standard_id 0.26.1 → 0.26.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b1486a551a57501f794685296e6d40c7c356917168fce7a515c7d869c887c1c
-  data.tar.gz: 9520bd31e28f591e0e5b65e95e4b8861c7fedc233471914740304984da666f6c
+  metadata.gz: a44aeb31a30319f06f305078bc0d9f0f5c20eff095680f3414085a7fb031c39c
+  data.tar.gz: 05bb225c7724ece28d0702345fe8f0560bef3e69d972a4b5f82ee3f97a304048
 SHA512:
-  metadata.gz: a2122cccd43faf84a5a332788f10f02a6a91928dfcc9452e080fb27704951da83dcaaffc02e0e91d7b1668b9f5696c0142b7744924908a5e03ac74c539bada1e
-  data.tar.gz: b287c31906e30d58e977ce778a9daa77010a346eaa355a343b0952ec82865ece850e6686b622af9f228e5f69010efd2d9e8914fbb56bd6fe7c4b497976ebb2a6
+  metadata.gz: 4d796392613832ea4987009991eb1c191936a492cfe60e69964ee28416c9e6c5715263499bf12045563bf9d861996f07fc6eca0def955e776dbf25cbb4f2b833
+  data.tar.gz: e12e0634851c73da51edff7433392bf44ce721fbc078dc993cee9f6035bec336ca60b38c2d0897e9a0478075d32ff9984c0ecfb1063882a9cfcf814501a2e75b

data/app/controllers/standard_id/web/base_controller.rb

@@ -16,8 +16,26 @@ module StandardId
       before_action -> { Current.scope = :web if defined?(::Current) }
       before_action :require_browser_session!
 
+      # The authentication guard (require_browser_session!) RAISES when a page
+      # requires a session that's missing / expired / revoked, rather than
+      # redirecting. The API base controller rescues the same errors; the web
+      # flow must too, or an unauthenticated request to a protected page (e.g.
+      # /sessions) surfaces as a 500 instead of bouncing to login. Expired and
+      # revoked sessions are InvalidSessionError subclasses.
+      rescue_from StandardId::NotAuthenticatedError,
+                  StandardId::InvalidSessionError,
+                  with: :redirect_unauthenticated_to_login
+
       private
 
+      # Bounce an unauthenticated web request to the login page, preserving the
+      # original destination (the guard already stored return_to_after_authenticating;
+      # redirect_to_login also carries it as a ?redirect_uri= param).
+      def redirect_unauthenticated_to_login(_error)
+        store_location_for_redirect
+        redirect_to_login
+      end
+
       # Read a top-level query/form param expected to be a scalar String, returning
       # nil for absent/blank values OR if Rails parsed it as an Array/Hash (e.g. from
       # `?redirect_uri[]=a&redirect_uri[]=b`). Without this guard, `redirect_to` is

data/app/jobs/standard_id/secure_mail_delivery_job.rb

@@ -0,0 +1,18 @@
+module StandardId
+  # Mailer delivery job that suppresses ActiveJob argument logging.
+  #
+  # The gem's mailers carry sensitive data in their params — the passwordless
+  # OTP code (PasswordlessMailer) and the password-reset URL/token
+  # (PasswordResetMailer). `deliver_later` serializes those params as the
+  # delivery job's arguments, and ActiveJob's log subscriber prints job
+  # arguments in plaintext on enqueue/perform — so the OTP/token would land in
+  # the application logs (readable by anyone with log access).
+  #
+  # Setting `log_arguments = false` keeps the arguments out of the logs without
+  # changing delivery behaviour. (The params still travel inside the serialized
+  # job payload until the job runs — a far higher access bar than logs, and
+  # short-lived — but they never reach the log stream.)
+  class SecureMailDeliveryJob < ActionMailer::MailDeliveryJob
+    self.log_arguments = false
+  end
+end

data/app/mailers/standard_id/application_mailer.rb

@@ -1,5 +1,10 @@
 module StandardId
   class ApplicationMailer < ActionMailer::Base
+    # Use a delivery job that doesn't log its arguments — the gem's mailers pass
+    # sensitive params (OTP code, password-reset token) that ActiveJob would
+    # otherwise print in plaintext. Applies to all StandardId mailers.
+    self.delivery_job = StandardId::SecureMailDeliveryJob
+
     default from: "from@example.com"
     layout "mailer"
   end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.26.1"
+  VERSION = "0.26.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.26.1
+  version: 0.26.3
 platform: ruby
 authors:
 - Jaryl Sim
@@ -169,6 +169,7 @@ files:
 - app/jobs/standard_id/cleanup_expired_refresh_tokens_job.rb
 - app/jobs/standard_id/cleanup_expired_sessions_job.rb
 - app/jobs/standard_id/password_reset_delivery_job.rb
+- app/jobs/standard_id/secure_mail_delivery_job.rb
 - app/mailers/standard_id/application_mailer.rb
 - app/mailers/standard_id/password_reset_mailer.rb
 - app/mailers/standard_id/passwordless_mailer.rb