standard_id 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a164420e3b36d754be94711721ead8cb4d29efed42fd6e75b0060e1c8c7c3bce
-  data.tar.gz: cded0bf7e847cc77ed0f6aa7c69647435c847d62ae02c2af1466778a507f88f4
+  metadata.gz: 6f6c0f3655d0ae20c828fa745d3c600bcf9b0b11521c1c498eb601d35e24e3e2
+  data.tar.gz: 1f3cca500ec2bf46a4e92b9d8d4a14c7c5fff2d898567a616094b47fd7af5312
 SHA512:
-  metadata.gz: 0b9b506d8014bd8d8cd380b1f5300a87d2d6825e073e8b959c67cbfeac3eb577abe671c9dac330833c8d27ee010b87786f533ac4e247459d691dd956d5053faf
-  data.tar.gz: ec1a9973e61d08fff4579099dbcac25ad8355d140994c51c2621559d4aed39486d2fdd891b451ade775799f792c3db19916d555d3a50f3bc84d07ed77c1f0a52
+  metadata.gz: d9cb2f2cafa4ddfb0af5839168db2566769b968689a3386c5519b0dc0e06bf0a5cd1a1434df57885549000c85e5eabb2b2608b276338f969625833d09de0c118
+  data.tar.gz: 4a382d6268709dfe42bac61e60f969153e5054831345250ada9c08436f0681fe5a4b58454ffbf3c00f506ec40308f031e28ac65acd52c8484f7c1adbd0c88738

data/app/controllers/concerns/standard_id/api_authentication.rb

@@ -2,6 +2,12 @@ module StandardId
   module ApiAuthentication
     extend ActiveSupport::Concern
 
+    included do
+      if StandardId.config.alias_current_user
+        define_method(:current_user) { current_account }
+      end
+    end
+
     delegate :current_session, :current_account, :revoke_current_session!, to: :session_manager
 
     private

data/app/controllers/concerns/standard_id/controller_policy.rb

@@ -0,0 +1,99 @@
+require "monitor"
+require "set"
+
+module StandardId
+  module ControllerPolicy
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :_standard_id_auth_policy, instance_writer: false
+    end
+
+    class_methods do
+      # Declares this controller as public (no host-app auth required).
+      def public_controller
+        self._standard_id_auth_policy = :public
+        ControllerPolicy.register(self, :public)
+      end
+
+      # Declares this controller as authenticated (requires host-app
+      # authentication but not authorization).
+      def authenticated_controller
+        self._standard_id_auth_policy = :authenticated
+        ControllerPolicy.register(self, :authenticated)
+      end
+
+      # Auto-register subclasses that inherit a policy declaration.
+      # This ensures controllers like VerifyEmail::ConfirmController
+      # (which inherits from VerifyEmail::BaseController) appear in
+      # the registry and receive AuthorizationBypass skips.
+      def inherited(subclass)
+        super
+        policy = subclass._standard_id_auth_policy
+        ControllerPolicy.register(subclass, policy) if policy
+      end
+    end
+
+    # Monitor instead of Mutex: registry is called from within synchronized
+    # blocks (e.g. register, public_controllers), so we need reentrant locking.
+    LOCK = Monitor.new
+    private_constant :LOCK
+
+    class << self
+      def public_controllers
+        LOCK.synchronize { registry[:public].dup }
+      end
+
+      def authenticated_controllers
+        LOCK.synchronize { registry[:authenticated].dup }
+      end
+
+      def all_controllers
+        LOCK.synchronize { registry[:public] + registry[:authenticated] }
+      end
+
+      # Registers a controller under the given policy. Raises if the
+      # controller is already registered under the opposite policy.
+      # Re-registering under the same policy is a safe no-op (Set semantics).
+      def register(controller, policy)
+        LOCK.synchronize do
+          other = policy == :public ? :authenticated : :public
+          if registry[other].include?(controller)
+            raise ArgumentError, "#{controller} is already registered as #{other}"
+          end
+
+          registry[policy] << controller
+        end
+
+        # If AuthorizationBypass has already been applied, apply skips to this
+        # newly registered controller immediately. This handles dev-mode lazy
+        # loading where controllers register after the initial apply_skips! call.
+        AuthorizationBypass.apply_to_controller(controller, policy) if AuthorizationBypass.applied?
+      end
+
+      # Returns a point-in-time copy of the registry, safe to iterate
+      # without holding the lock.
+      def registry_snapshot
+        LOCK.synchronize do
+          (@registry ||= { public: Set.new, authenticated: Set.new })
+            .transform_values(&:dup)
+        end
+      end
+
+      private
+
+      def registry
+        LOCK.synchronize { @registry ||= { public: Set.new, authenticated: Set.new } }
+      end
+
+      public
+
+      # @api private — intended for test isolation only.
+      def reset_registry!
+        LOCK.synchronize do
+          @registry = { public: Set.new, authenticated: Set.new }
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/standard_id/sentry_context.rb

@@ -0,0 +1,36 @@
+module StandardId
+  # Sets Sentry user context from the current authenticated account.
+  #
+  # This is a standalone concern that host apps can include in their
+  # ApplicationController to automatically set Sentry user context
+  # for each request. It eliminates the need for apps to write
+  # their own SentryContext boilerplate.
+  #
+  # Safe to include even when the Sentry gem is not installed -- the
+  # callback is a no-op if `Sentry` is not defined.
+  #
+  # @example
+  #   class ApplicationController < ActionController::Base
+  #     include StandardId::WebAuthentication
+  #     include StandardId::SentryContext
+  #   end
+  module SentryContext
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_standard_id_sentry_context
+    end
+
+    private
+
+    def set_standard_id_sentry_context
+      return unless defined?(Sentry)
+      return unless respond_to?(:current_account, true) && current_account.present?
+
+      context = { id: current_account.id }
+      context[:session_id] = current_session.id if respond_to?(:current_session, true) && current_session.present?
+
+      Sentry.set_user(context)
+    end
+  end
+end

data/app/controllers/concerns/standard_id/set_current_request_details.rb

@@ -12,7 +12,7 @@ module StandardId
       return unless defined?(::Current)
 
       ::Current.request_id = request.request_id if ::Current.respond_to?(:request_id=)
-      ::Current.ip_address = request.remote_ip if ::Current.respond_to?(:ip_address=)
+      ::Current.ip_address = StandardId::Utils::IpNormalizer.normalize(request.remote_ip) if ::Current.respond_to?(:ip_address=)
       ::Current.user_agent = request.user_agent if ::Current.respond_to?(:user_agent=)
     end
   end

data/app/controllers/concerns/standard_id/web_authentication.rb

@@ -5,6 +5,11 @@ module StandardId
     included do
       include StandardId::InertiaSupport
       helper_method :current_account, :authenticated?
+
+      if StandardId.config.alias_current_user
+        define_method(:current_user) { current_account }
+        helper_method :current_user
+      end
     end
 
     delegate :current_session, :current_account, :revoke_current_session!, to: :session_manager

data/app/controllers/standard_id/api/authorization_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Api
     class AuthorizationController < BaseController
+      public_controller
+
       include ActionController::Cookies
 
       skip_before_action :validate_content_type!

data/app/controllers/standard_id/api/base_controller.rb

@@ -1,6 +1,7 @@
 module StandardId
   module Api
     class BaseController < ActionController::API
+      include StandardId::ControllerPolicy
       include StandardId::ApiAuthentication
       include StandardId::SetCurrentRequestDetails
 

data/app/controllers/standard_id/api/oauth/callback/providers_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Api::Oauth
     module Callback
       class ProvidersController < BaseController
+        public_controller
+
         include StandardId::SocialAuthentication
 
         skip_before_action :validate_content_type!

data/app/controllers/standard_id/api/oauth/tokens_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Api
     module Oauth
       class TokensController < BaseController
+        public_controller
+
         skip_before_action :validate_content_type!
 
         FLOW_STRATEGIES = {

data/app/controllers/standard_id/api/oidc/logout_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Api
     module Oidc
       class LogoutController < ::StandardId::Api::BaseController
+        public_controller
+
         include ActionController::Cookies
 
         skip_before_action :validate_content_type!

data/app/controllers/standard_id/api/passwordless_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Api
     class PasswordlessController < BaseController
+      public_controller
+
       include StandardId::PasswordlessStrategy
 
       def start

data/app/controllers/standard_id/api/userinfo_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Api
     class UserinfoController < BaseController
+      authenticated_controller
+
       skip_before_action :validate_content_type!
 
       def show

data/app/controllers/standard_id/api/well_known/jwks_controller.rb

@@ -3,7 +3,13 @@
 module StandardId
   module Api
     module WellKnown
+      # Inherits from ActionController::API (not Api::BaseController) to avoid
+      # content-type validation and no-store cache headers — JWKS is a public,
+      # cacheable endpoint. Includes ControllerPolicy directly as a result.
       class JwksController < ActionController::API
+        include StandardId::ControllerPolicy
+        public_controller
+
         def show
           jwks = StandardId::JwtService.jwks
 

data/app/controllers/standard_id/web/account_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Web
     class AccountController < BaseController
+      authenticated_controller
+
       def show
         @account = current_account
         @sessions = current_account.sessions.active.order(created_at: :desc)

data/app/controllers/standard_id/web/auth/callback/providers_controller.rb

@@ -3,6 +3,8 @@ module StandardId
     module Auth
       module Callback
         class ProvidersController < StandardId::Web::BaseController
+          public_controller
+
           include StandardId::WebAuthentication
           include StandardId::SocialAuthentication
           include StandardId::Web::SocialLoginParams

data/app/controllers/standard_id/web/base_controller.rb

@@ -1,6 +1,7 @@
 module StandardId
   module Web
     class BaseController < ApplicationController
+      include StandardId::ControllerPolicy
       include StandardId::WebAuthentication
       include StandardId::SetCurrentRequestDetails
 

data/app/controllers/standard_id/web/login_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Web
     class LoginController < BaseController
+      public_controller
+
       include StandardId::InertiaRendering
       include StandardId::Web::SocialLoginParams
       include StandardId::PasswordlessStrategy

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -1,10 +1,9 @@
 module StandardId
   module Web
     class LoginVerifyController < BaseController
-      include StandardId::InertiaRendering
-      include StandardId::PasswordlessStrategy
+      public_controller
 
-      class OtpVerificationFailed < StandardError; end
+      include StandardId::InertiaRendering
 
       layout "public"
 
@@ -27,42 +26,21 @@ module StandardId
           return
         end
 
-        # Record failed attempts outside the main transaction so they persist
-        challenge = find_active_challenge
-        attempts = record_attempt(challenge, code)
-
-        if challenge.blank? || !ActiveSupport::SecurityUtils.secure_compare(challenge.code, code)
-          emit_otp_validation_failed(attempts) if challenge.present?
+        result = StandardId::Passwordless::VerificationService.verify(
+          connection: @otp_data[:connection],
+          username: @otp_data[:username],
+          code: code,
+          request: request
+        )
 
-          flash.now[:alert] = "Invalid or expired verification code"
+        unless result.success?
+          flash.now[:alert] = result.error
           render_with_inertia action: :show, props: verify_page_props, status: :unprocessable_content
           return
         end
 
-        strategy = strategy_for(@otp_data[:connection])
-
-        begin
-          ActiveRecord::Base.transaction do
-            # Re-fetch with lock inside transaction to prevent concurrent use
-            locked_challenge = StandardId::CodeChallenge.lock.find(challenge.id)
-            raise OtpVerificationFailed unless locked_challenge.active?
-
-            account = strategy.find_or_create_account(@otp_data[:username])
-            locked_challenge.use!
-
-            emit_otp_validated(account, locked_challenge)
-            session_manager.sign_in_account(account)
-            emit_authentication_succeeded(account)
-          end
-        rescue OtpVerificationFailed
-          flash.now[:alert] = "Invalid or expired verification code"
-          render_with_inertia action: :show, props: verify_page_props, status: :unprocessable_content
-          return
-        rescue ActiveRecord::RecordInvalid => e
-          flash.now[:alert] = "Unable to complete sign in: #{e.record.errors.full_messages.to_sentence}"
-          render_with_inertia action: :show, props: verify_page_props, status: :unprocessable_content
-          return
-        end
+        session_manager.sign_in_account(result.account)
+        emit_authentication_succeeded(result.account)
 
         session.delete(:standard_id_otp_payload)
 
@@ -98,56 +76,6 @@ module StandardId
         end
       end
 
-      def find_active_challenge
-        StandardId::CodeChallenge.active.find_by(
-          realm: "authentication",
-          channel: @otp_data[:connection],
-          target: @otp_data[:username]
-        )
-      end
-
-      def record_attempt(challenge, code)
-        return 0 if challenge.blank?
-        return 0 if ActiveSupport::SecurityUtils.secure_compare(challenge.code, code)
-
-        attempts = (challenge.metadata["attempts"] || 0) + 1
-        challenge.update!(metadata: challenge.metadata.merge("attempts" => attempts))
-
-        max_attempts = StandardId.config.passwordless.max_attempts
-        challenge.use! if attempts >= max_attempts
-
-        attempts
-      end
-
-      def emit_otp_validated(account, challenge)
-        StandardId::Events.publish(
-          StandardId::Events::OTP_VALIDATED,
-          account: account,
-          channel: @otp_data[:connection]
-        )
-        StandardId::Events.publish(
-          StandardId::Events::PASSWORDLESS_CODE_VERIFIED,
-          code_challenge: challenge,
-          account: account,
-          channel: @otp_data[:connection]
-        )
-      end
-
-      def emit_otp_validation_failed(attempts)
-        StandardId::Events.publish(
-          StandardId::Events::OTP_VALIDATION_FAILED,
-          identifier: @otp_data[:username],
-          channel: @otp_data[:connection],
-          attempts: attempts
-        )
-        StandardId::Events.publish(
-          StandardId::Events::PASSWORDLESS_CODE_FAILED,
-          identifier: @otp_data[:username],
-          channel: @otp_data[:connection],
-          attempts: attempts
-        )
-      end
-
       def emit_authentication_succeeded(account)
         StandardId::Events.publish(
           StandardId::Events::AUTHENTICATION_SUCCEEDED,

data/app/controllers/standard_id/web/logout_controller.rb

@@ -1,6 +1,13 @@
 module StandardId
   module Web
     class LogoutController < BaseController
+      # Classified as authenticated (not public) because logout requires
+      # host-app authentication. The controller handles unauthenticated
+      # users gracefully via redirect_if_not_authenticated rather than
+      # raising, and skips require_browser_session! to allow session
+      # revocation even with an expired browser session.
+      authenticated_controller
+
       skip_before_action :require_browser_session!, only: [:create]
 
       before_action :redirect_if_not_authenticated

data/app/controllers/standard_id/web/reset_password/confirm_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Web
     module ResetPassword
       class ConfirmController < BaseController
+        public_controller
+
         layout "public"
 
         skip_before_action :require_browser_session!, only: [:show, :update]

data/app/controllers/standard_id/web/reset_password/start_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Web
     module ResetPassword
       class StartController < BaseController
+        public_controller
+
         layout "public"
 
         skip_before_action :require_browser_session!, only: [:show, :create]

data/app/controllers/standard_id/web/sessions_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Web
     class SessionsController < BaseController
+      authenticated_controller
+
       def index
         @sessions = current_account.sessions.active.order(created_at: :desc)
         @current_session = current_session

data/app/controllers/standard_id/web/signup_controller.rb

@@ -1,6 +1,8 @@
 module StandardId
   module Web
     class SignupController < BaseController
+      public_controller
+
       include StandardId::InertiaRendering
 
       layout "public"

data/app/controllers/standard_id/web/verify_email/base_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Web
     module VerifyEmail
       class BaseController < StandardId::Web::BaseController
+        public_controller
+
         skip_before_action :require_browser_session!
       end
     end

data/app/controllers/standard_id/web/verify_email/start_controller.rb

@@ -19,7 +19,7 @@ module StandardId
             target: email,
             code: generate_otp_code,
             expires_at: 10.minutes.from_now,
-            ip_address: request.remote_ip,
+            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
             user_agent: request.user_agent
           )
 

data/app/controllers/standard_id/web/verify_phone/base_controller.rb

@@ -2,6 +2,8 @@ module StandardId
   module Web
     module VerifyPhone
       class BaseController < StandardId::Web::BaseController
+        public_controller
+
         skip_before_action :require_browser_session!
       end
     end

data/app/controllers/standard_id/web/verify_phone/start_controller.rb

@@ -19,7 +19,7 @@ module StandardId
             target: phone,
             code: generate_otp_code,
             expires_at: 10.minutes.from_now,
-            ip_address: request.remote_ip,
+            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
             user_agent: request.user_agent
           )
 

data/lib/standard_id/api/session_manager.rb

@@ -12,9 +12,7 @@ module StandardId
 
       def current_account
         return unless current_session
-        @current_account ||= StandardId.account_class
-          .find_by(id: current_session.account_id)
-          &.tap { |a| a.strict_loading!(false) }
+        @current_account ||= load_current_account
       end
 
       def revoke_current_session!
@@ -28,6 +26,12 @@ module StandardId
 
       private
 
+      def load_current_account
+        scope = StandardId.account_class
+        scope = StandardId.config.account_scope.call(scope) if StandardId.config.account_scope
+        scope.find_by(id: current_session.account_id)&.tap { |a| a.strict_loading!(false) }
+      end
+
       def load_current_session
         return @current_session if @current_session.present?
 

data/lib/standard_id/api/token_manager.rb

@@ -10,7 +10,7 @@ module StandardId
       def create_device_session(account, device_id: nil, device_agent: nil)
         StandardId::DeviceSession.create!(
           account:,
-          ip_address: @request.remote_ip,
+          ip_address: StandardId::Utils::IpNormalizer.normalize(@request.remote_ip),
           device_id: device_id || SecureRandom.uuid,
           device_agent: device_agent || @request.user_agent,
           expires_at: StandardId::DeviceSession.expiry
@@ -21,7 +21,7 @@ module StandardId
         StandardId::ServiceSession.create!(
           account:,
           owner:,
-          ip_address: @request.remote_ip,
+          ip_address: StandardId::Utils::IpNormalizer.normalize(@request.remote_ip),
           service_name:,
           service_version:,
           metadata: metadata || {},