# Gemfile
gem "unmagic-passkeys"

class User < ApplicationRecord
  has_passkeys name: :email_address, display_name: :name
end

# Registration ceremony
options  = Unmagic::Passkeys.registration_options(holder: user)   # -> pass to navigator.credentials.create()
passkey  = user.passkeys.register(params[:passkey])               # verifies attestation, persists

# Authentication ceremony
options  = Unmagic::Passkeys.authentication_options               # -> pass to navigator.credentials.get()
passkey  = Unmagic::Passkeys.authenticate(params[:passkey])       # verified credential, or nil

# config/routes.rb
resource  :session,      only: %i[new create destroy]
resource  :registration, only: %i[new create]
resources :passkeys,     only: %i[index create destroy]

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  include Unmagic::Passkeys::Request

  allow_unauthenticated_access only: %i[new create]
  rate_limit to: 10, within: 3.minutes, only: :create

  def new
    @authentication_options = passkey_authentication_options
  end

  def create
    if credential = Unmagic::Passkeys.authenticate(passkey_authentication_params)
      start_new_session_for credential.holder
      redirect_to after_authentication_url
    else
      redirect_to new_session_path, alert: "That passkey didn't work. Try again."
    end
  end

  def destroy
    terminate_session
    redirect_to new_session_path, status: :see_other
  end
end

# app/controllers/registrations_controller.rb
class RegistrationsController < ApplicationController
  include Unmagic::Passkeys::Request

  allow_unauthenticated_access
  rate_limit to: 10, within: 3.minutes, only: :create

  def new
  end

  # Called twice: with an email it renders the ceremony page; with the
  # attestation it verifies, saves the passkey, and signs the user in.
  def create
    @email = params.expect(registration: [ :email ])[:email]
    user = User.find_or_create_by!(email_address: @email)
    # TODO: verify the visitor owns @email before handing back an existing
    # account (emailed code, invite token, …) — otherwise a stranger can add
    # a passkey to it.

    if params[:passkey].present?
      user.passkeys.register(passkey_registration_params)
      start_new_session_for user
      redirect_to root_path
    else
      @registration_options = passkey_registration_options(holder: user)
      render :create
    end
  rescue ActiveRecord::RecordInvalid
    redirect_to new_registration_path, alert: "Enter a valid email address."
  rescue Unmagic::Passkeys::WebAuthn::InvalidResponseError
    redirect_to new_registration_path, alert: "That didn't work. Try again."
  end
end

# app/controllers/passkeys_controller.rb
class PasskeysController < ApplicationController
  include Unmagic::Passkeys::Request

  def index
    @passkeys = Current.user.passkeys.order(created_at: :desc)
    @registration_options = passkey_registration_options(holder: Current.user)
  end

  def create
    Current.user.passkeys.register(passkey_registration_params)
    redirect_to passkeys_path, notice: "Passkey added."
  end

  def destroy
    Current.user.passkeys.find(params[:id]).destroy
    redirect_to passkeys_path, notice: "Passkey removed."
  end
end

# config/initializers/passkeys.rb
Unmagic::Passkeys.configure do |config|
  config.default_creation_options        = { attestation: :none }
  config.default_request_options         = { user_verification: :required }
  config.creation_challenge_expiration   = 10.minutes
  config.request_challenge_expiration    = 5.minutes

  # Relying party identity (default: request host / Rails.application.name)
  # config.relying_party_id   = "example.com"
  # config.relying_party_name = "Example"

  # config.parent_class_name = "ApplicationRecord"
  # config.routes_prefix     = "/auth/passkeys"      # set in config/application.rb if overriding
  # config.draw_routes       = true
end

# test/test_helper.rb
require "unmagic/passkeys/test/helpers"

# test/integration/passkey_sign_in_test.rb
credential = register_passkey_for(@user)
assertion  = in_webauthn_context do
  build_assertion_params(challenge: webauthn_challenge(purpose: "authentication"), credential: credential)
end
post session_path, params: { passkey: assertion }

require "unmagic/passkeys/test/helpers"
RSpec.configure { |c| c.include Unmagic::Passkeys::Test::Helpers }