standard_id-google 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f22ca920dcb306788b3588bf99ac704b9ce5e40cbb9c423a551e064ab6b236a9
-  data.tar.gz: f8492f9d9af4dbf74af4062524e0c217e20e50ec3420605a76d363154cacc2f5
+  metadata.gz: 459021f16aaa8a5fa33bfcf4e1cbf310d9fe2873a8e899db7934325f605869d8
+  data.tar.gz: 929ccecf7bf0e0e1dac6488582d2996c065fb089a75d59fbaae3bb8e79a3a0e1
 SHA512:
-  metadata.gz: 9b8d7e1bb7bdfa6302108521bf603a8727a61cd2a6893dcfd8ed230f9999697aa627f912b870528833f9b4781cbe1dbd868f761bdec013ae6cb7ff3a2f8af004
-  data.tar.gz: 53b44b47d85d30da76de8dbdf1f55953c3b3f4a31fb3808c769b8a72175210d8ac0fdbbbbbe0d52eb7e45817666d17edd5ce2947b1dfc16462d3f12d92226544
+  metadata.gz: d8e1379e1de46a1cd29ae97a5e44640132cfa4d7d4756249ff6b3ac67df7a3a1562c59cb72227d201d9d443124579f95028bd1326c9a88de05a289ddb5519cd8
+  data.tar.gz: 8229c09170a9f4b8a76d02fc4b262d0d1d63516a9db56597beb1a3e724713ee496e54cedf60ae1ce5859c6683d047cfe67153ed0a7fcbf9d12f584fc213b56c4

data/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-02
+
+Pairs with **standard_id 0.44.0** (security fix L1-01), which matches returning
+social logins on the provider's `sub` and links an existing account only when
+the provider reports `email_verified`.
+
+### Fixed
+
+- **The code-exchange and access-token paths now return `sub` and
+  `email_verified`.** They read Google's OAuth2 v2 userinfo endpoint, which
+  calls those claims `id` and `verified_email`, and returned its JSON as-is, so
+  standard_id never saw a subject for web (code) or native access-token
+  sign-ins. `fetch_user_info` now adds `sub` (from `id`) and `email_verified`
+  (from `verified_email`), keeping the original keys, and raises
+  `StandardId::InvalidRequestError` if the userinfo subject differs from the
+  `sub` tokeninfo reported for the access token. The ID-token path already
+  returned both claims (`email_verified` arrives there as the string `"true"`,
+  which standard_id 0.44 accepts).
+
+### Upgrade
+
+- Bump together with standard_id 0.44.0. On standard_id < 0.44 the extra keys
+  are ignored, so this release is also safe on its own.
+
+### Changed
+
+- **Requires Rails 8.1** (`activesupport >= 8.1`, was `>= 8.0`). Every
+  consumer app already runs 8.1; 8.0 was never exercised in CI.
+
 ## [0.5.0] - 2026-09-24
 
 Adopts the provider-plugin API of standard_id 0.42.

data/lib/standard_id/google/providers/google.rb

@@ -160,14 +160,14 @@ module StandardId
           rescue_to_oauth_error do
             raise StandardId::InvalidRequestError, "Google access token is missing" if access_token.blank?
 
-            verify_token(access_token)
+            token_info = verify_token(access_token)
             user_response = HttpClient.get_with_bearer(USERINFO_ENDPOINT, access_token)
 
             unless user_response.is_a?(Net::HTTPSuccess)
               raise StandardId::InvalidRequestError, "Failed to fetch Google user info: HTTP #{user_response.code}"
             end
 
-            JSON.parse(user_response.body)
+            with_oidc_claims(JSON.parse(user_response.body), token_info)
           end
         end
 
@@ -200,6 +200,28 @@ module StandardId
           token_info
         end
 
+        # The v2 userinfo endpoint names the subject `id` and the verified
+        # flag `verified_email`. standard_id (>= 0.44) matches returning
+        # logins on the OIDC `sub` and links existing accounts only on
+        # `email_verified`, so add both claims; the original keys are kept.
+        # The subject must agree with the one tokeninfo reported for the
+        # access token, when it reported one.
+        def with_oidc_claims(user_info, token_info)
+          return user_info unless user_info.is_a?(Hash)
+
+          claims = user_info.dup
+          claims["sub"] = claims["id"].to_s.presence if claims["sub"].blank?
+          claims["email_verified"] = claims["verified_email"] if !claims.key?("email_verified") && claims.key?("verified_email")
+          claims.compact!
+
+          token_sub = token_info.is_a?(Hash) ? token_info["sub"].to_s.presence : nil
+          if token_sub && claims["sub"] && token_sub != claims["sub"].to_s
+            raise StandardId::InvalidRequestError, "Google user info does not match the access token"
+          end
+
+          claims
+        end
+
         def error_reason(response)
           body = JSON.parse(response.body.to_s)
           reason = body["error"] if body.is_a?(Hash)

data/lib/standard_id/google/version.rb

@@ -2,6 +2,6 @@
 
 module StandardId
   module Google
-    VERSION = "0.5.0"
+    VERSION = "0.6.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id-google
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
 - !ruby/object:Gem::Dependency
   name: standard_id
   requirement: !ruby/object:Gem::Requirement
@@ -76,7 +76,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Google Sign In provider plugin for the StandardId engine.
 test_files: []