identizer 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76e9316e637b4f310e3bd6a3de54774b7fd22ca365ae04942b0aae0196a218ad
-  data.tar.gz: 2c99082c990f28cabab4e57139dca3659839df1a3b6297a6f1aa3c42a175ec1d
+  metadata.gz: 35ee37820b54d6bbc2d8749adef4f8e464fdc579556019502998db7e75c6b12c
+  data.tar.gz: 3fdf1b5c9ef7f9ae6b17d9e817201e885810cf835a5eda89fca703ee716fa344
 SHA512:
-  metadata.gz: 71bc913525b42bc3ddad2762cc5dc6f869a694c26cbfb45830a9eb74923631a158b49eba54c95e7ed6e2c26f6507d6cc136af3539f73669357174b7a8c1823e4
-  data.tar.gz: 31fbca1b65dc8b02de55d4adf1acac07c12f4e59db1a712bdae0bac0da2e3c1b8f38d534eb2d5cb398e891cd49dbc08d192b817a7b75616e5c384ff4d4718f3d
+  metadata.gz: 40372939cb3c487b517fc9ff87a0114e93537f5acdf02854f849ec68f42d30dd9ff34dac631060e91ba1abc60c6152d127b6b0b7ffaf30a7b82d1af9e772d213
+  data.tar.gz: bc9c93f7492f2947e01a6db13655795bae3557d4d5310c8824259842ef888745703a4dbc9247fd30add059c46d918a32d70789cce9be6f1735dd685ecbdaf043

data/CHANGELOG.md

@@ -6,10 +6,20 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-07-21
+
+### Fixed
+- Token endpoints now read `code_verifier`, `grant_type`, `refresh_token` and
+  `client_id` from a JSON request body, not just form-encoded params. PKCE
+  exchanges and refresh-token grants sent as JSON (what the Auth0 SDKs do)
+  returned `invalid_grant`.
+- `--password` and `--rs256` are no longer overridden by settings previously
+  saved from the web admin; an explicit flag now wins, as documented.
+
 ## [0.1.0] - 2026-06-27
 
 First release. A local identity provider for developing and testing auth/SSO
-integrations, extracted and decoupled from the tap-v3 SSO emulator.
+integrations.
 
 ### OIDC / OAuth2
 - Authorization-code flow with PKCE (S256/plain), refresh-token grant (rotated,
@@ -44,5 +54,6 @@ integrations, extracted and decoupled from the tap-v3 SSO emulator.
   enforcement; registered JWT claims protected from directory-attribute forging.
 - `nokogiri` (SAML) and `net-ldap` (LDAP) load lazily; `sqlite3` is optional.
 
-[Unreleased]: https://github.com/alex-andreiev/identizer/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/alex-andreiev/identizer/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/alex-andreiev/identizer/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/alex-andreiev/identizer/releases/tag/v0.1.0

data/lib/identizer/cli.rb

@@ -15,6 +15,7 @@ module Identizer
     def initialize(argv)
       @argv = argv
       @demo = true
+      @explicit = [] # settings given as flags; they outrank the persisted ones
     end
 
     def run
@@ -27,7 +28,7 @@ module Identizer
     # starting the server. Separated out so it can be exercised in tests.
     def configure(config = Identizer.configuration)
       parser(config).parse!(@argv)
-      config.apply_persisted_settings! # web-admin saved password/signing
+      config.apply_persisted_settings!(except: @explicit) # web-admin saved password/signing
       config.seed_identities = [DEMO_USER] if @demo && config.seed_identities.empty?
       load_sqlite(config) if config.sqlite_path
       config
@@ -69,11 +70,15 @@ module Identizer
         opts.on("--tls-key PATH", "TLS private key (PEM)") { |value| config.tls_key_path = value }
         opts.on("--password PASS", "Shared sign-in password (default 'password')") do |value|
           config.shared_password = value
+          @explicit << :shared_password
         end
         opts.on("--sqlite PATH", "Use a SQLite-backed directory at PATH (needs the sqlite3 gem)") do |value|
           config.sqlite_path = value
         end
-        opts.on("--rs256", "Sign id_tokens with RS256 + publish JWKS") { config.signing = :rs256 }
+        opts.on("--rs256", "Sign id_tokens with RS256 + publish JWKS") do
+          config.signing = :rs256
+          @explicit << :signing
+        end
         opts.on("--no-demo", "Don't seed the demo user on first run") { @demo = false }
         opts.on("--quiet", "Don't log requests") { config.request_logging = false }
         opts.on("--ldap-port PORT", Integer, "Also start an LDAP listener on PORT") { |value| config.ldap_port = value }

data/lib/identizer/configuration.rb

@@ -140,11 +140,12 @@ module Identizer
     end
 
     # Apply settings previously saved from the web admin (password, signing mode).
-    # Called at boot; explicit flags/config still override afterwards.
-    def apply_persisted_settings!
+    # Called at boot. `except` names the settings given explicitly on the command
+    # line — those always win, so a saved value can never shadow a flag.
+    def apply_persisted_settings!(except: [])
       data = JSON.parse(File.read(settings_path))
-      self.shared_password = data["shared_password"] if data["shared_password"]
-      self.signing = data["signing"].to_sym if data["signing"]
+      self.shared_password = data["shared_password"] if data["shared_password"] && !except.include?(:shared_password)
+      self.signing = data["signing"].to_sym if data["signing"] && !except.include?(:signing)
       self
     rescue StandardError
       self

data/lib/identizer/handlers/base.rb

@@ -42,23 +42,18 @@ module Identizer
       # Consume a one-time authorization code and enforce PKCE when a challenge
       # was issued — uniformly, so a code can't be redeemed at a different token
       # endpoint to skip the check. Returns the Authorization, or nil if the code
-      # is unknown or PKCE verification fails.
+      # is unknown or PKCE verification fails. Reads both the code and the
+      # verifier from the same merged view, so form- and JSON-encoded token
+      # requests behave identically (the Auth0 SDKs POST JSON).
       def redeem_code(request)
-        authorization = consume(code_param(request))
+        params = merged_params(request)
+        authorization = consume(params["code"])
         return nil if authorization.nil?
-        return nil unless authorization.pkce_valid?(request.params["code_verifier"])
+        return nil unless authorization.pkce_valid?(params["code_verifier"])
 
         authorization
       end
 
-      def code_param(request)
-        if json_request?(request)
-          parse_json(request)["code"]
-        else
-          request.params["code"]
-        end
-      end
-
       def bearer(request)
         request.get_header("HTTP_AUTHORIZATION").to_s.sub(/\ABearer\s+/i, "")
       end

data/lib/identizer/handlers/oidc.rb

@@ -6,7 +6,7 @@ module Identizer
     # discovery and JWKS documents, and the end-session (logout) endpoint.
     class Oidc < Base
       def token(request)
-        case request.params["grant_type"]
+        case merged_params(request)["grant_type"]
         when "refresh_token" then refresh(request)
         else authorization_code(request)
         end
@@ -75,7 +75,7 @@ module Identizer
       end
 
       def refresh(request)
-        authorization = refresh_tokens.take(request.params["refresh_token"]) # single-use, rotated
+        authorization = refresh_tokens.take(merged_params(request)["refresh_token"]) # single-use, rotated
         return json(400, { error: "invalid_grant" }) if authorization.nil?
 
         issue(authorization)
@@ -106,7 +106,7 @@ module Identizer
       def valid_client?(request)
         return true if config.clients.empty?
 
-        config.clients.any? { |client| client[:client_id] == request.params["client_id"] }
+        config.clients.any? { |client| client[:client_id] == merged_params(request)["client_id"] }
       end
     end
   end

data/lib/identizer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Identizer
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: identizer
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Alex Andreiev
 bindir: exe
 cert_chain: []
-date: 2026-06-27 00:00:00.000000000 Z
+date: 2026-07-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt