sqrl-rails 0.1.0

data/app/models/sqrl/rails/identity.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # A SQRL association (+sqrl_identities+). +idk+, +suk+ and +vuk+ are base64url.
+    # Rows with +superseded_by+ set are tombstones left behind by a re-key.
+    class Identity < ::ActiveRecord::Base
+      self.table_name = "sqrl_identities"
+
+      belongs_to :user, polymorphic: true, optional: true
+
+      scope :active, -> { where(superseded_by: nil) }
+      scope :superseded, -> { where.not(superseded_by: nil) }
+      # Identities whose client asked the site to refuse non-SQRL authentication.
+      scope :sqrl_only, -> { where(sqrlonly: true) }
+      # Identities whose client asked the site to refuse non-SQRL account recovery.
+      scope :hard_locked, -> { where(hardlock: true) }
+      # Identities attached to a user record (or a +"Type:id"+ reference).
+      scope :for_user, lambda { |user|
+        ref = SQRL::Rails.user_ref(user)
+        type, id = ref.to_s.split(":", 2)
+        where(user_type: type, user_id: id)
+      }
+
+      validates :idk, presence: true, uniqueness: true
+
+      def superseded? = !superseded_by.nil?
+
+      # Raw +idk+ bytes.
+      def idk_bytes = SQRL::Util.b64u_decode(idk)
+
+      # A short, display-safe handle for the identity (the key is a public value, but a
+      # full base64url key is unwieldy in a table).
+      def short_idk = "#{idk[0, 12]}…"
+
+      # The policy flags the client set, as words.
+      #
+      # @return [Array<String>]
+      def flags
+        list = []
+        list << "disabled" if disabled
+        list << "SQRL only" if sqrlonly
+        list << "hard lock" if hardlock
+        list
+      end
+    end
+  end
+end

data/app/models/sqrl/rails/nut.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # An issued nut (+sqrl_nuts+). Consumed at most once; pruned by +sqrl:prune+.
+    class Nut < ::ActiveRecord::Base
+      self.table_name = "sqrl_nuts"
+
+      scope :unused, -> { where(used_at: nil) }
+      scope :expired, ->(now = Time.current) { where("expires_at <= ?", now) }
+    end
+  end
+end

data/app/models/sqrl/rails/pending_login.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # One login page view (+sqrl_pending_logins+), keyed by the opaque +login_id+ kept in
+    # the browser session. Pruned by +sqrl:prune+.
+    class PendingLogin < ::ActiveRecord::Base
+      self.table_name = "sqrl_pending_logins"
+
+      scope :expired, ->(now = Time.current) { where("expires_at <= ?", now) }
+
+      def authenticated? = !authenticated_idk.nil?
+    end
+  end
+end

data/app/views/layouts/sqrl/rails/application.html.erb

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Sign in with SQRL</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csrf_meta_tags %>
+    <style>
+      body { font-family: system-ui, sans-serif; max-width: 36em; margin: 3em auto; line-height: 1.5; padding: 0 1em; }
+      .sqrl-login__link { display: inline-block; padding: .6em 1.2em; background: #007cc3; color: #fff; border-radius: .4em; text-decoration: none; }
+      .sqrl-login__qr svg { max-width: 16em; height: auto; display: block; margin: 1em 0; }
+      .sqrl-alert { color: #b00020; }
+    </style>
+  </head>
+  <body>
+    <%= yield %>
+  </body>
+</html>

data/app/views/sqrl/rails/identities/index.html.erb

@@ -0,0 +1,27 @@
+<h1>Your SQRL identities</h1>
+<% if flash[:alert] %><p class="sqrl-alert" role="alert"><%= flash[:alert] %></p><% end %>
+<% if flash[:notice] %><p class="sqrl-notice" role="status"><%= flash[:notice] %></p><% end %>
+
+<% if @identities.empty? %>
+  <p id="sqrl-no-identities">No SQRL identity is linked to your account yet.</p>
+<% else %>
+  <table class="sqrl-identities">
+    <thead>
+      <tr><th>Identity</th><th>Linked</th><th>Last login</th><th>Logins</th><th>Flags</th><th></th></tr>
+    </thead>
+    <tbody>
+      <% @identities.each do |identity| %>
+        <tr id="sqrl-identity-<%= identity.id %>" data-sqrl-idk="<%= identity.idk %>">
+          <td><code><%= identity.short_idk %></code><% if identity.idk == @current_idk %> <em>(this session)</em><% end %></td>
+          <td><%= identity.created_at&.to_fs(:short) %></td>
+          <td><%= identity.last_login_at&.to_fs(:short) || "never" %></td>
+          <td><%= identity.logins %></td>
+          <td><%= identity.flags.join(", ") %></td>
+          <td><%= button_to "Unlink", identity_unlink_path(identity), method: :delete,
+                            form: { data: { turbo_confirm: "Unlink this SQRL identity?" } } %></td>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+<% end %>
+<p><%= link_to "Back", main_app.respond_to?(:root_path) ? main_app.root_path : "/" %></p>

data/app/views/sqrl/rails/logins/new.html.erb

@@ -0,0 +1,3 @@
+<h1>Sign in with SQRL</h1>
+<% if flash[:alert] %><p class="sqrl-alert" role="alert"><%= flash[:alert] %></p><% end %>
+<%= sqrl_login_block(return_to: @return_to) %>

data/config/locales/en.yml

@@ -0,0 +1,11 @@
+en:
+  sqrl:
+    password_policy:
+      sqrl_only: "This account signs in with SQRL only."
+      hard_lock: "Password recovery is disabled for this account; sign in with SQRL instead."
+    identities:
+      unlinked: "SQRL identity unlinked."
+      not_found: "That SQRL identity is not linked to your account."
+      sign_in_required: "Sign in to manage your SQRL identities."
+    callback:
+      declined: "You declined the SQRL login."

data/config/routes.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+SQRL::Rails::Engine.routes.draw do
+  post "cli", to: "cli#create", as: :cli
+  get "status", to: "status#show", as: :status
+  get "callback", to: "callback#show", as: :callback
+  get "login", to: "logins#new", as: :login
+  get "sqrl.js", to: "assets#script", as: :script
+  get "refresh", to: "refresh#show", as: :refresh
+  get "identities", to: "identities#index", as: :identities
+  delete "identities/:id", to: "identities#destroy", as: :identity_unlink
+end

data/lib/generators/sqrl/install/install_generator.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+# Generator namespace (+bin/rails generate sqrl:install+).
+module Sqrl
+  # Generator namespace.
+  module Generators
+    # `bin/rails generate sqrl:install`
+    #
+    # Adds the SQRL tables, mounts the engine, writes the initializer, links the user
+    # model and, when the application has Rails 8's generated login form, drops the SQRL
+    # login block into it. Every step is idempotent.
+    class InstallGenerator < ::Rails::Generators::Base
+      include ::ActiveRecord::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      class_option :skip_migration, type: :boolean, default: false, desc: "Do not copy the migration"
+      class_option :skip_views, type: :boolean, default: false, desc: "Do not touch app/views/sessions/new.html.erb"
+      class_option :skip_routes, type: :boolean, default: false, desc: "Do not mount the engine"
+      class_option :host, type: :string, default: nil, desc: "Public host for sqrl:// URLs (default: request host)"
+      class_option :mount, type: :string, default: "/sqrl", desc: "Where to mount the engine"
+      class_option :user_model, type: :string, default: "User", desc: "Name of the user model"
+
+      # Copy the +create_sqrl_tables+ migration unless one exists.
+      def copy_migration
+        return if options[:skip_migration]
+
+        migration_template "create_sqrl_tables.rb.tt", "db/migrate/create_sqrl_tables.rb"
+      end
+
+      # Mount the engine in +config/routes.rb+ (idempotent).
+      def mount_engine
+        return if options[:skip_routes]
+
+        line = %(mount SQRL::Rails::Engine, at: "#{options[:mount]}", as: :sqrl)
+        return say_status(:identical, "config/routes.rb already mounts the engine", :blue) if routes_include?(line)
+
+        route line
+      end
+
+      # Write +config/initializers/sqrl.rb+ with every option documented.
+      def create_initializer
+        template "initializer.rb.tt", "config/initializers/sqrl.rb"
+      end
+
+      # Add +has_many :sqrl_identities+ to the user model (idempotent).
+      def link_user_model
+        path = user_model_path
+        full = File.expand_path(path, destination_root)
+        return say_status(:skip, "#{path} not found; add `has_many :sqrl_identities` yourself", :yellow) unless File.exist?(full)
+
+        association = %(  has_many :sqrl_identities, class_name: "SQRL::Rails::Identity", as: :user, dependent: :destroy\n)
+        if File.read(full).include?("has_many :sqrl_identities")
+          say_status(:identical, path, :blue)
+        else
+          inject_into_class path, options[:user_model].classify, association
+        end
+      end
+
+      # Enforce the sqrlonly / hardlock account policies in the controllers that
+      # `bin/rails generate authentication` produced.
+      def include_password_policy
+        inject_policy("app/controllers/sessions_controller.rb", "SessionsController",
+                      "SQRL::Rails::PasswordPolicy::Sessions")
+        inject_policy("app/controllers/passwords_controller.rb", "PasswordsController",
+                      "SQRL::Rails::PasswordPolicy::Passwords")
+      end
+
+      # Append the login block to +sessions/new+ when that view exists (idempotent).
+      def add_login_block_to_sessions_view
+        return if options[:skip_views]
+
+        path = "app/views/sessions/new.html.erb"
+        full = File.expand_path(path, destination_root)
+        return unless File.exist?(full)
+
+        if File.read(full).include?("sqrl_login_block")
+          say_status(:identical, path, :blue)
+        else
+          append_to_file path, "\n<hr>\n<h2>Or sign in with SQRL</h2>\n<%= sqrl_login_block %>\n"
+        end
+      end
+
+      # Print what to do next.
+      def show_next_steps
+        say <<~TEXT
+
+          SQRL login is set up. Next:
+
+            bin/rails db:migrate
+
+          Then start the server and open /sessions/new (or #{options[:mount]}/login).
+          Configuration lives in config/initializers/sqrl.rb.
+        TEXT
+      end
+
+      private
+
+      def inject_policy(path, klass, concern)
+        full = File.expand_path(path, destination_root)
+        return unless File.exist?(full)
+
+        if File.read(full).include?(concern)
+          say_status(:identical, path, :blue)
+        else
+          inject_into_class path, klass, "  include #{concern}\n"
+        end
+      end
+
+      def user_model_path
+        "app/models/#{options[:user_model].underscore}.rb"
+      end
+
+      def routes_include?(line)
+        path = File.expand_path("config/routes.rb", destination_root)
+        File.exist?(path) && File.read(path).include?(line)
+      end
+
+      def host_option
+        options[:host]
+      end
+
+      def migration_version
+        "[#{::ActiveRecord::Migration.current_version}]"
+      end
+    end
+  end
+end

data/lib/generators/sqrl/install/templates/create_sqrl_tables.rb.tt

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+class CreateSQRLTables < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :sqrl_identities do |t|
+      t.string :idk, null: false
+      t.string :suk
+      t.string :vuk
+      t.boolean :disabled, null: false, default: false
+      t.boolean :sqrlonly, null: false, default: false
+      t.boolean :hardlock, null: false, default: false
+      t.string :ins
+      t.integer :logins, null: false, default: 0
+      t.string :user_type
+      t.bigint :user_id
+      t.string :superseded_by
+      t.datetime :last_login_at
+      t.timestamps
+    end
+    add_index :sqrl_identities, :idk, unique: true
+    add_index :sqrl_identities, %i[user_type user_id]
+
+    create_table :sqrl_nuts do |t|
+      t.string :nut, null: false
+      t.string :pending_login_id, null: false
+      t.text :expected_server, null: false
+      t.string :ip
+      t.string :bound_idk
+      t.datetime :expires_at
+      t.datetime :used_at
+      t.datetime :created_at, null: false
+    end
+    add_index :sqrl_nuts, :nut, unique: true
+    add_index :sqrl_nuts, :expires_at
+
+    create_table :sqrl_pending_logins do |t|
+      t.string :login_id, null: false
+      t.string :authenticated_idk
+      t.datetime :authenticated_at
+      t.integer :btn
+      t.boolean :asked, null: false, default: false
+      t.string :last_command
+      t.string :cps_token
+      t.datetime :cps_token_expires_at
+      t.string :ip
+      t.string :return_to
+      t.string :link_user_ref
+      t.boolean :ip_matched, null: false, default: false
+      t.datetime :expires_at
+      t.timestamps
+    end
+    add_index :sqrl_pending_logins, :login_id, unique: true
+    add_index :sqrl_pending_logins, :cps_token, unique: true
+    add_index :sqrl_pending_logins, :expires_at
+  end
+end

data/lib/generators/sqrl/install/templates/initializer.rb.tt

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+# SQRL login (sqrl-rails). Every option is documented in SQRL::Rails::Configuration.
+Rails.application.config.sqrl.tap do |sqrl|
+  # The public host (and port, when not the default) placed in the sqrl:// login URLs.
+  # SQRL identities are derived from this host, so it must be the name users see.
+  # When nil, the host of each request is used.
+<% if host_option -%>
+  sqrl.host = <%= host_option.inspect %>
+<% else -%>
+  sqrl.host = ENV["SQRL_HOST"].presence
+<% end -%>
+
+  # The user model.
+  sqrl.user_class = <%= options[:user_model].classify.inspect %>
+
+  # What to do when an unknown SQRL identity logs in:
+  #   :create  create an account for it (the SQRL default; see sqrl.create_user)
+  #   :link    only accept it while a user is signed in, and attach it to that user
+  #   :refuse  reject it
+  sqrl.on_unknown_identity = :create
+
+  # How a user is created for a new identity under :create. The default
+  # (SQRL::Rails::UserFactory) fills in placeholders for the columns your model has:
+  # a random password for has_secure_password and a non-routable email address.
+  # Replace it to collect real details, for example by redirecting to a profile form.
+  # sqrl.create_user = ->(identity) { User.create!(name: "SQRL user", password: SecureRandom.hex(32)) }
+
+  # How the user is signed in. By default the Authentication concern generated by
+  # `bin/rails generate authentication` is used (start_new_session_for); without it,
+  # session[:user_id] is set. Devise users should use the devise-sqrl gem instead.
+  # sqrl.sign_in = ->(controller, identity, user) { controller.send(:start_new_session_for, user) }
+
+  # Where to go after signing in (a same-site return_to recorded at login time wins).
+  # sqrl.after_sign_in = ->(controller, completion) { controller.send(:after_authentication_url) }
+
+  # Where to go when a login cannot be completed (default: the engine's login page).
+  # sqrl.failure_path = "/session/new"
+
+  # Protocol options (see SQRL::Server::Config): sqrl.nut_ttl, sqrl.cps_token_ttl,
+  # sqrl.require_ip_match, sqrl.path_extension, sqrl.on_authenticated.
+
+  # Optional hardening: refuse to complete a login through the page's poller (no CPS
+  # token) when the SQRL client's IP did not match the browser's. Off by default because
+  # a phone on another network is a normal SQRL login.
+  # sqrl.poll_requires_ip_match = true
+
+  # Loopback-only testing mode: issue qrl:// (plain http) URLs so the browser extension's
+  # test client can log in to `bin/rails server` without TLS. qrl:// is not part of the
+  # final SQRL specification and real clients refuse it; it is rejected for any host that
+  # is not loopback.
+  # sqrl.insecure_http = Rails.env.development? && ENV["SQRL_INSECURE_HTTP"].present?
+
+  # Ask the user a question on every login (the client shows it with the buttons; the
+  # answer arrives as btn=1 or btn=2). ask_deny_button names the button that refuses
+  # the login. SQRL_ASK=1 turns the example question on for testing.
+  if ENV["SQRL_ASK"].present?
+    sqrl.ask = SQRL::Ask.new(message: "Allow this login?", buttons: [{ label: "Allow" }, { label: "Deny" }],
+                             accept: [1])   # only "Allow" lets the ident proceed
+    sqrl.ask_deny_button = 2               # and a "Deny" that slips through is refused at the callback
+  end
+
+  # Secret index: the server sends sin= and the client answers with ins=, a per-site
+  # secret derived from its identity, which the site can use as an extra factor.
+  sqrl.sin = "0" if ENV["SQRL_SIN"].present?
+
+  # Rate limit for the protocol endpoint and the login page, per client IP, counted in
+  # Rails.cache. nil disables it.
+  # sqrl.rate_limit = { to: 60, within: 1.minute }
+
+  # Hosts a request may use when sqrl.host is not set (Strings or Regexps), and how many
+  # distinct request hosts are kept per process; nuts and pending logins are pruned
+  # opportunistically every prune_every handled requests.
+  # sqrl.allowed_hosts = ["example.com", /\.example\.com\z/]
+  # sqrl.host_cache_limit = 16
+  # sqrl.prune_every = 1000
+
+  # Hooks run before a login URL is issued and before a protocol request is handled;
+  # raise SQRL::Server::RateLimited to refuse (the request gets a 429).
+  # sqrl.before_handle = ->(context) { raise SQRL::Server::RateLimited.new(retry_after: 10) if Throttle.hot?(context[:ip]) }
+
+  # Storage: :active_record (default, tables from the sqrl:install migration), :cache
+  # (Rails.cache or sqrl.cache_store; needs Redis or Memcached) or :memory.
+  sqrl.stores = :active_record
+end
+
+# Account policies: a SQRL client can ask the site to refuse password logins (sqrlonly)
+# and password recovery (hardlock) for its account. The generator includes
+# SQRL::Rails::PasswordPolicy::Sessions / ::Passwords into the generated controllers to
+# enforce them; SQRL::Rails.sqrl_only?(user) and SQRL::Rails.hard_locked?(user) are
+# available for your own code. Users can review their identities at /sqrl/identities.

data/lib/sqrl/rails/configuration.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # +Rails.application.config.sqrl+. Every {SQRL::Server::Config} option is available,
+    # plus the Rails-specific settings that map a SQRL identity to a user and a user to a
+    # signed-in session.
+    #
+    #   Rails.application.config.sqrl.tap do |sqrl|
+    #     sqrl.host = "example.com"           # public host placed in sqrl:// URLs (default: request host)
+    #     sqrl.on_unknown_identity = :create  # :create, :link or :refuse
+    #     sqrl.sign_in = ->(controller, identity, user) { controller.send(:start_new_session_for, user) }
+    #   end
+    class Configuration
+      # Options forwarded unchanged to {SQRL::Server::Config}.
+      SERVER_OPTIONS = %i[insecure_http path_extension nut_ttl cps_token_ttl require_ip_match ask sin
+                          on_unknown_identity on_authenticated cps_url clock logger allowed_hosts prune_every
+                          before_issue before_handle].freeze
+
+      # --- protocol (see SQRL::Server::Config) ---------------------------------------
+      # Public host (with port when not default) for issued +sqrl://+ URLs. Defaults to
+      # the request's host.
+      attr_accessor :host
+      # Always +"sqrl"+ (HTTPS). Leave nil; set +insecure_http+ for the testing mode.
+      attr_accessor :scheme
+      # Loopback-only testing mode issuing +qrl://+ (plain http) URLs, for example to try
+      # the browser extension against +bin/rails server+ without TLS. +qrl://+ is not part
+      # of the final SQRL specification; real clients require +sqrl://+ over HTTPS.
+      attr_accessor :insecure_http
+      # Optional hardening (default false): a login completed through the browser's own
+      # cookie (the poll path) counts only when the SQRL client's IP matched the
+      # browser's. It also refuses legitimate logins from a phone on another network.
+      attr_accessor :poll_requires_ip_match
+      attr_accessor :path_extension, :nut_ttl, :cps_token_ttl, :require_ip_match, :ask, :sin, :on_unknown_identity, :on_authenticated, :cps_url,
+                    :clock, :logger, :session_key, :identity_key
+      # Hosts (Strings or Regexps) a request may use when +host+ is not configured.
+      attr_accessor :allowed_hosts
+      # Maximum number of distinct derived request hosts kept per process (default 16).
+      attr_accessor :host_cache_limit
+      # Delete expired nuts and pending logins after every N handled requests (default
+      # 1000; nil disables opportunistic pruning).
+      attr_accessor :prune_every
+      # Callables +(context)+ run before a login URL is issued / before a protocol request
+      # is handled; raise +SQRL::Server::RateLimited+ to refuse (answered with 429).
+      attr_accessor :before_issue, :before_handle
+
+      # When the site poses an +ask+ (see +ask+), the number of the button that means
+      # "do not log me in" (buttons are numbered from 1). A login completed with that
+      # answer is refused at the callback. +nil+ accepts every answer.
+      attr_accessor :ask_deny_button
+
+      # --- storage ---------------------------------------------------------------------
+      # +:active_record+ (default), +:cache+ (see +cache_store+), +:memory+, or an
+      # +SQRL::Server::Stores+.
+      attr_accessor :stores
+      # The +ActiveSupport::Cache::Store+ used by +stores = :cache+ (default +Rails.cache+).
+      # It must delete atomically (Redis, Memcached); see {Stores::Cache}.
+      attr_accessor :cache_store
+
+      # --- users -----------------------------------------------------------------------
+      # Name of the user model (+"User"+).
+      attr_accessor :user_class
+      # Callable +(identity) -> user or nil+ resolving the record an identity belongs to.
+      attr_accessor :find_user
+      # Callable +(identity) -> user+ creating a user for a brand-new identity
+      # (+on_unknown_identity = :create+). Defaults to {UserFactory}.
+      attr_accessor :create_user
+      # Callable +(controller) -> user or nil+ giving the signed-in user, used to link new
+      # identities (+:link+). Defaults to +Current.user+ when the host defines it.
+      attr_accessor :current_user
+      # Callable +(controller, identity, user)+ that signs the user in. Defaults to
+      # {SignIn.default}: +start_new_session_for+ from Rails' generated
+      # +Authentication+ concern when present, otherwise +session[:user_id]+.
+      attr_accessor :sign_in
+      # Callable +(controller, completion) -> String+ giving the redirect target after
+      # sign-in; a same-site +return_to+ recorded on the pending login wins.
+      attr_accessor :after_sign_in
+      # Where to send the browser when the callback cannot complete a login.
+      attr_accessor :failure_path
+
+      # --- plumbing --------------------------------------------------------------------
+      # Mount path of the engine; auto-detected from the routes when nil.
+      attr_accessor :mount_path
+      # Callable +(request) -> String+ resolving the client IP (default +remote_ip+).
+      attr_accessor :ip
+      # Rate limit for the protocol endpoint and the login page, as
+      # +{ to: 60, within: 1.minute }+ (per client IP, counted in +Rails.cache+); +nil+
+      # disables it. Optional keys: +by:+ a callable +(request) -> String+, +cache:+ a
+      # cache store, +only:+ an array of +:cli+, +:login+, +:status+, +:callback+.
+      attr_accessor :rate_limit
+
+      def initialize
+        @host = nil
+        @scheme = nil
+        @insecure_http = false
+        @poll_requires_ip_match = false
+        @path_extension = nil
+        @nut_ttl = 300
+        @cps_token_ttl = 60
+        @require_ip_match = true
+        @ask = nil
+        @sin = nil
+        @ask_deny_button = nil
+        @allowed_hosts = nil
+        @host_cache_limit = nil
+        @prune_every = nil
+        @before_issue = nil
+        @before_handle = nil
+        @on_unknown_identity = :create
+        @on_authenticated = nil
+        @cps_url = nil
+        @clock = nil
+        @logger = nil
+        @stores = :active_record
+        @cache_store = nil
+        @user_class = "User"
+        @find_user = nil
+        @create_user = nil
+        @current_user = nil
+        @sign_in = nil
+        @after_sign_in = nil
+        @failure_path = nil
+        @mount_path = nil
+        @session_key = SQRL::Rack::Endpoint::SESSION_KEY
+        @identity_key = SQRL::Rack::Endpoint::IDENTITY_KEY
+        @ip = nil
+        @rate_limit = nil
+      end
+
+      # Keyword options for {SQRL::Server::Config} (host, scheme and paths are added by
+      # the engine per request).
+      def server_options
+        SERVER_OPTIONS.each_with_object({}) do |key, opts|
+          value = public_send(key)
+          opts[key] = value unless value.nil?
+        end
+      end
+
+      # The user model class.
+      def user_model
+        user_class.is_a?(Class) ? user_class : user_class.to_s.constantize
+      end
+    end
+  end
+end

data/lib/sqrl/rails/controller_helpers.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # Included into +ActionController::Base+ of the host application.
+    module ControllerHelpers
+      extend ActiveSupport::Concern
+
+      included do
+        helper_method :current_sqrl_identity, :sqrl_authenticated? if respond_to?(:helper_method)
+      end
+
+      # The {SQRL::Rack::Endpoint} for this request.
+      def sqrl_endpoint
+        SQRL::Rails.endpoint_for(request)
+      end
+
+      # The SQRL identity record this browser session logged in with, or nil.
+      def current_sqrl_identity
+        return @current_sqrl_identity if defined?(@current_sqrl_identity)
+
+        @current_sqrl_identity = sqrl_endpoint.current_identity(request)
+      end
+
+      def sqrl_authenticated?
+        !current_sqrl_identity.nil?
+      end
+
+      # Forget the SQRL login in this browser session (call it from your logout action).
+      def sqrl_logout!
+        sqrl_endpoint.logout(request)
+        remove_instance_variable(:@current_sqrl_identity) if defined?(@current_sqrl_identity)
+        nil
+      end
+    end
+  end
+end

data/lib/sqrl/rails/engine.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# The engine's app/ directories are namespaced SQRL::Rails; teach the inflector the acronym
+# so Zeitwerk maps app/models/sqrl/rails/identity.rb to SQRL::Rails::Identity.
+ActiveSupport::Inflector.inflections(:en) { |inflect| inflect.acronym "SQRL" }
+
+module SQRL
+  module Rails
+    # The Rails engine. Mount it in the host application:
+    #
+    #   mount SQRL::Rails::Engine, at: "/sqrl", as: :sqrl
+    #
+    # It serves +POST /sqrl/cli+ (the SQRL endpoint), +GET /sqrl/status+ (cookie-bound
+    # poll), +GET /sqrl/callback+ (login completion), +GET /sqrl/login+ (a stand-alone
+    # login page) and +GET /sqrl/sqrl.js+.
+    class Engine < ::Rails::Engine
+      isolate_namespace SQRL::Rails
+      engine_name "sqrl"
+
+      config.sqrl = Configuration.new
+
+      initializer "sqrl.helpers" do
+        ActiveSupport.on_load(:action_controller_base) do
+          include SQRL::Rails::ControllerHelpers
+
+          helper SQRL::Rails::LoginHelper
+        end
+        ActiveSupport.on_load(:action_view) do
+          include SQRL::Rails::LoginHelper
+        end
+      end
+
+      initializer "sqrl.reset_on_reload" do |app|
+        app.reloader.to_prepare { SQRL::Rails.reset! } if app.respond_to?(:reloader)
+      end
+
+      rake_tasks do
+        load File.expand_path("../../tasks/sqrl.rake", __dir__)
+      end
+    end
+  end
+end