Magic Link / Token-Code Auth

Passwordless Rails auth: the human types a short code from email; the browser/API holds tokens. This is the Basecamp/Fizzy pattern (also used in Herald). It is not bin/rails generate authentication and not Devise.

Philosophy

1. Codes are for humans, tokens are for machines. Mixing them is the #1 implementation bug.
2. Same response whether the email exists or not. Enumeration via "no account found" is a hole.
3. Bind the code step to the email that requested it. A code for alice@ must not sign in bob@ just because the attacker typed it.
4. Consume codes. Destroy sessions. Reuse is a bug; logout must actually log out.
5. Identity authenticates. User belongs to a tenant. Don't hang sessions on the tenant membership record.

The Four Secrets