standard_id-provider 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 7277bed83877f6bf4d594edaf754208a194edc113b166428005491855f5c4e94
+  data.tar.gz: 6bb65c12882616a7b5116e56d82b6aae805ffcce9e021621f2572a00f4c4f4a3
+SHA512:
+  metadata.gz: f1648a8f251196809c60e44ab87dc8611e943f73c27e5430b70660c65af010eb523ac8dcce958ec992786e3784e571a67b49dc057ed1475079d8fd635d5410c1
+  data.tar.gz: 5ee6aaf6993590ddbf1c2139c26d11c079d0b3aee394cf38c48fe05b5cebaf85e36bbbefed4b8e641e9cfc63d657b66349e0442904b08db3ab95519d9566ac89

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) Jaryl Sim
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,28 @@
+# StandardId::Provider
+Short description and motivation.
+
+## Usage
+How to use my plugin.
+
+## Installation
+Add this line to your application's Gemfile:
+
+```ruby
+gem "standard_id-provider"
+```
+
+And then execute:
+```bash
+$ bundle
+```
+
+Or install it yourself as:
+```bash
+$ gem install standard_id-provider
+```
+
+## Contributing
+Contribution directions go here.
+
+## License
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/setup"
+
+APP_RAKEFILE = File.expand_path("spec/dummy/Rakefile", __dir__)
+load "rails/tasks/engine.rake"
+
+require "bundler/gem_tasks"

data/app/assets/stylesheets/standard_id/provider/application.css

@@ -0,0 +1,15 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the bottom of the
+ * compiled file so the styles you add here take precedence over styles defined in any other CSS/SCSS
+ * files in this directory. Styles in this file should be added after the last require_* statement.
+ * It is generally better to create a new file per style scope.
+ *
+ *= require_tree .
+ *= require_self
+ */

data/app/controllers/standard_id/provider/application_controller.rb

@@ -0,0 +1,40 @@
+module StandardId
+  module Provider
+    class ApplicationController < ActionController::API
+      rescue_from StandardId::OAuthError do |e|
+        render json: { error: e.oauth_error_code, error_description: e.message }, status: e.http_status
+      end
+
+      private
+
+      def authenticate_client!
+        extract_client_credentials_from_basic_auth
+
+        @client_credential = StandardId::ClientSecretCredential.active.find_by(client_id: params[:client_id])
+
+        unless @client_credential&.authenticate_client_secret(params[:client_secret])
+          raise StandardId::InvalidClientError, "Client authentication failed"
+        end
+
+        @client_credential
+      end
+
+      def extract_client_credentials_from_basic_auth
+        auth_header = request.headers["Authorization"]
+        return unless auth_header&.start_with?("Basic ")
+
+        if params[:client_id].present? || params[:client_secret].present?
+          raise StandardId::InvalidRequestError,
+            "Client credentials must be sent via Authorization header OR request body, not both"
+        end
+
+        decoded = Base64.strict_decode64(auth_header.split(" ", 2).last)
+        client_id, client_secret = decoded.split(":", 2)
+        params[:client_id] = CGI.unescape(client_id)
+        params[:client_secret] = CGI.unescape(client_secret)
+      rescue ArgumentError
+        raise StandardId::InvalidClientError, "Invalid Basic authentication encoding"
+      end
+    end
+  end
+end

data/app/controllers/standard_id/provider/consent_controller.rb

@@ -0,0 +1,91 @@
+module StandardId
+  module Provider
+    class ConsentController < ApplicationController
+      include ActionController::Cookies
+
+      before_action :require_authentication
+      before_action :load_client
+
+      def show
+        render json: {
+          client: { name: @client.name, description: @client.description },
+          scopes: requested_scopes,
+          authorization_params: authorization_params
+        }
+      end
+
+      def create
+        ConsentGrant.grant!(
+          account: current_account,
+          client_application: @client,
+          scopes: authorization_params[:scope]
+        )
+
+        authorize_url = build_authorize_redirect
+        redirect_to authorize_url, allow_other_host: true, status: :found
+      end
+
+      def destroy
+        redirect_uri = authorization_params[:redirect_uri]
+
+        if redirect_uri.present?
+          deny_url = build_error_redirect(redirect_uri, "access_denied", "The user denied the consent request")
+          redirect_to deny_url, allow_other_host: true, status: :found
+        else
+          render json: { error: "access_denied", error_description: "The user denied the consent request" }, status: :forbidden
+        end
+      end
+
+      private
+
+      def require_authentication
+        return if current_account.present?
+
+        render json: { error: "login_required", error_description: "Authentication is required" }, status: :unauthorized
+      end
+
+      def current_account
+        @current_account ||= begin
+          token_manager = StandardId::Web::TokenManager.new(request)
+          session_manager = StandardId::Web::SessionManager.new(token_manager, request: request, session: session, cookies: cookies)
+          session_manager.current_account
+        end
+      end
+
+      def load_client
+        @client = StandardId::ClientApplication.active.find_by(client_id: authorization_params[:client_id])
+
+        unless @client
+          raise StandardId::InvalidClientError, "Invalid client_id"
+        end
+      end
+
+      def authorization_params
+        @authorization_params ||= params.permit(
+          :client_id, :redirect_uri, :scope, :state, :audience,
+          :nonce, :response_type, :code_challenge, :code_challenge_method
+        ).to_h.symbolize_keys
+      end
+
+      def requested_scopes
+        authorization_params[:scope].to_s.split(/\s+/)
+      end
+
+      def build_authorize_redirect
+        uri = URI.parse("#{StandardId.config.issuer}/api/authorize")
+        uri.query = URI.encode_www_form(authorization_params.compact)
+        uri.to_s
+      end
+
+      def build_error_redirect(redirect_uri, error, description)
+        uri = URI.parse(redirect_uri)
+        query = URI.decode_www_form(uri.query || "")
+        query << [ "error", error ]
+        query << [ "error_description", description ]
+        query << [ "state", authorization_params[:state] ] if authorization_params[:state].present?
+        uri.query = URI.encode_www_form(query)
+        uri.to_s
+      end
+    end
+  end
+end

data/app/controllers/standard_id/provider/discovery_controller.rb

@@ -0,0 +1,34 @@
+module StandardId
+  module Provider
+    class DiscoveryController < ApplicationController
+      def show
+        render json: openid_configuration
+      end
+
+      private
+
+      def openid_configuration
+        issuer = StandardId.config.issuer
+        provider_config = StandardId.config.provider
+
+        {
+          issuer: issuer,
+          authorization_endpoint: "#{issuer}/api/authorize",
+          token_endpoint: "#{issuer}/api/oauth/token",
+          userinfo_endpoint: "#{issuer}/api/userinfo",
+          jwks_uri: "#{issuer}/api/.well-known/jwks.json",
+          introspection_endpoint: "#{issuer}/api/provider/introspect",
+          revocation_endpoint: "#{issuer}/api/provider/revoke",
+          scopes_supported: provider_config.scopes_supported,
+          response_types_supported: %w[code token],
+          grant_types_supported: %w[authorization_code client_credentials refresh_token],
+          subject_types_supported: provider_config.subject_types_supported,
+          id_token_signing_alg_values_supported: [ StandardId::JwtService.algorithm ],
+          token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post],
+          claims_supported: provider_config.claims_supported,
+          code_challenge_methods_supported: %w[S256 plain]
+        }.compact
+      end
+    end
+  end
+end

data/app/controllers/standard_id/provider/introspection_controller.rb

@@ -0,0 +1,41 @@
+module StandardId
+  module Provider
+    class IntrospectionController < ApplicationController
+      before_action :authenticate_client!
+
+      def create
+        token = params[:token]
+
+        if token.blank?
+          render json: { active: false }
+          return
+        end
+
+        payload = StandardId::JwtService.decode(token)
+
+        if payload.nil?
+          render json: { active: false }
+          return
+        end
+
+        if payload[:jti].present? && RevokedToken.revoked?(payload[:jti])
+          render json: { active: false }
+          return
+        end
+
+        render json: {
+          active: true,
+          sub: payload[:sub],
+          client_id: payload[:client_id],
+          scope: payload[:scope],
+          iss: payload[:iss],
+          exp: payload[:exp],
+          iat: payload[:iat],
+          jti: payload[:jti],
+          aud: payload[:aud],
+          token_type: "Bearer"
+        }.compact
+      end
+    end
+  end
+end

data/app/controllers/standard_id/provider/revocation_controller.rb

@@ -0,0 +1,29 @@
+module StandardId
+  module Provider
+    class RevocationController < ApplicationController
+      before_action :authenticate_client!
+
+      def create
+        token = params[:token]
+        return head :ok if token.blank?
+
+        payload = StandardId::JwtService.decode(token)
+        return head :ok if payload.nil?
+
+        jti = payload[:jti]
+        return head :ok if jti.blank?
+
+        expires_at = payload[:exp] ? Time.at(payload[:exp]) : 1.day.from_now
+
+        RevokedToken.revoke!(
+          jti: jti,
+          client_id: @client_credential.client_id,
+          token_type: params[:token_type_hint],
+          expires_at: expires_at
+        )
+
+        head :ok
+      end
+    end
+  end
+end

data/app/helpers/standard_id/provider/application_helper.rb

@@ -0,0 +1,6 @@
+module StandardId
+  module Provider
+    module ApplicationHelper
+    end
+  end
+end

data/app/jobs/standard_id/provider/application_job.rb

@@ -0,0 +1,6 @@
+module StandardId
+  module Provider
+    class ApplicationJob < ActiveJob::Base
+    end
+  end
+end

data/app/mailers/standard_id/provider/application_mailer.rb

@@ -0,0 +1,8 @@
+module StandardId
+  module Provider
+    class ApplicationMailer < ActionMailer::Base
+      default from: "from@example.com"
+      layout "mailer"
+    end
+  end
+end

data/app/models/standard_id/provider/application_record.rb

@@ -0,0 +1,7 @@
+module StandardId
+  module Provider
+    class ApplicationRecord < ActiveRecord::Base
+      self.abstract_class = true
+    end
+  end
+end

data/app/models/standard_id/provider/consent_grant.rb

@@ -0,0 +1,41 @@
+module StandardId
+  module Provider
+    class ConsentGrant < ApplicationRecord
+      self.table_name = "standard_id_consent_grants"
+
+      belongs_to :account, class_name: StandardId.config.account_class_name
+      belongs_to :client_application, class_name: "StandardId::ClientApplication"
+
+      validates :scopes, presence: true
+
+      scope :active, -> { where(revoked_at: nil) }
+      scope :revoked, -> { where.not(revoked_at: nil) }
+
+      before_validation :set_granted_at, on: :create
+
+      def self.grant!(account:, client_application:, scopes:)
+        transaction do
+          active.where(account: account, client_application: client_application).each(&:revoke!)
+          create!(account: account, client_application: client_application, scopes: scopes)
+        end
+      rescue ActiveRecord::RecordNotUnique
+        retry
+      end
+
+      def revoke!
+        update!(revoked_at: Time.current)
+      end
+
+      def covers_scopes?(requested_scopes)
+        granted = scopes.to_s.split(/\s+/)
+        (requested_scopes - granted).empty?
+      end
+
+      private
+
+      def set_granted_at
+        self.granted_at ||= Time.current
+      end
+    end
+  end
+end

data/app/models/standard_id/provider/revoked_token.rb

@@ -0,0 +1,31 @@
+module StandardId
+  module Provider
+    class RevokedToken < ApplicationRecord
+      self.table_name = "standard_id_revoked_tokens"
+
+      validates :jti, presence: true, uniqueness: true
+
+      scope :active, -> { where("expires_at > ?", Time.current) }
+
+      def self.revoke!(jti:, client_id: nil, token_type: nil, expires_at: nil)
+        create!(
+          jti: jti,
+          client_id: client_id,
+          token_type: token_type,
+          revoked_at: Time.current,
+          expires_at: expires_at || 1.day.from_now
+        )
+      rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+        # Token already revoked — idempotent
+      end
+
+      def self.revoked?(jti)
+        where(jti: jti).exists?
+      end
+
+      def self.cleanup_expired!
+        where("expires_at <= ?", Time.current).delete_all
+      end
+    end
+  end
+end

data/app/views/layouts/standard_id/provider/application.html.erb

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Standard id provider</title>
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= yield :head %>
+
+  <%= stylesheet_link_tag    "standard_id/provider/application", media: "all" %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/config/routes.rb

@@ -0,0 +1,11 @@
+StandardId::Provider::Engine.routes.draw do
+  scope ".well-known" do
+    get "openid-configuration", to: "discovery#show"
+  end
+
+  scope "api/provider" do
+    post "introspect", to: "introspection#create"
+    post "revoke", to: "revocation#create"
+    resource :consent, only: [ :show, :create, :destroy ], controller: :consent
+  end
+end

data/db/migrate/20260312000001_create_standard_id_consent_grants.rb

@@ -0,0 +1,19 @@
+class CreateStandardIdConsentGrants < ActiveRecord::Migration[8.0]
+  def change
+    create_table :standard_id_consent_grants do |t|
+      t.references :account, null: false
+      t.references :client_application, null: false
+      t.string :scopes, null: false
+      t.datetime :granted_at, null: false
+      t.datetime :revoked_at
+
+      t.timestamps
+    end
+
+    add_index :standard_id_consent_grants,
+      [ :account_id, :client_application_id ],
+      unique: true,
+      where: "revoked_at IS NULL",
+      name: "idx_consent_grants_active_unique"
+  end
+end

data/db/migrate/20260312000002_create_standard_id_revoked_tokens.rb

@@ -0,0 +1,16 @@
+class CreateStandardIdRevokedTokens < ActiveRecord::Migration[8.0]
+  def change
+    create_table :standard_id_revoked_tokens do |t|
+      t.string :jti, null: false
+      t.string :token_type
+      t.string :client_id
+      t.datetime :revoked_at, null: false
+      t.datetime :expires_at, null: false
+
+      t.timestamps
+    end
+
+    add_index :standard_id_revoked_tokens, :jti, unique: true
+    add_index :standard_id_revoked_tokens, :expires_at
+  end
+end

data/lib/standard_id/provider/config/schema.rb

@@ -0,0 +1,10 @@
+StandardConfig.schema.draw do
+  scope :provider do
+    field :id_token_lifetime, type: :integer, default: 3600
+    field :scopes_supported, type: :array, default: -> { %w[openid profile email offline_access] }
+    field :claims_supported, type: :array, default: -> { %w[sub iss aud exp iat nonce auth_time at_hash email name email_verified] }
+    field :subject_types_supported, type: :array, default: -> { %w[public] }
+    field :introspection_enabled, type: :boolean, default: true
+    field :revocation_enabled, type: :boolean, default: true
+  end
+end

data/lib/standard_id/provider/engine.rb

@@ -0,0 +1,25 @@
+module StandardId
+  module Provider
+    class Engine < ::Rails::Engine
+      isolate_namespace StandardId::Provider
+
+      initializer "standard_id_provider.extend_core" do
+        StandardId::Oauth::TokenGrantFlow.prepend(
+          StandardId::Provider::Extensions::TokenGrantFlowExt
+        )
+
+        StandardId::Oauth::AuthorizationCodeAuthorizationFlow.prepend(
+          StandardId::Provider::Extensions::AuthorizationFlowExt
+        )
+
+        StandardId::Oauth::Subflows::TraditionalCodeGrant.prepend(
+          StandardId::Provider::Extensions::TraditionalCodeGrantExt
+        )
+
+        StandardId::Oauth::AuthorizationCodeFlow.prepend(
+          StandardId::Provider::Extensions::AuthorizationCodeFlowExt
+        )
+      end
+    end
+  end
+end

data/lib/standard_id/provider/extensions/authorization_code_flow_ext.rb

@@ -0,0 +1,13 @@
+module StandardId
+  module Provider
+    module Extensions
+      module AuthorizationCodeFlowExt
+        private
+
+        def id_token_nonce
+          @authorization_code&.nonce
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/provider/extensions/authorization_flow_ext.rb

@@ -0,0 +1,60 @@
+module StandardId
+  module Provider
+    module Extensions
+      module AuthorizationFlowExt
+        private
+
+        def generate_authorization_response
+          if consent_required? && !consent_granted?
+            return redirect_to_consent
+          end
+
+          super
+        end
+
+        def common_subflow_params(flow_params)
+          super.merge(nonce: flow_params[:nonce])
+        end
+
+        def consent_required?
+          @client&.require_consent? && openid_scope_requested?
+        end
+
+        def openid_scope_requested?
+          scope.to_s.split(/\s+/).include?("openid")
+        end
+
+        def consent_granted?
+          return false unless current_account
+
+          grant = StandardId::Provider::ConsentGrant.active
+            .find_by(account: current_account, client_application: @client)
+
+          return false unless grant
+
+          requested = scope.to_s.split(/\s+/).sort
+          granted = grant.scopes.to_s.split(/\s+/).sort
+          (requested - granted).empty?
+        end
+
+        def redirect_to_consent
+          consent_params = {
+            client_id: params[:client_id],
+            redirect_uri: redirect_uri,
+            scope: scope,
+            state: state,
+            audience: audience,
+            nonce: params[:nonce],
+            response_type: params[:response_type],
+            code_challenge: params[:code_challenge],
+            code_challenge_method: params[:code_challenge_method]
+          }.compact
+
+          consent_url = StandardId::Provider::Engine.routes.url_helpers.consent_path(consent_params)
+
+          { redirect_to: consent_url, status: :found }
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/provider/extensions/token_grant_flow_ext.rb

@@ -0,0 +1,38 @@
+module StandardId
+  module Provider
+    module Extensions
+      module TokenGrantFlowExt
+        private
+
+        def generate_token_response
+          response = super
+
+          if openid_scope_requested? && subject_id.present?
+            response[:id_token] = Provider::IdTokenService.generate(
+              subject_id: subject_id,
+              client_id: client_id,
+              nonce: id_token_nonce,
+              access_token: response[:access_token],
+              auth_time: id_token_auth_time
+            )
+          end
+
+          response
+        end
+
+        def build_jwt_payload(expires_in)
+          payload = super
+          payload[:jti] = SecureRandom.uuid
+          payload
+        end
+
+        def openid_scope_requested?
+          current_scopes.include?("openid")
+        end
+
+        def id_token_nonce = nil
+        def id_token_auth_time = nil
+      end
+    end
+  end
+end

data/lib/standard_id/provider/extensions/traditional_code_grant_ext.rb

@@ -0,0 +1,24 @@
+module StandardId
+  module Provider
+    module Extensions
+      module TraditionalCodeGrantExt
+        private
+
+        def store_authorization_code
+          StandardId::AuthorizationCode.issue!(
+            plaintext_code: authorization_code,
+            client_id: params[:client_id],
+            redirect_uri: params[:redirect_uri],
+            scope: params[:scope],
+            audience: params[:audience],
+            account: params[:current_account],
+            code_challenge: params[:code_challenge],
+            code_challenge_method: params[:code_challenge_method],
+            nonce: params[:nonce],
+            metadata: { state: params[:state] }.compact
+          )
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/provider/id_token_service.rb

@@ -0,0 +1,40 @@
+module StandardId
+  module Provider
+    class IdTokenService
+      class << self
+        def generate(subject_id:, client_id:, nonce: nil, access_token: nil, authorization_code: nil, auth_time: nil, extra_claims: {})
+          payload = {
+            sub: subject_id,
+            aud: client_id,
+            nonce: nonce,
+            auth_time: auth_time&.to_i
+          }.compact
+
+          payload[:at_hash] = compute_half_hash(access_token) if access_token.present?
+          payload[:c_hash] = compute_half_hash(authorization_code) if authorization_code.present?
+          payload.merge!(extra_claims.symbolize_keys) if extra_claims.present?
+
+          expires_in = StandardId.config.provider.id_token_lifetime.seconds
+
+          StandardId::JwtService.encode(payload, expires_in: expires_in)
+        end
+
+        private
+
+        def compute_half_hash(value)
+          digest = hash_algorithm.digest(value)
+          Base64.urlsafe_encode64(digest[0, digest.length / 2], padding: false)
+        end
+
+        def hash_algorithm
+          case StandardId::JwtService.algorithm
+          when /256$/ then OpenSSL::Digest::SHA256
+          when /384$/ then OpenSSL::Digest::SHA384
+          when /512$/ then OpenSSL::Digest::SHA512
+          else OpenSSL::Digest::SHA256
+          end
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/provider/version.rb

@@ -0,0 +1,5 @@
+module StandardId
+  module Provider
+    VERSION = "0.1.0"
+  end
+end

data/lib/standard_id/provider.rb

@@ -0,0 +1,15 @@
+require "standard_id"
+
+require "standard_id/provider/version"
+require "standard_id/provider/config/schema"
+require "standard_id/provider/id_token_service"
+require "standard_id/provider/extensions/token_grant_flow_ext"
+require "standard_id/provider/extensions/authorization_flow_ext"
+require "standard_id/provider/extensions/traditional_code_grant_ext"
+require "standard_id/provider/extensions/authorization_code_flow_ext"
+require "standard_id/provider/engine"
+
+module StandardId
+  module Provider
+  end
+end

data/lib/tasks/standard_id/provider_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :standard_id_provider do
+#   # Task goes here
+# end

metadata

@@ -0,0 +1,102 @@
+--- !ruby/object:Gem::Specification
+name: standard_id-provider
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Jaryl Sim
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: standard_id
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+description: 'Extends StandardId with full OIDC Identity Provider capabilities: ID
+  tokens, consent management, token introspection, token revocation, and discovery.'
+email:
+- code@jaryl.dev
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- MIT-LICENSE
+- README.md
+- Rakefile
+- app/assets/stylesheets/standard_id/provider/application.css
+- app/controllers/standard_id/provider/application_controller.rb
+- app/controllers/standard_id/provider/consent_controller.rb
+- app/controllers/standard_id/provider/discovery_controller.rb
+- app/controllers/standard_id/provider/introspection_controller.rb
+- app/controllers/standard_id/provider/revocation_controller.rb
+- app/helpers/standard_id/provider/application_helper.rb
+- app/jobs/standard_id/provider/application_job.rb
+- app/mailers/standard_id/provider/application_mailer.rb
+- app/models/standard_id/provider/application_record.rb
+- app/models/standard_id/provider/consent_grant.rb
+- app/models/standard_id/provider/revoked_token.rb
+- app/views/layouts/standard_id/provider/application.html.erb
+- config/routes.rb
+- db/migrate/20260312000001_create_standard_id_consent_grants.rb
+- db/migrate/20260312000002_create_standard_id_revoked_tokens.rb
+- lib/standard_id/provider.rb
+- lib/standard_id/provider/config/schema.rb
+- lib/standard_id/provider/engine.rb
+- lib/standard_id/provider/extensions/authorization_code_flow_ext.rb
+- lib/standard_id/provider/extensions/authorization_flow_ext.rb
+- lib/standard_id/provider/extensions/token_grant_flow_ext.rb
+- lib/standard_id/provider/extensions/traditional_code_grant_ext.rb
+- lib/standard_id/provider/id_token_service.rb
+- lib/standard_id/provider/version.rb
+- lib/tasks/standard_id/provider_tasks.rake
+homepage: https://github.com/rarebit-one/standard_id-provider
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/rarebit-one/standard_id-provider
+  source_code_uri: https://github.com/rarebit-one/standard_id-provider
+  changelog_uri: https://github.com/rarebit-one/standard_id-provider/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/rarebit-one/standard_id-provider/issues
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.3
+specification_version: 4
+summary: OpenID Connect Identity Provider addon for StandardId.
+test_files: []