standard_id 0.22.0 → 0.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7caed55f6e5f6f70b01a7e79dabdc5ad9ddd646535f8c10bbde93158c65e32d9
-  data.tar.gz: 7ca5e3b573b3718e722eb047f14eefffab20263ee374d23f706f278878bcc640
+  metadata.gz: 96bb41b62e41b340083b98a19c91913d8a1342a1895150d68595cba6a576d039
+  data.tar.gz: b85e690728fad61be9a1ab5fa047096cf3db2b97bea9b9403774cd53895216f6
 SHA512:
-  metadata.gz: c68adc74ec092631a1af808cc61ea1d2d8adeb72dbaa70588cd4069edd71b94d57e6ed33f5a9fc5ca4104def616b779e9bbe44f3c9b61e9a861ebdee1eadc946
-  data.tar.gz: 6f10a9a4916737e870798e38c96c53e7767fcf9c4e538bd5c0ca0ee43d21843ec3dff838ee384d1acb6d68336655165fc43cf970e3e8a4e65e5e75cba32fd51f
+  metadata.gz: 4bebc333835970bebc067517014364dce32cfa6f3d9165a64aa7b82f3464f5862439c9fd7e40d73ae6d79a478490abe749609804c168d9ae8669d29e7d6d861e
+  data.tar.gz: 23a59d0a655a3d933ed953923ce5f2c4f63240543b06f094faa182366c6d147e27b769c6c6230821d0a1c60501399ac7569296840255403b95953faf37a5ba8b

data/app/controllers/standard_id/api/oauth/callback/providers_controller.rb

@@ -19,7 +19,7 @@ module StandardId
         ].freeze
 
         def callback
-          provider_response = get_user_info_from_provider(flow: resolve_flow_for(provider.provider_name))
+          provider_response = fetch_provider_user_info
           social_info = provider_response[:user_info]
           provider_tokens = provider_response[:tokens]
           account = find_or_create_account_from_social(social_info)
@@ -45,6 +45,22 @@ module StandardId
 
         private
 
+        # Mirror of the web callback's OAuthError handling: emit
+        # SOCIAL_AUTH_FAILED for infrastructure-level provider failures
+        # (HTTP/DNS/SSL/timeouts surfaced as OAuthError by provider
+        # implementations) so host apps can observe provider outages on the
+        # API flow too. Scoped to the provider call — OAuthError subclasses
+        # raised later in the flow (SocialLinkError, InvalidRequestError,
+        # ...) are policy/client errors, not infrastructure failures, and
+        # must not emit. The error re-raises into the standard
+        # handle_oauth_error JSON response.
+        def fetch_provider_user_info
+          get_user_info_from_provider(flow: resolve_flow_for(provider.provider_name))
+        rescue StandardId::OAuthError => e
+          emit_social_auth_failed(e)
+          raise
+        end
+
         def resolve_flow_for(connection)
           return :mobile unless connection == "apple"
 

data/app/controllers/standard_id/api/oauth/tokens_controller.rb

@@ -21,6 +21,7 @@ module StandardId
         }.freeze
 
         before_action :extract_client_credentials_from_basic_auth
+        before_action :enforce_per_audience_rate_limit, only: :create
 
         def create
           response_data = flow_strategy_class.new(flow_strategy_params, request).execute
@@ -29,6 +30,31 @@ module StandardId
 
         private
 
+        # Per-audience tightening on top of the global api_token_per_ip
+        # ceiling (rate_limits.api_token_per_audience_per_ip). Hand-rolled
+        # rather than the Rails rate_limit DSL on purpose: the DSL counts
+        # every request that reaches the action — a `by:` block returning nil
+        # does NOT exempt a request, it collapses into a shared bucket keyed
+        # without the discriminator (["rate-limit", scope, name, nil].compact),
+        # so one audience's rule would throttle every other audience's
+        # traffic. Here only requests that target a configured audience
+        # increment that audience's per-IP counter.
+        def enforce_per_audience_rate_limit
+          limits = StandardId.config.rate_limits.api_token_per_audience_per_ip
+          return if limits.blank?
+
+          Array(params[:audience]).each do |audience|
+            next unless audience.is_a?(String)
+
+            cap = limits[audience] || limits[audience.to_sym]
+            next if cap.blank?
+
+            cache_key = "rate-limit:#{self.class.controller_path}:api_token_per_audience:#{audience}:#{request.remote_ip}"
+            count = StandardId::RateLimitHandling::RATE_LIMIT_STORE.increment(cache_key, 1, expires_in: 15.minutes)
+            raise ActionController::TooManyRequests if count && count > cap.to_i
+          end
+        end
+
         # Support HTTP Basic authentication for client credentials (RFC 6749 Section 2.3.1)
         def extract_client_credentials_from_basic_auth
           auth_header = request.headers["Authorization"]

data/app/controllers/standard_id/web/consent_controller.rb

@@ -84,11 +84,26 @@ module StandardId
           .new(@consent_request, request, current_account: current_account)
           .execute
 
-        redirect_to result[:redirect_to], status: result[:status] || :found, allow_other_host: true
+        redirect_out(result[:redirect_to], status: result[:status] || :found)
       end
 
       def deny!
-        redirect_to denied_redirect_uri, status: :found, allow_other_host: true
+        redirect_out(denied_redirect_uri, status: :found)
+      end
+
+      # Redirect to the OAuth client's (external) redirect_uri in a way that
+      # works for BOTH plain-browser and Inertia consumers of the consent
+      # screen. An Inertia visit is an XHR — it cannot follow a 302 to a
+      # non-Inertia, cross-origin URL (the browser stays on the consent page),
+      # so for Inertia requests we emit an Inertia-Location (409 +
+      # X-Inertia-Location) which the client turns into a hard `window.location`
+      # navigation. Plain (ERB) form posts keep the ordinary redirect.
+      def redirect_out(url, status: :found)
+        if request.respond_to?(:inertia?) && request.inertia?
+          inertia_location(url)
+        else
+          redirect_to url, status: status, allow_other_host: true
+        end
       end
 
       def denied_redirect_uri

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -368,6 +368,11 @@ StandardId.configure do |c|
   # c.rate_limits.api_passwordless_start_per_target = 5  # per 15 minutes
   # c.rate_limits.api_token_per_ip               = 30  # per 15 minutes
 
+  # Optional per-audience tightening on top of api_token_per_ip. Only token
+  # requests targeting a configured audience count toward its cap (per IP,
+  # per 15 minutes); unlisted audiences are governed by the global ceiling.
+  # c.rate_limits.api_token_per_audience_per_ip  = { "mobile_app" => 10 }
+
   # ---------------------------------------------------------------------------
   # Observability
   # ---------------------------------------------------------------------------

data/lib/standard_id/config/schema.rb

@@ -289,6 +289,21 @@ StandardId::ConfigSchema.define do
     # silently failing the model's presence validation — so misconfiguration is
     # caught loudly at request time.
     field :dynamic_registration_owner, type: :any, default: nil
+
+    # Default `token_endpoint_auth_method` applied to clients created via RFC 7591
+    # Dynamic Client Registration when the request omits `token_endpoint_auth_method`.
+    #
+    # Controls whether self-registered clients default to PUBLIC (PKCE-only, no
+    # secret) or to a CONFIDENTIAL secret-bearing method. The default `"none"`
+    # preserves the historical behaviour (DCR clients are public unless they ask
+    # for a secret) and is the right default for interactive/native/MCP clients,
+    # which cannot keep a secret.
+    #
+    # Valid values (validated at use in StandardId::Oauth::ClientRegistration):
+    #   "none"                — public client, authenticates via PKCE alone
+    #   "client_secret_basic" — confidential, secret via HTTP Basic
+    #   "client_secret_post"  — confidential, secret in the request body
+    field :dynamic_registration_default_auth_method, type: :string, default: "none"
   end
 
   scope :social do
@@ -328,6 +343,15 @@ StandardId::ConfigSchema.define do
     field :api_passwordless_start_per_target, type: :integer, default: 5 # per 15 minutes
     field :api_token_per_ip, type: :integer, default: 30                 # per 15 minutes
 
+    # Optional per-audience tightening on top of the api_token_per_ip
+    # ceiling. A Hash of audience => max token requests per IP per 15
+    # minutes, e.g. `{ "mobile_app" => 10, "partner_api" => 30 }`. Only
+    # requests targeting a configured audience count toward that audience's
+    # limit; audiences without an entry are governed solely by the global
+    # api_token_per_ip ceiling. A request must pass both its audience cap
+    # and the global cap.
+    field :api_token_per_audience_per_ip, type: :hash, default: -> { {} }
+
     # Dynamic client registration (RFC 7591) — throttle the open registration
     # endpoint by IP so an enabled deployment can't be flooded with client rows.
     field :dynamic_registration_per_ip, type: :integer, default: 10      # per hour

data/lib/standard_id/oauth/authorization_code_flow.rb

@@ -1,11 +1,21 @@
 module StandardId
   module Oauth
     class AuthorizationCodeFlow < TokenGrantFlow
-      expect_params :client_id, :client_secret, :code
-      permit_params :redirect_uri, :code_verifier
+      expect_params :client_id, :code
+      permit_params :client_secret, :redirect_uri, :code_verifier
 
       def authenticate!
-        @credential = validate_client_secret!(params[:client_id], params[:client_secret])
+        @client = StandardId::ClientApplication.find_by(client_id: params[:client_id])
+        raise StandardId::InvalidClientError, "Client authentication failed" if @client.nil?
+
+        # Confidential clients authenticate with a client secret. Public clients
+        # (e.g. native/SPA/MCP clients per RFC 8252 / OAuth 2.1) cannot keep a
+        # secret and authenticate via PKCE alone — they MUST NOT send one.
+        if @client.confidential?
+          @credential = validate_client_secret!(params[:client_id], params[:client_secret])
+        elsif params[:client_secret].present?
+          raise StandardId::InvalidClientError, "Public clients must not send a client_secret"
+        end
 
         @authorization_code = find_authorization_code(params[:code])
         unless @authorization_code&.valid_for_client?(params[:client_id])
@@ -16,6 +26,14 @@ module StandardId
           raise StandardId::InvalidGrantError, "Redirect URI mismatch"
         end
 
+        # Fail closed: a public client's only authentication factor is PKCE, so a
+        # code minted without a code_challenge offers no client authentication at
+        # all. (pkce_valid? returns true when code_challenge is blank, which is
+        # safe for confidential clients but would be a bypass for public ones.)
+        if @client.public? && @authorization_code.code_challenge.blank?
+          raise StandardId::InvalidGrantError, "PKCE is required for public clients"
+        end
+
         unless @authorization_code.pkce_valid?(params[:code_verifier])
           raise StandardId::InvalidGrantError, "Invalid PKCE code_verifier"
         end
@@ -30,7 +48,7 @@ module StandardId
         StandardId::Events.publish(
           StandardId::Events::OAUTH_CODE_CONSUMED,
           authorization_code: @authorization_code,
-          client_id: @credential.client_id,
+          client_id: @client.client_id,
           account: @authorization_code.account
         )
       end
@@ -40,7 +58,7 @@ module StandardId
       end
 
       def client_id
-        @credential.client_id
+        @client.client_id
       end
 
       def token_scope
@@ -60,7 +78,7 @@ module StandardId
       end
 
       def token_client
-        @credential&.client_application
+        @client
       end
 
       def token_account

data/lib/standard_id/oauth/client_registration.rb

@@ -25,7 +25,7 @@ module StandardId
       # token_endpoint_auth_method -> client_type mapping.
       PUBLIC_AUTH_METHOD = "none".freeze
       CONFIDENTIAL_AUTH_METHODS = %w[client_secret_basic client_secret_post].freeze
-      DEFAULT_AUTH_METHOD = PUBLIC_AUTH_METHOD
+      SUPPORTED_AUTH_METHODS = (CONFIDENTIAL_AUTH_METHODS + [PUBLIC_AUTH_METHOD]).freeze
       DEFAULT_SCOPE = "openid profile email".freeze
 
       # Minimal result object mirroring the gem's `result.success?` /
@@ -132,7 +132,22 @@ module StandardId
 
       def auth_method
         method = metadata[:token_endpoint_auth_method].to_s.strip
-        method.presence || DEFAULT_AUTH_METHOD
+        method.presence || default_auth_method
+      end
+
+      # Fallback token_endpoint_auth_method when the registration request omits
+      # one. Reads the first-class config value (default "none"). A misconfigured
+      # value is a host-app bug, so it raises ConfigurationError loudly rather
+      # than silently registering a malformed client.
+      def default_auth_method
+        configured = StandardId.config.oauth.dynamic_registration_default_auth_method.to_s
+        unless SUPPORTED_AUTH_METHODS.include?(configured)
+          raise StandardId::ConfigurationError,
+            "oauth.dynamic_registration_default_auth_method must be one of " \
+            "#{SUPPORTED_AUTH_METHODS.join(', ')} (got #{configured.inspect})"
+        end
+
+        configured
       end
 
       def client_type
@@ -142,7 +157,7 @@ module StandardId
 
         raise StandardId::InvalidClientMetadataError,
           "Unsupported token_endpoint_auth_method: #{method.inspect}. " \
-          "Allowed: #{(CONFIDENTIAL_AUTH_METHODS + [PUBLIC_AUTH_METHOD]).join(', ')}"
+          "Allowed: #{SUPPORTED_AUTH_METHODS.join(', ')}"
       end
 
       # Public clients are always forced onto PKCE/S256 (the model also validates

data/lib/standard_id/oauth/discovery_document.rb

@@ -39,7 +39,9 @@ module StandardId
           grant_types_supported: %w[authorization_code refresh_token client_credentials],
           subject_types_supported: %w[public],
           id_token_signing_alg_values_supported: [StandardId.config.oauth.signing_algorithm.to_s.upcase],
-          token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post],
+          # "none" advertises public-client support (PKCE-only token exchange,
+          # no client_secret) per RFC 8414 — required by native/SPA/MCP clients.
+          token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post none],
           # PKCE is always enforced (require_pkce defaults true and cannot be
           # disabled for public clients), so advertise the supported method.
           code_challenge_methods_supported: %w[S256]

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.22.0"
+  VERSION = "0.24.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.24.0
 platform: ruby
 authors:
 - Jaryl Sim