katalyst-koi 5.8.3 → 5.9.0

data/app/models/koi/identity/provider.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module Koi
+  module Identity
+    class Provider
+      include ActiveModel::Model
+      include ActiveModel::Attributes
+
+      # Upper bound on how long a key removed from the issuer's JWKS remains
+      # trusted. Newly rotated-in keys are picked up immediately, as an
+      # unknown kid invalidates the cache.
+      KEY_SET_TTL = 1.hour
+
+      # A cached key set younger than this cannot be invalidated, so a stream
+      # of unknown-kid assertions cannot force a discovery refetch per
+      # request. A rotated-in key may take this long to be honoured.
+      INVALIDATION_GRACE = 5.minutes
+
+      attribute :name, :string
+      attribute :issuer, :string
+      attribute :keys, :string
+      attribute :audience, :string
+
+      # Acceptable signature algorithms: asymmetric families only, so a
+      # provider's public key can never be replayed as an HMAC secret and
+      # unsigned (none) tokens are rejected before key lookup.
+      attribute :algorithms, default: -> { %w[ES256 ES384 ES512 RS256 RS384 RS512 PS256 PS384 PS512].freeze }
+
+      # Allowed clock drift for verification
+      attribute :leeway, default: -> { 15.seconds }
+
+      # Upper bound on assertion lifetime. Exchange is immediate, so a
+      # distant expiry indicates an integration minting long-lived
+      # credentials; require assertions to be short-lived instead
+      # (RFC 7523 §3).
+      attribute :max_expiry, default: -> { 1.hour }
+
+      validates :keys, inclusion: { in: %w[env discover] }
+      validate :pinned_keys_parse, if: -> { keys == "env" }
+
+      # This provider's JWKS: pinned from ENV or fetched via OIDC discovery
+      # and cached. Passed to JWT.decode as its jwks loader, which retries
+      # with invalidate: true when a presented kid is missing from the set.
+      def key_set(options = {})
+        invalidate_key_set if options[:invalidate]
+
+        JWT::JWK::Set.new(jwks)
+      end
+
+      # Trusted-keys summary for the roles page: RFC 7638 thumbprints, plus
+      # when a discovered set was cached. Viewing may prime the discovery
+      # cache — the same fail-closed path verification uses — and an
+      # unreachable issuer reports itself rather than raising.
+      def key_status
+        case keys
+        when "env"
+          { fingerprints: fingerprints(jwks) }
+        when "discover"
+          cached = cached_discovery
+
+          { fingerprints: fingerprints(cached.fetch("jwks")),
+            fetched_at:   Time.zone.at(cached.fetch("fetched_at")) }
+        end
+      rescue JWT::JWKError => e
+        { error: e.message }
+      end
+
+      # Identity attributes are issuer-specific: AWS issuers carry
+      # admin-controlled principal tags; other issuers assert no identity
+      # beyond their subject. Keyed by the verified issuer — never by claim
+      # shape, which any trusted signer could imitate.
+      def identity_attributes(claims)
+        case URI.parse(issuer.to_s).host
+        when /\.sts\.global\.api\.aws\z/
+          claims.dig("https://sts.amazonaws.com/", "principal_tags")&.slice("name", "email") || {}
+        else
+          {}
+        end
+      end
+
+      # Atomically claims an assertion's jti for its replayable lifetime:
+      # the first presentation writes the key, a replay finds it taken and
+      # is rejected. jti uniqueness is only promised within an issuer
+      # (RFC 7519), so entries are scoped per provider. Requires a cache
+      # store shared by all app processes.
+      def consume_jti(jti, claims)
+        jti.present? &&
+          Rails.cache.write("koi/identity/jti/#{name}/#{jti}", true,
+                            unless_exist: true,
+                            expires_in:   Time.zone.at(claims["exp"].to_i) + leeway - Time.current)
+      end
+
+      private
+
+      def pinned_keys_parse
+        JWT::JWK::Set.new(JSON.parse(ENV.fetch(env_name)))
+      rescue KeyError, JSON::ParserError, JWT::JWKError => e
+        errors.add(:keys, "ENV #{env_name} is unavailable or invalid (#{e.message})")
+      end
+
+      def fingerprints(jwks)
+        JWT::JWK::Set.new(jwks).map { |jwk| JWT::JWK::Thumbprint.new(jwk).generate }
+      end
+
+      def env_name
+        "KOI_API_JWKS_#{name.upcase}"
+      end
+
+      def jwks
+        case keys
+        when "env"
+          JSON.parse(ENV.fetch(env_name))
+        when "discover"
+          cached_discovery.fetch("jwks")
+        end
+      end
+
+      def cached_discovery
+        Rails.cache.fetch(key_set_cache_key, expires_in: KEY_SET_TTL) do
+          { "fetched_at" => Time.current.to_i, "jwks" => discover_jwks }
+        end
+      end
+
+      def discover_jwks
+        discovery = JSON.parse(Net::HTTP.get(URI.parse("#{issuer}/.well-known/openid-configuration")))
+
+        # Mix-up defence: only the configured issuer's own keys are trusted.
+        unless discovery["issuer"] == issuer
+          raise JWT::JWKError, "#{name} discovery names issuer #{discovery['issuer'].inspect}, expected #{issuer}"
+        end
+
+        JSON.parse(Net::HTTP.get(URI.parse(discovery.fetch("jwks_uri"))))
+      rescue JWT::JWKError
+        raise
+      rescue StandardError => e
+        raise JWT::JWKError, "key discovery for #{name} failed: #{e.message} (#{e.class})"
+      end
+
+      def invalidate_key_set
+        cached = Rails.cache.read(key_set_cache_key)
+        return if cached && cached.fetch("fetched_at") > INVALIDATION_GRACE.ago.to_i
+
+        Rails.cache.delete(key_set_cache_key)
+      end
+
+      def key_set_cache_key
+        "koi/identity/jwks/#{name}"
+      end
+    end
+  end
+end

data/app/models/koi/identity.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "jwt"
+require "net/http"
+
+module Koi
+  module Identity
+    module_function
+
+    def authorize_bearer_token!(token, audience:)
+      assertion = Assertion.new(token)
+      provider  = provider_for(assertion)
+
+      provider.audience ||= audience
+      raise JWT::InvalidAudError, "no expected audience" if provider.audience.blank?
+
+      assertion.verify!(provider)
+    rescue JWT::DecodeError => e
+      Rails.logger.warn("#{e.class}: Koi::Identity rejected assertion #{assertion.inspect}: #{e.message}")
+      raise
+    end
+
+    def provider_for(assertion)
+      providers.find { |provider| provider.issuer == assertion.issuer } ||
+        raise(JWT::InvalidIssuerError, "unknown issuer #{assertion.issuer}")
+    end
+
+    # Resolves the member matching the verified (provider, subject) into a
+    # principal, carrying whatever identity attributes the issuer publishes.
+    def principal_for(provider, assertion)
+      member = members.find { |m| m.provider == provider.name && m.subject == assertion.subject }
+
+      return if member.nil?
+
+      Principal.new(provider: provider.name,
+                    scope:    member.scope,
+                    subject:  assertion.subject,
+                    **provider.identity_attributes(assertion.claims))
+    end
+
+    def providers
+      Koi.config.identity.providers.map do |name, config|
+        provider = Provider.new(name:, **config)
+        unless provider.valid?
+          raise ArgumentError, "Invalid identity provider #{name}: #{provider.errors.full_messages.to_sentence}"
+        end
+
+        provider
+      end
+    end
+
+    def members
+      provider_names = Koi.config.identity.providers.keys.map(&:to_s)
+
+      Koi.config.identity.members.map do |name, config|
+        member = Member.new(name:, provider_names:, **config)
+        unless member.valid?
+          raise ArgumentError, "Invalid identity member #{name}: #{member.errors.full_messages.to_sentence}"
+        end
+
+        member
+      end
+    end
+
+    # Role slugs granted by config; roles outside this set are not assumable.
+    def role_slugs
+      members.filter_map(&:role_slug)
+    end
+  end
+end

data/app/models/recurring_task.rb

@@ -3,6 +3,22 @@
 class RecurringTask
   include ActiveModel::Model
 
+  module Scopes
+    def admin_search(query)
+      where(
+        <<~SQL.squish,
+          solid_queue_recurring_tasks.key LIKE :query
+          OR solid_queue_recurring_tasks.class_name LIKE :query
+        SQL
+        query: "%#{query}%",
+      )
+    end
+  end
+
+  def self.scope
+    SolidQueue::RecurringTask.extending(Scopes)
+  end
+
   # @return [SolidQueue::RecurringTask]
   attr_reader :task
 

data/app/views/admin/admin_roles/index.html.erb

@@ -0,0 +1,14 @@
+<%# locals: (collection:) %>
+
+<% content_for(:header) do %>
+  <h1>Admin roles</h1>
+<% end %>
+
+<%= table_query_with(collection:) %>
+
+<%= table_with(collection:) do |row| %>
+  <% row.link(:slug, url: :admin_admin_role_path) %>
+  <% row.date(:created_at, label: "Materialized") %>
+  <% row.datetime(:last_authenticated_at, label: "Last authenticated") %>
+  <% row.boolean(:orphaned?, label: "Orphaned") %>
+<% end %>

data/app/views/admin/admin_roles/show.html.erb

@@ -0,0 +1,41 @@
+<%# locals: (role:, members:, providers:) %>
+
+<% content_for(:header) do %>
+  <%= breadcrumb_list do %>
+    <li><%= link_to("Admin roles", admin_admin_roles_path) %></li>
+  <% end %>
+
+  <h1><%= role.slug %></h1>
+<% end %>
+
+<%= summary_table_with(model: role) do |row| %>
+  <% row.text(:slug) %>
+  <% row.date(:created_at, label: "Materialized") %>
+  <% row.datetime(:last_authenticated_at, label: "Last authenticated") %>
+  <% row.boolean(:orphaned?) %>
+  <% row.datetime(:tokens_revoked_at) %>
+<% end %>
+
+<h2>Trust</h2>
+
+<%= table_with(collection: members) do |row| %>
+  <% row.text(:name, label: "Member") %>
+  <% row.text(:subject) %>
+  <% row.text(:provider) %>
+<% end %>
+
+<%= table_with(collection: providers) do |row, provider| %>
+  <% row.text(:name, label: "Provider") %>
+  <% row.text(:issuer) %>
+  <% row.text(:keys) do %>
+    <% status = provider.key_status %>
+    <% if status[:fingerprints] %>
+      <%= "#{provider.keys}: #{status[:fingerprints].join(', ')}" %>
+      <% if status[:fetched_at] %>
+        (fetched <%= l(status[:fetched_at], format: :short) %>)
+      <% end %>
+    <% else %>
+      <%= "#{provider.keys}: #{status[:error]}" %>
+    <% end %>
+  <% end %>
+<% end %>

data/app/views/admin/{tokens → sessions/tokens}/create.turbo_stream.erb

@@ -3,9 +3,9 @@
 <%= turbo_stream.replace "invite" do %>
   <div class="action copy-to-clipboard govuk-input__wrapper" data-controller="clipboard" data-clipboard-supported-class="clipboard--supported">
     <%= text_field_tag :invite_link, admin_session_token_url(token), readonly: true, data: { clipboard_target: "source" } %>
-    <button class="govuk-input__suffix clipboard-button" aria-hidden="true" data-action="clipboard#copy">
+    <button class="govuk-input__suffix clipboard-button" data-action="clipboard#copy">
       Copy link
     </button>
-    <div class="copy-to-clipboard-feedback" role="alert"></div>
+    <div class="copy-to-clipboard-feedback" role="status">Link copied to your clipboard!</div>
   </div>
 <% end %>

data/config/routes.rb

@@ -7,14 +7,16 @@ Rails.application.routes.draw do
       put :archive, on: :collection
       put :restore, on: :collection
 
-      resources :tokens, only: %i[create]
+      resources :tokens, only: %i[create], module: :sessions
     end
 
+    resources :admin_roles, only: %i[index show]
+
     resource :cache, only: %i[destroy]
     resource :dashboard, only: %i[show]
 
     resources :device_authorizations, param: :user_code, only: %i[create show update]
-    resources :device_tokens, only: %i[create]
+    post "/tokens", to: "tokens#create", constraints: { format: :json }
 
     scope :active_storage, module: :active_storage do
       post :direct_uploads, to: "direct_uploads#create"
@@ -27,7 +29,7 @@ Rails.application.routes.draw do
 
     resource :session, only: %i[new create destroy] do
       # JWT tokens contain periods
-      resources :tokens, param: :token, only: %i[show update], token: /[^\/]+/
+      resources :tokens, param: :token, only: %i[show update], token: /[^\/]+/, module: :sessions
     end
 
     resources :background_jobs, only: %i[index show], param: :active_job_id do

data/db/migrate/20260721000001_create_admin_roles.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class CreateAdminRoles < ActiveRecord::Migration[8.0]
+  def change
+    create_table :admin_roles do |t|
+      t.string :slug, null: false, index: { unique: true }
+      t.datetime :tokens_revoked_at
+
+      t.timestamps
+    end
+  end
+end

data/db/migrate/20260721000002_add_admin_role_to_admin_device_authorizations.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class AddAdminRoleToAdminDeviceAuthorizations < ActiveRecord::Migration[8.0]
+  def change
+    add_reference :admin_device_authorizations, :admin_role, null: true, foreign_key: true
+
+    add_check_constraint :admin_device_authorizations,
+                         "admin_user_id IS NULL OR admin_role_id IS NULL",
+                         name: "admin_device_authorizations_single_actor"
+
+    # allow device authorizations to be created without the request/approval flow
+    change_column_null :admin_device_authorizations, :device_code_digest, true
+    change_column_null :admin_device_authorizations, :request_expires_at, true
+    change_column_null :admin_device_authorizations, :user_code, true
+
+    # regenerate the unique indexes to ignore nulls
+    remove_index :admin_device_authorizations, :device_code_digest, unique: true
+    add_index :admin_device_authorizations, :device_code_digest,
+              unique: true, where: "device_code_digest IS NOT NULL"
+
+    remove_index :admin_device_authorizations, :user_code, unique: true
+    add_index :admin_device_authorizations, :user_code,
+              unique: true, where: "user_code IS NOT NULL"
+  end
+end

data/db/migrate/20260721000003_add_principal_to_admin_device_authorizations.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddPrincipalToAdminDeviceAuthorizations < ActiveRecord::Migration[8.0]
+  def change
+    add_column :admin_device_authorizations, :principal, :text
+  end
+end

data/lib/koi/config.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/hash/deep_merge"
 require "active_support/core_ext/numeric"
+require "active_support/ordered_options"
 
 module Koi
   class Config
@@ -28,5 +30,35 @@ module Koi
       @image_mime_types             = %w[image/png image/gif image/jpeg image/webp].freeze
       @image_size_limit             = 10.megabytes
     end
+
+    # Identity & access settings for OIDC authentication.
+    def identity
+      @identity ||= ActiveSupport::OrderedOptions.new.merge!(providers: {}, members: {})
+    end
+
+    def identity=(options)
+      identity.deep_merge!(options.to_h)
+    end
+
+    # Load config/koi.yml, if present
+    def load(app)
+      app.config_for(:koi).each do |attribute, value|
+        public_send("#{attribute}=", value)
+      end
+
+      self
+    rescue RuntimeError => e
+      raise unless e.message.start_with?("Could not load configuration")
+
+      self
+    end
+
+    private
+
+    def method_missing(name, *) # rubocop:disable Style/MissingRespondToMissing
+      return super unless name.to_s.end_with?("=")
+
+      raise ArgumentError, "Unknown Koi config setting: #{name.to_s.chomp('=')}"
+    end
   end
 end

data/lib/koi/engine.rb

@@ -5,6 +5,7 @@ require "katalyst/content"
 require "katalyst-govuk-formbuilder"
 require "katalyst/navigation"
 require "katalyst/tables"
+require "jwt"
 require "lexxy"
 require "pagy"
 require "rotp"
@@ -62,6 +63,17 @@ module Koi
       end
     end
 
+    initializer "koi.config" do |app|
+      Koi.config.load(app)
+
+      # Constructing providers and members validates the trust config, so a
+      # config error fails the deploy rather than a partner's exchange.
+      app.config.to_prepare do
+        Koi::Identity.providers
+        Koi::Identity.members
+      end
+    end
+
     initializer "koi.content" do
       Katalyst::Content.config.base_controller  = "Admin::ApplicationController"
       Katalyst::Content.config.errors_component = "Koi::Content::Editor::ErrorsComponent"

data/lib/koi/extensions/object_rendering.rb

@@ -6,20 +6,20 @@ module Koi
       # Workaround for de-duplicating nested module paths for admin controllers
       # See https://github.com/rails/rails/issues/50916
       def merge_prefix_into_object_path(prefix, object_path)
-        if prefix.include?(?/) && object_path.include?(?/)
-          prefixes     = []
-          prefix_array = File.dirname(prefix).split("/")
+        return object_path unless prefix.include?(?/) && object_path.include?(?/)
 
-          prefix_array.each_with_index do |dir, index|
-            break if object_path.start_with?(prefix_array[index..].join("/"))
+        prefixes         = File.dirname(prefix).split("/")
+        object_namespace = object_path.split("/")
 
-            prefixes << dir
-          end
-
-          (prefixes << object_path).join("/")
-        else
-          object_path
+        # Drop the longest run of trailing prefix segments that also appears at
+        # the head of the object namespace, merging overlapping namespaces
+        # rather than repeating them.
+        max_overlap = [prefixes.length, object_namespace.length].min
+        overlap     = max_overlap.downto(0).find do |length|
+          prefixes.last(length) == object_namespace.first(length)
         end
+
+        (prefixes.first(prefixes.length - overlap) << object_path).join("/")
       end
     end
   end

data/lib/koi/middleware/admin_authentication.rb

@@ -48,7 +48,7 @@ module Koi
       end
 
       def authenticated?
-        Koi::Current.admin_user.present?
+        Koi::Current.actor.present?
       end
 
       def find_device_authentication(token:)
@@ -75,7 +75,7 @@ module Koi
       end
 
       def device_flow_request?(request:)
-        request.post? && %w[/admin/device_authorizations /admin/device_tokens].include?(request.path)
+        request.post? && %w[/admin/device_authorizations /admin/tokens].include?(request.path)
       end
 
       def bearer_token(request:)

data/spec/factories/admin_device_authorizations.rb

@@ -25,5 +25,23 @@ FactoryBot.define do
       consumed_at { Time.current }
       admin_user
     end
+
+    # An authorization issued for an admin role
+    trait :admin_role do
+      admin_role
+      principal do
+        Koi::Identity::Principal.new(
+          provider: "komet",
+          scope:    "admin/role/#{admin_role.slug}",
+          subject:  "komet-production",
+        )
+      end
+      status { :consumed }
+      consumed_at { Time.current }
+      token_expires_at { consumed_at + 1.hour }
+      device_code_digest { nil }
+      user_code { nil }
+      request_expires_at { nil }
+    end
   end
 end

data/spec/factories/admin_roles.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :admin_role, class: "Admin::Role" do
+    sequence(:slug) { |n| "role_#{n}" }
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: katalyst-koi
 version: !ruby/object:Gem::Version
-  version: 5.8.3
+  version: 5.9.0
 platform: ruby
 authors:
 - Katalyst Interactive
@@ -79,6 +79,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: rotp
   requirement: !ruby/object:Gem::Requirement
@@ -265,6 +279,7 @@ files:
 - app/assets/builds/katalyst/koi.js
 - app/assets/builds/katalyst/koi.min.js
 - app/assets/builds/katalyst/koi.min.js.map
+- app/assets/builds/koi/admin.css
 - app/assets/config/koi.js
 - app/assets/fonts/koi/inconsolata-license.txt
 - app/assets/fonts/koi/inconsolata-v37-latin-regular.woff2
@@ -373,6 +388,7 @@ files:
 - app/components/koi/tables/cells/link_component.rb
 - app/components/koi/tables/table_component.rb
 - app/controllers/admin/active_storage/direct_uploads_controller.rb
+- app/controllers/admin/admin_roles_controller.rb
 - app/controllers/admin/admin_users_controller.rb
 - app/controllers/admin/application_controller.rb
 - app/controllers/admin/background_jobs_controller.rb
@@ -380,11 +396,11 @@ files:
 - app/controllers/admin/credentials_controller.rb
 - app/controllers/admin/dashboards_controller.rb
 - app/controllers/admin/device_authorizations_controller.rb
-- app/controllers/admin/device_tokens_controller.rb
 - app/controllers/admin/feature_flags_controller.rb
 - app/controllers/admin/otps_controller.rb
 - app/controllers/admin/profiles_controller.rb
 - app/controllers/admin/recurring_tasks_controller.rb
+- app/controllers/admin/sessions/tokens_controller.rb
 - app/controllers/admin/sessions_controller.rb
 - app/controllers/admin/tokens_controller.rb
 - app/controllers/admin/url_rewrites_controller.rb
@@ -425,6 +441,7 @@ files:
 - app/models/admin/collection.rb
 - app/models/admin/credential.rb
 - app/models/admin/device_authorization.rb
+- app/models/admin/role.rb
 - app/models/admin/session.rb
 - app/models/admin/user.rb
 - app/models/application_record.rb
@@ -433,9 +450,16 @@ files:
 - app/models/concerns/koi/model/otp.rb
 - app/models/feature_flag.rb
 - app/models/koi/current.rb
+- app/models/koi/identity.rb
+- app/models/koi/identity/assertion.rb
+- app/models/koi/identity/member.rb
+- app/models/koi/identity/principal.rb
+- app/models/koi/identity/provider.rb
 - app/models/recurring_task.rb
 - app/models/url_rewrite.rb
 - app/models/well_known.rb
+- app/views/admin/admin_roles/index.html.erb
+- app/views/admin/admin_roles/show.html.erb
 - app/views/admin/admin_users/_form.html.erb
 - app/views/admin/admin_users/archived.html.erb
 - app/views/admin/admin_users/edit.html.erb
@@ -469,12 +493,12 @@ files:
 - app/views/admin/sessions/new.html.erb
 - app/views/admin/sessions/otp.html.erb
 - app/views/admin/sessions/password.html.erb
+- app/views/admin/sessions/tokens/create.turbo_stream.erb
+- app/views/admin/sessions/tokens/show.html.erb
 - app/views/admin/shared/icons/_close.html.erb
 - app/views/admin/shared/icons/_cross.html.erb
 - app/views/admin/shared/icons/_menu.html.erb
 - app/views/admin/shared/icons/_refresh.html.erb
-- app/views/admin/tokens/create.turbo_stream.erb
-- app/views/admin/tokens/show.html.erb
 - app/views/admin/url_rewrites/_form.html.erb
 - app/views/admin/url_rewrites/edit.html.erb
 - app/views/admin/url_rewrites/index.html.erb
@@ -521,6 +545,9 @@ files:
 - db/migrate/20260501000000_add_last_sign_out_at_to_admin_users.rb
 - db/migrate/20260525041029_create_admin_sessions.rb
 - db/migrate/20260525111759_clean_up_admin_user_timestamps.rb
+- db/migrate/20260721000001_create_admin_roles.rb
+- db/migrate/20260721000002_add_admin_role_to_admin_device_authorizations.rb
+- db/migrate/20260721000003_add_principal_to_admin_device_authorizations.rb
 - db/seeds.rb
 - lib/generators/koi/admin/USAGE
 - lib/generators/koi/admin/admin_generator.rb
@@ -558,6 +585,7 @@ files:
 - lib/koi/middleware/url_redirect.rb
 - lib/koi/release.rb
 - spec/factories/admin_device_authorizations.rb
+- spec/factories/admin_roles.rb
 - spec/factories/admin_sessions.rb
 - spec/factories/admins.rb
 - spec/factories/url_rewrites.rb
@@ -581,7 +609,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Koi CMS admin framework
 test_files: []