standard_id 0.32.0 → 0.34.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9186b11b608c1e58f0ea0a2c957eac6e88aaeb7ea18012fe133b40c5d77c54e9
-  data.tar.gz: 888389931fa6d8854c4632f175db13409c32991905870cdcbb2c16bc53c912cb
+  metadata.gz: 984924490081d96a84ec4570541802d70414cac9dcf9dd325b8aba6ee7af7be2
+  data.tar.gz: c132d58daeea53090156fe42bfd3b6a7b8d8a2393d7ae7a3766e0c4ece0e8a6d
 SHA512:
-  metadata.gz: 423dc3b53caf3fad0e0ba2ea41230627a07328e27fdb29439bfaaafb0701b1887f78744321c2579ac8018741a96fda684230d488604702b865e5b8193ebecce4
-  data.tar.gz: c16d76284752125e7191ca9ae7770a9fed1c3f0af6078f0221bfb294eaddf78f16701c1954147467f9118916d9d662d50dae5b6844589ffc76d65b14af406ab2
+  metadata.gz: 65dac8337e2bfa0784d43308d4c29eeeb8208c3b06b721a3f1a2f040eec1916ba35c00b8e69945f72c80a7240b95cb17ed4bf46c6939fe8c78508c44bf3363b9
+  data.tar.gz: eb1acc6703201fa5955494aec635f1821ea4d9689b49f73703736f853deb166b5eeaec1adcb20fe79c083f15903301e60829da0497ec0e138af49d2f406e4b02

data/CHANGELOG.md

@@ -7,6 +7,297 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.34.0] - 2026-07-31
+
+### Added
+
+- **`config.verify_issuer`** — decouples MINTING an `iss` claim from REQUIRING one. `nil` (default) follows `config.issuer`, which is the historic behaviour and changes nothing. Set `false` to stamp `iss` on new tokens without yet verifying it.
+
+  This exists because the two were one switch, which made adopting an issuer a flag day: every token already in flight was minted without an `iss`, so setting `config.issuer` rejected all of them at once — every access token and, far worse, every refresh token. An app that had never configured an issuer had no safe single step, which is where `nutripod-web` was stuck (rarebit-one/nutripod-web#1111) and why it could not retire its hand-rolled discovery controller with the rest of the estate.
+
+  Migration: set `issuer` with `verify_issuer = false`, wait out `refresh_token_lifetime` (the long pole — access tokens are short), then remove the override. Setting `true` with no issuer raises at boot rather than silently verifying against `nil` and accepting anything.
+
+## [0.33.0] - 2026-07-30
+
+### Added
+
+- **RFC 7662 token introspection** — `POST /oauth/introspect`, behind
+  `config.oauth.introspection_enabled` (default **false**). When off the
+  endpoint returns 404 and `introspection_endpoint` is not advertised in either
+  discovery document, mirroring how `dynamic_registration_enabled` gates
+  `/oauth/register`.
+
+  Confidential clients only: `client_id` + `client_secret`, via HTTP Basic or
+  the form body (RFC 6749 §2.3.1 — never both). Every failure mode renders
+  `{"active": false}` with **no other members**, per RFC 7662 §2.2.
+
+  Throttled per IP via `config.rate_limits.introspection_per_ip` (default 30 per
+  15 minutes).
+
+  Two properties are load-bearing and deliberately not what you would reach for:
+
+  - **The rate limit renders `{"active": false}` / 200, never 429.** A 429
+    distinguishes "you are throttled" from "that token is not valid", which turns
+    the limiter into a token-validity oracle — an attacker probes until throttled
+    and then reads the *status code* to classify tokens. This opts out of
+    `RateLimitHandling.rate_limit`'s wrapper by passing an explicit `with:`. The
+    reason is commented at the call site, because it reads like a bug otherwise.
+  - **The limit keys on `request.remote_ip`** — not Rack's `request.ip`, which
+    resolves the forwarding chain against Rack's own trusted-proxy list rather
+    than `config.action_dispatch.trusted_proxies` and therefore collapses every
+    caller behind a CDN into one bucket. And never on the `Authorization` header
+    or `client_id`: `rate_limit` is a `before_action` that runs *before* client
+    authentication, so a header-derived key is attacker-controlled and a caller
+    could mint a fresh bucket per request by rotating it.
+
+  **Know this limit before building an authorization gate on it.** Access tokens
+  are stateless — never persisted, carrying no `sid` — so **a revoked session's
+  access token introspects as `active: true` until its `exp`**. Introspection
+  answers "did we mint this, and is it unexpired?", not "is it still honoured?".
+  The only mitigation is a short access-token lifetime. Refresh tokens *are*
+  persisted (as `SHA256(jti)`) and are checked against the row, so a revoked or
+  expired refresh token introspects as inactive immediately, and is reported with
+  `token_type: "refresh_token"`. Both halves are asserted by specs, the access-token
+  one deliberately, so nobody later "corrects" the documentation to overclaim.
+
+- `config.oauth.introspection_enabled` and
+  `config.rate_limits.introspection_per_ip`, both documented inline in the
+  install template.
+
+
+- `StandardId::ProviderRegistry.declare_config_schemas!`,
+  `.declare_config_schema(provider_class)` and `.provider_classes` — public
+  entry points for the above. Useful if you define a provider somewhere the
+  boot-time sweep cannot see it (e.g. under `app/`, autoloaded) and need to
+  declare its fields yourself.
+
+- **`config.association_strict_loading`** — a supported way to opt the gem's own
+  associations out of an app-wide `strict_loading_by_default = true`.
+
+  Two consuming apps were reaching into Rails internals to do this:
+
+  ```ruby
+  Account.reflect_on_association(assoc)&.options&.[]=(:strict_loading, false)
+  ```
+
+  both with a comment asking for exactly this hook. They could not simply
+  re-declare the associations: they are declared inside
+  `StandardId::AccountAssociations`, and `credentials` is a `has_many :through`,
+  where re-declaration risks ordering breakage. Passing `strict_loading:` at
+  declaration time is the supported Rails API, and unlike re-declaration it
+  works for the `:through` association.
+
+  Covers `Account#identifiers`, `#credentials`, `#sessions`, `#refresh_tokens`,
+  `#client_applications`, plus `Session#refresh_tokens` and
+  `Identifier#credentials`.
+
+  **Tri-state, and `nil` is not `false`:**
+
+  | value | effect |
+  |---|---|
+  | `nil` (default) | no `strict_loading:` option is declared at all — the associations inherit the owner's setting, exactly as before |
+  | `false` | opt out; may lazy-load even with strict loading on app-wide |
+  | `true` | opt in; strict loading enforced even if off app-wide |
+
+  That distinction is load-bearing rather than stylistic. Rails checks
+  `reflection.options.key?(:strict_loading)` *before* consulting the owner
+  (`Association#violates_strict_loading?`), so declaring `strict_loading: nil`
+  would put the key in the options hash and make `reflection.strict_loading?`
+  return `false` — silently disabling strict loading on every gem association in
+  every app that never asked for it. The option is therefore omitted entirely
+  when unconfigured, and a spec asserts the key's absence.
+
+  **Set it in `config/initializers/standard_id.rb`, not in an
+  `after_initialize` block.** The associations read it when your `Account` class
+  body runs. StandardId raises a `ConfigurationError` at boot naming the ordering
+  problem if a declaration disagrees with the configured value — otherwise a
+  too-late assignment fails silently, surfacing as an
+  `ActiveRecord::StrictLoadingViolationError` deep inside a request or a quiet
+  N+1 in production.
+
+- **`StandardId::Session.revoke_all_for!(account, reason:)`** — bulk session
+  revocation that cascades to refresh tokens, promoted from the private
+  `RevocationsController#revoke_sessions!` where it had lived since the RFC 7009
+  endpoint was built.
+
+  Consuming apps that bulk-revoked with a bare
+  `Session.where(account:).update_all(revoked_at:)` were silently skipping the
+  refresh-token cascade that `Session#revoke!` performs, leaving the holder of a
+  refresh token able to keep minting access tokens after a password reset or
+  account deactivation — and skipping the `session.revoked` event, so
+  audit-trail and account-locking subscribers never learned. This gives them a
+  supported API instead of a local re-implementation.
+
+  Two set-based UPDATEs (one per table) rather than `sessions.each(&:revoke!)`,
+  which is O(N) UPDATEs plus O(N) cascades — these call sites are admin bulk
+  actions and password resets.
+
+  ```ruby
+  result = StandardId::Session.revoke_all_for!(account, reason: "password_reset")
+  result.sessions_revoked       # => 3
+  result.refresh_tokens_revoked # => 5
+  ```
+
+  Honours the current scope, so callers narrow as they need:
+  `StandardId::DeviceSession.active.revoke_all_for!(account, reason: "logout")`.
+  Accepts an account record or a bare id.
+
+  **Events: one `SESSION_REVOKED` per revoked session, never a single
+  aggregate** — subscribers must not need a second code path for bulk
+  revocation. Because `update_all` skips callbacks, each event is re-emitted
+  explicitly after the transaction commits, and each is individually rescued: a
+  raising subscriber must not short-circuit the loop and leave later sessions
+  without their event, which would permanently desync audit consumers from the
+  DB. Callers emit their own aggregate from the returned counts.
+
+- **`StandardId::Session.revoke_sessions!(sessions, account:, reason:)`** — the
+  same set-based core over an explicit collection, for callers that have already
+  selected the sessions (e.g. the tokens of a single authorization grant).
+
+
+- **`config.oauth.discovery_endpoint_base`** — where the advertised endpoints
+  actually live.
+
+  | value | meaning |
+  |---|---|
+  | `nil` (default) | the issuer — byte-identical to 0.32.0 |
+  | `:request` | `request.base_url` + the detected mount path |
+  | `"https://…"` | verbatim |
+  | `->(request:) { … }` | for a proxy that rewrites `base_url`, or an app mounting `ApiEngine` more than once (e.g. under host constraints) where no single detected path is right |
+
+  Request-derived is **opt-in, not the default**, on purpose: defaulting to it
+  would silently rewrite the document of every app whose issuer host differs from
+  the host serving the request — the split-host setup a separate issuer exists to
+  express.
+
+  Inside the mount the mount path needs no configuring or detecting: Rails sets
+  `SCRIPT_NAME` to the mount prefix, so `request.script_name` *is* the mount
+  path, exactly.
+
+- **`standard_id_well_known_routes at: "<mount path>"`** — a routes-file mapper
+  helper that serves the documents at the **origin root**.
+
+  RFC 8615 clients probe the origin root, which is outside every engine mount, so
+  the gem could not draw those routes itself — this has to live in the host's
+  routes file.
+
+  For each metadata document it draws **both** the bare root form and the RFC
+  8414 §3.1 **path-inserted** form:
+
+  ```
+  /.well-known/oauth-authorization-server
+  /.well-known/oauth-authorization-server/api/v1
+  ```
+
+  The second looks redundant and is not. §3.1 inserts the well-known segment
+  *before* a path-carrying issuer's path rather than appending to it, and that is
+  the URL Claude Code actually requests in production. Without it the client 404s,
+  falls back to issuer-relative defaults — hitting the engine's own `/authorize`
+  rather than a host audience shim — and every subsequent authenticated request
+  401s, a long way from the cause. It is drawn for you rather than documented as
+  an extra step.
+
+  `only:` / `except:` select among `:oauth_authorization_server`,
+  `:openid_configuration`, `:jwks` — `only: :jwks` for an app that keeps its own
+  metadata controller but wants the gem's JWKS at the root. `extra_paths:` adds
+  further path-inserted suffixes. `path_inserted: false` draws only the bare root
+  forms. No path-inserted JWKS is drawn: it is a concrete file path, not a
+  document whose location §3.1 relocates.
+
+- **`config.oauth.discovery_metadata_overrides`** — the members that cannot be
+  derived: an authorization endpoint pointing at a host-owned audience-injecting
+  shim (needed by all five apps, and the original reason they each wrote a
+  controller), a scope list deliberately narrower than what the server can mint,
+  an auth-method list that must mirror the host's dynamic-registration policy.
+
+  Values are static or callable; a callable receives
+  `{ origin:, endpoint_base:, issuer:, request: }` with `origin` carrying no
+  path. A **`nil` value removes the member** rather than emitting `null` — real
+  apps omit `scopes_supported` entirely, and a typed RFC 8414 member set to null
+  is worse than either alternative.
+
+  **Setting `issuer` raises `StandardId::ConfigurationError`**, naming
+  `discovery_endpoint_base` as the thing you probably wanted. It is refused
+  rather than ignored because an issuer diverging from what the token service
+  stamps yields a document that validates against nothing, failing far from its
+  cause.
+
+  See `docs/MIGRATION_GUIDE.md` for how to retire a hand-rolled controller.
+
+### Fixed
+
+- **The discovery documents no longer ignore the `ApiEngine` mount prefix.**
+
+  `Oauth::DiscoveryDocument` derived every endpoint from the issuer
+  (`base = issuer.to_s.chomp("/")`). An app mounting `ApiEngine` under a prefix
+  its issuer does not carry — `/api`, `/api/v1` — therefore advertised
+  `<issuer>/oauth/token` while the endpoint actually lived at
+  `<origin>/api/oauth/token`. **Every advertised endpoint 404'd.** Both documents
+  were affected; the OIDC one had the identical bug.
+
+  All five consuming apps hand-rolled a replacement controller because of it.
+
+  `issuer` and the endpoint base are now separate values, and stay separate.
+  `issuer` is a stable security identifier (RFC 8414 §2) that clients match
+  byte-for-byte against both their discovery URL and the `iss` claim of issued
+  tokens: it is never derived from the request and cannot be overridden.
+
+
+- `Session.revoke_sessions!` no longer aborts the revocation loop when logging
+  itself fails. The rescue around each `SESSION_REVOKED` publish exists so a
+  failing subscriber cannot short-circuit the loop and leave later sessions
+  without their event — but it logged via `StandardId.logger.error`, and
+  `StandardId.logger` is a *memoized* `config.logger || Rails.logger`, so
+  whatever the first reader in the process saw is what every later caller gets,
+  including a value that is not a logger at all. In that case the rescue raised
+  from inside itself and the guarantee evaporated. It now checks the logger
+  responds to `error` first.
+
+- **Provider plugin config fields are now declared before host initializers
+  run**, so `config.social.google_client_id = ...` works in a plain
+  `config/initializers/standard_id.rb` — the way the install template, this
+  README, and both plugin READMEs all said it did.
+
+  It did not. `social.google_client_id` is not in the core schema; the plugin
+  declares it via `Providers::Google.config_schema`, which reached
+  `ConfigSchema.add_field` only through `ProviderRegistry.register`, called from
+  the plugin Railtie's `config.after_initialize` — long after
+  `:load_config_initializers`. The host's write therefore hit
+  `ConfigSchema::Scope#[]=` → `validate!` against a schema that did not yet know
+  the field and raised `StandardId::ConfigurationError: Unknown field
+  'google_client_id' for scope 'social'`, with nothing in the message to suggest
+  the cause was boot ordering. Every consuming app that used a provider plugin
+  independently rediscovered the same
+  `Rails.application.config.after_initialize { ... }` workaround, and the three
+  documented forms disagreed with each other — two of them raised.
+
+  A new core Engine initializer, `standard_id.provider_config_schemas`, runs
+  `before: :load_config_initializers` and declares the fields of every loaded
+  provider class. **No plugin release is required**: provider classes are
+  required at gem-require time, so they are already loaded at that point.
+
+  Only *field declaration* moved earlier. Full `ProviderRegistry.register` —
+  which also runs `validate_provider!` and the provider's `setup` — stays in
+  `after_initialize`, where host configuration is complete.
+
+  **Existing `after_initialize` wrappers keep working verbatim.**
+  `add_field` is retroactive: `Scope#validate!` and `Scope#[]` both consult the
+  schema live, the latter falling back to the field's declared default for an
+  unwritten key, so declaring a field late is indistinguishable from declaring
+  it early. There is nothing to migrate.
+
+  The dummy app now loads a stand-in provider at application-require time and
+  writes its fields from an ordinary initializer, so a regression stops the app
+  booting rather than failing one assertion.
+
+### Documentation
+
+- The install template's social-login section now states that these fields come
+  from the plugin gems, that omitting the gem is what makes them raise, and that
+  the `after_initialize` workaround is no longer needed. Documenting "requires
+  0.33.0" alone would have been wrong: uncommenting a line without the provider
+  gem in the Gemfile still raises.
+
 ## [0.32.0] - 2026-07-28
 
 ### Changed

data/README.md

@@ -237,6 +237,20 @@ Resolvers receive keyword arguments with the context containing `client`, `accou
 
 ### Social Login Setup
 
+The `social.google_*` and `social.apple_*` fields are declared by the **provider
+plugin gems**, not by `standard_id` itself — add `standard_id-google` and/or
+`standard_id-apple` to your Gemfile first. Writing a field whose gem is absent
+raises `StandardId::ConfigurationError` ("Unknown field ... for scope
+`social`"), because nothing declared it.
+
+With the gem present, a plain initializer is correct: since 0.33.0 `standard_id`
+declares every loaded provider's fields before `:load_config_initializers`, so
+these writes happen after the schema knows about them. On 0.32.0 and earlier the
+fields were declared only from the plugin Railtie's `after_initialize`, so the
+same code raised and apps wrapped the writes in
+`Rails.application.config.after_initialize { ... }`. That wrapper is no longer
+necessary; existing ones keep working unchanged.
+
 ```ruby
 StandardId.configure do |config|
   # Google OAuth

data/app/controllers/standard_id/api/oauth/introspections_controller.rb

@@ -0,0 +1,164 @@
+module StandardId
+  module Api
+    module Oauth
+      # RFC 7662 OAuth 2.0 Token Introspection (POST /oauth/introspect).
+      #
+      # Off by default. The endpoint is fully absent (404) unless
+      # `StandardId.config.oauth.introspection_enabled` is true, mirroring how
+      # `dynamic_registration_enabled` gates `/oauth/register`: an endpoint that
+      # answers questions about other people's tokens is not something to expose
+      # by accident.
+      #
+      # Confidential clients only (RFC 7662 §2.1 requires the caller be
+      # authorized). Credentials arrive as HTTP Basic or in the form body, per
+      # RFC 6749 §2.3.1 — never both.
+      #
+      # Every failure mode renders `{"active": false}` with **no other members**,
+      # per RFC 7662 §2.2. That includes bad client credentials, a blank token,
+      # a garbage token, a revoked token, and a tripped rate limit. The endpoint
+      # deliberately reveals nothing beyond that one bit.
+      #
+      # ## What introspection can and cannot tell you here
+      #
+      # **Read this before building an authorization gate on it.**
+      #
+      # Access tokens are stateless: this engine never persists them and they
+      # carry no `sid`, so there is nothing to look up. A revoked session's
+      # access token therefore introspects as **`active: true` until its `exp`**.
+      # Introspection of an access token answers "was this minted by us, and is
+      # it unexpired?" — not "is it still honoured?". The only mitigation is a
+      # short `access_token_lifetime`; a caller who assumes otherwise will build
+      # a gate that keeps honouring revoked credentials for a full token
+      # lifetime.
+      #
+      # Refresh tokens ARE persisted (as `SHA256(jti)`), so those are checked
+      # against the row: a revoked or expired refresh token introspects as
+      # inactive, correctly and immediately.
+      class IntrospectionsController < BaseController
+        public_controller
+
+        skip_before_action :validate_content_type!, raise: false
+
+        # The `with:` renders `{active: false}` / 200 — NEVER 429. THIS IS
+        # DELIBERATE; DO NOT "FIX" IT.
+        #
+        # A 429 distinguishes "you are throttled" from "that token is not
+        # valid", which turns the rate limiter into a token-validity oracle: an
+        # attacker probes until throttled, then reads the *status code* rather
+        # than the body to classify tokens. Returning the ordinary inactive
+        # response keeps a throttled probe indistinguishable from a miss.
+        #
+        # Passing an explicit `with:` also opts out of
+        # RateLimitHandling.rate_limit's wrapper (which raises
+        # ActionController::TooManyRequests to attach Retry-After) — that is the
+        # intent, and the concern documents the opt-out.
+        #
+        # Keyed on `request.remote_ip`, and this matters:
+        #
+        #   * NOT Rack's `request.ip`, which resolves the forwarding chain
+        #     against Rack's own trusted-proxy list rather than
+        #     `config.action_dispatch.trusted_proxies`. Behind a CDN that returns
+        #     the edge address and collapses every caller in the world into a
+        #     single bucket.
+        #   * NOT the `Authorization` header or client_id. `rate_limit` is a
+        #     before_action, so it runs BEFORE client authentication — at that
+        #     point the header is unverified, attacker-controlled input, and a
+        #     caller could mint a fresh bucket per request by rotating it. The
+        #     limit would evaporate exactly when it is needed.
+        rate_limit to: StandardId.config.rate_limits.introspection_per_ip,
+                   within: 15.minutes,
+                   name: "introspection-ip",
+                   by: -> { request.remote_ip },
+                   with: -> { render_inactive },
+                   only: :create,
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
+        before_action :require_introspection_enabled!
+
+        # POST /oauth/introspect
+        def create
+          return render_inactive if authenticate_client!.nil?
+
+          token = params[:token].to_s
+          return render_inactive if token.blank?
+
+          payload = decode_token(token)
+          return render_inactive if payload.nil?
+
+          # Persisted refresh tokens are checkable; access tokens are not.
+          persisted = StandardId::RefreshToken.find_by_jti(payload[:jti].to_s) if payload[:jti].present?
+          return render_inactive if persisted && !persisted.active?
+
+          render json: active_response(payload, persisted), status: :ok
+        end
+
+        private
+
+        # 404 (not 403) when the feature is off, so the endpoint is
+        # indistinguishable from one that does not exist.
+        def require_introspection_enabled!
+          head(:not_found) unless StandardId.config.oauth.introspection_enabled
+        end
+
+        # @return [StandardId::ClientSecretCredential, nil]
+        def authenticate_client!
+          client_id, client_secret = client_credentials
+          return nil if client_id.blank? || client_secret.blank?
+
+          credential = StandardId::ClientSecretCredential.active.find_by(client_id: client_id)
+          return nil unless credential&.authenticate_client_secret(client_secret)
+
+          credential
+        end
+
+        # RFC 6749 §2.3.1 — Basic auth OR request body, never both. Unlike the
+        # token endpoint (which raises InvalidRequestError so a misconfigured
+        # client gets told), sending both here is just another `active: false`:
+        # this endpoint reports nothing but that one bit.
+        def client_credentials
+          header = request.headers["Authorization"]
+          return [params[:client_id].to_s, params[:client_secret].to_s] unless header&.start_with?("Basic ")
+          return [nil, nil] if params[:client_id].present? || params[:client_secret].present?
+
+          decoded = Base64.strict_decode64(header.split(" ", 2).last)
+          id, secret = decoded.split(":", 2)
+          [CGI.unescape(id.to_s), CGI.unescape(secret.to_s)]
+        rescue ArgumentError
+          [nil, nil]
+        end
+
+        # JwtService.decode already returns nil for malformed tokens, bad
+        # signatures, expired tokens, wrong issuer and bad iat. No
+        # allowed_audiences is passed: introspection is audience-agnostic and
+        # returns `aud` for the caller to inspect. The rescue is
+        # defence-in-depth in case that contract shifts.
+        def decode_token(token)
+          StandardId::JwtService.decode(token)
+        rescue StandardId::InvalidAudienceError, StandardId::InvalidTokenError, JWT::DecodeError
+          nil
+        end
+
+        # RFC 7662 §2.2. `.compact` so absent claims are omitted rather than
+        # emitted as null.
+        def active_response(payload, persisted)
+          {
+            active: true,
+            token_type: persisted ? "refresh_token" : "Bearer",
+            sub: payload[:sub],
+            aud: payload[:aud],
+            iss: payload[:iss],
+            exp: payload[:exp],
+            iat: payload[:iat],
+            jti: payload[:jti],
+            client_id: payload[:client_id],
+            scope: payload[:scope]
+          }.compact
+        end
+
+        def render_inactive
+          render json: { active: false }, status: :ok
+        end
+      end
+    end
+  end
+end

data/app/controllers/standard_id/api/oauth/revocations_controller.rb

@@ -4,6 +4,9 @@ module StandardId
       class RevocationsController < BaseController
         VALID_REVOCATION_SCOPES = %i[account grant].freeze
 
+        # Carried on every SESSION_REVOKED event this endpoint causes.
+        REVOCATION_REASON = "token_revocation".freeze
+
         public_controller
 
         skip_before_action :validate_content_type!
@@ -56,14 +59,15 @@ module StandardId
         # credentials with their own lifecycle, not something an interactive
         # client's logout should silently kill.
         def revoke_account_sessions!(account_id)
-          sessions = StandardId::DeviceSession.where(account_id: account_id).active.to_a
-          return if sessions.empty?
+          result = StandardId::DeviceSession
+            .active
+            .revoke_all_for!(account_id, reason: REVOCATION_REASON)
+          return if result.sessions_revoked.zero?
 
-          refresh_tokens_revoked = revoke_sessions!(sessions)
           emit_token_revoked(
             account_id: account_id,
-            sessions_revoked: sessions.size,
-            refresh_tokens_revoked: refresh_tokens_revoked
+            sessions_revoked: result.sessions_revoked,
+            refresh_tokens_revoked: result.refresh_tokens_revoked
           )
         end
 
@@ -100,7 +104,9 @@ module StandardId
           # (RefreshToken#session_id is nil unless the flow sets it).
           session = record.session
           sessions = (session && session.active?) ? [session] : []
-          refresh_tokens_revoked += revoke_sessions!(sessions, account: record.account)
+          refresh_tokens_revoked += StandardId::Session.revoke_sessions!(
+            sessions, account: record.account, reason: REVOCATION_REASON
+          ).refresh_tokens_revoked
 
           emit_token_revoked(
             account_id: payload[:sub],
@@ -109,61 +115,6 @@ module StandardId
           )
         end
 
-        # Bulk-revoke in two queries (one UPDATE per table) instead of
-        # issuing session.revoke! per row, which would be O(N) UPDATEs plus
-        # another O(N) cascades to refresh_tokens.
-        #
-        # Tradeoff: update_all skips ActiveRecord callbacks, so the per-row
-        # SESSION_REVOKED event emitted by Session#revoke! is not fired
-        # automatically. We re-emit it explicitly below so audit-trail
-        # subscribers (account status/locking, etc.) still see one event
-        # per revoked session — the semantics are preserved, only the SQL
-        # shape has changed.
-        #
-        # @return [Integer] number of refresh-token rows revoked by the cascade
-        def revoke_sessions!(sessions, account: nil)
-          return 0 if sessions.empty?
-
-          now = Time.current
-          session_ids = sessions.map(&:id)
-          refresh_tokens_revoked = 0
-
-          ActiveRecord::Base.transaction do
-            StandardId::Session.where(id: session_ids).update_all(revoked_at: now)
-            refresh_tokens_revoked = StandardId::RefreshToken
-              .where(session_id: session_ids, revoked_at: nil)
-              .update_all(revoked_at: now)
-          end
-
-          # DB state is already committed above; event publishing is best-effort
-          # audit emission. A failing subscriber must not short-circuit the loop
-          # and leave later sessions without their SESSION_REVOKED event, which
-          # would permanently desync audit-trail consumers from the DB.
-          #
-          # All sessions here belong to the same account (both callers scope by
-          # account), so we load the account once rather than calling
-          # session.account per row, which would issue N extra SELECTs.
-          shared_account = account || sessions.first.account
-          sessions.each do |session|
-            session.revoked_at = now
-            begin
-              StandardId::Events.publish(
-                StandardId::Events::SESSION_REVOKED,
-                session: session,
-                account: shared_account,
-                reason: "token_revocation"
-              )
-            rescue StandardError => e
-              StandardId.logger.error(
-                "[StandardId::Revocations] Failed to publish SESSION_REVOKED " \
-                "for session #{session.id}: #{e.class}: #{e.message}"
-              )
-            end
-          end
-
-          refresh_tokens_revoked
-        end
-
         def emit_token_revoked(account_id:, sessions_revoked:, refresh_tokens_revoked:)
           StandardId::Events.publish(
             StandardId::Events::OAUTH_TOKEN_REVOKED,

data/app/controllers/standard_id/api/well_known/oauth_authorization_server_controller.rb

@@ -19,17 +19,20 @@ module StandardId
         public_controller
 
         def show
-          issuer = StandardId.config.issuer
+          resolved = StandardId::Oauth::DiscoveryResolver.resolve(request: request)
 
-          unless issuer.present?
+          unless resolved[:issuer].present?
             render json: { error: "Issuer not configured" }, status: :not_found
             return
           end
 
           response.headers["Cache-Control"] = "public, max-age=3600"
           render json: StandardId::Oauth::DiscoveryDocument.build(
-            issuer,
-            registration_enabled: StandardId.config.oauth.dynamic_registration_enabled
+            resolved[:issuer],
+            endpoint_base: resolved[:endpoint_base],
+            registration_enabled: StandardId.config.oauth.dynamic_registration_enabled,
+            introspection_enabled: StandardId.config.oauth.introspection_enabled,
+            overrides: resolved[:overrides]
           )
         end
       end

data/app/controllers/standard_id/api/well_known/openid_configuration_controller.rb

@@ -6,17 +6,20 @@ module StandardId
         public_controller
 
         def show
-          issuer = StandardId.config.issuer
+          resolved = StandardId::Oauth::DiscoveryResolver.resolve(request: request)
 
-          unless issuer.present?
+          unless resolved[:issuer].present?
             render json: { error: "Issuer not configured" }, status: :not_found
             return
           end
 
           response.headers["Cache-Control"] = "public, max-age=3600"
           render json: StandardId::Oauth::DiscoveryDocument.build(
-            issuer,
-            registration_enabled: StandardId.config.oauth.dynamic_registration_enabled
+            resolved[:issuer],
+            endpoint_base: resolved[:endpoint_base],
+            registration_enabled: StandardId.config.oauth.dynamic_registration_enabled,
+            introspection_enabled: StandardId.config.oauth.introspection_enabled,
+            overrides: resolved[:overrides]
           )
         end
       end