activeadmin-oidc 2.1.3 → 2.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 352c557fd647f3422d80408f88f874cb995d6ce588dd2265263b3d6bf0da0030
-  data.tar.gz: 488b15eb1617beb855fba722dc841bee6cf3403e7b5782c5904bf92bc97d7f74
+  metadata.gz: 7c594b010c852e97fc78daab9679704e733ed49341d26cc6763942e3aa081e47
+  data.tar.gz: 66c0b9c1f7557dfb9edac28392547070641c2164df4d9963018e8c8c9d3e116d
 SHA512:
-  metadata.gz: a687c6ff15b7338e64e4dd5719792ce345b1b582c3952df38b7d44dde287020a92e71f57de660d9c487016025e518fe4eb72a12fc1103ba7f7131b6fd2d34eab
-  data.tar.gz: abcfbd2f2a94c224c12315dc096a0c7c2fea335be7620e44798c3a2f584872eac47543f6b647b2679052d0dd657e85d3f896c18205f2c00dcc9dc97b25d0bde6
+  metadata.gz: 15fde3a273751c975c14f9bbbc43b6984796049e86649a25d6b257075834e249fb48bbafa67f9b3da0e2c12c780c0b8ba9097ba469d596742ec44a18114febcf
+  data.tar.gz: a8a9449b8a4b8871af049b1e55071820045f307cec42fda3850db0e999894bd14996f3c1a5d60737326fe95cad726ef6cb04c21e1ac37d1c54e93713b04c8a2a

data/README.md

@@ -112,6 +112,10 @@ ActiveAdmin::Oidc.configure do |c|
   # By default PKCE is enabled iff client_secret is blank. Override:
   # c.pkce = true
 
+  # --- Stub login (development only) ------------------------------------
+  # See "Stub login" below. A no-op outside the development environment.
+  # c.stub_dev_env_login!
+
   # --- Authorization hook (REQUIRED) ------------------------------------
   c.on_login = ->(admin_user, claims) {
     # ... see "The on_login hook" below
@@ -137,6 +141,8 @@ end
 | `access_denied_message` | generic | Flash shown on any denial |
 | `on_login` | — (required) | Authorization hook; see below |
 
+`stub_dev_env_login!` is a method, not an option — see "Stub login" below.
+
 ## The `on_login` hook
 
 `on_login` is the **only** place authorization lives. The gem handles authentication (the user proved who they are via the IdP); deciding whether that user is allowed into the admin panel — and what they can see once they are in — is the host application's problem. The gem does not ship a role model.
@@ -243,8 +249,101 @@ AdminUser.last.oidc_raw_info
 * Clicking it POSTs to `/admin/auth/oidc` with a Rails CSRF token. The gem loads `omniauth-rails_csrf_protection` so OmniAuth 2.x delegates its authenticity check to Rails' forgery protection and `button_to` just works.
 * After a successful callback the user is signed in and redirected to `/admin` (not the host app's `/`, which may not exist).
 * **Disabled/locked users are rejected.** Devise's `active_for_authentication?` is checked after provisioning but before sign-in. If your model overrides this method (e.g. to check an `enabled` flag or Devise's `:lockable` module), the guard fires on OIDC sign-in too — the user sees an appropriate flash and is redirected to the login page.
+* In development, `stub_dev_env_login!` repoints that same button at a local sign-in that never contacts the IdP — see "Stub login" below.
 * Logout goes through Devise's stock session destroy. No RP-initiated single-logout ping to the IdP — override the destroy action in your host app if you need that.
 
+## Stub login (development)
+
+When OIDC is the only way in, local development gets harder than the feature
+you were trying to build. Some providers accept a `localhost:3000` redirect
+URI — until you need a different port, or a second app that also speaks OIDC on
+the same machine. Registering and juggling those redirect URIs is work that has
+nothing to do with the change you are making.
+
+Stub login is the escape hatch. Turn it on and the login page renders exactly as
+it always does — same button, same label — but the button signs in with locally
+fabricated claims instead of redirecting to the IdP. A red warning sits above
+it while it is on.
+
+```ruby
+ActiveAdmin::Oidc.configure do |c|
+  c.on_login = ->(admin_user, claims) {
+    groups = Array(claims["groups"])
+    return false unless groups.include?(ADMIN_GROUP)
+
+    admin_user.super_admin = groups.include?("super-admins")
+    true
+  }
+
+  # Default claims: { "sub" => "stub-uid", "email" => "stub-dev@example.com" }
+  # The optional block patches or replaces them.
+  c.stub_dev_env_login! do |claims|
+    claims.merge("groups" => [ADMIN_GROUP])
+  end
+end
+```
+
+`stub_dev_env_login!` is a **no-op outside the development environment** and
+returns `false` there. That is the whole safety story: nothing to flip off
+before a deploy, no boot guard to trip, and no route drawn anywhere else.
+Leave the call uncommented in the initializer if you want.
+
+The block runs once per sign-in, not once at boot. To switch between distinct
+users, vary both `sub` and the configured identity claim; changing only the
+email retains `stub-uid` and updates the same `(provider, uid)` row.
+
+### It is not a separate code path
+
+The button POSTs to the gem's own callbacks controller, which hands the claims
+to the **same `UserProvisioner` a real callback uses**. That means identity
+lookup by `(provider, uid)`, the account-takeover guard, your `on_login` hook,
+`oidc_raw_info`, and Devise's `active_for_authentication?` check all still run.
+Authorization you develop against the stub is the authorization you get against
+the IdP.
+
+Three consequences worth internalising:
+
+* **Your `on_login` hook must accept the stub claims.** If it reads
+  `claims["groups"]` or Zitadel's nested roles claim, add them in the block —
+  otherwise the stub is denied, correctly. You will find out the first time you
+  click the button, and fix it once.
+* **Use a made-up email, never your real one.** A stub sign-in writes the fake
+  `sub` onto that row. Your real sign-in later brings the real `sub`, they do not
+  match, and the takeover guard locks you out of that account until someone
+  clears the columns by hand.
+* **`provider` is always `"oidc"`,** never a separate `"stub"`/`"test"` value,
+  so the row a stub sign-in creates is an ordinary OIDC row.
+
+### Limits
+
+* **Development only.** Nothing else enables it.
+* **Devise mounted inside an isolated engine is not supported.** The stub URL is
+  built as `"#{login_path}/stub"`, which does not account for a mount prefix.
+  The real SSO flow is unaffected.
+* **CSRF protection is your app's.** The stub POST does not go through the
+  OmniAuth stack, so it relies on whatever your `ApplicationController` does. If
+  you have set `allow_forgery_protection = false` in `development.rb`, any web
+  page you visit can silently sign you into your local admin panel.
+
+### Hosts with a custom login view
+
+If your app ships its own `app/views/active_admin/devise/sessions/new.html.erb`,
+the engine backs off and your view wins, so you render the button yourself.
+Everything you need is on the config object — no helpers to mix in:
+
+```erb
+<% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
+  <p>Stub login is enabled: this button never contacts the identity provider.</p>
+<% end %>
+
+<%= button_to ActiveAdmin::Oidc.config.login_button_label,
+              ActiveAdmin::Oidc.config.login_submit_path,
+              method: :post, data: { turbo: false } %>
+```
+
+`login_submit_path` returns the stub route while stub login is on and the real
+OmniAuth entry point otherwise.
+
 ## Custom login view
 
 The gem ships a minimal SSO-only login page (a single button, no email/password fields). If you need a different layout — for instance, different branding, an explanatory paragraph, or multiple OmniAuth strategies — drop your own template at:

data/app/controllers/active_admin/oidc/devise/omniauth_callbacks_controller.rb

@@ -32,6 +32,50 @@ module ActiveAdmin
           claims['sub']   = auth['uid'] if claims['sub'].blank? && auth['uid'].present?
           claims['email'] = info['email'] if claims['email'].blank? && info['email'].present?
 
+          provision_and_sign_in(claims)
+        end
+
+        # Development stub login: sign in with locally fabricated claims
+        # instead of a real authorization code flow, for machines whose
+        # redirect URI the IdP does not know. Deliberately runs the SAME
+        # provisioning path as `#oidc` -- identity lookup, the takeover
+        # guard, the host's `on_login` hook, oidc_raw_info, and the
+        # active_for_authentication? check all still apply, so what works
+        # locally is what works against the real IdP. In particular, a
+        # claims block that does not satisfy `on_login` is denied here
+        # exactly as the real IdP would deny it.
+        #
+        # The route only exists when stub login is enabled, and
+        # `stub_dev_env_login!` only enables it in the development
+        # environment. The check here covers a flag flipped at runtime.
+        def stub
+          cfg = ActiveAdmin::Oidc.config
+          unless cfg.stub_dev_env_login_enabled?
+            head :not_found
+            return
+          end
+
+          claims = cfg.stub_dev_env_login_claims
+
+          ActiveAdmin::Oidc.logger.warn(
+            "[activeadmin-oidc] STUB LOGIN used for sub=#{claims['sub'].inspect} " \
+            '-- no identity provider was contacted.'
+          )
+
+          provision_and_sign_in(claims, kind: 'stub login (no IdP)')
+        end
+
+        def failure
+          Rails.logger.warn("[activeadmin-oidc] omniauth failure: #{failure_message}")
+          flash[:alert] = ActiveAdmin::Oidc.config.access_denied_message
+          redirect_to after_omniauth_failure_path_for(resource_name)
+        end
+
+        private
+
+        # Shared tail of every sign-in path: turn a claims hash into a
+        # persisted, signed-in admin user, or into a denial flash.
+        def provision_and_sign_in(claims, kind: 'OIDC')
           admin_user = UserProvisioner.new(
             ActiveAdmin::Oidc.config,
             claims: claims,
@@ -39,7 +83,7 @@ module ActiveAdmin
           ).call
 
           sign_in_and_redirect admin_user, event: :authentication
-          set_flash_message(:notice, :success, kind: 'OIDC') if is_navigational_format?
+          set_flash_message(:notice, :success, kind: kind) if is_navigational_format?
         rescue ActiveAdmin::Oidc::InactiveError => e
           Rails.logger.warn("[activeadmin-oidc] inactive: #{e.inactive_message_key}")
           # Fall back to the standard `inactive` translation rather
@@ -57,14 +101,6 @@ module ActiveAdmin
           redirect_to after_omniauth_failure_path_for(resource_name)
         end
 
-        def failure
-          Rails.logger.warn("[activeadmin-oidc] omniauth failure: #{failure_message}")
-          flash[:alert] = ActiveAdmin::Oidc.config.access_denied_message
-          redirect_to after_omniauth_failure_path_for(resource_name)
-        end
-
-        private
-
         # Land on the ActiveAdmin namespace root after a successful SSO
         # sign-in instead of Devise's default (host app root). Hosts
         # that don't define a `/` route would otherwise hit a routing

data/app/views/active_admin/devise/sessions/new.html.erb

@@ -1,11 +1,33 @@
 <% if ActiveAdmin::Oidc.aa_v4? %>
   <div class="p-6 sm:p-8 space-y-4 md:space-y-6 w-full sm:max-w-md bg-white sm:rounded-md shadow dark:border dark:bg-gray-800/50 dark:border-gray-800">
-    <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
-      <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
-    </h2>
+    <div class="flex gap-2 items-center">
+      <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
+        <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
+      </h2>
+
+      <%# Active Admin's own dark mode toggle. The logged out layout renders
+          active_admin/html_head, which loads the JS that delegates clicks on
+          .dark-mode-toggle, so the button needs no script of its own. %>
+      <button type="button"
+              class="dark-mode-toggle ms-auto flex items-center w-9 h-9 justify-center text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200 text-sm"
+              aria-label="<%= t('active_admin.toggle_dark_mode', default: 'Toggle dark mode') %>">
+        <svg class="hidden dark:block w-5 h-5 rtl:-scale-x-100" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 18 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.509 5.75c0-1.493.394-2.96 1.144-4.25h-.081a8.5 8.5 0 1 0 7.356 12.746A8.5 8.5 0 0 1 8.509 5.75Z"></path></svg>
+        <svg class="dark:hidden w-5 h-5" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 20 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 3V1m0 18v-2M5.05 5.05 3.636 3.636m12.728 12.728L14.95 14.95M3 10H1m18 0h-2M5.05 14.95l-1.414 1.414M16.364 3.636 14.95 5.05M14 10a4 4 0 1 1-8 0 4 4 0 0 1 8 0Z"></path></svg>
+      </button>
+    </div>
+
+    <% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
+      <%# Classes copied from Active Admin's own error flash. The gem's views are
+          outside the host's Tailwind content path, so only utilities Active Admin
+          itself already emits are compiled. %>
+      <div class="activeadmin-oidc-stub-login flex items-center gap-3 p-4 rounded-lg bg-red-50 text-red-800 dark:bg-red-800 dark:text-red-300">
+        <svg class="w-5 h-5 shrink-0 text-red-400 dark:text-red-300" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 20 20"><path d="M10 .5a9.5 9.5 0 1 0 9.5 9.5A9.51 9.51 0 0 0 10 .5ZM10 15a1 1 0 1 1 0-2 1 1 0 0 1 0 2Zm1-4a1 1 0 0 1-2 0V6a1 1 0 0 1 2 0v5Z"/></svg>
+        Stub login is enabled: the button below signs in without contacting the identity provider.
+      </div>
+    <% end %>
 
     <%= button_to ActiveAdmin::Oidc.config.login_button_label,
-                  "#{OmniAuth.config.path_prefix}/oidc",
+                  ActiveAdmin::Oidc.config.login_submit_path,
                   method: :post,
                   class: "activeadmin-oidc-login-button w-full",
                   form_class: 'formtastic',
@@ -15,7 +37,13 @@
   <div id="login">
     <h2><%= active_admin_application.site_title(self) %></h2>
 
-    <%= form_tag "#{OmniAuth.config.path_prefix}/oidc",
+    <% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
+      <p class="activeadmin-oidc-stub-login" style="margin-top:1em;padding:0.75em;border:1px solid #c00;background:#fff3f3;color:#900;font-weight:bold">
+        Stub login is enabled: the button below signs in without contacting the identity provider.
+      </p>
+    <% end %>
+
+    <%= form_tag ActiveAdmin::Oidc.config.login_submit_path,
                  method: :post,
                  class: "activeadmin-oidc-login-form formtastic",
                  data: { turbo: false } do %>

data/lib/activeadmin/oidc/configuration.rb

@@ -13,6 +13,10 @@ module ActiveAdmin
         'Your account has no permission to access this admin panel.'
       DEFAULT_LOGIN_PATH  = '/admin/login'
       DEFAULT_LOGOUT_PATH = '/admin/logout'
+      DEFAULT_STUB_DEV_ENV_LOGIN_CLAIMS = {
+        'sub'   => 'stub-uid',
+        'email' => 'stub-dev@example.com'
+      }.freeze
 
       attr_accessor :issuer, :client_id, :client_secret, :scope,
                     :redirect_uri,
@@ -21,6 +25,12 @@ module ActiveAdmin
                     :access_denied_message, :on_login, :admin_user_class,
                     :login_path, :logout_path
 
+      # Readers, not writers: stub login is turned on through
+      # `stub_dev_env_login!` so the environment check cannot be skipped.
+      # Specs (this gem's own included) stub these two instead of
+      # pretending to run in the development environment.
+      attr_reader :stub_dev_env_login_claims_block
+
       def initialize
         reset!
       end
@@ -41,6 +51,8 @@ module ActiveAdmin
         @logout_path           = DEFAULT_LOGOUT_PATH
         @on_login              = nil
         @pkce_override         = nil
+        @stub_dev_env_login = false
+        @stub_dev_env_login_claims_block = nil
         self
       end
 
@@ -54,6 +66,60 @@ module ActiveAdmin
         @pkce_override = value
       end
 
+      # Turns on the development stub login: the login page's button
+      # signs in with locally fabricated claims instead of redirecting to
+      # the IdP. For machines whose redirect URI the IdP does not know --
+      # a non-default port, or two apps sharing one OIDC client.
+      #
+      # A no-op outside the development environment, so there is nothing
+      # to guard at boot and nothing to flip off before a deploy.
+      #
+      # The optional block receives the default claims and returns the
+      # claims to sign in with, so a host whose `on_login` reads roles or
+      # groups can satisfy it:
+      #
+      #   c.stub_dev_env_login! { |claims| claims.merge('groups' => ADMIN_GROUP) }
+      #
+      # The claims go through the same UserProvisioner as a real
+      # callback, so a block that does not satisfy `on_login` is denied
+      # exactly as the real IdP would deny it.
+      def stub_dev_env_login!(&block)
+        return false unless ::Rails.env.development?
+
+        @stub_dev_env_login = true
+        @stub_dev_env_login_claims_block = block
+        true
+      end
+
+      def stub_dev_env_login_enabled?
+        @stub_dev_env_login
+      end
+
+      # Evaluated once per stub sign-in, in the controller. String keys
+      # all the way down, the same shape `on_login` receives from a real
+      # callback.
+      #
+      # The block may either return a Hash or mutate the one it is given
+      # -- `claims["groups"] = [...]` as a last line returns the assigned
+      # value, not the Hash, and that should not 500 the dev's login.
+      def stub_dev_env_login_claims
+        claims = DEFAULT_STUB_DEV_ENV_LOGIN_CLAIMS.dup
+        block  = stub_dev_env_login_claims_block
+        if block
+          returned = block.call(claims)
+          claims = returned if returned.is_a?(Hash)
+        end
+        claims.deep_transform_keys(&:to_s)
+      end
+
+      # Where the login page's single button POSTs to: the stub route
+      # while stub login is on, the real OmniAuth entry point otherwise.
+      def login_submit_path
+        return "#{login_path}/stub" if stub_dev_env_login_enabled?
+
+        "#{::OmniAuth.config.path_prefix}/#{Engine::PROVIDER_NAME}"
+      end
+
       def validate!
         raise ConfigurationError, 'issuer is required'    if issuer.blank?
         raise ConfigurationError, 'client_id is required' if client_id.blank?

data/lib/activeadmin/oidc/engine.rb

@@ -145,9 +145,12 @@ module ActiveAdmin
         app.config.after_initialize do
           next unless Engine.oidc_enabled?
 
-          cfg         = ActiveAdmin::Oidc.config
-          login_path  = cfg.login_path
-          logout_path = cfg.logout_path
+          # Captured here, not inside the append block: on ActiveAdmin 4
+          # routes are drawn lazily on the first request, long after the
+          # host initializer that set these ran, so a draw-time read can
+          # observe a config that something else has since replaced.
+          login_path  = ActiveAdmin::Oidc.config.login_path
+          logout_path = ActiveAdmin::Oidc.config.logout_path
           scope_name  = Engine.admin_user_class.model_name.singular.to_sym
 
           Engine.session_routes_target(app).append do
@@ -174,6 +177,30 @@ module ActiveAdmin
               logout_via = [*::Devise.sign_out_via, aa_method].compact.uniq
 
               match logout_path, to: ::ActiveAdmin::Devise::SessionsController.action(:destroy), as: :"destroy_#{scope_name}_session", via: logout_via
+
+              # Development stub login. `stub_dev_env_login!` only ever
+              # sets the flag in the development environment, so the
+              # route simply does not exist anywhere else -- and a route
+              # that is never drawn cannot be probed.
+              # Read through `ActiveAdmin::Oidc.config` at draw time rather
+              # than from a captured object: `reset!` swaps the whole
+              # Configuration instance, and a redraw must see the current
+              # one.
+              stub_cfg = ActiveAdmin::Oidc.config
+
+              if stub_cfg.stub_dev_env_login_enabled?
+                # Resolve the controller per request instead of capturing
+                # `.action(:stub)` at draw time: the class lives in the
+                # engine's app/ and is reloadable, and stub login runs in
+                # development where a captured constant goes stale on the
+                # first reload. A lambda also sidesteps the module scoping
+                # an isolated engine would apply to a string target.
+                # `login_submit_path` is what the login button posts to,
+                # so drawing the route from it keeps the two in step.
+                post stub_cfg.login_submit_path,
+                     to: ->(env) { ::ActiveAdmin::Oidc::Devise::OmniauthCallbacksController.action(:stub).call(env) },
+                     as: :"#{scope_name}_stub_login"
+              end
             end
           end
         end

data/lib/activeadmin/oidc/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module Oidc
-    VERSION = "2.1.3"
+    VERSION = "2.2.1"
   end
 end

data/lib/generators/active_admin/oidc/install/templates/initializer.rb.tt

@@ -21,6 +21,33 @@ ActiveAdmin::Oidc.configure do |c|
   # --- Login button label ----------------------------------------------
   # c.login_button_label = "Sign in with Corporate SSO"
 
+  # --- Stub login (development only) ------------------------------------
+  # Makes the login button sign in with locally fabricated claims instead
+  # of redirecting to the IdP. Nothing is automatic: the login page still
+  # renders and you still click. Useful when the IdP does not know your
+  # local redirect URI -- a non-default port, or two apps sharing one
+  # OIDC client.
+  #
+  # A no-op outside the development environment, so it is safe to leave
+  # uncommented. A red warning sits above the button while it is on.
+  #
+  # The claims run through the normal pipeline, `on_login` included, so
+  # authorization behaves exactly as it will against the real IdP.
+  # Default claims: { "sub" => "stub-uid", "email" => "stub-dev@example.com" }
+  #
+  # c.stub_dev_env_login!
+  #
+  # Pass a block to patch or replace the claims -- needed when your
+  # `on_login` reads roles, groups or anything else:
+  #
+  # c.stub_dev_env_login! do |claims|
+  #   claims.merge("groups" => ["admins"])
+  # end
+  #
+  # Use a made-up email, not your real SSO one. A stub sign-in stamps the
+  # row with uid "stub-uid", and a later real sign-in for the same email
+  # is then refused by the takeover guard.
+
   # --- on_login hook ---------------------------------------------------
   # Called with (admin_user, claims) after identity lookup and before
   # save. Mutate admin_user in place, return truthy to allow sign-in,

data/lib/generators/active_admin/oidc/install/templates/sessions_new.html.erb

@@ -1,11 +1,20 @@
+<%# Development stub login. The submit path switches to the stub
+    route while ActiveAdmin::Oidc.config.stub_dev_env_login! is on,
+    which only ever happens in the development environment. %>
 <div id="login">
-  <h2><%%= active_admin_application.site_title(self) %></h2>
+  <h2><%= active_admin_application.site_title(self) %></h2>
 
-  <%%= form_tag "#{OmniAuth.config.path_prefix}/oidc",
+  <% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
+    <p class="activeadmin-oidc-stub-login" style="margin-top:1em;padding:0.75em;border:1px solid #c00;background:#fff3f3;color:#900;font-weight:bold">
+      Stub login is enabled: the button below signs in without contacting the identity provider.
+    </p>
+  <% end %>
+
+  <%= form_tag ActiveAdmin::Oidc.config.login_submit_path,
                method: :post,
                class: "activeadmin-oidc-login-form formtastic",
                data: { turbo: false } do %>
-    <%%= submit_tag ActiveAdmin::Oidc.config.login_button_label,
+    <%= submit_tag ActiveAdmin::Oidc.config.login_button_label,
                    class: "activeadmin-oidc-login-button" %>
-  <%% end %>
+  <% end %>
 </div>

data/lib/generators/active_admin/oidc/install/templates/sessions_new_v4.html.erb

@@ -1,12 +1,37 @@
+<%# Development stub login. The submit path switches to the stub
+    route while ActiveAdmin::Oidc.config.stub_dev_env_login! is on,
+    which only ever happens in the development environment. %>
 <div class="p-6 sm:p-8 space-y-4 md:space-y-6 w-full sm:max-w-md bg-white sm:rounded-md shadow dark:border dark:bg-gray-800/50 dark:border-gray-800">
-  <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
-    <%%= site_title %> <%%= set_page_title t('active_admin.devise.login.title') %>
-  </h2>
+  <div class="flex gap-2 items-center">
+    <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
+      <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
+    </h2>
 
-  <%%= button_to ActiveAdmin::Oidc.config.login_button_label,
-       "#{OmniAuth.config.path_prefix}/oidc",
-       method: :post,
-       class: "activeadmin-oidc-login-button w-full",
-       form_class: 'formtastic',
-       data: { turbo: false } %>
+    <%# Active Admin's own dark mode toggle. The logged out layout renders
+        active_admin/html_head, which loads the JS that delegates clicks on
+        .dark-mode-toggle, so the button needs no script of its own. %>
+    <button type="button"
+            class="dark-mode-toggle ms-auto flex items-center w-9 h-9 justify-center text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200 text-sm"
+            aria-label="<%= t('active_admin.toggle_dark_mode', default: 'Toggle dark mode') %>">
+      <svg class="hidden dark:block w-5 h-5 rtl:-scale-x-100" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 18 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.509 5.75c0-1.493.394-2.96 1.144-4.25h-.081a8.5 8.5 0 1 0 7.356 12.746A8.5 8.5 0 0 1 8.509 5.75Z"></path></svg>
+      <svg class="dark:hidden w-5 h-5" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 20 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 3V1m0 18v-2M5.05 5.05 3.636 3.636m12.728 12.728L14.95 14.95M3 10H1m18 0h-2M5.05 14.95l-1.414 1.414M16.364 3.636 14.95 5.05M14 10a4 4 0 1 1-8 0 4 4 0 0 1 8 0Z"></path></svg>
+    </button>
+  </div>
+
+  <% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
+    <%# Classes copied from Active Admin's own error flash. The gem's views are
+        outside the host's Tailwind content path, so only utilities Active Admin
+        itself already emits are compiled. %>
+    <div class="activeadmin-oidc-stub-login flex items-center gap-3 p-4 rounded-lg bg-red-50 text-red-800 dark:bg-red-800 dark:text-red-300">
+      <svg class="w-5 h-5 shrink-0 text-red-400 dark:text-red-300" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 20 20"><path d="M10 .5a9.5 9.5 0 1 0 9.5 9.5A9.51 9.51 0 0 0 10 .5ZM10 15a1 1 0 1 1 0-2 1 1 0 0 1 0 2Zm1-4a1 1 0 0 1-2 0V6a1 1 0 0 1 2 0v5Z"/></svg>
+      Stub login is enabled: the button below signs in without contacting the identity provider.
+    </div>
+  <% end %>
+
+  <%= button_to ActiveAdmin::Oidc.config.login_button_label,
+                ActiveAdmin::Oidc.config.login_submit_path,
+                method: :post,
+                class: "activeadmin-oidc-login-button w-full",
+                form_class: 'formtastic',
+                data: { turbo: false } %>
 </div>

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-oidc
 version: !ruby/object:Gem::Version
-  version: 2.1.3
+  version: 2.2.1
 platform: ruby
 authors:
 - Igor Fedoronchuk
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeadmin
@@ -254,6 +255,7 @@ description: |
   It builds on Devise + omniauth_openid_connect and adds JIT user provisioning,
   role mapping from provider claims via a host-owned on_login hook, and a
   single install generator that wires everything up.
+email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -278,6 +280,7 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -292,7 +295,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.1
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: OpenID Connect SSO for ActiveAdmin
 test_files: []