activeadmin-oidc 3.0.0 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4482b8503e17fed870824c6a6d10bf09d5f5653a065edf1bdbf179f0cb5a8ebb
-  data.tar.gz: 6d8f00973fd12b22497e3d82a7b80f684e5ffc54ffa15f2a8b93493e825f76c4
+  metadata.gz: 46c2a781cb0b4f80d9d4708dcea4ce1753b15f24bfd47c322c66ee11cadccd35
+  data.tar.gz: bb722c546ebe3fac910f9d5f87fffa5da241174765109f28e721817362823fbf
 SHA512:
-  metadata.gz: daf83b73aaabff38e15b6c6e3ea4c3eb54c10f20e6736b543db6b0d603843ed605f8aa6e6bfe2ca31dab2e6c82a883abecd3a23a3fbd7cd233551206132db065
-  data.tar.gz: 625cd770049d4e7e4af7211a78fa1ffcd2cc0ddf603228935c0a620e2439cb9ba553c07d9cc6e38187e8a2d8b55ff4884f610e37864b366f4cc6259a2cec0cd4
+  metadata.gz: 9ba4e7efc6bfa363cc33b80c20f13813ce30ebd2890fc215d5b5762891232af4d2b50bfb7fccab9e04a14c60146b49ba0d762e7edfbb19e8373de897723d22e3
+  data.tar.gz: 42c4cfbe4e62dd7bd885a201590424b97630ec774760e9cbdc11965a715e141a1aa5e90b70cf038dd7ec8b38a06132d81819c29c4dc508101dc67da2140575ae

data/README.md

@@ -83,7 +83,7 @@ The gem's Rails engine handles several things so host apps don't have to:
 * **Login view override** — the engine prepends an SSO-only login page (no email/password fields) to the sessions controller's view path. If your host app ships its own `app/views/active_admin/devise/sessions/new.html.erb`, the gem detects it and backs off — your view wins.
 * **Session routes** — the engine mounts `GET /admin/login` (renders the SSO landing page) and `DELETE /admin/logout` under `devise_scope`, with the scope name derived from `config.admin_user_class`. Devise normally generates session routes as a side effect of `:database_authenticatable`; without that module the route helpers would not exist and ActiveAdmin's login redirect would 404.
 * **Path prefix** — the engine registers the strategy with `path_prefix: '/admin/auth'` so the middleware intercepts requests under ActiveAdmin's mount point, and sets `Devise.omniauth_path_prefix` to the prefix Devise declares its routes with. Compatible with Rails 7.2+ and Rails 8's lazy route loading.
-* **Parameter filtering** — `code`, `id_token`, `access_token`, `refresh_token`, `state`, and `nonce` are added to `Rails.application.config.filter_parameters`.
+* **Parameter filtering** — the OIDC keys are added to `Rails.application.config.filter_parameters` as exact-key matches. `code_verifier`, `id_token`, `access_token` and `refresh_token` are filtered at any depth. The generic `code`, `state`, `session_state` and `nonce` are filtered only as top-level params, where the callback sends them, so host params like `code_id`, `state_eq` or `order[state]` stay visible.
 
 ## Configuration
 
@@ -410,7 +410,7 @@ The gem also adds a unique `(provider, uid)` partial index in its own install mi
 
 ### What's filtered from logs
 
-The engine merges `code`, `id_token`, `access_token`, `refresh_token`, `state`, and `nonce` into `Rails.application.config.filter_parameters` so a mid-callback crash can't dump them into production logs. Your own `filter_parameters` entries are preserved.
+The engine adds the OIDC keys to `Rails.application.config.filter_parameters`, so a mid-callback crash can't dump them into production logs. Keys are matched exactly. `code_verifier`, `id_token`, `access_token` and `refresh_token` are filtered at any depth; `code`, `state`, `session_state` and `nonce` only as top-level params. So `code_id`, `state_eq` and nested params like `order[state]` are not filtered. Your own `filter_parameters` entries are preserved.
 
 ## Logger
 

data/lib/activeadmin/oidc/engine.rb

@@ -136,7 +136,14 @@ module ActiveAdmin
       end
 
       initializer 'activeadmin_oidc.filter_parameters' do |app|
-        app.config.filter_parameters |= %i[code id_token access_token refresh_token state nonce]
+        # ActiveSupport::ParameterFilter matches a regexp containing "\." against the dotted
+        # full key (data.attributes.state), so the generic callback names stay visible when nested.
+        callback_params = %w[code state session_state nonce]
+        token_params = %w[code_verifier id_token access_token refresh_token]
+        app.config.filter_parameters |= [
+          /\A(?!.*\.)(?:#{Regexp.union(callback_params).source})\z/i,
+          /\A(?:#{Regexp.union(token_params).source})\z/i
+        ]
       end
 
       # The gem is OIDC-first: mount our SSO landing page at /admin/login

data/lib/activeadmin/oidc/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module Oidc
-    VERSION = "3.0.0"
+    VERSION = "3.0.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-oidc
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.0.1
 platform: ruby
 authors:
 - Igor Fedoronchuk
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeadmin