Merge branch 'master' into sr--add-missing-breaking-changes

santiagorodriguez96 · web-flow · commit 2311b64de07c · 2026-03-04T17:21:30.000-03:00
diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
@@ -79,6 +79,7 @@ jobs:
       uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby }}
+        rubygems: latest
         bundler-cache: true
 
     - name: Run tests
diff --git a/Appraisals b/Appraisals
@@ -22,7 +22,6 @@ appraise "rails-7_1" do
   gem "capybara", "~> 3.39"
   gem "importmap-rails", "~> 2.0"
   gem "pry-byebug", "~> 3.10"
-  gem "psych", "~> 4.0"
   gem "rack", "~> 2.2"
   gem "rspec-rails", "~> 7.1"
   gem "sqlite3", "~> 1.7"
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,20 +2,37 @@
 
 ## Unreleased
 
+### Added
+
+- Dispatch webauthn:unsupported for browsers missing parseOptionsFromJSON [#127](https://github.com/cedarcode/devise-webauthn/pull/127) [@santiagorodriguez96]
+
 ### Changed
 
+- Change `webauthn_id` generation from `after_initialize` to `before_validation` and add a data backfill to the `webauthn_id` migration generator for existing records. [@santiagorodriguez96]
 - Options for getting or creating passkeys and security keys are now served by dedicated Rails controllers and retrieved via JavaScript fetch requests. [#73](https://github.com/cedarcode/devise-webauthn/pull/73) [@nicolastemciuc]
 - BREAKING!: Remove helpers for generating WebAuthn options. [#106](https://github.com/cedarcode/devise-webauthn/pull/115) [@nicolastemciuc]
+- BREAKING!: Replace `form_classes:` keyword argument with direct keyword arguments in all form helper methods (`passkey_creation_form_for`, `login_with_passkey_form_for`, `security_key_creation_form_for`, `login_with_security_key_form_for`). All options are delegated to `form_with`, allowing you to pass any HTML attributes or form options directly. [@RenzoMinelli]
+```erb
+<%# Before %>
+<%= passkey_creation_form_for(:user, form_classes: "my-class") do |form| %>
+  ...
+<% end %>
+
+<%# After %>
+<%= passkey_creation_form_for(:user, class: "my-class", id: "my-form", data: { turbo: false }) do |form| %>
+  ...
+<% end %>
+```
 
-- BREAKING: `login_with_passkey_button` and `login_with_security_key_button` helpers have been renamed to `login_with_passkey_form_for` and `login_with_security_key_form_for`. They now take a block and no longer generate the submit button automatically. You need to explicitly add the button inside the block:
+- BREAKING!: `login_with_passkey_button` and `login_with_security_key_button` helpers have been renamed to `login_with_passkey_form_for` and `login_with_security_key_form_for`. They now take a block and no longer generate the submit button automatically. You need to explicitly add the button inside the block:
 ```erb
 <%# Before %>
-<%%= login_with_passkey_button(:user, "Log in with passkeys") %>
+<%= login_with_passkey_button(:user, "Log in with passkeys") %>
 
 <%# After %>
-<%%= login_with_passkey_form_for(:user) do |form| %>
-  <%%= form.submit "Log in with passkeys" %>
-<%% end %>
+<%= login_with_passkey_form_for(:user) do |form| %>
+  <%= form.submit "Log in with passkeys" %>
+<% end %>
 ```
 
 ### Fixed
diff --git a/app/assets/javascript/devise/webauthn.js b/app/assets/javascript/devise/webauthn.js
@@ -3,7 +3,9 @@ function isWebAuthnSupported() {
     navigator.credentials &&
     navigator.credentials.create &&
     navigator.credentials.get &&
-    window.PublicKeyCredential
+    window.PublicKeyCredential &&
+    PublicKeyCredential.parseCreationOptionsFromJSON &&
+    PublicKeyCredential.parseRequestOptionsFromJSON
   );
 }
 
diff --git a/gemfiles/devise_5_0.gemfile b/gemfiles/devise_5_0.gemfile
@@ -18,7 +18,6 @@ gem "rubocop-rails", "~> 2.32"
 gem "rubocop-rspec", "~> 3.6"
 gem "selenium-webdriver"
 gem "sqlite3", ">= 1.6", "!= 1.7.0", "!= 1.7.1", "!= 1.7.2", "!= 1.7.3"
-gem "stimulus-rails", "~> 1.3"
 
 install_if -> { RUBY_VERSION < "3.0" } do
   gem "rack", "~> 2.2"
diff --git a/gemfiles/rails_7_1.gemfile b/gemfiles/rails_7_1.gemfile
@@ -18,8 +18,6 @@ gem "rubocop-rails", "~> 2.32"
 gem "rubocop-rspec", "~> 3.6"
 gem "selenium-webdriver"
 gem "sqlite3", "~> 1.7"
-gem "stimulus-rails", "~> 1.3"
-gem "psych", "~> 4.0"
 gem "rack", "~> 2.2"
 
 gemspec path: "../"
diff --git a/gemfiles/rails_7_2.gemfile b/gemfiles/rails_7_2.gemfile
@@ -18,6 +18,5 @@ gem "rubocop-rails", "~> 2.32"
 gem "rubocop-rspec", "~> 3.6"
 gem "selenium-webdriver"
 gem "sqlite3", "~> 2.7"
-gem "stimulus-rails", "~> 1.3"
 
 gemspec path: "../"
diff --git a/gemfiles/rails_8_0.gemfile b/gemfiles/rails_8_0.gemfile
@@ -18,6 +18,5 @@ gem "rubocop-rails", "~> 2.32"
 gem "rubocop-rspec", "~> 3.6"
 gem "selenium-webdriver"
 gem "sqlite3", "~> 2.7"
-gem "stimulus-rails", "~> 1.3"
 
 gemspec path: "../"
diff --git a/gemfiles/rails_8_1.gemfile b/gemfiles/rails_8_1.gemfile
@@ -18,6 +18,5 @@ gem "rubocop-rails", "~> 2.32"
 gem "rubocop-rspec", "~> 3.6"
 gem "selenium-webdriver"
 gem "sqlite3", "~> 2.7"
-gem "stimulus-rails", "~> 1.3"
 
 gemspec path: "../"
diff --git a/gemfiles/rails_edge.gemfile b/gemfiles/rails_edge.gemfile
@@ -18,6 +18,5 @@ gem "rubocop-rails", "~> 2.32"
 gem "rubocop-rspec", "~> 3.6"
 gem "selenium-webdriver"
 gem "sqlite3", "~> 2.7"
-gem "stimulus-rails", "~> 1.3"
 
 gemspec path: "../"
diff --git a/lib/devise/models/webauthn_credential_authenticatable.rb b/lib/devise/models/webauthn_credential_authenticatable.rb
@@ -12,7 +12,7 @@ module WebauthnCredentialAuthenticatable
 
         validates :webauthn_id, uniqueness: true, allow_blank: true
 
-        after_initialize do
+        before_validation do
           self.webauthn_id ||= WebAuthn.generate_user_id
         end
       end
diff --git a/lib/devise/webauthn/helpers/credentials_helper.rb b/lib/devise/webauthn/helpers/credentials_helper.rb
@@ -3,11 +3,9 @@
 module Devise
   module Webauthn
     module CredentialsHelper
-      def passkey_creation_form_for(resource_or_resource_name, form_classes: nil, &block)
+      def passkey_creation_form_for(resource_or_resource_name, **options, &block)
         form_with(
-          url: passkeys_path(resource_or_resource_name),
-          method: :post,
-          class: form_classes
+          **options, url: passkeys_path(resource_or_resource_name), method: :post
         ) do |f|
           tag.webauthn_create(data: { options_url: passkey_registration_options_path(resource_or_resource_name) }) do
             concat f.hidden_field(:public_key_credential, data: { webauthn_target: "response" })
@@ -16,11 +14,9 @@ def passkey_creation_form_for(resource_or_resource_name, form_classes: nil, &blo
         end
       end
 
-      def login_with_passkey_form_for(resource_or_resource_name, form_classes: nil, &block)
+      def login_with_passkey_form_for(resource_or_resource_name, **options, &block)
         form_with(
-          url: session_path(resource_or_resource_name),
-          method: :post,
-          class: form_classes
+          **options, url: session_path(resource_or_resource_name), method: :post
         ) do |f|
           tag.webauthn_get(data: { options_url: passkey_authentication_options_path(resource_or_resource_name) }) do
             concat f.hidden_field(:public_key_credential, data: { webauthn_target: "response" })
@@ -29,11 +25,9 @@ def login_with_passkey_form_for(resource_or_resource_name, form_classes: nil, &b
         end
       end
 
-      def security_key_creation_form_for(resource_or_resource_name, form_classes: nil, &block)
+      def security_key_creation_form_for(resource_or_resource_name, **options, &block)
         form_with(
-          url: second_factor_webauthn_credentials_path(resource_or_resource_name),
-          method: :post,
-          class: form_classes
+          **options, url: second_factor_webauthn_credentials_path(resource_or_resource_name), method: :post
         ) do |f|
           tag.webauthn_create(
             data: { options_url: security_key_registration_options_path(resource_or_resource_name) }
@@ -44,11 +38,9 @@ def security_key_creation_form_for(resource_or_resource_name, form_classes: nil,
         end
       end
 
-      def login_with_security_key_form_for(resource_or_resource_name, form_classes: nil, &block)
+      def login_with_security_key_form_for(resource_or_resource_name, **options, &block)
         form_with(
-          url: two_factor_authentication_path(resource_or_resource_name),
-          method: :post,
-          class: form_classes
+          **options, url: two_factor_authentication_path(resource_or_resource_name), method: :post
         ) do |f|
           tag.webauthn_get(data: {
                              options_url: security_key_authentication_options_path(resource_or_resource_name)
diff --git a/lib/generators/devise/webauthn/webauthn_id/templates/add_webauthn_id.rb.erb b/lib/generators/devise/webauthn/webauthn_id/templates/add_webauthn_id.rb.erb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+class AddWebauthnIdTo<%= user_table_name.camelize %> < ActiveRecord::Migration[<%= Rails.version.to_f %>]
+  def up
+    add_column :<%= user_table_name %>, :webauthn_id, :string
+    add_index :<%= user_table_name %>, :webauthn_id, unique: true
+
+    # WARNING: The code below backfills webauthn_id for all existing records
+    # one row at a time. For larger tables, consider removing it and running
+    # the backfill separately (e.g., in a background job or maintenance task).
+    #
+    # Worth noting: PostgreSQL and MySQL support single-query backfills:
+    #
+    #   PostgreSQL:
+    #     UPDATE <%= user_table_name %> SET webauthn_id = encode(gen_random_bytes(64), 'base64') WHERE webauthn_id IS NULL
+    #
+    #   MySQL:
+    #     UPDATE <%= user_table_name %> SET webauthn_id = TO_BASE64(RANDOM_BYTES(64)) WHERE webauthn_id IS NULL
+    #
+    execute("SELECT id FROM <%= user_table_name %> WHERE webauthn_id IS NULL").each do |row|
+      webauthn_id = WebAuthn.generate_user_id
+      execute(ActiveRecord::Base.sanitize_sql_array(
+        ["UPDATE <%= user_table_name %> SET webauthn_id = ? WHERE id = ?", webauthn_id, row["id"]]
+      ))
+    end
+    # Note: if your application creates records using methods that skip
+    # callbacks (e.g., insert_all), consider adding a database default
+    # to ensure webauthn_id is always set. For example, in PostgreSQL:
+    #
+    #   change_column_default :<%= user_table_name %>, :webauthn_id, from: nil, to: -> { "encode(gen_random_bytes(64), 'base64')" }
+    #
+    # For the same reason, you may want to add a NOT NULL constraint in a
+    # separate migration after the backfill is complete:
+    #
+    #   change_column_null :<%= user_table_name %>, :webauthn_id, false
+  end
+
+  def down
+    remove_column :<%= user_table_name %>, :webauthn_id
+  end
+end
diff --git a/lib/generators/devise/webauthn/webauthn_id/webauthn_id_generator.rb b/lib/generators/devise/webauthn/webauthn_id/webauthn_id_generator.rb
@@ -6,17 +6,22 @@
 module Devise
   module Webauthn
     class WebauthnIdGenerator < Rails::Generators::Base
+      include Rails::Generators::Migration
+
       hide!
       namespace "devise:webauthn:webauthn_id"
 
+      source_root File.expand_path("templates", __dir__)
+
       desc "Add webauthn_id field to User model"
       class_option :resource_name, type: :string, default: "user", desc: "The resource name for Devise (default: user)"
 
+      def self.next_migration_number(dirname)
+        ActiveRecord::Generators::Base.next_migration_number(dirname)
+      end
+
       def generate_migration
-        invoke "active_record:migration", [
-          "add_webauthn_id_to_#{user_table_name}",
-          "webauthn_id:string:uniq"
-        ]
+        migration_template "add_webauthn_id.rb.erb", "db/migrate/add_webauthn_id_to_#{user_table_name}.rb"
       end
 
       def show_instructions
diff --git a/spec/devise/models/passkey_authenticatable_spec.rb b/spec/devise/models/passkey_authenticatable_spec.rb
@@ -2,16 +2,30 @@
 
 RSpec.describe Devise::Models::PasskeyAuthenticatable, type: :model do
   describe "webauthn_id initialization" do
-    it "generates a webauthn_id on initialize" do
-      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password")
+    it "generates a webauthn_id on create" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
       expect(user.webauthn_id).to be_present
     end
 
-    it "keeps existing webauthn_id" do
-      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password",
-                         webauthn_id: "custom")
+    it "does not generate a webauthn_id on initialize" do
+      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password")
+      expect(user.webauthn_id).to be_nil
+    end
+
+    it "keeps webauthn_id if created with one" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password",
+                             webauthn_id: "custom")
       expect(user.webauthn_id).to eq("custom")
     end
+
+    it "generates a webauthn_id on update if missing" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
+      user.update_column(:webauthn_id, nil) # rubocop:disable Rails/SkipsModelValidations
+      user.reload
+
+      user.update!(email: "updated@example.com")
+      expect(user.webauthn_id).to be_present
+    end
   end
 
   describe "associations" do
diff --git a/spec/devise/models/webauthn_two_factor_authenticatable_spec.rb b/spec/devise/models/webauthn_two_factor_authenticatable_spec.rb
@@ -2,16 +2,30 @@
 
 RSpec.describe Devise::Models::WebauthnTwoFactorAuthenticatable, type: :model do
   describe "webauthn_id initialization" do
-    it "generates a webauthn_id on initialize" do
-      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password")
+    it "generates a webauthn_id on create" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
       expect(user.webauthn_id).to be_present
     end
 
-    it "keeps existing webauthn_id" do
-      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password",
-                         webauthn_id: "custom")
+    it "does not generate a webauthn_id on initialize" do
+      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password")
+      expect(user.webauthn_id).to be_nil
+    end
+
+    it "keeps webauthn_id if created with one" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password",
+                             webauthn_id: "custom")
       expect(user.webauthn_id).to eq("custom")
     end
+
+    it "generates a webauthn_id on update if missing" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
+      user.update_column(:webauthn_id, nil) # rubocop:disable Rails/SkipsModelValidations
+      user.reload
+
+      user.update!(email: "updated@example.com")
+      expect(user.webauthn_id).to be_present
+    end
   end
 
   describe "associations" do
diff --git a/spec/generators/devise/webauthn/webauthn_id_generator_spec.rb b/spec/generators/devise/webauthn/webauthn_id_generator_spec.rb
@@ -9,25 +9,35 @@
 
   before do
     prepare_destination
-    allow(generator_instance).to receive(:invoke)
     invoke generator_instance
   end
 
   context "when using default resource name" do
     let(:generator_instance) { generator }
 
-    it "invokes the active_record:migration generator with correct arguments" do
-      expect(generator).to have_received(:invoke).with("active_record:migration",
-                                                       ["add_webauthn_id_to_users", "webauthn_id:string:uniq"])
+    it "creates a migration that adds webauthn_id to users" do
+      assert_migration "db/migrate/add_webauthn_id_to_users.rb" do |migration|
+        assert_match(/add_column :users, :webauthn_id, :string/, migration)
+        assert_match(/add_index :users, :webauthn_id, unique: true/, migration)
+      end
+    end
+
+    it "creates a migration that backfills existing records" do
+      assert_migration "db/migrate/add_webauthn_id_to_users.rb" do |migration|
+        assert_match(/SELECT id FROM users WHERE webauthn_id IS NULL/, migration)
+        assert_match(/WebAuthn\.generate_user_id/, migration)
+      end
     end
   end
 
   context "when using a custom resource name" do
     let(:generator_instance) { generator([destination_root], ["--resource_name=admin"]) }
 
-    it "invokes the active_record:migration generator with correct arguments" do
-      expect(generator).to have_received(:invoke).with("active_record:migration",
-                                                       ["add_webauthn_id_to_admins", "webauthn_id:string:uniq"])
+    it "creates a migration that adds webauthn_id to admins" do
+      assert_migration "db/migrate/add_webauthn_id_to_admins.rb" do |migration|
+        assert_match(/add_column :admins, :webauthn_id, :string/, migration)
+        assert_match(/add_index :admins, :webauthn_id, unique: true/, migration)
+      end
     end
   end
 end
diff --git a/spec/helpers/devise/webauthn/credentials_helper_spec.rb b/spec/helpers/devise/webauthn/credentials_helper_spec.rb
