standard_id-apple 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 75dbd2b3cec3ede939959396e75f19d8aea74524af5d94a19ceb3a88ac35fea5
-  data.tar.gz: a8cbbae0a326e7289c8bd537ab61451a90c39bd93ecca72d6f6aff4c4cc34736
+  metadata.gz: be7fc30fab9732c5874d6d9672193130821d23251e1d838bfaf952851f988a6f
+  data.tar.gz: '0529585c83478d6ce4f11a48dbc2fb54548db01ff75f46a50f3f77673b8bc234'
 SHA512:
-  metadata.gz: b34faef3f56f6b1f8e6753b99dbdf5ed11170ecd6d666f3096d3c206b09ccbde0ed9177868c737abd401b8e5025699268b2e9272e106053b87cf355932ad57c9
-  data.tar.gz: 98dededac1c594d78d430c0c0ccb103912f997cce6369642921fd5568a078ecf9f375bea01535b6373b76e8cc9ac6cf1a3ffd0ddd92fcd78b24eac9a9892b704
+  metadata.gz: 0fcea150d715a749d08fbdea281f45e790901a4af7e9cacd090492b66f5e6c633fa3e249164d4613309c780350ee1d8ba3c674b7e685573862f1177f89d8dc1e
+  data.tar.gz: 3f131c47f4e7ebe1021a967d3426356efdb80b8eeeed86ded1c3f4f5fb5210257ca58fe95a7292a9246404679cb83a0d38e30be5977ffed50a021ffaa5af2d4a

data/CHANGELOG.md

@@ -7,6 +7,160 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-09-24
+
+Adopts the provider-plugin API of standard_id 0.42.
+
+### Upgrade
+
+- **Requires `standard_id` 0.42** (`~> 0.42`, was `>= 0.29, < 1.0`). Bump both
+  together.
+- **Rename `APPLE_PRIVATE_KEY_PEM` to `APPLE_PRIVATE_KEY`** when convenient.
+  Initializers from the 0.5.0 generator assign `ENV["APPLE_PRIVATE_KEY_PEM"]`
+  explicitly and keep working unchanged; the old name is also read as a
+  deprecated ENV fallback (see Deprecated).
+- **Expect a boot warning if Apple is half-configured.** With
+  `apple_client_id` set and any of `apple_team_id` / `apple_key_id` /
+  `apple_private_key` blank, standard_id now logs a warning at boot (raises in
+  production under `c.social.provider_misconfiguration = :raise`). sidekick-web
+  can drop the gated `APPLE_PRIVATE_KEY` / `APPLE_KEY_ID` / `APPLE_TEAM_ID`
+  entries in `config/initializers/standard_health.rb` in favour of that
+  setting, or keep them for the health report.
+- **Anyone rescuing on message text:** several messages changed (see Changed).
+  `StandardId::Apple::Railtie` no longer exists.
+
+### Added
+
+- **Required config fields.** `apple_private_key`, `apple_key_id` and
+  `apple_team_id` are declared `required: true`, so
+  `StandardId::Providers::Apple.configuration_errors` and standard_id's boot
+  check report them whenever `apple_client_id` (the enabling field) is set —
+  the two-stage check sidekick-web rebuilt by hand. `apple_mobile_client_id`
+  stays optional: the native `id_token` flow needs no signing key.
+- **ENV fallback** through standard_id 0.42: `APPLE_CLIENT_ID`,
+  `APPLE_MOBILE_CLIENT_ID`, `APPLE_PRIVATE_KEY`, `APPLE_KEY_ID`, `APPLE_TEAM_ID`.
+- **JWKS caching.** Apple's key set is cached in-process for an hour
+  (`JWKS_CACHE_TTL`) instead of being downloaded on every sign-in. A token whose
+  `kid` is not in the cached set triggers one refetch — Apple rotated — no more
+  than once a minute (`JWKS_MIN_REFRESH_INTERVAL`), so tokens with made-up
+  `kid`s cannot make this process hammer Apple. `reset_jwks_cache!` drops it.
+- Specs for `resolve_params`, `skip_csrf?`, `supports_mobile_callback?` /
+  `flow_for`, nonce handling, JWKS caching and configuration, plus standard_id's
+  `"a registered StandardId provider"` shared example.
+
+### Changed
+
+- **The JWKS is fetched through `StandardId::HttpClient`** — 5s open / 10s read
+  timeouts and the private/internal-address guard — instead of a bare
+  `Net::HTTP.get_response` with Ruby's default 60s timeouts. HttpClient has no
+  public plain GET, so this calls its `validate_url!` / `start_connection`
+  directly; CI's compat job catches it if those change.
+- **Nonce mismatches no longer leak the nonce.** The message was
+  `ID token nonce mismatch. Expected: <nonce>, got: <nonce>`; it is now
+  standard_id's `ID token nonce mismatch`, and the comparison is constant-time.
+- **The duplicated helpers are gone** in favour of standard_id's
+  `Providers::Base`: `rescue_to_oauth_error`, `verify_nonce!`,
+  `build_authorization_url`, `extract_tokens` (the private
+  `extract_token_payload` is removed). `lib/standard_id/apple/railtie.rb` is
+  replaced by `StandardId::Providers.plugin_railtie(:apple, ...)`.
+- **Error messages**, now consistently Apple-prefixed and never echoing a `kid`
+  or nonce:
+  - `Either code or id_token must be provided` → `Apple sign-in requires a code or an id_token`
+  - `Access token login flow is not supported for Apple` → `Apple sign-in does not support the access token flow`
+  - `Missing authorization code` → `Apple authorization code is missing`
+  - `Missing id_token` → `Apple id_token is missing`
+  - `Apple response missing id_token` → `Apple token response is missing id_token`
+  - `Apple OAuth credentials are incomplete` → `... are incomplete: <fields> not set`
+  - `Failed to exchange Apple authorization code: <error>` now falls back to
+    `HTTP <status>` when Apple's body names no error (it printed nothing).
+  - `JWK with kid '<kid>' not found in Apple's JWKS` → `Invalid Apple ID token: signing key not found in Apple's JWKS`
+  - `Failed to fetch JWK: ...` → `Failed to fetch Apple JWKS: ...`. A non-2xx
+    JWKS response is now `StandardId::OAuthError` (an upstream failure) rather
+    than `InvalidRequestError`.
+- Install generator and README use the canonical `APPLE_PRIVATE_KEY`, and
+  document the ENV fallback, required fields and flows.
+
+### Deprecated
+
+- **`APPLE_PRIVATE_KEY_PEM`** as an ENV source for `apple_private_key`. Read only
+  when the field is never assigned and `APPLE_PRIVATE_KEY` is unset, with one
+  warning per process through `StandardId.deprecator`.
+
+### Removed
+
+- `StandardId::Apple::Railtie` (replaced by the Railtie `plugin_railtie`
+  defines, `StandardId::Providers::Railties::Apple`).
+
+## [0.5.0] - 2026-07-31
+
+### Added
+
+- **Install generator: `bin/rails g standard_id:apple:install`.** Writes
+  `config/initializers/standard_id_apple.rb` with all five `social.apple_*`
+  fields wired to ENV, then prints the environment variables the host has to
+  set (including the warning that `APPLE_PRIVATE_KEY_PEM` is multi-line and
+  that a secret store which flattens it to literal `\n` produces a key that
+  parses but fails to sign — surfacing as a JWT error at callback time, not at
+  boot). Idempotent: re-running skips an existing initializer; `--force`
+  overwrites, `--skip-initializer` writes nothing.
+
+  It writes a **separate** file rather than editing `standard_id.rb`, so the
+  provider can be removed by deleting one file and `standard_id`'s own install
+  generator stays free to overwrite its initializer without clobbering these
+  credentials. Initializers load alphabetically, so the base config is applied
+  first. The generated file uses the `config.social.` form throughout — a spec
+  pins that it never emits the unqualified `config.apple_*` form, which works
+  today only because the names happen to be unique across scopes.
+
+  Five of the nine `standard_*` gems shipped an install generator and this was
+  not one of them, which left both consumers assembling the block from the
+  README by hand.
+
+### Documentation
+
+- **Consumer list corrected in `CLAUDE.md`: this gem has two consumers, not
+  one.** It named `luminality-web` only; `sidekick-web` also consumes it. Both
+  live in sibling workspaces rather than beside this repo, which is how the
+  second one went unnoticed.
+
+- **Corrected the Configuration section, which was wrong in two ways.**
+
+  It showed the *flat* form (`config.apple_client_id = ...`) rather than the
+  `social` scope the fields actually live in. The flat form works — StandardId
+  routes an unqualified name to the owning scope when it is unique across scopes
+  — but only once the field is declared, and it silently breaks the day another
+  scope declares a colliding name. Existing code using it is not broken.
+
+  It also documented a form that raised on `standard_id` <= 0.32.0. These fields
+  are declared by this gem, and until `standard_id` 0.33.0 they were declared
+  from this gem's Railtie `after_initialize` — after `config/initializers` — so
+  the plain initializer raised `StandardId::ConfigurationError: Unknown field
+  'apple_client_id' for scope 'social'`. The README now records the
+  `after_initialize` workaround for older `standard_id`, states that 0.33.0
+  declares provider fields before `:load_config_initializers` so the plain form
+  is correct there, and notes that the fields do not exist at all without this
+  gem in the Gemfile — on any `standard_id` version.
+
+### Changed
+
+- **`standard_id` dependency tightened from `~> 0.1, >= 0.1.7` to `~> 0.29.0`.**
+  The old constraint claimed compatibility with every `0.x` release while this
+  plugin reaches into `StandardId::ProviderRegistry` and
+  `StandardId::Providers::Apple`, and `standard_id` is pre-1.0 with breaking
+  minors. Bundler would happily resolve against an untested minor and fail at
+  runtime instead of at resolution. Both current consumers already pin
+  `standard_id "~> 0.29.0"`, so nothing existing is affected.
+
+### Fixed
+
+- Gemspec now uses an allow-list (`Dir["lib/**/*", …]`) rather than a
+  `git ls-files` reject-list. A reject-list fails **open** — new files ship
+  unless someone remembers to exclude them, which is how `.claude/` reached
+  published `0.3.0` of `standard_id-google` (rarebit-one/standard_id-google#69).
+  Drops `.editorconfig`, `.pinact.yaml`, `.rspec`, `.rubocop.yml`,
+  `.ruby-version`, `AGENTS.md`, `CLAUDE.md`, and `CODE_OF_CONDUCT.md` from the
+  package; `lib/` is byte-identical.
+
 ## [0.4.0] - 2026-05-19
 
 ### Changed

data/{LICENSE.txt → LICENSE}

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) Jaryl Sim
+Copyright (c) 2026 Rarebit One
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -4,7 +4,7 @@ This gem extracts the Apple OAuth provider from the core [`standard_id`](https:/
 
 ## Installation
 
-Add the gem next to `standard_id`:
+Requires `standard_id` 0.42 or later. Add the gem next to `standard_id`:
 
 ```ruby
 # Gemfile
@@ -20,25 +20,144 @@ bundle install
 
 The gem automatically registers itself with StandardId when it is required.
 
+Then run the install generator to drop the credentials block in place:
+
+```bash
+bin/rails g standard_id:apple:install
+```
+
+This writes `config/initializers/standard_id_apple.rb` — deliberately a
+separate file from `config/initializers/standard_id.rb`, so the provider can be
+removed by deleting one file and `standard_id`'s own install generator stays
+free to overwrite its initializer without clobbering these values. Initializers
+load alphabetically, so the base config is applied first. The generator is
+idempotent; re-running on an existing initializer skips with a clear message
+(pass `--force` to overwrite).
+
 ## Configuration
 
-Configure Apple credentials via the StandardId configuration block:
+The generator writes this for you; the block is documented here for hosts
+configuring by hand. Configure Apple credentials via the StandardId
+configuration block, in the `social` scope:
 
 ```ruby
+# config/initializers/standard_id_apple.rb
 StandardId.configure do |config|
-  config.apple_client_id = ENV["APPLE_CLIENT_ID"]
-  config.apple_mobile_client_id = ENV["APPLE_MOBILE_CLIENT_ID"] # optional
-  config.apple_team_id = ENV["APPLE_TEAM_ID"]
-  config.apple_key_id = ENV["APPLE_KEY_ID"]
-  config.apple_private_key = ENV["APPLE_PRIVATE_KEY_PEM"]
+  config.social.apple_client_id = ENV["APPLE_CLIENT_ID"]
+  config.social.apple_mobile_client_id = ENV["APPLE_MOBILE_CLIENT_ID"] # optional
+  config.social.apple_team_id = ENV["APPLE_TEAM_ID"]
+  config.social.apple_key_id = ENV["APPLE_KEY_ID"]
+  config.social.apple_private_key = ENV["APPLE_PRIVATE_KEY"]
 end
 ```
 
 With those values in place, StandardId routes such as `/auth/callback/apple` continue to function using this provider gem.
 
+### ENV fallback
+
+On `standard_id` 0.42+, a field you never assign falls back to the ENV
+variable named after it, upper-cased:
+
+| Field | ENV variable |
+|---|---|
+| `apple_client_id` | `APPLE_CLIENT_ID` |
+| `apple_mobile_client_id` | `APPLE_MOBILE_CLIENT_ID` |
+| `apple_team_id` | `APPLE_TEAM_ID` |
+| `apple_key_id` | `APPLE_KEY_ID` |
+| `apple_private_key` | `APPLE_PRIVATE_KEY` (deprecated fallback: `APPLE_PRIVATE_KEY_PEM`) |
+
+So with those variables set the block above is optional. Explicit
+configuration, even `nil`, always wins. `APPLE_PRIVATE_KEY_PEM` — the name
+install generators before 0.6.0 wrote — is still read when
+`APPLE_PRIVATE_KEY` is unset and the field is never assigned, with a
+deprecation warning; rename it. (An initializer that assigns
+`ENV["APPLE_PRIVATE_KEY_PEM"]` explicitly keeps working as-is.)
+
+### Required fields and the boot check
+
+`apple_client_id` (the web Services ID) switches the provider on — it is what
+`StandardId.social_provider_enabled?(:apple)` and the `apple_enabled` Inertia
+prop report. While it is set, `apple_team_id`, `apple_key_id` and
+`apple_private_key` are required: the code exchange signs its `client_secret`
+with them, so without them the flow starts, the user authenticates with Apple,
+and only then does the callback fail. StandardId checks this once every plugin
+has registered:
+
+```ruby
+StandardId::Providers::Apple.configuration_errors
+# => ["apple_private_key is required when apple_client_id is set"]
+
+config.social.provider_misconfiguration = :raise # fail a production boot instead of warning
+```
+
+`apple_mobile_client_id` gates nothing: the native `id_token` flow verifies the
+token against Apple's JWKS and needs no signing key. A native-only app (mobile
+client ID set, `apple_client_id` not) is therefore "not enabled" for the web
+UI while its native sign-in keeps working.
+
+### Flows
+
+| Flow | Audience (`client_id`) | Needs signing key |
+|---|---|---|
+| Web (`/auth/callback/apple`, form_post, CSRF skipped) | `apple_client_id` | yes |
+| Native `id_token` (`/api/oauth/callback/apple`) | `apple_mobile_client_id` | no |
+| Web flow on Android etc. (`flow=web` on the API callback, redirects back into the app) | `apple_client_id` | yes |
+
+Apple's signing keys (JWKS) are fetched through `StandardId::HttpClient`
+(timeouts, private-address guard) and cached in-process for an hour; a token
+signed with an unknown key triggers one early refetch, at most once a minute.
+
+### Two corrections to earlier versions of this section
+
+**The `social.` prefix.** This section previously showed the flat form
+(`config.apple_client_id = ...`). That happens to work — `StandardId`'s top-level
+config routes an unqualified name to the owning scope when it is unique across
+scopes, and these five are — but only *after* the field has been declared, and it
+is the wrong thing to document: the fields live in the `social` scope, the
+install template writes them there, and the flat form silently stops working the
+day another scope declares a colliding name. Existing code using the flat form is
+not broken and needs no change.
+
+**Boot ordering.** These fields are declared by *this gem*, not by
+`standard_id`, and until `standard_id` 0.33.0 they were declared from this gem's
+Railtie `after_initialize` — which runs *after* `config/initializers`. On
+`standard_id` **0.32.0 and earlier**, the block above therefore raised:
+
+```
+StandardId::ConfigurationError: Unknown field 'apple_client_id' for scope 'social'
+```
+
+The workaround was to wrap the writes:
+
+```ruby
+# Only needed on standard_id <= 0.32.0
+Rails.application.config.after_initialize do
+  StandardId.configure { |config| config.social.apple_client_id = ENV["APPLE_CLIENT_ID"] }
+end
+```
+
+`standard_id` **>= 0.33.0** declares every loaded provider's fields before
+`:load_config_initializers`, so a plain initializer is correct. The wrapper is no
+longer needed and existing ones keep working unchanged.
+
+Note this is about *ordering*, not just versions: **the fields do not exist
+without this gem in your Gemfile**, on any `standard_id` version. Configuring
+`social.apple_*` with the plugin absent raises the same error, correctly.
+
 ## Testing
 
-Run the spec suite:
+In a host app, pin the plugin's registration with standard_id's shared
+example:
+
+```ruby
+require "standard_id/testing"
+
+RSpec.describe "StandardId social providers" do
+  it_behaves_like "a registered StandardId provider", :apple
+end
+```
+
+Run this gem's spec suite:
 
 ```bash
 bundle exec rspec
@@ -56,4 +175,4 @@ To release a new version:
 
 ## License
 
-MIT — see [LICENSE.txt](LICENSE.txt).
+MIT — see [LICENSE](LICENSE).

data/lib/generators/standard_id/apple/install/install_generator.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module StandardId
+  module Apple
+    module Generators
+      # Installs the Apple provider's credentials block in a host Rails app.
+      #
+      # Writes `config/initializers/standard_id_apple.rb` — a separate file from
+      # `config/initializers/standard_id.rb` on purpose. The provider is opt-in
+      # per app, so its credentials should be removable by deleting one file,
+      # and `standard_id`'s own install generator must stay free to overwrite
+      # its initializer without clobbering these five values.
+      #
+      # Initializers load alphabetically, so `standard_id.rb` runs before
+      # `standard_id_apple.rb` — the base configuration is already applied by
+      # the time this file sets the `social.apple_*` fields.
+      #
+      # Idempotent: re-running skips an initializer that is already there.
+      # `--skip-initializer` opts out; `--force` overwrites.
+      class InstallGenerator < Rails::Generators::Base
+        source_root File.expand_path("templates", __dir__)
+
+        INITIALIZER_PATH = "config/initializers/standard_id_apple.rb"
+
+        desc <<~DESC
+          Installs StandardId Apple. This writes #{INITIALIZER_PATH} with the
+          five social.apple_* fields wired to ENV, and prints the env vars the
+          host needs to set.
+
+          The generator is idempotent — an existing initializer is skipped with
+          a clear message. Pass --force to overwrite.
+        DESC
+
+        class_option :skip_initializer, type: :boolean, default: false,
+          desc: "Do not write #{INITIALIZER_PATH}"
+        class_option :force, type: :boolean, default: false,
+          desc: "Overwrite #{INITIALIZER_PATH} if it already exists"
+
+        def copy_initializer
+          if options[:skip_initializer]
+            say_status("skip", "#{INITIALIZER_PATH} (--skip-initializer)", :yellow)
+            return
+          end
+
+          if File.exist?(File.join(destination_root, INITIALIZER_PATH)) && !options[:force]
+            say_status("identical", "#{INITIALIZER_PATH} (already exists; pass --force to overwrite)", :blue)
+            return
+          end
+
+          template "initializer.rb.erb", INITIALIZER_PATH, force: options[:force]
+        end
+
+        def print_env_hint
+          return if options[:skip_initializer]
+
+          say ""
+          say "=" * 79
+          say "StandardId Apple installed."
+          say ""
+          say "Set these in the host's environment (1Password / DO app spec / .env):"
+          say ""
+          say "  APPLE_CLIENT_ID         the Services ID (web sign-in)"
+          say "  APPLE_MOBILE_CLIENT_ID  the iOS bundle ID — optional, web-only apps skip it"
+          say "  APPLE_TEAM_ID           the 10-character Apple Developer team ID"
+          say "  APPLE_KEY_ID            the key ID of the Sign In with Apple private key"
+          say "  APPLE_PRIVATE_KEY       the .p8 private key contents, PEM, newlines intact"
+          say ""
+          say "APPLE_TEAM_ID, APPLE_KEY_ID and APPLE_PRIVATE_KEY are required whenever"
+          say "APPLE_CLIENT_ID is set; StandardId checks for them at boot."
+          say ""
+          say "APPLE_PRIVATE_KEY is multi-line. Most secret stores flatten it to"
+          say "literal \\n — if sign-in fails on a JWT signing error, that is why."
+          say "=" * 79
+          say ""
+        end
+      end
+    end
+  end
+end

data/lib/generators/standard_id/apple/install/templates/initializer.rb.erb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# Apple Sign In credentials for StandardId.
+#
+# These five fields are declared by the standard_id-apple gem, NOT by
+# standard_id — they do not exist unless this gem is in the Gemfile, on any
+# standard_id version. Removing the gem and leaving this file behind raises
+# `StandardId::ConfigurationError: Unknown field 'apple_client_id' for scope
+# 'social'`, which is correct behaviour, not a bug.
+#
+# Set them in the `social` scope, as below. The unqualified form
+# (`config.apple_client_id = ...`) happens to work today because StandardId
+# routes a unique unqualified name to its owning scope, but it stops working
+# the day another scope declares a colliding name. Use `config.social.`.
+#
+# ENV: on standard_id >= 0.42 a field this file does not assign falls back to
+# the ENV variable named after it, upper-cased — APPLE_CLIENT_ID,
+# APPLE_MOBILE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY — which
+# are the names used below. The assignments are kept so the wiring is visible;
+# delete any you prefer to leave to the fallback, or point one at another
+# source (e.g. Rails credentials).
+#
+# apple_client_id switches the web flow on. While it is set, StandardId's boot
+# check requires apple_team_id, apple_key_id and apple_private_key (warns by
+# default; `config.social.provider_misconfiguration = :raise` fails a
+# production boot instead).
+StandardId.configure do |config|
+  config.social.apple_client_id = ENV["APPLE_CLIENT_ID"]
+
+  # Optional: only set when a native iOS client signs in against the same
+  # backend. Its audience differs from the web Services ID, so leaving it nil
+  # on a web-only app is correct — don't point it at APPLE_CLIENT_ID.
+  config.social.apple_mobile_client_id = ENV["APPLE_MOBILE_CLIENT_ID"]
+
+  config.social.apple_team_id = ENV["APPLE_TEAM_ID"]
+  config.social.apple_key_id = ENV["APPLE_KEY_ID"]
+
+  # The .p8 contents in PEM form, newlines intact. Secret stores that flatten
+  # multi-line values to literal \n produce a key that parses but fails to
+  # sign — surfacing as a JWT error at callback time, not at boot.
+  # (Installs before standard_id-apple 0.6.0 used APPLE_PRIVATE_KEY_PEM.)
+  config.social.apple_private_key = ENV["APPLE_PRIVATE_KEY"]
+end

data/lib/standard_id/apple/providers/apple.rb

@@ -1,7 +1,7 @@
-require "uri"
-require "net/http"
 require "json"
 require "jwt"
+require "net/http"
+require "openssl"
 
 module StandardId
   module Providers
@@ -17,6 +17,22 @@ module StandardId
         response_mode: DEFAULT_RESPONSE_MODE
       }.freeze
 
+      # Apple's signing keys rotate rarely; an unknown `kid` forces an early
+      # refetch (see #fetch_jwk), so a long TTL costs nothing on rotation.
+      JWKS_CACHE_TTL = 3600
+      # Floor between forced refetches, so a stream of ID tokens carrying
+      # made-up `kid`s cannot turn this process into a request amplifier
+      # against Apple.
+      JWKS_MIN_REFRESH_INTERVAL = 60
+
+      # Pre-0.6.0 install generators wired `apple_private_key` to this
+      # variable. Still read, with a deprecation warning, when the canonical
+      # APPLE_PRIVATE_KEY is unset and the host never assigns the field.
+      LEGACY_PRIVATE_KEY_ENV = "APPLE_PRIVATE_KEY_PEM".freeze
+
+      @jwks_mutex = Mutex.new
+      @jwks_cache = nil
+
       class << self
         def provider_name
           "apple"
@@ -29,18 +45,12 @@ module StandardId
         def authorization_url(state:, redirect_uri:, **options)
           ensure_basic_credentials!
 
-          query = {
+          build_authorization_url(
+            endpoint: AUTH_ENDPOINT,
             client_id: StandardId.config.apple_client_id,
-            redirect_uri:,
-            response_type: "code",
-            state:
-          }
-
-          supported_authorization_params.each do |param|
-            query[param] = options[param] || AUTHORIZATION_PARAM_DEFAULTS[param]
-          end
-
-          "#{AUTH_ENDPOINT}?#{URI.encode_www_form(query.compact)}"
+            redirect_uri:, state:, options:,
+            defaults: AUTHORIZATION_PARAM_DEFAULTS
+          )
         end
 
         def get_user_info(code: nil, id_token: nil, access_token: nil, redirect_uri: nil, nonce: nil, **options)
@@ -54,19 +64,32 @@ module StandardId
           elsif code.present?
             exchange_code_for_user_info(code: code, redirect_uri: redirect_uri, client_id: client_id, nonce: nonce)
           elsif access_token.present?
-            raise StandardId::InvalidRequestError, "Access token login flow is not supported for Apple"
+            raise StandardId::InvalidRequestError, "Apple sign-in does not support the access token flow"
           else
-            raise StandardId::InvalidRequestError, "Either code or id_token must be provided"
+            raise StandardId::InvalidRequestError, "Apple sign-in requires a code or an id_token"
           end
         end
 
+        # `apple_client_id` (the web Services ID) switches the provider on —
+        # it is the enabling field, so StandardId's boot check reports the
+        # three signing credentials below whenever it is set. They are what
+        # the code exchange needs to sign its client_secret; without them the
+        # web flow starts fine and only fails at the callback, after the user
+        # has authenticated with Apple.
+        #
+        # `apple_mobile_client_id` gates nothing: the native id_token flow
+        # verifies against Apple's JWKS and needs no signing key.
+        #
+        # ENV fallbacks (standard_id >= 0.42) use the upper-cased field names:
+        # APPLE_CLIENT_ID, APPLE_MOBILE_CLIENT_ID, APPLE_PRIVATE_KEY,
+        # APPLE_KEY_ID, APPLE_TEAM_ID.
         def config_schema
           {
             apple_client_id: { type: :string, default: nil },
             apple_mobile_client_id: { type: :string, default: nil },
-            apple_private_key: { type: :string, default: nil },
-            apple_key_id: { type: :string, default: nil },
-            apple_team_id: { type: :string, default: nil }
+            apple_private_key: { type: :string, default: -> { legacy_private_key_from_env }, required: true },
+            apple_key_id: { type: :string, default: nil, required: true },
+            apple_team_id: { type: :string, default: nil, required: true }
           }
         end
 
@@ -74,14 +97,19 @@ module StandardId
           DEFAULT_SCOPE
         end
 
+        # Apple posts the web callback (response_mode=form_post).
         def skip_csrf?
           true
         end
 
+        # Android and other non-Apple platforms sign in through Apple's web
+        # flow and need the server to redirect back into the app.
         def supports_mobile_callback?
           true
         end
 
+        # The web flow authenticates against the Services ID, the native flow
+        # against the app's bundle ID.
         def resolve_params(params, context: {})
           flow = context[:flow] || :web
           client_id = flow == :mobile ? StandardId.config.apple_mobile_client_id : StandardId.config.apple_client_id
@@ -90,83 +118,71 @@ module StandardId
         end
 
         def exchange_code_for_user_info(code:, redirect_uri:, client_id: StandardId.config.apple_client_id, nonce: nil)
-          ensure_full_credentials!(client_id: client_id)
-          raise StandardId::InvalidRequestError, "Missing authorization code" if code.blank?
-
-          token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
-                                                  client_id: client_id,
-                                                  client_secret: generate_client_secret(client_id: client_id),
-                                                  code: code,
-                                                  grant_type: "authorization_code",
-                                                  redirect_uri: redirect_uri
-                                                })
-
-          unless token_response.is_a?(Net::HTTPSuccess)
-            error_body = begin
-              JSON.parse(token_response.body)
-            rescue StandardError
-              {}
+          rescue_to_oauth_error do
+            ensure_full_credentials!(client_id: client_id)
+            raise StandardId::InvalidRequestError, "Apple authorization code is missing" if code.blank?
+
+            token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
+                                                    client_id: client_id,
+                                                    client_secret: generate_client_secret(client_id: client_id),
+                                                    code: code,
+                                                    grant_type: "authorization_code",
+                                                    redirect_uri: redirect_uri
+                                                  })
+
+            unless token_response.is_a?(Net::HTTPSuccess)
+              raise StandardId::InvalidRequestError,
+                    "Failed to exchange Apple authorization code: #{error_reason(token_response)}"
             end
-            raise StandardId::InvalidRequestError, "Failed to exchange Apple authorization code: #{error_body["error"]}"
-          end
-
-          parsed_token = JSON.parse(token_response.body)
-          id_token = parsed_token["id_token"]
-          raise StandardId::InvalidRequestError, "Apple response missing id_token" if id_token.blank?
-
-          tokens = extract_token_payload(parsed_token)
-          user_info = verify_id_token(id_token: id_token, client_id: client_id, nonce: nonce)
 
-          build_response(user_info, tokens: tokens)
-        rescue StandardError => e
-          raise e if e.is_a?(StandardId::OAuthError)
+            parsed_token = JSON.parse(token_response.body)
+            id_token = parsed_token["id_token"]
+            raise StandardId::InvalidRequestError, "Apple token response is missing id_token" if id_token.blank?
 
-          raise StandardId::OAuthError, e.message, cause: e
+            user_info = verify_id_token(id_token: id_token, client_id: client_id, nonce: nonce)
+            build_response(user_info, tokens: extract_tokens(parsed_token))
+          end
         end
 
         def verify_id_token(id_token:, client_id: StandardId.config.apple_client_id, nonce: nil)
-          raise StandardId::InvalidRequestError, "Missing id_token" if id_token.blank?
-          raise StandardId::InvalidRequestError, "Apple client_id is not configured" if client_id.blank?
-
-          decoded_token = JWT.decode(id_token, nil, false)
-          header = decoded_token[1]
-
-          jwk = fetch_jwk(kid: header["kid"])
-
-          verified_payload, = JWT.decode(
-            id_token,
-            jwk.public_key,
-            true,
-            algorithms: ["RS256"],
-            iss: ISSUER,
-            verify_iss: true,
-            aud: client_id,
-            verify_aud: true
-          )
+          rescue_to_oauth_error do
+            raise StandardId::InvalidRequestError, "Apple id_token is missing" if id_token.blank?
+            raise StandardId::InvalidRequestError, "Apple client_id is not configured" if client_id.blank?
+
+            _unverified_payload, header = JWT.decode(id_token, nil, false)
+            jwk = fetch_jwk(kid: header["kid"])
+
+            verified_payload, = JWT.decode(
+              id_token,
+              jwk.public_key,
+              true,
+              algorithms: ["RS256"],
+              iss: ISSUER,
+              verify_iss: true,
+              aud: client_id,
+              verify_aud: true
+            )
 
-          # Validate nonce if provided (web flow with server-generated nonce)
-          if nonce.present?
-            token_nonce = verified_payload["nonce"]
-            if token_nonce != nonce
-              raise StandardId::InvalidRequestError,
-                    "ID token nonce mismatch. Expected: #{nonce}, got: #{token_nonce}"
-            end
+            # Web flow with a server-generated nonce; constant-time, and the
+            # error never echoes either value.
+            verify_nonce!(expected: nonce, actual: verified_payload["nonce"])
+
+            {
+              "sub" => verified_payload["sub"],
+              "email" => verified_payload["email"],
+              "email_verified" => verified_payload["email_verified"],
+              "is_private_email" => verified_payload["is_private_email"]
+            }.compact
+          rescue JWT::InvalidAudError => e
+            raise StandardId::InvalidRequestError, "Invalid Apple ID token audience: #{e.message}"
+          rescue JWT::DecodeError => e
+            raise StandardId::InvalidRequestError, "Invalid Apple ID token: #{e.message}"
           end
+        end
 
-          {
-            "sub" => verified_payload["sub"],
-            "email" => verified_payload["email"],
-            "email_verified" => verified_payload["email_verified"],
-            "is_private_email" => verified_payload["is_private_email"]
-          }.compact
-        rescue JWT::InvalidAudError => e
-          raise StandardId::InvalidRequestError, "Invalid Apple ID token audience: #{e.message}"
-        rescue JWT::DecodeError => e
-          raise StandardId::InvalidRequestError, "Invalid Apple ID token: #{e.message}"
-        rescue StandardError => e
-          raise e if e.is_a?(StandardId::OAuthError)
-
-          raise StandardId::OAuthError, e.message, cause: e
+        # Drop the in-process JWKS cache (tests, or after a known rotation).
+        def reset_jwks_cache!
+          @jwks_mutex.synchronize { @jwks_cache = nil }
         end
 
         private
@@ -177,18 +193,18 @@ module StandardId
           raise StandardId::InvalidRequestError, "Apple OAuth is not configured"
         end
 
+        # The same fields StandardId's boot check reports (required_config_fields),
+        # checked again at the point of use because the mobile code exchange
+        # can run with only apple_mobile_client_id set. Names fields, never
+        # values.
         def ensure_full_credentials!(client_id: nil)
           ensure_basic_credentials!(client_id: client_id)
 
-          required = [
-            StandardId.config.apple_private_key,
-            StandardId.config.apple_key_id,
-            StandardId.config.apple_team_id
-          ]
-
-          return unless required.any?(&:blank?)
+          missing = required_config_fields.select { |field| config_value(field).blank? }
+          return if missing.empty?
 
-          raise StandardId::InvalidRequestError, "Apple OAuth credentials are incomplete"
+          raise StandardId::InvalidRequestError,
+                "Apple OAuth credentials are incomplete: #{missing.join(', ')} not set"
         end
 
         def generate_client_secret(client_id: StandardId.config.apple_client_id)
@@ -209,32 +225,77 @@ module StandardId
           JWT.encode(payload, private_key, "ES256", header)
         end
 
+        # Look `kid` up in Apple's JWKS, served from an in-process cache
+        # (JWKS_CACHE_TTL). An unknown `kid` refetches once — Apple may have
+        # rotated — subject to JWKS_MIN_REFRESH_INTERVAL.
         def fetch_jwk(kid:)
-          uri = URI(JWKS_URI)
-          jwks_response = Net::HTTP.get_response(uri)
+          raise StandardId::InvalidRequestError, "Invalid Apple ID token: header has no kid" if kid.blank?
+
+          jwk_data = find_jwk(jwks_keys, kid) || find_jwk(jwks_keys(refresh: true), kid)
+          raise StandardId::InvalidRequestError, "Invalid Apple ID token: signing key not found in Apple's JWKS" unless jwk_data
+
+          JWT::JWK.import(jwk_data)
+        end
+
+        def find_jwk(keys, kid)
+          keys.find { |key| key["kid"] == kid }
+        end
+
+        def jwks_keys(refresh: false)
+          @jwks_mutex.synchronize do
+            now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            cache = @jwks_cache
+
+            stale = cache.nil? || now - cache[:fetched_at] > JWKS_CACHE_TTL
+            forced = refresh && cache && now - cache[:fetched_at] >= JWKS_MIN_REFRESH_INTERVAL
+            if stale || forced
+              @jwks_cache = cache = { keys: download_jwks, fetched_at: now }
+            end
 
-          unless jwks_response.is_a?(Net::HTTPSuccess)
-            raise StandardId::InvalidRequestError, "Failed to fetch Apple JWKS"
+            cache[:keys]
           end
+        end
 
-          jwks_data = JSON.parse(jwks_response.body)
-          jwk_data = jwks_data["keys"].find { |key| key["kid"] == kid }
+        # Fetched through StandardId::HttpClient's connection setup, so the
+        # request gets its timeouts and its private/internal-address guard.
+        # HttpClient has no public plain GET (only get_with_bearer, which would
+        # send an empty Authorization header), hence the two private calls.
+        def download_jwks
+          rescue_to_oauth_error("Failed to fetch Apple JWKS") do
+            uri, resolved_ip = HttpClient.send(:validate_url!, JWKS_URI)
+            response = HttpClient.send(:start_connection, uri, resolved_ip: resolved_ip) do |http|
+              http.request(Net::HTTP::Get.new(uri))
+            end
+            raise StandardId::OAuthError, "Failed to fetch Apple JWKS: HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
 
-          raise StandardId::InvalidRequestError, "JWK with kid '#{kid}' not found in Apple's JWKS" unless jwk_data
+            keys = JSON.parse(response.body)["keys"]
+            raise StandardId::OAuthError, "Failed to fetch Apple JWKS: response has no keys" unless keys.is_a?(Array)
 
-          JWT::JWK.import(jwk_data)
-        rescue StandardError => e
-          raise e if e.is_a?(StandardId::OAuthError)
+            keys
+          end
+        end
 
-          raise StandardId::OAuthError, "Failed to fetch JWK: #{e.message}"
+        def error_reason(response)
+          body = JSON.parse(response.body.to_s)
+          reason = body["error"] if body.is_a?(Hash)
+          reason.presence || "HTTP #{response.code}"
+        rescue JSON::ParserError
+          "HTTP #{response.code}"
         end
 
-        def extract_token_payload(parsed_token)
-          {
-            access_token: parsed_token["access_token"],
-            refresh_token: parsed_token["refresh_token"],
-            id_token: parsed_token["id_token"]
-          }.compact
+        def legacy_private_key_from_env
+          value = ENV[LEGACY_PRIVATE_KEY_ENV]
+          return nil if value.blank?
+
+          # An unassigned field's default is re-evaluated on read; warn once.
+          return value if @legacy_private_key_warned
+
+          @legacy_private_key_warned = true
+          StandardId.deprecator.warn(
+            "standard_id-apple: reading apple_private_key from #{LEGACY_PRIVATE_KEY_ENV} is deprecated. " \
+            "Rename the variable to APPLE_PRIVATE_KEY (or assign config.social.apple_private_key explicitly)."
+          )
+          value
         end
       end
     end

data/lib/standard_id/apple/version.rb

@@ -2,6 +2,6 @@
 
 module StandardId
   module Apple
-    VERSION = "0.4.0"
+    VERSION = "0.6.0"
   end
 end

data/lib/standard_id/apple.rb

@@ -1,5 +1,10 @@
 require "active_support/core_ext/numeric/time"
 require "active_support/core_ext/hash/indifferent_access"
 require "standard_id"
+require "standard_id/apple/version"
 require "standard_id/apple/providers/apple"
-require "standard_id/apple/railtie" if defined?(Rails)
+
+# Registers the provider from a Railtie's after_initialize (a no-op outside
+# Rails). Its config fields are declared earlier, before config/initializers,
+# by standard_id's own engine initializer.
+StandardId::Providers.plugin_railtie(:apple, "StandardId::Providers::Apple")

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: standard_id-apple
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Jaryl Sim
-bindir: exe
+bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
@@ -49,20 +49,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.7
+        version: '0.42'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.7
+        version: '0.42'
 description: Extracted StandardId::Providers::Apple implementation packaged as a standalone
   gem so StandardId installations can opt into Sign in with Apple independently.
 email:
@@ -71,20 +65,14 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".editorconfig"
-- ".rspec"
-- ".rubocop.yml"
-- ".ruby-version"
-- AGENTS.md
 - CHANGELOG.md
-- CLAUDE.md
-- CODE_OF_CONDUCT.md
-- LICENSE.txt
+- LICENSE
 - README.md
 - Rakefile
+- lib/generators/standard_id/apple/install/install_generator.rb
+- lib/generators/standard_id/apple/install/templates/initializer.rb.erb
 - lib/standard_id/apple.rb
 - lib/standard_id/apple/providers/apple.rb
-- lib/standard_id/apple/railtie.rb
 - lib/standard_id/apple/version.rb
 homepage: https://github.com/rarebit-one/standard_id_apple
 licenses:

data/.editorconfig

@@ -1,15 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[*.md]
-trim_trailing_whitespace = false
-
-[Makefile]
-indent_style = tab

data/.rspec

@@ -1,3 +0,0 @@
---format documentation
---color
---require spec_helper

data/.rubocop.yml

@@ -1,8 +0,0 @@
-# Omakase Ruby styling for Rails
-inherit_gem: { rubocop-rails-omakase: rubocop.yml }
-
-# Overwrite or add rules to create your own house style
-
-# Use `[a, [b, c]]` not `[ a, [ b, c ] ]`
-Layout/SpaceInsideArrayLiteralBrackets:
-  EnforcedStyle: no_space

data/.ruby-version

@@ -1 +0,0 @@
-4.0.1

data/AGENTS.md

@@ -1,72 +0,0 @@
-# AGENTS.md - AI Agent Guide for standard_id-apple
-
-`standard_id-apple` is a provider plugin for the [StandardId](https://github.com/rarebit-one/standard_id) authentication engine. It packages a `StandardId::Providers::Apple` implementation for Sign in with Apple, and auto-registers itself with the host StandardId installation via a `Rails::Railtie` so apps that bundle the gem don't need an explicit initializer.
-
-## Quick Reference
-
-```bash
-# Run tests
-bundle exec rspec
-
-# Run a single spec file
-bundle exec rspec spec/standard_id/apple/providers/apple_spec.rb
-
-# Run linting (note: --config flag is required on Ruby 4.0)
-bundle exec rubocop --config .rubocop.yml
-
-# Auto-fix lint issues
-bundle exec rubocop --config .rubocop.yml -A
-```
-
-## Project Structure
-
-```
-standard_id-apple/
-├── lib/standard_id/
-│   ├── apple.rb                         # Top-level require entrypoint
-│   └── apple/
-│       ├── version.rb                   # Gem version constant
-│       ├── railtie.rb                   # Auto-registers provider on after_initialize
-│       └── providers/apple.rb           # StandardId::Providers::Apple implementation
-└── spec/
-    ├── spec_helper.rb                   # Boots a minimal Rails app so the Railtie fires
-    └── standard_id/                     # Provider specs
-```
-
-## Key Patterns
-
-### Provider class
-
-`StandardId::Providers::Apple` inherits from `StandardId::Providers::Base` (defined in the parent `standard_id` gem) and implements the provider contract: `provider_name`, `authorization_url`, `get_user_info`, `config_schema`, plus Apple-specific helpers (`verify_id_token`, `generate_client_secret`, JWKS fetching).
-
-### Railtie auto-registration
-
-`StandardId::Apple::Railtie` runs on `config.after_initialize` and calls `StandardId::ProviderRegistry.register(:apple, StandardId::Providers::Apple)`. Host apps just need the gem in their Gemfile — no initializer required.
-
-### Spec bootstrapping
-
-`spec/spec_helper.rb` defines a tiny `Rails::Application` and calls `Rails.application.initialize!` so the Railtie's `after_initialize` hook fires during the spec run; without this the provider would not appear in the registry.
-
-## Key Files
-
-| File | Purpose |
-|------|---------|
-| `lib/standard_id/apple.rb` | Top-level require entrypoint |
-| `lib/standard_id/apple/railtie.rb` | Provider registration on Rails boot |
-| `lib/standard_id/apple/providers/apple.rb` | Apple provider implementation |
-| `lib/standard_id/apple/version.rb` | Gem version constant |
-| `standard_id-apple.gemspec` | Gem metadata + runtime deps |
-
-## Dependencies
-
-- **standard_id** `~> 0.1`, `>= 0.1.7` (parent engine — provides `Providers::Base`, `ProviderRegistry`, errors)
-- **activesupport** `>= 8.0` (`Time.current`, `present?`/`blank?`, indifferent access)
-- **jwt** `~> 2.7` (id_token decoding, client_secret signing)
-
-Dev: rspec, rubocop, webmock, lefthook.
-
-## Testing
-
-- WebMock stubs Apple's JWKS and token endpoints — never make real network calls in specs.
-- The dummy Rails app in `spec_helper.rb` is intentionally minimal; add config via `StandardId.config.apple_*` setters in individual specs rather than expanding the dummy app.
-- CI runs the full Ruby 4.0.x patch matrix via the shared `rarebit-one/.github` reusable workflow.

data/CLAUDE.md

@@ -1,32 +0,0 @@
-# CLAUDE.md
-
-## Worktree-Only Workflow (Enforced)
-
-**All file modifications are blocked in the main checkout.** A PreToolUse hook (`enforce-worktree.sh`) rejects Edit, Write, and NotebookEdit operations targeting files outside a worktree. There are no opt-outs. Do not use Bash to write files in the main checkout either (e.g., `echo >`, `sed -i`, `tee`, `cp`) — the hook cannot intercept shell commands, so this rule is instruction-enforced.
-
-Before writing any code, create a worktree:
-
-```bash
-DEFAULT_BRANCH=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@refs/remotes/origin/@@')
-DEFAULT_BRANCH=${DEFAULT_BRANCH:-main}
-git fetch origin "$DEFAULT_BRANCH"
-git worktree add .worktrees/<name> -b <branch-name> "origin/$DEFAULT_BRANCH"
-```
-
-Then work inside `.worktrees/<name>/` for the rest of the session.
-
-**Naming:** Use the Linear issue identifier if available (e.g., `.worktrees/<identifier>`), a task slug (e.g., `.worktrees/fix-auth-timeout`), or today's date (e.g., `.worktrees/2026-04-01`) as fallback.
-
-**The hook allows modifications only when:**
-
-1. The file is inside a git worktree (detected via `git rev-parse --git-dir` returning a path under `.git/worktrees/`)
-2. Running in a CI/automated context where the checkout is already isolated
-**Why this matters:** Working directly on the main checkout causes cross-contamination between sessions — uncommitted changes, wrong branches, and dirty state leak into unrelated work. Worktrees eliminate this entirely.
-
-See the `/worktree` and `/start` skills for full conventions and flags.
-
-## Consumers
-
-`standard_id-apple` is currently consumed by `luminality-web` only in the rarebit-one workspace. Apple Sign In is a Luminality-only feature; `fundbright-web` and `nutripod-web` do not consume this gem.
-
-After publishing a new version via `/publish-gem`, roll it out with the workspace-level `/rollout-gem standard_id-apple [<version>]` skill (defined at the rarebit-one workspace root, one directory above this repo). The canonical consumer matrix — including version constraints — lives in that skill's `SKILL.md`.

data/CODE_OF_CONDUCT.md

@@ -1,132 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, caste, color, religion, or sexual
-identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the overall
-  community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or advances of
-  any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email address,
-  without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official email address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-[INSERT CONTACT METHOD].
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series of
-actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or permanent
-ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within the
-community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.1, available at
-[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
-
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
-
-For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
-[https://www.contributor-covenant.org/translations][translations].
-
-[homepage]: https://www.contributor-covenant.org
-[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
-[Mozilla CoC]: https://github.com/mozilla/diversity
-[FAQ]: https://www.contributor-covenant.org/faq
-[translations]: https://www.contributor-covenant.org/translations

data/lib/standard_id/apple/railtie.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-module StandardId
-  module Apple
-    class Railtie < ::Rails::Railtie
-      config.after_initialize do
-        StandardId::ProviderRegistry.register(:apple, StandardId::Providers::Apple)
-
-        Rails.logger.debug("[StandardId::Apple] registered provider") if Rails.logger
-      end
-    end
-  end
-end