standard_id-google 0.6.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 459021f16aaa8a5fa33bfcf4e1cbf310d9fe2873a8e899db7934325f605869d8
-  data.tar.gz: 929ccecf7bf0e0e1dac6488582d2996c065fb089a75d59fbaae3bb8e79a3a0e1
+  metadata.gz: 41656bb0ca1e58c41e45f5d1e293b9d6d172c83fa2aeb759be169c121ddb344d
+  data.tar.gz: fb852f913672f0ee5afd16927b5a4c5d36a4d6a46d81c39c17f89faed26edabb
 SHA512:
-  metadata.gz: d8e1379e1de46a1cd29ae97a5e44640132cfa4d7d4756249ff6b3ac67df7a3a1562c59cb72227d201d9d443124579f95028bd1326c9a88de05a289ddb5519cd8
-  data.tar.gz: 8229c09170a9f4b8a76d02fc4b262d0d1d63516a9db56597beb1a3e724713ee496e54cedf60ae1ce5859c6683d047cfe67153ed0a7fcbf9d12f584fc213b56c4
+  metadata.gz: 7d1182bfbb9b6fde3ffc787140920cef1c1fde07b4d3bf83ed9285101f061e66b3d7eb3793484b1e5e22aa932edf073412f957eb00371544146c9139876e413d
+  data.tar.gz: 5a60c09f63ca31495364b6d99904121e7424f3f82e49b1278f0e4640a82a41193971a2c7846f0a634d089092741d29f2db34f03697325460af1bb6c4706f673e

data/CHANGELOG.md

@@ -7,6 +7,68 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-10-26
+
+### Changed
+
+- **`verify_id_token` now verifies Google ID tokens locally (default: `:jwks`).**
+  Signatures are checked against Google's JWKS at
+  `https://www.googleapis.com/oauth2/v3/certs`, using RS256 only. The JWKS
+  response is cached in-process (TTL 3600 s) with a kid-miss refresh subject to
+  a 60 s minimum interval, mirroring the sibling `standard_id-apple` provider.
+  The token stays within the process after the initial key fetch: no token
+  material is sent to Google.
+  Claims verified locally: algorithm (RS256 only — `alg:none` and `alg:HS256`
+  are rejected), expiry (with 60 s clock-skew leeway), issuer (`accounts.google.com`
+  or `https://accounts.google.com`), audience (configured client ID), nonce
+  (timing-safe), and `hd` when `google_hosted_domains` is set.
+- **`jwt` gem added as a runtime dependency** (`>= 2.7, < 4`). It was already a
+  transitive dependency via `standard_id-apple` in most installations.
+
+### Deprecated
+
+- **`config.google_id_token_verification = :tokeninfo`** (new opt-in).
+  The pre-0.8.0 behaviour of POSTing the raw ID token to Google's tokeninfo
+  endpoint is available for one release as an explicit opt-in. Set
+  `config.social.google_id_token_verification = :tokeninfo` to keep the old
+  path. **The `:tokeninfo` fallback will be removed in 0.9.0.**
+
+### Upgrade
+
+- No action required for apps that do not set `google_id_token_verification`.
+  The JWKS path is a drop-in replacement: the same claims are returned in the
+  same shape.
+- Apps running in network-restricted environments that block outbound HTTPS to
+  `googleapis.com` should either open that connection or set `:tokeninfo` while
+  they plan the migration.
+
+## [0.7.0] - 2026-10-06
+
+### Added
+
+- **Pin sign-in to Google Workspace domains: `social.google_hosted_domains`.**
+  An array of domains (default empty: nothing changes). While set, every
+  Google login, on the web code flow and the native `id_token` flow alike,
+  must present a verified ID token whose `hd` claim equals one of them
+  (case-insensitive, exact: no subdomains), with `email_verified` true and an
+  email whose domain is that `hd`. Anything else, including consumer gmail
+  (which has no `hd`), is refused with `StandardId::InvalidRequestError`
+  before any account is touched. In the web flow the ID token is required and
+  decides identity; the access-token-only sign-in is refused while pinned
+  (it has no ID token to pin on). With exactly one domain, `hd` is also sent
+  as the account-chooser hint (a caller-supplied `hd` still wins).
+  **Security note:** pinning is enforced server-side on the verified ID
+  token; the `hd` URL parameter is only a hint and proves nothing.
+- **`trusted_for_linking?` is true while pinned** (standard_id >= 0.46), so a
+  Workspace login may link to the organisation's existing account for the same
+  address under `link_strategy: :strict`. Unpinned it stays false.
+- **`StandardId::Google.staff_policy`** (standard_id >= 0.45): a
+  `login_method_policy` that lets staff in only via Google with a pinned
+  domain, mirroring `StandardId::VoidWhichBinds.staff_policy` (`staff_predicate:`,
+  `fallback:`, `social.google_require_for_staff`, `social.google_staff_predicate`).
+  `StandardId::Google.any_of(*policies)` combines it with another staff policy.
+- `verify_id_token` now also returns the `hd` claim.
+
 ## [0.6.0] - 2026-10-02
 
 Pairs with **standard_id 0.44.0** (security fix L1-01), which matches returning

data/README.md

@@ -52,6 +52,59 @@ end
 
 With those values in place, StandardId routes such as `/auth/callback/google` continue to function using this provider gem.
 
+### Pin sign-in to a Google Workspace domain
+
+To make Google the organisation's own identity provider, pin it to the
+Workspace domain(s) your admins control:
+
+```ruby
+StandardId.configure do |config|
+  config.social.google_hosted_domains = ["example.com"]
+end
+```
+
+With the default (empty), nothing changes. While set, every Google login (web
+and native `id_token`) is refused unless the verified ID token has an `hd`
+claim exactly matching one of the domains (case-insensitive; no subdomains),
+`email_verified` is true, and the email's domain equals `hd`. Consumer Google
+accounts have no `hd`, so they are refused. The refusal is a
+`StandardId::InvalidRequestError` raised before any account is created or
+linked. While pinned the web flow requires the ID token and takes identity from
+it, and access-token-only sign-in is refused. With exactly one domain, `hd` is
+also sent as the account-chooser hint (pass your own `hd:` to override).
+
+**Security:** pinning is enforced server-side on the verified ID token, never on
+the `hd` URL parameter, which a user can edit away. Only trust it if the
+domains' Workspace admins are the people who may create addresses on them.
+
+**Linking.** While pinned, `trusted_for_linking?` is `true` (standard_id 0.46),
+so under `link_strategy: :strict` a Workspace login may link to an existing
+account with the same verified email. Core asks per provider class, not per
+login, which is safe here because core calls it only for a login whose
+`get_user_info` has just passed the pin; unpinned it is `false`, as for any
+public IdP.
+
+**Staff policy.** To require staff to use it (standard_id 0.45+):
+
+```ruby
+StandardId.configure do |config|
+  config.login_method_policy = StandardId::Google.staff_policy(
+    staff_predicate: ->(account) { account.staff? }
+  )
+end
+```
+
+Staff may sign in only with `auth_method: :social`, provider `google`, and only
+while `google_hosted_domains` is set; password, passwordless and remember-me
+(and refreshes of those) are refused, as in the void_which_binds policy.
+Non-staff are allowed everything, or go to `fallback:`. Without a predicate
+the policy raises (fails closed); `social.google_require_for_staff = false`
+switches it off. A host running both this and
+`StandardId::VoidWhichBinds.staff_policy` should combine them with
+`StandardId::Google.any_of(google_policy, void_which_binds_policy)`: staff are
+admitted by either method and refused otherwise (chaining with `fallback:`
+would lock staff out of the other method).
+
 ### ENV fallback
 
 On `standard_id` 0.42+, a field you never assign falls back to the ENV

data/lib/generators/standard_id/google/install/templates/initializer.rb.erb

@@ -28,4 +28,8 @@
 StandardId.configure do |config|
   config.social.google_client_id = ENV.fetch("GOOGLE_CLIENT_ID", nil)
   config.social.google_client_secret = ENV.fetch("GOOGLE_CLIENT_SECRET", nil)
+
+  # Optional: pin sign-in to your Google Workspace domain(s). Enforced on the
+  # verified ID token's `hd` claim (consumer gmail is refused); see the README.
+  # config.social.google_hosted_domains = ["example.com"]
 end

data/lib/standard_id/google/providers/google.rb

@@ -1,5 +1,7 @@
 require "json"
+require "jwt"
 require "net/http"
+require "openssl"
 
 module StandardId
   module Providers
@@ -12,12 +14,24 @@ module StandardId
       # developers.google.com/identity/protocols/oauth2). The legacy
       # www.googleapis.com/oauth2/v3/tokeninfo host is no longer used.
       TOKEN_INFO_ENDPOINT = "https://oauth2.googleapis.com/tokeninfo".freeze
+      # Google's JWKS endpoint for local ID token signature verification.
+      JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs".freeze
       VALID_ISSUERS = ["accounts.google.com", "https://accounts.google.com"].freeze
       DEFAULT_SCOPE = "openid email profile".freeze
       AUTHORIZATION_PARAM_DEFAULTS = {
         scope: DEFAULT_SCOPE
       }.freeze
 
+      # Google's signing keys rotate rarely; an unknown `kid` forces an early
+      # refetch (see #fetch_jwk), so a long TTL costs nothing on rotation.
+      JWKS_CACHE_TTL = 3600
+      # Floor between forced refetches, so a stream of ID tokens carrying
+      # made-up `kid`s cannot turn this process into a request amplifier
+      # against Google.
+      JWKS_MIN_REFRESH_INTERVAL = 60
+      # Accepted clock drift for exp/iat, matching the sibling Apple provider.
+      CLOCK_SKEW_SECONDS = 60
+
       # Pre-0.5.0 install generators wired the fields to these variables.
       # Still read, with a deprecation warning, when the canonical variable
       # (GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET) is unset and the host never
@@ -27,21 +41,56 @@ module StandardId
         google_client_secret: "GOOGLE_OAUTH_CLIENT_SECRET"
       }.freeze
 
+      @jwks_mutex = Mutex.new
+      @jwks_cache = nil
+
       class << self
         def provider_name
           "google"
         end
 
+        # The Google Workspace domains sign-in is pinned to
+        # (`social.google_hosted_domains`): lowercase, stripped, de-duplicated.
+        # Empty means the provider is not pinned and behaves as it always has.
+        def hosted_domains
+          raw = StandardId.config.google_hosted_domains
+          list = raw.is_a?(String) ? raw.split(/[\s,]+/) : Array(raw)
+          list.map { |domain| domain.to_s.strip.downcase }.reject(&:empty?).uniq
+        end
+
+        def pinned?
+          hosted_domains.any?
+        end
+
+        # True ONLY while sign-in is pinned to Workspace domains. Core calls
+        # this on the class, after get_user_info has returned for the very
+        # login being linked, so there is no per-login question to answer:
+        # while pinned, every login that gets that far presented a verified
+        # ID token whose `hd` is one of the configured domains and whose
+        # email is on that domain (see enforce_hosted_domain!), so the
+        # address is one the domain's Workspace admin provisioned. Unpinned,
+        # Google is a public IdP and must never be trusted for linking.
+        def trusted_for_linking?
+          pinned?
+        end
+
         def supported_authorization_params
           [:nonce, :login_hint, :prompt, :scope, :access_type, :hd, :response_mode, :include_granted_scopes]
         end
 
         def authorization_url(state:, redirect_uri:, **options)
+          # With exactly one pinned domain, `hd` is sent as Google's account
+          # chooser hint (a caller-supplied `hd` still wins). It is only a
+          # hint: pinning is enforced on the verified ID token, never on it.
+          defaults = AUTHORIZATION_PARAM_DEFAULTS
+          domains = hosted_domains
+          defaults = defaults.merge(hd: domains.first) if domains.one?
+
           build_authorization_url(
             endpoint: AUTH_ENDPOINT,
             client_id: credentials[:client_id],
             redirect_uri:, state:, options:,
-            defaults: AUTHORIZATION_PARAM_DEFAULTS
+            defaults: defaults
           )
         end
 
@@ -52,6 +101,13 @@ module StandardId
               tokens: { id_token: id_token }
             )
           elsif access_token.present?
+            # An access token carries no ID token, so there is no verified
+            # `hd` claim to pin on: refused rather than trusted.
+            if pinned?
+              raise StandardId::InvalidRequestError,
+                    "Google access-token sign-in is not available while google_hosted_domains is set"
+            end
+
             build_response(
               fetch_user_info(access_token: access_token),
               tokens: { access_token: access_token }
@@ -68,8 +124,8 @@ module StandardId
         # enabled provider shows the web sign-in button, and the web flow's
         # code exchange needs the secret — without it the user authenticates
         # with Google and only then does the callback fail. The native
-        # id_token and access_token flows verify through Google's tokeninfo
-        # endpoint and need only the client ID.
+        # id_token and access_token flows verify through Google's JWKS (or
+        # tokeninfo) and need only the client ID.
         #
         # ENV fallbacks (standard_id >= 0.42): GOOGLE_CLIENT_ID and
         # GOOGLE_CLIENT_SECRET; the pre-0.5.0 GOOGLE_OAUTH_* names are read as
@@ -77,7 +133,20 @@ module StandardId
         def config_schema
           {
             google_client_id: { type: :string, default: -> { legacy_env(:google_client_id) } },
-            google_client_secret: { type: :string, default: -> { legacy_env(:google_client_secret) }, required: true }
+            google_client_secret: { type: :string, default: -> { legacy_env(:google_client_secret) }, required: true },
+            # Workspace domains sign-in is pinned to; empty (default) = not pinned.
+            google_hosted_domains: { type: :any, default: -> { [] }, env: false },
+            # StandardId::Google.staff_policy settings.
+            google_require_for_staff: { type: :boolean, default: true },
+            google_staff_predicate: { type: :any, default: nil, env: false },
+            # ID token verification mode:
+            #   :jwks (default) — verify the signature locally against Google's
+            #     JWKS at #{JWKS_URI}. More reliable (no network round-trip for
+            #     every auth) and keeps the token within the process.
+            #   :tokeninfo — POST the raw token to Google's tokeninfo endpoint
+            #     (legacy behaviour, pre-0.8.0). Kept for one release as an
+            #     explicit opt-in. Will be removed in 0.9.0.
+            google_id_token_verification: { type: :string, default: "jwks", env: false }
           }
         end
 
@@ -111,6 +180,18 @@ module StandardId
             access_token = parsed_token["access_token"]
             raise StandardId::InvalidRequestError, "Google token response is missing access_token" if access_token.blank?
 
+            if pinned?
+              # Pinned: the ID token is required and decides identity; the
+              # userinfo only adds profile fields.
+              if parsed_token["id_token"].blank?
+                raise StandardId::InvalidRequestError, "Google token response is missing id_token"
+              end
+
+              id_claims = verify_id_token(id_token: parsed_token["id_token"], nonce: nonce)
+              user_info = pinned_user_info(fetch_user_info(access_token: access_token), id_claims)
+              return build_response(user_info, tokens: extract_tokens(parsed_token))
+            end
+
             # Web flow with a server-generated nonce: check it on the ID token.
             if parsed_token["id_token"].present? && nonce.present?
               verify_id_token(id_token: parsed_token["id_token"], nonce: nonce)
@@ -120,39 +201,27 @@ module StandardId
           end
         end
 
-        # Verifies through Google's tokeninfo endpoint, which checks the
-        # signature and expiry; the audience, issuer and nonce are checked
-        # here. Needs only the client ID.
+        # Verifies a Google ID token and returns its claims.
+        #
+        # Default mode (:jwks): verifies the signature locally against
+        # Google's JWKS, keeping the token within the process. Signature,
+        # algorithm (RS256 only), expiry, issuer and audience are all checked
+        # here; no network call is required after the keys are cached.
+        #
+        # Fallback mode (:tokeninfo): POSTs the raw token to Google's
+        # tokeninfo endpoint, which checks signature + expiry server-side;
+        # audience, issuer and nonce are checked here. Kept for one release as
+        # config.google_id_token_verification = :tokeninfo. Will be removed in
+        # 0.9.0.
         def verify_id_token(id_token:, nonce: nil)
           rescue_to_oauth_error do
             raise StandardId::InvalidRequestError, "Google id_token is missing" if id_token.blank?
 
-            response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)
-            raise StandardId::InvalidRequestError, "Invalid Google ID token: invalid or expired" unless response.is_a?(Net::HTTPSuccess)
-
-            token_info = JSON.parse(response.body)
-
-            unless token_info["aud"].present? && token_info["aud"] == credentials[:client_id]
-              raise StandardId::InvalidRequestError, "Invalid Google ID token audience"
-            end
-
-            unless VALID_ISSUERS.include?(token_info["iss"])
-              raise StandardId::InvalidRequestError, "Invalid Google ID token issuer"
+            if tokeninfo_verification?
+              verify_id_token_via_tokeninfo(id_token: id_token, nonce: nonce)
+            else
+              verify_id_token_via_jwks(id_token: id_token, nonce: nonce)
             end
-
-            # Constant-time, and the error never echoes either value.
-            verify_nonce!(expected: nonce, actual: token_info["nonce"])
-
-            {
-              "sub" => token_info["sub"],
-              "email" => token_info["email"],
-              "email_verified" => token_info["email_verified"],
-              "name" => token_info["name"],
-              "given_name" => token_info["given_name"],
-              "family_name" => token_info["family_name"],
-              "picture" => token_info["picture"],
-              "locale" => token_info["locale"]
-            }.compact
           end
         end
 
@@ -171,8 +240,183 @@ module StandardId
           end
         end
 
+        # Drop the in-process JWKS cache (tests, or after a known rotation).
+        def reset_jwks_cache!
+          @jwks_mutex.synchronize { @jwks_cache = nil }
+        end
+
         private
 
+        # True when the host has opted into the :tokeninfo fallback.
+        def tokeninfo_verification?
+          StandardId.config.google_id_token_verification.to_s == "tokeninfo"
+        end
+
+        # Local JWKS-based verification. RS256 only. The token never leaves
+        # the process after the keys are cached.
+        def verify_id_token_via_jwks(id_token:, nonce: nil)
+          _unverified_payload, header = JWT.decode(id_token, nil, false)
+          kid = header["kid"]
+          raise StandardId::InvalidRequestError, "Invalid Google ID token: header has no kid" if kid.blank?
+
+          jwk = fetch_jwk(kid: kid)
+          creds = credentials
+
+          # RS256 is the only algorithm Google uses for ID tokens. Enforcing
+          # it here blocks alg:none and alg:HS256 attacks even if the JWKS
+          # call is somehow poisoned.
+          verified_payload, = JWT.decode(
+            id_token,
+            jwk.public_key,
+            true,
+            algorithms: ["RS256"],
+            verify_expiration: true,
+            leeway: CLOCK_SKEW_SECONDS
+          )
+
+          # Issuer and audience are checked manually for robustness across
+          # JWT gem minor versions and to keep error messages consistent.
+          unless VALID_ISSUERS.include?(verified_payload["iss"])
+            raise StandardId::InvalidRequestError, "Invalid Google ID token issuer"
+          end
+
+          # Support the multiple-client-id case: if the config carries an
+          # array, any member may match.
+          allowed = Array(creds[:client_id])
+          unless allowed.include?(verified_payload["aud"])
+            raise StandardId::InvalidRequestError, "Invalid Google ID token audience"
+          end
+
+          # Constant-time, and the error never echoes either value.
+          verify_nonce!(expected: nonce, actual: verified_payload["nonce"])
+
+          enforce_hosted_domain!(verified_payload) if pinned?
+
+          extract_id_token_claims(verified_payload)
+        rescue JWT::DecodeError => e
+          raise StandardId::InvalidRequestError, "Invalid Google ID token: #{e.message}"
+        end
+
+        # Legacy tokeninfo path. Kept as an explicit opt-in for one release.
+        # Deprecated: will be removed in 0.9.0.
+        def verify_id_token_via_tokeninfo(id_token:, nonce: nil)
+          response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)
+          raise StandardId::InvalidRequestError, "Invalid Google ID token: invalid or expired" unless response.is_a?(Net::HTTPSuccess)
+
+          token_info = JSON.parse(response.body)
+
+          unless token_info["aud"].present? && token_info["aud"] == credentials[:client_id]
+            raise StandardId::InvalidRequestError, "Invalid Google ID token audience"
+          end
+
+          unless VALID_ISSUERS.include?(token_info["iss"])
+            raise StandardId::InvalidRequestError, "Invalid Google ID token issuer"
+          end
+
+          # Constant-time, and the error never echoes either value.
+          verify_nonce!(expected: nonce, actual: token_info["nonce"])
+
+          enforce_hosted_domain!(token_info) if pinned?
+
+          extract_id_token_claims(token_info)
+        end
+
+        # Pull the canonical set of ID token claims from a verified payload.
+        def extract_id_token_claims(claims)
+          {
+            "hd" => claims["hd"],
+            "sub" => claims["sub"],
+            "email" => claims["email"],
+            "email_verified" => claims["email_verified"],
+            "name" => claims["name"],
+            "given_name" => claims["given_name"],
+            "family_name" => claims["family_name"],
+            "picture" => claims["picture"],
+            "locale" => claims["locale"]
+          }.compact
+        end
+
+        # Look `kid` up in Google's JWKS, served from an in-process cache
+        # (JWKS_CACHE_TTL). An unknown `kid` refetches once — Google may have
+        # rotated — subject to JWKS_MIN_REFRESH_INTERVAL.
+        def fetch_jwk(kid:)
+          jwk_data = find_jwk(jwks_keys, kid) || find_jwk(jwks_keys(refresh: true), kid)
+          raise StandardId::InvalidRequestError, "Invalid Google ID token: signing key not found in Google's JWKS" unless jwk_data
+
+          JWT::JWK.import(jwk_data)
+        end
+
+        def find_jwk(keys, kid)
+          keys.find { |key| key["kid"] == kid }
+        end
+
+        def jwks_keys(refresh: false)
+          @jwks_mutex.synchronize do
+            now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            cache = @jwks_cache
+
+            stale = cache.nil? || now - cache[:fetched_at] > JWKS_CACHE_TTL
+            forced = refresh && cache && now - cache[:fetched_at] >= JWKS_MIN_REFRESH_INTERVAL
+            if stale || forced
+              @jwks_cache = cache = { keys: download_jwks, fetched_at: now }
+            end
+
+            cache[:keys]
+          end
+        end
+
+        # Fetched through StandardId::HttpClient's connection setup, so the
+        # request gets its timeouts and its private/internal-address guard.
+        # HttpClient has no public plain GET (only get_with_bearer, which would
+        # send an empty Authorization header), hence the two private calls.
+        def download_jwks
+          rescue_to_oauth_error("Failed to fetch Google JWKS") do
+            uri, resolved_ip = HttpClient.send(:validate_url!, JWKS_URI)
+            response = HttpClient.send(:start_connection, uri, resolved_ip: resolved_ip) do |http|
+              http.request(Net::HTTP::Get.new(uri))
+            end
+            raise StandardId::OAuthError, "Failed to fetch Google JWKS: HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+
+            keys = JSON.parse(response.body)["keys"]
+            raise StandardId::OAuthError, "Failed to fetch Google JWKS: response has no keys" unless keys.is_a?(Array)
+
+            keys
+          end
+        end
+
+        # Pins sign-in to the configured Workspace domains, on the claims of
+        # a verified ID token: `hd` must be one of them (an exact,
+        # case-insensitive match; consumer accounts have no `hd`), the email
+        # must be verified, and its domain must equal `hd`. Messages never
+        # echo the claims.
+        def enforce_hosted_domain!(claims)
+          hd = claims["hd"]
+          hd = hd.is_a?(String) ? hd.strip.downcase : nil
+          unless hd.present? && hosted_domains.include?(hd)
+            raise StandardId::InvalidRequestError, "Google account is not in an allowed Workspace domain"
+          end
+
+          unless [true, "true"].include?(claims["email_verified"])
+            raise StandardId::InvalidRequestError, "Google account email is not verified"
+          end
+
+          email = claims["email"]
+          local, separator, domain = email.is_a?(String) ? email.strip.rpartition("@") : []
+          unless separator == "@" && local.present? && !local.include?("@") && domain.downcase == hd
+            raise StandardId::InvalidRequestError, "Google account email is not on its Workspace domain"
+          end
+        end
+
+        # Web flow, pinned: identity comes from the verified ID token. The
+        # userinfo must agree on the subject, and its profile fields are kept.
+        def pinned_user_info(userinfo, id_claims)
+          unless userinfo.is_a?(Hash) && userinfo["sub"].to_s == id_claims["sub"].to_s && id_claims["sub"].present?
+            raise StandardId::InvalidRequestError, "Google user info does not match the ID token"
+          end
+
+          userinfo.merge(id_claims.slice("sub", "email", "email_verified", "hd"))
+        end
+
         # The client ID every flow needs, and the secret only the code
         # exchange needs (checked there). Raises when the provider is off.
         def credentials

data/lib/standard_id/google/staff_policy.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module StandardId
+  module Google
+    # A `login_method_policy` (standard_id >= 0.45) that refuses every way into
+    # a staff account except a Google sign-in pinned to the organisation's
+    # Workspace domain(s), so removing someone from the Workspace removes their
+    # way into the app:
+    #
+    #   StandardId.configure do |c|
+    #     c.social.google_hosted_domains = ["example.com"]
+    #     c.login_method_policy = StandardId::Google.staff_policy(
+    #       staff_predicate: ->(account) { account.staff? }
+    #     )
+    #   end
+    #
+    # standard_id consults it before any session or token exists, in every flow
+    # (web password, passwordless, remember-me, other social providers, the
+    # OAuth grants, and each refresh with the original sign-in's method).
+    # Remember-me re-authentication is therefore refused for staff, exactly as
+    # the void_which_binds policy does: staff sign in again with Google.
+    # Non-staff accounts pass through to `fallback`, if given (another policy
+    # with the same keyword contract), and are otherwise allowed.
+    #
+    # Enforced while `social.google_require_for_staff` is true (the default).
+    # `staff_predicate` falls back to `social.google_staff_predicate`; with
+    # neither, every decision fails closed (raises). A staff Google login is
+    # admitted only while `google_hosted_domains` is non-empty: an unpinned
+    # Google sign-in proves nothing about the organisation, so it is refused.
+    class StaffPolicy
+      MESSAGE = "Staff accounts must sign in with the organisation's Google Workspace account"
+
+      attr_reader :staff_predicate
+
+      def initialize(staff_predicate: nil, fallback: nil)
+        @staff_predicate = staff_predicate
+        @fallback = fallback
+      end
+
+      def call(account:, auth_method:, provider:, request: nil, flow: nil)
+        if require_for_staff? && staff?(account)
+          raise StandardId::LoginMethodDenied, MESSAGE unless pinned_google?(auth_method, provider)
+
+          return true
+        end
+        return true if @fallback.nil?
+
+        context = { account:, auth_method:, provider:, request:, flow: }
+        @fallback.call(**StandardId::Utils::CallableParameterFilter.filter(@fallback, context))
+      end
+
+      def staff?(account)
+        predicate = @staff_predicate || StandardId.config.google_staff_predicate
+        unless predicate.respond_to?(:call)
+          raise StandardId::ConfigurationError, "StandardId::Google.staff_policy needs a staff_predicate (or social.google_staff_predicate)"
+        end
+
+        account.present? && predicate.call(account) ? true : false
+      end
+
+      private
+
+      def require_for_staff?
+        StandardId.config.google_require_for_staff == true
+      end
+
+      def pinned_google?(auth_method, provider)
+        auth_method&.to_sym == :social &&
+          provider.to_s == StandardId::Providers::Google.provider_name &&
+          StandardId::Providers::Google.pinned?
+      end
+    end
+
+    # Combines login_method_policies for a host that runs more than one staff
+    # policy (for example this one and StandardId::VoidWhichBinds.staff_policy).
+    # Each of those admits a staff account by ITS method and refuses the rest,
+    # so chaining them with `fallback:` would lock staff out of the other's
+    # method. any_of admits when ANY policy allows, and refuses (with the first
+    # refusal's message) only when all do. Non-staff pass every such policy.
+    # A policy that raises anything but LoginMethodDenied (a missing predicate,
+    # a bug) propagates: the request fails closed.
+    class AnyOfPolicy
+      def initialize(policies)
+        @policies = policies
+        raise ArgumentError, "any_of needs at least one policy" if @policies.empty?
+      end
+
+      def call(**context)
+        denial = nil
+        @policies.each do |policy|
+          allowed = policy.call(**StandardId::Utils::CallableParameterFilter.filter(policy, context))
+          return true if allowed
+          denial ||= StandardId::LoginMethodDenied.new
+        rescue StandardId::LoginMethodDenied => e
+          denial ||= e
+        end
+        raise denial
+      end
+    end
+
+    def self.staff_policy(staff_predicate: nil, fallback: nil)
+      StaffPolicy.new(staff_predicate: staff_predicate, fallback: fallback)
+    end
+
+    def self.any_of(*policies)
+      AnyOfPolicy.new(policies.flatten)
+    end
+  end
+end

data/lib/standard_id/google/version.rb

@@ -2,6 +2,6 @@
 
 module StandardId
   module Google
-    VERSION = "0.6.0"
+    VERSION = "0.8.0"
   end
 end

data/lib/standard_id/google.rb

@@ -3,6 +3,7 @@ require "active_support/core_ext/hash/indifferent_access"
 require "standard_id"
 require "standard_id/google/version"
 require "standard_id/google/providers/google"
+require "standard_id/google/staff_policy"
 
 # Registers the provider from a Railtie's after_initialize (a no-op outside
 # Rails). Its config fields are declared earlier, before config/initializers,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id-google
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -23,6 +23,26 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '8.1'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: standard_id
   requirement: !ruby/object:Gem::Requirement
@@ -53,6 +73,7 @@ files:
 - lib/generators/standard_id/google/install/templates/initializer.rb.erb
 - lib/standard_id/google.rb
 - lib/standard_id/google/providers/google.rb
+- lib/standard_id/google/staff_policy.rb
 - lib/standard_id/google/version.rb
 homepage: https://github.com/rarebit-one/standard_id_google
 licenses: