standard_id 0.2.1 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: acbf22ea3a73945fedbcc5d26da84954f4b4e04de00cf2bac51eb59374231a09
-  data.tar.gz: 063d9c263aa7ca6910602a1a570676ee96348a88b1265a2c2ac5d8c11dacf076
+  metadata.gz: b187dd81d274ace6321becb8a2be32bf28968ab27d845d698294ff2ec448ad53
+  data.tar.gz: 3deb68b18b7d5ad8a4075c303ebe03cf93fc0fd0a74b1ef399736688e62f35ab
 SHA512:
-  metadata.gz: 8a3e58978c5525de51c16ad46e563567a93790a7ad5a99aeea1d43d3068c01df9120ccc5d0a5694a5e3531fe916906bcc811f2a2dcbce25ec42228ca7ddfa4e5
-  data.tar.gz: 2f3d4beee53b0fa961ed8648eb433a65e751f63c8f20fa10153e10c16bfce50440a5714bbd9b8a8cc4fefe98ff806804c6f49e6e3a79362b10e9780a55d49fce
+  metadata.gz: 1e64c713cd3861aba0ceb1f946d881effc025439807eb30e7ea373052c9890e077a654257e940e6379c7ae743a90fa8736ece2139bb92dd2b9a284b943c48ed2
+  data.tar.gz: c61fd9e8033cbbd91903e31933b3d1f0c77b34298a672e77b77af0478b3a64eec011674a1c21b3db5111f60277baf3a71357cd021c45eb2e1dba7222fe828e62

data/README.md

@@ -101,6 +101,26 @@ class ApiController < ActionController::API
 end
 ```
 
+### 5. Action Cable Authentication
+
+- Include in Your Connection Class
+```ruby
+module ApplicationCable
+  class Connection < ActionCable::Connection::Base
+    include StandardId::CableAuthentication
+  end
+end
+```
+
+- Access Current Account in Channels
+```ruby
+class ChatChannel < ApplicationCable::Channel
+  def subscribed
+    stream_for current_account
+  end
+end
+```
+
 ## Configuration
 
 ### Basic Configuration

data/app/channels/concerns/standard_id/cable_authentication.rb

@@ -0,0 +1,33 @@
+module StandardId
+  module CableAuthentication
+    extend ActiveSupport::Concern
+
+    included do
+      identified_by :current_account
+    end
+
+    def connect
+      self.current_account = find_verified_account
+    end
+
+    private
+
+    def find_verified_account
+      if verified_account = find_account_from_session_token
+        verified_account
+      else
+        reject_unauthorized_connection
+      end
+    end
+
+    def find_account_from_session_token
+      session_token = cookies.encrypted[:session_token] || request.session[:session_token]
+      return nil if session_token.blank?
+
+      browser_session = StandardId::BrowserSession.eager_load(:account).by_token(session_token).first
+      return nil unless browser_session&.active?
+
+      browser_session.account
+    end
+  end
+end

data/app/controllers/standard_id/api/oauth/callback/providers_controller.rb

@@ -16,7 +16,8 @@ module StandardId
             params,
             request,
             account:,
-            connection: provider.provider_name
+            connection: provider.provider_name,
+            scopes: params[:scope] || params[:scopes]
           )
 
           token_response = flow.execute
@@ -24,7 +25,7 @@ module StandardId
             provider: provider.provider_name,
             social_info:,
             provider_tokens:,
-            account:
+            account:,
           )
           render json: token_response, status: :ok
         end

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -60,6 +60,7 @@ StandardId.configure do |c|
   # c.social.apple_key_id         = ENV["APPLE_KEY_ID"]
   # c.social.apple_team_id        = ENV["APPLE_TEAM_ID"]
   # c.social.allowed_redirect_url_prefixes = ["sidekicklabs://"]
+  # c.social.available_scopes = ["profile", "email", "offline_access"]
   # c.social.social_account_attributes = ->(social_info:, provider:) {
   #   {
   #     email: social_info[:email],

data/lib/standard_id/config/schema.rb

@@ -55,5 +55,6 @@ StandardConfig.schema.draw do
   scope :social do
     field :social_account_attributes, type: :any, default: nil
     field :allowed_redirect_url_prefixes, type: :array, default: []
+    field :available_scopes, type: :array, default: -> { [] }
   end
 end

data/lib/standard_id/oauth/social_flow.rb

@@ -1,12 +1,13 @@
 module StandardId
   module Oauth
     class SocialFlow < TokenGrantFlow
-      attr_reader :account, :connection, :original_params
+      attr_reader :account, :connection, :scopes
 
-      def initialize(params, request, account:, connection:)
+      def initialize(params, request, account:, connection:, scopes:)
         super(params, request)
         @account = account
         @connection = connection
+        @scopes = validate_and_normalize_scopes(scopes)
       end
 
       def authenticate!
@@ -24,7 +25,7 @@ module StandardId
       end
 
       def token_scope
-        nil
+        scopes
       end
 
       def grant_type
@@ -51,6 +52,22 @@ module StandardId
         base_payload = super(expires_in)
         base_payload.merge(provider: @connection).compact
       end
+
+      def validate_and_normalize_scopes(scopes)
+        return nil if scopes.blank?
+
+        available_scopes = StandardId.config.social.available_scopes
+        return scopes if available_scopes.blank?
+
+        requested_scopes = scopes.to_s.split(/\s+/).reject(&:blank?).uniq
+        invalid_scopes = requested_scopes - available_scopes.map(&:to_s)
+
+        if invalid_scopes.any?
+          raise StandardId::InvalidScopeError, "Invalid scope(s): #{invalid_scopes.join(', ')}. Available scopes: #{available_scopes.join(', ')}"
+        end
+
+        requested_scopes.join(" ")
+      end
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.2.1"
+  VERSION = "0.2.3"
 end

data/lib/standard_id/web/session_manager.rb

@@ -21,7 +21,10 @@ module StandardId
       def sign_in_account(account)
         emit_session_creating(account, "browser")
         token_manager.create_browser_session(account).tap do |browser_session|
+          # Store in both session and encrypted cookie for backward compatibility
+          # Action Cable will use the encrypted cookie
           session[:session_token] = browser_session.token
+          cookies.encrypted[:session_token] = browser_session.token
           Current.session = browser_session
           emit_session_created(browser_session, account, "browser")
         end
@@ -39,6 +42,7 @@ module StandardId
       def clear_session!
         # TODO: make token key names configurable
         session.delete(:session_token)
+        cookies.encrypted[:session_token] = nil
         cookies.delete(:remember_token)
 
         Current.session = nil
@@ -65,7 +69,9 @@ module StandardId
       end
 
       def load_session_from_session_token
-        StandardId::BrowserSession.eager_load(:account).by_token(session[:session_token]).first
+        # Try encrypted cookie first (for Action Cable), then fall back to session (for backward compatibility)
+        session_token = cookies.encrypted[:session_token] || session[:session_token]
+        StandardId::BrowserSession.eager_load(:account).by_token(session_token).first
       end
 
       def load_session_from_remember_token
@@ -73,7 +79,9 @@ module StandardId
         return if password_credential.blank?
 
         token_manager.create_browser_session(password_credential.account, remember_me: true).tap do |browser_session|
+          # Store in both session and encrypted cookie for backward compatibility
           session[:session_token] = browser_session.token
+          cookies.encrypted[:session_token] = browser_session.token
           cookies[:remember_token] = token_manager.create_remember_token(password_credential)
         end
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.3
 platform: ruby
 authors:
 - Jaryl Sim
@@ -64,6 +64,7 @@ files:
 - README.md
 - Rakefile
 - app/assets/stylesheets/standard_id/application.css
+- app/channels/concerns/standard_id/cable_authentication.rb
 - app/controllers/concerns/standard_id/api_authentication.rb
 - app/controllers/concerns/standard_id/inertia_rendering.rb
 - app/controllers/concerns/standard_id/inertia_support.rb