standard_id 0.32.0 → 0.34.0

data/lib/standard_id/jwt_service.rb

@@ -52,6 +52,30 @@ module StandardId
       SUPPORTED_ALGORITHMS[algorithm] || raise(ArgumentError, "Unsupported algorithm: #{algorithm}. Supported: #{SUPPORTED_ALGORITHMS.keys.join(', ')}")
     end
 
+    # Whether decode REQUIRES a matching `iss`. `nil` (the default) follows the
+    # issuer, which is the historic behaviour: verification on exactly when an
+    # issuer is configured.
+    #
+    # The override exists so an app can START MINTING an `iss` without yet
+    # REQUIRING one. Coupled, adopting an issuer is a flag day — every token
+    # already in flight was minted without the claim, so enabling the issuer
+    # rejects all of them at once, refresh tokens included. Decoupled, the app
+    # sets `verify_issuer = false`, waits out `refresh_token_lifetime`, and then
+    # drops the override with no window in which valid tokens are refused.
+    def self.verify_issuer?
+      configured = StandardId.config.verify_issuer
+      return StandardId.config.issuer.present? if configured.nil?
+
+      if configured && StandardId.config.issuer.blank?
+        raise StandardId::ConfigurationError,
+              "verify_issuer is true but no issuer is configured — decode would " \
+              "verify against nil and accept any token. Set config.issuer, or " \
+              "leave verify_issuer nil to follow it."
+      end
+
+      configured
+    end
+
     def self.asymmetric?
       algorithm_config[:type] == :asymmetric
     end
@@ -152,7 +176,7 @@ module StandardId
     def self.decode(token, allowed_audiences: nil)
       options = { algorithms: [algorithm] }
 
-      if StandardId.config.issuer.present?
+      if StandardId.config.issuer.present? && verify_issuer?
         options[:iss] = StandardId.config.issuer
         options[:verify_iss] = true
       end

data/lib/standard_id/oauth/discovery_document.rb

@@ -5,28 +5,57 @@ module StandardId
     #   * /.well-known/oauth-authorization-server (RFC 8414)
     #
     # Both well-known controllers render this single builder so the two
-    # documents cannot drift. Endpoint URLs are derived from the configured
-    # issuer.
+    # documents cannot drift.
     #
-    # NOTE on mounting (RFC 8414 caveat): the ApiEngine is consumer-mounted at
-    # a sub-path (e.g. `/auth/api`), so the gem can only serve
-    # `/auth/api/.well-known/oauth-authorization-server`. A strict RFC 8414
-    # client that derives a *root-anchored* metadata URL from a path-carrying
-    # issuer would probe `<host>/.well-known/oauth-authorization-server/auth/api`,
-    # which falls outside any engine mount. Hosts that need the root-anchored
-    # form must add their own root route — the gem cannot.
+    # ## `issuer` and the endpoint base are two different things
+    #
+    # This used to derive every endpoint from the issuer
+    # (`base = issuer.to_s.chomp("/")`), which is wrong for any app mounting
+    # `ApiEngine` under a prefix its issuer does not carry: the document
+    # advertised `<issuer>/oauth/token` while the endpoint actually lived at
+    # `<origin>/api/oauth/token`. Every consuming app hand-rolled a replacement
+    # controller because of it.
+    #
+    # The two are now separate, and must stay separate:
+    #
+    #   * `issuer` is a stable **security identifier** (RFC 8414 §2). Clients
+    #     compare it byte-for-byte with the URL they used for discovery and with
+    #     the `iss` claim of issued tokens. It is never derived from the request
+    #     and can never be overridden — see .apply_overrides!.
+    #   * `endpoint_base` is where the endpoints actually are. It defaults to the
+    #     issuer, which preserves the previous behaviour exactly for apps whose
+    #     issuer already carries the mount path.
+    #
+    # ## Overrides
+    #
+    # Some members are not derivable at all — a host-owned authorization shim
+    # that injects an audience, a scope list deliberately narrower than what the
+    # server can mint, an auth-method list that must mirror the host's dynamic
+    # registration policy. `overrides` covers those; see
+    # StandardId::Oauth::DiscoveryResolver for the config surface.
     module DiscoveryDocument
       module_function
 
-      # @param issuer [String] the configured issuer (e.g. "https://auth.example.com")
+      # @param issuer [String] the configured issuer, emitted verbatim
+      # @param endpoint_base [String, nil] base URL for the endpoints. Defaults
+      #   to `issuer` — the previous behaviour — so existing callers are
+      #   unaffected.
       # @param registration_enabled [Boolean] when true, advertises the RFC 7591
       #   dynamic client registration endpoint. The well-known controllers pass
       #   `StandardId.config.oauth.dynamic_registration_enabled` here, so the
       #   `registration_endpoint` is emitted only when DCR is turned on. Defaults
       #   to false so callers (and tests) that omit it get no registration_endpoint.
+      # @param introspection_enabled [Boolean] when true, advertises the RFC 7662
+      #   introspection endpoint. The well-known controllers pass
+      #   `StandardId.config.oauth.introspection_enabled`, so it is advertised only
+      #   when the endpoint actually exists (the controller 404s when off).
+      #   Defaults to false, matching registration_enabled.
+      # @param overrides [Hash] members to replace, add, or (with a nil value)
+      #   remove. Already resolved — callables are evaluated by the caller.
       # @return [Hash]
-      def build(issuer, registration_enabled: false)
-        base = issuer.to_s.chomp("/")
+      def build(issuer, endpoint_base: nil, registration_enabled: false,
+        introspection_enabled: false, overrides: {})
+        base = (endpoint_base.presence || issuer).to_s.chomp("/")
 
         doc = {
           issuer: issuer,
@@ -55,6 +84,38 @@ module StandardId
         doc[:jwks_uri] = "#{base}/.well-known/jwks.json" if StandardId::JwtService.asymmetric?
 
         doc[:registration_endpoint] = "#{base}/oauth/register" if registration_enabled
+        doc[:introspection_endpoint] = "#{base}/oauth/introspect" if introspection_enabled
+
+        apply_overrides!(doc, overrides)
+      end
+
+      # Merge resolved overrides into the document.
+      #
+      # A `nil` value REMOVES the member rather than emitting `null`. Real apps
+      # need that — one omits `scopes_supported` entirely — and a `null` would be
+      # worse than either alternative, since RFC 8414 members are typed.
+      #
+      # `issuer` is REFUSED rather than silently dropped. It is a security
+      # identifier clients match byte-for-byte against both their discovery URL
+      # and the `iss` claim; letting a metadata override diverge it from what the
+      # token service actually stamps would produce a document that validates
+      # against nothing, and the failure would surface a long way from here.
+      def apply_overrides!(doc, overrides)
+        return doc if overrides.blank?
+
+        overrides = overrides.symbolize_keys
+        if overrides.key?(:issuer)
+          raise StandardId::ConfigurationError,
+            "discovery_metadata_overrides cannot set `issuer`. The issuer is a stable " \
+            "security identifier (RFC 8414 §2): clients compare it byte-for-byte with " \
+            "the URL they used for discovery and with the `iss` claim of issued tokens, " \
+            "so it must stay exactly StandardId.config.issuer. To move where the " \
+            "ENDPOINTS live, set config.oauth.discovery_endpoint_base instead."
+        end
+
+        overrides.each do |key, value|
+          value.nil? ? doc.delete(key) : doc[key] = value
+        end
 
         doc
       end

data/lib/standard_id/oauth/discovery_resolver.rb

@@ -0,0 +1,158 @@
+module StandardId
+  module Oauth
+    # Resolves the three request-dependent inputs of a discovery document:
+    # the issuer, the endpoint base, and the overrides.
+    #
+    # Lives apart from DiscoveryDocument so the builder stays a pure function of
+    # its arguments (and stays trivially testable without a request), while all
+    # the "where am I actually mounted" reasoning is in one place.
+    module DiscoveryResolver
+      # Values of `discovery_endpoint_base` that mean "derive it from the
+      # request". Compared as strings so `:request` and `"request"` both work —
+      # this is set from an initializer and the symbol/string distinction is not
+      # something a config file should have to get right.
+      REQUEST_DERIVED = %w[request].freeze
+
+      module_function
+
+      # The issuer, verbatim from config. Never derived from the request, never
+      # overridable: RFC 8414 §2 makes it a stable security identifier that
+      # clients match byte-for-byte against their discovery URL and against the
+      # `iss` claim of issued tokens.
+      #
+      # @return [String, nil]
+      def issuer
+        StandardId.config.issuer
+      end
+
+      # Base URL the advertised endpoints hang off, from
+      # `config.oauth.discovery_endpoint_base`:
+      #
+      #   nil (default) — the issuer. EXACTLY the behaviour before this option
+      #                   existed, so an upgrade changes no document. Correct
+      #                   already for an app whose issuer carries the mount path
+      #                   (`https://host/auth/api`); wrong, and the bug this
+      #                   option exists for, when it does not.
+      #   :request      — `request.base_url` + the detected mount path. This is
+      #                   what an app mounting ApiEngine under a prefix wants.
+      #   String        — used verbatim.
+      #   callable      — called with `(request:)`. The escape hatch for a proxy
+      #                   that rewrites `request.base_url`, and for an app that
+      #                   mounts ApiEngine more than once (under host constraints,
+      #                   say) where no single detected path is right.
+      #
+      # Request-derived is deliberately OPT-IN rather than the default. Making it
+      # the default would silently rewrite the document of every app whose issuer
+      # host differs from the host serving the request — which is exactly the
+      # split-host setup a separate issuer exists to express.
+      #
+      # @param request [ActionDispatch::Request, nil]
+      # @return [String, nil]
+      def endpoint_base(request: nil)
+        configured = StandardId.config.oauth.discovery_endpoint_base
+
+        return issuer if configured.blank?
+
+        if configured.respond_to?(:call)
+          resolved = configured.call(request: request)
+          return resolved.present? ? resolved.to_s.chomp("/") : issuer
+        end
+
+        return configured.to_s.chomp("/") unless REQUEST_DERIVED.include?(configured.to_s)
+        return issuer if request.nil?
+
+        "#{request.base_url}#{mount_path(request)}".chomp("/")
+      end
+
+      # The path ApiEngine is mounted at, as seen from this request.
+      #
+      # Two cases, and the difference is why this is not a config lookup:
+      #
+      #   * The document is served from INSIDE the engine mount (the gem's own
+      #     `scope ".well-known"` routes). Rails sets SCRIPT_NAME to the mount
+      #     prefix, so `request.script_name` IS the mount path, exactly, with no
+      #     detection or guessing. This is the case that used to produce 404-ing
+      #     endpoint URLs.
+      #   * The document is served from a ROOT route drawn by
+      #     `standard_id_well_known_routes` (RFC 8615 clients probe the origin
+      #     root, which is outside any engine mount). There `script_name` is
+      #     empty, so the helper stamps the mount path it was given into the
+      #     route defaults and we read it back from `params`.
+      #
+      # @return [String] "" when neither is available, which resolves to the
+      #   origin root — correct for an app that mounts ApiEngine at "/".
+      def mount_path(request)
+        from_defaults = request.params[MOUNT_PATH_PARAM].presence
+        return normalize_path(from_defaults) if from_defaults
+
+        normalize_path(request.script_name)
+      end
+
+      # Route default the routing helper uses to carry the mount path to a
+      # root-served document. Named rather than positional so it cannot collide
+      # with a host's own params.
+      MOUNT_PATH_PARAM = :standard_id_mount_path
+
+      # Resolve `config.oauth.discovery_metadata_overrides` for this request.
+      #
+      # Values may be static or callable. A callable receives one Hash argument
+      # so members can be built from the request without each app re-deriving the
+      # origin:
+      #
+      #   {
+      #     # host-owned shim that injects the audience before handing off to the
+      #     # engine's /authorize
+      #     authorization_endpoint: ->(ctx) { "#{ctx[:origin]}/oauth/authorize" },
+      #     # deliberately narrower than what the server can mint
+      #     scopes_supported: %w[mcp mcp:read],
+      #     # must mirror the host's DCR policy, or spec-following clients
+      #     # register in a way that policy then rejects
+      #     token_endpoint_auth_methods_supported: %w[none],
+      #     # remove a member entirely
+      #     grant_types_supported: nil
+      #   }
+      #
+      # Context keys: `:origin` (scheme+host+port, no path), `:endpoint_base`,
+      # `:issuer`, `:request`.
+      #
+      # @return [Hash] with callables evaluated
+      def metadata_overrides(request: nil, endpoint_base: nil)
+        configured = StandardId.config.oauth.discovery_metadata_overrides
+        return {} if configured.blank?
+
+        context = {
+          origin: request&.base_url,
+          endpoint_base: endpoint_base,
+          issuer: issuer,
+          request: request
+        }
+
+        configured.to_h.each_with_object({}) do |(key, value), acc|
+          acc[key.to_sym] = value.respond_to?(:call) ? value.call(context) : value
+        end
+      end
+
+      # Everything a well-known controller needs, in one call.
+      #
+      # @return [Hash] `{ issuer:, endpoint_base:, overrides: }`
+      def resolve(request: nil)
+        base = endpoint_base(request: request)
+
+        {
+          issuer: issuer,
+          endpoint_base: base,
+          overrides: metadata_overrides(request: request, endpoint_base: base)
+        }
+      end
+
+      # "" or "/foo" — never "/" and never a trailing slash, so string
+      # concatenation against an origin cannot produce a double slash.
+      def normalize_path(path)
+        normalized = path.to_s.chomp("/")
+        return "" if normalized.empty?
+
+        normalized.start_with?("/") ? normalized : "/#{normalized}"
+      end
+    end
+  end
+end

data/lib/standard_id/provider_registry.rb

@@ -18,11 +18,76 @@ module StandardId
       def register(name, provider_class)
         validate_provider!(provider_class)
         providers[name.to_s] = provider_class
-        register_config_schema(provider_class)
+        declare_config_schema(provider_class)
         provider_class.setup if provider_class.respond_to?(:setup)
         provider_class
       end
 
+      # Declare the `social` config fields of every provider class that has been
+      # LOADED, whether or not it has been `register`ed yet.
+      #
+      # Called by a core Engine initializer that runs `before:
+      # :load_config_initializers` — see StandardId::Engine. It exists because
+      # provider plugins register themselves from their Railtie's
+      # `config.after_initialize`, which runs long AFTER the host's
+      # `config/initializers/standard_id.rb`. A host initializer writing
+      # `c.social.google_client_id` therefore hit `Scope#[]=` → `validate!`
+      # before the field existed and raised StandardId::ConfigurationError, with
+      # nothing in the message to suggest the cause was ordering. Every consuming
+      # app that used a provider plugin independently discovered the same
+      # `Rails.application.config.after_initialize { ... }` wrapper to work
+      # around it.
+      #
+      # This is safe to do early because provider classes are required at
+      # gem-require time (`require "standard_id/google/providers/google"` in the
+      # plugin's entry file), so `Providers::Base.subclasses` is already
+      # populated before any initializer runs.
+      #
+      # Only FIELD DECLARATION moves earlier. Full `register` — which also runs
+      # `validate_provider!` and the provider's `setup` — deliberately stays in
+      # `after_initialize`, where the host's configuration is complete and
+      # `setup` can rely on it.
+      #
+      # Idempotent: `ConfigSchema#add_field` uses `compute_if_absent`, so a field
+      # already declared here is untouched when the plugin later calls `register`.
+      #
+      # @return [Array<Class>] the provider classes whose fields were declared
+      def declare_config_schemas!
+        provider_classes.each { |provider_class| declare_config_schema(provider_class) }
+      end
+
+      # Provider classes known to the process: every loaded subclass of
+      # Providers::Base, plus anything already registered (a registered class
+      # need not be a direct subclass).
+      #
+      # @return [Array<Class>]
+      def provider_classes
+        (StandardId::Providers::Base.subclasses + providers.values).uniq
+      end
+
+      # Declare one provider's config fields against the `social` scope.
+      #
+      # Thread-safe and idempotent — adding the same field twice is a no-op.
+      #
+      # `add_field` is retroactive: `ConfigSchema::Scope#validate!` and `#[]`
+      # both consult the schema live (the latter falling back to
+      # `field_for(...).default_value` for an unwritten key), so declaring a
+      # field after `StandardId.config` has been built works exactly as if it
+      # had been declared before. That is what makes the existing host-side
+      # `after_initialize` wrappers keep working untouched.
+      #
+      # @param provider_class [Class] Provider implementation class
+      def declare_config_schema(provider_class)
+        return unless provider_class.respond_to?(:config_schema)
+
+        schema = provider_class.config_schema
+        return if schema.nil? || schema.empty?
+
+        schema.each do |field_name, options|
+          StandardId::ConfigSchema.add_field(scope: :social, name: field_name, **options)
+        end
+      end
+
       # Get provider by name
       # @param name [Symbol, String] Provider identifier
       # @return [Class] Provider class
@@ -49,18 +114,6 @@ module StandardId
 
       private
 
-      # Register provider's config schema fields with the StandardId schema.
-      # Thread-safe and idempotent — adding the same field twice is a no-op.
-      # @param provider_class [Class] Provider implementation class
-      def register_config_schema(provider_class)
-        schema = provider_class.config_schema
-        return if schema.nil? || schema.empty?
-
-        schema.each do |field_name, options|
-          StandardId::ConfigSchema.add_field(scope: :social, name: field_name, **options)
-        end
-      end
-
       def validate_provider!(provider_class)
         unless provider_class.is_a?(Class)
           raise InvalidProviderError,

data/lib/standard_id/routing.rb

@@ -0,0 +1,133 @@
+require "action_dispatch/routing/mapper"
+
+module StandardId
+  # Route-mapper extensions, available inside `Rails.application.routes.draw`.
+  module Routing
+    # Documents this helper can draw, mapped to their path and controller.
+    WELL_KNOWN_DOCUMENTS = {
+      oauth_authorization_server: {
+        path: "oauth-authorization-server",
+        to: "standard_id/api/well_known/oauth_authorization_server#show"
+      },
+      openid_configuration: {
+        path: "openid-configuration",
+        to: "standard_id/api/well_known/openid_configuration#show"
+      },
+      jwks: {
+        path: "jwks.json",
+        to: "standard_id/api/well_known/jwks#show"
+      }
+    }.freeze
+
+    # Draw StandardId's discovery documents at the ORIGIN ROOT.
+    #
+    #   # config/routes.rb
+    #   Rails.application.routes.draw do
+    #     standard_id_well_known_routes at: "/api/v1"
+    #     namespace :api do
+    #       mount StandardId::ApiEngine, at: "/", as: :standard_id_api
+    #     end
+    #   end
+    #
+    # ## Why the gem cannot just route these itself
+    #
+    # The engine's own `.well-known` routes live INSIDE its mount, so an app
+    # mounting ApiEngine at `/api/v1` serves them at
+    # `/api/v1/.well-known/openid-configuration`. But RFC 8615 clients probe the
+    # **origin root**, which is outside any engine mount — a mapper helper in the
+    # host's routes file is the only place these can be drawn.
+    #
+    # ## The path-inserted form, and why it is not optional
+    #
+    # For each document this draws BOTH:
+    #
+    #   /.well-known/oauth-authorization-server
+    #   /.well-known/oauth-authorization-server/api/v1     <- RFC 8414 §3.1
+    #
+    # The second is the spec's form for an issuer that carries a path: the
+    # well-known segment is INSERTED BEFORE the issuer's path rather than appended
+    # to it. It looks redundant and it is not. It is the URL Claude Code actually
+    # requests in production against a path-carrying issuer; without it the client
+    # 404s, falls back to issuer-relative defaults (hitting the engine's real
+    # `/authorize` instead of a host audience shim), and every subsequent
+    # authenticated request 401s. That failure is remote from its cause and hard
+    # to diagnose, which is why the route is drawn for you rather than documented
+    # as an extra step.
+    #
+    # Both forms serve the same document. The mount path is stamped into the
+    # route defaults so DiscoveryResolver can build endpoint URLs off it — a root
+    # route has no SCRIPT_NAME to read it from.
+    #
+    # @param at [String] the path ApiEngine is mounted at ("/" or "" for root).
+    #   Used both to build the path-inserted routes and to resolve endpoint URLs.
+    # @param only [Array<Symbol>, Symbol, nil] restrict to these documents.
+    #   Keys: :oauth_authorization_server, :openid_configuration, :jwks. Apps
+    #   that keep a host-owned metadata controller but want the gem's JWKS at the
+    #   root pass `only: :jwks`.
+    # @param except [Array<Symbol>, Symbol, nil] the inverse of `only`.
+    # @param extra_paths [Array<String>] additional path-inserted suffixes beyond
+    #   `at:`. For serving the same document under a second issuer path (e.g. a
+    #   protected resource at `/mcp`) without a second route block.
+    # @param path_inserted [Boolean] set false to draw only the bare root forms.
+    #   Defaults to true; turning it off is what reintroduces the Claude Code
+    #   failure above, so it exists only for apps that route those themselves.
+    def standard_id_well_known_routes(at:, only: nil, except: nil, extra_paths: [], path_inserted: true)
+      mount_path = StandardId::Oauth::DiscoveryResolver.normalize_path(at)
+      documents = StandardId::Routing.selected_documents(only: only, except: except)
+
+      suffixes = path_inserted ? ([mount_path] + Array(extra_paths)).map { |p| StandardId::Oauth::DiscoveryResolver.normalize_path(p) } : []
+      suffixes = suffixes.reject(&:empty?).uniq
+
+      defaults = { StandardId::Oauth::DiscoveryResolver::MOUNT_PATH_PARAM => mount_path }
+
+      scope ".well-known" do
+        documents.each do |name, config|
+          get config[:path], to: config[:to], as: :"standard_id_root_#{name}", defaults: defaults
+
+          # jwks.json is a concrete file path, not a metadata document whose
+          # location RFC 8414 §3.1 relocates — a path-inserted variant of it
+          # would advertise a URL no spec describes.
+          next if name == :jwks
+
+          suffixes.each_with_index do |suffix, index|
+            get "#{config[:path]}#{suffix}",
+              to: config[:to],
+              as: :"standard_id_root_#{name}_at_#{index}",
+              defaults: defaults
+          end
+        end
+      end
+    end
+
+    # @return [Hash] the WELL_KNOWN_DOCUMENTS entries `only:`/`except:` select
+    def self.selected_documents(only: nil, except: nil)
+      if only.present? && except.present?
+        raise ArgumentError, "standard_id_well_known_routes accepts `only:` or `except:`, not both"
+      end
+
+      keys = WELL_KNOWN_DOCUMENTS.keys
+      requested = Array(only).map(&:to_sym) + Array(except).map(&:to_sym)
+      unknown = requested - keys
+      if unknown.any?
+        raise ArgumentError,
+          "Unknown StandardId well-known document(s): #{unknown.join(', ')}. Valid: #{keys.join(', ')}"
+      end
+
+      selected = if only.present?
+        Array(only).map(&:to_sym)
+      elsif except.present?
+        keys - Array(except).map(&:to_sym)
+      else
+        keys
+      end
+
+      WELL_KNOWN_DOCUMENTS.slice(*selected)
+    end
+  end
+end
+
+# Included directly rather than through a load hook: ActionDispatch has no
+# `:action_dispatch_routing_mapper` hook, and this file is required from
+# lib/standard_id.rb during Bundler.require — long before any routes file is
+# evaluated — so the mapper method is defined by the time a host calls it.
+ActionDispatch::Routing::Mapper.include(StandardId::Routing)

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.32.0"
+  VERSION = "0.34.0"
 end

data/lib/standard_id.rb

@@ -6,6 +6,7 @@ require "standard_id/api_engine"
 require "standard_id/config_schema"
 require "standard_id/config/schema"
 require "standard_id/scope_config"
+require "standard_id/association_strict_loading"
 require "standard_id/errors"
 require "standard_id/events"
 require "standard_id/events/subscribers/base"
@@ -44,7 +45,9 @@ require "standard_id/oauth/subflows/base"
 require "standard_id/oauth/subflows/traditional_code_grant"
 require "standard_id/oauth/subflows/social_login_grant"
 require "standard_id/oauth/passwordless_otp_flow"
+require "standard_id/oauth/discovery_resolver"
 require "standard_id/oauth/discovery_document"
+require "standard_id/routing"
 require "standard_id/oauth/consent_payload"
 require "standard_id/oauth/client_registration"
 require "standard_id/passwordless/base_strategy"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.32.0
+  version: 0.34.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -133,6 +133,7 @@ files:
 - app/controllers/standard_id/api/base_controller.rb
 - app/controllers/standard_id/api/oauth/base_controller.rb
 - app/controllers/standard_id/api/oauth/callback/providers_controller.rb
+- app/controllers/standard_id/api/oauth/introspections_controller.rb
 - app/controllers/standard_id/api/oauth/registrations_controller.rb
 - app/controllers/standard_id/api/oauth/revocations_controller.rb
 - app/controllers/standard_id/api/oauth/tokens_controller.rb
@@ -238,6 +239,7 @@ files:
 - lib/standard_id/api/session_manager.rb
 - lib/standard_id/api/token_manager.rb
 - lib/standard_id/api_engine.rb
+- lib/standard_id/association_strict_loading.rb
 - lib/standard_id/authorization_bypass.rb
 - lib/standard_id/bearer_token_extraction.rb
 - lib/standard_id/config/callable_validator.rb
@@ -267,6 +269,7 @@ files:
 - lib/standard_id/oauth/client_registration.rb
 - lib/standard_id/oauth/consent_payload.rb
 - lib/standard_id/oauth/discovery_document.rb
+- lib/standard_id/oauth/discovery_resolver.rb
 - lib/standard_id/oauth/implicit_authorization_flow.rb
 - lib/standard_id/oauth/oauth_session_persistence.rb
 - lib/standard_id/oauth/password_flow.rb
@@ -287,6 +290,7 @@ files:
 - lib/standard_id/provider_registry.rb
 - lib/standard_id/providers/base.rb
 - lib/standard_id/rate_limit_store.rb
+- lib/standard_id/routing.rb
 - lib/standard_id/scope_config.rb
 - lib/standard_id/session_type_resolver.rb
 - lib/standard_id/testing.rb