activeadmin-oidc 2.2.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9047da541972355d3eca04483c7b57d51b2fcc931dda10e188cb4cf0e3ba0723
-  data.tar.gz: b5422c866ff24c4dc3a11ae11d5c70e229494fce603af8a2d1351b6f2565ecab
+  metadata.gz: 4482b8503e17fed870824c6a6d10bf09d5f5653a065edf1bdbf179f0cb5a8ebb
+  data.tar.gz: 6d8f00973fd12b22497e3d82a7b80f684e5ffc54ffa15f2a8b93493e825f76c4
 SHA512:
-  metadata.gz: f7ef072f775050bbb777a855180e7bfe0736919c08b5eec238368be1bccae360fd16df88fc12f3f18ea87bf5ee332b48db6db5458dfc52421366dd8722f58931
-  data.tar.gz: e2497c94cff51a8f6451ab92b8a8ae0969b152bcef9a46d657e59258bf7e5ac6e5faee4e852c992eb22593b50581dd39bae1ad0dd76d5452ff9de87db6a36324
+  metadata.gz: daf83b73aaabff38e15b6c6e3ea4c3eb54c10f20e6736b543db6b0d603843ed605f8aa6e6bfe2ca31dab2e6c82a883abecd3a23a3fbd7cd233551206132db065
+  data.tar.gz: 625cd770049d4e7e4af7211a78fa1ffcd2cc0ddf603228935c0a620e2439cb9ba553c07d9cc6e38187e8a2d8b55ff4884f610e37864b366f4cc6259a2cec0cd4

data/README.md

@@ -50,16 +50,25 @@ OIDC is the only authentication mechanism — `:database_authenticatable`, `encr
 
 If `devise_for :admin_users` lives inside a Rails engine (not the main app routes), set `Devise.router_name = :<engine_name>` in `config/initializers/devise.rb` and pass the same option to `devise_for`. The gem reads `Devise.available_router_name` and mounts its session routes inside that engine's route set, so `<Engine>.routes.url_helpers.new_<scope>_session_path` resolves correctly.
 
-For **isolated** engines (`isolate_namespace ...`) mounted at a prefix (e.g. `mount AdminPanel::Engine => '/admin'`), the engine prepends its mount path to every internal route. The gem's default `login_path = '/admin/login'` would then become `/admin/admin/login`. Configure engine-relative paths in `config/initializers/activeadmin_oidc.rb`:
+For **isolated** engines (`isolate_namespace ...`) mounted at a prefix (e.g. `mount AdminPanel::Engine => '/admin'`), the engine prepends its mount path to every internal route, so the derived `login_path` of `/admin/login` would become `/admin/admin/login`. Configure engine-relative paths in `config/initializers/activeadmin_oidc.rb`:
 
 ```ruby
 ActiveAdmin::Oidc.configure do |c|
-  c.login_path  = '/login'
-  c.logout_path = '/logout'
+  c.login_path            = '/login'
+  c.logout_path           = '/logout'
+  c.omniauth_route_prefix = '/auth'
 end
 ```
 
-Non-isolated engines don't need this override.
+`omniauth_route_prefix` is the same idea applied to the routes Devise draws for
+OmniAuth. It is separate from `omniauth_path_prefix` because the two are not the
+same string here: the OmniAuth middleware sits in the *application's* Rack stack
+and sees `/admin/auth/oidc` with the mount prefix still attached, while the route
+Devise declares for the callback is inside the engine and gets `/admin` prepended
+to it. Set only `omniauth_path_prefix` and the callback route lands on
+`/admin/admin/auth/oidc/callback`, so the redirect the middleware issues 404s.
+
+Non-isolated engines mounted at `/` don't need any of these overrides.
 
 ### 3. `config/initializers/activeadmin_oidc.rb` (generated)
 
@@ -73,7 +82,7 @@ The gem's Rails engine handles several things so host apps don't have to:
 * **Callback controller** — the engine patches `ActiveAdmin::Devise.controllers` to route OmniAuth callbacks to the gem's controller. No manual `controllers: { omniauth_callbacks: ... }` needed in `routes.rb`.
 * **Login view override** — the engine prepends an SSO-only login page (no email/password fields) to the sessions controller's view path. If your host app ships its own `app/views/active_admin/devise/sessions/new.html.erb`, the gem detects it and backs off — your view wins.
 * **Session routes** — the engine mounts `GET /admin/login` (renders the SSO landing page) and `DELETE /admin/logout` under `devise_scope`, with the scope name derived from `config.admin_user_class`. Devise normally generates session routes as a side effect of `:database_authenticatable`; without that module the route helpers would not exist and ActiveAdmin's login redirect would 404.
-* **Path prefix** — the engine sets `Devise.omniauth_path_prefix` and `OmniAuth.config.path_prefix` to `/admin/auth` so the middleware intercepts requests under ActiveAdmin's mount point. Compatible with Rails 7.2+ and Rails 8's lazy route loading.
+* **Path prefix** — the engine registers the strategy with `path_prefix: '/admin/auth'` so the middleware intercepts requests under ActiveAdmin's mount point, and sets `Devise.omniauth_path_prefix` to the prefix Devise declares its routes with. Compatible with Rails 7.2+ and Rails 8's lazy route loading.
 * **Parameter filtering** — `code`, `id_token`, `access_token`, `refresh_token`, `state`, and `nonce` are added to `Rails.application.config.filter_parameters`.
 
 ## Configuration
@@ -137,12 +146,41 @@ end
 | `identity_attribute` | `:email` | AdminUser column used for lookup/adoption |
 | `identity_claim` | `:email` | Claim key read from the id_token/userinfo |
 | `admin_user_class` | `"AdminUser"` | String or Class for the host's admin user model |
+| `login_path` | `/<namespace>/login` | SSO landing page path; derived from ActiveAdmin's namespace |
+| `logout_path` | `/<namespace>/logout` | Sign-out path; derived from ActiveAdmin's namespace |
+| `omniauth_path_prefix` | `/<namespace>/auth` | Browser-visible path the OmniAuth middleware listens on; derived from ActiveAdmin's namespace |
+| `omniauth_route_prefix` | `omniauth_path_prefix` | Prefix Devise declares its OmniAuth routes with; differs only for engine-mounted hosts |
 | `login_button_label` | `"Sign in with SSO"` | Label on the login-page button |
 | `access_denied_message` | generic | Flash shown on any denial |
 | `on_login` | — (required) | Authorization hook; see below |
 
 `stub_dev_env_login!` is a method, not an option — see "Stub login" below.
 
+## ActiveAdmin's namespace
+
+Everything the gem mounts hangs off ActiveAdmin's namespace, and all of it is
+derived from `ActiveAdmin.application.default_namespace` rather than assumed to
+be `admin`. A host that renames it:
+
+```ruby
+# config/initializers/active_admin.rb
+config.default_namespace = :backoffice
+```
+
+gets `/backoffice/login`, `/backoffice/logout`, the OmniAuth middleware at
+`/backoffice/auth`, and a post-sign-in redirect to `/backoffice` — no gem
+configuration needed. ActiveAdmin's root namespace (`config.default_namespace =
+false`) mounts everything at the top level: `/login`, `/auth`, `/`.
+
+Each is still overridable. Isolated engines *have* to override them, since the
+engine's mount prefix is prepended to every path declared inside it — see
+[Engine-mounted Devise](#engine-mounted-devise).
+
+`omniauth_route_prefix` is what the gem assigns to `Devise.omniauth_path_prefix`,
+and it is skipped entirely if your app already assigned that in
+`config/initializers/devise.rb`. `omniauth_path_prefix` is passed to the OmniAuth
+strategy directly, so it stays correct regardless.
+
 ## The `on_login` hook
 
 `on_login` is the **only** place authorization lives. The gem handles authentication (the user proved who they are via the IdP); deciding whether that user is allowed into the admin panel — and what they can see once they are in — is the host application's problem. The gem does not ship a role model.
@@ -247,7 +285,7 @@ AdminUser.last.oidc_raw_info
 
 * A login button is added to the ActiveAdmin sessions page via a prepended view override — no templates to edit.
 * Clicking it POSTs to `/admin/auth/oidc` with a Rails CSRF token. The gem loads `omniauth-rails_csrf_protection` so OmniAuth 2.x delegates its authenticity check to Rails' forgery protection and `button_to` just works.
-* After a successful callback the user is signed in and redirected to `/admin` (not the host app's `/`, which may not exist).
+* After a successful callback the user is signed in and redirected to ActiveAdmin's namespace root (not the host app's `/`, which may not exist). The path comes from ActiveAdmin's own route helper, so a renamed `config.default_namespace` or an engine-mounted ActiveAdmin lands correctly; `/admin` is only the fallback when that helper cannot be resolved.
 * **Disabled/locked users are rejected.** Devise's `active_for_authentication?` is checked after provisioning but before sign-in. If your model overrides this method (e.g. to check an `enabled` flag or Devise's `:lockable` module), the guard fires on OIDC sign-in too — the user sees an appropriate flash and is redirected to the login page.
 * In development, `stub_dev_env_login!` repoints that same button at a local sign-in that never contacts the IdP — see "Stub login" below.
 * Logout goes through Devise's stock session destroy. No RP-initiated single-logout ping to the IdP — override the destroy action in your host app if you need that.

data/app/controllers/active_admin/oidc/devise/omniauth_callbacks_controller.rb

@@ -105,28 +105,53 @@ module ActiveAdmin
         # sign-in instead of Devise's default (host app root). Hosts
         # that don't define a `/` route would otherwise hit a routing
         # error immediately after login, and even when `/` does exist
-        # it's rarely what an admin user wants to see. ActiveAdmin
-        # always mounts at `/admin`, so we go there directly.
+        # it's rarely what an admin user wants to see.
         def after_sign_in_path_for(resource)
-          stored_location_for(resource) || '/admin'
+          stored_location_for(resource) || active_admin_root_path
+        end
+
+        # Resolved from ActiveAdmin's own route helper rather than
+        # assumed to be '/admin'. Two things move it: a host can rename
+        # the namespace (`config.default_namespace = :backoffice`), and
+        # an engine-mounted ActiveAdmin prefixes every path it declares
+        # with the engine's mount point -- so the real root can be
+        # '/admin/admin' or anything else entirely. Routing a signed-in
+        # admin to a 404 is a poor reward for a successful login.
+        def active_admin_root_path
+          send(devise_router_name(resource_name)).public_send(active_admin_root_helper)
+        rescue NameError, ::ActionController::UrlGenerationError
+          # The host has ActiveAdmin's routes somewhere we can't see (or
+          # hasn't drawn them at all). Its namespace prefix is the best
+          # remaining guess at where the admin panel lives -- except for
+          # the root namespace, where that prefix is '' and would make an
+          # empty, unredirectable Location.
+          ActiveAdmin::Oidc.config.active_admin_namespace_prefix.presence || '/'
+        end
+
+        # ActiveAdmin names its namespace root helper `<namespace>_root_path`,
+        # except for the root namespace where it is plain `root_path`.
+        def active_admin_root_helper
+          namespace = ActiveAdmin::Oidc.config.active_admin_namespace
+          namespace ? :"#{namespace}_root_path" : :root_path
         end
 
         # Devise's `new_session_path(scope)` is only generated when
         # `:database_authenticatable` is in the mapping's `used_helpers`,
         # so an OIDC-only model never gets it. The engine mounts
-        # `new_<scope>_session_path` itself, but the helper lives on
-        # whichever route set Devise's URL helper dispatcher points at:
-        # the per-mapping `router_name` (set by
-        # `devise_for :scope, router_name: :engine`) when present,
-        # otherwise the global `Devise.available_router_name`
-        # (set by `Devise.router_name = :engine`), which defaults to
-        # `:main_app`. Replicate that dispatcher here so the helper is
-        # resolved on the right context (Rails.application proxy or
-        # mounted engine proxy).
+        # `new_<scope>_session_path` itself, but on whichever route set
+        # `devise_router_name` resolves to.
         def after_omniauth_failure_path_for(scope)
-          router_name = ::Devise.mappings[scope].router_name ||
-                        ::Devise.available_router_name
-          send(router_name).public_send(:"new_#{scope}_session_path")
+          send(devise_router_name(scope)).public_send(:"new_#{scope}_session_path")
+        end
+
+        # Devise's URL helpers live on the per-mapping `router_name` (set
+        # by `devise_for :scope, router_name: :engine`) when present,
+        # otherwise on the global `Devise.available_router_name` (set by
+        # `Devise.router_name = :engine`), which defaults to `:main_app`.
+        # Replicate that dispatcher here so helpers resolve on the right
+        # context (Rails.application proxy or mounted engine proxy).
+        def devise_router_name(scope)
+          ::Devise.mappings[scope]&.router_name || ::Devise.available_router_name
         end
       end
     end

data/app/views/active_admin/devise/sessions/new.html.erb

@@ -1,13 +1,29 @@
 <% if ActiveAdmin::Oidc.aa_v4? %>
   <div class="p-6 sm:p-8 space-y-4 md:space-y-6 w-full sm:max-w-md bg-white sm:rounded-md shadow dark:border dark:bg-gray-800/50 dark:border-gray-800">
-    <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
-      <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
-    </h2>
+    <div class="flex gap-2 items-center">
+      <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
+        <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
+      </h2>
+
+      <%# Active Admin's own dark mode toggle. The logged out layout renders
+          active_admin/html_head, which loads the JS that delegates clicks on
+          .dark-mode-toggle, so the button needs no script of its own. %>
+      <button type="button"
+              class="dark-mode-toggle ms-auto flex items-center w-9 h-9 justify-center text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200 text-sm"
+              aria-label="<%= t('active_admin.toggle_dark_mode', default: 'Toggle dark mode') %>">
+        <svg class="hidden dark:block w-5 h-5 rtl:-scale-x-100" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 18 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.509 5.75c0-1.493.394-2.96 1.144-4.25h-.081a8.5 8.5 0 1 0 7.356 12.746A8.5 8.5 0 0 1 8.509 5.75Z"></path></svg>
+        <svg class="dark:hidden w-5 h-5" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 20 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 3V1m0 18v-2M5.05 5.05 3.636 3.636m12.728 12.728L14.95 14.95M3 10H1m18 0h-2M5.05 14.95l-1.414 1.414M16.364 3.636 14.95 5.05M14 10a4 4 0 1 1-8 0 4 4 0 0 1 8 0Z"></path></svg>
+      </button>
+    </div>
 
     <% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
-      <p class="activeadmin-oidc-stub-login text-sm font-semibold border border-red-400 bg-red-50 text-red-900 rounded-md p-3 dark:bg-red-900/30 dark:border-red-700 dark:text-red-100">
+      <%# Classes copied from Active Admin's own error flash. The gem's views are
+          outside the host's Tailwind content path, so only utilities Active Admin
+          itself already emits are compiled. %>
+      <div class="activeadmin-oidc-stub-login flex items-center gap-3 p-4 rounded-lg bg-red-50 text-red-800 dark:bg-red-800 dark:text-red-300">
+        <svg class="w-5 h-5 shrink-0 text-red-400 dark:text-red-300" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 20 20"><path d="M10 .5a9.5 9.5 0 1 0 9.5 9.5A9.51 9.51 0 0 0 10 .5ZM10 15a1 1 0 1 1 0-2 1 1 0 0 1 0 2Zm1-4a1 1 0 0 1-2 0V6a1 1 0 0 1 2 0v5Z"/></svg>
         Stub login is enabled: the button below signs in without contacting the identity provider.
-      </p>
+      </div>
     <% end %>
 
     <%= button_to ActiveAdmin::Oidc.config.login_button_label,

data/lib/activeadmin/oidc/configuration.rb

@@ -11,19 +11,23 @@ module ActiveAdmin
       DEFAULT_ADMIN_USER_CLASS    = 'AdminUser'
       DEFAULT_ACCESS_DENIED_MESSAGE =
         'Your account has no permission to access this admin panel.'
-      DEFAULT_LOGIN_PATH  = '/admin/login'
-      DEFAULT_LOGOUT_PATH = '/admin/logout'
       DEFAULT_STUB_DEV_ENV_LOGIN_CLAIMS = {
         'sub'   => 'stub-uid',
         'email' => 'stub-dev@example.com'
       }.freeze
+      # Stands in for ActiveAdmin's namespace when ActiveAdmin is not
+      # loaded (plain unit specs, scripts) and it therefore cannot be
+      # read. Everything else derives from
+      # `ActiveAdmin.application.default_namespace`.
+      FALLBACK_NAMESPACE = :admin
 
       attr_accessor :issuer, :client_id, :client_secret, :scope,
                     :redirect_uri,
                     :login_button_label, :timeout,
                     :identity_attribute, :identity_claim,
-                    :access_denied_message, :on_login, :admin_user_class,
-                    :login_path, :logout_path
+                    :access_denied_message, :on_login, :admin_user_class
+      attr_writer :login_path, :logout_path,
+                  :omniauth_path_prefix, :omniauth_route_prefix
 
       # Readers, not writers: stub login is turned on through
       # `stub_dev_env_login!` so the environment check cannot be skipped.
@@ -47,8 +51,10 @@ module ActiveAdmin
         @identity_claim        = DEFAULT_IDENTITY_CLAIM
         @access_denied_message = DEFAULT_ACCESS_DENIED_MESSAGE
         @admin_user_class      = DEFAULT_ADMIN_USER_CLASS
-        @login_path            = DEFAULT_LOGIN_PATH
-        @logout_path           = DEFAULT_LOGOUT_PATH
+        @login_path            = nil
+        @logout_path           = nil
+        @omniauth_path_prefix  = nil
+        @omniauth_route_prefix = nil
         @on_login              = nil
         @pkce_override         = nil
         @stub_dev_env_login = false
@@ -56,6 +62,82 @@ module ActiveAdmin
         self
       end
 
+      # The paths below all hang off ActiveAdmin's namespace, which the
+      # host can rename (`config.default_namespace = :backoffice`) -- in
+      # which case there is no /admin anywhere in the app and every
+      # hardcoded one would 404. They are computed on read rather than in
+      # `reset!` because the gem's own initializer may run before the
+      # host's `ActiveAdmin.setup` block.
+      #
+      # `login_path` and `logout_path` are declared inside whichever route
+      # set holds the host's Devise mapping, so an engine-mounted host has
+      # to override them engine-relative -- the mount prefix is prepended
+      # on top of whatever is written here.
+      def login_path
+        @login_path || "#{active_admin_namespace_prefix}/login"
+      end
+
+      def logout_path
+        @logout_path || "#{active_admin_namespace_prefix}/logout"
+      end
+
+      # Where the OmniAuth middleware listens. This one is a real,
+      # browser-visible path: the middleware sits in the application's
+      # Rack stack and sees the URL before any engine mount prefix has
+      # been stripped.
+      def omniauth_path_prefix
+        @omniauth_path_prefix || "#{active_admin_namespace_prefix}/auth"
+      end
+
+      # A host that set only `Devise.omniauth_path_prefix` meant one
+      # prefix, so it becomes ours too. An explicit value set here still
+      # wins: engine-mounted hosts need the two to differ by the mount
+      # prefix.
+      def adopt_devise_omniauth_path_prefix(prefix)
+        @omniauth_path_prefix ||= prefix.presence
+      end
+
+      # What Devise declares its OmniAuth request/callback routes with.
+      # Devise reuses a single setting for both jobs, and the two differ
+      # by exactly the mount prefix when `devise_for` lives inside a
+      # mounted engine -- so an engine-mounted host sets this
+      # engine-relative ('/auth'), the same way it does `login_path`.
+      def omniauth_route_prefix
+        @omniauth_route_prefix || omniauth_path_prefix
+      end
+
+      # ActiveAdmin's namespace as a Symbol, or nil for the root
+      # namespace (`default_namespace = false`), which mounts everything
+      # at the top level.
+      def active_admin_namespace
+        namespace = active_admin_default_namespace
+        return nil if namespace.blank? || namespace.to_sym == :root
+
+        # `.underscore` to match ActiveAdmin: `Namespace#initialize` does
+        # `name.to_s.underscore`, so `default_namespace = :"admin-panel"`
+        # routes under /admin_panel. Deriving from the raw value would
+        # mount the login page at /admin-panel and 404 after sign-in.
+        namespace.to_s.underscore.to_sym
+      end
+
+      # Narrow on purpose: `NoMethodError` is what "ActiveAdmin is not
+      # loaded, or not set up yet" surfaces as. Anything else -- a host
+      # initializer blowing up inside its own `default_namespace`
+      # override, say -- is a real misconfiguration and must not be
+      # quietly turned into a wrong path.
+      def active_admin_default_namespace
+        return FALLBACK_NAMESPACE unless defined?(::ActiveAdmin) && ::ActiveAdmin.respond_to?(:application)
+
+        ::ActiveAdmin.application.default_namespace
+      rescue NoMethodError
+        FALLBACK_NAMESPACE
+      end
+
+      def active_admin_namespace_prefix
+        namespace = active_admin_namespace
+        namespace ? "/#{namespace}" : ''
+      end
+
       def pkce
         return @pkce_override unless @pkce_override.nil?
 
@@ -117,7 +199,10 @@ module ActiveAdmin
       def login_submit_path
         return "#{login_path}/stub" if stub_dev_env_login_enabled?
 
-        "#{::OmniAuth.config.path_prefix}/#{Engine::PROVIDER_NAME}"
+        # `omniauth_path_prefix`, not `OmniAuth.config.path_prefix`:
+        # under an engine mount those two differ by the mount prefix,
+        # and this one is the browser-visible path the form posts to.
+        "#{omniauth_path_prefix}/#{Engine::PROVIDER_NAME}"
       end
 
       def validate!

data/lib/activeadmin/oidc/engine.rb

@@ -7,6 +7,12 @@ module ActiveAdmin
     class Engine < ::Rails::Engine
       PROVIDER_NAME = :oidc
 
+      # True once the host has supplied the minimum OIDC credentials.
+      def self.configured?
+        cfg = ActiveAdmin::Oidc.config
+        cfg.issuer.present? && cfg.client_id.present?
+      end
+
       # True when the host's AdminUser model includes :omniauthable.
       # Used to gate controller registration and view overrides so the
       # gem is a no-op when OIDC is not enabled on the model.
@@ -77,21 +83,42 @@ module ActiveAdmin
       # Automatically register the OmniAuth :openid_connect strategy with
       # Devise when the gem is configured, so host apps don't have to
       # duplicate the config.omniauth boilerplate in devise.rb.
-      # Runs before Devise's own initializer so the strategy is available
-      # when the model calls `devise :omniauthable`.
-      initializer 'activeadmin_oidc.register_omniauth_strategy', before: 'devise.omniauth' do
+      #
+      # Ordered after the host's config/initializers (where
+      # `ActiveAdmin.setup` and `Devise.setup` live, so the namespace and
+      # any explicit host overrides are readable) and before
+      # `devise.omniauth`, which both needs the strategy registered and
+      # builds the middleware from these args.
+      #
+      # `path_prefix` is passed per-strategy rather than left to
+      # `OmniAuth.config.path_prefix`, because Devise overwrites that
+      # global at route-draw time with `Devise.omniauth_path_prefix` --
+      # the value it *declares its routes* with, which for a mounted
+      # engine is the same path minus the mount prefix. Setting the two
+      # independently through the global is impossible: Devise raises
+      # "Wrong OmniAuth configuration" whenever they disagree.
+      initializer 'activeadmin_oidc.register_omniauth_strategy',
+                  after: :load_config_initializers, before: 'devise.omniauth' do
         cfg = ActiveAdmin::Oidc.config
-        next if cfg.issuer.blank? || cfg.client_id.blank?
+        next unless Engine.configured?
 
         require 'omniauth_openid_connect'
 
-        ::Devise.setup do |devise|
-          # ActiveAdmin mounts Devise under /admin, so OmniAuth middleware
-          # must intercept /admin/auth/:provider.
-          devise.omniauth_path_prefix ||= '/admin/auth'
+        # `||=` semantics preserved: a host that set the prefix in its
+        # own devise.rb keeps it. Read by Devise when the routes are
+        # drawn, which happens later still.
+        host_prefix = ::Devise.omniauth_path_prefix
+        ::Devise.omniauth_path_prefix ||= cfg.omniauth_route_prefix
+
+        # Devise's setting decides where the routes are DRAWN; the
+        # strategy's `path_prefix` decides where the middleware LISTENS,
+        # and the login view posts to it. If they differ, sign-in 404s.
+        cfg.adopt_devise_omniauth_path_prefix(host_prefix)
 
+        ::Devise.setup do |devise|
           devise.omniauth :openid_connect,
                           name: PROVIDER_NAME,
+                          path_prefix: cfg.omniauth_path_prefix,
                           scope: (cfg.scope || 'openid email profile').split,
                           response_type: :code,
                           issuer: cfg.issuer,
@@ -106,15 +133,6 @@ module ActiveAdmin
                             host: nil
                           }.compact
         end
-
-        # Devise propagates omniauth_path_prefix to
-        # OmniAuth.config.path_prefix during route generation
-        # (set_omniauth_path_prefix!). On Rails 8 routes load lazily,
-        # so the OmniAuth middleware may process requests before routes
-        # are drawn and miss the prefix. Set it eagerly here.
-        # Must happen AFTER `devise.omniauth` because that call
-        # triggers autoload of devise/omniauth which nils the value.
-        ::OmniAuth.config.path_prefix = ::Devise.omniauth_path_prefix
       end
 
       initializer 'activeadmin_oidc.filter_parameters' do |app|

data/lib/activeadmin/oidc/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module Oidc
-    VERSION = "2.2.0"
+    VERSION = "3.0.0"
   end
 end

data/lib/activeadmin-oidc.rb

@@ -18,6 +18,17 @@ require "active_admin/version"
 # at file load, so pull in the minimal Railtie base class first — this
 # keeps the require safe even in spec_helper contexts where the full
 # Rails stack hasn't been initialized yet.
+#
+# The delegation core ext has to come first. railties 8.1's
+# `rails/initializable.rb` calls `delegate_missing_to` in the body of
+# `Rails::Initializable::Collection` but only requires "tsort", and
+# `rails/railtie.rb` requires `rails/initializable` before any
+# ActiveSupport core ext. So on Rails 8.1 a bare `require
+# "rails/railtie"` raises `NoMethodError: undefined method
+# 'delegate_missing_to'`. Requiring the one core ext it needs keeps the
+# intent above intact — we still load only the minimal Railtie base
+# class, not all of Rails.
+require "active_support/core_ext/module/delegation"
 require "rails/railtie"
 require "omniauth/rails_csrf_protection"
 

data/lib/generators/active_admin/oidc/install/templates/sessions_new_v4.html.erb

@@ -2,14 +2,30 @@
     route while ActiveAdmin::Oidc.config.stub_dev_env_login! is on,
     which only ever happens in the development environment. %>
 <div class="p-6 sm:p-8 space-y-4 md:space-y-6 w-full sm:max-w-md bg-white sm:rounded-md shadow dark:border dark:bg-gray-800/50 dark:border-gray-800">
-  <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
-    <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
-  </h2>
+  <div class="flex gap-2 items-center">
+    <h2 class="text-xl font-bold text-gray-900 md:text-2xl dark:text-white flex gap-2 items-center">
+      <%= site_title %> <%= set_page_title t('active_admin.devise.login.title') %>
+    </h2>
+
+    <%# Active Admin's own dark mode toggle. The logged out layout renders
+        active_admin/html_head, which loads the JS that delegates clicks on
+        .dark-mode-toggle, so the button needs no script of its own. %>
+    <button type="button"
+            class="dark-mode-toggle ms-auto flex items-center w-9 h-9 justify-center text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200 text-sm"
+            aria-label="<%= t('active_admin.toggle_dark_mode', default: 'Toggle dark mode') %>">
+      <svg class="hidden dark:block w-5 h-5 rtl:-scale-x-100" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 18 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.509 5.75c0-1.493.394-2.96 1.144-4.25h-.081a8.5 8.5 0 1 0 7.356 12.746A8.5 8.5 0 0 1 8.509 5.75Z"></path></svg>
+      <svg class="dark:hidden w-5 h-5" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 20 20"><path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 3V1m0 18v-2M5.05 5.05 3.636 3.636m12.728 12.728L14.95 14.95M3 10H1m18 0h-2M5.05 14.95l-1.414 1.414M16.364 3.636 14.95 5.05M14 10a4 4 0 1 1-8 0 4 4 0 0 1 8 0Z"></path></svg>
+    </button>
+  </div>
 
   <% if ActiveAdmin::Oidc.config.stub_dev_env_login_enabled? %>
-    <p class="activeadmin-oidc-stub-login text-sm font-semibold border border-red-400 bg-red-50 text-red-900 rounded-md p-3 dark:bg-red-900/30 dark:border-red-700 dark:text-red-100">
+    <%# Classes copied from Active Admin's own error flash. The gem's views are
+        outside the host's Tailwind content path, so only utilities Active Admin
+        itself already emits are compiled. %>
+    <div class="activeadmin-oidc-stub-login flex items-center gap-3 p-4 rounded-lg bg-red-50 text-red-800 dark:bg-red-800 dark:text-red-300">
+      <svg class="w-5 h-5 shrink-0 text-red-400 dark:text-red-300" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 20 20"><path d="M10 .5a9.5 9.5 0 1 0 9.5 9.5A9.51 9.51 0 0 0 10 .5ZM10 15a1 1 0 1 1 0-2 1 1 0 0 1 0 2Zm1-4a1 1 0 0 1-2 0V6a1 1 0 0 1 2 0v5Z"/></svg>
       Stub login is enabled: the button below signs in without contacting the identity provider.
-    </p>
+    </div>
   <% end %>
 
   <%= button_to ActiveAdmin::Oidc.config.login_button_label,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-oidc
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 3.0.0
 platform: ruby
 authors:
 - Igor Fedoronchuk
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-03 00:00:00.000000000 Z
+date: 2026-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeadmin
@@ -288,7 +288,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="