standard_id 0.24.0 → 0.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96bb41b62e41b340083b98a19c91913d8a1342a1895150d68595cba6a576d039
-  data.tar.gz: b85e690728fad61be9a1ab5fa047096cf3db2b97bea9b9403774cd53895216f6
+  metadata.gz: a0d8132ce80b99059528d033a05dc3d6ec4c421d6eaea14725e51357639f4808
+  data.tar.gz: 2c8386bc4ea25b23e54553ed0ad3ba5816fc47efcb64003aa02252e0af54e54d
 SHA512:
-  metadata.gz: 4bebc333835970bebc067517014364dce32cfa6f3d9165a64aa7b82f3464f5862439c9fd7e40d73ae6d79a478490abe749609804c168d9ae8669d29e7d6d861e
-  data.tar.gz: 23a59d0a655a3d933ed953923ce5f2c4f63240543b06f094faa182366c6d147e27b769c6c6230821d0a1c60501399ac7569296840255403b95953faf37a5ba8b
+  metadata.gz: e69d8a20c4419deec38b8cc3c69b51a6b99b6a6c2a9043bf0a16625bb7539faf8ebf9095856d2fcad9a6ed2eda011863ba374d7872d681dc229e6a682d273e99
+  data.tar.gz: ed39942791e51fff0b333d9026e4707a52c8acdfffc5a40c447939b5f486d971597d3711417453bb1ecb66f736b78af607bf8bb9607c0a9ae1594139d3d4a7ff

data/README.md

@@ -450,7 +450,17 @@ end
 
 **Realm isolation.** `realm:` is a free-form string that partitions challenges by purpose. A code issued for realm `"widget_contact_verification"` cannot be used to verify against realm `"authentication"` (or any other realm) — even for the same `target`. Choose a stable string per flow.
 
-**Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and `Rails.env` is not `"production"`), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
+**Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and the deploy is not production), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
+
+By default "production" means `Rails.env.production?`. Apps that distinguish a physical deploy environment from `RAILS_ENV` (e.g. a staging box that still runs `RAILS_ENV=production`) can override the decision with a callable:
+
+```ruby
+# Allow the bypass code on a physically-staging box, still refused on real prod.
+c.passwordless.production_env_detector = -> { AppEnv.production? }
+c.passwordless.bypass_code = ENV["STANDARD_ID_BYPASS_CODE"] unless AppEnv.production?
+```
+
+`production_env_detector` takes no arguments and returns a boolean; when `nil` (the default) the gem falls back to `Rails.env.production?`, so existing consumers are unaffected.
 
 **Back-compat.** The existing passwordless authentication flow continues to work unchanged. `Otp.issue`/`Otp.verify` are a new addition — you can migrate direct `CodeChallenge.create!` calls at your own pace.
 

data/lib/standard_id/config/schema.rb

@@ -102,13 +102,27 @@ StandardId::ConfigSchema.define do
     field :max_attempts_per_challenge, type: :integer, default: nil
 
     field :retry_delay, type: :integer, default: 30 # 30 seconds
-    # Bypass code for E2E testing — NEVER set in production (raises).
-    # When set and Rails.env != "production", this code is accepted by
+    # Bypass code for E2E testing — refused on production deploys (raises).
+    # When set and the deploy is *not* production, this code is accepted by
     # both the built-in passwordless login and by StandardId::Otp.verify
     # for *any* realm. Use a long, non-guessable value and unset it
     # outside test environments.
+    #
+    # "Production" is decided by production_env_detector below (default
+    # Rails.env.production?), so host apps that distinguish a physical deploy
+    # environment from RAILS_ENV can still gate this correctly.
     field :bypass_code, type: :string, default: nil
 
+    # Optional callable deciding whether the current deploy is "production"
+    # for the purpose of the bypass-code guard. Takes no args, returns a
+    # boolean. When nil (default), falls back to Rails.env.production? — so
+    # existing consumers are unchanged. Host apps that distinguish a physical
+    # deploy environment from RAILS_ENV (e.g. APP_ENVIRONMENT, which stays
+    # RAILS_ENV=production on a physically-staging box) can supply
+    # `-> { AppEnv.production? }` to allow a bypass code on staging while it
+    # stays refused on real production.
+    field :production_env_detector, type: :any, default: nil
+
     # Custom username validator for passwordless flows.
     # When set, called before OTP generation to validate the recipient address.
     # Must be a callable (lambda/proc) that receives (username, connection_type)

data/lib/standard_id/passwordless/verification_service.rb

@@ -204,7 +204,7 @@ module StandardId
         bypass_code = StandardId.config.passwordless.bypass_code
         return unless bypass_code.present?
 
-        if defined?(Rails) && Rails.env.production?
+        if bypass_production_deploy?
           raise "STANDARD_ID_BYPASS_CODE must not be set in production"
         end
 
@@ -246,6 +246,17 @@ module StandardId
         end
       end
 
+      # Whether the bypass code is forbidden because this is a production
+      # deploy. Defers to config.passwordless.production_env_detector when set
+      # (host apps that distinguish a physical deploy env from RAILS_ENV), else
+      # falls back to Rails.env.production?.
+      def bypass_production_deploy?
+        detector = StandardId.config.passwordless.production_env_detector
+        return !!detector.call if detector
+
+        defined?(Rails) && Rails.env.production?
+      end
+
       def resolve_target_and_channel!(email, phone)
         if email.present?
           @target = email.to_s.strip

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.24.0"
+  VERSION = "0.26.0"
 end

data/lib/standard_id/web/session_manager.rb

@@ -35,7 +35,7 @@ module StandardId
           # Store in both session and encrypted cookie for backward compatibility
           # Action Cable will use the encrypted cookie
           session[:session_token] = browser_session.token
-          cookies.encrypted[:session_token] = browser_session.token
+          write_session_cookie(browser_session)
           if scope_name
             scopes = Array(session[:standard_id_scopes])
             scopes << scope_name.to_s unless scopes.include?(scope_name.to_s)
@@ -71,6 +71,22 @@ module StandardId
 
       private
 
+      # Persist the session token in an encrypted cookie whose lifetime matches
+      # the DB session's expires_at, so an authenticated session survives a full
+      # browser restart (a bare session cookie would be cleared on browser close,
+      # logging the user out well before the BrowserSession actually expires).
+      # httponly/secure/same_site harden the cookie; httponly does not affect
+      # Action Cable, which reads the cookie server-side.
+      def write_session_cookie(browser_session)
+        cookies.encrypted[:session_token] = {
+          value:     browser_session.token,
+          expires:   browser_session.expires_at,
+          httponly:  true,
+          secure:    request.ssl?,
+          same_site: :lax
+        }
+      end
+
       def load_current_account
         if StandardId.config.account_scope
           account_id = current_session&.account_id
@@ -121,7 +137,7 @@ module StandardId
         token_manager.create_browser_session(password_credential.account, remember_me: true).tap do |browser_session|
           # Store in both session and encrypted cookie for backward compatibility
           session[:session_token] = browser_session.token
-          cookies.encrypted[:session_token] = browser_session.token
+          write_session_cookie(browser_session)
           cookies[:remember_token] = token_manager.create_remember_token(password_credential)
         end
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.24.0
+  version: 0.26.0
 platform: ruby
 authors:
 - Jaryl Sim