standard_id 0.25.0 → 0.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99d7cfa49958800d64f4798faa9811f7bbb5b2b48a15259dc175c69530bd6891
-  data.tar.gz: 915aecf6b38851c2d8858c541a999571923bd11749aa2f45e315cceb263bf0a1
+  metadata.gz: a0d8132ce80b99059528d033a05dc3d6ec4c421d6eaea14725e51357639f4808
+  data.tar.gz: 2c8386bc4ea25b23e54553ed0ad3ba5816fc47efcb64003aa02252e0af54e54d
 SHA512:
-  metadata.gz: 9b1a05470a63051f476189c8a8bafabb271e34754cc59774a0cc6aa8e361fd01a217882504ab41f8c01ee58dea69f5ac437948e02d0abfb71db8b643e8837e77
-  data.tar.gz: 7da0cdaf7b12dcbbc1a7c17d808c0c803857448f56b929336f09c8591a7c1b602ecf32381c58d785ec0ff274d5167524a47837a9fbc7141630d7f9fc75265e2e
+  metadata.gz: e69d8a20c4419deec38b8cc3c69b51a6b99b6a6c2a9043bf0a16625bb7539faf8ebf9095856d2fcad9a6ed2eda011863ba374d7872d681dc229e6a682d273e99
+  data.tar.gz: ed39942791e51fff0b333d9026e4707a52c8acdfffc5a40c447939b5f486d971597d3711417453bb1ecb66f736b78af607bf8bb9607c0a9ae1594139d3d4a7ff

data/README.md

@@ -450,7 +450,17 @@ end
 
 **Realm isolation.** `realm:` is a free-form string that partitions challenges by purpose. A code issued for realm `"widget_contact_verification"` cannot be used to verify against realm `"authentication"` (or any other realm) — even for the same `target`. Choose a stable string per flow.
 
-**Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and `Rails.env` is not `"production"`), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
+**Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and the deploy is not production), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
+
+By default "production" means `Rails.env.production?`. Apps that distinguish a physical deploy environment from `RAILS_ENV` (e.g. a staging box that still runs `RAILS_ENV=production`) can override the decision with a callable:
+
+```ruby
+# Allow the bypass code on a physically-staging box, still refused on real prod.
+c.passwordless.production_env_detector = -> { AppEnv.production? }
+c.passwordless.bypass_code = ENV["STANDARD_ID_BYPASS_CODE"] unless AppEnv.production?
+```
+
+`production_env_detector` takes no arguments and returns a boolean; when `nil` (the default) the gem falls back to `Rails.env.production?`, so existing consumers are unaffected.
 
 **Back-compat.** The existing passwordless authentication flow continues to work unchanged. `Otp.issue`/`Otp.verify` are a new addition — you can migrate direct `CodeChallenge.create!` calls at your own pace.
 

data/lib/standard_id/config/schema.rb

@@ -102,13 +102,27 @@ StandardId::ConfigSchema.define do
     field :max_attempts_per_challenge, type: :integer, default: nil
 
     field :retry_delay, type: :integer, default: 30 # 30 seconds
-    # Bypass code for E2E testing — NEVER set in production (raises).
-    # When set and Rails.env != "production", this code is accepted by
+    # Bypass code for E2E testing — refused on production deploys (raises).
+    # When set and the deploy is *not* production, this code is accepted by
     # both the built-in passwordless login and by StandardId::Otp.verify
     # for *any* realm. Use a long, non-guessable value and unset it
     # outside test environments.
+    #
+    # "Production" is decided by production_env_detector below (default
+    # Rails.env.production?), so host apps that distinguish a physical deploy
+    # environment from RAILS_ENV can still gate this correctly.
     field :bypass_code, type: :string, default: nil
 
+    # Optional callable deciding whether the current deploy is "production"
+    # for the purpose of the bypass-code guard. Takes no args, returns a
+    # boolean. When nil (default), falls back to Rails.env.production? — so
+    # existing consumers are unchanged. Host apps that distinguish a physical
+    # deploy environment from RAILS_ENV (e.g. APP_ENVIRONMENT, which stays
+    # RAILS_ENV=production on a physically-staging box) can supply
+    # `-> { AppEnv.production? }` to allow a bypass code on staging while it
+    # stays refused on real production.
+    field :production_env_detector, type: :any, default: nil
+
     # Custom username validator for passwordless flows.
     # When set, called before OTP generation to validate the recipient address.
     # Must be a callable (lambda/proc) that receives (username, connection_type)

data/lib/standard_id/passwordless/verification_service.rb

@@ -204,7 +204,7 @@ module StandardId
         bypass_code = StandardId.config.passwordless.bypass_code
         return unless bypass_code.present?
 
-        if defined?(Rails) && Rails.env.production?
+        if bypass_production_deploy?
           raise "STANDARD_ID_BYPASS_CODE must not be set in production"
         end
 
@@ -246,6 +246,17 @@ module StandardId
         end
       end
 
+      # Whether the bypass code is forbidden because this is a production
+      # deploy. Defers to config.passwordless.production_env_detector when set
+      # (host apps that distinguish a physical deploy env from RAILS_ENV), else
+      # falls back to Rails.env.production?.
+      def bypass_production_deploy?
+        detector = StandardId.config.passwordless.production_env_detector
+        return !!detector.call if detector
+
+        defined?(Rails) && Rails.env.production?
+      end
+
       def resolve_target_and_channel!(email, phone)
         if email.present?
           @target = email.to_s.strip

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.25.0"
+  VERSION = "0.26.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.25.0
+  version: 0.26.0
 platform: ruby
 authors:
 - Jaryl Sim