Rails 8の認証ジェネレータをマジックリンク（パスワードレス）ログインに改造する方法｜Basecamp Fizzyの実装を読む

bin/rails generate authentication
bin/rails db:migrate

# app/controllers/concerns/authentication.rb（生成されたもの・抜粋）
def start_new_session_for(user)
  user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session|
    Current.session = session
    cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax }
  end
end

def after_authentication_url
  session.delete(:return_to_after_authenticating) || root_url
end

# Fizzy: app/models/magic_link.rb
class MagicLink < ApplicationRecord
  CODE_LENGTH = 6
  EXPIRATION_TIME = 15.minutes

  belongs_to :identity

  enum :purpose, %w[ sign_in sign_up ], prefix: :for, default: :sign_in

  scope :active, -> { where(expires_at: Time.current...) }
  scope :stale, -> { where(expires_at: ..Time.current) }

  before_validation :generate_code, on: :create
  before_validation :set_expiration, on: :create

  validates :code, uniqueness: true, presence: true

  class << self
    def consume(code)
      active.find_by(code: Code.sanitize(code))&.consume
    end

    def cleanup
      stale.delete_all
    end
  end

  def consume
    destroy
    self
  end
end

# Fizzy: app/models/magic_link/code.rb
module MagicLink::Code
  CODE_SUBSTITUTIONS = { "O" => "0", "I" => "1", "L" => "1" }.freeze

  class << self
    def generate(length)
      SecureRandom.base32(length)
    end

    def sanitize(code)
      if code.present?
        normalize_code(code)
          .then { apply_substitutions(it) }
          .then { remove_invalid_characters(it) }
      end
    end

    private
      def normalize_code(code)
        code.to_s.upcase
      end

      def apply_substitutions(code)
        CODE_SUBSTITUTIONS.reduce(code) { |result, (from, to)| result.gsub(from, to) }
      end

      def remove_invalid_characters(code)
        code.gsub(/[^#{SecureRandom::BASE32_ALPHABET.join}]/, "")
      end
  end
end

# Fizzy: app/controllers/concerns/authentication/via_magic_link.rb（抜粋）
def set_pending_authentication_token(magic_link)
  cookies[:pending_authentication_token] = {
    value: pending_authentication_token_verifier.generate(magic_link.identity.email_address, expires_at: magic_link.expires_at),
    httponly: true,
    same_site: :lax,
    expires: magic_link.expires_at
  }
end

def email_address_pending_authentication
  pending_authentication_token_verifier.verified(pending_authentication_token)
end

def pending_authentication_token_verifier
  Rails.application.message_verifier(:pending_authentication)
end

# Fizzy: app/controllers/sessions/magic_links_controller.rb（抜粋）
def create
  if magic_link = MagicLink.consume(code)
    authenticate magic_link
  else
    invalid_code
  end
end

def authenticate(magic_link)
  if ActiveSupport::SecurityUtils.secure_compare(email_address_pending_authentication || "", magic_link.identity.email_address)
    sign_in magic_link
  else
    email_address_mismatch
  end
end

bin/rails generate model MagicLink user:references code:string:uniq expires_at:datetime

class CreateMagicLinks < ActiveRecord::Migration[8.0]
  def change
    create_table :magic_links do |t|
      t.references :user, null: false, foreign_key: true
      t.string :code, null: false
      t.datetime :expires_at, null: false

      t.timestamps
    end

    add_index :magic_links, :code, unique: true
    add_index :magic_links, :expires_at
  end
end

# app/models/magic_link.rb
class MagicLink < ApplicationRecord
  CODE_LENGTH = 6
  EXPIRATION_TIME = 15.minutes

  belongs_to :user

  scope :active, -> { where(expires_at: Time.current...) }
  scope :stale,  -> { where(expires_at: ..Time.current) }

  before_validation :generate_code, on: :create
  before_validation :set_expiration, on: :create

  validates :code, presence: true, uniqueness: true

  class << self
    # コードを引き当てて、その場で使い捨てる
    def consume(code)
      active.find_by(code: Code.sanitize(code))&.consume
    end

    # 期限切れの掃除（定期実行する）
    def cleanup
      stale.delete_all
    end
  end

  def consume
    destroy
    self
  end

  private
    def generate_code
      self.code ||= loop do
        candidate = Code.generate(CODE_LENGTH)
        break candidate unless self.class.exists?(code: candidate)
      end
    end

    def set_expiration
      self.expires_at ||= EXPIRATION_TIME.from_now
    end
end

# app/models/magic_link/code.rb
module MagicLink::Code
  # Crockford Base32: 見間違えやすい I / L / O / U を除外した文字セット
  ALPHABET = (("0".."9").to_a + ("A".."Z").to_a - %w[ I L O U ]).freeze

  # ユーザーが打ち間違えやすい文字の読み替え
  SUBSTITUTIONS = { "O" => "0", "I" => "1", "L" => "1" }.freeze

  class << self
    def generate(length)
      Array.new(length) { ALPHABET[SecureRandom.random_number(ALPHABET.size)] }.join
    end

    def sanitize(code)
      if code.present?
        normalize(code)
          .then { |value| substitute(value) }
          .then { |value| remove_invalid_characters(value) }
      end
    end

    private
      def normalize(code)
        code.to_s.upcase
      end

      def substitute(code)
        SUBSTITUTIONS.reduce(code) { |result, (from, to)| result.gsub(from, to) }
      end

      def remove_invalid_characters(code)
        code.gsub(/[^#{ALPHABET.join}]/, "")
      end
  end
end

# app/models/user.rb
class User < ApplicationRecord
  has_secure_password
  has_many :sessions, dependent: :destroy
  has_many :magic_links, dependent: :destroy   # 追加

  normalizes :email_address, with: ->(e) { e.strip.downcase }

  # 追加：コードを発行してメールで送る
  def send_magic_link
    magic_links.create!.tap do |magic_link|
      MagicLinkMailer.sign_in_instructions(magic_link).deliver_later
    end
  end
end

# app/mailers/magic_link_mailer.rb
class MagicLinkMailer < ApplicationMailer
  def sign_in_instructions(magic_link)
    @magic_link = magic_link

    mail to: magic_link.user.email_address,
         subject: "ログイン用コード: #{magic_link.code}"
  end
end

<%# app/views/magic_link_mailer/sign_in_instructions.text.erb %>
ログインページに、次の6文字のコードを入力してください。

  <%= @magic_link.code %>

このコードは <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %> 有効です。
心当たりがない場合は、このメールは破棄してください。

# app/controllers/concerns/authentication/via_magic_link.rb
module Authentication::ViaMagicLink
  extend ActiveSupport::Concern

  private
    # コードを発行したら、コード入力画面へ送る
    def redirect_to_session_magic_link(magic_link)
      set_pending_authentication_token(magic_link)
      redirect_to session_magic_link_url
    end

    # 存在しないメアド用のダミー（ユーザー列挙対策・後述）
    def redirect_to_fake_session_magic_link(email_address)
      fake_magic_link = MagicLink.new(
        user: User.new(email_address: email_address),
        code: MagicLink::Code.generate(MagicLink::CODE_LENGTH),
        expires_at: MagicLink::EXPIRATION_TIME.from_now
      )

      redirect_to_session_magic_link fake_magic_link
    end

    def set_pending_authentication_token(magic_link)
      cookies[:pending_authentication_token] = {
        value: pending_authentication_token_verifier.generate(
          magic_link.user.email_address, expires_at: magic_link.expires_at
        ),
        httponly: true,
        same_site: :lax,
        expires: magic_link.expires_at
      }
    end

    def email_address_pending_authentication
      pending_authentication_token_verifier.verified(cookies[:pending_authentication_token])
    end

    def clear_pending_authentication_token
      cookies.delete(:pending_authentication_token)
    end

    def pending_authentication_token_verifier
      Rails.application.message_verifier(:pending_authentication)
    end
end

# app/controllers/concerns/authentication.rb
module Authentication
  extend ActiveSupport::Concern

  included do
    before_action :require_authentication
    helper_method :authenticated?
    helper_method :email_address_pending_authentication   # 追加

    include Authentication::ViaMagicLink                  # 追加
  end

  # 以下、生成されたまま
end

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  allow_unauthenticated_access only: %i[ new create ]
  rate_limit to: 10, within: 3.minutes, only: :create,
    with: -> { redirect_to new_session_url, alert: "しばらく時間をおいてからお試しください。" }

  def new
  end

  def create
    if user = User.find_by(email_address: email_address)
      redirect_to_session_magic_link user.send_magic_link
    else
      # 存在しないメアドでも、見た目は全く同じ画面へ
      redirect_to_fake_session_magic_link email_address
    end
  end

  def destroy
    terminate_session
    redirect_to new_session_path
  end

  private
    def email_address
      params.expect(:email_address)
    end
end

# app/controllers/sessions/magic_links_controller.rb
class Sessions::MagicLinksController < ApplicationController
  allow_unauthenticated_access
  rate_limit to: 10, within: 15.minutes, only: :create,
    with: -> { redirect_to session_magic_link_url, alert: "15分ほど時間をおいてからお試しください。" }

  before_action :ensure_email_address_pending_authentication

  def show
  end

  def create
    if magic_link = MagicLink.consume(params.expect(:code))
      authenticate magic_link
    else
      redirect_to session_magic_link_url, alert: "コードが違うようです。もう一度ご確認ください。"
    end
  end

  private
    # メアド入力を飛ばして直接来た人は、入り口へ戻す
    def ensure_email_address_pending_authentication
      unless email_address_pending_authentication.present?
        redirect_to new_session_url, alert: "メールアドレスの入力からやり直してください。"
      end
    end

    def authenticate(magic_link)
      if matching_email_address?(magic_link)
        clear_pending_authentication_token
        start_new_session_for magic_link.user     # ← ジェネレータ生成のメソッドをそのまま使う
        redirect_to after_authentication_url
      else
        clear_pending_authentication_token
        redirect_to new_session_url, alert: "うまくいきませんでした。もう一度お試しください。"
      end
    end

    # 「コードを要求したブラウザ」と「コードの持ち主」が一致するか
    def matching_email_address?(magic_link)
      ActiveSupport::SecurityUtils.secure_compare(
        email_address_pending_authentication.to_s, magic_link.user.email_address
      )
    end
end

# config/routes.rb
resource :session do
  scope module: :sessions do
    resource :magic_link, only: %i[ show create ]
  end
end

<%# app/views/sessions/new.html.erb %>
<h1>ログイン</h1>

<%= form_with url: session_path do |form| %>
  <%= form.email_field :email_address, required: true, autofocus: true,
        autocomplete: "username", placeholder: "メールアドレス" %>
  <%= form.submit "ログイン用コードを送る" %>
<% end %>

<%# app/views/sessions/magic_links/show.html.erb %>
<h1>メールを確認してください</h1>
<p><strong><%= email_address_pending_authentication %></strong> 宛にコードを送りました。</p>

<%= form_with url: session_magic_link_path, method: :post do |form| %>
  <%= form.text_field :code, required: true, autofocus: true, maxlength: 6,
        autocomplete: "one-time-code", autocapitalize: "off", spellcheck: "false",
        placeholder: "••••••" %>
  <%= form.submit "ログイン" %>
<% end %>

<p>コードは <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %> 有効です。</p>

# test/controllers/sessions/magic_links_controller_test.rb
class Sessions::MagicLinksControllerTest < ActionDispatch::IntegrationTest
  # ① 他人のコードではログインできない（照合が効いているか）
  test "他人のコードは弾かれる" do
    post session_url, params: { email_address: users(:alice).email_address }
    post session_magic_link_url, params: { code: users(:bob).send_magic_link.code }

    assert_redirected_to new_session_path
    assert_not cookies[:session_id].present?
  end

  # ② 期限切れのコードは消費されない（使い回されないか）
  test "期限切れのコードは使えない" do
    magic_link = users(:alice).send_magic_link
    magic_link.update_column(:expires_at, 1.hour.ago)

    post session_url, params: { email_address: users(:alice).email_address }
    post session_magic_link_url, params: { code: magic_link.code }

    assert_not cookies[:session_id].present?
    assert MagicLink.exists?(magic_link.id), "期限切れのリンクは消費してはいけない"
  end
end

# ❌ 登録の有無が丸わかりになる
def create
  if user = User.find_by(email_address: email_address)
    redirect_to_session_magic_link user.send_magic_link
  else
    redirect_to new_session_url, alert: "そのメールアドレスは登録されていません"
  end
end

# config/recurring.yml
production:
  cleanup_magic_links:
    command: "MagicLink.cleanup"
    schedule: every 4 hours

cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax }

# 生成されたコード：読むだけで、期限は延びない
def resume_session
  Current.session ||= find_session_by_cookie
end

# app/controllers/concerns/authentication.rb
def resume_session
  Current.session ||= find_session_by_cookie
  refresh_session_cookie if Current.session
  Current.session
end

private
  # アクセスのたびに期限を打ち直して「最終アクセスから」に変える
  def refresh_session_cookie
    cookies.signed.permanent[:session_id] = {
      value: Current.session.id, httponly: true, same_site: :lax
    }
  end