standard_id-google 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 24f43e5bf2451f85eeefc67854060b443fe88781f76228eac4754dc8fcaf42c7
-  data.tar.gz: d17aa2f191d3616e3c17f838f2c4c0630c93c4e1afb8372d1f6fd311b61ccbf1
+  metadata.gz: 459021f16aaa8a5fa33bfcf4e1cbf310d9fe2873a8e899db7934325f605869d8
+  data.tar.gz: 929ccecf7bf0e0e1dac6488582d2996c065fb089a75d59fbaae3bb8e79a3a0e1
 SHA512:
-  metadata.gz: 361bd688a31baaf8bed7ec6a4adfd13c130f146af786ec20e00809be932ee304b9f27bd73890754053a972bad67e51e92dacd1dd6dfc8fe20e5b5c13800a10f8
-  data.tar.gz: 7dfbd6c33aa66ec005e29774a7b8419c68593d78c5959933b7ec8c71814dfe454f718e147a8714b32a6b51ce85f04d0cf8c163b0f69d1ae9d0bc636aa2cf4e8d
+  metadata.gz: d8e1379e1de46a1cd29ae97a5e44640132cfa4d7d4756249ff6b3ac67df7a3a1562c59cb72227d201d9d443124579f95028bd1326c9a88de05a289ddb5519cd8
+  data.tar.gz: 8229c09170a9f4b8a76d02fc4b262d0d1d63516a9db56597beb1a3e724713ee496e54cedf60ae1ce5859c6683d047cfe67153ed0a7fcbf9d12f584fc213b56c4

data/CHANGELOG.md

@@ -7,6 +7,129 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-02
+
+Pairs with **standard_id 0.44.0** (security fix L1-01), which matches returning
+social logins on the provider's `sub` and links an existing account only when
+the provider reports `email_verified`.
+
+### Fixed
+
+- **The code-exchange and access-token paths now return `sub` and
+  `email_verified`.** They read Google's OAuth2 v2 userinfo endpoint, which
+  calls those claims `id` and `verified_email`, and returned its JSON as-is, so
+  standard_id never saw a subject for web (code) or native access-token
+  sign-ins. `fetch_user_info` now adds `sub` (from `id`) and `email_verified`
+  (from `verified_email`), keeping the original keys, and raises
+  `StandardId::InvalidRequestError` if the userinfo subject differs from the
+  `sub` tokeninfo reported for the access token. The ID-token path already
+  returned both claims (`email_verified` arrives there as the string `"true"`,
+  which standard_id 0.44 accepts).
+
+### Upgrade
+
+- Bump together with standard_id 0.44.0. On standard_id < 0.44 the extra keys
+  are ignored, so this release is also safe on its own.
+
+### Changed
+
+- **Requires Rails 8.1** (`activesupport >= 8.1`, was `>= 8.0`). Every
+  consumer app already runs 8.1; 8.0 was never exercised in CI.
+
+## [0.5.0] - 2026-09-24
+
+Adopts the provider-plugin API of standard_id 0.42.
+
+### Upgrade
+
+- **Requires `standard_id` 0.42** (`~> 0.42`, was `>= 0.29, < 1.0`). Bump both
+  together.
+- **Rename `GOOGLE_OAUTH_CLIENT_ID` / `GOOGLE_OAUTH_CLIENT_SECRET` to
+  `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET`** when convenient. Initializers
+  from the 0.4.0 generator assign the old names explicitly and keep working
+  unchanged; the old names are also read as a deprecated ENV fallback (see
+  Deprecated). sidekick-web already uses the canonical names.
+- **Expect a boot warning if the secret is missing.** With `google_client_id`
+  set and `google_client_secret` blank, standard_id now logs a warning at boot
+  (raises in production under `c.social.provider_misconfiguration = :raise`).
+  An app that deliberately accepts only native ID tokens and has no secret
+  should keep that setting at `:warn`.
+- **Specs stubbing the tokeninfo call:** access-token verification now posts to
+  `TOKEN_INFO_ENDPOINT` (`https://oauth2.googleapis.com/tokeninfo`), not
+  `https://www.googleapis.com/oauth2/v3/tokeninfo`. ID-token stubs against
+  `TOKEN_INFO_ENDPOINT` (sidekick-web's `social_callback_spec.rb`) are
+  unaffected.
+- **Anyone rescuing on message text:** several messages changed (see Changed).
+  `StandardId::Google::Railtie` no longer exists.
+
+### Added
+
+- **Required config field.** `google_client_secret` is declared
+  `required: true`, so `StandardId::Providers::Google.configuration_errors` and
+  standard_id's boot check report it whenever `google_client_id` (the enabling
+  field) is set.
+- **ENV fallback** through standard_id 0.42: `GOOGLE_CLIENT_ID`,
+  `GOOGLE_CLIENT_SECRET`.
+- Specs for `resolve_params`, `skip_csrf?`, `supports_mobile_callback?` /
+  `flow_for`, nonce handling (web code exchange included) and configuration,
+  plus standard_id's `"a registered StandardId provider"` shared example.
+
+### Changed
+
+- **One tokeninfo endpoint.** ID tokens and access tokens are both verified
+  against `TOKEN_INFO_ENDPOINT`, `https://oauth2.googleapis.com/tokeninfo` —
+  the endpoint Google documents for both. Access tokens previously went to a
+  hard-coded `https://www.googleapis.com/oauth2/v3/tokeninfo`.
+- **The id_token and access_token flows no longer need `google_client_secret`.**
+  Both verify through tokeninfo and compare the audience to the client ID; only
+  the web code exchange sends the secret. Previously every flow raised
+  `Google provider is not configured` without it.
+- **Nonce mismatches no longer leak the nonce.** The message was
+  `ID token nonce mismatch. Expected: <nonce>, got: <nonce>`; it is now
+  standard_id's `ID token nonce mismatch`, and the comparison is constant-time.
+  The nonce is now checked after the audience and issuer.
+- **Audience and issuer errors no longer echo values** — the old messages
+  included this app's client ID and the presented `aud`/`iss`. A token with no
+  `aud` at all is rejected explicitly.
+- **The duplicated helpers are gone** in favour of standard_id's
+  `Providers::Base`: `rescue_to_oauth_error`, `verify_nonce!`,
+  `build_authorization_url`, `extract_tokens` (the private
+  `extract_token_payload` is removed). `lib/standard_id/google/railtie.rb` is
+  replaced by `StandardId::Providers.plugin_railtie(:google, ...)`.
+- **Error messages**, now consistently Google-prefixed:
+  - `Either code, id_token, or access_token must be provided` → `Google sign-in requires a code, an id_token or an access_token`
+  - `Google provider is not configured` → `Google OAuth is not configured` (client ID missing) or `Google OAuth credentials are incomplete: google_client_secret not set` (code exchange only)
+  - `Missing authorization code` → `Google authorization code is missing`
+  - `Failed to exchange Google authorization code` → `...: <error>` (Google's `error`, else `HTTP <status>`)
+  - `Google response missing access token` → `Google token response is missing access_token`
+  - `Missing id_token` → `Google id_token is missing`
+  - `Invalid or expired id_token` → `Invalid Google ID token: invalid or expired`
+  - `ID token audience mismatch. Expected: ..., got: ...` → `Invalid Google ID token audience`
+  - `ID token issuer invalid. Expected Google, got: ...` → `Invalid Google ID token issuer`
+  - `Missing access token` → `Google access token is missing`
+  - `Invalid or expired access token` → `Invalid Google access token: invalid or expired`
+  - `Access token audience mismatch. Expected: ..., got: ...` → `Invalid Google access token audience`
+  - `Failed to fetch Google user info` → `...: HTTP <status>`
+- **Spec layout mirrors `lib/`** and standard_id-apple:
+  `spec/standard_id/providers/google_spec.rb` →
+  `spec/standard_id/google/providers/google_spec.rb`, plus
+  `spec/standard_id/google/registration_spec.rb`.
+- Install generator and README use the canonical `GOOGLE_CLIENT_ID` /
+  `GOOGLE_CLIENT_SECRET`, and document the ENV fallback, required field and
+  flows.
+
+### Deprecated
+
+- **`GOOGLE_OAUTH_CLIENT_ID` / `GOOGLE_OAUTH_CLIENT_SECRET`** as ENV sources.
+  Read only when the field is never assigned and the canonical variable is
+  unset, with one warning per variable per process through
+  `StandardId.deprecator`.
+
+### Removed
+
+- `StandardId::Google::Railtie` (replaced by the Railtie `plugin_railtie`
+  defines, `StandardId::Providers::Railties::Google`).
+
 ## [0.4.0] - 2026-07-31
 
 ### Added

data/README.md

@@ -4,6 +4,8 @@ This gem extracts the Google OAuth provider from the core [`standard_id`](https:
 
 ## Installation
 
+Requires `standard_id` 0.42 or later.
+
 Add the gem next to `standard_id`:
 
 ```ruby
@@ -41,15 +43,62 @@ configuring by hand. Configure your Google credentials inside the StandardId
 configuration block:
 
 ```ruby
-# config/initializers/standard_id.rb
+# config/initializers/standard_id_google.rb
 StandardId.configure do |config|
-  config.social.google_client_id = ENV.fetch("GOOGLE_OAUTH_CLIENT_ID", nil)
-  config.social.google_client_secret = ENV.fetch("GOOGLE_OAUTH_CLIENT_SECRET", nil)
+  config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
+  config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
 end
 ```
 
 With those values in place, StandardId routes such as `/auth/callback/google` continue to function using this provider gem.
 
+### ENV fallback
+
+On `standard_id` 0.42+, a field you never assign falls back to the ENV
+variable named after it, upper-cased:
+
+| Field | ENV variable | Deprecated fallback |
+|---|---|---|
+| `google_client_id` | `GOOGLE_CLIENT_ID` | `GOOGLE_OAUTH_CLIENT_ID` |
+| `google_client_secret` | `GOOGLE_CLIENT_SECRET` | `GOOGLE_OAUTH_CLIENT_SECRET` |
+
+So with those variables set the block above is optional. Explicit
+configuration, even `nil`, always wins. The `GOOGLE_OAUTH_*` names — what
+install generators before 0.5.0 wrote — are still read when the canonical
+variable is unset and the field is never assigned, with a deprecation warning;
+rename them. (An initializer that assigns `ENV.fetch("GOOGLE_OAUTH_CLIENT_ID")`
+explicitly keeps working as-is.)
+
+### Required fields and the boot check
+
+`google_client_id` switches the provider on — it is what
+`StandardId.social_provider_enabled?(:google)` and the `google_enabled` Inertia
+prop report. While it is set, `google_client_secret` is required: the web
+sign-in's code exchange needs it, so without it the user authenticates with
+Google and only then does the callback fail. StandardId checks this once every
+plugin has registered:
+
+```ruby
+StandardId::Providers::Google.configuration_errors
+# => ["google_client_secret is required when google_client_id is set"]
+
+config.social.provider_misconfiguration = :raise # fail a production boot instead of warning
+```
+
+### Flows
+
+| Flow | Needs `google_client_secret` |
+|---|---|
+| Web (`/auth/callback/google`, authorization code) | yes |
+| Native `id_token` (`/api/oauth/callback/google`) | no |
+| Native `access_token` | no |
+
+ID tokens and access tokens are both checked against Google's tokeninfo
+endpoint (`https://oauth2.googleapis.com/tokeninfo`), then against this app's
+client ID. An app that only accepts native ID tokens can run without a client
+secret; it will get the boot warning above, because an enabled provider shows
+the web sign-in button — leave `provider_misconfiguration` at `:warn` there.
+
 ### Boot ordering (standard_id <= 0.32.0)
 
 These fields are declared by *this gem*, not by `standard_id`, and until
@@ -67,8 +116,8 @@ The workaround was to wrap the writes:
 # Only needed on standard_id <= 0.32.0
 Rails.application.config.after_initialize do
   StandardId.configure do |config|
-    config.social.google_client_id = ENV.fetch("GOOGLE_OAUTH_CLIENT_ID", nil)
-    config.social.google_client_secret = ENV.fetch("GOOGLE_OAUTH_CLIENT_SECRET", nil)
+    config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
+    config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
   end
 end
 ```
@@ -83,6 +132,17 @@ without this gem in your Gemfile**, on any `standard_id` version. Configuring
 
 ## Testing
 
+In a host app, pin the plugin's registration with standard_id's shared
+example:
+
+```ruby
+require "standard_id/testing"
+
+RSpec.describe "StandardId social providers" do
+  it_behaves_like "a registered StandardId provider", :google
+end
+```
+
 Run the provider test suite with:
 
 ```bash

data/lib/generators/standard_id/google/install/install_generator.rb

@@ -61,8 +61,9 @@ module StandardId
           say ""
           say "Set these in the host's environment (1Password / DO app spec / .env):"
           say ""
-          say "  GOOGLE_OAUTH_CLIENT_ID      the OAuth 2.0 Web application client ID"
-          say "  GOOGLE_OAUTH_CLIENT_SECRET  its client secret"
+          say "  GOOGLE_CLIENT_ID      the OAuth 2.0 Web application client ID"
+          say "  GOOGLE_CLIENT_SECRET  its client secret — required whenever GOOGLE_CLIENT_ID"
+          say "                        is set; StandardId checks for it at boot"
           say ""
           say "Register /auth/callback/google as an authorized redirect URI in the"
           say "Google Cloud console for EVERY origin you serve — the console matches"

data/lib/generators/standard_id/google/install/templates/initializer.rb.erb

@@ -13,18 +13,19 @@
 # routes a unique unqualified name to its owning scope, but it stops working
 # the day another scope declares a colliding name. Use `config.social.`.
 #
-# On standard_id <= 0.32.0 these fields were declared from this gem's Railtie
-# `after_initialize`, which runs AFTER config/initializers — so the plain block
-# below raised at boot and had to be wrapped:
+# ENV: on standard_id >= 0.42 a field this file does not assign falls back to
+# the ENV variable named after it, upper-cased — GOOGLE_CLIENT_ID and
+# GOOGLE_CLIENT_SECRET — which are the names used below. The assignments are
+# kept so the wiring is visible; delete them to leave it to the fallback, or
+# point them at another source (e.g. Rails credentials). Installs before
+# standard_id-google 0.5.0 used GOOGLE_OAUTH_CLIENT_ID / _SECRET.
 #
-#   Rails.application.config.after_initialize do
-#     StandardId.configure { |config| config.social.google_client_id = ... }
-#   end
-#
-# standard_id >= 0.33.0 declares every loaded provider's fields before
-# `:load_config_initializers`, so the plain form is correct. Existing wrappers
-# keep working and need no change.
+# google_client_id switches the provider on. While it is set, StandardId's boot
+# check requires google_client_secret, which the web sign-in's code exchange
+# needs (warns by default; `config.social.provider_misconfiguration = :raise`
+# fails a production boot instead). Native id_token / access_token sign-in
+# needs only the client ID.
 StandardId.configure do |config|
-  config.social.google_client_id = ENV.fetch("GOOGLE_OAUTH_CLIENT_ID", nil)
-  config.social.google_client_secret = ENV.fetch("GOOGLE_OAUTH_CLIENT_SECRET", nil)
+  config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
+  config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
 end

data/lib/standard_id/google/providers/google.rb

@@ -1,5 +1,5 @@
 require "json"
-require "uri"
+require "net/http"
 
 module StandardId
   module Providers
@@ -7,12 +7,26 @@ module StandardId
       AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth".freeze
       TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token".freeze
       USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v2/userinfo".freeze
+      # Google's documented tokeninfo endpoint, for both ID tokens and access
+      # tokens (developers.google.com/identity/sign-in/web/backend-auth,
+      # developers.google.com/identity/protocols/oauth2). The legacy
+      # www.googleapis.com/oauth2/v3/tokeninfo host is no longer used.
       TOKEN_INFO_ENDPOINT = "https://oauth2.googleapis.com/tokeninfo".freeze
+      VALID_ISSUERS = ["accounts.google.com", "https://accounts.google.com"].freeze
       DEFAULT_SCOPE = "openid email profile".freeze
       AUTHORIZATION_PARAM_DEFAULTS = {
         scope: DEFAULT_SCOPE
       }.freeze
 
+      # Pre-0.5.0 install generators wired the fields to these variables.
+      # Still read, with a deprecation warning, when the canonical variable
+      # (GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET) is unset and the host never
+      # assigns the field.
+      LEGACY_ENV = {
+        google_client_id: "GOOGLE_OAUTH_CLIENT_ID",
+        google_client_secret: "GOOGLE_OAUTH_CLIENT_SECRET"
+      }.freeze
+
       class << self
         def provider_name
           "google"
@@ -23,18 +37,12 @@ module StandardId
         end
 
         def authorization_url(state:, redirect_uri:, **options)
-          query = {
+          build_authorization_url(
+            endpoint: AUTH_ENDPOINT,
             client_id: credentials[:client_id],
-            redirect_uri: redirect_uri,
-            response_type: "code",
-            state: state
-          }
-
-          supported_authorization_params.each do |param|
-            query[param] = options[param] || AUTHORIZATION_PARAM_DEFAULTS[param]
-          end
-
-          "#{AUTH_ENDPOINT}?#{URI.encode_www_form(query.compact)}"
+            redirect_uri:, state:, options:,
+            defaults: AUTHORIZATION_PARAM_DEFAULTS
+          )
         end
 
         def get_user_info(code: nil, id_token: nil, access_token: nil, redirect_uri: nil, nonce: nil, **_options)
@@ -51,14 +59,25 @@ module StandardId
           elsif code.present?
             exchange_code_for_user_info(code: code, redirect_uri: redirect_uri, nonce: nonce)
           else
-            raise StandardId::InvalidRequestError, "Either code, id_token, or access_token must be provided"
+            raise StandardId::InvalidRequestError, "Google sign-in requires a code, an id_token or an access_token"
           end
         end
 
+        # `google_client_id` switches the provider on (it is the enabling
+        # field). `google_client_secret` is required while it is set: an
+        # enabled provider shows the web sign-in button, and the web flow's
+        # code exchange needs the secret — without it the user authenticates
+        # with Google and only then does the callback fail. The native
+        # id_token and access_token flows verify through Google's tokeninfo
+        # endpoint and need only the client ID.
+        #
+        # ENV fallbacks (standard_id >= 0.42): GOOGLE_CLIENT_ID and
+        # GOOGLE_CLIENT_SECRET; the pre-0.5.0 GOOGLE_OAUTH_* names are read as
+        # a deprecated fallback.
         def config_schema
           {
-            google_client_id: { type: :string, default: nil },
-            google_client_secret: { type: :string, default: nil }
+            google_client_id: { type: :string, default: -> { legacy_env(:google_client_id) } },
+            google_client_secret: { type: :string, default: -> { legacy_env(:google_client_secret) }, required: true }
           }
         end
 
@@ -67,139 +86,165 @@ module StandardId
         end
 
         def exchange_code_for_user_info(code:, redirect_uri:, nonce: nil)
-          raise StandardId::InvalidRequestError, "Missing authorization code" if code.blank?
+          rescue_to_oauth_error do
+            raise StandardId::InvalidRequestError, "Google authorization code is missing" if code.blank?
 
-          token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
-            client_id: credentials[:client_id],
-            client_secret: credentials[:client_secret],
-            code: code,
-            grant_type: "authorization_code",
-            redirect_uri: redirect_uri
-          }.compact)
-
-          unless token_response.is_a?(Net::HTTPSuccess)
-            raise StandardId::InvalidRequestError, "Failed to exchange Google authorization code"
-          end
+            creds = credentials
+            if creds[:client_secret].blank?
+              raise StandardId::InvalidRequestError, "Google OAuth credentials are incomplete: google_client_secret not set"
+            end
 
-          parsed_token = JSON.parse(token_response.body)
-          access_token = parsed_token["access_token"]
-          raise StandardId::InvalidRequestError, "Google response missing access token" if access_token.blank?
+            token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
+              client_id: creds[:client_id],
+              client_secret: creds[:client_secret],
+              code: code,
+              grant_type: "authorization_code",
+              redirect_uri: redirect_uri
+            }.compact)
 
-          # If we have an ID token in the response and a nonce was provided, verify it
-          if parsed_token["id_token"].present? && nonce.present?
-            verify_id_token(id_token: parsed_token["id_token"], nonce: nonce)
-          end
+            unless token_response.is_a?(Net::HTTPSuccess)
+              raise StandardId::InvalidRequestError,
+                    "Failed to exchange Google authorization code: #{error_reason(token_response)}"
+            end
 
-          tokens = extract_token_payload(parsed_token)
-          user_info = fetch_user_info(access_token: access_token)
+            parsed_token = JSON.parse(token_response.body)
+            access_token = parsed_token["access_token"]
+            raise StandardId::InvalidRequestError, "Google token response is missing access_token" if access_token.blank?
 
-          build_response(user_info, tokens: tokens)
-        rescue StandardError => e
-          raise e if e.is_a?(StandardId::OAuthError)
+            # Web flow with a server-generated nonce: check it on the ID token.
+            if parsed_token["id_token"].present? && nonce.present?
+              verify_id_token(id_token: parsed_token["id_token"], nonce: nonce)
+            end
 
-          raise StandardId::OAuthError, e.message, cause: e
+            build_response(fetch_user_info(access_token: access_token), tokens: extract_tokens(parsed_token))
+          end
         end
 
+        # Verifies through Google's tokeninfo endpoint, which checks the
+        # signature and expiry; the audience, issuer and nonce are checked
+        # here. Needs only the client ID.
         def verify_id_token(id_token:, nonce: nil)
-          raise StandardId::InvalidRequestError, "Missing id_token" if id_token.blank?
+          rescue_to_oauth_error do
+            raise StandardId::InvalidRequestError, "Google id_token is missing" if id_token.blank?
 
-          response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)
+            response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)
+            raise StandardId::InvalidRequestError, "Invalid Google ID token: invalid or expired" unless response.is_a?(Net::HTTPSuccess)
 
-          raise StandardId::InvalidRequestError, "Invalid or expired id_token" unless response.is_a?(Net::HTTPSuccess)
+            token_info = JSON.parse(response.body)
 
-          token_info = JSON.parse(response.body)
-
-          # Validate nonce if provided (web flow with server-generated nonce)
-          if nonce.present?
-            token_nonce = token_info["nonce"]
-            if token_nonce != nonce
-              raise StandardId::InvalidRequestError,
-                    "ID token nonce mismatch. Expected: #{nonce}, got: #{token_nonce}"
+            unless token_info["aud"].present? && token_info["aud"] == credentials[:client_id]
+              raise StandardId::InvalidRequestError, "Invalid Google ID token audience"
             end
-          end
 
-          unless token_info["aud"] == credentials[:client_id]
-            raise StandardId::InvalidRequestError,
-                  "ID token audience mismatch. Expected: #{credentials[:client_id]}, got: #{token_info["aud"]}"
-          end
+            unless VALID_ISSUERS.include?(token_info["iss"])
+              raise StandardId::InvalidRequestError, "Invalid Google ID token issuer"
+            end
 
-          unless ["accounts.google.com", "https://accounts.google.com"].include?(token_info["iss"])
-            raise StandardId::InvalidRequestError,
-                  "ID token issuer invalid. Expected Google, got: #{token_info["iss"]}"
+            # Constant-time, and the error never echoes either value.
+            verify_nonce!(expected: nonce, actual: token_info["nonce"])
+
+            {
+              "sub" => token_info["sub"],
+              "email" => token_info["email"],
+              "email_verified" => token_info["email_verified"],
+              "name" => token_info["name"],
+              "given_name" => token_info["given_name"],
+              "family_name" => token_info["family_name"],
+              "picture" => token_info["picture"],
+              "locale" => token_info["locale"]
+            }.compact
           end
-
-          {
-            "sub" => token_info["sub"],
-            "email" => token_info["email"],
-            "email_verified" => token_info["email_verified"],
-            "name" => token_info["name"],
-            "given_name" => token_info["given_name"],
-            "family_name" => token_info["family_name"],
-            "picture" => token_info["picture"],
-            "locale" => token_info["locale"]
-          }.compact
-        rescue StandardError => e
-          raise e if e.is_a?(StandardId::OAuthError)
-
-          raise StandardId::OAuthError, e.message, cause: e
         end
 
         def fetch_user_info(access_token:)
-          raise StandardId::InvalidRequestError, "Missing access token" if access_token.blank?
+          rescue_to_oauth_error do
+            raise StandardId::InvalidRequestError, "Google access token is missing" if access_token.blank?
 
-          verify_token(access_token)
-          user_response = HttpClient.get_with_bearer(USERINFO_ENDPOINT, access_token)
-
-          unless user_response.is_a?(Net::HTTPSuccess)
-            raise StandardId::InvalidRequestError, "Failed to fetch Google user info"
-          end
+            token_info = verify_token(access_token)
+            user_response = HttpClient.get_with_bearer(USERINFO_ENDPOINT, access_token)
 
-          JSON.parse(user_response.body)
-        rescue StandardError => e
-          raise e if e.is_a?(StandardId::OAuthError)
+            unless user_response.is_a?(Net::HTTPSuccess)
+              raise StandardId::InvalidRequestError, "Failed to fetch Google user info: HTTP #{user_response.code}"
+            end
 
-          raise StandardId::OAuthError, e.message, cause: e
+            with_oidc_claims(JSON.parse(user_response.body), token_info)
+          end
         end
 
         private
 
+        # The client ID every flow needs, and the secret only the code
+        # exchange needs (checked there). Raises when the provider is off.
         def credentials
           client_id = StandardId.config.google_client_id
-          client_secret = StandardId.config.google_client_secret
-
-          if client_id.blank? || client_secret.blank?
-            raise StandardId::InvalidRequestError, "Google provider is not configured"
-          end
+          raise StandardId::InvalidRequestError, "Google OAuth is not configured" if client_id.blank?
 
           {
             client_id: client_id,
-            client_secret: client_secret
+            client_secret: StandardId.config.google_client_secret
           }
         end
 
+        # Confirms an access token was issued to this app's client before its
+        # userinfo is trusted.
         def verify_token(access_token)
-          response = HttpClient.post_form("https://www.googleapis.com/oauth2/v3/tokeninfo", access_token: access_token)
-
-          unless response.is_a?(Net::HTTPSuccess)
-            raise StandardId::InvalidRequestError, "Invalid or expired access token"
-          end
+          response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, access_token: access_token)
+          raise StandardId::InvalidRequestError, "Invalid Google access token: invalid or expired" unless response.is_a?(Net::HTTPSuccess)
 
           token_info = JSON.parse(response.body)
 
-          unless token_info["aud"] == credentials[:client_id]
-            raise StandardId::InvalidRequestError,
-                  "Access token audience mismatch. Expected: #{credentials[:client_id]}, got: #{token_info["aud"]}"
+          unless token_info["aud"].present? && token_info["aud"] == credentials[:client_id]
+            raise StandardId::InvalidRequestError, "Invalid Google access token audience"
           end
 
           token_info
         end
 
-        def extract_token_payload(parsed_token)
-          {
-            access_token: parsed_token["access_token"],
-            refresh_token: parsed_token["refresh_token"],
-            id_token: parsed_token["id_token"]
-          }.compact
+        # The v2 userinfo endpoint names the subject `id` and the verified
+        # flag `verified_email`. standard_id (>= 0.44) matches returning
+        # logins on the OIDC `sub` and links existing accounts only on
+        # `email_verified`, so add both claims; the original keys are kept.
+        # The subject must agree with the one tokeninfo reported for the
+        # access token, when it reported one.
+        def with_oidc_claims(user_info, token_info)
+          return user_info unless user_info.is_a?(Hash)
+
+          claims = user_info.dup
+          claims["sub"] = claims["id"].to_s.presence if claims["sub"].blank?
+          claims["email_verified"] = claims["verified_email"] if !claims.key?("email_verified") && claims.key?("verified_email")
+          claims.compact!
+
+          token_sub = token_info.is_a?(Hash) ? token_info["sub"].to_s.presence : nil
+          if token_sub && claims["sub"] && token_sub != claims["sub"].to_s
+            raise StandardId::InvalidRequestError, "Google user info does not match the access token"
+          end
+
+          claims
+        end
+
+        def error_reason(response)
+          body = JSON.parse(response.body.to_s)
+          reason = body["error"] if body.is_a?(Hash)
+          reason.presence || "HTTP #{response.code}"
+        rescue JSON::ParserError
+          "HTTP #{response.code}"
+        end
+
+        def legacy_env(field)
+          name = LEGACY_ENV.fetch(field)
+          value = ENV[name]
+          return nil if value.blank?
+
+          # An unassigned field's default is re-evaluated on read; warn once.
+          @legacy_env_warned ||= {}
+          return value if @legacy_env_warned[name]
+
+          @legacy_env_warned[name] = true
+          StandardId.deprecator.warn(
+            "standard_id-google: reading #{field} from #{name} is deprecated. " \
+            "Rename the variable to #{field.to_s.upcase} (or assign config.social.#{field} explicitly)."
+          )
+          value
         end
       end
     end

data/lib/standard_id/google/version.rb

@@ -2,6 +2,6 @@
 
 module StandardId
   module Google
-    VERSION = "0.4.0"
+    VERSION = "0.6.0"
   end
 end

data/lib/standard_id/google.rb

@@ -1,5 +1,10 @@
 require "active_support/core_ext/numeric/time"
 require "active_support/core_ext/hash/indifferent_access"
 require "standard_id"
+require "standard_id/google/version"
 require "standard_id/google/providers/google"
-require "standard_id/google/railtie" if defined?(Rails)
+
+# Registers the provider from a Railtie's after_initialize (a no-op outside
+# Rails). Its config fields are declared earlier, before config/initializers,
+# by standard_id's own engine initializer.
+StandardId::Providers.plugin_railtie(:google, "StandardId::Providers::Google")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id-google
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -15,34 +15,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
 - !ruby/object:Gem::Dependency
   name: standard_id
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.29'
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '0.42'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.29'
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '0.42'
 description: Extracted StandardId::Providers::Google implementation packaged as a
   standalone gem so StandardId installations can opt into Sign in with Google independently.
 email:
@@ -59,7 +53,6 @@ files:
 - lib/generators/standard_id/google/install/templates/initializer.rb.erb
 - lib/standard_id/google.rb
 - lib/standard_id/google/providers/google.rb
-- lib/standard_id/google/railtie.rb
 - lib/standard_id/google/version.rb
 homepage: https://github.com/rarebit-one/standard_id_google
 licenses:
@@ -83,7 +76,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Google Sign In provider plugin for the StandardId engine.
 test_files: []

data/lib/standard_id/google/railtie.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-module StandardId
-  module Google
-    class Railtie < ::Rails::Railtie
-      config.after_initialize do
-        StandardId::ProviderRegistry.register(:google, StandardId::Providers::Google)
-
-        Rails.logger.debug("[StandardId::Google] registered provider") if Rails.logger
-      end
-    end
-  end
-end