standard_id 0.14.2 → 0.14.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86f8a8439f93dda629769f1c0a8a26494733ae862295bbe416f5294c4818562c
-  data.tar.gz: b97caba35aa2f704f3dd6fd37796e602276be1c84bc76f89390688ed01512ff9
+  metadata.gz: 47ce66e4e4b242fd96a90cda7b20a9316e31642551ebe6c94ae660336f8f0b2c
+  data.tar.gz: a1a6d6f746f2ef0590aec0b5d6c4cc51472e04030af53e30d8546495d2556f03
 SHA512:
-  metadata.gz: 2f2697a1def9d53f287e9c6cda65c9e86894f8dd8d4f91b9e5af5cfb47d87f85502bb6953786f61707582e6d4485a6df90d2d18fe74ce7fe36e08638aaa0d4c6
-  data.tar.gz: f6899943cae7817977ddc8d37345f5e26739e9fbe0ff7a41864d6490c86dc85f525e67b7ad71d16a5d039edda03c24eb73be6b387a044b1705535eec3934a377
+  metadata.gz: f323ce02474f8d4fc98a8aa4466616f15e58b9a5f6174336c91c0f9bc02c22e95862909963d0470271b49dc588fb0abcfcd2434c17a7ece79952d7547ed81ddf
+  data.tar.gz: 03a24d819ad4f699be3d97ce26e8dcf04873b373ff55c03e31f0de475a014198053a1927bf6539de40c0398855490be01ea4bc77dbe093d1f381f67eddfb8608

data/db/migrate/20260414200000_add_target_created_at_index_to_code_challenges.rb

@@ -0,0 +1,7 @@
+class AddTargetCreatedAtIndexToCodeChallenges < ActiveRecord::Migration[8.0]
+  def change
+    add_index :standard_id_code_challenges,
+      [:realm, :channel, :target, :created_at],
+      name: "index_code_challenges_on_target_created_at"
+  end
+end

data/lib/standard_id/authorization_bypass.rb

@@ -103,6 +103,14 @@ module StandardId
       # Must remain public because it is invoked from a to_prepare lambda
       # registered in apply, which executes outside this module's scope.
       def apply_skips!
+        # ControllerPolicy lives in app/controllers/concerns/ and is autoloaded
+        # by Zeitwerk. When apply is called early (e.g. from a Rails initializer),
+        # the constant may not be loaded yet. This is safe to skip — controllers
+        # that register later will receive skips via apply_to_controller (called
+        # from ControllerPolicy.register), and the to_prepare block re-runs
+        # apply_skips! after class loading is complete.
+        return unless defined?(StandardId::ControllerPolicy)
+
         StandardId::ControllerPolicy.registry_snapshot.each do |policy, controllers|
           controllers.each { |controller| apply_to_controller(controller, policy) }
         end

data/lib/standard_id/passwordless/base_strategy.rb

@@ -28,18 +28,30 @@ module StandardId
       protected
 
       def create_challenge!(username)
-        code = generate_otp_code
+        ActiveRecord::Base.transaction do
+          invalidate_active_challenges!(username)
+
+          code = generate_otp_code
+
+          StandardId::CodeChallenge.create!(
+            realm: "authentication",
+            channel: connection_type,
+            target: username,
+            code: code,
+            expires_at: StandardId.config.passwordless.code_ttl.seconds.from_now,
+            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
+            user_agent: request.user_agent
+          )
+        end
+      end
 
-        cc = StandardId::CodeChallenge.create!(
-          realm: "authentication",
-          channel: connection_type,
-          target: username,
-          code: code,
-          expires_at: StandardId.config.passwordless.code_ttl.seconds.from_now,
-          ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
-          user_agent: request.user_agent
-        )
-        cc
+      # Uses update_all for a single UPDATE statement (no N+1). This bypasses
+      # ActiveRecord callbacks intentionally — CodeChallenge has no after-save
+      # hooks today. If callbacks are added to CodeChallenge#use!, revisit this.
+      def invalidate_active_challenges!(username)
+        StandardId::CodeChallenge.active
+          .where(realm: "authentication", channel: connection_type, target: username)
+          .update_all(used_at: Time.current)
       end
 
       def generate_otp_code

data/lib/standard_id/passwordless/verification_service.rb

@@ -200,11 +200,10 @@ module StandardId
       end
 
       def find_active_challenge
-        StandardId::CodeChallenge.active.find_by(
-          realm: "authentication",
-          channel: @channel,
-          target: @target
-        )
+        StandardId::CodeChallenge.active
+          .where(realm: "authentication", channel: @channel, target: @target)
+          .order(created_at: :desc)
+          .first
       end
 
       # NOTE: The update! here can raise ActiveRecord::RecordInvalid, which is

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.14.2"
+  VERSION = "0.14.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.14.2
+  version: 0.14.4
 platform: ruby
 authors:
 - Jaryl Sim
@@ -205,6 +205,7 @@ files:
 - db/migrate/20260311000000_add_provider_to_standard_id_identifiers.rb
 - db/migrate/20260311100000_create_standard_id_refresh_tokens.rb
 - db/migrate/20260311100001_add_nullify_to_refresh_token_previous_token_fk.rb
+- db/migrate/20260414200000_add_target_created_at_index_to_code_challenges.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/standard_config.rb