standard_id-google 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 88bce7685da60d2df6e41c103d179a5baa6bfb71d9e7f82ecaabb43e280680c7
-  data.tar.gz: 55a57eaba19c3907515a9609548e4d1370adaf400aa3481125e3d2a42e866c9b
+  metadata.gz: f22ca920dcb306788b3588bf99ac704b9ce5e40cbb9c423a551e064ab6b236a9
+  data.tar.gz: f8492f9d9af4dbf74af4062524e0c217e20e50ec3420605a76d363154cacc2f5
 SHA512:
-  metadata.gz: 1453686923aaf994a195d5d8d811fce1d1f02a4128eba1bcecffe457a533bad0a9345be8ae6f2545375e5c65d5357a170d450f18ca5ae71ae322f822b5a2013c
-  data.tar.gz: 1d23bfa48f33aab5980bbd9f6a4e5594dba9259dbe8cac91b434a3700f13187884972ca783674bc29986ebfc7c22040bf516445c338cc0d24ae15eb1099a0f9f
+  metadata.gz: 9b8d7e1bb7bdfa6302108521bf603a8727a61cd2a6893dcfd8ed230f9999697aa627f912b870528833f9b4781cbe1dbd868f761bdec013ae6cb7ff3a2f8af004
+  data.tar.gz: 53b44b47d85d30da76de8dbdf1f55953c3b3f4a31fb3808c769b8a72175210d8ac0fdbbbbbe0d52eb7e45817666d17edd5ce2947b1dfc16462d3f12d92226544

data/CHANGELOG.md

@@ -7,6 +7,167 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-24
+
+Adopts the provider-plugin API of standard_id 0.42.
+
+### Upgrade
+
+- **Requires `standard_id` 0.42** (`~> 0.42`, was `>= 0.29, < 1.0`). Bump both
+  together.
+- **Rename `GOOGLE_OAUTH_CLIENT_ID` / `GOOGLE_OAUTH_CLIENT_SECRET` to
+  `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET`** when convenient. Initializers
+  from the 0.4.0 generator assign the old names explicitly and keep working
+  unchanged; the old names are also read as a deprecated ENV fallback (see
+  Deprecated). sidekick-web already uses the canonical names.
+- **Expect a boot warning if the secret is missing.** With `google_client_id`
+  set and `google_client_secret` blank, standard_id now logs a warning at boot
+  (raises in production under `c.social.provider_misconfiguration = :raise`).
+  An app that deliberately accepts only native ID tokens and has no secret
+  should keep that setting at `:warn`.
+- **Specs stubbing the tokeninfo call:** access-token verification now posts to
+  `TOKEN_INFO_ENDPOINT` (`https://oauth2.googleapis.com/tokeninfo`), not
+  `https://www.googleapis.com/oauth2/v3/tokeninfo`. ID-token stubs against
+  `TOKEN_INFO_ENDPOINT` (sidekick-web's `social_callback_spec.rb`) are
+  unaffected.
+- **Anyone rescuing on message text:** several messages changed (see Changed).
+  `StandardId::Google::Railtie` no longer exists.
+
+### Added
+
+- **Required config field.** `google_client_secret` is declared
+  `required: true`, so `StandardId::Providers::Google.configuration_errors` and
+  standard_id's boot check report it whenever `google_client_id` (the enabling
+  field) is set.
+- **ENV fallback** through standard_id 0.42: `GOOGLE_CLIENT_ID`,
+  `GOOGLE_CLIENT_SECRET`.
+- Specs for `resolve_params`, `skip_csrf?`, `supports_mobile_callback?` /
+  `flow_for`, nonce handling (web code exchange included) and configuration,
+  plus standard_id's `"a registered StandardId provider"` shared example.
+
+### Changed
+
+- **One tokeninfo endpoint.** ID tokens and access tokens are both verified
+  against `TOKEN_INFO_ENDPOINT`, `https://oauth2.googleapis.com/tokeninfo` —
+  the endpoint Google documents for both. Access tokens previously went to a
+  hard-coded `https://www.googleapis.com/oauth2/v3/tokeninfo`.
+- **The id_token and access_token flows no longer need `google_client_secret`.**
+  Both verify through tokeninfo and compare the audience to the client ID; only
+  the web code exchange sends the secret. Previously every flow raised
+  `Google provider is not configured` without it.
+- **Nonce mismatches no longer leak the nonce.** The message was
+  `ID token nonce mismatch. Expected: <nonce>, got: <nonce>`; it is now
+  standard_id's `ID token nonce mismatch`, and the comparison is constant-time.
+  The nonce is now checked after the audience and issuer.
+- **Audience and issuer errors no longer echo values** — the old messages
+  included this app's client ID and the presented `aud`/`iss`. A token with no
+  `aud` at all is rejected explicitly.
+- **The duplicated helpers are gone** in favour of standard_id's
+  `Providers::Base`: `rescue_to_oauth_error`, `verify_nonce!`,
+  `build_authorization_url`, `extract_tokens` (the private
+  `extract_token_payload` is removed). `lib/standard_id/google/railtie.rb` is
+  replaced by `StandardId::Providers.plugin_railtie(:google, ...)`.
+- **Error messages**, now consistently Google-prefixed:
+  - `Either code, id_token, or access_token must be provided` → `Google sign-in requires a code, an id_token or an access_token`
+  - `Google provider is not configured` → `Google OAuth is not configured` (client ID missing) or `Google OAuth credentials are incomplete: google_client_secret not set` (code exchange only)
+  - `Missing authorization code` → `Google authorization code is missing`
+  - `Failed to exchange Google authorization code` → `...: <error>` (Google's `error`, else `HTTP <status>`)
+  - `Google response missing access token` → `Google token response is missing access_token`
+  - `Missing id_token` → `Google id_token is missing`
+  - `Invalid or expired id_token` → `Invalid Google ID token: invalid or expired`
+  - `ID token audience mismatch. Expected: ..., got: ...` → `Invalid Google ID token audience`
+  - `ID token issuer invalid. Expected Google, got: ...` → `Invalid Google ID token issuer`
+  - `Missing access token` → `Google access token is missing`
+  - `Invalid or expired access token` → `Invalid Google access token: invalid or expired`
+  - `Access token audience mismatch. Expected: ..., got: ...` → `Invalid Google access token audience`
+  - `Failed to fetch Google user info` → `...: HTTP <status>`
+- **Spec layout mirrors `lib/`** and standard_id-apple:
+  `spec/standard_id/providers/google_spec.rb` →
+  `spec/standard_id/google/providers/google_spec.rb`, plus
+  `spec/standard_id/google/registration_spec.rb`.
+- Install generator and README use the canonical `GOOGLE_CLIENT_ID` /
+  `GOOGLE_CLIENT_SECRET`, and document the ENV fallback, required field and
+  flows.
+
+### Deprecated
+
+- **`GOOGLE_OAUTH_CLIENT_ID` / `GOOGLE_OAUTH_CLIENT_SECRET`** as ENV sources.
+  Read only when the field is never assigned and the canonical variable is
+  unset, with one warning per variable per process through
+  `StandardId.deprecator`.
+
+### Removed
+
+- `StandardId::Google::Railtie` (replaced by the Railtie `plugin_railtie`
+  defines, `StandardId::Providers::Railties::Google`).
+
+## [0.4.0] - 2026-07-31
+
+### Added
+
+- **Install generator: `bin/rails g standard_id:google:install`.** Writes
+  `config/initializers/standard_id_google.rb` with the `social.google_*` fields
+  wired to ENV, then prints the environment variables the host has to set and
+  the reminder that `/auth/callback/google` must be registered as an authorized
+  redirect URI for **every** origin served — the Google console matches the
+  redirect exactly, so staging and production each need their own. Idempotent:
+  re-running skips an existing initializer; `--force` overwrites,
+  `--skip-initializer` writes nothing.
+
+  It writes a **separate** file rather than editing `standard_id.rb`, so the
+  provider can be removed by deleting one file and `standard_id`'s own install
+  generator stays free to overwrite its initializer without clobbering these
+  credentials. Initializers load alphabetically, so the base config is applied
+  first. The generated file uses the `config.social.` form throughout — a spec
+  pins that it never emits the unqualified `config.google_*` form, which works
+  today only because the names happen to be unique across scopes.
+
+  Five of the nine `standard_*` gems shipped an install generator and this was
+  not one of them, which left both consumers assembling the block from the
+  README by hand.
+
+### Documentation
+
+- **Consumer list corrected in `CLAUDE.md`: this gem has two consumers, not
+  one.** It named `luminality-web` only; `sidekick-web` also consumes it. Both
+  live in sibling workspaces rather than beside this repo, which is how the
+  second one went unnoticed.
+
+- **Corrected the Configuration section, which showed a form that raised on
+  `standard_id` <= 0.32.0.** These fields are declared by this gem, and until
+  `standard_id` 0.33.0 they were declared from this gem's Railtie
+  `after_initialize` — after `config/initializers` — so the documented plain
+  initializer raised `StandardId::ConfigurationError: Unknown field
+  'google_client_id' for scope 'social'`. The README now records the
+  `after_initialize` workaround for older `standard_id`, states that 0.33.0
+  declares provider fields before `:load_config_initializers` so the plain form
+  is correct there, and notes that the fields do not exist at all without this
+  gem in the Gemfile — on any `standard_id` version.
+
+### Changed
+
+- **`standard_id` dependency tightened from `~> 0.1, >= 0.1.7` to `~> 0.29.0`.**
+  The old constraint claimed compatibility with every `0.x` release while this
+  plugin reaches into `StandardId::ProviderRegistry` and
+  `StandardId::Providers::Google`, and `standard_id` is pre-1.0 with breaking
+  minors. Bundler would happily resolve against an untested minor and fail at
+  runtime instead of at resolution. Both current consumers already pin
+  `standard_id "~> 0.29.0"`, so nothing existing is affected.
+
+### Fixed
+
+- Gemspec no longer packages the `.claude/` directory. Published `0.3.0` shipped
+  `.claude/settings.json`, `.claude/hooks/enforce-worktree.sh`, and three skill
+  files to every consumer — this gem's `spec.files` reject-list was the only one
+  in the `standard_*` family missing the `.claude/` prefix (`standard_id-apple`
+  already had it). Packaged file count drops 21 → 16; `lib/` and `LICENSE` are
+  unaffected.
+- Gemspec now uses an allow-list (`Dir["lib/**/*", …]`) rather than a
+  `git ls-files` reject-list, so packaging fails **closed** and this class of
+  leak cannot recur. Also drops `.editorconfig`, `.pinact.yaml`, `.rspec`,
+  `.rubocop.yml`, `.ruby-version`, `AGENTS.md`, `CLAUDE.md`, and
+  `CODE_OF_CONDUCT.md`; `lib/` is byte-identical.
+
 ## [0.3.0] - 2026-04-29
 
 ### Added

data/{LICENSE.txt → LICENSE}

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) Jaryl Sim
+Copyright (c) 2026 Rarebit One
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -4,6 +4,8 @@ This gem extracts the Google OAuth provider from the core [`standard_id`](https:
 
 ## Installation
 
+Requires `standard_id` 0.42 or later.
+
 Add the gem next to `standard_id`:
 
 ```ruby
@@ -20,21 +22,127 @@ bundle install
 
 The gem automatically registers itself with StandardId when it is required.
 
+Then run the install generator to drop the credentials block in place:
+
+```bash
+bin/rails g standard_id:google:install
+```
+
+This writes `config/initializers/standard_id_google.rb` — deliberately a
+separate file from `config/initializers/standard_id.rb`, so the provider can be
+removed by deleting one file and `standard_id`'s own install generator stays
+free to overwrite its initializer without clobbering these values. Initializers
+load alphabetically, so the base config is applied first. The generator is
+idempotent; re-running on an existing initializer skips with a clear message
+(pass `--force` to overwrite).
+
 ## Configuration
 
-Configure your Google credentials inside the StandardId configuration block:
+The generator writes this for you; the block is documented here for hosts
+configuring by hand. Configure your Google credentials inside the StandardId
+configuration block:
 
 ```ruby
+# config/initializers/standard_id_google.rb
 StandardId.configure do |config|
-  config.social.google_client_id = ENV.fetch("GOOGLE_OAUTH_CLIENT_ID", nil)
-  config.social.google_client_secret = ENV.fetch("GOOGLE_OAUTH_CLIENT_SECRET", nil)
+  config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
+  config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
 end
 ```
 
 With those values in place, StandardId routes such as `/auth/callback/google` continue to function using this provider gem.
 
+### ENV fallback
+
+On `standard_id` 0.42+, a field you never assign falls back to the ENV
+variable named after it, upper-cased:
+
+| Field | ENV variable | Deprecated fallback |
+|---|---|---|
+| `google_client_id` | `GOOGLE_CLIENT_ID` | `GOOGLE_OAUTH_CLIENT_ID` |
+| `google_client_secret` | `GOOGLE_CLIENT_SECRET` | `GOOGLE_OAUTH_CLIENT_SECRET` |
+
+So with those variables set the block above is optional. Explicit
+configuration, even `nil`, always wins. The `GOOGLE_OAUTH_*` names — what
+install generators before 0.5.0 wrote — are still read when the canonical
+variable is unset and the field is never assigned, with a deprecation warning;
+rename them. (An initializer that assigns `ENV.fetch("GOOGLE_OAUTH_CLIENT_ID")`
+explicitly keeps working as-is.)
+
+### Required fields and the boot check
+
+`google_client_id` switches the provider on — it is what
+`StandardId.social_provider_enabled?(:google)` and the `google_enabled` Inertia
+prop report. While it is set, `google_client_secret` is required: the web
+sign-in's code exchange needs it, so without it the user authenticates with
+Google and only then does the callback fail. StandardId checks this once every
+plugin has registered:
+
+```ruby
+StandardId::Providers::Google.configuration_errors
+# => ["google_client_secret is required when google_client_id is set"]
+
+config.social.provider_misconfiguration = :raise # fail a production boot instead of warning
+```
+
+### Flows
+
+| Flow | Needs `google_client_secret` |
+|---|---|
+| Web (`/auth/callback/google`, authorization code) | yes |
+| Native `id_token` (`/api/oauth/callback/google`) | no |
+| Native `access_token` | no |
+
+ID tokens and access tokens are both checked against Google's tokeninfo
+endpoint (`https://oauth2.googleapis.com/tokeninfo`), then against this app's
+client ID. An app that only accepts native ID tokens can run without a client
+secret; it will get the boot warning above, because an enabled provider shows
+the web sign-in button — leave `provider_misconfiguration` at `:warn` there.
+
+### Boot ordering (standard_id <= 0.32.0)
+
+These fields are declared by *this gem*, not by `standard_id`, and until
+`standard_id` 0.33.0 they were declared from this gem's Railtie
+`after_initialize` — which runs *after* `config/initializers`. On `standard_id`
+**0.32.0 and earlier** the block above therefore raised:
+
+```
+StandardId::ConfigurationError: Unknown field 'google_client_id' for scope 'social'
+```
+
+The workaround was to wrap the writes:
+
+```ruby
+# Only needed on standard_id <= 0.32.0
+Rails.application.config.after_initialize do
+  StandardId.configure do |config|
+    config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
+    config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
+  end
+end
+```
+
+`standard_id` **>= 0.33.0** declares every loaded provider's fields before
+`:load_config_initializers`, so a plain initializer is correct. The wrapper is no
+longer needed and existing ones keep working unchanged.
+
+Note this is about *ordering*, not just versions: **the fields do not exist
+without this gem in your Gemfile**, on any `standard_id` version. Configuring
+`social.google_*` with the plugin absent raises the same error, correctly.
+
 ## Testing
 
+In a host app, pin the plugin's registration with standard_id's shared
+example:
+
+```ruby
+require "standard_id/testing"
+
+RSpec.describe "StandardId social providers" do
+  it_behaves_like "a registered StandardId provider", :google
+end
+```
+
 Run the provider test suite with:
 
 ```bash
@@ -53,4 +161,4 @@ To release a new version:
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](LICENSE.txt).
+The gem is available as open source under the terms of the [MIT License](LICENSE).

data/lib/generators/standard_id/google/install/install_generator.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module StandardId
+  module Google
+    module Generators
+      # Installs the Google provider's credentials block in a host Rails app.
+      #
+      # Writes `config/initializers/standard_id_google.rb` — a separate file
+      # from `config/initializers/standard_id.rb` on purpose. The provider is
+      # opt-in per app, so its credentials should be removable by deleting one
+      # file, and `standard_id`'s own install generator must stay free to
+      # overwrite its initializer without clobbering these values.
+      #
+      # Initializers load alphabetically, so `standard_id.rb` runs before
+      # `standard_id_google.rb` — the base configuration is already applied by
+      # the time this file sets the `social.google_*` fields.
+      #
+      # Idempotent: re-running skips an initializer that is already there.
+      # `--skip-initializer` opts out; `--force` overwrites.
+      class InstallGenerator < Rails::Generators::Base
+        source_root File.expand_path("templates", __dir__)
+
+        INITIALIZER_PATH = "config/initializers/standard_id_google.rb"
+
+        desc <<~DESC
+          Installs StandardId Google. This writes #{INITIALIZER_PATH} with the
+          social.google_* fields wired to ENV, and prints the env vars the host
+          needs to set.
+
+          The generator is idempotent — an existing initializer is skipped with
+          a clear message. Pass --force to overwrite.
+        DESC
+
+        class_option :skip_initializer, type: :boolean, default: false,
+          desc: "Do not write #{INITIALIZER_PATH}"
+        class_option :force, type: :boolean, default: false,
+          desc: "Overwrite #{INITIALIZER_PATH} if it already exists"
+
+        def copy_initializer
+          if options[:skip_initializer]
+            say_status("skip", "#{INITIALIZER_PATH} (--skip-initializer)", :yellow)
+            return
+          end
+
+          if File.exist?(File.join(destination_root, INITIALIZER_PATH)) && !options[:force]
+            say_status("identical", "#{INITIALIZER_PATH} (already exists; pass --force to overwrite)", :blue)
+            return
+          end
+
+          template "initializer.rb.erb", INITIALIZER_PATH, force: options[:force]
+        end
+
+        def print_env_hint
+          return if options[:skip_initializer]
+
+          say ""
+          say "=" * 79
+          say "StandardId Google installed."
+          say ""
+          say "Set these in the host's environment (1Password / DO app spec / .env):"
+          say ""
+          say "  GOOGLE_CLIENT_ID      the OAuth 2.0 Web application client ID"
+          say "  GOOGLE_CLIENT_SECRET  its client secret — required whenever GOOGLE_CLIENT_ID"
+          say "                        is set; StandardId checks for it at boot"
+          say ""
+          say "Register /auth/callback/google as an authorized redirect URI in the"
+          say "Google Cloud console for EVERY origin you serve — the console matches"
+          say "the redirect exactly, so staging and production each need their own."
+          say "=" * 79
+          say ""
+        end
+      end
+    end
+  end
+end

data/lib/generators/standard_id/google/install/templates/initializer.rb.erb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+# Google Sign In credentials for StandardId.
+#
+# These two fields are declared by the standard_id-google gem, NOT by
+# standard_id — they do not exist unless this gem is in the Gemfile, on any
+# standard_id version. Removing the gem and leaving this file behind raises
+# `StandardId::ConfigurationError: Unknown field 'google_client_id' for scope
+# 'social'`, which is correct behaviour, not a bug.
+#
+# Set them in the `social` scope, as below. The unqualified form
+# (`config.google_client_id = ...`) happens to work today because StandardId
+# routes a unique unqualified name to its owning scope, but it stops working
+# the day another scope declares a colliding name. Use `config.social.`.
+#
+# ENV: on standard_id >= 0.42 a field this file does not assign falls back to
+# the ENV variable named after it, upper-cased — GOOGLE_CLIENT_ID and
+# GOOGLE_CLIENT_SECRET — which are the names used below. The assignments are
+# kept so the wiring is visible; delete them to leave it to the fallback, or
+# point them at another source (e.g. Rails credentials). Installs before
+# standard_id-google 0.5.0 used GOOGLE_OAUTH_CLIENT_ID / _SECRET.
+#
+# google_client_id switches the provider on. While it is set, StandardId's boot
+# check requires google_client_secret, which the web sign-in's code exchange
+# needs (warns by default; `config.social.provider_misconfiguration = :raise`
+# fails a production boot instead). Native id_token / access_token sign-in
+# needs only the client ID.
+StandardId.configure do |config|
+  config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
+  config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
+end