trek 2.5.0 → 2.6.0

data/lib/generators/trek/templates/public_accounts/spec/web/accounts_spec.rb.tt

@@ -0,0 +1,126 @@
+require "rails_helper"
+
+RSpec.describe "<%= human_name.pluralize %>' accounts", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+<% if code? -%>
+  let(:<%= file_name %>) { <%= class_name %>.create!(email: "ada@example.com") }
+
+  def emailed_code
+    ActionMailer::Base.deliveries.last.text_part.body.to_s[/\b\d{6}\b/]
+  end
+
+  def change_email_to(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_email_change_path, params: { email: } }
+    patch <%= route_prefix %>_email_change_path, params: { otp: emailed_code }
+  end
+
+  def sign_in_as(<%= file_name %>)
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_in_path, params: { email: <%= file_name %>.email } }
+    post <%= route_prefix %>_sign_in_code_path, params: { otp: emailed_code }
+  end
+<% else -%>
+  let(:<%= file_name %>) { <%= class_name %>.create!(email: "ada@example.com", password: "correct horse battery staple") }
+
+  def emailed_link
+    ActionMailer::Base.deliveries.last.text_part.body.to_s[%r{https?://\S+}]
+  end
+
+  def change_email_to(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_email_change_path, params: { email: } }
+    get emailed_link
+  end
+
+  def sign_in_as(<%= file_name %>)
+    post <%= route_prefix %>_sign_in_path, params: { email: <%= file_name %>.email, password: "correct horse battery staple" }
+  end
+<% end -%>
+
+  it "asks to sign in" do
+    get <%= route_prefix %>_account_path
+
+    expect(response).to redirect_to(<%= route_prefix %>_sign_in_path)
+  end
+
+  it "shows the account" do
+    sign_in_as(<%= file_name %>)
+    get <%= route_prefix %>_account_path
+
+    expect(response.body).to include(<%= file_name %>.email)
+  end
+
+  it "changes the name" do
+    sign_in_as(<%= file_name %>)
+    patch <%= route_prefix %>_account_path, params: { <%= file_name %>: { name: "Ada Lovelace" } }
+
+    expect(<%= file_name %>.reload.name).to eq("Ada Lovelace")
+  end
+
+  it "changes the email once the <%= code? ? "code" : "link" %> sent to the new one is <%= code? ? "typed" : "followed" %>", :aggregate_failures do
+    sign_in_as(<%= file_name %>)
+    change_email_to("ada@lovelace.org")
+
+    expect(ActionMailer::Base.deliveries.last.to).to eq(["ada@lovelace.org"])
+    expect(<%= file_name %>.reload.email).to eq("ada@lovelace.org")
+  end
+
+  it "keeps the email when another account has the new one", :aggregate_failures do
+    <%= class_name %>.create!(email: "taken@example.com"<% if password? %>, password: "correct horse battery staple"<% end %>)
+    sign_in_as(<%= file_name %>)
+    change_email_to("taken@example.com")
+
+    expect(<%= file_name %>.reload.email).to eq("ada@example.com")
+    expect(flash[:alert]).to be_present
+  end
+
+  it "signs the other browsers out", :aggregate_failures do
+    other = <%= file_name %>.sessions.create!
+    sign_in_as(<%= file_name %>)
+
+    delete others_<%= route_prefix %>_active_sessions_path
+
+    expect(<%= class_name %>::Session.exists?(other.id)).to be(false)
+    expect(<%= file_name %>.sessions.count).to eq(1)
+  end
+
+  it "deletes the account after a recent sign-in" do
+    sign_in_as(<%= file_name %>)
+
+    expect { delete <%= route_prefix %>_account_path }.to change(<%= class_name %>, :count).by(-1)
+  end
+
+  it "asks to sign in again before deleting the account", :aggregate_failures do
+    sign_in_as(<%= file_name %>)
+    travel <%= class_name %>::Session::RECENT + 1.minute
+
+    expect { delete <%= route_prefix %>_account_path }.not_to change(<%= class_name %>, :count)
+    expect(response).to redirect_to(<%= route_prefix %>_sign_in_path)
+  end
+<% if password? -%>
+
+  it "sends the confirmation link again" do
+    sign_in_as(<%= file_name %>)
+
+    perform_enqueued_jobs { post <%= route_prefix %>_email_confirmation_path }
+
+    expect(ActionMailer::Base.deliveries.last.to).to eq([<%= file_name %>.email])
+  end
+
+  it "changes the password after a recent sign-in, and signs the other browsers out", :aggregate_failures do
+    other = <%= file_name %>.sessions.create!
+    sign_in_as(<%= file_name %>)
+
+    patch <%= route_prefix %>_password_path, params: { <%= file_name %>: { password: "a brand new password 1!" } }
+
+    expect(<%= file_name %>.reload.authenticate("a brand new password 1!")).to be_truthy
+    expect(<%= class_name %>::Session.exists?(other.id)).to be(false)
+  end
+
+  it "refuses a password breaking the rules" do
+    sign_in_as(<%= file_name %>)
+    patch <%= route_prefix %>_password_path, params: { <%= file_name %>: { password: "short" } }
+
+    expect(response).to have_http_status(:unprocessable_content)
+  end
+<% end -%>
+end

data/lib/generators/trek/templates/public_accounts/spec/web/authentication_spec.rb.tt

@@ -0,0 +1,43 @@
+require "rails_helper"
+
+# What any page of the site knows about who is signed in (<%= accounts_module %>::Authentication).
+RSpec.describe ApplicationController, type: :controller do
+  controller do
+    def index
+      render plain: [current_<%= file_name %>&.email, staff_user&.email].inspect
+    end
+  end
+
+  it "knows nobody by default" do
+    get :index
+
+    expect(response.body).to eq("[nil, nil]")
+  end
+
+  it "knows the signed-in <%= human_name.downcase %>" do
+    <%= file_name %>_session = <%= class_name %>.create!(email: "ada@example.com"<% if password? %>, password: "correct horse battery staple"<% end %>).sessions.create!
+    cookies.signed[<%= accounts_module %>::Authentication::COOKIE] = <%= file_name %>_session.id
+
+    get :index
+
+    expect(response.body).to eq('["ada@example.com", nil]')
+  end
+
+  it "knows a staff member signed in to the admin, without signing in a <%= human_name.downcase %>" do
+    editor = users.create(role: :editor)
+    cookies.signed[:session_id] = editor.sessions.create!.id
+
+    get :index
+
+    expect(response.body).to eq("[nil, #{editor.email.inspect}]")
+  end
+
+  it "ignores an admin session of a user who isn't staff anymore" do
+    reader = users.create(role: :reader)
+    cookies.signed[:session_id] = reader.sessions.create!.id
+
+    get :index
+
+    expect(response.body).to eq("[nil, nil]")
+  end
+end

data/lib/generators/trek/templates/public_accounts/spec/web/sign_ins_spec.rb.tt

@@ -0,0 +1,215 @@
+require "rails_helper"
+
+RSpec.describe "<%= human_name.pluralize %>' sign-ins", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+<% if code? -%>
+  def emailed_code
+    ActionMailer::Base.deliveries.last.text_part.body.to_s[/\b\d{6}\b/]
+  end
+
+  def ask_for_code(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_in_path, params: { email: } }
+  end
+
+  # The status and the notice, without the email it repeats
+  def answer_to_code_request(email)
+    ask_for_code(email)
+    [response.status, flash[:notice]&.sub(email, "EMAIL")]
+  end
+
+  def sign_in(email)
+    ask_for_code(email)
+    post <%= route_prefix %>_sign_in_code_path, params: { otp: emailed_code }
+  end
+
+  it "renders the sign-in form" do
+    get <%= route_prefix %>_sign_in_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "emails a code to an email without an account, with the same answer as for an account", :aggregate_failures do
+    <%= class_name %>.create!(email: "ada@example.com")
+
+    expect(answer_to_code_request("grace@example.com")).to eq(answer_to_code_request("ada@example.com"))
+    expect(ActionMailer::Base.deliveries.flat_map(&:to)).to eq(%w[grace@example.com ada@example.com])
+  end
+
+  it "refuses an invalid email" do
+    post <%= route_prefix %>_sign_in_path, params: { email: "not an email" }
+
+    expect(response).to have_http_status(:unprocessable_content)
+  end
+
+  it "creates the account and signs in with the emailed code", :aggregate_failures do
+    ask_for_code("grace@example.com")
+
+    expect { post <%= route_prefix %>_sign_in_code_path, params: { otp: emailed_code } }.to change(<%= class_name %>, :count).by(1)
+    expect(response).to redirect_to(<%= route_prefix %>_account_url)
+    expect(cookies[<%= accounts_module %>::Authentication::COOKIE]).to be_present
+  end
+
+  it "signs in to the email's account", :aggregate_failures do
+    <%= file_name %> = <%= class_name %>.create!(email: "ada@example.com")
+    ask_for_code("Ada@Example.com")
+
+    expect { post <%= route_prefix %>_sign_in_code_path, params: { otp: emailed_code } }.not_to change(<%= class_name %>, :count)
+    expect(<%= file_name %>.sessions.count).to eq(1)
+  end
+
+  it "refuses a wrong code", :aggregate_failures do
+    ask_for_code("ada@example.com")
+    post <%= route_prefix %>_sign_in_code_path, params: { otp: "000000" }
+
+    expect(response).to have_http_status(:unprocessable_content)
+    expect(<%= class_name %>.count).to eq(0)
+  end
+
+  it "asks for the email first" do
+    get <%= route_prefix %>_sign_in_code_path
+
+    expect(response).to redirect_to(<%= route_prefix %>_sign_in_path)
+  end
+<% else -%>
+  let(:password) { "correct horse battery staple" }
+  let(:<%= file_name %>) { <%= class_name %>.create!(email: "ada@example.com", password:) }
+
+  def sign_in(email, password: self.password)
+    post <%= route_prefix %>_sign_in_path, params: { email:, password: }
+  end
+
+  def sign_up(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_up_path, params: { <%= file_name %>: { email:, password: } } }
+  end
+
+  it "renders the sign-in and sign-up forms", :aggregate_failures do
+    get <%= route_prefix %>_sign_in_path
+    expect(response).to have_http_status(:ok)
+
+    get <%= route_prefix %>_sign_up_path
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "signs up and in, and emails a link to confirm the email", :aggregate_failures do
+    expect { sign_up("grace@example.com") }.to change(<%= class_name %>, :count).by(1)
+    expect(response).to redirect_to(<%= route_prefix %>_account_path)
+    expect(ActionMailer::Base.deliveries.last.to).to eq(["grace@example.com"])
+  end
+
+  it "confirms the email with the emailed link", :aggregate_failures do
+    sign_up("grace@example.com")
+    link = ActionMailer::Base.deliveries.last.text_part.body.to_s[%r{https?://\S+}]
+
+    get link
+    expect(<%= class_name %>.find_by(email: "grace@example.com")).to be_confirmed
+  end
+
+  it "refuses a password breaking the rules on signing up" do
+    post <%= route_prefix %>_sign_up_path, params: { <%= file_name %>: { email: "grace@example.com", password: "short" } }
+
+    expect(response).to have_http_status(:unprocessable_content)
+  end
+
+  it "signs in", :aggregate_failures do
+    sign_in(<%= file_name %>.email)
+
+    expect(response).to redirect_to(<%= route_prefix %>_account_url)
+    expect(<%= file_name %>.sessions.count).to eq(1)
+  end
+
+  it "refuses a wrong password, and an unknown email, with the same answer" do
+    sign_in(<%= file_name %>.email, password: "wrong horse battery staple")
+    wrong_password = [response.status, flash[:alert]]
+    sign_in("nobody@example.com")
+
+    expect([response.status, flash[:alert]]).to eq(wrong_password)
+  end
+
+  it "locks signing in after failures in a row, and emails the account", :aggregate_failures do
+    perform_enqueued_jobs { <%= class_name %>.sign_in_lockout_after.times { sign_in(<%= file_name %>.email, password: "wrong horse battery staple") } }
+    sign_in(<%= file_name %>.email)
+
+    expect(response).to have_http_status(:unprocessable_content)
+    expect(ActionMailer::Base.deliveries.last.to).to eq([<%= file_name %>.email])
+  end
+
+  describe "password reset" do
+    def ask_for_reset(email)
+      perform_enqueued_jobs { post <%= route_prefix %>_password_reset_path, params: { email: } }
+    end
+
+    it "emails a link to an account, with the same answer as for an unknown email", :aggregate_failures do
+      ask_for_reset("nobody@example.com")
+      unknown = [response.status, flash[:notice]]
+      ask_for_reset(<%= file_name %>.email)
+
+      expect([response.status, flash[:notice]]).to eq(unknown)
+      expect(ActionMailer::Base.deliveries.flat_map(&:to)).to eq([<%= file_name %>.email])
+    end
+
+    it "sets the new password, and signs every session out", :aggregate_failures do
+      <%= file_name %>.sessions.create!
+      token = <%= file_name %>.password_reset_token
+
+      patch <%= route_prefix %>_password_reset_path, params: { token:, <%= file_name %>: { password: "a brand new password 1!" } }
+
+      expect(<%= file_name %>.reload.authenticate("a brand new password 1!")).to be_truthy
+      expect(<%= file_name %>.sessions).to be_empty
+    end
+
+    it "refuses a wrong link" do
+      get edit_<%= route_prefix %>_password_reset_path(token: "wrong")
+
+      expect(response).to redirect_to(new_<%= route_prefix %>_password_reset_path)
+    end
+  end
+<% end -%>
+
+  it "goes back to the page that asked to sign in" do
+    get <%= route_prefix %>_account_path
+    sign_in(<% if code? %>"ada@example.com"<% else %><%= file_name %>.email<% end %>)
+
+    expect(response).to redirect_to(<%= route_prefix %>_account_url)
+  end
+
+  it "signs out", :aggregate_failures do
+    sign_in(<% if code? %>"ada@example.com"<% else %><%= file_name %>.email<% end %>)
+
+    expect { delete <%= route_prefix %>_sign_out_path }.to change(<%= class_name %>::Session, :count).by(-1)
+    get <%= route_prefix %>_account_path
+    expect(response).to redirect_to(<%= route_prefix %>_sign_in_path)
+  end
+
+  it "signs in again after the session's idle timeout" do
+    sign_in(<% if code? %>"ada@example.com"<% else %><%= file_name %>.email<% end %>)
+
+    travel <%= class_name %>::Session.idle_timeout + 1.minute
+    get <%= route_prefix %>_account_path
+
+    expect(response).to redirect_to(<%= route_prefix %>_sign_in_path)
+  end
+<% if audit_log? -%>
+
+  it "records the sign-in in the audit log" do
+    sign_in(<% if code? %>"ada@example.com"<% else %><%= file_name %>.email<% end %>)
+
+    expect(AuditLog.where(action: "<%= controllers_path %>/sessions#create", actor: <%= class_name %>.last)).to exist
+  end
+<% end -%>
+
+  it "doesn't sign in to the admin" do
+    sign_in(<% if code? %>"ada@example.com"<% else %><%= file_name %>.email<% end %>)
+
+    get admin_root_path
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "isn't signed in by the admin's session" do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+
+    get <%= route_prefix %>_account_path
+    expect(response).to redirect_to(<%= route_prefix %>_sign_in_path)
+  end
+end

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change.en.html.slim.tt

@@ -0,0 +1,10 @@
+p Hello,
+p
+  | To use this email address for your #{t("application_name")} account,
+  =< link_to "follow this link",
+      @url,
+      target: "_blank",
+      rel: "noopener"
+  | . It is valid for #{@validity}.
+p If you didn't ask for it, ignore this email: your address won't be used.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change.en.text.erb.tt

@@ -0,0 +1,8 @@
+Hello,
+
+To use this email address for your <%%= t("application_name") %> account, follow this link. It is valid for <%%= @validity %>:
+<%%= @url %>
+
+If you didn't ask for it, ignore this email: your address won't be used.
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change.fr.html.slim.tt

@@ -0,0 +1,13 @@
+p Bonjour,
+p
+  | Pour utiliser cette adresse e-mail pour votre compte
+    #{t("application_name")},
+  =< link_to "suivez ce lien",
+      @url,
+      target: "_blank",
+      rel: "noopener"
+  | . Il est valable #{@validity}.
+p
+  | Si vous ne l'avez pas demandé, ignorez cet e-mail : votre adresse ne
+    sera pas utilisée.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change.fr.text.erb.tt

@@ -0,0 +1,8 @@
+Bonjour,
+
+Pour utiliser cette adresse e-mail pour votre compte <%%= t("application_name") %>, suivez ce lien. Il est valable <%%= @validity %> :
+<%%= @url %>
+
+Si vous ne l'avez pas demandé, ignorez cet e-mail : votre adresse ne sera pas utilisée.
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change_code.en.html.slim.tt

@@ -0,0 +1,9 @@
+p Hello,
+p
+  | Here is your code to confirm this email address for your
+    #{t("application_name")} account:
+p
+  strong(style="font-size: 28px; letter-spacing: 4px;") = @code
+p It is valid for #{@validity}.
+p If you didn't ask for it, ignore this email: your address won't be used.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change_code.en.text.erb.tt

@@ -0,0 +1,11 @@
+Hello,
+
+Here is your code to confirm this email address for your <%%= t("application_name") %> account:
+
+<%%= @code %>
+
+It is valid for <%%= @validity %>.
+
+If you didn't ask for it, ignore this email: your address won't be used.
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change_code.fr.html.slim.tt

@@ -0,0 +1,11 @@
+p Bonjour,
+p
+  | Voici votre code pour confirmer cette adresse e-mail pour votre compte
+    #{t("application_name")} :
+p
+  strong(style="font-size: 28px; letter-spacing: 4px;") = @code
+p Il est valable #{@validity}.
+p
+  | Si vous ne l'avez pas demandé, ignorez cet e-mail : votre adresse ne
+    sera pas utilisée.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/public_accounts/views/mailer/email_change_code.fr.text.erb.tt

@@ -0,0 +1,11 @@
+Bonjour,
+
+Voici votre code pour confirmer cette adresse e-mail pour votre compte <%%= t("application_name") %> :
+
+<%%= @code %>
+
+Il est valable <%%= @validity %>.
+
+Si vous ne l'avez pas demandé, ignorez cet e-mail : votre adresse ne sera pas utilisée.
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/public_accounts/views/mailer/email_confirmation.en.html.slim.tt

@@ -0,0 +1,10 @@
+p Hello,
+p
+  | Welcome to #{t("application_name")}! Confirm your email address
+  =< link_to "with this link",
+      @url,
+      target: "_blank",
+      rel: "noopener"
+  | , valid for #{@validity}.
+p If you didn't create this account, ignore this email.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/public_accounts/views/mailer/email_confirmation.en.text.erb.tt

@@ -0,0 +1,8 @@
+Hello,
+
+Welcome to <%%= t("application_name") %>! Confirm your email address with this link, valid for <%%= @validity %>:
+<%%= @url %>
+
+If you didn't create this account, ignore this email.
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/public_accounts/views/mailer/email_confirmation.fr.html.slim.tt

@@ -0,0 +1,10 @@
+p Bonjour,
+p
+  | Bienvenue sur #{t("application_name")} ! Confirmez votre adresse e-mail
+  =< link_to "avec ce lien",
+      @url,
+      target: "_blank",
+      rel: "noopener"
+  | , valable #{@validity}.
+p Si vous n'avez pas créé ce compte, ignorez cet e-mail.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/public_accounts/views/mailer/email_confirmation.fr.text.erb.tt

@@ -0,0 +1,8 @@
+Bonjour,
+
+Bienvenue sur <%%= t("application_name") %> ! Confirmez votre adresse e-mail avec ce lien, valable <%%= @validity %> :
+<%%= @url %>
+
+Si vous n'avez pas créé ce compte, ignorez cet e-mail.
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/public_accounts/views/mailer/password_reset.en.html.slim.tt

@@ -0,0 +1,10 @@
+p Hello,
+p
+  | To choose a new password for your #{t("application_name")} account,
+  =< link_to "follow this link",
+      @url,
+      target: "_blank",
+      rel: "noopener"
+  | . It is valid for #{@validity}, once.
+p If you didn't ask for it, ignore this email: your password stays the same.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/public_accounts/views/mailer/password_reset.en.text.erb.tt

@@ -0,0 +1,8 @@
+Hello,
+
+To choose a new password for your <%%= t("application_name") %> account, follow this link. It is valid for <%%= @validity %>, once:
+<%%= @url %>
+
+If you didn't ask for it, ignore this email: your password stays the same.
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/public_accounts/views/mailer/password_reset.fr.html.slim.tt

@@ -0,0 +1,13 @@
+p Bonjour,
+p
+  | Pour choisir un nouveau mot de passe pour votre compte
+    #{t("application_name")},
+  =< link_to "suivez ce lien",
+      @url,
+      target: "_blank",
+      rel: "noopener"
+  | . Il est valable #{@validity}, une seule fois.
+p
+  | Si vous ne l'avez pas demandé, ignorez cet e-mail : votre mot de passe
+    reste le même.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/public_accounts/views/mailer/password_reset.fr.text.erb.tt

@@ -0,0 +1,8 @@
+Bonjour,
+
+Pour choisir un nouveau mot de passe pour votre compte <%%= t("application_name") %>, suivez ce lien. Il est valable <%%= @validity %>, une seule fois :
+<%%= @url %>
+
+Si vous ne l'avez pas demandé, ignorez cet e-mail : votre mot de passe reste le même.
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_code.en.html.slim.tt

@@ -0,0 +1,9 @@
+p Hello,
+p Here is your code to sign in to #{t("application_name")}:
+p
+  strong(style="font-size: 28px; letter-spacing: 4px;") = @code
+p It is valid for #{@validity}, for this sign-in only.
+p
+  | If you didn't ask for it, ignore this email: nobody can sign in without
+    the code.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_code.en.text.erb.tt

@@ -0,0 +1,11 @@
+Hello,
+
+Here is your code to sign in to <%%= t("application_name") %>:
+
+<%%= @code %>
+
+It is valid for <%%= @validity %>, for this sign-in only.
+
+If you didn't ask for it, ignore this email: nobody can sign in without the code.
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_code.fr.html.slim.tt

@@ -0,0 +1,9 @@
+p Bonjour,
+p Voici votre code pour vous connecter à #{t("application_name")} :
+p
+  strong(style="font-size: 28px; letter-spacing: 4px;") = @code
+p Il est valable #{@validity}, pour cette connexion uniquement.
+p
+  | Si vous ne l'avez pas demandé, ignorez cet e-mail : personne ne peut se
+    connecter sans le code.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_code.fr.text.erb.tt

@@ -0,0 +1,11 @@
+Bonjour,
+
+Voici votre code pour vous connecter à <%%= t("application_name") %> :
+
+<%%= @code %>
+
+Il est valable <%%= @validity %>, pour cette connexion uniquement.
+
+Si vous ne l'avez pas demandé, ignorez cet e-mail : personne ne peut se connecter sans le code.
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_locked.en.html.slim.tt

@@ -0,0 +1,23 @@
+p Hello #{@<%= file_name %>},
+p
+  | Several attempts in a row to sign in to #{t("application_name")} with
+    your email failed, with a wrong password. To keep your account safe,
+    signing in is paused for a few minutes, a little longer after each new
+    failure.
+<% unless web? -%>
+p
+  | If it was you, wait a few minutes before trying again, or reset your
+    password from the app.
+<% else -%>
+p
+  | If it was you, wait a few minutes before trying again, or
+  =< link_to "choose a new password",
+      @reset_url,
+      target: "_blank",
+      rel: "noopener"
+  | .
+<% end -%>
+p
+  | If it wasn't you, someone may be trying to guess your password: if it's
+    short or you use it elsewhere, choose a new one.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/public_accounts/views/mailer/sign_in_locked.en.text.erb.tt

@@ -0,0 +1,14 @@
+Hello <%%= @<%= file_name %> %>,
+
+Several attempts in a row to sign in to <%%= t("application_name") %> with your email failed, with a wrong password. To keep your account safe, signing in is paused for a few minutes, a little longer after each new failure.
+
+<% unless web? -%>
+If it was you, wait a few minutes before trying again, or reset your password from the app.
+<% else -%>
+If it was you, wait a few minutes before trying again, or choose a new password:
+<%%= @reset_url %>
+<% end -%>
+
+If it wasn't you, someone may be trying to guess your password: if it's short or you use it elsewhere, choose a new one.
+
+The <%%= t("application_name") %> team