standard_id 0.13.0 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90019539f1e0cc2c3fee8e641ff0b18a337bd1b263aa78441b3c886bde6b72d4
-  data.tar.gz: a98746c6be195bf842304c07bcb6276f8f95031be8c83b349ce902185874e248
+  metadata.gz: 8d7f2bce088273acf1c2601b85b0c1fc5f72cd36d465fc7370c3b9e2f651166d
+  data.tar.gz: a45562de00f147d69627dc2a377e645c167d8814e34c824eee2a38893c6727df
 SHA512:
-  metadata.gz: 85558657315f76bfbdb3d05638cb7280805e2f329dca42dc99f0c0a2e2fd99bcd0ce6d0ffa4289138d13ac89207276fd9c0d75dd52336e8538c12dcfcbcd8164
-  data.tar.gz: 707fb170fee01dae20abd78a62ba67c9f9d6a2135ed6ddad02610f1194b89c41e9cef62f12a8c2358931b66c21aa66952cfaaccb2b0d36bd60f7269fbf6b7493
+  metadata.gz: ef7e0f56d1d5575727c4a18f4b13daae6afafd58a40a0871a511feaf4b212e2d9f631033f9034f82f16833ac5f022c656fb5addd7653719f66b4892fad78ea4f
+  data.tar.gz: 1a0d7b18b6d166deba7fa54cd14bc2ddc7d6fffec7583decd984d27bcf91844da0469ebc1f1760f22e5fe9ea8cced5bd67ffabb22ee663dcb667335d094ea530

data/app/controllers/standard_id/web/login_controller.rb

@@ -147,7 +147,10 @@ module StandardId
         supported_params = provider.try(:supported_authorization_params)
         return {} if supported_params.blank?
 
-        params.permit(*supported_params).to_h.compact.symbolize_keys
+        # Exclude :scope from OAuth params — the route-level scope default (e.g., :user, :admin)
+        # is a StandardId auth scope, not an OAuth scope. Providers define their own default
+        # OAuth scopes (e.g., Google uses "openid email profile").
+        params.except(:scope).permit(*supported_params).to_h.compact.symbolize_keys
       end
 
       def generate_oauth_token

data/lib/standard_id/config/schema.rb

@@ -71,6 +71,13 @@ StandardConfig.schema.draw do
     field :retry_delay, type: :integer, default: 30 # 30 seconds
     field :bypass_code, type: :string, default: nil # E2E testing only — NEVER set in production
 
+    # Custom username validator for passwordless flows.
+    # When set, called before OTP generation to validate the recipient address.
+    # Must be a callable (lambda/proc) that receives (username, connection_type)
+    # and returns nil/false to proceed, or an error message string to reject.
+    # Example: ->(username, connection_type) { "Invalid email" unless MyValidator.valid?(username) }
+    field :username_validator, type: :any, default: nil
+
     # Custom account factory for passwordless registration.
     # When set, replaces the default find_or_create_account! logic in strategies.
     # Must be a callable (lambda/proc) that receives (identifier:, params:, request:)

data/lib/standard_id/passwordless/base_strategy.rb

@@ -16,6 +16,7 @@ module StandardId
       def start!(attrs)
         username = attrs[:username]
         validate_username!(username)
+        run_username_validator!(username)
         emit_code_requested(username)
         challenge = create_challenge!(username)
         emit_code_generated(challenge, username)
@@ -104,6 +105,14 @@ module StandardId
         request.params
       end
 
+      def run_username_validator!(username)
+        validator = StandardId.config.passwordless.username_validator
+        return unless validator.respond_to?(:call)
+
+        error = validator.call(username, connection_type)
+        raise StandardId::InvalidRequestError, error if error.present?
+      end
+
       def emit_code_requested(username)
         StandardId::Events.publish(
           StandardId::Events::PASSWORDLESS_CODE_REQUESTED,

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.13.0"
+  VERSION = "0.14.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Jaryl Sim