standard_id 0.20.0 → 0.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: faa6cfb238d38d71af682021ba3b6407cf06657c1b12e7ff29474dc97c753277
-  data.tar.gz: 365d86af12a4fef90b669f52114ae449d07facd5389089b438ae67174f75059e
+  metadata.gz: 4999da4a28bb0450d14da9b7383099cbf67860c9c739c7785cc84f8ba2cc84f0
+  data.tar.gz: f6d6574ddb0c3e331dd955bd3fd1c65a3b30c523f7d721b7274762d558f017ca
 SHA512:
-  metadata.gz: 4ffc829b81cb6315954c5f2b3632889a7afd3c7457c4971297698f04ec9f43682b7eb715f711e2b28ea3c40d33f51519fc7339cd8d0f4996a7adad413677e880
-  data.tar.gz: 6247cc6fd0deeee072d90711ae1443d01d42bb585a58330358d9596fae8e665e14af4c274a478f7bc43b4e47adc2aca05d4f2c6ab7a7dc1c4caa846f751ab917
+  metadata.gz: 20d8e4560eacf2a272e2cadafcb5647a82781813a5164f510a91bf8f80fc6d3bb17a6287fee15b41704907b323a3039c279213603cfdf619639298b8ca952f80
+  data.tar.gz: 60b2c0fa613bcf40eae4197e73d122d957769f4faae6f85dafdec25e463ef375c336fa07308459e0c0c1d1c49ce7ef03ff0fe5d50f1839a0f1213323be74f3cc

data/{MIT-LICENSE → LICENSE}

@@ -1,4 +1,6 @@
-Copyright (c) Jaryl Sim
+The MIT License (MIT)
+
+Copyright (c) 2026 Rarebit One
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/app/controllers/concerns/standard_id/lifecycle_hooks.rb

@@ -100,6 +100,12 @@ module StandardId
     #   - :profile_type [String, nil] first configured profile type for the scope (back-compat)
     #   - :profile_types [Array<String>, nil] all configured profile types for the scope
     #   - :after_sign_in_path [String, nil] default redirect path for the scope
+    #   - :redirect_uri [String, nil] caller-supplied destination (from the form
+    #     param for password/signup, from the OAuth state cookie for social).
+    #     Hooks that always return a default path should return nil when this is
+    #     present so the originator's URL wins — otherwise upstream OAuth/SSO
+    #     flows that send users to /login?redirect_uri=... will land on the
+    #     hook's default page instead of completing the handshake.
     # @return [String, nil] redirect path override, or nil for default
     # @raise [StandardId::AuthenticationDenied] to reject the sign-in
     def invoke_after_sign_in(account, context)
@@ -118,6 +124,12 @@ module StandardId
         return result if result.present?
       end
 
+      # When the caller supplied a :redirect_uri and the hook returned nil, treat that
+      # as the documented "defer to originator" signal — do NOT shadow it with the
+      # scope's after_sign_in_path (which would silently break OAuth/SSO handshakes
+      # for any host that configures a scope default).
+      return nil if context[:redirect_uri].present?
+
       # When no hook override, use the scope's after_sign_in_path if present
       scope_config&.after_sign_in_path
     end

data/app/controllers/standard_id/api/authorization_controller.rb

@@ -16,6 +16,9 @@ module StandardId
       }.freeze
 
       def show
+        reject_invalid_redirect_uri!
+        return redirect_to_consent if consent_required?
+
         response_data = flow_strategy_class.new(flow_strategy_params, request, current_account: current_account).execute
 
         if response_data[:redirect_to]
@@ -27,6 +30,85 @@ module StandardId
 
       private
 
+      # Validate redirect_uri against the resolved client BEFORE any consent
+      # hand-off. The authorization flow validates it during #execute, but the
+      # consent gate (redirect_to_consent) runs first — so without this an
+      # unvalidated redirect_uri would be signed into the consent payload and the
+      # Deny path would redirect straight to it (open redirect). Per OAuth, an
+      # invalid redirect_uri is surfaced as an error, never redirected to. On the
+      # non-consent path the flow re-validates (harmless, same error).
+      def reject_invalid_redirect_uri!
+        return if params[:redirect_uri].blank?
+
+        client = consent_client
+        return if client.nil? # unknown/inactive client is rejected by the flow
+
+        return if client.valid_redirect_uri?(params[:redirect_uri])
+
+        raise StandardId::InvalidRequestError, "Invalid redirect_uri"
+      end
+
+      # An interactive authorization-code request needs a consent screen when:
+      #   * the user is authenticated,
+      #   * the request is an interactive (HTML) request — not JSON, not a
+      #     social-login redirect (which bounces to the provider),
+      #   * the resolved client has require_consent enabled, and
+      #   * the account has not already granted consent covering the scope.
+      # Implicit flows and JSON callers are unaffected. The consent screen is
+      # authenticated HTML, so it is rendered by the WebEngine (full ERB /
+      # Inertia stack); the API endpoint hands off via a signed payload and
+      # resumes here once a grant exists.
+      def consent_required?
+        return false unless response_type == "code"
+        return false unless request.format.html?
+        return false if social_login?
+        return false if current_account.blank?
+
+        client = consent_client
+        return false unless client&.require_consent?
+
+        !StandardId::ClientGrant.granted?(
+          account: current_account,
+          client_id: client.client_id,
+          requested_scope: params[:scope]
+        )
+      end
+
+      def consent_client
+        @consent_client ||= StandardId::ClientApplication.active.find_by(client_id: params[:client_id])
+      end
+
+      def redirect_to_consent
+        payload = StandardId::Oauth::ConsentPayload.encode(authorize_params_for_resume)
+        base = StandardId.config.login_url.present? ? consent_base_from_login_url : "/consent"
+        redirect_to "#{base}?consent_request=#{CGI.escape(payload)}", allow_other_host: true, status: :found
+      end
+
+      # Derive the WebEngine consent path from the configured login_url so the
+      # consent screen lands on the same host/mount as login (login and consent
+      # are both WebEngine, authenticated-HTML routes).
+      def consent_base_from_login_url
+        login = StandardId.config.login_url.to_s
+        login.sub(%r{/login/?\z}, "/consent").then { |u| u == login ? "/consent" : u }
+      end
+
+      # The exact params required to resume authorization-code issuance after
+      # approval. Carried through a signed payload so they cannot be tampered
+      # with; redirect_uri + PKCE are revalidated when the flow re-runs.
+      def authorize_params_for_resume
+        {
+          response_type: response_type,
+          client_id: params[:client_id],
+          redirect_uri: params[:redirect_uri],
+          scope: params[:scope],
+          audience: params[:audience],
+          state: params[:state],
+          code_challenge: params[:code_challenge],
+          code_challenge_method: params[:code_challenge_method],
+          nonce: params[:nonce]
+        }.compact
+      end
+
       def response_type
         @response_type ||= params[:response_type]
       end

data/app/controllers/standard_id/api/well_known/oauth_authorization_server_controller.rb

@@ -0,0 +1,35 @@
+module StandardId
+  module Api
+    module WellKnown
+      # RFC 8414 OAuth 2.0 Authorization Server Metadata.
+      #
+      # Mirrors OpenidConfigurationController: a public endpoint, guarded on a
+      # configured issuer, with a one-hour public cache. Both render the shared
+      # StandardId::Oauth::DiscoveryDocument so the OIDC and OAuth metadata
+      # documents cannot drift.
+      #
+      # MOUNT CAVEAT (RFC 8414): the ApiEngine is consumer-mounted at a sub-path
+      # (e.g. `/auth/api`), so the gem can only serve this document at
+      # `/auth/api/.well-known/oauth-authorization-server`. A strict RFC 8414
+      # client that derives a root-anchored URL from a path-carrying issuer
+      # (`<host>/.well-known/oauth-authorization-server/auth/api`) lands outside
+      # any engine mount; hosts needing that form must add their own root route.
+      class OauthAuthorizationServerController < ActionController::API
+        include StandardId::ControllerPolicy
+        public_controller
+
+        def show
+          issuer = StandardId.config.issuer
+
+          unless issuer.present?
+            render json: { error: "Issuer not configured" }, status: :not_found
+            return
+          end
+
+          response.headers["Cache-Control"] = "public, max-age=3600"
+          render json: StandardId::Oauth::DiscoveryDocument.build(issuer)
+        end
+      end
+    end
+  end
+end

data/app/controllers/standard_id/api/well_known/openid_configuration_controller.rb

@@ -14,27 +14,7 @@ module StandardId
           end
 
           response.headers["Cache-Control"] = "public, max-age=3600"
-          render json: discovery_document(issuer)
-        end
-
-        private
-
-        def discovery_document(issuer)
-          base = issuer.chomp("/")
-
-          {
-            issuer: issuer,
-            authorization_endpoint: "#{base}/authorize",
-            token_endpoint: "#{base}/oauth/token",
-            revocation_endpoint: "#{base}/oauth/revoke",
-            userinfo_endpoint: "#{base}/userinfo",
-            jwks_uri: "#{base}/.well-known/jwks.json",
-            response_types_supported: %w[code],
-            grant_types_supported: %w[authorization_code refresh_token client_credentials],
-            subject_types_supported: %w[public],
-            id_token_signing_alg_values_supported: [StandardId.config.oauth.signing_algorithm.to_s.upcase],
-            token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post]
-          }
+          render json: StandardId::Oauth::DiscoveryDocument.build(issuer)
         end
       end
     end

data/app/controllers/standard_id/web/auth/callback/providers_controller.rb

@@ -26,6 +26,7 @@ module StandardId
 
             begin
               extract_state_and_nonce => { state_data:, nonce: }
+              caller_redirect_uri = state_data&.dig("redirect_uri").presence
               redirect_uri = callback_url_for
               provider_response = get_user_info_from_provider(redirect_uri:, nonce:)
               social_info = provider_response[:user_info]
@@ -52,10 +53,19 @@ module StandardId
                 original_request_params: state_data
               )
 
-              context = { mechanism: "social", provider: provider_name }
+              context = {
+                mechanism: "social",
+                provider: provider_name,
+                redirect_uri: caller_redirect_uri
+              }
               redirect_override = invoke_after_sign_in(account, context)
 
-              destination = redirect_override || state_data["redirect_uri"]
+              # When the hook defers (returns nil), the originator-supplied URL becomes the
+              # destination. Validate it before redirect_to — without this, an attacker who
+              # tricks a victim into clicking /login?connection=google&redirect_uri=<evil>
+              # can steer the post-auth landing page. redirect_override is host-internal so
+              # we trust it; only the fallthrough needs validation.
+              destination = redirect_override || (safe_destination?(caller_redirect_uri) ? caller_redirect_uri : safe_post_signin_default)
               redirect_options = { notice: "Successfully signed in with #{provider_name.humanize}" }
               redirect_options[:allow_other_host] = true if allow_other_host_redirect?(destination)
               redirect_to destination, redirect_options
@@ -124,7 +134,17 @@ module StandardId
                             "Authentication failed"
             end
 
-            redirect_to StandardId::WebEngine.routes.url_helpers.login_path, alert: error_message
+            # Preserve redirect_uri across the bounce-back-to-/login so the user can retry
+            # the OAuth handshake and complete it back to the originator. Symmetric with
+            # the SocialLinkError / OAuthError rescue paths above.
+            redirect_uri = begin
+              extract_state_and_nonce => { state_data: }
+              state_data&.dig("redirect_uri").presence
+            rescue StandardId::InvalidRequestError
+              nil
+            end
+
+            redirect_to StandardId::WebEngine.routes.url_helpers.login_path(redirect_uri: redirect_uri), alert: error_message
           end
 
           def mobile_relay_params

data/app/controllers/standard_id/web/base_controller.rb

@@ -14,6 +14,51 @@ module StandardId
 
       before_action -> { Current.scope = :web if defined?(::Current) }
       before_action :require_browser_session!
+
+      private
+
+      # Read a top-level query/form param expected to be a scalar String, returning
+      # nil for absent/blank values OR if Rails parsed it as an Array/Hash (e.g. from
+      # `?redirect_uri[]=a&redirect_uri[]=b`). Without this guard, `redirect_to` is
+      # called with a non-String and raises ArgumentError → 500 for any caller that
+      # sends a malformed redirect_uri.
+      def string_param(key)
+        value = params[key]
+        value.is_a?(String) ? value.presence : nil
+      end
+
+      # Whether `destination` is safe to redirect a signed-in user to.
+      # - Same-origin paths ("/foo") pass; protocol-relative ("//evil") does not.
+      # - Same-origin absolute URLs ("https://this-host/...") pass — `store_location_for_redirect`
+      #   stashes `request.url` in session, so callers wrapping `after_authentication_url`
+      #   need same-origin URLs accepted.
+      # - Cross-host URLs pass only when the host has explicitly allow-listed the prefix
+      #   via `StandardId.config.allowed_redirect_url_prefixes`.
+      # - Anything else (blank, absolute URL not in the allow-list, protocol-relative,
+      #   opaque scheme) is rejected; callers should fall back to `safe_post_signin_default`.
+      def safe_destination?(destination)
+        return false if destination.blank?
+        return true if destination.start_with?("/") && !destination.start_with?("//")
+        return true if same_origin_url?(destination)
+
+        Array(StandardId.config.allowed_redirect_url_prefixes).any? do |entry|
+          case entry
+          when Regexp then entry.match?(destination)
+          else destination.start_with?(entry.to_s)
+          end
+        end
+      end
+
+      def same_origin_url?(destination)
+        return false unless destination.start_with?("http://", "https://")
+        URI.parse(destination).origin == URI.parse(request.base_url).origin
+      rescue URI::Error, ArgumentError
+        false
+      end
+
+      def safe_post_signin_default
+        "/"
+      end
     end
   end
 end

data/app/controllers/standard_id/web/consent_controller.rb

@@ -0,0 +1,144 @@
+module StandardId
+  module Web
+    # Renders the OAuth consent screen and records the user's decision.
+    #
+    # The consent screen is authenticated HTML, so it lives on the WebEngine
+    # (full ERB / Inertia stack with `layout "public"`), alongside login. The
+    # API authorize endpoint (ActionController::API, JSON/redirect only) hands
+    # off here with a signed payload of the original /authorize params when a
+    # client has require_consent enabled and no prior grant exists.
+    #
+    # Flow:
+    #   GET  /consent?consent_request=<signed>  -> show the screen
+    #   POST /consent (decision=approve|deny)   -> record + resume, or deny
+    #
+    # On approve we persist a ClientGrant and resume issuing the authorization
+    # code by running the same AuthorizationCodeAuthorizationFlow the API
+    # endpoint would have run — so redirect_uri and PKCE are revalidated here,
+    # not duplicated. On deny we redirect to redirect_uri with
+    # error=access_denied (+ state), per RFC 6749 §4.1.2.1.
+    class ConsentController < BaseController
+      public_controller
+
+      include StandardId::InertiaRendering
+
+      layout "public"
+
+      skip_before_action :require_browser_session!, only: [:show, :create]
+
+      # A bad/expired consent payload or an unknown client must not 500. The
+      # WebEngine doesn't render OAuth errors as JSON (that's the API layer),
+      # so surface a 400 HTML page instead.
+      rescue_from StandardId::OAuthError, with: :handle_consent_error
+
+      before_action :require_authenticated!
+      before_action :load_consent_request
+
+      def show
+        @client = consent_client
+        raise StandardId::InvalidClientError, "Invalid client_id" unless @client
+
+        @scopes = scope_list
+        render_with_inertia props: consent_props
+      end
+
+      def create
+        @client = consent_client
+        raise StandardId::InvalidClientError, "Invalid client_id" unless @client
+
+        if params[:decision].to_s == "approve"
+          approve!
+        else
+          deny!
+        end
+      end
+
+      private
+
+      def require_authenticated!
+        return if current_account.present?
+
+        base_login_url = StandardId.config.login_url.presence || "/login"
+        separator = base_login_url.include?("?") ? "&" : "?"
+        redirect_to "#{base_login_url}#{separator}redirect_uri=#{CGI.escape(request.url)}",
+                    allow_other_host: true, status: :found
+      end
+
+      def load_consent_request
+        @consent_request = StandardId::Oauth::ConsentPayload.decode(params[:consent_request])
+        raise StandardId::InvalidRequestError, "Invalid or expired consent request" if @consent_request.blank?
+      end
+
+      def consent_client
+        @consent_client ||= StandardId::ClientApplication.active.find_by(client_id: @consent_request[:client_id])
+      end
+
+      def approve!
+        StandardId::ClientGrant.record!(
+          account: current_account,
+          client_id: @client.client_id,
+          scope: @consent_request[:scope]
+        )
+
+        result = StandardId::Oauth::AuthorizationCodeAuthorizationFlow
+          .new(@consent_request, request, current_account: current_account)
+          .execute
+
+        redirect_to result[:redirect_to], status: result[:status] || :found, allow_other_host: true
+      end
+
+      def deny!
+        redirect_to denied_redirect_uri, status: :found, allow_other_host: true
+      end
+
+      def denied_redirect_uri
+        base = @consent_request[:redirect_uri].presence || @client.redirect_uris_array.first
+        # Defense-in-depth: only ever redirect to a URI registered on the client.
+        # The authorize endpoint already validates redirect_uri before the consent
+        # hand-off, but re-check here so a deny can never become an open redirect
+        # (and guard the nil case where a client has no registered URIs).
+        unless base.present? && @client.valid_redirect_uri?(base)
+          raise StandardId::InvalidRequestError, "Invalid redirect_uri"
+        end
+
+        params_hash = { error: "access_denied", state: @consent_request[:state] }.compact
+        build_error_redirect(base, params_hash)
+      end
+
+      def build_error_redirect(base_uri, params_hash)
+        uri = URI.parse(base_uri)
+        query = URI.decode_www_form(uri.query || "")
+        params_hash.each { |k, v| query << [k.to_s, v.to_s] if v.present? }
+        uri.query = URI.encode_www_form(query)
+        uri.to_s
+      end
+
+      def consent_props
+        {
+          client: {
+            client_id: @client.client_id,
+            name: @client.name,
+            description: @client.description
+          },
+          scopes: @scopes,
+          consent_request: params[:consent_request],
+          flash: { notice: flash[:notice], alert: flash[:alert] }.compact
+        }
+      end
+
+      def scope_list
+        @consent_request[:scope].to_s.split(/\s+/).map(&:strip).reject(&:blank?)
+      end
+
+      def handle_consent_error(error)
+        @consent_error = error.message
+        if use_inertia?
+          render inertia: inertia_component_name(:error),
+                 props: { error: @consent_error }, status: :bad_request
+        else
+          render :error, status: :bad_request
+        end
+      end
+    end
+  end
+end

data/app/controllers/standard_id/web/login_controller.rb

@@ -31,8 +31,12 @@ module StandardId
       before_action :redirect_if_social_login, only: [:create]
 
       def show
-        @redirect_uri = params[:redirect_uri] || after_authentication_url
+        @redirect_uri = string_param(:redirect_uri) || after_authentication_url
         @connection = params[:connection]
+        # Drive the ERB view's form selection with the same passwordless-first
+        # precedence the #create action uses (passwordless wins when both are on).
+        @passwordless_enabled = passwordless_enabled?
+        @password_enabled = StandardId.config.web.password_login
 
         render_with_inertia props: auth_page_props(passwordless_enabled: passwordless_enabled?)
       end
@@ -59,9 +63,12 @@ module StandardId
         }
 
         if result
-          context = { mechanism: "password", provider: nil }
+          redirect_uri = string_param(:redirect_uri)
+          context = { mechanism: "password", provider: nil, redirect_uri: redirect_uri }
           redirect_override = invoke_after_sign_in(current_account, context)
-          destination = redirect_override || params[:redirect_uri] || after_authentication_url
+          fallback = after_authentication_url
+          fallback = safe_post_signin_default unless safe_destination?(fallback)
+          destination = redirect_override || (safe_destination?(redirect_uri) ? redirect_uri : nil) || fallback
           redirect_to destination, status: :see_other, notice: "Successfully signed in"
         else
           flash.now[:alert] = "Invalid email or password"
@@ -95,7 +102,11 @@ module StandardId
           expires_in: code_ttl.seconds
         )
         session[:standard_id_otp_payload] = signed_payload
-        session[:return_to_after_authenticating] = params[:redirect_uri] if params[:redirect_uri].present?
+        # Use string_param to reject Array/Hash-shaped values — login_verify_controller
+        # consumes this via after_authentication_url and passes it to redirect_to;
+        # storing a non-String here would crash that flow with ArgumentError.
+        redirect_uri = string_param(:redirect_uri)
+        session[:return_to_after_authenticating] = redirect_uri if redirect_uri
 
         redirect_to login_verify_path, status: :see_other
       end

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -60,12 +60,24 @@ module StandardId
           invoke_after_account_created(account, { mechanism: "passwordless", provider: nil })
         end
 
-        context = { mechanism: "passwordless", provider: nil }
+        # Peek (don't pop) session[:return_to_after_authenticating] — after_authentication_url
+        # consumes it below when redirect_override is nil, so deleting it here would lose the
+        # destination for hosts whose after_sign_in hook defers to the originator's redirect_uri.
+        context = {
+          mechanism: "passwordless",
+          provider: nil,
+          redirect_uri: session[:return_to_after_authenticating]
+        }
         redirect_override = invoke_after_sign_in(account, context)
 
         session.delete(:standard_id_otp_payload)
 
-        destination = redirect_override || after_authentication_url
+        # after_authentication_url returns whatever was stashed in
+        # session[:return_to_after_authenticating] — which could be an attacker-controlled
+        # URL set by handle_passwordless_login from params[:redirect_uri]. string_param
+        # blocks Array/Hash but not "https://evil.com/phish". Validate before redirect.
+        fallback = after_authentication_url
+        destination = redirect_override || (safe_destination?(fallback) ? fallback : safe_post_signin_default)
         redirect_to destination, status: :see_other, notice: "Successfully signed in"
       rescue StandardId::AuthenticationDenied => e
         session.delete(:standard_id_otp_payload)

data/app/controllers/standard_id/web/logout_controller.rb

@@ -14,13 +14,18 @@ module StandardId
 
       def create
         revoke_current_session!
-        redirect_to params[:redirect_uri] || root_path, notice: "Successfully signed out"
+        redirect_to logout_destination, notice: "Successfully signed out"
       end
 
       private
 
       def redirect_if_not_authenticated
-        redirect_to params[:redirect_uri] || root_path unless authenticated?
+        redirect_to logout_destination unless authenticated?
+      end
+
+      def logout_destination
+        redirect_uri = string_param(:redirect_uri)
+        safe_destination?(redirect_uri) ? redirect_uri : root_path
       end
     end
   end

data/app/controllers/standard_id/web/signup_controller.rb

@@ -15,7 +15,7 @@ module StandardId
       before_action :redirect_if_social_login, only: [:create]
 
       def show
-        @redirect_uri = params[:redirect_uri] || after_authentication_url
+        @redirect_uri = string_param(:redirect_uri) || after_authentication_url
         @connection = params[:connection] # For social login detection
 
         render_with_inertia props: auth_page_props
@@ -43,12 +43,15 @@ module StandardId
           session_manager.sign_in_account(form.account, scope_name: request.path_parameters[:scope])
           invoke_after_account_created(form.account, { mechanism: "signup", provider: nil })
 
-          context = { mechanism: "password", provider: nil }
+          redirect_uri = string_param(:redirect_uri)
+          context = { mechanism: "password", provider: nil, redirect_uri: redirect_uri }
           redirect_override = invoke_after_sign_in(form.account, context)
-          destination = redirect_override || params[:redirect_uri] || after_authentication_url
+          fallback = after_authentication_url
+          fallback = safe_post_signin_default unless safe_destination?(fallback)
+          destination = redirect_override || (safe_destination?(redirect_uri) ? redirect_uri : nil) || fallback
           redirect_to destination, notice: "Account created successfully"
         else
-          @redirect_uri = params[:redirect_uri] || after_authentication_url
+          @redirect_uri = string_param(:redirect_uri) || after_authentication_url
           @connection = params[:connection]
           flash.now[:alert] = form.errors.full_messages.join(", ")
           render_with_inertia action: :show, props: auth_page_props(errors: form.errors.to_hash), status: :unprocessable_content
@@ -79,7 +82,7 @@ module StandardId
 
       def encode_state
         Base64.urlsafe_encode64({
-          redirect_uri: params[:redirect_uri] || after_authentication_url,
+          redirect_uri: string_param(:redirect_uri) || after_authentication_url,
           timestamp: Time.current.to_i
         }.to_json)
       end

data/app/models/standard_id/client_grant.rb

@@ -0,0 +1,44 @@
+module StandardId
+  # Records a user's prior consent to an OAuth client, so repeat authorizations
+  # for the same (account, client) skip the consent screen. One row per
+  # (account, client); re-approval updates the stored scope.
+  class ClientGrant < ApplicationRecord
+    self.table_name = "standard_id_client_grants"
+
+    belongs_to :account, class_name: StandardId.config.account_class_name
+
+    validates :client_id, presence: true
+    validates :account_id, uniqueness: { scope: :client_id }
+
+    # Whether `account` has already consented to `client_id` covering every
+    # scope token in `requested_scope`. A grant with a nil/blank stored scope
+    # is treated as covering nothing new only when the request also asks for
+    # nothing (blank request) — otherwise the requested tokens must all be a
+    # subset of the previously granted set.
+    def self.granted?(account:, client_id:, requested_scope: nil)
+      return false if account.nil? || client_id.blank?
+
+      grant = find_by(account_id: account.id, client_id: client_id)
+      return false unless grant
+
+      requested = scope_tokens(requested_scope)
+      return true if requested.empty?
+
+      granted = scope_tokens(grant.scope)
+      (requested - granted).empty?
+    end
+
+    # Record (or update) a grant for the given account + client + scope.
+    def self.record!(account:, client_id:, scope: nil)
+      grant = find_or_initialize_by(account_id: account.id, client_id: client_id)
+      grant.scope = scope
+      grant.save!
+      grant
+    end
+
+    def self.scope_tokens(value)
+      value.to_s.split(/\s+/).map(&:strip).reject(&:blank?).uniq
+    end
+    private_class_method :scope_tokens
+  end
+end

data/app/views/standard_id/web/consent/error.html.erb

@@ -0,0 +1,6 @@
+<% content_for :title, "Authorization error" %>
+
+<main>
+  <h1>Authorization error</h1>
+  <p><%= @consent_error.presence || "This authorization request could not be processed." %></p>
+</main>

data/app/views/standard_id/web/consent/show.html.erb

@@ -0,0 +1,35 @@
+<% content_for :title, "Authorize access" %>
+
+<%#
+  OAuth consent screen. Deliberately ASSET-FREE: semantic HTML only, no
+  external images and no reliance on utility CSS, so it renders acceptably
+  under a minimal element-selector layout. Inertia consumers receive the same
+  data as props (see ConsentController#consent_props) and render their own
+  component instead of this ERB.
+%>
+<main>
+  <h1>Authorize access</h1>
+
+  <p>
+    <strong><%= @client.name %></strong> is requesting access to your account.
+  </p>
+
+  <% if @client.description.present? %>
+    <p><%= @client.description %></p>
+  <% end %>
+
+  <% if @scopes.any? %>
+    <p>This will grant the following:</p>
+    <ul>
+      <% @scopes.each do |scope| %>
+        <li><%= scope %></li>
+      <% end %>
+    </ul>
+  <% end %>
+
+  <%= form_with url: consent_path, method: :post, local: true do |form| %>
+    <%= form.hidden_field :consent_request, value: params[:consent_request] %>
+    <button type="submit" name="decision" value="approve">Approve</button>
+    <button type="submit" name="decision" value="deny">Deny</button>
+  <% end %>
+</main>

data/app/views/standard_id/web/login/_social_buttons.html.erb

@@ -0,0 +1,23 @@
+<%#
+  Asset-free social login buttons for the passwordless / no-method branches.
+  Semantic HTML only — no Tailwind utility classes — so it renders under a
+  minimal element-selector layout. Each provider posts to login_path with a
+  hidden `connection`, triggering LoginController#create's social branch.
+%>
+<section aria-label="Other sign-in options">
+  <p>Or continue with</p>
+  <% if StandardId.config.google_client_id.present? %>
+    <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
+      <%= form.hidden_field :connection, value: "google" %>
+      <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+      <button type="submit">Google</button>
+    <% end %>
+  <% end %>
+  <% if StandardId.config.apple_client_id.present? %>
+    <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
+      <%= form.hidden_field :connection, value: "apple" %>
+      <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+      <button type="submit">Apple</button>
+    <% end %>
+  <% end %>
+</section>

data/app/views/standard_id/web/login/show.html.erb

@@ -1,108 +1,163 @@
 <% content_for :title, "Sign In" %>
 
-<div class="flex min-h-full flex-col justify-center py-12 sm:px-6 lg:px-8">
-  <div class="sm:mx-auto sm:w-full sm:max-w-md">
-    <img src="https://tailwindcss.com/plus-assets/img/logos/mark.svg?color=indigo&shade=600" alt="Your Company" class="mx-auto h-10 w-auto dark:hidden" />
-    <img src="https://tailwindcss.com/plus-assets/img/logos/mark.svg?color=indigo&shade=500" alt="Your Company" class="mx-auto hidden h-10 w-auto dark:block" />
-    <h2 class="mt-6 text-center text-2xl/9 font-bold tracking-tight text-gray-900 dark:text-white">Sign in to your account</h2>
-  </div>
+<% if @passwordless_enabled %>
+  <%#
+    Passwordless-first branch (matches LoginController#create precedence).
+    Deliberately ASSET-FREE: semantic HTML only, no external tailwindcss.com
+    logo image and no reliance on Tailwind utility classes, so it renders
+    acceptably under a minimal element-selector layout (e.g. layouts/public).
+  %>
+  <main>
+    <h1>Sign in to your account</h1>
+
+    <% if flash[:alert].present? %>
+      <p role="alert"><%= flash[:alert] %></p>
+    <% end %>
+    <% if flash[:notice].present? %>
+      <p role="status"><%= flash[:notice] %></p>
+    <% end %>
+
+    <%= form_with url: login_path, method: :post, local: true do |form| %>
+      <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+
+      <p>
+        <%= form.label :email, "Email address" %><br />
+        <%= form.email_field "login[email]", required: true, autofocus: true, autocomplete: "email" %>
+      </p>
 
-  <div class="mt-10 sm:mx-auto sm:w-full sm:max-w-[480px]">
-    <div class="bg-white px-6 py-12 shadow sm:rounded-lg sm:px-12 dark:bg-gray-800/50 dark:shadow-none dark:outline dark:outline-1 dark:-outline-offset-1 dark:outline-white/10">
+      <p>
+        <%= form.submit "Continue" %>
+      </p>
+    <% end %>
 
-      <% if flash[:alert].present? %>
-        <div class="mb-4 rounded-md bg-red-50 p-4 text-sm text-red-700 dark:bg-red-900/20 dark:text-red-300"><%= flash[:alert] %></div>
-      <% end %>
-      <% if flash[:notice].present? %>
-        <div class="mb-4 rounded-md bg-green-50 p-4 text-sm text-green-700 dark:bg-green-900/20 dark:text-green-300"><%= flash[:notice] %></div>
-      <% end %>
+    <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+      <%= render "standard_id/web/login/social_buttons" %>
+    <% end %>
 
-      <%= form_with url: login_path, method: :post, local: true, html: { class: "space-y-6" } do |form| %>
-        <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+    <p>
+      Not a member?
+      <%= link_to "Sign up", signup_path(redirect_uri: @redirect_uri) %>
+    </p>
+  </main>
+
+<% elsif @password_enabled %>
+  <%# Password branch — markup/styling intentionally UNCHANGED so existing
+      ERB consumers (e.g. nutripod) are unaffected. %>
+  <div class="flex min-h-full flex-col justify-center py-12 sm:px-6 lg:px-8">
+    <div class="sm:mx-auto sm:w-full sm:max-w-md">
+      <img src="https://tailwindcss.com/plus-assets/img/logos/mark.svg?color=indigo&shade=600" alt="Your Company" class="mx-auto h-10 w-auto dark:hidden" />
+      <img src="https://tailwindcss.com/plus-assets/img/logos/mark.svg?color=indigo&shade=500" alt="Your Company" class="mx-auto hidden h-10 w-auto dark:block" />
+      <h2 class="mt-6 text-center text-2xl/9 font-bold tracking-tight text-gray-900 dark:text-white">Sign in to your account</h2>
+    </div>
 
-        <div>
-          <%= form.label :email, "Email address", class: "block text-sm/6 font-medium text-gray-900 dark:text-white" %>
-          <div class="mt-2">
-            <%= form.email_field "login[email]", required: true, autofocus: true, autocomplete: "email", class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
+    <div class="mt-10 sm:mx-auto sm:w-full sm:max-w-[480px]">
+      <div class="bg-white px-6 py-12 shadow sm:rounded-lg sm:px-12 dark:bg-gray-800/50 dark:shadow-none dark:outline dark:outline-1 dark:-outline-offset-1 dark:outline-white/10">
+
+        <% if flash[:alert].present? %>
+          <div class="mb-4 rounded-md bg-red-50 p-4 text-sm text-red-700 dark:bg-red-900/20 dark:text-red-300"><%= flash[:alert] %></div>
+        <% end %>
+        <% if flash[:notice].present? %>
+          <div class="mb-4 rounded-md bg-green-50 p-4 text-sm text-green-700 dark:bg-green-900/20 dark:text-green-300"><%= flash[:notice] %></div>
+        <% end %>
+
+        <%= form_with url: login_path, method: :post, local: true, html: { class: "space-y-6" } do |form| %>
+          <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+
+          <div>
+            <%= form.label :email, "Email address", class: "block text-sm/6 font-medium text-gray-900 dark:text-white" %>
+            <div class="mt-2">
+              <%= form.email_field "login[email]", required: true, autofocus: true, autocomplete: "email", class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
+            </div>
           </div>
-        </div>
 
-        <div>
-          <%= form.label :password, "Password", class: "block text-sm/6 font-medium text-gray-900 dark:text-white" %>
-          <div class="mt-2">
-            <%= form.password_field "login[password]", required: true, autocomplete: "current-password", class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
+          <div>
+            <%= form.label :password, "Password", class: "block text-sm/6 font-medium text-gray-900 dark:text-white" %>
+            <div class="mt-2">
+              <%= form.password_field "login[password]", required: true, autocomplete: "current-password", class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
+            </div>
           </div>
-        </div>
-
-        <div class="flex items-center justify-between">
-          <div class="flex gap-3">
-            <div class="flex h-6 shrink-0 items-center">
-              <div class="group grid size-4 grid-cols-1">
-                <%= form.check_box "login[remember_me]", id: "remember-me", class: "col-start-1 row-start-1 appearance-none rounded border border-gray-300 bg-white checked:border-indigo-600 checked:bg-indigo-600 indeterminate:border-indigo-600 indeterminate:bg-indigo-600 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 disabled:border-gray-300 disabled:bg-gray-100 disabled:checked:bg-gray-100 dark:border-white/10 dark:bg-white/5 dark:checked:border-indigo-500 dark:checked:bg-indigo-500 dark:indeterminate:border-indigo-500 dark:indeterminate:bg-indigo-500 dark:focus-visible:outline-indigo-500 forced-colors:appearance-auto" %>
-                <svg viewBox="0 0 14 14" fill="none" class="pointer-events-none col-start-1 row-start-1 size-3.5 self-center justify-self-center stroke-white group-has-[:disabled]:stroke-gray-950/25 dark:group-has-[:disabled]:stroke-white/25">
-                  <path d="M3 8L6 11L11 3.5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="opacity-0 group-has-[:checked]:opacity-100" />
-                  <path d="M3 7H11" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="opacity-0 group-has-[:indeterminate]:opacity-100" />
-                </svg>
+
+          <div class="flex items-center justify-between">
+            <div class="flex gap-3">
+              <div class="flex h-6 shrink-0 items-center">
+                <div class="group grid size-4 grid-cols-1">
+                  <%= form.check_box "login[remember_me]", id: "remember-me", class: "col-start-1 row-start-1 appearance-none rounded border border-gray-300 bg-white checked:border-indigo-600 checked:bg-indigo-600 indeterminate:border-indigo-600 indeterminate:bg-indigo-600 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 disabled:border-gray-300 disabled:bg-gray-100 disabled:checked:bg-gray-100 dark:border-white/10 dark:bg-white/5 dark:checked:border-indigo-500 dark:checked:bg-indigo-500 dark:indeterminate:border-indigo-500 dark:indeterminate:bg-indigo-500 dark:focus-visible:outline-indigo-500 forced-colors:appearance-auto" %>
+                  <svg viewBox="0 0 14 14" fill="none" class="pointer-events-none col-start-1 row-start-1 size-3.5 self-center justify-self-center stroke-white group-has-[:disabled]:stroke-gray-950/25 dark:group-has-[:disabled]:stroke-white/25">
+                    <path d="M3 8L6 11L11 3.5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="opacity-0 group-has-[:checked]:opacity-100" />
+                    <path d="M3 7H11" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="opacity-0 group-has-[:indeterminate]:opacity-100" />
+                  </svg>
+                </div>
               </div>
+              <label for="remember-me" class="block text-sm/6 text-gray-900 dark:text-white">Remember me</label>
             </div>
-            <label for="remember-me" class="block text-sm/6 text-gray-900 dark:text-white">Remember me</label>
-          </div>
 
-          <div class="text-sm/6">
-            <%= link_to "Forgot password?", reset_password_start_path, class: "font-semibold text-indigo-600 hover:text-indigo-500 dark:text-indigo-400 dark:hover:text-indigo-300" %>
+            <div class="text-sm/6">
+              <%= link_to "Forgot password?", reset_password_start_path, class: "font-semibold text-indigo-600 hover:text-indigo-500 dark:text-indigo-400 dark:hover:text-indigo-300" %>
+            </div>
           </div>
-        </div>
-
-        <div>
-          <%= form.submit "Sign in", class: "flex w-full justify-center rounded-md bg-indigo-600 px-3 py-1.5 text-sm/6 font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 dark:bg-indigo-500 dark:shadow-none dark:hover:bg-indigo-400 dark:focus-visible:outline-indigo-500" %>
-        </div>
-      <% end %>
-
-      <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
-        <div>
-          <div class="mt-10 flex items-center gap-x-6">
-            <div class="w-full flex-1 border-t border-gray-200 dark:border-white/10"></div>
-            <p class="text-nowrap text-sm/6 font-medium text-gray-900 dark:text-white">Or continue with</p>
-            <div class="w-full flex-1 border-t border-gray-200 dark:border-white/10"></div>
+
+          <div>
+            <%= form.submit "Sign in", class: "flex w-full justify-center rounded-md bg-indigo-600 px-3 py-1.5 text-sm/6 font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 dark:bg-indigo-500 dark:shadow-none dark:hover:bg-indigo-400 dark:focus-visible:outline-indigo-500" %>
           </div>
+        <% end %>
 
-          <div class="mt-6 grid grid-cols-2 gap-4">
-            <% if StandardId.config.google_client_id.present? %>
-              <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
-                <%= form.hidden_field :connection, value: "google" %>
-                <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
-                <button type="submit" class="flex w-full items-center justify-center gap-3 rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50 focus-visible:ring-transparent dark:bg-white/10 dark:text-white dark:shadow-none dark:ring-white/5 dark:hover:bg-white/20">
-                  <svg viewBox="0 0 24 24" aria-hidden="true" class="h-5 w-5">
-                    <path d="M12.0003 4.75C13.7703 4.75 15.3553 5.36002 16.6053 6.54998L20.0303 3.125C17.9502 1.19 15.2353 0 12.0003 0C7.31028 0 3.25527 2.69 1.28027 6.60998L5.27028 9.70498C6.21525 6.86002 8.87028 4.75 12.0003 4.75Z" fill="#EA4335" />
-                    <path d="M23.49 12.275C23.49 11.49 23.415 10.73 23.3 10H12V14.51H18.47C18.18 15.99 17.34 17.25 16.08 18.1L19.945 21.1C22.2 19.01 23.49 15.92 23.49 12.275Z" fill="#4285F4" />
-                    <path d="M5.26498 14.2949C5.02498 13.5699 4.88501 12.7999 4.88501 11.9999C4.88501 11.1999 5.01998 10.4299 5.26498 9.7049L1.275 6.60986C0.46 8.22986 0 10.0599 0 11.9999C0 13.9399 0.46 15.7699 1.28 17.3899L5.26498 14.2949Z" fill="#FBBC05" />
-                    <path d="M12.0004 24.0001C15.2404 24.0001 17.9654 22.935 19.9454 21.095L16.0804 18.095C15.0054 18.82 13.6204 19.245 12.0004 19.245C8.8704 19.245 6.21537 17.135 5.2654 14.29L1.27539 17.385C3.25539 21.31 7.3104 24.0001 12.0004 24.0001Z" fill="#34A853" />
-                  </svg>
-                  <span class="text-sm/6 font-semibold">Google</span>
-                </button>
+        <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+          <div>
+            <div class="mt-10 flex items-center gap-x-6">
+              <div class="w-full flex-1 border-t border-gray-200 dark:border-white/10"></div>
+              <p class="text-nowrap text-sm/6 font-medium text-gray-900 dark:text-white">Or continue with</p>
+              <div class="w-full flex-1 border-t border-gray-200 dark:border-white/10"></div>
+            </div>
+
+            <div class="mt-6 grid grid-cols-2 gap-4">
+              <% if StandardId.config.google_client_id.present? %>
+                <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
+                  <%= form.hidden_field :connection, value: "google" %>
+                  <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+                  <button type="submit" class="flex w-full items-center justify-center gap-3 rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50 focus-visible:ring-transparent dark:bg-white/10 dark:text-white dark:shadow-none dark:ring-white/5 dark:hover:bg-white/20">
+                    <svg viewBox="0 0 24 24" aria-hidden="true" class="h-5 w-5">
+                      <path d="M12.0003 4.75C13.7703 4.75 15.3553 5.36002 16.6053 6.54998L20.0303 3.125C17.9502 1.19 15.2353 0 12.0003 0C7.31028 0 3.25527 2.69 1.28027 6.60998L5.27028 9.70498C6.21525 6.86002 8.87028 4.75 12.0003 4.75Z" fill="#EA4335" />
+                      <path d="M23.49 12.275C23.49 11.49 23.415 10.73 23.3 10H12V14.51H18.47C18.18 15.99 17.34 17.25 16.08 18.1L19.945 21.1C22.2 19.01 23.49 15.92 23.49 12.275Z" fill="#4285F4" />
+                      <path d="M5.26498 14.2949C5.02498 13.5699 4.88501 12.7999 4.88501 11.9999C4.88501 11.1999 5.01998 10.4299 5.26498 9.7049L1.275 6.60986C0.46 8.22986 0 10.0599 0 11.9999C0 13.9399 0.46 15.7699 1.28 17.3899L5.26498 14.2949Z" fill="#FBBC05" />
+                      <path d="M12.0004 24.0001C15.2404 24.0001 17.9654 22.935 19.9454 21.095L16.0804 18.095C15.0054 18.82 13.6204 19.245 12.0004 19.245C8.8704 19.245 6.21537 17.135 5.2654 14.29L1.27539 17.385C3.25539 21.31 7.3104 24.0001 12.0004 24.0001Z" fill="#34A853" />
+                    </svg>
+                    <span class="text-sm/6 font-semibold">Google</span>
+                  </button>
+                <% end %>
               <% end %>
-            <% end %>
-
-            <% if StandardId.config.apple_client_id.present? %>
-              <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
-                <%= form.hidden_field :connection, value: "apple" %>
-                <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
-                <button type="submit" class="flex w-full items-center justify-center gap-3 rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50 focus-visible:ring-transparent dark:bg-white/10 dark:text-white dark:shadow-none dark:ring-white/5 dark:hover:bg-white/20">
-                  <svg viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" class="size-5 fill-[#24292F] dark:fill-white">
-                    <path d="M10 0C4.477 0 0 4.484 0 10.017c0 4.425 2.865 8.18 6.839 9.504.5.092.682-.217.682-.483 0-.237-.008-.868-.013-1.703-2.782.605-3.369-1.343-3.369-1.343-.454-1.158-1.11-1.466-1.11-1.466-.908-.62.069-.608.069-.608 1.003.07 1.531 1.032 1.531 1.032.892 1.53 2.341 1.088 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.113-4.555-4.951 0-1.093.39-1.988 1.029-2.688-.103-.253-.446-1.272.098-2.65 0 0 .84-.27 2.75 1.026A9.564 9.564 0 0110 4.844c.85.004 1.705.115 2.504.337 1.909-1.296 2.747-1.027 2.747-1.027.546 1.379.203 2.398.1 2.651.64.7 1.028 1.595 1.028 2.688 0 3.848-2.339 4.695-4.566 4.942.359.31.678.921.678 1.856 0 1.338-.012 2.419-.012 2.747 0 .268.18.58.688.482A10.019 10.019 0 0020 10.017C20 4.484 15.522 0 10 0z" clip-rule="evenodd" fill-rule="evenodd" />
-                  </svg>
-                  <span class="text-sm/6 font-semibold">Apple</span>
-                </button>
+
+              <% if StandardId.config.apple_client_id.present? %>
+                <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
+                  <%= form.hidden_field :connection, value: "apple" %>
+                  <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+                  <button type="submit" class="flex w-full items-center justify-center gap-3 rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50 focus-visible:ring-transparent dark:bg-white/10 dark:text-white dark:shadow-none dark:ring-white/5 dark:hover:bg-white/20">
+                    <svg viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" class="size-5 fill-[#24292F] dark:fill-white">
+                      <path d="M10 0C4.477 0 0 4.484 0 10.017c0 4.425 2.865 8.18 6.839 9.504.5.092.682-.217.682-.483 0-.237-.008-.868-.013-1.703-2.782.605-3.369-1.343-3.369-1.343-.454-1.158-1.11-1.466-1.11-1.466-.908-.62.069-.608.069-.608 1.003.07 1.531 1.032 1.531 1.032.892 1.53 2.341 1.088 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.113-4.555-4.951 0-1.093.39-1.988 1.029-2.688-.103-.253-.446-1.272.098-2.65 0 0 .84-.27 2.75 1.026A9.564 9.564 0 0110 4.844c.85.004 1.705.115 2.504.337 1.909-1.296 2.747-1.027 2.747-1.027.546 1.379.203 2.398.1 2.651.64.7 1.028 1.595 1.028 2.688 0 3.848-2.339 4.695-4.566 4.942.359.31.678.921.678 1.856 0 1.338-.012 2.419-.012 2.747 0 .268.18.58.688.482A10.019 10.019 0 0020 10.017C20 4.484 15.522 0 10 0z" clip-rule="evenodd" fill-rule="evenodd" />
+                    </svg>
+                    <span class="text-sm/6 font-semibold">Apple</span>
+                  </button>
+                <% end %>
               <% end %>
-            <% end %>
+            </div>
           </div>
-        </div>
-      <% end %>
-    </div>
+        <% end %>
+      </div>
 
-    <p class="mt-10 text-center text-sm/6 text-gray-500 dark:text-gray-400">
-      Not a member?
-      <%= link_to "Sign up", signup_path(redirect_uri: @redirect_uri), class: "font-semibold text-indigo-600 hover:text-indigo-500 dark:text-indigo-400 dark:hover:text-indigo-300" %>
-    </p>
+      <p class="mt-10 text-center text-sm/6 text-gray-500 dark:text-gray-400">
+        Not a member?
+        <%= link_to "Sign up", signup_path(redirect_uri: @redirect_uri), class: "font-semibold text-indigo-600 hover:text-indigo-500 dark:text-indigo-400 dark:hover:text-indigo-300" %>
+      </p>
+    </div>
   </div>
-</div>
+
+<% else %>
+  <%# Neither password nor passwordless login is enabled — render a message
+      instead of crashing. Social login (if configured) is still offered. %>
+  <main>
+    <h1>Sign in</h1>
+    <p>No login method is enabled.</p>
+    <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+      <%= render "standard_id/web/login/social_buttons" %>
+    <% end %>
+  </main>
+<% end %>

data/config/routes/api.rb

@@ -26,6 +26,7 @@ StandardId::ApiEngine.routes.draw do
     scope ".well-known", module: :well_known do
       get "jwks.json", to: "jwks#show", as: :jwks
       get "openid-configuration", to: "openid_configuration#show", as: :openid_configuration
+      get "oauth-authorization-server", to: "oauth_authorization_server#show", as: :oauth_authorization_server
     end
   end
 end

data/config/routes/web.rb

@@ -2,6 +2,11 @@ StandardId::WebEngine.routes.draw do
   scope module: :web do
     # Authentication flows
     resource :login, only: [:show, :create], controller: :login
+
+    # OAuth consent screen (authenticated HTML). The API authorize endpoint
+    # hands off here with a signed payload when a client requires consent.
+    resource :consent, only: [:show, :create], controller: :consent
+
     resource :login_verify, only: [:show, :update], controller: :login_verify
     resource :logout, only: [:create], controller: :logout
     resource :signup, only: [:show, :create], controller: :signup

data/db/migrate/20260611000000_create_standard_id_client_grants.rb

@@ -0,0 +1,23 @@
+class CreateStandardIdClientGrants < ActiveRecord::Migration[8.0]
+  def change
+    create_table :standard_id_client_grants, id: primary_key_type do |t|
+      # The account that granted consent. Required — consent is per-user.
+      t.references :account, null: false, foreign_key: true, index: true, type: foreign_key_type
+
+      # The OAuth client the consent was granted to. Stored as client_id (the
+      # public identifier) to mirror authorization_codes' client binding.
+      t.string :client_id, null: false
+
+      # The space-delimited scope string the user approved. Lets a future
+      # change require re-consent when a client requests a broader scope than
+      # was previously granted.
+      t.string :scope
+
+      t.timestamps
+
+      # One active grant per (account, client). Re-approving updates the row.
+      t.index [:account_id, :client_id], unique: true, name: "idx_standard_id_client_grants_on_account_client"
+      t.index :client_id
+    end
+  end
+end

data/lib/standard_id/oauth/authorization_code_authorization_flow.rb

@@ -1,8 +1,13 @@
 module StandardId
   module Oauth
     class AuthorizationCodeAuthorizationFlow < AuthorizationFlow
-      expect_params :client_id, :audience
-      permit_params :scope, :redirect_uri, :state, :connection, :prompt, :organization, :invitation, :code_challenge, :code_challenge_method, :nonce
+      expect_params :client_id
+      # :audience is optional (RFC 6749 / RFC 8707 §2 treats `resource`/`audience`
+      # as OPTIONAL at /authorize). Token-time validation in
+      # TokenGrantFlow#validate_audience! already no-ops when audience is blank or
+      # when no allowed_audiences are configured, so omitting it is safe and lets
+      # standards-compliant clients (e.g. MCP) authorize without it.
+      permit_params :audience, :scope, :redirect_uri, :state, :connection, :prompt, :organization, :invitation, :code_challenge, :code_challenge_method, :nonce
 
       private
 

data/lib/standard_id/oauth/consent_payload.rb

@@ -0,0 +1,36 @@
+module StandardId
+  module Oauth
+    # Tamper-proof carrier for the original /authorize parameters across the
+    # consent hand-off (API authorize -> WebEngine consent screen -> resume).
+    #
+    # Mirrors the OTP flow's use of Rails.application.message_verifier: the
+    # params are signed (not encrypted — they are not secret, but must not be
+    # mutable by the user) and expire so a stale consent link can't be replayed
+    # indefinitely. redirect_uri and PKCE are revalidated when the resumed
+    # /authorize re-runs, so signing here defends the integrity of the carried
+    # values, not the eventual code issuance.
+    module ConsentPayload
+      VERIFIER_PURPOSE = :standard_id_oauth_consent
+      # Generous TTL: the user may take a while to read the consent screen.
+      DEFAULT_EXPIRY = 600 # seconds (10 minutes)
+
+      module_function
+
+      def encode(params, expires_in: DEFAULT_EXPIRY)
+        verifier.generate(params.to_h.symbolize_keys, expires_in: expires_in.seconds)
+      end
+
+      # Returns the params Hash (symbolized keys) or nil if the payload is
+      # missing, tampered, or expired.
+      def decode(token)
+        return nil if token.blank?
+
+        verifier.verified(token)&.symbolize_keys
+      end
+
+      def verifier
+        Rails.application.message_verifier(VERIFIER_PURPOSE)
+      end
+    end
+  end
+end

data/lib/standard_id/oauth/discovery_document.rb

@@ -0,0 +1,53 @@
+module StandardId
+  module Oauth
+    # Shared builder for the OIDC / OAuth 2.0 metadata documents served at:
+    #   * /.well-known/openid-configuration   (OpenID Connect Discovery)
+    #   * /.well-known/oauth-authorization-server (RFC 8414)
+    #
+    # Both well-known controllers render this single builder so the two
+    # documents cannot drift. Endpoint URLs are derived from the configured
+    # issuer.
+    #
+    # NOTE on mounting (RFC 8414 caveat): the ApiEngine is consumer-mounted at
+    # a sub-path (e.g. `/auth/api`), so the gem can only serve
+    # `/auth/api/.well-known/oauth-authorization-server`. A strict RFC 8414
+    # client that derives a *root-anchored* metadata URL from a path-carrying
+    # issuer would probe `<host>/.well-known/oauth-authorization-server/auth/api`,
+    # which falls outside any engine mount. Hosts that need the root-anchored
+    # form must add their own root route — the gem cannot.
+    module DiscoveryDocument
+      module_function
+
+      # @param issuer [String] the configured issuer (e.g. "https://auth.example.com")
+      # @param registration_enabled [Boolean] when true, advertises the RFC 7591
+      #   dynamic client registration endpoint. Defaults to false; the seam is
+      #   kept here so Phase 2 (DCR) can flip it on via config without touching
+      #   either controller. While false, no registration_endpoint is emitted.
+      # @return [Hash]
+      def build(issuer, registration_enabled: false)
+        base = issuer.to_s.chomp("/")
+
+        doc = {
+          issuer: issuer,
+          authorization_endpoint: "#{base}/authorize",
+          token_endpoint: "#{base}/oauth/token",
+          revocation_endpoint: "#{base}/oauth/revoke",
+          userinfo_endpoint: "#{base}/userinfo",
+          jwks_uri: "#{base}/.well-known/jwks.json",
+          response_types_supported: %w[code],
+          grant_types_supported: %w[authorization_code refresh_token client_credentials],
+          subject_types_supported: %w[public],
+          id_token_signing_alg_values_supported: [StandardId.config.oauth.signing_algorithm.to_s.upcase],
+          token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post],
+          # PKCE is always enforced (require_pkce defaults true and cannot be
+          # disabled for public clients), so advertise the supported method.
+          code_challenge_methods_supported: %w[S256]
+        }
+
+        doc[:registration_endpoint] = "#{base}/oauth/register" if registration_enabled
+
+        doc
+      end
+    end
+  end
+end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.20.0"
+  VERSION = "0.21.0"
 end

data/lib/standard_id.rb

@@ -44,6 +44,8 @@ require "standard_id/oauth/subflows/base"
 require "standard_id/oauth/subflows/traditional_code_grant"
 require "standard_id/oauth/subflows/social_login_grant"
 require "standard_id/oauth/passwordless_otp_flow"
+require "standard_id/oauth/discovery_document"
+require "standard_id/oauth/consent_payload"
 require "standard_id/passwordless/base_strategy"
 require "standard_id/passwordless/email_strategy"
 require "standard_id/passwordless/sms_strategy"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.21.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -108,7 +108,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- MIT-LICENSE
+- LICENSE
 - README.md
 - Rakefile
 - app/assets/stylesheets/standard_id/application.css
@@ -139,10 +139,12 @@ files:
 - app/controllers/standard_id/api/sessions_controller.rb
 - app/controllers/standard_id/api/userinfo_controller.rb
 - app/controllers/standard_id/api/well_known/jwks_controller.rb
+- app/controllers/standard_id/api/well_known/oauth_authorization_server_controller.rb
 - app/controllers/standard_id/api/well_known/openid_configuration_controller.rb
 - app/controllers/standard_id/web/account_controller.rb
 - app/controllers/standard_id/web/auth/callback/providers_controller.rb
 - app/controllers/standard_id/web/base_controller.rb
+- app/controllers/standard_id/web/consent_controller.rb
 - app/controllers/standard_id/web/login_controller.rb
 - app/controllers/standard_id/web/login_verify_controller.rb
 - app/controllers/standard_id/web/logout_controller.rb
@@ -176,6 +178,7 @@ files:
 - app/models/standard_id/authorization_code.rb
 - app/models/standard_id/browser_session.rb
 - app/models/standard_id/client_application.rb
+- app/models/standard_id/client_grant.rb
 - app/models/standard_id/client_secret_credential.rb
 - app/models/standard_id/code_challenge.rb
 - app/models/standard_id/credential.rb
@@ -195,6 +198,9 @@ files:
 - app/views/standard_id/web/account/edit.html.erb
 - app/views/standard_id/web/account/show.html.erb
 - app/views/standard_id/web/auth/callback/providers/mobile_callback.html.erb
+- app/views/standard_id/web/consent/error.html.erb
+- app/views/standard_id/web/consent/show.html.erb
+- app/views/standard_id/web/login/_social_buttons.html.erb
 - app/views/standard_id/web/login/show.html.erb
 - app/views/standard_id/web/login_verify/show.html.erb
 - app/views/standard_id/web/reset_password/confirm/show.html.erb
@@ -219,6 +225,7 @@ files:
 - db/migrate/20260311100001_add_nullify_to_refresh_token_previous_token_fk.rb
 - db/migrate/20260414200000_add_target_created_at_index_to_code_challenges.rb
 - db/migrate/20260416180511_add_partial_indexes_for_active_session_and_challenge_lookups.rb
+- db/migrate/20260611000000_create_standard_id_client_grants.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/standard_id.rb
@@ -254,6 +261,8 @@ files:
 - lib/standard_id/oauth/authorization_flow.rb
 - lib/standard_id/oauth/base_request_flow.rb
 - lib/standard_id/oauth/client_credentials_flow.rb
+- lib/standard_id/oauth/consent_payload.rb
+- lib/standard_id/oauth/discovery_document.rb
 - lib/standard_id/oauth/implicit_authorization_flow.rb
 - lib/standard_id/oauth/oauth_session_persistence.rb
 - lib/standard_id/oauth/password_flow.rb