standard_id 0.25.0 → 0.26.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99d7cfa49958800d64f4798faa9811f7bbb5b2b48a15259dc175c69530bd6891
-  data.tar.gz: 915aecf6b38851c2d8858c541a999571923bd11749aa2f45e315cceb263bf0a1
+  metadata.gz: 6b1486a551a57501f794685296e6d40c7c356917168fce7a515c7d869c887c1c
+  data.tar.gz: 9520bd31e28f591e0e5b65e95e4b8861c7fedc233471914740304984da666f6c
 SHA512:
-  metadata.gz: 9b1a05470a63051f476189c8a8bafabb271e34754cc59774a0cc6aa8e361fd01a217882504ab41f8c01ee58dea69f5ac437948e02d0abfb71db8b643e8837e77
-  data.tar.gz: 7da0cdaf7b12dcbbc1a7c17d808c0c803857448f56b929336f09c8591a7c1b602ecf32381c58d785ec0ff274d5167524a47837a9fbc7141630d7f9fc75265e2e
+  metadata.gz: a2122cccd43faf84a5a332788f10f02a6a91928dfcc9452e080fb27704951da83dcaaffc02e0e91d7b1668b9f5696c0142b7744924908a5e03ac74c539bada1e
+  data.tar.gz: b287c31906e30d58e977ce778a9daa77010a346eaa355a343b0952ec82865ece850e6686b622af9f228e5f69010efd2d9e8914fbb56bd6fe7c4b497976ebb2a6

data/README.md

@@ -450,7 +450,17 @@ end
 
 **Realm isolation.** `realm:` is a free-form string that partitions challenges by purpose. A code issued for realm `"widget_contact_verification"` cannot be used to verify against realm `"authentication"` (or any other realm) — even for the same `target`. Choose a stable string per flow.
 
-**Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and `Rails.env` is not `"production"`), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
+**Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and the deploy is not production), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
+
+By default "production" means `Rails.env.production?`. Apps that distinguish a physical deploy environment from `RAILS_ENV` (e.g. a staging box that still runs `RAILS_ENV=production`) can override the decision with a callable:
+
+```ruby
+# Allow the bypass code on a physically-staging box, still refused on real prod.
+c.passwordless.production_env_detector = -> { AppEnv.production? }
+c.passwordless.bypass_code = ENV["STANDARD_ID_BYPASS_CODE"] unless AppEnv.production?
+```
+
+`production_env_detector` takes no arguments and returns a boolean; when `nil` (the default) the gem falls back to `Rails.env.production?`, so existing consumers are unaffected.
 
 **Back-compat.** The existing passwordless authentication flow continues to work unchanged. `Otp.issue`/`Otp.verify` are a new addition — you can migrate direct `CodeChallenge.create!` calls at your own pace.
 

data/app/controllers/concerns/standard_id/rate_limit_handling.rb

@@ -20,7 +20,14 @@ module StandardId
         }, status: :too_many_requests
       else
         flash[:alert] = "Too many requests. Please try again later."
-        redirect_to request.referer || main_app.root_path, status: :see_other
+        # Bounce back to the rate-limited form's own GET action. Previously this
+        # used `request.referer || main_app.root_path`, which raised (→ 500) for
+        # two real cases: a host app that doesn't define a root route (e.g. an
+        # API/control-plane that only mounts the engine — `main_app.root_path`
+        # then doesn't exist), and a cross-origin `Referer` (Rails refuses the
+        # redirect as unsafe). `request.path` is always a valid, same-origin GET
+        # for every rate-limited action here, so it degrades gracefully.
+        redirect_to request.path, status: :see_other
       end
     end
   end

data/app/controllers/standard_id/web/base_controller.rb

@@ -9,6 +9,7 @@ module StandardId
 
       include StandardId::WebEngine.routes.url_helpers
       helper StandardId::WebEngine.routes.url_helpers
+      helper StandardId::ApplicationHelper
 
       layout -> { StandardId.config.web_layout.presence || "application" }
 

data/app/helpers/standard_id/application_helper.rb

@@ -1,4 +1,10 @@
 module StandardId
   module ApplicationHelper
+    # The configured OTP code length, clamped to the engine's supported range
+    # (4..10). Views use this so the verification-code input's `maxlength`
+    # stays in sync with the length of codes the generator actually produces.
+    def otp_code_length
+      StandardId::Passwordless.otp_code_length
+    end
   end
 end

data/app/views/standard_id/web/login_verify/show.html.erb

@@ -22,7 +22,7 @@
         <div>
           <%= form.label :code, "Verification code", class: "block text-sm/6 font-medium text-gray-900 dark:text-white" %>
           <div class="mt-2">
-            <%= form.text_field :code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric", maxlength: 6, class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
+            <%= form.text_field :code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric", maxlength: otp_code_length, class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
           </div>
         </div>
 

data/lib/standard_id/config/schema.rb

@@ -102,13 +102,27 @@ StandardId::ConfigSchema.define do
     field :max_attempts_per_challenge, type: :integer, default: nil
 
     field :retry_delay, type: :integer, default: 30 # 30 seconds
-    # Bypass code for E2E testing — NEVER set in production (raises).
-    # When set and Rails.env != "production", this code is accepted by
+    # Bypass code for E2E testing — refused on production deploys (raises).
+    # When set and the deploy is *not* production, this code is accepted by
     # both the built-in passwordless login and by StandardId::Otp.verify
     # for *any* realm. Use a long, non-guessable value and unset it
     # outside test environments.
+    #
+    # "Production" is decided by production_env_detector below (default
+    # Rails.env.production?), so host apps that distinguish a physical deploy
+    # environment from RAILS_ENV can still gate this correctly.
     field :bypass_code, type: :string, default: nil
 
+    # Optional callable deciding whether the current deploy is "production"
+    # for the purpose of the bypass-code guard. Takes no args, returns a
+    # boolean. When nil (default), falls back to Rails.env.production? — so
+    # existing consumers are unchanged. Host apps that distinguish a physical
+    # deploy environment from RAILS_ENV (e.g. APP_ENVIRONMENT, which stays
+    # RAILS_ENV=production on a physically-staging box) can supply
+    # `-> { AppEnv.production? }` to allow a bypass code on staging while it
+    # stays refused on real production.
+    field :production_env_detector, type: :any, default: nil
+
     # Custom username validator for passwordless flows.
     # When set, called before OTP generation to validate the recipient address.
     # Must be a callable (lambda/proc) that receives (username, connection_type)

data/lib/standard_id/oauth/discovery_document.rb

@@ -34,7 +34,6 @@ module StandardId
           token_endpoint: "#{base}/oauth/token",
           revocation_endpoint: "#{base}/oauth/revoke",
           userinfo_endpoint: "#{base}/userinfo",
-          jwks_uri: "#{base}/.well-known/jwks.json",
           response_types_supported: %w[code],
           grant_types_supported: %w[authorization_code refresh_token client_credentials],
           subject_types_supported: %w[public],
@@ -47,6 +46,14 @@ module StandardId
           code_challenge_methods_supported: %w[S256]
         }
 
+        # Only advertise jwks_uri when signing is asymmetric. With symmetric
+        # (HS256/384/512) signing there are no public keys to publish, so the
+        # jwks endpoint deliberately returns 404 — advertising it would point
+        # clients at a dead URL. HS-signed tokens are verified with the shared
+        # secret, not JWKS. (RFC 8414 makes jwks_uri optional; an OIDC client
+        # using HS256 id_tokens verifies them with the client_secret.)
+        doc[:jwks_uri] = "#{base}/.well-known/jwks.json" if StandardId::JwtService.asymmetric?
+
         doc[:registration_endpoint] = "#{base}/oauth/register" if registration_enabled
 
         doc

data/lib/standard_id/passwordless/verification_service.rb

@@ -204,7 +204,7 @@ module StandardId
         bypass_code = StandardId.config.passwordless.bypass_code
         return unless bypass_code.present?
 
-        if defined?(Rails) && Rails.env.production?
+        if bypass_production_deploy?
           raise "STANDARD_ID_BYPASS_CODE must not be set in production"
         end
 
@@ -246,6 +246,17 @@ module StandardId
         end
       end
 
+      # Whether the bypass code is forbidden because this is a production
+      # deploy. Defers to config.passwordless.production_env_detector when set
+      # (host apps that distinguish a physical deploy env from RAILS_ENV), else
+      # falls back to Rails.env.production?.
+      def bypass_production_deploy?
+        detector = StandardId.config.passwordless.production_env_detector
+        return !!detector.call if detector
+
+        defined?(Rails) && Rails.env.production?
+      end
+
       def resolve_target_and_channel!(email, phone)
         if email.present?
           @target = email.to_s.strip

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.25.0"
+  VERSION = "0.26.1"
 end

data/lib/standard_id/web/session_manager.rb

@@ -63,7 +63,12 @@ module StandardId
         # TODO: make token key names configurable
         session.delete(:session_token)
         session.delete(:standard_id_scopes)
-        cookies.encrypted[:session_token] = nil
+        # Delete the cookie outright. Assigning `cookies.encrypted[:session_token] = nil`
+        # writes a fresh encrypted blob through the jar's default options (no httponly)
+        # on every unauthenticated request, leaving a confusing non-HttpOnly
+        # `session_token` cookie that carries no real token. `cookies.delete` removes it
+        # cleanly — the token-bearing write (write_session_cookie) keeps httponly: true.
+        cookies.delete(:session_token)
         cookies.delete(:remember_token)
 
         Current.session = nil

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.25.0
+  version: 0.26.1
 platform: ruby
 authors:
 - Jaryl Sim