to_s.gsub(/\D/, '')
+        return nil if digits.length < 10
+
+        digits = "91#{digits}" if digits.length == 10
+        "+#{digits}"
+      end
+
+      def valid_phone?(phone)
+        phone.to_s.match?(PHONE_FORMAT)
+      end
+
+      def normalize_email(raw)
+        raw.to_s.strip.downcase.presence
+      end
+
+      def valid_email?(email)
+        email.to_s.match?(URI::MailTo::EMAIL_REGEXP)
+      end
+
+      def email_identifier?(identifier)
+        identifier.to_s.include?('@')
+      end
+
+      def real_email?(email)
+        email.present? && !email.to_s.downcase.end_with?(synthetic_email_domain)
+      end
+
+      def synthetic_email_for(mobile)
+        "#{mobile.to_s.gsub(/\D/, '')}#{synthetic_email_domain}"
+      end
+
+      # Returns [normalized, 'email' | 'mobile'] or [nil, nil].
+      def normalize_identifier(identifier)
+        raw = identifier.to_s.strip
+        return [normalize_email(raw), 'email'] if email_identifier?(raw)
+
+        phone = normalize_phone(raw)
+        phone ? [phone, 'mobile'] : [nil, nil]
+      end
+
+      def mask_email(email)
+        user_part, domain = email.to_s.split('@', 2)
+        return email.to_s if user_part.blank? || domain.blank?
+
+        masked_user = user_part.length <= 2 ? "#{user_part[0]}***" : "#{user_part[0]}***#{user_part[-1]}"
+        "#{masked_user}@#{domain}"
+      end
+
+      def mask_phone(phone)
+        digits = phone.to_s.gsub(/\D/, '')
+        return phone.to_s if digits.length < 10
+
+        country_code = digits[0..-11]
+        "+#{country_code.presence || '91'} #{digits[-10..-9]}*** **#{digits[-3..]}"
+      end
+
+      def mask(identifier)
+        email_identifier?(identifier) ? mask_email(identifier) : mask_phone(identifier)
+      end
+    end
+  end
+end

data/app/services/spree/otp/marketing_consent.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Spree
+  module Otp
+    # Applies the customer's news-and-offers choice from the login screen (or
+    # the account order page) to the user and Spree's newsletter list.
+    #
+    # accept: true  -> subscribe (verified: they just proved the phone and
+    #                  typed or own the email)
+    #         false -> record the opt-out and drop any subscription
+    #         nil   -> no choice was shown; change nothing
+    module MarketingConsent
+      module_function
+
+      def call(user:, store:, accept:)
+        return if accept.nil? || user.nil?
+        return unless Spree::Otp::Identity.real_email?(user.email)
+
+        email = user.email.downcase
+
+        ApplicationRecord.transaction do
+          if accept
+            Spree::NewsletterSubscriber.subscribe(email: email, user: user, store: store)
+            subscriber = Spree::NewsletterSubscriber.find_by(email: email, store: store)
+            subscriber&.update!(user: user, verified_at: subscriber.verified_at || Time.current)
+          else
+            Spree::NewsletterSubscriber.where(email: email, store: store).destroy_all
+          end
+
+          user.update_columns(accepts_email_marketing: accept, email_marketing_decided_at: Time.current, updated_at: Time.current)
+        end
+      end
+    end
+  end
+end

data/app/services/spree/otp/rate_limiter.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module Spree
+  module Otp
+    class RateLimiter
+      MAX_HOURLY_DISPATCHES = 5
+      MAX_FAILED_ATTEMPTS = 5
+
+      attr_reader :store, :identifier
+
+      def initialize(store:, identifier:)
+        @store = store
+        @identifier = identifier.to_s.strip.downcase
+      end
+
+      # Checks if a resend cooldown is currently active.
+      # Returns remaining seconds (integer) or nil if cooldown has expired.
+      def cooldown_remaining(cooldown_seconds = nil)
+        cooldown = cooldown_seconds || default_cooldown_seconds
+        last_attempt = latest_attempt
+        return nil unless last_attempt
+
+        elapsed = Time.current - last_attempt.created_at
+        return nil if elapsed >= cooldown
+
+        (cooldown - elapsed).ceil
+      end
+
+      # Checks if hourly OTP dispatch limit has been exceeded.
+      def hourly_limit_exceeded?(limit = MAX_HOURLY_DISPATCHES)
+        attempts_in_last_hour >= limit
+      end
+
+      # Checks if the active attempt has reached max failed verification attempts.
+      def locked_out?(max_attempts = MAX_FAILED_ATTEMPTS)
+        active_attempt = latest_unverified_attempt
+        return false unless active_attempt
+
+        active_attempt.attempts_count >= (active_attempt.max_attempts || max_attempts)
+      end
+
+      # Full check for dispatch readiness.
+      # Returns [allowed (boolean), reason_code (symbol or nil), retry_after (integer or nil)]
+      def check_dispatch_allowed(cooldown_seconds = nil)
+        if hourly_limit_exceeded?
+          return [false, :hourly_limit_exceeded, 3600]
+        end
+
+        remaining = cooldown_remaining(cooldown_seconds)
+        if remaining && remaining.positive?
+          return [false, :cooldown_active, remaining]
+        end
+
+        [true, nil, nil]
+      end
+
+      private
+
+      def default_cooldown_seconds
+        config = store.respond_to?(:effective_otp_configuration) ? store.effective_otp_configuration : nil
+        config&.resend_cooldown_seconds || 30
+      end
+
+      def latest_attempt
+        Spree::OtpAttempt.where(store: store, identifier: identifier).order(created_at: :desc).first
+      end
+
+      def latest_unverified_attempt
+        Spree::OtpAttempt.where(store: store, identifier: identifier, verified_at: nil)
+                         .where('expires_at > ?', Time.current)
+                         .order(created_at: :desc)
+                         .first
+      end
+
+      def attempts_in_last_hour
+        Spree::OtpAttempt.where(store: store, identifier: identifier)
+                         .where('created_at > ?', 1.hour.ago)
+                         .count
+      end
+    end
+  end
+end

data/app/services/spree/otp/resend.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Spree
+  module Otp
+    class Resend
+      prepend Spree::ServiceModule::Base
+
+      # Resends on the latest attempt's channel (so a code that already moved to
+      # email stays on email), carrying over whatever was collected on screen.
+      def call(store:, identifier:, channel: nil, request_env: {})
+        normalized, = Spree::Otp::Identity.normalize_identifier(identifier)
+        normalized ||= identifier.to_s.strip
+
+        latest_attempt = Spree::OtpAttempt.where(store: store).login.for_identifier(normalized).order(created_at: :desc).first
+
+        Spree::Otp::Generate.call(
+          store: store,
+          identifier: identifier,
+          mobile_number: latest_attempt&.staged_mobile_number,
+          email: latest_attempt&.staged_email || latest_attempt&.link_email_attempt&.identifier,
+          channel: channel.presence || latest_attempt&.channel,
+          request_env: request_env
+        )
+      end
+    end
+  end
+end

data/app/services/spree/otp/verify.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+
+require 'jwt'
+require 'securerandom'
+
+module Spree
+  module Otp
+    class Verify
+      prepend Spree::ServiceModule::Base
+
+      # accept_marketing: nil when the news-and-offers box wasn't shown.
+      def call(store:, identifier:, code:, email_code: nil, accept_marketing: nil, request_env: {})
+        normalized_identifier, = Spree::Otp::Identity.normalize_identifier(identifier)
+        return failure(:invalid_identifier, 'Invalid email or phone number format.') if normalized_identifier.blank?
+
+        attempt = find_active_attempt(store, normalized_identifier)
+        return failure(:invalid_otp, 'The entered code is incorrect or expired. Please try again.') unless attempt
+
+        code_failure = check_code(attempt, code, :invalid_otp, 'The entered code is incorrect or expired. Please try again.')
+        return code_failure if code_failure
+
+        link_attempt = attempt.link_email_attempt
+        if link_attempt
+          return failure(:invalid_email_code, 'The code sent to your email is incorrect or expired.') if link_attempt.expired?
+
+          email_failure = check_code(link_attempt, email_code, :invalid_email_code, 'The code sent to your email is incorrect or expired.')
+          return email_failure if email_failure
+        end
+
+        user = nil
+        ApplicationRecord.transaction do
+          attempt.mark_verified!
+          link_attempt&.mark_verified!
+          user = resolve_user(attempt, normalized_identifier)
+          attempt.update(user: user) if attempt.user_id.nil?
+          Spree::Otp::MarketingConsent.call(user: user, store: store, accept: accept_marketing)
+        end
+
+        tokens = issue_tokens(user, request_env)
+
+        success(
+          user: user,
+          token: tokens[:token],
+          refresh_token: tokens[:refresh_token],
+          attempt: attempt
+        )
+      end
+
+      private
+
+      # Returns a failure Result, or nil when the code matches.
+      def check_code(attempt, submitted, error_code, message)
+        if attempt.locked?
+          return failure(:max_attempts_exceeded, 'Maximum verification attempts reached. Please request a new code.')
+        end
+        return nil if attempt.valid_code?(submitted)
+
+        attempt.record_failed_attempt!
+        return failure(:max_attempts_exceeded, 'Maximum verification attempts reached. Please request a new code.') if attempt.locked?
+
+        failure(error_code, message)
+      end
+
+      def find_active_attempt(store, identifier)
+        Spree::OtpAttempt.where(store: store, identifier: identifier).login.active
+                         .order(created_at: :desc)
+                         .first
+      end
+
+      def resolve_user(attempt, identifier)
+        user = if Spree::Otp::Identity.email_identifier?(identifier)
+                 find_or_create_email_user(identifier)
+               else
+                 attempt.user || find_or_create_mobile_user(identifier, attempt.staged_email)
+               end
+
+        changed = false
+        if attempt.staged_mobile_number.present? && user.mobile_number != attempt.staged_mobile_number
+          user.mobile_number = attempt.staged_mobile_number
+          changed = true
+        end
+        # A mobile-first login finished with an email backup code doesn't prove
+        # the phone. Email-first logins keep feature 010's behaviour.
+        phone_unproven = attempt.channel == 'email' && !Spree::Otp::Identity.email_identifier?(identifier)
+        if !phone_unproven && user.mobile_number.present? && user.respond_to?(:mobile_confirmed_at=) &&
+           (attempt.staged_mobile_number.present? || !Spree::Otp::Identity.email_identifier?(identifier))
+          user.mobile_confirmed_at ||= Time.current
+          changed = true
+        end
+        if attempt.staged_email.present? && !Spree::Otp::Identity.real_email?(user.email)
+          user.email = attempt.staged_email
+          changed = true
+        end
+        user.save!(validate: false) if changed
+        user
+      end
+
+      def find_or_create_email_user(email)
+        user = Spree.user_class.find_by('LOWER(email) = ?', email)
+        return user if user
+
+        user = Spree.user_class.new(
+          email: email,
+          auth_identifier: email,
+          auth_channel: 'email',
+          password: SecureRandom.hex(16)
+        )
+        user.save!(validate: false)
+        user
+      end
+
+      def find_or_create_mobile_user(mobile, staged_email = nil)
+        user = Spree.user_class.find_by(mobile_number: mobile)
+        return user if user
+
+        placeholder_email = Spree::Otp::Identity.synthetic_email_for(mobile)
+        user = Spree.user_class.find_by('LOWER(email) = ?', placeholder_email)
+        return user if user
+
+        user = Spree.user_class.new(
+          email: staged_email.presence || placeholder_email,
+          mobile_number: mobile,
+          auth_identifier: mobile,
+          auth_channel: 'mobile',
+          password: SecureRandom.hex(16)
+        )
+        user.save!(validate: false)
+        user
+      end
+
+      def issue_tokens(user, request_env)
+        env = {
+          ip_address: request_env[:ip_address],
+          user_agent: request_env[:user_agent]&.truncate(255)
+        }
+        refresh_token = Spree::RefreshToken.create_for(user, request_env: env)
+        jwt = generate_jwt(user)
+
+        {
+          token: jwt,
+          refresh_token: refresh_token.token
+        }
+      end
+
+      def generate_jwt(user, expiration: 30.days.to_i)
+        payload = {
+          user_id: user.id,
+          user_type: determine_user_type(user),
+          jti: SecureRandom.uuid,
+          iss: 'spree',
+          aud: 'store_api',
+          exp: Time.current.to_i + expiration
+        }
+        JWT.encode(payload, jwt_secret, 'HS256')
+      end
+
+      def determine_user_type(user)
+        if defined?(Spree.admin_user_class) && user.is_a?(Spree.admin_user_class)
+          'admin'
+        else
+          'customer'
+        end
+      end
+
+      def jwt_secret
+        Spree::Api::Config[:jwt_secret_key].presence ||
+          Rails.application.credentials.jwt_secret_key ||
+          ENV['JWT_SECRET_KEY'] ||
+          Rails.application.secret_key_base
+      end
+    end
+  end
+end

data/app/subscribers/spree/otp/delivery_failed_subscriber.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Spree
+  module Otp
+    # A provider accepted a login code, then reported it as failed (e.g. the
+    # number is not on WhatsApp). Sends the code by email when the backup is
+    # on; otherwise marks the attempt failed.
+    class DeliveryFailedSubscriber < Spree::Subscriber
+      subscribes_to 'notification.delivery_failed', async: false
+
+      def call(event)
+        payload = event.payload.to_h.stringify_keys
+        attempt = find_attempt(payload)
+        return if attempt.nil? || attempt.verified? || attempt.expired? || attempt.delivery_status == 'fallback_sent'
+
+        reason = payload['reason'].to_s.truncate(120)
+        Rails.logger.info("[SpreeOtpAuth] Code #{attempt.provider_message_id} failed for OTP attempt #{attempt.prefixed_id}")
+
+        config = attempt.store.effective_otp_configuration
+        result = if config.email_fallback_enabled?
+                   Spree::Otp::Fallback.call(store: attempt.store, attempt: attempt, reason: reason, enforce_cooldown: false)
+                 end
+        return if result&.success?
+
+        attempt.update_columns(delivery_status: 'failed', fallback_reason: reason.presence)
+      end
+
+      private
+
+      def find_attempt(payload)
+        scope = Spree::OtpAttempt.login.where(store_id: payload['store_id'])
+        if payload['delivery_id'].present?
+          delivery = Spree::NotificationDelivery.find_by(id: payload['delivery_id'])
+          by_ref = scope.find_by(delivery_message_ref: delivery.message_ref) if delivery
+          return by_ref if by_ref
+        end
+        return nil if payload['provider_message_id'].blank?
+
+        scope.find_by(provider_message_id: payload['provider_message_id'])
+      end
+    end
+  end
+end

data/app/views/spree/admin/otp_configurations/edit.html.erb

@@ -0,0 +1,141 @@
+<% content_for :title do %>
+  <%= Spree.t('otp_auth.admin.title', default: 'OTP Authentication Settings') %>
+<% end %>
+
+<% content_for :page_title do %>
+  <%= Spree.t('otp_auth.admin.title', default: 'OTP Authentication Settings') %>
+<% end %>
+
+<div class="grid grid-cols-12 gap-6">
+  <div class="col-span-12 lg:col-span-8 lg:col-start-3">
+    <%= render 'spree/admin/shared/error_messages', target: @otp_configuration %>
+
+    <div class="card mb-6">
+      <div class="card-body flex items-center justify-between">
+        <div>
+          <h5 class="card-title text-base font-semibold text-gray-900 mb-1">
+            Store Context: <%= current_store.name %>
+          </h5>
+          <p class="text-xs text-gray-500 mb-0">
+            Settings configured here are strictly isolated to <strong><%= current_store.name %></strong> (Code: <%= current_store.code %>).
+          </p>
+        </div>
+        <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-blue-100 text-blue-800">
+          <%= current_store.code.upcase %>
+        </span>
+      </div>
+    </div>
+
+    <%= form_with model: @otp_configuration, scope: :otp_configuration, url: spree.admin_otp_configuration_path, method: :patch, id: 'otp-configuration-form' do |f| %>
+      <!-- Channel & Timing Section -->
+      <div class="card mb-6">
+        <div class="card-header border-b border-gray-200 px-6 py-4">
+          <h5 class="card-title text-sm font-semibold text-gray-900">
+            <%= Spree.t('otp_auth.admin.channel_header', default: 'Channel & Template Configuration') %>
+          </h5>
+        </div>
+        <div class="card-body px-6 py-4 space-y-4">
+          <div>
+            <% channel_options = [['WhatsApp', 'whatsapp'], ['SMS', 'mobile'], ['Email', 'email']] %>
+            <%= f.spree_select :active_channel,
+                  options_for_select(channel_options, @otp_configuration.active_channel),
+                  { label: Spree.t('otp_auth.admin.active_channel', default: 'Primary Verification Channel') } %>
+            <p class="text-xs text-gray-500 mt-1">
+              Customers sign in with their mobile number. WhatsApp and SMS send the code to that number; Email sends it to the account's email.
+            </p>
+          </div>
+
+          <% %w[whatsapp mobile].each do |otp_channel| %>
+            <% missing = @otp_configuration.missing_requirements(otp_channel) %>
+            <% provider_channel = Spree::Otp::Delivery.provider_channel(otp_channel) %>
+            <div class="flex items-start justify-between gap-4 rounded-md border border-gray-200 px-4 py-3" id="otp-channel-status-<%= otp_channel %>">
+              <div>
+                <p class="text-sm font-medium text-gray-900 mb-1"><%= otp_channel == 'mobile' ? 'SMS' : 'WhatsApp' %> providers</p>
+                <% if missing.empty? %>
+                  <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800">Ready</span>
+                  <span class="text-xs text-gray-500 ml-1">
+                    <%= SpreeNotificationProviders.channel_status(current_store, provider_channel).select { |s| s[:status] == :ready }.map { |s| SpreeNotificationProviders.provider(s[:provider_key])&.label }.compact.join(' → ') %>
+                  </span>
+                <% else %>
+                  <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-red-100 text-red-800">Not set up</span>
+                  <span class="text-xs text-gray-500 ml-1">Missing: <%= missing.join(', ') %></span>
+                <% end %>
+              </div>
+              <%= link_to 'Notification providers', spree.admin_notification_providers_path(channel: provider_channel),
+                    class: 'text-sm text-blue-600 hover:underline font-medium whitespace-nowrap' %>
+            </div>
+          <% end %>
+
+          <div class="flex items-start gap-3">
+            <%= f.check_box :fallback_channel,
+                  { checked: @otp_configuration.email_fallback_enabled?, class: 'mt-1 h-4 w-4 rounded border-gray-300' },
+                  'email', 'none' %>
+            <div>
+              <%= f.label :fallback_channel, Spree.t('otp_auth.admin.email_backup', default: 'Email backup'), class: 'text-sm font-medium text-gray-900' %>
+              <p class="text-xs text-gray-500 mb-0">
+                If WhatsApp or SMS can't deliver the code, send it to the customer's email automatically, and offer
+                "Send code by email instead" on the code screen after the resend wait.
+              </p>
+            </div>
+          </div>
+
+          <% template_model = SpreeOtpAuth.email_template_model %>
+          <% if template_model %>
+          <% email_templates = template_model.column_names.include?('store_id') ? template_model.where(store_id: [current_store.id, nil]) : template_model.all %>
+          <div>
+            <%= f.spree_select :email_template_id,
+                  options_for_select(
+                    [['Default Responsive OTP Mailer', '']] +
+                    email_templates.map { |t| [t.name, t.id] },
+                    @otp_configuration.email_template_id
+                  ),
+                  { label: Spree.t('otp_auth.admin.email_template', default: 'Transactional Email Template') } %>
+            <p class="text-xs text-gray-500 mt-1">
+              Select an email template configured in <a href="/admin/email_templates" class="text-blue-600 hover:underline font-medium" target="_blank">Email Templates</a> with <code>{{otp_code}}</code>, <code>{{store_name}}</code>, and <code>{{expiry_minutes}}</code> variables, or use the built-in responsive mailer.
+            </p>
+          </div>
+          <% end %>
+
+          <div class="grid grid-cols-1 md:grid-cols-2 gap-4 pt-2">
+            <div>
+              <%= f.spree_select :otp_length,
+                    options_for_select([
+                      ['6 Digits (Recommended)', 6],
+                      ['4 Digits', 4]
+                    ], @otp_configuration.otp_length),
+                    { label: Spree.t('otp_auth.admin.otp_length', default: 'OTP Length') } %>
+            </div>
+            <div>
+              <%= f.spree_number_field :otp_expiry_seconds,
+                    label: Spree.t('otp_auth.admin.otp_expiry_seconds', default: 'OTP Expiry (seconds)'),
+                    min: 60,
+                    step: 10 %>
+              <p class="text-xs text-gray-400 mt-1">Duration before OTP expires (min 60s, default 600s).</p>
+            </div>
+          </div>
+
+          <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <div>
+              <%= f.spree_number_field :resend_cooldown_seconds,
+                    label: Spree.t('otp_auth.admin.resend_cooldown_seconds', default: 'Resend Cooldown (seconds)'),
+                    min: 10,
+                    step: 5 %>
+              <p class="text-xs text-gray-400 mt-1">Wait duration before resend OTP is unlocked (default 30s).</p>
+            </div>
+            <div>
+              <%= f.spree_number_field :fallback_delay_seconds,
+                    label: Spree.t('otp_auth.admin.fallback_delay_seconds', default: 'Fallback Option Delay (seconds)'),
+                    min: 10,
+                    step: 5 %>
+              <p class="text-xs text-gray-400 mt-1">Threshold before secondary fallback option button is displayed (default 20s).</p>
+            </div>
+          </div>
+        </div>
+      </div>
+
+      <div class="form-actions mt-6 flex justify-end">
+        <%= f.submit Spree.t(:update, default: 'Update Settings'), class: 'btn btn-primary' %>
+      </div>
+    <% end %>
+  </div>
+</div>

data/app/views/spree/otp_mailer/send_otp.html.erb

@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title><%= @code %> is your <%= @store.name %> verification code</title>
+    <style>
+      body {
+        margin: 0;
+        padding: 0;
+        background-color: #f7f7f8;
+        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+        color: #111827;
+      }
+      .container {
+        max-width: 520px;
+        margin: 40px auto;
+        background: #ffffff;
+        border-radius: 8px;
+        border: 1px solid #e5e7eb;
+        overflow: hidden;
+      }
+      .header {
+        padding: 24px;
+        text-align: center;
+        border-bottom: 1px solid #f3f4f6;
+      }
+      .store-name {
+        font-size: 20px;
+        font-weight: 700;
+        color: #111827;
+        margin: 0;
+      }
+      .content {
+        padding: 32px 24px;
+        text-align: center;
+      }
+      .title {
+        font-size: 18px;
+        font-weight: 600;
+        margin: 0 0 12px 0;
+        color: #111827;
+      }
+      .subtitle {
+        font-size: 14px;
+        color: #6b7280;
+        margin: 0 0 24px 0;
+        line-height: 1.5;
+      }
+      .otp-box {
+        display: inline-block;
+        font-size: 32px;
+        font-weight: 800;
+        letter-spacing: 6px;
+        padding: 14px 28px;
+        background: #f3f4f6;
+        border-radius: 6px;
+        color: #111827;
+        margin-bottom: 24px;
+        font-family: monospace;
+      }
+      .expiry-notice {
+        font-size: 13px;
+        color: #9ca3af;
+        margin: 0 0 8px 0;
+      }
+      .security-warning {
+        font-size: 12px;
+        color: #9ca3af;
+        margin: 0;
+        line-height: 1.4;
+      }
+      .footer {
+        padding: 16px 24px;
+        background: #f9fafb;
+        border-top: 1px solid #f3f4f6;
+        text-align: center;
+        font-size: 12px;
+        color: #9ca3af;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <div class="header">
+        <h1 class="store-name"><%= @store.name %></h1>
+      </div>
+      <div class="content">
+        <h2 class="title">Verification Code</h2>
+        <p class="subtitle">Use the code below to complete your sign-in to <%= @store.name %>.</p>
+        <div class="otp-box"><%= @code %></div>
+        <p class="expiry-notice">This code expires in <%= @expiry_minutes %> minutes.</p>
+        <p class="security-warning">If you did not request this login code, please safely disregard this email.</p>
+      </div>
+      <div class="footer">
+        &copy; <%= Time.current.year %> <%= @store.name %>. All rights reserved.
+      </div>
+    </div>
+  </body>
+</html>