trek 2.5.0 → 2.6.0

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_locked.fr.html.slim.tt

@@ -0,0 +1,24 @@
+p Bonjour #{@<%= file_name %>},
+p
+  | Plusieurs tentatives de connexion à #{t("application_name")} avec votre
+    adresse e-mail ont échoué d'affilée, avec un mauvais mot de passe. Pour
+    protéger votre compte, la connexion est suspendue quelques minutes, un
+    peu plus longtemps après chaque nouvel échec.
+<% unless web? -%>
+p
+  | Si c'était vous, patientez quelques minutes avant de réessayer, ou
+    choisissez un nouveau mot de passe depuis l'application.
+<% else -%>
+p
+  | Si c'était vous, patientez quelques minutes avant de réessayer, ou
+  =< link_to "choisissez un nouveau mot de passe",
+      @reset_url,
+      target: "_blank",
+      rel: "noopener"
+  | .
+<% end -%>
+p
+  | Si ce n'était pas vous, quelqu'un essaie peut-être de deviner votre mot
+    de passe : s'il est court ou que vous l'utilisez ailleurs,
+    choisissez-en un nouveau.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_locked.fr.text.erb.tt

@@ -0,0 +1,14 @@
+Bonjour <%%= @<%= file_name %> %>,
+
+Plusieurs tentatives de connexion à <%%= t("application_name") %> avec votre adresse e-mail ont échoué d'affilée, avec un mauvais mot de passe. Pour protéger votre compte, la connexion est suspendue quelques minutes, un peu plus longtemps après chaque nouvel échec.
+
+<% unless web? -%>
+Si c'était vous, patientez quelques minutes avant de réessayer, ou choisissez un nouveau mot de passe depuis l'application.
+<% else -%>
+Si c'était vous, patientez quelques minutes avant de réessayer, ou choisissez un nouveau mot de passe :
+<%%= @reset_url %>
+<% end -%>
+
+Si ce n'était pas vous, quelqu'un essaie peut-être de deviner votre mot de passe : s'il est court ou que vous l'utilisez ailleurs, choisissez-en un nouveau.
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/public_accounts/web/authentication.rb.tt

@@ -0,0 +1,97 @@
+# Signs <%= human_name.pluralize.downcase %> in on the site, through a signed <%= file_name %>_session_id cookie: apart from
+# the admin's session_id cookie (Trek::Authentication), so signing in or out of one never touches
+# the other. Included in ApplicationController, so every page may show who is signed in; the pages
+# that need a <%= human_name.downcase %> call `before_action :require_<%= file_name %>`.
+module <%= accounts_module %>::Authentication
+  extend ActiveSupport::Concern
+
+  COOKIE = :<%= file_name %>_session_id
+
+  included do
+    after_action :track_<%= file_name %>_activity
+    helper_method :current_<%= file_name %>, :<%= file_name %>_signed_in?, :staff_user
+  end
+
+  private
+
+  def current_<%= file_name %>
+    resume_<%= file_name %>_session&.<%= file_name %>
+  end
+
+  def <%= file_name %>_signed_in?
+    current_<%= file_name %>.present?
+  end
+
+  def require_<%= file_name %>
+    return if resume_<%= file_name %>_session
+
+    session[:return_to_after_<%= file_name %>_sign_in] = request.url if request.get?
+    redirect_to <%= route_prefix %>_sign_in_path, notice: t("<%= accounts_path %>.authentication.sign_in_needed")
+  end
+
+  # Changing the password or deleting the account asks to sign in again when the session isn't recent.
+  def require_recent_<%= file_name %>_sign_in
+    return if Current.<%= file_name %>_session.recent?
+
+    session[:return_to_after_<%= file_name %>_sign_in] = request.referer || <%= route_prefix %>_account_url
+    redirect_to <%= route_prefix %>_sign_in_path, notice: t("<%= accounts_path %>.authentication.recent_sign_in_needed")
+  end
+
+  def resume_<%= file_name %>_session
+    return Current.<%= file_name %>_session if Current.<%= file_name %>_session
+    return unless cookies.signed[COOKIE]
+
+    # A session past its idle timeout or lifetime is dropped: the <%= human_name.downcase %> signs in again.
+    <%= file_name %>_session = <%= class_name %>::Session.find_by(id: cookies.signed[COOKIE])
+    return Current.<%= file_name %>_session = <%= file_name %>_session unless <%= file_name %>_session&.expired?
+
+    <%= file_name %>_session.destroy
+    cookies.delete(COOKIE)
+    nil
+  end
+
+  # A new session row and cookie: nothing about the sign-in lives in Rails' own session, which the
+  # admin's sign-in uses too.
+  def start_<%= file_name %>_session_for(<%= file_name %>)
+    <%= file_name %>.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |<%= file_name %>_session|
+      Current.<%= file_name %>_session = <%= file_name %>_session
+      Trek::ResolveSessionHostnameJob.perform_later(<%= file_name %>_session)
+      cookies.signed[COOKIE] = {
+        value: <%= file_name %>_session.id, expires: <%= class_name %>::Session.lifetime.from_now, httponly: true, same_site: :lax
+      }
+    end
+  end
+
+  def after_<%= file_name %>_sign_in_url
+    session.delete(:return_to_after_<%= file_name %>_sign_in) || <%= route_prefix %>_account_url
+  end
+
+  def terminate_<%= file_name %>_session
+    resume_<%= file_name %>_session&.destroy
+    Current.<%= file_name %>_session = nil
+    cookies.delete(COOKIE)
+  end
+
+  # At most once every <%= class_name %>::Session.activity_interval (5 minutes), and only on the requests
+  # that looked the <%= human_name.downcase %> up.
+  def track_<%= file_name %>_activity
+    <%= file_name %>_session = Current.<%= file_name %>_session
+    return unless <%= file_name %>_session&.persisted?
+
+    <%= file_name %>_session.record_activity
+    <%= file_name %> = <%= file_name %>_session.<%= file_name %>
+    return if <%= file_name %>.last_activity_at&.after?(<%= class_name %>::Session.activity_interval.ago)
+
+    <%= file_name %>.update_columns(last_activity_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+  end
+
+  # The staff member signed in to the admin in this browser, if any, for previews and links to the
+  # admin on the site. Read only: it neither extends nor ends their admin session, and it never
+  # signs a <%= human_name.downcase %> in.
+  def staff_user
+    return @staff_user if defined?(@staff_user)
+
+    staff_session = User::Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id]
+    @staff_user = staff_session.user if staff_session && !staff_session.expired? && staff_session.user.privileged?
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/accounts_controller.rb.tt

@@ -0,0 +1,33 @@
+# The <%= human_name.downcase %>'s own account: its name, email, signed-in browsers, and deleting it.
+class <%= controllers_module %>::AccountsController < <%= controllers_module %>::BaseController
+  before_action :require_<%= file_name %>
+  before_action :require_recent_<%= file_name %>_sign_in, only: :destroy
+  before_action :set_<%= file_name %>
+
+  helper Trek::UserAgentsHelper
+
+  def show
+  end
+
+  def update
+    if @<%= file_name %>.update(params.expect(<%= file_name %>: [:name]))
+      redirect_to <%= route_prefix %>_account_path, notice: t(".success")
+    else
+      render :show, status: :unprocessable_content
+    end
+  end
+
+  def destroy
+    @<%= file_name %>.destroy!
+    Current.<%= file_name %>_session = nil
+    cookies.delete(<%= accounts_module %>::Authentication::COOKIE)
+    redirect_to "/", notice: t(".success"), status: :see_other
+  end
+
+  private
+
+  def set_<%= file_name %>
+    @<%= file_name %> = Current.<%= file_name %>
+    @sessions = @<%= file_name %>.sessions.active.recent_first
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/active_sessions_controller.rb.tt

@@ -0,0 +1,15 @@
+# Signs out browsers signed in as the current <%= human_name.downcase %>, listed on their account page. Only
+# theirs: every query goes through Current.<%= file_name %>.sessions.
+class <%= controllers_module %>::ActiveSessionsController < <%= controllers_module %>::BaseController
+  before_action :require_<%= file_name %>
+
+  def destroy
+    Current.<%= file_name %>.sessions.find(params[:id]).destroy
+    redirect_to <%= route_prefix %>_account_path(anchor: "sessions"), notice: t(".success"), status: :see_other
+  end
+
+  def destroy_others
+    Current.<%= file_name %>.sessions.where.not(id: Current.<%= file_name %>_session.id).destroy_all
+    redirect_to <%= route_prefix %>_account_path(anchor: "sessions"), notice: t(".success"), status: :see_other
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/base_controller.rb.tt

@@ -0,0 +1,52 @@
+# The account pages' controllers: <%= human_name.pluralize.downcase %> only, never the admin's users.
+class <%= controllers_module %>::BaseController < ApplicationController
+  # Sign-ins, <% if code? %>code requests<% else %>sign-ups, password resets<% end %> and account changes go to the audit log, when the app has one.
+  include Trek::Auditable if defined?(::AuditLog)
+
+  # Emails sent to one address (<% if code? %>codes<% else %>password resets, confirmations<% end %>), whatever the IP address: rate_limit
+  # counts per IP address.
+  EMAILS_PER_ADDRESS = 5
+  EMAILS_PER_ADDRESS_WINDOW = 1.hour
+
+  # Failed sign-ins from one IP address, whatever the account, over a longer window than rate_limit's.
+  FAILED_SIGN_INS_PER_IP = 20
+  FAILED_SIGN_INS_WINDOW = 1.hour
+
+  private
+
+  def normalized_email(email)
+    <%= class_name %>.normalize_value_for(:email, email.to_s)
+  end
+
+  def valid_email?(email)
+    email.match?(URI::MailTo::EMAIL_REGEXP)
+  end
+
+  # Counted in Rails.cache, as rate_limit is, under a digest rather than the email itself.
+  def too_many_emails_to?(email)
+    key = "<%= accounts_path %>/emails/#{Digest::SHA256.hexdigest(email)}"
+    Rails.cache.increment(key, 1, expires_in: EMAILS_PER_ADDRESS_WINDOW).to_i > EMAILS_PER_ADDRESS
+  end
+
+  def too_many_failed_sign_ins_from_ip?
+    Rails.cache.read(failed_sign_ins_from_ip_key).to_i >= FAILED_SIGN_INS_PER_IP
+  end
+
+  def count_failed_sign_in_from_ip
+    Rails.cache.increment(failed_sign_ins_from_ip_key, 1, expires_in: FAILED_SIGN_INS_WINDOW)
+  end
+
+  def failed_sign_ins_from_ip_key
+    "<%= accounts_path %>/failed_sign_ins/#{request.remote_ip}"
+  end
+
+  # For the audit log (Trek::Auditable): the signed-in <%= human_name.downcase %>, nil before signing in
+  def audit_actor
+    Current.<%= file_name %>
+  end
+
+  # The account signed in to, tried, or changed
+  def audit_target
+    @<%= file_name %> || Current.<%= file_name %>
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/email_changes_controller.rb.tt

@@ -0,0 +1,85 @@
+<% if code? -%>
+# Changing the account's email: a code sent to the new address confirms it's theirs.
+<% else -%>
+# Changing the account's email: a link sent to the new address confirms it's theirs.
+<% end -%>
+class <%= controllers_module %>::EmailChangesController < <%= controllers_module %>::BaseController
+  rate_limit to: 10, within: 15.minutes, only: %i[create<% if code? %> update<% end %>], with: -> { redirect_to <%= route_prefix %>_account_path, alert: t("<%= accounts_path %>.authentication.rate_limited") }
+
+  before_action :require_<%= file_name %><% if password? %>, except: :show<% end %>
+<% if code? -%>
+  before_action :set_email, only: %i[edit update]
+<% end -%>
+
+  def new
+  end
+
+  def create
+    @email = normalized_email(params[:email])
+    return render_email_form t(".invalid_email") unless valid_email?(@email) && @email != Current.<%= file_name %>.email
+    return render_email_form t("<%= accounts_path %>.authentication.rate_limited") if too_many_emails_to?(@email)
+
+<% if code? -%>
+    <%= accounts_module %>::SignInCodeJob.perform_later(@email, purpose: "email_change", <%= file_name %>: Current.<%= file_name %>)
+    session[:<%= file_name %>_new_email] = @email
+    redirect_to edit_<%= route_prefix %>_email_change_path, notice: t(".sent", email: @email)
+  end
+
+  def edit
+  end
+
+  # Taken by another account is only told once the code proved the address is theirs.
+  def update
+    return render_code_form t("<%= accounts_path %>.authentication.rate_limited") if too_many_failed_sign_ins_from_ip?
+
+    unless <%= class_name %>::SignInCode.redeem(@email, params[:otp], purpose: "email_change", <%= file_name %>: Current.<%= file_name %>)
+      count_failed_sign_in_from_ip
+      return render_code_form t(".failure")
+    end
+
+    session.delete(:<%= file_name %>_new_email)
+    if Current.<%= file_name %>.update(email: @email)
+      redirect_to <%= route_prefix %>_account_path, notice: t(".success")
+    else
+      redirect_to <%= route_prefix %>_account_path, alert: t(".taken")
+    end
+  end
+<% else -%>
+    Current.<%= file_name %>.update_column(:unconfirmed_email, @email) # rubocop:disable Rails/SkipsModelValidations -- checked above
+    <%= class_name %>Mailer.email_change(Current.<%= file_name %>).deliver_later
+    redirect_to <%= route_prefix %>_account_path, notice: t(".sent", email: @email)
+  end
+
+  # Opened from the email, possibly in another browser: the token is enough. Taken by another
+  # account is only told once the link proved the address is theirs.
+  def show
+    @<%= file_name %> = <%= class_name %>.find_by_token_for(:email_change, params[:token].to_s)
+    return redirect_to "/", alert: t(".invalid") unless @<%= file_name %>
+
+    if @<%= file_name %>.change_email!
+      redirect_to <%= file_name %>_signed_in? ? <%= route_prefix %>_account_path : <%= route_prefix %>_sign_in_path, notice: t(".success")
+    else
+      redirect_to "/", alert: t(".taken")
+    end
+  end
+<% end -%>
+
+  private
+<% if code? -%>
+
+  def set_email
+    @email = session[:<%= file_name %>_new_email]
+    redirect_to new_<%= route_prefix %>_email_change_path unless @email
+  end
+
+  def render_code_form(alert)
+    flash.now[:alert] = alert
+    render :edit, status: :unprocessable_content
+  end
+<% end -%>
+
+  def render_email_form(alert)
+    flash.now[:alert] = alert
+    render :new, status: :unprocessable_content
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/email_confirmations_controller.rb.tt

@@ -0,0 +1,19 @@
+# The link confirming the account's email (show), and sending it again (create).
+class <%= controllers_module %>::EmailConfirmationsController < <%= controllers_module %>::BaseController
+  before_action :require_<%= file_name %>, only: :create
+
+  # Opened from the email, possibly in another browser: the token is enough.
+  def show
+    @<%= file_name %> = <%= class_name %>.find_by_token_for(:email_confirmation, params[:token].to_s)
+    return redirect_to "/", alert: t(".invalid") unless @<%= file_name %>
+
+    @<%= file_name %>.confirm_email!
+    redirect_to <%= file_name %>_signed_in? ? <%= route_prefix %>_account_path : <%= route_prefix %>_sign_in_path, notice: t(".success")
+  end
+
+  def create
+    <%= file_name %> = Current.<%= file_name %>
+    <%= class_name %>Mailer.email_confirmation(<%= file_name %>).deliver_later unless <%= file_name %>.confirmed? || too_many_emails_to?(<%= file_name %>.email)
+    redirect_to <%= route_prefix %>_account_path, notice: t(".sent", email: <%= file_name %>.email)
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/password_resets_controller.rb.tt

@@ -0,0 +1,41 @@
+# A forgotten password: a link emailed to the account, if the email has one, with the same answer
+# either way, then the new password, which signs out every session.
+class <%= controllers_module %>::PasswordResetsController < <%= controllers_module %>::BaseController
+  rate_limit to: 10, within: 15.minutes, only: %i[create update], with: -> { redirect_to new_<%= route_prefix %>_password_reset_path, alert: t("<%= accounts_path %>.authentication.rate_limited") }
+
+  before_action :set_<%= file_name %>_by_token, only: %i[edit update]
+
+  def new
+  end
+
+  def create
+    email = normalized_email(params[:email])
+    @<%= file_name %> = <%= class_name %>.find_by(email:) if valid_email?(email)
+    <%= class_name %>Mailer.password_reset(@<%= file_name %>).deliver_later if @<%= file_name %> && !too_many_emails_to?(email)
+
+    redirect_to <%= route_prefix %>_sign_in_path, notice: t(".sent")
+  end
+
+  def edit
+  end
+
+  def update
+    @<%= file_name %>.password = params.expect(<%= file_name %>: [:password])[:password].to_s
+
+    if @<%= file_name %>.save
+      @<%= file_name %>.sessions.delete_all
+      redirect_to <%= route_prefix %>_sign_in_path, notice: t(".success")
+    else
+      render :edit, status: :unprocessable_content
+    end
+  end
+
+  private
+
+  # The token of the link, used up by the new password
+  def set_<%= file_name %>_by_token
+    @token = params[:token].to_s
+    @<%= file_name %> = <%= class_name %>.find_by_token_for(:password_reset, @token)
+    redirect_to new_<%= route_prefix %>_password_reset_path, alert: t("<%= accounts_path %>.password_resets.invalid") unless @<%= file_name %>
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/passwords_controller.rb.tt

@@ -0,0 +1,23 @@
+# Changing the account's password, after a recent sign-in; a forgotten one goes through
+# PasswordResetsController.
+class <%= controllers_module %>::PasswordsController < <%= controllers_module %>::BaseController
+  before_action :require_<%= file_name %>
+  before_action :require_recent_<%= file_name %>_sign_in
+
+  def edit
+    @<%= file_name %> = Current.<%= file_name %>
+  end
+
+  # Signs out the account's other browsers: whoever knew the old password is out.
+  def update
+    @<%= file_name %> = Current.<%= file_name %>
+    @<%= file_name %>.password = params.expect(<%= file_name %>: [:password])[:password].to_s
+
+    if @<%= file_name %>.save
+      @<%= file_name %>.sessions.where.not(id: Current.<%= file_name %>_session.id).delete_all
+      redirect_to <%= route_prefix %>_account_path, notice: t(".success")
+    else
+      render :edit, status: :unprocessable_content
+    end
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/registrations_controller.rb.tt

@@ -0,0 +1,24 @@
+# Signing up with an email and a password: signed in at once, the email confirmed later by a link
+# (confirmed_at), so the app decides what an unconfirmed account may do. An email that already has
+# an account is refused by its uniqueness validation, as on most sites.
+class <%= controllers_module %>::RegistrationsController < <%= controllers_module %>::BaseController
+  rate_limit to: 5, within: 15.minutes, only: :create, with: -> { redirect_to <%= route_prefix %>_sign_up_path, alert: t("<%= accounts_path %>.authentication.rate_limited") }
+
+  def new
+    return redirect_to after_<%= file_name %>_sign_in_url if <%= file_name %>_signed_in?
+
+    @<%= file_name %> = <%= class_name %>.new
+  end
+
+  def create
+    @<%= file_name %> = <%= class_name %>.new(params.expect(<%= file_name %>: %i[email name password]))
+
+    if @<%= file_name %>.save
+      <%= class_name %>Mailer.email_confirmation(@<%= file_name %>).deliver_later
+      start_<%= file_name %>_session_for @<%= file_name %>
+      redirect_to <%= route_prefix %>_account_path, notice: t(".success", email: @<%= file_name %>.email)
+    else
+      render :new, status: :unprocessable_content
+    end
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/sessions_controller.rb.tt

@@ -0,0 +1,78 @@
+<% if code? -%>
+# Step 2 of signing in: the emailed code, which signs in to the email's account, created if it had
+# none. Also signs out.
+<% else -%>
+# Signing in with the email and password, and out.
+<% end -%>
+class <%= controllers_module %>::SessionsController < <%= controllers_module %>::BaseController
+  rate_limit to: <%= code? ? 10 : 5 %>, within: 3.minutes, only: :create, with: -> { render_sign_in_form t("<%= accounts_path %>.authentication.rate_limited"), status: :too_many_requests }
+
+<% if code? -%>
+  before_action :set_email, only: %i[new create]
+
+  def new
+  end
+
+  def create
+    return render_sign_in_form t("<%= accounts_path %>.authentication.rate_limited"), status: :too_many_requests if too_many_failed_sign_ins_from_ip?
+
+    if <%= class_name %>::SignInCode.redeem(@email, params[:otp])
+      @<%= file_name %> = <%= class_name %>.for_verified_email!(@email)
+      session.delete(:<%= file_name %>_sign_in_email)
+      url = after_<%= file_name %>_sign_in_url
+      start_<%= file_name %>_session_for @<%= file_name %>
+      redirect_to url, notice: t(".success")
+    else
+      count_failed_sign_in_from_ip
+      render_sign_in_form t(".failure"), status: :unprocessable_content
+    end
+  end
+<% else -%>
+  def new
+    redirect_to after_<%= file_name %>_sign_in_url if <%= file_name %>_signed_in?
+  end
+
+  def create
+    return render_sign_in_form t("<%= accounts_path %>.authentication.rate_limited"), status: :too_many_requests if too_many_failed_sign_ins_from_ip?
+
+    # Hashes the password typed even when no account matches, so the response takes as long
+    <%= file_name %> = <%= class_name %>.authenticate_by(email: params[:email].to_s, password: params[:password].to_s)
+    @<%= file_name %> = <%= file_name %> || <%= class_name %>.find_by(email: params[:email].to_s)
+
+    # A locked account is refused even with the right password, with the same answer as a wrong one
+    if <%= file_name %> && !<%= file_name %>.sign_in_locked?
+      <%= file_name %>.record_successful_sign_in!
+      url = after_<%= file_name %>_sign_in_url
+      start_<%= file_name %>_session_for <%= file_name %>
+      redirect_to url, notice: t(".success")
+    else
+      @<%= file_name %>&.record_failed_sign_in!
+      count_failed_sign_in_from_ip
+      render_sign_in_form t(".failure"), status: :unprocessable_content
+    end
+  end
+<% end -%>
+
+  def destroy
+    terminate_<%= file_name %>_session
+    redirect_to "/", notice: t(".success"), status: :see_other
+  end
+
+  private
+<% if code? -%>
+
+  # The email of step 1, kept in Rails' session rather than the URL
+  def set_email
+    @email = session[:<%= file_name %>_sign_in_email]
+    redirect_to <%= route_prefix %>_sign_in_path unless @email
+  end
+<% end -%>
+
+  def render_sign_in_form(alert, status:)
+<% if password? -%>
+    @email = params[:email]
+<% end -%>
+    flash.now[:alert] = alert
+    render :new, status:
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/controllers/sign_in_codes_controller.rb.tt

@@ -0,0 +1,27 @@
+# Step 1 of signing in: an email, to which a code is sent. Whether or not it has an account, the
+# answer is the same; the code creates the account on its first use.
+class <%= controllers_module %>::SignInCodesController < <%= controllers_module %>::BaseController
+  rate_limit to: 10, within: 15.minutes, only: :create, with: -> { render_email_form t("<%= accounts_path %>.authentication.rate_limited"), status: :too_many_requests }
+
+  def new
+    redirect_to after_<%= file_name %>_sign_in_url if <%= file_name %>_signed_in?
+  end
+
+  def create
+    email = normalized_email(params[:email])
+    return render_email_form t(".invalid_email"), status: :unprocessable_content unless valid_email?(email)
+    return render_email_form t("<%= accounts_path %>.authentication.rate_limited"), status: :too_many_requests if too_many_emails_to?(email)
+
+    <%= accounts_module %>::SignInCodeJob.perform_later(email)
+    session[:<%= file_name %>_sign_in_email] = email
+    redirect_to <%= route_prefix %>_sign_in_code_path, notice: t(".sent", email:)
+  end
+
+  private
+
+  def render_email_form(alert, status:)
+    @email = params[:email]
+    flash.now[:alert] = alert
+    render :new, status:
+  end
+end

data/lib/generators/trek/templates/public_accounts/web/views/_flash.html.slim.tt

@@ -0,0 +1,5 @@
+/ The account pages' notices. Move them to the site's layout if it shows
+/ flash messages.
+- flash.each do |type, message|
+  p(role=(type == "alert" ? "alert" : "status") class="flash-#{type}")
+    = message

data/lib/generators/trek/templates/public_accounts/web/views/accounts/show.html.slim.tt

@@ -0,0 +1,52 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+
+= form_with model: @<%= file_name %>, url: <%= route_prefix %>_account_path, method: :patch do |f|
+  - if @<%= file_name %>.errors.any?
+    ul(role="alert")
+      - @<%= file_name %>.errors.full_messages.each do |message|
+        li = message
+  = f.label :name
+  = f.text_field :name, autocomplete: "name"
+  = f.submit t(".save")
+
+h2 = <%= class_name %>.human_attribute_name(:email)
+p
+  = @<%= file_name %>.email
+  =< link_to t(".change_email"), new_<%= route_prefix %>_email_change_path
+<% if password? -%>
+- unless @<%= file_name %>.confirmed?
+  p = t(".unconfirmed")
+  = button_to t(".resend_confirmation"), <%= route_prefix %>_email_confirmation_path
+- if @<%= file_name %>.unconfirmed_email
+  p = t(".pending_email", email: @<%= file_name %>.unconfirmed_email)
+
+h2 = <%= class_name %>.human_attribute_name(:password)
+p = link_to t(".change_password"), edit_<%= route_prefix %>_password_path
+<% end -%>
+
+h2#sessions = t(".sessions")
+ul
+  - @sessions.each do |<%= file_name %>_session|
+    li
+      = user_agent_summary(<%= file_name %>_session.user_agent)
+      =< t(".signed_in", date: l(<%= file_name %>_session.created_at, format: :long))
+      - if <%= file_name %>_session == Current.<%= file_name %>_session
+        =< t(".this_browser")
+      - else
+        = button_to t(".sign_out_session"),
+            <%= route_prefix %>_active_session_path(<%= file_name %>_session),
+            method: :delete
+- if @sessions.size > 1
+  = button_to t(".sign_out_others"),
+      others_<%= route_prefix %>_active_sessions_path,
+      method: :delete
+
+= button_to t(".sign_out"), <%= route_prefix %>_sign_out_path, method: :delete
+
+h2 = t(".delete_title")
+p = t(".delete_intro")
+= button_to t(".delete"), <%= route_prefix %>_account_path,
+    method: :delete,
+    form: { data: { turbo_confirm: t(".delete_confirm") } }

data/lib/generators/trek/templates/public_accounts/web/views/email_changes/edit.html.slim.tt

@@ -0,0 +1,17 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+p = t(".intro", email: @email)
+
+= form_with url: <%= route_prefix %>_email_change_path, method: :patch do |f|
+  = f.label :otp, t(".code")
+  = f.text_field :otp,
+      required: true,
+      autofocus: true,
+      autocomplete: "one-time-code",
+      inputmode: "numeric",
+      pattern: "[0-9 ]*",
+      maxlength: 7
+  = f.submit t(".submit")
+
+p = link_to t(".back"), <%= route_prefix %>_account_path

data/lib/generators/trek/templates/public_accounts/web/views/email_changes/new.html.slim.tt

@@ -0,0 +1,15 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+p = t(".intro")
+
+= form_with url: <%= route_prefix %>_email_change_path do |f|
+  = f.label :email, t(".email")
+  = f.email_field :email,
+      value: @email,
+      required: true,
+      autofocus: true,
+      autocomplete: "email"
+  = f.submit t(".submit")
+
+p = link_to t(".back"), <%= route_prefix %>_account_path

data/lib/generators/trek/templates/public_accounts/web/views/password_resets/edit.html.slim.tt

@@ -0,0 +1,26 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+
+= form_with model: @<%= file_name %>,
+    url: <%= route_prefix %>_password_reset_path,
+    method: :patch do |f|
+  - if @<%= file_name %>.errors.any?
+    ul(role="alert")
+      - @<%= file_name %>.errors.full_messages.each do |message|
+        li = message
+  = hidden_field_tag :token, @token
+  = f.label :password
+  ruby:
+    rules = {
+      min: @<%= file_name %>.password_min_length,
+      passphrase: @<%= file_name %>.passphrase_length
+    }
+  p = t(".rules", **rules)
+  = f.password_field :password,
+      required: true,
+      autofocus: true,
+      autocomplete: "new-password",
+      maxlength: 72,
+      minlength: @<%= file_name %>.password_min_length
+  = f.submit t(".submit")