activeadmin-oidc 2.2.1 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c594b010c852e97fc78daab9679704e733ed49341d26cc6763942e3aa081e47
-  data.tar.gz: 66c0b9c1f7557dfb9edac28392547070641c2164df4d9963018e8c8c9d3e116d
+  metadata.gz: 4482b8503e17fed870824c6a6d10bf09d5f5653a065edf1bdbf179f0cb5a8ebb
+  data.tar.gz: 6d8f00973fd12b22497e3d82a7b80f684e5ffc54ffa15f2a8b93493e825f76c4
 SHA512:
-  metadata.gz: 15fde3a273751c975c14f9bbbc43b6984796049e86649a25d6b257075834e249fb48bbafa67f9b3da0e2c12c780c0b8ba9097ba469d596742ec44a18114febcf
-  data.tar.gz: a8a9449b8a4b8871af049b1e55071820045f307cec42fda3850db0e999894bd14996f3c1a5d60737326fe95cad726ef6cb04c21e1ac37d1c54e93713b04c8a2a
+  metadata.gz: daf83b73aaabff38e15b6c6e3ea4c3eb54c10f20e6736b543db6b0d603843ed605f8aa6e6bfe2ca31dab2e6c82a883abecd3a23a3fbd7cd233551206132db065
+  data.tar.gz: 625cd770049d4e7e4af7211a78fa1ffcd2cc0ddf603228935c0a620e2439cb9ba553c07d9cc6e38187e8a2d8b55ff4884f610e37864b366f4cc6259a2cec0cd4

data/README.md

@@ -50,16 +50,25 @@ OIDC is the only authentication mechanism — `:database_authenticatable`, `encr
 
 If `devise_for :admin_users` lives inside a Rails engine (not the main app routes), set `Devise.router_name = :<engine_name>` in `config/initializers/devise.rb` and pass the same option to `devise_for`. The gem reads `Devise.available_router_name` and mounts its session routes inside that engine's route set, so `<Engine>.routes.url_helpers.new_<scope>_session_path` resolves correctly.
 
-For **isolated** engines (`isolate_namespace ...`) mounted at a prefix (e.g. `mount AdminPanel::Engine => '/admin'`), the engine prepends its mount path to every internal route. The gem's default `login_path = '/admin/login'` would then become `/admin/admin/login`. Configure engine-relative paths in `config/initializers/activeadmin_oidc.rb`:
+For **isolated** engines (`isolate_namespace ...`) mounted at a prefix (e.g. `mount AdminPanel::Engine => '/admin'`), the engine prepends its mount path to every internal route, so the derived `login_path` of `/admin/login` would become `/admin/admin/login`. Configure engine-relative paths in `config/initializers/activeadmin_oidc.rb`:
 
 ```ruby
 ActiveAdmin::Oidc.configure do |c|
-  c.login_path  = '/login'
-  c.logout_path = '/logout'
+  c.login_path            = '/login'
+  c.logout_path           = '/logout'
+  c.omniauth_route_prefix = '/auth'
 end
 ```
 
-Non-isolated engines don't need this override.
+`omniauth_route_prefix` is the same idea applied to the routes Devise draws for
+OmniAuth. It is separate from `omniauth_path_prefix` because the two are not the
+same string here: the OmniAuth middleware sits in the *application's* Rack stack
+and sees `/admin/auth/oidc` with the mount prefix still attached, while the route
+Devise declares for the callback is inside the engine and gets `/admin` prepended
+to it. Set only `omniauth_path_prefix` and the callback route lands on
+`/admin/admin/auth/oidc/callback`, so the redirect the middleware issues 404s.
+
+Non-isolated engines mounted at `/` don't need any of these overrides.
 
 ### 3. `config/initializers/activeadmin_oidc.rb` (generated)
 
@@ -73,7 +82,7 @@ The gem's Rails engine handles several things so host apps don't have to:
 * **Callback controller** — the engine patches `ActiveAdmin::Devise.controllers` to route OmniAuth callbacks to the gem's controller. No manual `controllers: { omniauth_callbacks: ... }` needed in `routes.rb`.
 * **Login view override** — the engine prepends an SSO-only login page (no email/password fields) to the sessions controller's view path. If your host app ships its own `app/views/active_admin/devise/sessions/new.html.erb`, the gem detects it and backs off — your view wins.
 * **Session routes** — the engine mounts `GET /admin/login` (renders the SSO landing page) and `DELETE /admin/logout` under `devise_scope`, with the scope name derived from `config.admin_user_class`. Devise normally generates session routes as a side effect of `:database_authenticatable`; without that module the route helpers would not exist and ActiveAdmin's login redirect would 404.
-* **Path prefix** — the engine sets `Devise.omniauth_path_prefix` and `OmniAuth.config.path_prefix` to `/admin/auth` so the middleware intercepts requests under ActiveAdmin's mount point. Compatible with Rails 7.2+ and Rails 8's lazy route loading.
+* **Path prefix** — the engine registers the strategy with `path_prefix: '/admin/auth'` so the middleware intercepts requests under ActiveAdmin's mount point, and sets `Devise.omniauth_path_prefix` to the prefix Devise declares its routes with. Compatible with Rails 7.2+ and Rails 8's lazy route loading.
 * **Parameter filtering** — `code`, `id_token`, `access_token`, `refresh_token`, `state`, and `nonce` are added to `Rails.application.config.filter_parameters`.
 
 ## Configuration
@@ -137,12 +146,41 @@ end
 | `identity_attribute` | `:email` | AdminUser column used for lookup/adoption |
 | `identity_claim` | `:email` | Claim key read from the id_token/userinfo |
 | `admin_user_class` | `"AdminUser"` | String or Class for the host's admin user model |
+| `login_path` | `/<namespace>/login` | SSO landing page path; derived from ActiveAdmin's namespace |
+| `logout_path` | `/<namespace>/logout` | Sign-out path; derived from ActiveAdmin's namespace |
+| `omniauth_path_prefix` | `/<namespace>/auth` | Browser-visible path the OmniAuth middleware listens on; derived from ActiveAdmin's namespace |
+| `omniauth_route_prefix` | `omniauth_path_prefix` | Prefix Devise declares its OmniAuth routes with; differs only for engine-mounted hosts |
 | `login_button_label` | `"Sign in with SSO"` | Label on the login-page button |
 | `access_denied_message` | generic | Flash shown on any denial |
 | `on_login` | — (required) | Authorization hook; see below |
 
 `stub_dev_env_login!` is a method, not an option — see "Stub login" below.
 
+## ActiveAdmin's namespace
+
+Everything the gem mounts hangs off ActiveAdmin's namespace, and all of it is
+derived from `ActiveAdmin.application.default_namespace` rather than assumed to
+be `admin`. A host that renames it:
+
+```ruby
+# config/initializers/active_admin.rb
+config.default_namespace = :backoffice
+```
+
+gets `/backoffice/login`, `/backoffice/logout`, the OmniAuth middleware at
+`/backoffice/auth`, and a post-sign-in redirect to `/backoffice` — no gem
+configuration needed. ActiveAdmin's root namespace (`config.default_namespace =
+false`) mounts everything at the top level: `/login`, `/auth`, `/`.
+
+Each is still overridable. Isolated engines *have* to override them, since the
+engine's mount prefix is prepended to every path declared inside it — see
+[Engine-mounted Devise](#engine-mounted-devise).
+
+`omniauth_route_prefix` is what the gem assigns to `Devise.omniauth_path_prefix`,
+and it is skipped entirely if your app already assigned that in
+`config/initializers/devise.rb`. `omniauth_path_prefix` is passed to the OmniAuth
+strategy directly, so it stays correct regardless.
+
 ## The `on_login` hook
 
 `on_login` is the **only** place authorization lives. The gem handles authentication (the user proved who they are via the IdP); deciding whether that user is allowed into the admin panel — and what they can see once they are in — is the host application's problem. The gem does not ship a role model.
@@ -247,7 +285,7 @@ AdminUser.last.oidc_raw_info
 
 * A login button is added to the ActiveAdmin sessions page via a prepended view override — no templates to edit.
 * Clicking it POSTs to `/admin/auth/oidc` with a Rails CSRF token. The gem loads `omniauth-rails_csrf_protection` so OmniAuth 2.x delegates its authenticity check to Rails' forgery protection and `button_to` just works.
-* After a successful callback the user is signed in and redirected to `/admin` (not the host app's `/`, which may not exist).
+* After a successful callback the user is signed in and redirected to ActiveAdmin's namespace root (not the host app's `/`, which may not exist). The path comes from ActiveAdmin's own route helper, so a renamed `config.default_namespace` or an engine-mounted ActiveAdmin lands correctly; `/admin` is only the fallback when that helper cannot be resolved.
 * **Disabled/locked users are rejected.** Devise's `active_for_authentication?` is checked after provisioning but before sign-in. If your model overrides this method (e.g. to check an `enabled` flag or Devise's `:lockable` module), the guard fires on OIDC sign-in too — the user sees an appropriate flash and is redirected to the login page.
 * In development, `stub_dev_env_login!` repoints that same button at a local sign-in that never contacts the IdP — see "Stub login" below.
 * Logout goes through Devise's stock session destroy. No RP-initiated single-logout ping to the IdP — override the destroy action in your host app if you need that.

data/app/controllers/active_admin/oidc/devise/omniauth_callbacks_controller.rb

@@ -105,28 +105,53 @@ module ActiveAdmin
         # sign-in instead of Devise's default (host app root). Hosts
         # that don't define a `/` route would otherwise hit a routing
         # error immediately after login, and even when `/` does exist
-        # it's rarely what an admin user wants to see. ActiveAdmin
-        # always mounts at `/admin`, so we go there directly.
+        # it's rarely what an admin user wants to see.
         def after_sign_in_path_for(resource)
-          stored_location_for(resource) || '/admin'
+          stored_location_for(resource) || active_admin_root_path
+        end
+
+        # Resolved from ActiveAdmin's own route helper rather than
+        # assumed to be '/admin'. Two things move it: a host can rename
+        # the namespace (`config.default_namespace = :backoffice`), and
+        # an engine-mounted ActiveAdmin prefixes every path it declares
+        # with the engine's mount point -- so the real root can be
+        # '/admin/admin' or anything else entirely. Routing a signed-in
+        # admin to a 404 is a poor reward for a successful login.
+        def active_admin_root_path
+          send(devise_router_name(resource_name)).public_send(active_admin_root_helper)
+        rescue NameError, ::ActionController::UrlGenerationError
+          # The host has ActiveAdmin's routes somewhere we can't see (or
+          # hasn't drawn them at all). Its namespace prefix is the best
+          # remaining guess at where the admin panel lives -- except for
+          # the root namespace, where that prefix is '' and would make an
+          # empty, unredirectable Location.
+          ActiveAdmin::Oidc.config.active_admin_namespace_prefix.presence || '/'
+        end
+
+        # ActiveAdmin names its namespace root helper `<namespace>_root_path`,
+        # except for the root namespace where it is plain `root_path`.
+        def active_admin_root_helper
+          namespace = ActiveAdmin::Oidc.config.active_admin_namespace
+          namespace ? :"#{namespace}_root_path" : :root_path
         end
 
         # Devise's `new_session_path(scope)` is only generated when
         # `:database_authenticatable` is in the mapping's `used_helpers`,
         # so an OIDC-only model never gets it. The engine mounts
-        # `new_<scope>_session_path` itself, but the helper lives on
-        # whichever route set Devise's URL helper dispatcher points at:
-        # the per-mapping `router_name` (set by
-        # `devise_for :scope, router_name: :engine`) when present,
-        # otherwise the global `Devise.available_router_name`
-        # (set by `Devise.router_name = :engine`), which defaults to
-        # `:main_app`. Replicate that dispatcher here so the helper is
-        # resolved on the right context (Rails.application proxy or
-        # mounted engine proxy).
+        # `new_<scope>_session_path` itself, but on whichever route set
+        # `devise_router_name` resolves to.
         def after_omniauth_failure_path_for(scope)
-          router_name = ::Devise.mappings[scope].router_name ||
-                        ::Devise.available_router_name
-          send(router_name).public_send(:"new_#{scope}_session_path")
+          send(devise_router_name(scope)).public_send(:"new_#{scope}_session_path")
+        end
+
+        # Devise's URL helpers live on the per-mapping `router_name` (set
+        # by `devise_for :scope, router_name: :engine`) when present,
+        # otherwise on the global `Devise.available_router_name` (set by
+        # `Devise.router_name = :engine`), which defaults to `:main_app`.
+        # Replicate that dispatcher here so helpers resolve on the right
+        # context (Rails.application proxy or mounted engine proxy).
+        def devise_router_name(scope)
+          ::Devise.mappings[scope]&.router_name || ::Devise.available_router_name
         end
       end
     end

data/lib/activeadmin/oidc/configuration.rb

@@ -11,19 +11,23 @@ module ActiveAdmin
       DEFAULT_ADMIN_USER_CLASS    = 'AdminUser'
       DEFAULT_ACCESS_DENIED_MESSAGE =
         'Your account has no permission to access this admin panel.'
-      DEFAULT_LOGIN_PATH  = '/admin/login'
-      DEFAULT_LOGOUT_PATH = '/admin/logout'
       DEFAULT_STUB_DEV_ENV_LOGIN_CLAIMS = {
         'sub'   => 'stub-uid',
         'email' => 'stub-dev@example.com'
       }.freeze
+      # Stands in for ActiveAdmin's namespace when ActiveAdmin is not
+      # loaded (plain unit specs, scripts) and it therefore cannot be
+      # read. Everything else derives from
+      # `ActiveAdmin.application.default_namespace`.
+      FALLBACK_NAMESPACE = :admin
 
       attr_accessor :issuer, :client_id, :client_secret, :scope,
                     :redirect_uri,
                     :login_button_label, :timeout,
                     :identity_attribute, :identity_claim,
-                    :access_denied_message, :on_login, :admin_user_class,
-                    :login_path, :logout_path
+                    :access_denied_message, :on_login, :admin_user_class
+      attr_writer :login_path, :logout_path,
+                  :omniauth_path_prefix, :omniauth_route_prefix
 
       # Readers, not writers: stub login is turned on through
       # `stub_dev_env_login!` so the environment check cannot be skipped.
@@ -47,8 +51,10 @@ module ActiveAdmin
         @identity_claim        = DEFAULT_IDENTITY_CLAIM
         @access_denied_message = DEFAULT_ACCESS_DENIED_MESSAGE
         @admin_user_class      = DEFAULT_ADMIN_USER_CLASS
-        @login_path            = DEFAULT_LOGIN_PATH
-        @logout_path           = DEFAULT_LOGOUT_PATH
+        @login_path            = nil
+        @logout_path           = nil
+        @omniauth_path_prefix  = nil
+        @omniauth_route_prefix = nil
         @on_login              = nil
         @pkce_override         = nil
         @stub_dev_env_login = false
@@ -56,6 +62,82 @@ module ActiveAdmin
         self
       end
 
+      # The paths below all hang off ActiveAdmin's namespace, which the
+      # host can rename (`config.default_namespace = :backoffice`) -- in
+      # which case there is no /admin anywhere in the app and every
+      # hardcoded one would 404. They are computed on read rather than in
+      # `reset!` because the gem's own initializer may run before the
+      # host's `ActiveAdmin.setup` block.
+      #
+      # `login_path` and `logout_path` are declared inside whichever route
+      # set holds the host's Devise mapping, so an engine-mounted host has
+      # to override them engine-relative -- the mount prefix is prepended
+      # on top of whatever is written here.
+      def login_path
+        @login_path || "#{active_admin_namespace_prefix}/login"
+      end
+
+      def logout_path
+        @logout_path || "#{active_admin_namespace_prefix}/logout"
+      end
+
+      # Where the OmniAuth middleware listens. This one is a real,
+      # browser-visible path: the middleware sits in the application's
+      # Rack stack and sees the URL before any engine mount prefix has
+      # been stripped.
+      def omniauth_path_prefix
+        @omniauth_path_prefix || "#{active_admin_namespace_prefix}/auth"
+      end
+
+      # A host that set only `Devise.omniauth_path_prefix` meant one
+      # prefix, so it becomes ours too. An explicit value set here still
+      # wins: engine-mounted hosts need the two to differ by the mount
+      # prefix.
+      def adopt_devise_omniauth_path_prefix(prefix)
+        @omniauth_path_prefix ||= prefix.presence
+      end
+
+      # What Devise declares its OmniAuth request/callback routes with.
+      # Devise reuses a single setting for both jobs, and the two differ
+      # by exactly the mount prefix when `devise_for` lives inside a
+      # mounted engine -- so an engine-mounted host sets this
+      # engine-relative ('/auth'), the same way it does `login_path`.
+      def omniauth_route_prefix
+        @omniauth_route_prefix || omniauth_path_prefix
+      end
+
+      # ActiveAdmin's namespace as a Symbol, or nil for the root
+      # namespace (`default_namespace = false`), which mounts everything
+      # at the top level.
+      def active_admin_namespace
+        namespace = active_admin_default_namespace
+        return nil if namespace.blank? || namespace.to_sym == :root
+
+        # `.underscore` to match ActiveAdmin: `Namespace#initialize` does
+        # `name.to_s.underscore`, so `default_namespace = :"admin-panel"`
+        # routes under /admin_panel. Deriving from the raw value would
+        # mount the login page at /admin-panel and 404 after sign-in.
+        namespace.to_s.underscore.to_sym
+      end
+
+      # Narrow on purpose: `NoMethodError` is what "ActiveAdmin is not
+      # loaded, or not set up yet" surfaces as. Anything else -- a host
+      # initializer blowing up inside its own `default_namespace`
+      # override, say -- is a real misconfiguration and must not be
+      # quietly turned into a wrong path.
+      def active_admin_default_namespace
+        return FALLBACK_NAMESPACE unless defined?(::ActiveAdmin) && ::ActiveAdmin.respond_to?(:application)
+
+        ::ActiveAdmin.application.default_namespace
+      rescue NoMethodError
+        FALLBACK_NAMESPACE
+      end
+
+      def active_admin_namespace_prefix
+        namespace = active_admin_namespace
+        namespace ? "/#{namespace}" : ''
+      end
+
       def pkce
         return @pkce_override unless @pkce_override.nil?
 
@@ -117,7 +199,10 @@ module ActiveAdmin
       def login_submit_path
         return "#{login_path}/stub" if stub_dev_env_login_enabled?
 
-        "#{::OmniAuth.config.path_prefix}/#{Engine::PROVIDER_NAME}"
+        # `omniauth_path_prefix`, not `OmniAuth.config.path_prefix`:
+        # under an engine mount those two differ by the mount prefix,
+        # and this one is the browser-visible path the form posts to.
+        "#{omniauth_path_prefix}/#{Engine::PROVIDER_NAME}"
       end
 
       def validate!

data/lib/activeadmin/oidc/engine.rb

@@ -7,6 +7,12 @@ module ActiveAdmin
     class Engine < ::Rails::Engine
       PROVIDER_NAME = :oidc
 
+      # True once the host has supplied the minimum OIDC credentials.
+      def self.configured?
+        cfg = ActiveAdmin::Oidc.config
+        cfg.issuer.present? && cfg.client_id.present?
+      end
+
       # True when the host's AdminUser model includes :omniauthable.
       # Used to gate controller registration and view overrides so the
       # gem is a no-op when OIDC is not enabled on the model.
@@ -77,21 +83,42 @@ module ActiveAdmin
       # Automatically register the OmniAuth :openid_connect strategy with
       # Devise when the gem is configured, so host apps don't have to
       # duplicate the config.omniauth boilerplate in devise.rb.
-      # Runs before Devise's own initializer so the strategy is available
-      # when the model calls `devise :omniauthable`.
-      initializer 'activeadmin_oidc.register_omniauth_strategy', before: 'devise.omniauth' do
+      #
+      # Ordered after the host's config/initializers (where
+      # `ActiveAdmin.setup` and `Devise.setup` live, so the namespace and
+      # any explicit host overrides are readable) and before
+      # `devise.omniauth`, which both needs the strategy registered and
+      # builds the middleware from these args.
+      #
+      # `path_prefix` is passed per-strategy rather than left to
+      # `OmniAuth.config.path_prefix`, because Devise overwrites that
+      # global at route-draw time with `Devise.omniauth_path_prefix` --
+      # the value it *declares its routes* with, which for a mounted
+      # engine is the same path minus the mount prefix. Setting the two
+      # independently through the global is impossible: Devise raises
+      # "Wrong OmniAuth configuration" whenever they disagree.
+      initializer 'activeadmin_oidc.register_omniauth_strategy',
+                  after: :load_config_initializers, before: 'devise.omniauth' do
         cfg = ActiveAdmin::Oidc.config
-        next if cfg.issuer.blank? || cfg.client_id.blank?
+        next unless Engine.configured?
 
         require 'omniauth_openid_connect'
 
-        ::Devise.setup do |devise|
-          # ActiveAdmin mounts Devise under /admin, so OmniAuth middleware
-          # must intercept /admin/auth/:provider.
-          devise.omniauth_path_prefix ||= '/admin/auth'
+        # `||=` semantics preserved: a host that set the prefix in its
+        # own devise.rb keeps it. Read by Devise when the routes are
+        # drawn, which happens later still.
+        host_prefix = ::Devise.omniauth_path_prefix
+        ::Devise.omniauth_path_prefix ||= cfg.omniauth_route_prefix
+
+        # Devise's setting decides where the routes are DRAWN; the
+        # strategy's `path_prefix` decides where the middleware LISTENS,
+        # and the login view posts to it. If they differ, sign-in 404s.
+        cfg.adopt_devise_omniauth_path_prefix(host_prefix)
 
+        ::Devise.setup do |devise|
           devise.omniauth :openid_connect,
                           name: PROVIDER_NAME,
+                          path_prefix: cfg.omniauth_path_prefix,
                           scope: (cfg.scope || 'openid email profile').split,
                           response_type: :code,
                           issuer: cfg.issuer,
@@ -106,15 +133,6 @@ module ActiveAdmin
                             host: nil
                           }.compact
         end
-
-        # Devise propagates omniauth_path_prefix to
-        # OmniAuth.config.path_prefix during route generation
-        # (set_omniauth_path_prefix!). On Rails 8 routes load lazily,
-        # so the OmniAuth middleware may process requests before routes
-        # are drawn and miss the prefix. Set it eagerly here.
-        # Must happen AFTER `devise.omniauth` because that call
-        # triggers autoload of devise/omniauth which nils the value.
-        ::OmniAuth.config.path_prefix = ::Devise.omniauth_path_prefix
       end
 
       initializer 'activeadmin_oidc.filter_parameters' do |app|

data/lib/activeadmin/oidc/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module Oidc
-    VERSION = "2.2.1"
+    VERSION = "3.0.0"
   end
 end

data/lib/activeadmin-oidc.rb

@@ -18,6 +18,17 @@ require "active_admin/version"
 # at file load, so pull in the minimal Railtie base class first — this
 # keeps the require safe even in spec_helper contexts where the full
 # Rails stack hasn't been initialized yet.
+#
+# The delegation core ext has to come first. railties 8.1's
+# `rails/initializable.rb` calls `delegate_missing_to` in the body of
+# `Rails::Initializable::Collection` but only requires "tsort", and
+# `rails/railtie.rb` requires `rails/initializable` before any
+# ActiveSupport core ext. So on Rails 8.1 a bare `require
+# "rails/railtie"` raises `NoMethodError: undefined method
+# 'delegate_missing_to'`. Requiring the one core ext it needs keeps the
+# intent above intact — we still load only the minimal Railtie base
+# class, not all of Rails.
+require "active_support/core_ext/module/delegation"
 require "rails/railtie"
 require "omniauth/rails_csrf_protection"
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-oidc
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 3.0.0
 platform: ruby
 authors:
 - Igor Fedoronchuk
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-03 00:00:00.000000000 Z
+date: 2026-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeadmin
@@ -288,7 +288,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="