standard_id 0.26.0 → 0.26.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a0d8132ce80b99059528d033a05dc3d6ec4c421d6eaea14725e51357639f4808
-  data.tar.gz: 2c8386bc4ea25b23e54553ed0ad3ba5816fc47efcb64003aa02252e0af54e54d
+  metadata.gz: dde5f52a936c2e51f795216d21fa5bf700f897f55ef5cd843ac15cb42f7ddf0c
+  data.tar.gz: 106311d1a7228cf3686669cb5588b9db9b0e2b17fdb53247e715275bfd5db7ec
 SHA512:
-  metadata.gz: e69d8a20c4419deec38b8cc3c69b51a6b99b6a6c2a9043bf0a16625bb7539faf8ebf9095856d2fcad9a6ed2eda011863ba374d7872d681dc229e6a682d273e99
-  data.tar.gz: ed39942791e51fff0b333d9026e4707a52c8acdfffc5a40c447939b5f486d971597d3711417453bb1ecb66f736b78af607bf8bb9607c0a9ae1594139d3d4a7ff
+  metadata.gz: dcdc4eb6ac8a332ec8ffc9fcb56baee4b3205fb23133192d9c4500497f92f9403212b429e0616dafb8accd62491ee4e09621928e97244ff95c7098f33cfdf144
+  data.tar.gz: 9f4ea2218791b46ef44d6866de2bf85c3d3dfece82c64141a1f70895c1dc976e82c3c61dae0bbade82c2279d72466a10fe3da7bb212a70f6c90e421e0e56d556

data/app/controllers/concerns/standard_id/rate_limit_handling.rb

@@ -20,7 +20,14 @@ module StandardId
         }, status: :too_many_requests
       else
         flash[:alert] = "Too many requests. Please try again later."
-        redirect_to request.referer || main_app.root_path, status: :see_other
+        # Bounce back to the rate-limited form's own GET action. Previously this
+        # used `request.referer || main_app.root_path`, which raised (→ 500) for
+        # two real cases: a host app that doesn't define a root route (e.g. an
+        # API/control-plane that only mounts the engine — `main_app.root_path`
+        # then doesn't exist), and a cross-origin `Referer` (Rails refuses the
+        # redirect as unsafe). `request.path` is always a valid, same-origin GET
+        # for every rate-limited action here, so it degrades gracefully.
+        redirect_to request.path, status: :see_other
       end
     end
   end

data/app/controllers/standard_id/web/base_controller.rb

@@ -9,6 +9,7 @@ module StandardId
 
       include StandardId::WebEngine.routes.url_helpers
       helper StandardId::WebEngine.routes.url_helpers
+      helper StandardId::ApplicationHelper
 
       layout -> { StandardId.config.web_layout.presence || "application" }
 

data/app/helpers/standard_id/application_helper.rb

@@ -1,4 +1,10 @@
 module StandardId
   module ApplicationHelper
+    # The configured OTP code length, clamped to the engine's supported range
+    # (4..10). Views use this so the verification-code input's `maxlength`
+    # stays in sync with the length of codes the generator actually produces.
+    def otp_code_length
+      StandardId::Passwordless.otp_code_length
+    end
   end
 end

data/app/jobs/standard_id/secure_mail_delivery_job.rb

@@ -0,0 +1,18 @@
+module StandardId
+  # Mailer delivery job that suppresses ActiveJob argument logging.
+  #
+  # The gem's mailers carry sensitive data in their params — the passwordless
+  # OTP code (PasswordlessMailer) and the password-reset URL/token
+  # (PasswordResetMailer). `deliver_later` serializes those params as the
+  # delivery job's arguments, and ActiveJob's log subscriber prints job
+  # arguments in plaintext on enqueue/perform — so the OTP/token would land in
+  # the application logs (readable by anyone with log access).
+  #
+  # Setting `log_arguments = false` keeps the arguments out of the logs without
+  # changing delivery behaviour. (The params still travel inside the serialized
+  # job payload until the job runs — a far higher access bar than logs, and
+  # short-lived — but they never reach the log stream.)
+  class SecureMailDeliveryJob < ActionMailer::MailDeliveryJob
+    self.log_arguments = false
+  end
+end

data/app/mailers/standard_id/application_mailer.rb

@@ -1,5 +1,10 @@
 module StandardId
   class ApplicationMailer < ActionMailer::Base
+    # Use a delivery job that doesn't log its arguments — the gem's mailers pass
+    # sensitive params (OTP code, password-reset token) that ActiveJob would
+    # otherwise print in plaintext. Applies to all StandardId mailers.
+    self.delivery_job = StandardId::SecureMailDeliveryJob
+
     default from: "from@example.com"
     layout "mailer"
   end

data/app/views/standard_id/web/login_verify/show.html.erb

@@ -22,7 +22,7 @@
         <div>
           <%= form.label :code, "Verification code", class: "block text-sm/6 font-medium text-gray-900 dark:text-white" %>
           <div class="mt-2">
-            <%= form.text_field :code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric", maxlength: 6, class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
+            <%= form.text_field :code, required: true, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric", maxlength: otp_code_length, class: "block w-full rounded-md bg-white px-3 py-1.5 text-base text-gray-900 outline outline-1 -outline-offset-1 outline-gray-300 placeholder:text-gray-400 focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-indigo-600 sm:text-sm/6 dark:bg-white/5 dark:text-white dark:outline-white/10 dark:placeholder:text-gray-500 dark:focus:outline-indigo-500" %>
           </div>
         </div>
 

data/lib/standard_id/oauth/discovery_document.rb

@@ -34,7 +34,6 @@ module StandardId
           token_endpoint: "#{base}/oauth/token",
           revocation_endpoint: "#{base}/oauth/revoke",
           userinfo_endpoint: "#{base}/userinfo",
-          jwks_uri: "#{base}/.well-known/jwks.json",
           response_types_supported: %w[code],
           grant_types_supported: %w[authorization_code refresh_token client_credentials],
           subject_types_supported: %w[public],
@@ -47,6 +46,14 @@ module StandardId
           code_challenge_methods_supported: %w[S256]
         }
 
+        # Only advertise jwks_uri when signing is asymmetric. With symmetric
+        # (HS256/384/512) signing there are no public keys to publish, so the
+        # jwks endpoint deliberately returns 404 — advertising it would point
+        # clients at a dead URL. HS-signed tokens are verified with the shared
+        # secret, not JWKS. (RFC 8414 makes jwks_uri optional; an OIDC client
+        # using HS256 id_tokens verifies them with the client_secret.)
+        doc[:jwks_uri] = "#{base}/.well-known/jwks.json" if StandardId::JwtService.asymmetric?
+
         doc[:registration_endpoint] = "#{base}/oauth/register" if registration_enabled
 
         doc

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.26.0"
+  VERSION = "0.26.2"
 end

data/lib/standard_id/web/session_manager.rb

@@ -63,7 +63,12 @@ module StandardId
         # TODO: make token key names configurable
         session.delete(:session_token)
         session.delete(:standard_id_scopes)
-        cookies.encrypted[:session_token] = nil
+        # Delete the cookie outright. Assigning `cookies.encrypted[:session_token] = nil`
+        # writes a fresh encrypted blob through the jar's default options (no httponly)
+        # on every unauthenticated request, leaving a confusing non-HttpOnly
+        # `session_token` cookie that carries no real token. `cookies.delete` removes it
+        # cleanly — the token-bearing write (write_session_cookie) keeps httponly: true.
+        cookies.delete(:session_token)
         cookies.delete(:remember_token)
 
         Current.session = nil

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.26.0
+  version: 0.26.2
 platform: ruby
 authors:
 - Jaryl Sim
@@ -169,6 +169,7 @@ files:
 - app/jobs/standard_id/cleanup_expired_refresh_tokens_job.rb
 - app/jobs/standard_id/cleanup_expired_sessions_job.rb
 - app/jobs/standard_id/password_reset_delivery_job.rb
+- app/jobs/standard_id/secure_mail_delivery_job.rb
 - app/mailers/standard_id/application_mailer.rb
 - app/mailers/standard_id/password_reset_mailer.rb
 - app/mailers/standard_id/passwordless_mailer.rb