standard_id 0.30.0 → 0.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4df6991c3cbb7aef140e051d72b3f935b8df67cfa2cb9464ee4edbfce15da54
-  data.tar.gz: 77369b34dfb1704913c5a65201af083e089f32cad50cfc4e9617b1b4a2916cf6
+  metadata.gz: f929d1f67a0302d3b2f93043c5ac009d8d98195a8c1f3f5c7e79ca45210873dc
+  data.tar.gz: 1b58091aeb06c9d3a13a3fc57dd710688dd75c8be48d2d950b19bfc400cb00d0
 SHA512:
-  metadata.gz: ccb1224de12859d408ddbdaeed0e05066195515108109f5088475d299c697f44dc6c1b80869936ea2452a8639dec1d5f922d52a94f4d48fdf2f4190d3d20e60d
-  data.tar.gz: 1457a6e23483a48c2a84a32a2e03827da964c296f75232238d99da65995f3317b8a5622ed5fcc0180be304a166bb6b98b5baeb0390f81bfa432765049196700d
+  metadata.gz: b4dbbac7f24a1cb89efa9787e2acbed6ab4f8fa531d84c525344f3069c4d6bd0be2d5a17f014074f700c5af88be2b6c071ed6d1ecb94d1b27fec172bf8d3b169
+  data.tar.gz: 265319cf5f65851df3e4a7f8a24d3aa4765d001a27e4d89797e10cc372f4515d558b785863810cd71e7f8d577e4388c1b8f98dfe273218824e29fa7f8e3f9183

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.31.0] - 2026-07-27
+
+### Fixed
+
+- **`EmailIdentifier` now rejects dot-atom violations in the local part.**
+  `URI::MailTo::EMAIL_REGEXP` models the local part as one flat character class
+  that happens to include `.`, so it accepted dot placements RFC 5322 forbids in
+  an unquoted local part — a leading dot, a trailing dot, and consecutive dots.
+  `a..b@example.com` passed it. Email service providers do not accept these:
+  Postmark rejects them at *send* time with `InvalidEmailRequestError`, so a
+  typo accepted at sign-up only surfaced much later as a failed delivery job,
+  long after the user could have corrected it. The domain pattern is
+  `URI::MailTo`'s own, unchanged; only the local part is stricter.
+
+  **Consumer impact.** Addresses your app previously accepted may now be
+  rejected at the identifier layer. The validation is scoped to a *changed*
+  value, so rows created under the looser rule keep saving until someone edits
+  the address — an existing account will not be locked out of a flow that merely
+  stamps `verified_at`. Check any test fixtures or seeds using addresses with
+  doubled or edge dots.
+
 ## [0.30.0] - 2026-07-26
 
 ### Added

data/app/models/standard_id/email_identifier.rb

@@ -1,7 +1,28 @@
 module StandardId
   class EmailIdentifier < Identifier
+    # `URI::MailTo::EMAIL_REGEXP` models the local part as one flat character
+    # class that happens to include `.`, so it accepts dot placements RFC 5322
+    # forbids in an unquoted local part: a leading dot, a trailing dot, and
+    # consecutive dots. `a..b@example.com` passes it.
+    #
+    # ESPs do not. Postmark rejects such an address at send time with
+    # `InvalidEmailRequestError`, so a typo accepted at sign-up surfaces much
+    # later as a failed delivery job that no operator can act on — the address
+    # is already stored and the user is long gone.
+    #
+    # Enforce the dot-atom rule instead: the local part is dot-separated atoms,
+    # each at least one character. The domain pattern is `URI::MailTo`'s,
+    # unchanged.
+    LOCAL_PART = %r{[A-Za-z0-9!\#$%&'*+/=?^_`{|}~-]+(?:\.[A-Za-z0-9!\#$%&'*+/=?^_`{|}~-]+)*}
+    DOMAIN = /[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*/
+    EMAIL_FORMAT = /\A#{LOCAL_PART}@#{DOMAIN}\z/
+
     normalizes :value, with: ->(e) { e.strip.downcase }
 
-    validates :value, format: { with: URI::MailTo::EMAIL_REGEXP }
+    # Scoped to a changed value so tightening the rule cannot strand an account
+    # created under the looser one: an existing row keeps working until someone
+    # actually edits the address. Without this, saving an unrelated attribute on
+    # a grandfathered identifier would start raising.
+    validates :value, format: { with: EMAIL_FORMAT }, if: :value_changed?
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.30.0"
+  VERSION = "0.31.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.30.0
+  version: 0.31.0
 platform: ruby
 authors:
 - Jaryl Sim