standard_id 0.26.3 → 0.27.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a44aeb31a30319f06f305078bc0d9f0f5c20eff095680f3414085a7fb031c39c
-  data.tar.gz: 05bb225c7724ece28d0702345fe8f0560bef3e69d972a4b5f82ee3f97a304048
+  metadata.gz: d2917c7c97e54e0fd55a78e52c0f8eb202e3e1221267d5fe25af54da788c0e85
+  data.tar.gz: 7d2dad4ae7677431a6df91efef81ef0cf08794d7adc26be6b26fede63247f358
 SHA512:
-  metadata.gz: 4d796392613832ea4987009991eb1c191936a492cfe60e69964ee28416c9e6c5715263499bf12045563bf9d861996f07fc6eca0def955e776dbf25cbb4f2b833
-  data.tar.gz: e12e0634851c73da51edff7433392bf44ce721fbc078dc993cee9f6035bec336ca60b38c2d0897e9a0478075d32ff9984c0ecfb1063882a9cfcf814501a2e75b
+  metadata.gz: 5bc7d5bc447389b6cb44ae9962820fcb6a4bfb2109dc1e82fb334cfdba08d8dab1c1f8d7c41e63ee47ec8962b3a2ee38bd59d02ada3177b6ede3adce246398a2
+  data.tar.gz: 7d27375bfce3b17ff6ede7690f6e114f0e84d374c792e02d6c847f90a8a5a6d4c5492a57df596a94d8dbae073aa39c67627498c23c05ddb3639517d580ad4437

data/app/controllers/concerns/standard_id/lifecycle_hooks.rb

@@ -197,7 +197,9 @@ module StandardId
       # When raised without arguments, StandardError#message returns the class name
       message = "Sign-in was denied" if message.blank? || message == error.class.name
       login_path = begin
-        StandardId::WebEngine.routes.url_helpers.login_path
+        # Engine `_path` helpers are mount-relative and redirect_to won't prepend
+        # the mount's SCRIPT_NAME (no-op at root), so a non-root mount would 404.
+        "#{request.script_name}#{StandardId::WebEngine.routes.url_helpers.login_path}"
       rescue NameError, NoMethodError, ActionController::UrlGenerationError
         StandardId.config.login_url || "/"
       end

data/app/controllers/standard_id/web/account_controller.rb

@@ -16,7 +16,7 @@ module StandardId
         @account = current_account
 
         if @account.update(account_params)
-          redirect_to account_path, notice: "Account updated successfully"
+          redirect_to engine_path(account_path), notice: "Account updated successfully"
         else
           flash.now[:alert] = @account.errors.full_messages.join(", ")
           render :edit, status: :unprocessable_content

data/app/controllers/standard_id/web/base_controller.rb

@@ -36,6 +36,21 @@ module StandardId
         redirect_to_login
       end
 
+      # Prefix an engine-relative path with the current mount point's SCRIPT_NAME.
+      #
+      # Isolated-engine `_path` helpers return paths relative to the engine mount
+      # (e.g. "/login_verify"), and `redirect_to` / `redirect_with_inertia` —
+      # unlike view URL generation (form_with / link_to / url_for) — do NOT
+      # prepend the mount's SCRIPT_NAME. So a bare `redirect_to login_verify_path`
+      # 404s when the engine is mounted at a non-root path (e.g. "/auth" yields
+      # "/login_verify" instead of "/auth/login_verify"). SCRIPT_NAME is "" for a
+      # root mount, so this is a no-op there. Apply ONLY to engine-relative paths
+      # — host destinations (after_authentication_url, safe_post_signin_default)
+      # are already absolute and must not be prefixed.
+      def engine_path(path)
+        "#{request.script_name}#{path}"
+      end
+
       # Read a top-level query/form param expected to be a scalar String, returning
       # nil for absent/blank values OR if Rails parsed it as an Array/Hash (e.g. from
       # `?redirect_uri[]=a&redirect_uri[]=b`). Without this guard, `redirect_to` is

data/app/controllers/standard_id/web/login_controller.rb

@@ -108,7 +108,7 @@ module StandardId
         redirect_uri = string_param(:redirect_uri)
         session[:return_to_after_authenticating] = redirect_uri if redirect_uri
 
-        redirect_to login_verify_path, status: :see_other
+        redirect_to engine_path(login_verify_path), status: :see_other
       end
 
       def redirect_if_authenticated

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -94,7 +94,7 @@ module StandardId
         signed_payload = session[:standard_id_otp_payload]
 
         if signed_payload.blank?
-          redirect_to login_path, alert: "Please start the login process"
+          redirect_to engine_path(login_path), alert: "Please start the login process"
           return
         end
 
@@ -102,7 +102,7 @@ module StandardId
           @otp_data = Rails.application.message_verifier(:otp).verify(signed_payload).symbolize_keys
         rescue ActiveSupport::MessageVerifier::InvalidSignature
           session.delete(:standard_id_otp_payload)
-          redirect_to login_path, alert: "Your verification session has expired. Please try again."
+          redirect_to engine_path(login_path), alert: "Your verification session has expired. Please try again."
         end
       end
 

data/app/controllers/standard_id/web/reset_password/confirm_controller.rb

@@ -20,7 +20,7 @@ module StandardId
 
           if form.submit
             flash[:notice] = "Your password has been successfully reset. Please sign in with your new password."
-            redirect_to login_path, status: :see_other
+            redirect_to engine_path(login_path), status: :see_other
           else
             flash.now[:alert] = form.errors.full_messages.to_sentence
             render :show, status: :unprocessable_content
@@ -41,7 +41,7 @@ module StandardId
           return if @password_credential.present?
 
           flash[:alert] = "Invalid or expired password reset link"
-          redirect_to login_path, status: :see_other
+          redirect_to engine_path(login_path), status: :see_other
         end
       end
     end

data/app/controllers/standard_id/web/reset_password/start_controller.rb

@@ -21,7 +21,7 @@ module StandardId
 
           if form.submit
             flash[:notice] = "If an account with that email exists, we've sent password reset instructions."
-            redirect_to login_path, status: :see_other
+            redirect_to engine_path(login_path), status: :see_other
           else
             flash.now[:alert] = form.errors[:email].first || "Please enter your email address"
             render :show, status: :unprocessable_content

data/app/controllers/standard_id/web/sessions_controller.rb

@@ -19,10 +19,10 @@ module StandardId
         else
           # Revoke other session
           session.revoke!
-          redirect_to sessions_path, notice: "Session revoked successfully"
+          redirect_to engine_path(sessions_path), notice: "Session revoked successfully"
         end
       rescue ActiveRecord::RecordNotFound
-        redirect_to sessions_path, alert: "Session not found"
+        redirect_to engine_path(sessions_path), alert: "Session not found"
       end
     end
   end

data/app/models/standard_id/client_application.rb

@@ -34,6 +34,11 @@ module StandardId
     scope :public_clients, -> { where(client_type: "public") }
     scope :for_owner, ->(owner) { where(owner: owner) }
 
+    # Loopback interface hosts per RFC 8252 §7.3 (native apps). "localhost" is
+    # included for compatibility but RFC 8252 §8.3 recommends clients use
+    # 127.0.0.1/::1 instead, since "localhost" can be remapped by the OS.
+    LOOPBACK_HOSTS = %w[127.0.0.1 ::1 localhost].freeze
+
     # Callbacks
     before_create :generate_client_id
     before_update :set_deactivated_at, if: :will_save_change_to_active?
@@ -99,6 +104,12 @@ module StandardId
     # (or, worse, a different path segment like /cb/evil).
     #
     # Subdomain wildcards are NOT supported — host must match exactly.
+    #
+    # Exception — loopback redirects for native apps (RFC 8252 §7.3): when this
+    # client is public + PKCE-required and BOTH the registered and requested
+    # URIs are http loopback URIs, the port is ignored (native apps bind an
+    # ephemeral port on a local listener at authorization time, so it cannot be
+    # known at registration). See #loopback_redirect_uri? below.
     def valid_redirect_uri?(uri)
       requested = self.class.parse_redirect_uri(uri)
       return false unless requested
@@ -107,6 +118,23 @@ module StandardId
         registered = self.class.parse_redirect_uri(registered_uri)
         next false unless registered
 
+        # RFC 8252 §7.3: for loopback interface redirects, "the authorization
+        # server MUST allow any port to be specified at the time of the request".
+        # Only host + path are compared; scheme is already pinned to "http" by
+        # the loopback predicate. Host equality is still required, so a client
+        # registered with 127.0.0.1 does not match localhost (or vice versa) —
+        # per §8.3, "localhost" is less trustworthy than the literal loopback
+        # IPs because the OS can remap it. This relaxation is gated to public
+        # PKCE clients: the redirect lands on an ephemeral listener on the
+        # user's own machine and PKCE binds the code to the initiating client,
+        # whereas confidential clients have stable callback URLs and keep
+        # strict port matching.
+        if public? && require_pkce? &&
+            self.class.loopback_redirect_uri?(registered) &&
+            self.class.loopback_redirect_uri?(requested)
+          next registered.host == requested.host && registered.path == requested.path
+        end
+
         registered.scheme == requested.scheme &&
           registered.host == requested.host &&
           registered.port == requested.port &&
@@ -114,6 +142,17 @@ module StandardId
       end
     end
 
+    # True when the parsed URI is an http URI targeting a loopback interface
+    # literal (RFC 8252 §7.3). IPv6 loopback hosts are normalized: URI.parse
+    # yields "[::1]" on some Ruby versions and "::1" on others, so surrounding
+    # brackets are stripped before comparison.
+    def self.loopback_redirect_uri?(parsed_uri)
+      return false unless parsed_uri.scheme == "http"
+
+      host = parsed_uri.host.to_s.delete_prefix("[").delete_suffix("]")
+      LOOPBACK_HOSTS.include?(host)
+    end
+
     # Parse a redirect URI string into a URI object suitable for comparison.
     # Returns nil for unparseable, relative, or scheme-less URIs.
     def self.parse_redirect_uri(value)

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.26.3"
+  VERSION = "0.27.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.26.3
+  version: 0.27.0
 platform: ruby
 authors:
 - Jaryl Sim