standard_id-oidc 0.6.0

data/app/models/standard_id/oidc/revoked_token.rb

@@ -0,0 +1,31 @@
+module StandardId
+  module Oidc
+    class RevokedToken < ApplicationRecord
+      self.table_name = "standard_id_revoked_tokens"
+
+      validates :jti, presence: true, uniqueness: true
+
+      scope :active, -> { where("expires_at > ?", Time.current) }
+
+      def self.revoke!(jti:, client_id: nil, token_type: nil, expires_at: nil)
+        create!(
+          jti: jti,
+          client_id: client_id,
+          token_type: token_type,
+          revoked_at: Time.current,
+          expires_at: expires_at || 1.day.from_now
+        )
+      rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+        # Token already revoked — idempotent
+      end
+
+      def self.revoked?(jti)
+        where(jti: jti).exists?
+      end
+
+      def self.cleanup_expired!
+        where("expires_at <= ?", Time.current).delete_all
+      end
+    end
+  end
+end

data/app/views/layouts/standard_id/oidc/application.html.erb

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Standard id provider</title>
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= yield :head %>
+
+  <%= stylesheet_link_tag    "standard_id/oidc/application", media: "all" %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/config/routes.rb

@@ -0,0 +1,15 @@
+StandardId::Oidc::Engine.routes.draw do
+  scope ".well-known" do
+    get "openid-configuration", to: "discovery#show", as: :openid_configuration
+  end
+
+  scope "api/provider" do
+    # NOTE: there is deliberately no `introspect` route here any more. Core's
+    # RFC 7662 endpoint (POST /oauth/introspect, gated on
+    # `config.oauth.introspection_enabled`) is the one endpoint, and this engine
+    # contributes its denylist into it — see
+    # StandardId::Oidc::Extensions::IntrospectionsControllerExt.
+    post "revoke", to: "revocation#create", as: :revoke
+    resource :consent, only: [ :show, :create, :destroy ], controller: :consent
+  end
+end

data/db/migrate/20260312000001_create_standard_id_consent_grants.rb

@@ -0,0 +1,19 @@
+class CreateStandardIdConsentGrants < ActiveRecord::Migration[8.0]
+  def change
+    create_table :standard_id_consent_grants do |t|
+      t.references :account, null: false
+      t.references :client_application, null: false
+      t.string :scopes, null: false
+      t.datetime :granted_at, null: false
+      t.datetime :revoked_at
+
+      t.timestamps
+    end
+
+    add_index :standard_id_consent_grants,
+      [ :account_id, :client_application_id ],
+      unique: true,
+      where: "revoked_at IS NULL",
+      name: "idx_consent_grants_active_unique"
+  end
+end

data/db/migrate/20260312000002_create_standard_id_revoked_tokens.rb

@@ -0,0 +1,16 @@
+class CreateStandardIdRevokedTokens < ActiveRecord::Migration[8.0]
+  def change
+    create_table :standard_id_revoked_tokens do |t|
+      t.string :jti, null: false
+      t.string :token_type
+      t.string :client_id
+      t.datetime :revoked_at, null: false
+      t.datetime :expires_at, null: false
+
+      t.timestamps
+    end
+
+    add_index :standard_id_revoked_tokens, :jti, unique: true
+    add_index :standard_id_revoked_tokens, :expires_at
+  end
+end

data/lib/generators/standard_id/oidc/install/install_generator.rb

@@ -0,0 +1,149 @@
+require "rails/generators"
+
+module StandardId
+  module Oidc
+    module Generators
+      # Installs StandardId::Oidc in a host Rails application.
+      #
+      # Three steps, each independently skippable:
+      #
+      #   * copies the engine's migrations into db/migrate/
+      #   * writes config/initializers/standard_id_oidc.rb
+      #   * mounts the engine in config/routes.rb
+      #
+      # Idempotent: re-running skips pieces that are already installed and says
+      # so. Pass `--skip-*` to opt out of individual steps and `--force` to
+      # overwrite an existing initializer.
+      class InstallGenerator < Rails::Generators::Base
+        source_root File.expand_path("templates", __dir__)
+
+        desc <<~DESC
+          Installs StandardId::Oidc. By default this:
+            * copies the engine's migrations into db/migrate/
+            * writes config/initializers/standard_id_oidc.rb
+            * mounts StandardId::Oidc::Engine in config/routes.rb
+
+          Use --skip-* flags to opt out of individual steps when re-running on
+          an existing install. The generator is idempotent — already-installed
+          pieces are skipped with a clear message. Pass --force to overwrite an
+          existing initializer.
+
+          Run `rails db:migrate` afterwards.
+        DESC
+
+        LEGACY_INITIALIZER = "config/initializers/standard_id_provider.rb"
+
+        class_option :skip_migrations, type: :boolean, default: false,
+          desc: "Do not copy the engine's migrations into db/migrate"
+        class_option :skip_initializer, type: :boolean, default: false,
+          desc: "Do not write config/initializers/standard_id_oidc.rb"
+        class_option :skip_routes, type: :boolean, default: false,
+          desc: "Do not mount StandardId::Oidc::Engine in config/routes.rb"
+        class_option :mount_path, type: :string, default: "/",
+          desc: "Path to mount StandardId::Oidc::Engine at"
+        class_option :force, type: :boolean, default: false,
+          desc: "Overwrite config/initializers/standard_id_oidc.rb if it already exists"
+
+        # Copies the engine's migrations with the same `.standard_id_oidc`
+        # suffix `rails standard_id_oidc:install:migrations` uses, so the
+        # two are interchangeable and neither double-installs the other's work.
+        # Done in-process rather than by shelling out to that rake task so the
+        # generator stays testable and does not need a booted host app.
+        # Migrations copied under the gem's former name (`.standard_id_provider`
+        # suffix) count as installed, so an upgraded host is not double-migrated.
+        def copy_migrations
+          if options[:skip_migrations]
+            say_status("skip", "db/migrate (--skip-migrations)", :yellow)
+            return
+          end
+
+          if existing_migrations.any?
+            say_status(
+              "identical",
+              "StandardId::Oidc migrations already present (#{existing_migrations.size}), skipping",
+              :blue
+            )
+            return
+          end
+
+          engine_migrations.each_with_index do |source, index|
+            name = File.basename(source, ".rb").sub(/\A\d+_/, "")
+            copy_file source, "db/migrate/#{migration_number(index)}_#{name}.standard_id_oidc.rb"
+          end
+        end
+
+        def copy_initializer
+          path = "config/initializers/standard_id_oidc.rb"
+
+          if options[:skip_initializer]
+            say_status("skip", "#{path} (--skip-initializer)", :yellow)
+            return
+          end
+
+          if File.exist?(File.join(destination_root, LEGACY_INITIALIZER)) && !options[:force]
+            say_status("identical", "#{LEGACY_INITIALIZER} (former name; rename it at your leisure)", :blue)
+            return
+          end
+
+          if File.exist?(File.join(destination_root, path)) && !options[:force]
+            say_status("identical", "#{path} (already exists; pass --force to overwrite)", :blue)
+            return
+          end
+
+          template "initializer.rb.erb", path, force: options[:force]
+        end
+
+        def mount_engine
+          routes_path = "config/routes.rb"
+
+          if options[:skip_routes]
+            say_status("skip", "#{routes_path} (--skip-routes)", :yellow)
+            return
+          end
+
+          unless File.exist?(File.join(destination_root, routes_path))
+            say_status("warn", "#{routes_path} not found; mount the engine yourself", :red)
+            return
+          end
+
+          # StandardId::Provider is an alias of StandardId::Oidc, so a legacy
+          # mount is the same engine; mounting it again would duplicate routes.
+          if File.read(File.join(destination_root, routes_path)).match?(/StandardId::(Oidc|Provider)::Engine/)
+            say_status("identical", "#{routes_path} (engine already mounted)", :blue)
+            return
+          end
+
+          route(%(mount StandardId::Oidc::Engine => "#{options[:mount_path]}"))
+        end
+
+        def print_next_steps
+          say ""
+          say "StandardId::Oidc installed. Next:", :green
+          say "  1. rails db:migrate"
+          say "  2. Set config.oauth.discovery_endpoint_base in your StandardId"
+          say "     initializer — this engine's discovery document cannot detect"
+          say "     the ApiEngine mount on its own. See the README."
+          say "  3. Set config.oauth.introspection_enabled = true if you want the"
+          say "     RFC 7662 endpoint (it is off by default in standard_id)."
+          say ""
+        end
+
+        no_commands do
+          def existing_migrations
+            Dir.glob(File.join(destination_root, "db/migrate/*.{standard_id_oidc,standard_id_provider}.rb"))
+          end
+
+          def engine_migrations
+            Dir.glob(File.expand_path("../../../../../db/migrate/*.rb", __dir__)).sort
+          end
+
+          # Migrations are ordered among themselves and must not collide, hence
+          # the index offset. `install:migrations` does the same thing.
+          def migration_number(index)
+            (Time.now.utc + index).strftime("%Y%m%d%H%M%S")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/generators/standard_id/oidc/install/templates/initializer.rb.erb

@@ -0,0 +1,56 @@
+# StandardId::Oidc — OpenID Connect Identity Provider addon for StandardId.
+#
+# This engine EXTENDS standard_id rather than standing alone: it prepends into
+# StandardId's OAuth flow classes and contributes its token denylist into
+# StandardId's introspection endpoint. Your `standard_id.rb` initializer is
+# still the primary configuration surface; the settings below are the ones this
+# engine adds, plus the two core settings a provider deployment must revisit.
+
+StandardId.configure do |c|
+  # --- Settings this engine adds -------------------------------------------
+
+  # Lifetime of issued ID tokens, in seconds.
+  # c.provider.id_token_lifetime = 3600
+
+  # Advertised in the discovery document. These describe what YOU are willing
+  # to issue — narrow them rather than widen them.
+  # c.provider.scopes_supported = %w[openid profile email offline_access]
+  # c.provider.claims_supported = %w[sub iss aud exp iat nonce auth_time at_hash email name email_verified]
+  # c.provider.subject_types_supported = %w[public]
+
+  # RFC 7009 token revocation at POST <provider mount>/api/provider/revoke.
+  # When false the endpoint renders 404, indistinguishable from one that does
+  # not exist. This is the endpoint that writes the RevokedToken denylist, so
+  # turning it off means access tokens cannot be revoked before their exp.
+  # c.provider.revocation_enabled = true
+
+  # --- Core settings a provider deployment must revisit --------------------
+
+  # REQUIRED for discovery. The issuer is a stable security identifier
+  # (RFC 8414 §2); clients match it byte-for-byte against their discovery URL
+  # and against the `iss` claim of issued tokens.
+  # c.issuer = "https://auth.example.com"
+
+  # REQUIRED for discovery, and easy to miss. This engine's discovery document
+  # is served from the PROVIDER engine's mount, so — unlike core's own
+  # well-known controllers — it cannot read the ApiEngine mount out of
+  # SCRIPT_NAME. Tell it where the endpoints actually live, or the document
+  # will advertise URLs that 404.
+  #
+  #   c.oauth.discovery_endpoint_base = ->(request:) { "#{request.base_url}/api" }
+  #   # or, for a fixed deployment:
+  #   c.oauth.discovery_endpoint_base = "https://auth.example.com/api"
+
+  # RFC 7662 introspection lives on CORE's endpoint (POST /oauth/introspect),
+  # which is OFF by default — it 404s until you opt in. This engine contributes
+  # its RevokedToken denylist into it, so a revoked access token introspects as
+  # inactive rather than staying active until its exp.
+  # c.oauth.introspection_enabled = true
+
+  # Members that cannot be derived — a host-owned authorization shim, a
+  # deliberately narrower scope list. Applied LAST, so they win over everything
+  # above. Setting `issuer` here raises; use c.issuer.
+  # c.oauth.discovery_metadata_overrides = {
+  #   authorization_endpoint: ->(ctx) { "#{ctx[:origin]}/oauth/authorize" }
+  # }
+end

data/lib/standard_id/oidc/config/schema.rb

@@ -0,0 +1,17 @@
+StandardId::ConfigSchema.define do
+  scope :provider do
+    field :id_token_lifetime, type: :integer, default: 3600
+    field :scopes_supported, type: :array, default: -> { %w[openid profile email offline_access] }
+    field :claims_supported, type: :array, default: -> { %w[sub iss aud exp iat nonce auth_time at_hash email name email_verified] }
+    field :subject_types_supported, type: :array, default: -> { %w[public] }
+    # NOTE: there is deliberately no `introspection_enabled` here any more.
+    # It was declared, documented as a switch, and never read by anything —
+    # the endpoint it claimed to gate was always on. Introspection is now
+    # core's endpoint, gated by `StandardId.config.oauth.introspection_enabled`
+    # (which defaults to FALSE — a provider deployment must opt in).
+    #
+    # `revocation_enabled` had the same defect and is now actually enforced by
+    # StandardId::Oidc::RevocationController.
+    field :revocation_enabled, type: :boolean, default: true
+  end
+end

data/lib/standard_id/oidc/engine.rb

@@ -0,0 +1,36 @@
+module StandardId
+  module Oidc
+    class Engine < ::Rails::Engine
+      isolate_namespace StandardId::Oidc
+
+      initializer "standard_id_oidc.extend_core" do
+        StandardId::Oauth::TokenGrantFlow.prepend(
+          StandardId::Oidc::Extensions::TokenGrantFlowExt
+        )
+
+        StandardId::Oauth::AuthorizationCodeAuthorizationFlow.prepend(
+          StandardId::Oidc::Extensions::AuthorizationFlowExt
+        )
+
+        StandardId::Oauth::Subflows::TraditionalCodeGrant.prepend(
+          StandardId::Oidc::Extensions::TraditionalCodeGrantExt
+        )
+
+        StandardId::Oauth::AuthorizationCodeFlow.prepend(
+          StandardId::Oidc::Extensions::AuthorizationCodeFlowExt
+        )
+      end
+
+      # Controllers are reloadable, so this cannot live in the initializer
+      # above: referencing the constant there would pin the boot-time class and
+      # every `reload!` in development would drop the extension. `to_prepare`
+      # runs on each reload, and `prepend` of an already-prepended module is a
+      # no-op, so re-running it is free.
+      config.to_prepare do
+        StandardId::Api::Oauth::IntrospectionsController.prepend(
+          StandardId::Oidc::Extensions::IntrospectionsControllerExt
+        )
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/extensions/authorization_code_flow_ext.rb

@@ -0,0 +1,13 @@
+module StandardId
+  module Oidc
+    module Extensions
+      module AuthorizationCodeFlowExt
+        private
+
+        def id_token_nonce
+          @authorization_code&.nonce
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/extensions/authorization_flow_ext.rb

@@ -0,0 +1,60 @@
+module StandardId
+  module Oidc
+    module Extensions
+      module AuthorizationFlowExt
+        private
+
+        def generate_authorization_response
+          if consent_required? && !consent_granted?
+            return redirect_to_consent
+          end
+
+          super
+        end
+
+        def common_subflow_params(flow_params)
+          super.merge(nonce: flow_params[:nonce])
+        end
+
+        def consent_required?
+          @client&.require_consent? && openid_scope_requested?
+        end
+
+        def openid_scope_requested?
+          scope.to_s.split(/\s+/).include?("openid")
+        end
+
+        def consent_granted?
+          return false unless current_account
+
+          grant = StandardId::Oidc::ConsentGrant.active
+            .find_by(account: current_account, client_application: @client)
+
+          return false unless grant
+
+          requested = scope.to_s.split(/\s+/).sort
+          granted = grant.scopes.to_s.split(/\s+/).sort
+          (requested - granted).empty?
+        end
+
+        def redirect_to_consent
+          consent_params = {
+            client_id: params[:client_id],
+            redirect_uri: redirect_uri,
+            scope: scope,
+            state: state,
+            audience: audience,
+            nonce: params[:nonce],
+            response_type: params[:response_type],
+            code_challenge: params[:code_challenge],
+            code_challenge_method: params[:code_challenge_method]
+          }.compact
+
+          consent_url = StandardId::Oidc::Engine.routes.url_helpers.consent_path(consent_params)
+
+          { redirect_to: consent_url, status: :found }
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/extensions/introspections_controller_ext.rb

@@ -0,0 +1,60 @@
+module StandardId
+  module Oidc
+    module Extensions
+      # Teaches core's RFC 7662 endpoint (`POST /oauth/introspect`,
+      # StandardId::Api::Oauth::IntrospectionsController) about this engine's
+      # access-token denylist.
+      #
+      # ## Why this replaced a second introspection endpoint
+      #
+      # This gem used to ship its own `POST /api/provider/introspect`. Since
+      # standard_id 0.33.0 core has one too, and core's is strictly more
+      # RFC-conformant:
+      #
+      #   * RFC 7662 §2.2 — every failure mode renders `{"active": false}` and
+      #     NOTHING else. The provider's raised InvalidClientError on bad client
+      #     credentials, answering 401 with an error body: a caller could tell
+      #     "your credentials are wrong" from "that token is not valid".
+      #   * The provider's rate limiter answered 429, which turns the throttle
+      #     into a token-validity oracle — probe until throttled, then read the
+      #     status code rather than the body. Core's renders the ordinary
+      #     inactive response instead, deliberately.
+      #   * Core's is 404-gated behind `config.oauth.introspection_enabled`, so
+      #     an endpoint that answers questions about other people's tokens is
+      #     not exposed by accident. The provider's was always on — and its own
+      #     `config.provider.introspection_enabled` flag was never read.
+      #
+      # Only one thing was worth keeping: core cannot see
+      # StandardId::Oidc::RevokedToken. Core says so itself — access tokens
+      # are stateless, "this engine cannot invalidate a stateless JWT before its
+      # exp". This engine's revocation endpoint maintains exactly the jti
+      # denylist that makes that possible. So rather than run two endpoints with
+      # different answers, the denylist is contributed INTO core's.
+      #
+      # ## Coupling
+      #
+      # `#decode_token` is a private method of a non-public controller. That is
+      # the same bargain the rest of this gem already makes (see
+      # StandardId::Oidc::Engine), and the reason the gemspec pins
+      # `standard_id` to `~> 0.33` with a `compat` CI job watching it.
+      #
+      # Returning nil is the whole mechanism: core already treats a nil decode
+      # as inactive and renders the bare `{"active": false}`, so a denylisted
+      # token is indistinguishable from a forged one — which is what RFC 7662
+      # §2.2 wants.
+      module IntrospectionsControllerExt
+        private
+
+        def decode_token(token)
+          payload = super
+          return nil if payload.nil?
+
+          jti = payload[:jti]
+          return nil if jti.present? && StandardId::Oidc::RevokedToken.revoked?(jti)
+
+          payload
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/extensions/token_grant_flow_ext.rb

@@ -0,0 +1,38 @@
+module StandardId
+  module Oidc
+    module Extensions
+      module TokenGrantFlowExt
+        private
+
+        def generate_token_response
+          response = super
+
+          if openid_scope_requested? && subject_id.present?
+            response[:id_token] = Oidc::IdTokenService.generate(
+              subject_id: subject_id,
+              client_id: client_id,
+              nonce: id_token_nonce,
+              access_token: response[:access_token],
+              auth_time: id_token_auth_time
+            )
+          end
+
+          response
+        end
+
+        def build_jwt_payload(expires_in)
+          payload = super
+          payload[:jti] = SecureRandom.uuid
+          payload
+        end
+
+        def openid_scope_requested?
+          current_scopes.include?("openid")
+        end
+
+        def id_token_nonce = nil
+        def id_token_auth_time = nil
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/extensions/traditional_code_grant_ext.rb

@@ -0,0 +1,24 @@
+module StandardId
+  module Oidc
+    module Extensions
+      module TraditionalCodeGrantExt
+        private
+
+        def store_authorization_code
+          StandardId::AuthorizationCode.issue!(
+            plaintext_code: authorization_code,
+            client_id: params[:client_id],
+            redirect_uri: params[:redirect_uri],
+            scope: params[:scope],
+            audience: params[:audience],
+            account: params[:current_account],
+            code_challenge: params[:code_challenge],
+            code_challenge_method: params[:code_challenge_method],
+            nonce: params[:nonce],
+            metadata: { state: params[:state] }.compact
+          )
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/id_token_service.rb

@@ -0,0 +1,40 @@
+module StandardId
+  module Oidc
+    class IdTokenService
+      class << self
+        def generate(subject_id:, client_id:, nonce: nil, access_token: nil, authorization_code: nil, auth_time: nil, extra_claims: {})
+          payload = {
+            sub: subject_id,
+            aud: client_id,
+            nonce: nonce,
+            auth_time: auth_time&.to_i
+          }.compact
+
+          payload[:at_hash] = compute_half_hash(access_token) if access_token.present?
+          payload[:c_hash] = compute_half_hash(authorization_code) if authorization_code.present?
+          payload.merge!(extra_claims.symbolize_keys) if extra_claims.present?
+
+          expires_in = StandardId.config.provider.id_token_lifetime.seconds
+
+          StandardId::JwtService.encode(payload, expires_in: expires_in)
+        end
+
+        private
+
+        def compute_half_hash(value)
+          digest = hash_algorithm.digest(value)
+          Base64.urlsafe_encode64(digest[0, digest.length / 2], padding: false)
+        end
+
+        def hash_algorithm
+          case StandardId::JwtService.algorithm
+          when /256$/ then OpenSSL::Digest::SHA256
+          when /384$/ then OpenSSL::Digest::SHA384
+          when /512$/ then OpenSSL::Digest::SHA512
+          else OpenSSL::Digest::SHA256
+          end
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/oidc/version.rb

@@ -0,0 +1,5 @@
+module StandardId
+  module Oidc
+    VERSION = "0.6.0"
+  end
+end

data/lib/standard_id/oidc.rb

@@ -0,0 +1,22 @@
+require "standard_id"
+
+require "standard_id/oidc/version"
+require "standard_id/oidc/config/schema"
+require "standard_id/oidc/id_token_service"
+require "standard_id/oidc/extensions/token_grant_flow_ext"
+require "standard_id/oidc/extensions/authorization_flow_ext"
+require "standard_id/oidc/extensions/traditional_code_grant_ext"
+require "standard_id/oidc/extensions/authorization_code_flow_ext"
+require "standard_id/oidc/extensions/introspections_controller_ext"
+require "standard_id/oidc/engine"
+
+module StandardId
+  module Oidc
+  end
+
+  # Former name (the gem was standard_id-provider). Kept so existing host code
+  # (`StandardId::Provider::Engine` in routes, `StandardId::Provider::ConsentGrant`)
+  # keeps loading; deprecated, and removed in a future minor release.
+  Provider = Oidc
+  deprecate_constant :Provider
+end

data/lib/standard_id/provider.rb

@@ -0,0 +1,10 @@
+# Compatibility shim for the gem's former name, standard_id-provider.
+#
+# `require "standard_id/provider"` keeps working. The `StandardId::Provider`
+# constant alias itself lives in standard_id/oidc.rb, so it is available however
+# the gem was loaded. Both are deprecated: use `require "standard_id/oidc"` and
+# `StandardId::Oidc`. This shim will be removed in a future minor release.
+warn "[standard_id-oidc] `require \"standard_id/provider\"` is deprecated; " \
+     "use `require \"standard_id/oidc\"` instead.", uplevel: 1, category: :deprecated
+
+require "standard_id/oidc"

data/lib/tasks/standard_id/oidc_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :standard_id_oidc do
+#   # Task goes here
+# end