standard_id 0.27.0 → 0.28.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2917c7c97e54e0fd55a78e52c0f8eb202e3e1221267d5fe25af54da788c0e85
-  data.tar.gz: 7d2dad4ae7677431a6df91efef81ef0cf08794d7adc26be6b26fede63247f358
+  metadata.gz: c3aa81db933d1f506926c8c400e2bc57f60a7b29529f7bfa514e71b68fe028c1
+  data.tar.gz: 47a3be048ef63b02ee3819354dae0e4af75cb21a88d740e5b72e754c55471a2a
 SHA512:
-  metadata.gz: 5bc7d5bc447389b6cb44ae9962820fcb6a4bfb2109dc1e82fb334cfdba08d8dab1c1f8d7c41e63ee47ec8962b3a2ee38bd59d02ada3177b6ede3adce246398a2
-  data.tar.gz: 7d27375bfce3b17ff6ede7690f6e114f0e84d374c792e02d6c847f90a8a5a6d4c5492a57df596a94d8dbae073aa39c67627498c23c05ddb3639517d580ad4437
+  metadata.gz: e4b6618506a9428d7a426ad4d095bd95fd2aa9c3f7b58e8727f20e8300d8dc3c6f622da1e07829961474c392d35a292775f4596b36e39c0961f66a28cca2db7a
+  data.tar.gz: 585a4b2d8c65e4d9de10eb8466d99c9323ea6279459edf21fe72705f829688cded440133faaa50317a01bcf4d2544ecf48b01749527287be73cc042eb833fe6a

data/app/controllers/standard_id/web/reset_password/start_controller.rb

@@ -7,6 +7,23 @@ module StandardId
 
         layout "public"
 
+        # Rate limit reset-request generation by IP (10 per hour). The endpoint
+        # emails a reset token, so without a limit it's an email-flooding vector.
+        rate_limit to: StandardId.config.rate_limits.password_reset_start_per_ip,
+                   within: 1.hour,
+                   name: "reset-password-ip",
+                   only: :create,
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
+        # Rate limit reset requests by email target (3 per 15 minutes) to blunt
+        # account-enumeration probing of individual addresses.
+        rate_limit to: StandardId.config.rate_limits.password_reset_start_per_target,
+                   within: 15.minutes,
+                   by: -> { "reset-password:#{params[:email].to_s.strip.downcase}" },
+                   name: "reset-password-target",
+                   only: :create,
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
         skip_before_action :require_browser_session!, only: [:show, :create]
 
         def show

data/app/controllers/standard_id/web/signup_controller.rb

@@ -9,6 +9,13 @@ module StandardId
 
       layout "public"
 
+      # Throttle account-creation spam by IP (10 per hour).
+      rate_limit to: StandardId.config.rate_limits.signup_per_ip,
+                 within: 1.hour,
+                 name: "signup-ip",
+                 only: :create,
+                 store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
       skip_before_action :require_browser_session!, only: [:show, :create]
 
       before_action :redirect_if_authenticated, only: [:show]

data/app/controllers/standard_id/web/verify_email/confirm_controller.rb

@@ -2,6 +2,15 @@ module StandardId
   module Web
     module VerifyEmail
       class ConfirmController < BaseController
+        # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
+        # verify). The per-challenge attempt cap alone doesn't stop distributed
+        # guessing across many challenges; both show and update probe a code.
+        rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
+                   within: 15.minutes,
+                   name: "verify-email-confirm-ip",
+                   only: [:show, :update],
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
         before_action :prepare_code_challenge
 
         def show

data/app/controllers/standard_id/web/verify_phone/confirm_controller.rb

@@ -2,6 +2,15 @@ module StandardId
   module Web
     module VerifyPhone
       class ConfirmController < BaseController
+        # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
+        # verify). The per-challenge attempt cap alone doesn't stop distributed
+        # guessing across many challenges; both show and update probe a code.
+        rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
+                   within: 15.minutes,
+                   name: "verify-phone-confirm-ip",
+                   only: [:show, :update],
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
         before_action :prepare_code_challenge
 
         def show

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -153,7 +153,10 @@ StandardId.configure do |c|
   # for backwards compatibility; new installs should set the newer key.
   # c.passwordless.max_attempts = 3
 
-  # Default: 30 — seconds before a new challenge can be requested.
+  # Default: 30 — OTP-resend cooldown: minimum seconds before the same target
+  # can request another code. Enforced in the passwordless start path; a resend
+  # inside the window is rejected (the already-sent code stays valid). Set to 0
+  # to disable the cooldown.
   # c.passwordless.retry_delay = 30
 
   # Custom username validator; return nil/false to accept, or an error message

data/lib/standard_id/config/schema.rb

@@ -352,6 +352,15 @@ StandardId::ConfigSchema.define do
     field :verification_start_per_target, type: :integer, default: 3 # per 15 minutes
     field :verification_start_per_ip, type: :integer, default: 10    # per hour
 
+    # Password-reset request. The start endpoint emails a reset token, so an
+    # unthrottled endpoint is an email-flooding + account-enumeration vector.
+    # Mirrors the verification_start shape (per-IP hourly + per-target 15-min).
+    field :password_reset_start_per_ip, type: :integer, default: 10      # per hour
+    field :password_reset_start_per_target, type: :integer, default: 3   # per 15 minutes
+
+    # Password signup — throttle account-creation spam by IP.
+    field :signup_per_ip, type: :integer, default: 10                    # per hour
+
     # API equivalents
     field :api_passwordless_start_per_ip, type: :integer, default: 10    # per hour
     field :api_passwordless_start_per_target, type: :integer, default: 5 # per 15 minutes

data/lib/standard_id/passwordless/base_strategy.rb

@@ -23,6 +23,7 @@ module StandardId
 
         validate_username!(username)
         run_username_validator!(username)
+        enforce_retry_delay!(username)
         emit_code_requested(username)
         challenge = create_challenge!(
           username,
@@ -43,6 +44,29 @@ module StandardId
 
       protected
 
+      # Reject a resend that arrives within passwordless.retry_delay seconds of
+      # the most recent still-active code for this target. A soft cooldown that
+      # complements the coarser per-target rate limits: it does not consume the
+      # active challenge, so the code already sent remains usable. Raises
+      # InvalidRequestError (rescued by the web login + API OAuth error handlers).
+      def enforce_retry_delay!(username)
+        delay = StandardId::Passwordless.retry_delay
+        return if delay <= 0
+
+        last = StandardId::CodeChallenge.active
+          .where(realm: @realm, channel: connection_type, target: username)
+          .order(created_at: :desc)
+          .first
+        return if last.nil?
+
+        elapsed = Time.current - last.created_at
+        return if elapsed >= delay
+
+        wait = (delay - elapsed).ceil
+        raise StandardId::InvalidRequestError,
+          "Please wait #{wait} #{'second'.pluralize(wait)} before requesting another code"
+      end
+
       def create_challenge!(username, code_length: nil, expires_in: nil, metadata: {})
         ActiveRecord::Base.transaction do
           invalidate_active_challenges!(username)

data/lib/standard_id/passwordless.rb

@@ -83,6 +83,14 @@ module StandardId
         legacy = StandardId.config.passwordless.max_attempts.to_i
         legacy.positive? ? legacy : 5
       end
+
+      # Minimum seconds that must elapse between successive code requests for
+      # the same target (the OTP-resend cooldown). Reads passwordless.retry_delay;
+      # 0 or negative disables the cooldown. Enforced in the passwordless strategy
+      # start path (see BaseStrategy#enforce_retry_delay!).
+      def retry_delay
+        StandardId.config.passwordless.retry_delay.to_i
+      end
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.27.0"
+  VERSION = "0.28.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.27.0
+  version: 0.28.0
 platform: ruby
 authors:
 - Jaryl Sim