standard_id-apple 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12a977e4ff2079df4c467f77c117bd3ea4564de05381b29514f7c1bbdec87380
-  data.tar.gz: c071fe2549d4dae82f12d98e435214a615e68fa892fd85ff2a0dda88290c1a9b
+  metadata.gz: 75dbd2b3cec3ede939959396e75f19d8aea74524af5d94a19ceb3a88ac35fea5
+  data.tar.gz: a8cbbae0a326e7289c8bd537ab61451a90c39bd93ecca72d6f6aff4c4cc34736
 SHA512:
-  metadata.gz: c94b517719fa7da262ec4c189e4c3d791eef9e3e352afc4181844f0d353729bf167523932d9aab1c1eae88825001d9e87a7cf0c808b14182a6c081190ab956a3
-  data.tar.gz: b92eb9d4c48fefc7c59e1636f28e8a5483e13e58bdc83753716ca6e4956d334b8880e2a685a4288949b13c5048b433b788db0c874df9d2fd25809ae6b287e847
+  metadata.gz: b34faef3f56f6b1f8e6753b99dbdf5ed11170ecd6d666f3096d3c206b09ccbde0ed9177868c737abd401b8e5025699268b2e9272e106053b87cf355932ad57c9
+  data.tar.gz: 98dededac1c594d78d430c0c0ccb103912f997cce6369642921fd5568a078ecf9f375bea01535b6373b76e8cc9ac6cf1a3ffd0ddd92fcd78b24eac9a9892b704

data/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

data/AGENTS.md

@@ -0,0 +1,72 @@
+# AGENTS.md - AI Agent Guide for standard_id-apple
+
+`standard_id-apple` is a provider plugin for the [StandardId](https://github.com/rarebit-one/standard_id) authentication engine. It packages a `StandardId::Providers::Apple` implementation for Sign in with Apple, and auto-registers itself with the host StandardId installation via a `Rails::Railtie` so apps that bundle the gem don't need an explicit initializer.
+
+## Quick Reference
+
+```bash
+# Run tests
+bundle exec rspec
+
+# Run a single spec file
+bundle exec rspec spec/standard_id/apple/providers/apple_spec.rb
+
+# Run linting (note: --config flag is required on Ruby 4.0)
+bundle exec rubocop --config .rubocop.yml
+
+# Auto-fix lint issues
+bundle exec rubocop --config .rubocop.yml -A
+```
+
+## Project Structure
+
+```
+standard_id-apple/
+├── lib/standard_id/
+│   ├── apple.rb                         # Top-level require entrypoint
+│   └── apple/
+│       ├── version.rb                   # Gem version constant
+│       ├── railtie.rb                   # Auto-registers provider on after_initialize
+│       └── providers/apple.rb           # StandardId::Providers::Apple implementation
+└── spec/
+    ├── spec_helper.rb                   # Boots a minimal Rails app so the Railtie fires
+    └── standard_id/                     # Provider specs
+```
+
+## Key Patterns
+
+### Provider class
+
+`StandardId::Providers::Apple` inherits from `StandardId::Providers::Base` (defined in the parent `standard_id` gem) and implements the provider contract: `provider_name`, `authorization_url`, `get_user_info`, `config_schema`, plus Apple-specific helpers (`verify_id_token`, `generate_client_secret`, JWKS fetching).
+
+### Railtie auto-registration
+
+`StandardId::Apple::Railtie` runs on `config.after_initialize` and calls `StandardId::ProviderRegistry.register(:apple, StandardId::Providers::Apple)`. Host apps just need the gem in their Gemfile — no initializer required.
+
+### Spec bootstrapping
+
+`spec/spec_helper.rb` defines a tiny `Rails::Application` and calls `Rails.application.initialize!` so the Railtie's `after_initialize` hook fires during the spec run; without this the provider would not appear in the registry.
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `lib/standard_id/apple.rb` | Top-level require entrypoint |
+| `lib/standard_id/apple/railtie.rb` | Provider registration on Rails boot |
+| `lib/standard_id/apple/providers/apple.rb` | Apple provider implementation |
+| `lib/standard_id/apple/version.rb` | Gem version constant |
+| `standard_id-apple.gemspec` | Gem metadata + runtime deps |
+
+## Dependencies
+
+- **standard_id** `~> 0.1`, `>= 0.1.7` (parent engine — provides `Providers::Base`, `ProviderRegistry`, errors)
+- **activesupport** `>= 8.0` (`Time.current`, `present?`/`blank?`, indifferent access)
+- **jwt** `~> 2.7` (id_token decoding, client_secret signing)
+
+Dev: rspec, rubocop, webmock, lefthook.
+
+## Testing
+
+- WebMock stubs Apple's JWKS and token endpoints — never make real network calls in specs.
+- The dummy Rails app in `spec_helper.rb` is intentionally minimal; add config via `StandardId.config.apple_*` setters in individual specs rather than expanding the dummy app.
+- CI runs the full Ruby 4.0.x patch matrix via the shared `rarebit-one/.github` reusable workflow.

data/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-05-19
+
+### Changed
+
+- Relaxed `jwt` dependency constraint from `~> 2.7` to `>= 2.7, < 4`, allowing consumers to satisfy the GHSA security advisory for `jwt` 2.x by upgrading to `jwt` 3.x. The provider's `JWT.encode` / `JWT.decode` call sites already pass an explicit algorithm and are compatible with the 3.x API surface.
+
+## [0.3.0] - 2026-04-29
+
+### Added
+
+- `.editorconfig` and `AGENTS.md` for dev tooling parity with the parent `standard_id` gem.
+- SimpleCov branch coverage reporting in `spec/spec_helper.rb`. No minimum threshold is enforced; `coverage/` is gitignored.
+
+### Changed
+
+- CI and release workflows migrated to the shared `rarebit-one/.github` reusable workflows (`reusable-gem-ci.yml@v1`, `reusable-gem-release.yml@v1`); `.github/workflows/ci.yml` and `release.yml` are now thin shims.
+- CI matrix expanded to all four Ruby 4.0.x patch releases (`4.0.0`, `4.0.1`, `4.0.2`, `4.0.3`) and lint pinned to `4.0.3`. Branch protection will be updated post-merge to require the consolidated `ci / test` aggregator (added in `rarebit-one/.github#6`) instead of per-version checks, so future Ruby version churn won't require updating protection.
+
+### Removed
+
+- **BREAKING:** Dropped support for Ruby < 4.0. `required_ruby_version` is now `>= 4.0`. Aligns with `standard_id` (the parent gem) which made the same break in [rarebit-one/standard_id#195](https://github.com/rarebit-one/standard_id/pull/195) — host apps must upgrade to Ruby 4.0+ before bundling this version.
+
 ## [0.2.0] - 2026-04-21
 
 ### Added

data/CLAUDE.md

@@ -24,3 +24,9 @@ Then work inside `.worktrees/<name>/` for the rest of the session.
 **Why this matters:** Working directly on the main checkout causes cross-contamination between sessions — uncommitted changes, wrong branches, and dirty state leak into unrelated work. Worktrees eliminate this entirely.
 
 See the `/worktree` and `/start` skills for full conventions and flags.
+
+## Consumers
+
+`standard_id-apple` is currently consumed by `luminality-web` only in the rarebit-one workspace. Apple Sign In is a Luminality-only feature; `fundbright-web` and `nutripod-web` do not consume this gem.
+
+After publishing a new version via `/publish-gem`, roll it out with the workspace-level `/rollout-gem standard_id-apple [<version>]` skill (defined at the rarebit-one workspace root, one directory above this repo). The canonical consumer matrix — including version constraints — lives in that skill's `SKILL.md`.

data/lib/standard_id/apple/providers/apple.rb

@@ -137,7 +137,7 @@ module StandardId
             id_token,
             jwk.public_key,
             true,
-            algorithm: "RS256",
+            algorithms: ["RS256"],
             iss: ISSUER,
             verify_iss: true,
             aud: client_id,

data/lib/standard_id/apple/version.rb

@@ -2,6 +2,6 @@
 
 module StandardId
   module Apple
-    VERSION = "0.2.0"
+    VERSION = "0.4.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id-apple
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -27,16 +27,22 @@ dependencies:
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: standard_id
   requirement: !ruby/object:Gem::Requirement
@@ -65,9 +71,11 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".editorconfig"
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-version"
+- AGENTS.md
 - CHANGELOG.md
 - CLAUDE.md
 - CODE_OF_CONDUCT.md
@@ -93,7 +101,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: '4.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="