standard_id 0.28.0 → 0.29.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c3aa81db933d1f506926c8c400e2bc57f60a7b29529f7bfa514e71b68fe028c1
-  data.tar.gz: 47a3be048ef63b02ee3819354dae0e4af75cb21a88d740e5b72e754c55471a2a
+  metadata.gz: e92eb10b6ca75511deb6b2b825b95fc79b25db73135d1cc6c637095e7466f8e8
+  data.tar.gz: 4968ead0789aaeddb2ab68de34c224d951d988a18932e49e29125489cfa6eacb
 SHA512:
-  metadata.gz: e4b6618506a9428d7a426ad4d095bd95fd2aa9c3f7b58e8727f20e8300d8dc3c6f622da1e07829961474c392d35a292775f4596b36e39c0961f66a28cca2db7a
-  data.tar.gz: 585a4b2d8c65e4d9de10eb8466d99c9323ea6279459edf21fe72705f829688cded440133faaa50317a01bcf4d2544ecf48b01749527287be73cc042eb833fe6a
+  metadata.gz: 4c14b2551f993b7b7f9a20694ef337af4a9ebb05270c9a1cc343f43d3f3483d6196d1360786410b4140cc6c0214e82feadf5688019c347f66e0476958fb3c7c3
+  data.tar.gz: b71083067ee12c30bfedc1a1ee5ac8b9181c47fcaf790e8ee60e00eee4d73ac5a1eadcbd496e51f7244fd08bd83ec0a5a412e2cc225901c259809645b482af9a

data/app/controllers/concerns/standard_id/rate_limit_handling.rb

@@ -4,20 +4,89 @@ module StandardId
 
     RATE_LIMIT_STORE = StandardId::RateLimitStore.new
 
+    # Fallback window for the Retry-After header when the tripped limit's window
+    # was not captured on the instance — e.g. a hand-rolled `raise
+    # TooManyRequests` that bypasses the rate_limit macro (see
+    # Api::Oauth::TokensController's per-audience limit, which uses a 15-minute
+    # window). Matches that hand-rolled limit's window, so the fallback stays
+    # accurate for it.
+    DEFAULT_RETRY_AFTER = 15.minutes
+
     included do
       rescue_from ActionController::TooManyRequests, with: :handle_rate_limited
     end
 
+    class_methods do
+      # Wrap Rails' `rate_limit` so the tripped limit's window (`within:`) is
+      # remembered on the controller instance, letting the shared
+      # `handle_rate_limited` rescue emit a Retry-After that reflects the ACTUAL
+      # window instead of a hardcoded 15 minutes (which was 4x wrong for every
+      # 1-hour limit — verification/password-reset/signup/api-passwordless start,
+      # dynamic registration). This transparently upgrades every existing
+      # `rate_limit ... within: X` call site with no change to the call itself.
+      #
+      # ActionController::TooManyRequests carries no window, and a controller may
+      # declare several limits with different windows, so a single class-level
+      # value can't identify which limit fired. Capturing it in the per-limit
+      # `with:` closure (evaluated in controller context the instant that
+      # specific limit trips) is the least-invasive way to thread the correct
+      # window through. A host that passes its own `with:` opts out and keeps the
+      # default fallback.
+      def rate_limit(within:, with: nil, **options)
+        with ||= -> {
+          @standard_id_rate_limit_within = within
+          raise ActionController::TooManyRequests
+        }
+        super(within: within, with: with, **options)
+      end
+    end
+
+    # Resolve the effective per-IP login rate limit, preferring the
+    # mechanism-agnostic `login_per_ip` alias and falling back to the deprecated
+    # `password_login_per_ip` when the host left the alias at its default (i.e.
+    # only configured the old name). The new alias wins whenever explicitly set.
+    # Mirrors the max_attempts -> max_attempts_per_challenge deprecation-alias
+    # precedent (prefer-new, fall-back-to-old).
+    def self.login_per_ip
+      resolve_login_alias(:login_per_ip, :password_login_per_ip)
+    end
+
+    # Effective per-email login rate limit; see .login_per_ip.
+    def self.login_per_email
+      resolve_login_alias(:login_per_email, :password_login_per_email)
+    end
+
+    # Return the alias value unless it still equals its schema default, in which
+    # case fall back to the deprecated field. Both fields share the same default,
+    # so the effective default is unchanged when neither is set.
+    def self.resolve_login_alias(new_field, old_field)
+      rate_limits = StandardId.config.rate_limits
+      default = StandardId.config.__schema__.field_for(:rate_limits, new_field).default_value
+      new_value = rate_limits[new_field]
+      new_value == default ? rate_limits[old_field] : new_value
+    end
+
     private
 
     def handle_rate_limited(_exception)
-      response.set_header("Retry-After", 15.minutes.to_i.to_s)
+      retry_after = (@standard_id_rate_limit_within || DEFAULT_RETRY_AFTER).to_i
+      response.set_header("Retry-After", retry_after.to_s)
 
       if self.class.ancestors.include?(ActionController::API)
         render json: {
           error: "rate_limit_exceeded",
           error_description: "Too many requests. Please try again later."
         }, status: :too_many_requests
+      elsif request.get? || request.head?
+        # A rate-limited GET/HEAD has no sibling form to bounce to. Redirecting
+        # to `request.path` (the non-GET branch below) would target the SAME
+        # throttled action, so the browser follows the redirect, re-increments
+        # the counter, and gets redirected again — an unbounded loop that also
+        # keeps resetting the window. v0.28.0 shipped the first rate-limited GETs
+        # (email/phone confirm #show), which exposed this. Render a terminal 429
+        # instead: the response is the end of the exchange, so it cannot loop.
+        render plain: "Too many requests. Please try again later.",
+               status: :too_many_requests
       else
         flash[:alert] = "Too many requests. Please try again later."
         # Bounce back to the rate-limited form's own GET action. Previously this
@@ -26,7 +95,8 @@ module StandardId
         # API/control-plane that only mounts the engine — `main_app.root_path`
         # then doesn't exist), and a cross-origin `Referer` (Rails refuses the
         # redirect as unsafe). `request.path` is always a valid, same-origin GET
-        # for every rate-limited action here, so it degrades gracefully.
+        # for every rate-limited *non-GET* action here, so it degrades
+        # gracefully. (GET/HEAD are handled above to avoid a redirect loop.)
         redirect_to request.path, status: :see_other
       end
     end

data/app/controllers/standard_id/api/passwordless_controller.rb

@@ -12,10 +12,17 @@ module StandardId
                  only: :start,
                  store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-      # RAR-60: Rate limit OTP initiation by target (5 per 15 minutes)
+      # RAR-60: Rate limit OTP initiation by target (5 per 15 minutes). A blank
+      # target would collapse into one shared "api-passwordless:" bucket
+      # (`.compact` does not drop a non-nil empty string), throttling every
+      # caller; fall the key back to the remote IP when the target is blank so
+      # blank spam stays bounded per-IP without poisoning real targets.
       rate_limit to: StandardId.config.rate_limits.api_passwordless_start_per_target,
                  within: 15.minutes,
-                 by: -> { "api-passwordless:#{(params[:username] || params[:email] || params[:phone_number]).to_s.strip.downcase}" },
+                 by: -> {
+                   target = (params[:username] || params[:email] || params[:phone_number]).to_s.strip.downcase
+                   "api-passwordless:#{target.presence || request.remote_ip}"
+                 },
                  name: "passwordless-target",
                  only: :start,
                  store: StandardId::RateLimitHandling::RATE_LIMIT_STORE

data/app/controllers/standard_id/web/login_controller.rb

@@ -10,17 +10,29 @@ module StandardId
 
       layout "public"
 
-      # RAR-51: Rate limit login attempts by IP (20 per 15 minutes)
-      rate_limit to: StandardId.config.rate_limits.password_login_per_ip,
+      # RAR-51: Rate limit login attempts by IP (20 per 15 minutes). Reads the
+      # mechanism-agnostic `login_per_ip` alias, falling back to the deprecated
+      # `password_login_per_ip` — this action branches password OR passwordless,
+      # so on a passwordless app this governs the OTP-send limit, not a password
+      # login. See StandardId::RateLimitHandling.login_per_ip.
+      rate_limit to: StandardId::RateLimitHandling.login_per_ip,
                  within: 15.minutes,
                  name: "login-ip",
                  only: :create,
                  store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-      # RAR-51: Rate limit login attempts by email target (5 per 15 minutes)
-      rate_limit to: StandardId.config.rate_limits.password_login_per_email,
+      # RAR-51: Rate limit login attempts by email target (5 per 15 minutes).
+      # A blank email would otherwise collapse every blank-target request into
+      # one shared "login-email:" bucket (`.compact` does not drop a non-nil
+      # empty string), so blank spam throttles all users. Fall the key back to
+      # the remote IP when the target is blank, keeping it bounded per-IP while
+      # a well-formed email keeps its own per-target bucket.
+      rate_limit to: StandardId::RateLimitHandling.login_per_email,
                  within: 15.minutes,
-                 by: -> { "login-email:#{params.dig(:login, :email).to_s.strip.downcase}" },
+                 by: -> {
+                   email = params.dig(:login, :email).to_s.strip.downcase
+                   "login-email:#{email.presence || request.remote_ip}"
+                 },
                  name: "login-email",
                  only: :create,
                  store: StandardId::RateLimitHandling::RATE_LIMIT_STORE

data/app/controllers/standard_id/web/reset_password/start_controller.rb

@@ -16,10 +16,17 @@ module StandardId
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
         # Rate limit reset requests by email target (3 per 15 minutes) to blunt
-        # account-enumeration probing of individual addresses.
+        # account-enumeration probing of individual addresses. A blank email
+        # would collapse into one shared "reset-password:" bucket (`.compact`
+        # does not drop a non-nil empty string), throttling everyone; fall the
+        # key back to the remote IP when blank so it stays bounded per-IP without
+        # poisoning real targets.
         rate_limit to: StandardId.config.rate_limits.password_reset_start_per_target,
                    within: 15.minutes,
-                   by: -> { "reset-password:#{params[:email].to_s.strip.downcase}" },
+                   by: -> {
+                     email = params[:email].to_s.strip.downcase
+                     "reset-password:#{email.presence || request.remote_ip}"
+                   },
                    name: "reset-password-target",
                    only: :create,
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE

data/app/controllers/standard_id/web/verify_email/start_controller.rb

@@ -9,10 +9,17 @@ module StandardId
                    only: :create,
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-        # RAR-56: Rate limit verification code generation by email target (3 per 15 minutes)
+        # RAR-56: Rate limit verification code generation by email target (3 per
+        # 15 minutes). A blank email would collapse into one shared
+        # "verify-email:" bucket (`.compact` does not drop a non-nil empty
+        # string), throttling everyone; fall the key back to the remote IP when
+        # blank so it stays bounded per-IP without poisoning real targets.
         rate_limit to: StandardId.config.rate_limits.verification_start_per_target,
                    within: 15.minutes,
-                   by: -> { "verify-email:#{params[:email].to_s.strip.downcase}" },
+                   by: -> {
+                     email = params[:email].to_s.strip.downcase
+                     "verify-email:#{email.presence || request.remote_ip}"
+                   },
                    name: "verify-email-target",
                    only: :create,
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE

data/app/controllers/standard_id/web/verify_phone/start_controller.rb

@@ -9,10 +9,17 @@ module StandardId
                    only: :create,
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-        # RAR-56: Rate limit verification code generation by phone target (3 per 15 minutes)
+        # RAR-56: Rate limit verification code generation by phone target (3 per
+        # 15 minutes). A blank phone would collapse into one shared
+        # "verify-phone:" bucket (`.compact` does not drop a non-nil empty
+        # string), throttling everyone; fall the key back to the remote IP when
+        # blank so it stays bounded per-IP without poisoning real targets.
         rate_limit to: StandardId.config.rate_limits.verification_start_per_target,
                    within: 15.minutes,
-                   by: -> { "verify-phone:#{params[:phone_number].to_s.strip}" },
+                   by: -> {
+                     phone = params[:phone_number].to_s.strip
+                     "verify-phone:#{phone.presence || request.remote_ip}"
+                   },
                    name: "verify-phone-target",
                    only: :create,
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE

data/app/helpers/standard_id/application_helper.rb

@@ -6,5 +6,13 @@ module StandardId
     def otp_code_length
       StandardId::Passwordless.otp_code_length
     end
+
+    # The configured OTP resend cooldown, in seconds. The native login_verify
+    # view uses this to drive a client-side "resend in Ns" countdown that mirrors
+    # the server-side cooldown (passwordless.retry_delay, enforced in
+    # BaseStrategy#enforce_retry_delay!). 0 or negative means no cooldown.
+    def otp_retry_delay
+      StandardId::Passwordless.retry_delay
+    end
   end
 end

data/app/views/standard_id/web/login/show.html.erb

@@ -17,7 +17,7 @@
       <p role="status"><%= flash[:notice] %></p>
     <% end %>
 
-    <%= form_with url: login_path, method: :post, local: true do |form| %>
+    <%= form_with url: login_path, method: :post, local: true, html: { id: "passwordless-login-form" } do |form| %>
       <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
 
       <p>
@@ -26,10 +26,33 @@
       </p>
 
       <p>
-        <%= form.submit "Continue" %>
+        <%= form.submit "Continue", data: { sending_label: "Sending…" } %>
       </p>
     <% end %>
 
+    <%#
+      Progressive-enhancement double-submit guard. With JS off the form submits
+      normally; with JS on we disable the submit button on the first submit so an
+      impatient double-click can't fire two OTP requests. Disabling happens IN the
+      submit handler — the browser has already serialized the form for the native
+      (non-AJAX) submit by then, so the request still goes through. Vanilla JS
+      only; the gem ships no JS framework.
+    %>
+    <script>
+      (function () {
+        var form = document.getElementById("passwordless-login-form");
+        if (!form) return;
+        form.addEventListener("submit", function () {
+          var btn = form.querySelector('input[type="submit"], button[type="submit"]');
+          if (!btn || btn.dataset.stdidSubmitting === "true") return;
+          btn.dataset.stdidSubmitting = "true";
+          btn.disabled = true;
+          var label = btn.getAttribute("data-sending-label") || "Sending…";
+          if (btn.tagName === "INPUT") { btn.value = label; } else { btn.textContent = label; }
+        });
+      })();
+    </script>
+
     <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
       <%= render "standard_id/web/login/social_buttons" %>
     <% end %>

data/app/views/standard_id/web/login_verify/show.html.erb

@@ -30,6 +30,54 @@
           <%= form.submit "Verify", class: "flex w-full justify-center rounded-md bg-indigo-600 px-3 py-1.5 text-sm/6 font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 dark:bg-indigo-500 dark:shadow-none dark:hover:bg-indigo-400 dark:focus-visible:outline-indigo-500" %>
         </div>
       <% end %>
+
+      <%#
+        Resend code. Re-runs the passwordless start path (POST /login with the
+        same email), which re-issues an OTP and redirects back here. The server
+        enforces a resend cooldown (passwordless.retry_delay) and rejects an early
+        resend with a flash alert, so this is safe with JS off. With JS on we mirror
+        that cooldown as a visible "Resend in Ns" countdown and keep the button
+        disabled until it hits 0. @otp_data comes from require_otp_payload!.
+      %>
+      <div class="mt-6 text-center text-sm/6 text-gray-500 dark:text-gray-400">
+        <%= form_with url: login_path, method: :post, local: true, html: { id: "resend-otp-form", class: "inline" } do |resend_form| %>
+          <%= resend_form.hidden_field "login[email]", value: @otp_data[:username] %>
+          Didn't get a code?
+          <button type="submit" id="resend-otp-button" data-retry-delay="<%= otp_retry_delay %>" class="font-semibold text-indigo-600 hover:text-indigo-500 disabled:cursor-not-allowed disabled:text-gray-400 dark:text-indigo-400 dark:hover:text-indigo-300 dark:disabled:text-gray-500">
+            Resend code
+          </button>
+        <% end %>
+      </div>
     </div>
   </div>
 </div>
+
+<%#
+  Client-side resend cooldown. Progressive enhancement: with JS off the button is
+  always active and the server's retry_delay guard is the backstop. Vanilla JS only.
+%>
+<script>
+  (function () {
+    var btn = document.getElementById("resend-otp-button");
+    if (!btn) return;
+    var delay = parseInt(btn.getAttribute("data-retry-delay"), 10);
+    if (!delay || delay <= 0) return;
+
+    var label = "Resend code";
+    var remaining = delay;
+
+    function tick() {
+      if (remaining <= 0) {
+        btn.disabled = false;
+        btn.textContent = label;
+        return;
+      }
+      btn.disabled = true;
+      btn.textContent = "Resend in " + remaining + "s";
+      remaining -= 1;
+      window.setTimeout(tick, 1000);
+    }
+
+    tick();
+  })();
+</script>

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -362,8 +362,14 @@ StandardId.configure do |c|
   # ---------------------------------------------------------------------------
   # Defaults are conservative; tune per environment.
 
-  # c.rate_limits.password_login_per_ip          = 20  # per 15 minutes
-  # c.rate_limits.password_login_per_email       = 5   # per 15 minutes
+  # Login limits. The login action branches password OR passwordless, so on a
+  # passwordless app these govern the OTP-SEND limit. Prefer the
+  # mechanism-agnostic names; the deprecated password_login_* names still work
+  # (the new name wins when both are set).
+  # c.rate_limits.login_per_ip                   = 20  # per 15 minutes
+  # c.rate_limits.login_per_email                = 5   # per 15 minutes
+  # c.rate_limits.password_login_per_ip          = 20  # deprecated alias of login_per_ip
+  # c.rate_limits.password_login_per_email       = 5   # deprecated alias of login_per_email
   # c.rate_limits.otp_verify_per_ip              = 20  # per 15 minutes
   # c.rate_limits.verification_start_per_target  = 3   # per 15 minutes
   # c.rate_limits.verification_start_per_ip      = 10  # per hour

data/lib/standard_id/config/schema.rb

@@ -341,9 +341,24 @@ StandardId::ConfigSchema.define do
 
   # Rate limiting defaults (used by Rails 8 built-in rate_limit DSL)
   scope :rate_limits do
-    # RAR-51: Password login
-    field :password_login_per_ip, type: :integer, default: 20        # per 15 minutes
-    field :password_login_per_email, type: :integer, default: 5      # per 15 minutes
+    # RAR-51: Login rate limits.
+    #
+    # Mechanism-agnostic aliases. The `rate_limit` macro that consumes these
+    # sits on Web::LoginController#create, which branches password OR
+    # passwordless — so on a passwordless app these govern the OTP-SEND limit,
+    # not a password login. Prefer these names for new config.
+    field :login_per_ip, type: :integer, default: 20                 # per 15 minutes
+    field :login_per_email, type: :integer, default: 5               # per 15 minutes
+
+    # Deprecated mechanism-specific names, retained for backwards compatibility.
+    # The schema raises ConfigurationError on unknown fields at boot, so these
+    # must NOT be removed while hosts still set them. When a host leaves the
+    # `login_per_*` alias at its default, the login controller falls back to
+    # these values (see StandardId::RateLimitHandling.login_per_ip). New name
+    # wins when explicitly set. Mirrors the max_attempts ->
+    # max_attempts_per_challenge deprecation-alias precedent.
+    field :password_login_per_ip, type: :integer, default: 20        # per 15 minutes; deprecated alias of login_per_ip
+    field :password_login_per_email, type: :integer, default: 5      # per 15 minutes; deprecated alias of login_per_email
 
     # RAR-60: OTP verification
     field :otp_verify_per_ip, type: :integer, default: 20            # per 15 minutes
@@ -361,9 +376,16 @@ StandardId::ConfigSchema.define do
     # Password signup — throttle account-creation spam by IP.
     field :signup_per_ip, type: :integer, default: 10                    # per hour
 
-    # API equivalents
+    # API OTP-initiation limits — the API counterpart of the web *login* limits
+    # (login_per_* / the deprecated password_login_*): the API passwordless
+    # `start` action and the web login action both drive the passwordless
+    # `start!` strategy. NOT the counterpart of verification_start_*
+    # (email/phone verification), which bypasses the strategy via a direct
+    # CodeChallenge.create!.
     field :api_passwordless_start_per_ip, type: :integer, default: 10    # per hour
     field :api_passwordless_start_per_target, type: :integer, default: 5 # per 15 minutes
+
+    # OAuth token endpoint — requests per IP.
     field :api_token_per_ip, type: :integer, default: 30                 # per 15 minutes
 
     # Optional per-audience tightening on top of the api_token_per_ip

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.28.0"
+  VERSION = "0.29.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.28.0
+  version: 0.29.0
 platform: ruby
 authors:
 - Jaryl Sim