standard_id 0.41.0 → 0.42.0

data/lib/standard_id/providers/plugin_railtie.rb

@@ -0,0 +1,59 @@
+module StandardId
+  module Providers
+    # Namespace for the Railties generated by {Providers.plugin_railtie}.
+    module Railties; end
+
+    class << self
+      # Define the Railtie that registers a provider plugin with StandardId.
+      #
+      # Replaces the hand-written `lib/standard_id/<name>/railtie.rb` every
+      # provider plugin used to carry. Call it from the plugin's entry file,
+      # after the provider class is required:
+      #
+      #   # lib/standard_id/github.rb
+      #   require "standard_id"
+      #   require "standard_id/github/providers/github"
+      #
+      #   StandardId::Providers.plugin_railtie(:github, "StandardId::Providers::GitHub")
+      #
+      # The generated Railtie (`StandardId::Providers::Railties::<Name>`)
+      # registers the provider from `config.after_initialize`, once the host's
+      # configuration is complete. Its config fields are declared earlier, before
+      # `config/initializers` run, by StandardId's own engine initializer — the
+      # plugin has nothing further to do for that.
+      #
+      # Outside Rails (no `Rails::Railtie`) nothing is defined and nil is
+      # returned, so the entry file needs no `if defined?(Rails)` guard.
+      #
+      # Idempotent: calling it again for the same name returns the existing
+      # Railtie rather than defining a second one (which would register twice).
+      #
+      # @param name [Symbol, String] Provider identifier, as passed to
+      #   ProviderRegistry.register (e.g. :google)
+      # @param provider_class [Class, String] The provider class, or its name.
+      #   A String is constantized when the Railtie runs, so the entry file may
+      #   call this before the class is loaded.
+      # @return [Class, nil] the Railtie class
+      def plugin_railtie(name, provider_class)
+        return nil unless defined?(::Rails::Railtie)
+
+        const_name = name.to_s.camelize
+        if Railties.const_defined?(const_name, false)
+          return Railties.const_get(const_name, false)
+        end
+
+        provider_name = name.to_sym
+        railtie = Class.new(::Rails::Railtie)
+        Railties.const_set(const_name, railtie)
+
+        railtie.config.after_initialize do
+          klass = provider_class.is_a?(String) ? provider_class.constantize : provider_class
+          StandardId::ProviderRegistry.register(provider_name, klass)
+          Rails.logger&.debug("[StandardId] registered provider #{provider_name}")
+        end
+
+        railtie
+      end
+    end
+  end
+end

data/lib/standard_id/scope_config.rb

@@ -1,7 +1,11 @@
 module StandardId
   class ScopeConfig
     # @!attribute [r] allow_registration
-    #   Reserved for future use — controls whether new accounts can register under this scope.
+    #   Whether passwordless sign-in under this scope may create a new account
+    #   (default true). It can only RESTRICT: registration happens iff the
+    #   global switch allows it (web.passwordless_registration for the
+    #   WebEngine; the caller's `allow_registration:` for host controllers using
+    #   StandardId::PasswordlessFlow) AND this is true. See #allow_registration?.
     # @!attribute [r] profile_types
     #   Array of profile-type class names accepted by this scope. Any profile matching any of
     #   these types satisfies the built-in profile check.
@@ -20,11 +24,9 @@ module StandardId
                 :allow_registration,
                 :authorizer
 
-    # Shared deprecator instance. Creating a new ActiveSupport::Deprecation on
-    # every extract_profile_types call bypasses the host app's configured
-    # deprecation behaviour (Rails 7.1+ routes through deprecation registries)
-    # and allocates for every scope init. One instance is enough.
-    DEPRECATOR = ActiveSupport::Deprecation.new("2.0", "StandardId")
+    # Kept as an alias for hosts/specs that reference it; it is the gem-wide
+    # StandardId.deprecator, registered in Rails.application.deprecators.
+    DEPRECATOR = StandardId.deprecator
 
     # Normalize profile-type inputs from config.
     #
@@ -59,7 +61,8 @@ module StandardId
       @after_sign_in_path = config[:after_sign_in_path]
       @no_profile_message = config[:no_profile_message] || default_no_profile_message
       @label = config[:label] || name.to_s.humanize
-      @allow_registration = config.fetch(:allow_registration, true)
+      # A present-but-nil key means "not configured", i.e. the default (true).
+      @allow_registration = config[:allow_registration].nil? ? true : config[:allow_registration]
       @authorizer = config[:authorizer]
     end
 
@@ -82,6 +85,20 @@ module StandardId
       authorizer.respond_to?(:call)
     end
 
+    def allow_registration?
+      allow_registration != false
+    end
+
+    # Combine a global/caller registration switch with a (possibly nil) scope.
+    # No scope → the global value unchanged; a scope can only turn it off.
+    #
+    # @param global [Boolean]
+    # @param scope_config [StandardId::ScopeConfig, nil]
+    def self.registration_allowed?(global, scope_config)
+      return false unless global
+      scope_config.nil? || scope_config.allow_registration?
+    end
+
     private
 
     def default_no_profile_message

data/lib/standard_id/testing/provider_examples.rb

@@ -0,0 +1,117 @@
+# RSpec support for host apps (and provider plugins) that want to pin down
+# "this provider plugin is installed, registered, and its config fields are
+# writable from config/initializers/standard_id.rb".
+#
+# Loaded automatically by `require "standard_id/testing"` when RSpec is
+# present, or explicitly:
+#
+#   require "standard_id/testing/provider_examples"
+#
+# Shared example — the one-liner most apps want:
+#
+#   RSpec.describe "StandardId social providers" do
+#     it_behaves_like "a registered StandardId provider", :google
+#     it_behaves_like "a registered StandardId provider", :apple,
+#                     config_fields: %i[apple_client_id apple_private_key apple_key_id apple_team_id]
+#   end
+#
+# `config_fields:` defaults to every field in the provider's `config_schema`.
+#
+# Matcher — for ad-hoc assertions:
+#
+#   expect(:google).to be_a_registered_standard_id_provider
+#   expect(:apple).to be_a_registered_standard_id_provider.with_config_fields(:apple_client_id, :apple_team_id)
+#
+require "standard_id"
+
+module StandardId
+  module Testing
+    module ProviderExamples
+      module_function
+
+      # Problems preventing `name` from counting as a registered provider with
+      # the given social config fields. Empty when all is well.
+      #
+      # @param name [Symbol, String]
+      # @param fields [Array<Symbol>, nil] nil = the provider's config_schema keys
+      # @return [Array<String>]
+      def problems(name, fields = nil)
+        return ["provider #{name.inspect} is not registered with StandardId::ProviderRegistry"] unless StandardId::ProviderRegistry.registered?(name)
+
+        fields = config_fields_for(name) if fields.nil?
+        fields.filter_map do |field|
+          next "#{field} is not declared on the social config scope" unless StandardId::ConfigSchema.instance.field?(:social, field)
+
+          begin
+            StandardId.config.social.public_send(field)
+            nil
+          rescue StandardError => e
+            "reading social.#{field} raised #{e.class}: #{e.message}"
+          end
+        end
+      end
+
+      def config_fields_for(name)
+        StandardId::ProviderRegistry.get(name).config_schema.keys.map(&:to_sym)
+      end
+
+      # Write `value` through the same setter a host initializer uses, then
+      # restore the field exactly — including "never assigned", so an ENV
+      # fallback keeps working for later examples.
+      def round_trip(field, value)
+        social = StandardId.config.social
+        assigned = social.key?(field.to_sym)
+        original = social.to_h[field.to_sym]
+        social.public_send(:"#{field}=", value)
+        social.public_send(field)
+      ensure
+        if assigned
+          social[field.to_sym] = original
+        else
+          social.delete(field.to_sym)
+        end
+      end
+    end
+  end
+end
+
+if defined?(RSpec::Matchers) && RSpec::Matchers.respond_to?(:define)
+  RSpec::Matchers.define :be_a_registered_standard_id_provider do
+    chain(:with_config_fields) { |*fields| @fields = fields.flatten.map(&:to_sym) }
+
+    match do |name|
+      @problems = StandardId::Testing::ProviderExamples.problems(name, @fields)
+      @problems.empty?
+    end
+
+    failure_message do |name|
+      "expected #{name.inspect} to be a registered StandardId provider, but:\n  " + @problems.join("\n  ")
+    end
+
+    failure_message_when_negated do |name|
+      "expected #{name.inspect} not to be a registered StandardId provider"
+    end
+  end
+end
+
+if defined?(RSpec) && RSpec.respond_to?(:shared_examples)
+  RSpec.shared_examples "a registered StandardId provider" do |name, config_fields: nil|
+    fields_for = -> { config_fields || StandardId::Testing::ProviderExamples.config_fields_for(name) }
+
+    it "registers the #{name} provider" do
+      expect(StandardId::ProviderRegistry.registered?(name)).to be(true),
+        "#{name.inspect} is not registered — is its plugin gem in the Gemfile, and did the app boot its Railtie?"
+    end
+
+    it "declares the #{name} config fields on the social scope" do
+      expect(name).to be_a_registered_standard_id_provider.with_config_fields(fields_for.call)
+    end
+
+    it "accepts writes to the #{name} config fields, as config/initializers/standard_id.rb does" do
+      fields_for.call.each do |field|
+        expect(StandardId::Testing::ProviderExamples.round_trip(field, "probe-value")).to eq("probe-value"),
+          "writing social.#{field} did not round-trip"
+      end
+    end
+  end
+end

data/lib/standard_id/testing.rb

@@ -1,5 +1,6 @@
 require "standard_id/testing/authentication_helpers"
 require "standard_id/testing/request_helpers"
+require "standard_id/testing/provider_examples" if defined?(RSpec)
 
 module StandardId
   module Testing

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.41.0"
+  VERSION = "0.42.0"
 end

data/lib/standard_id.rb

@@ -1,4 +1,6 @@
 require "standard_id/version"
+require "standard_id/deprecator"
+require "standard_id/instrumentation"
 require "standard_id/current_attributes"
 require "standard_id/engine"
 require "standard_id/web_engine"
@@ -7,6 +9,9 @@ require "standard_id/config_schema"
 require "standard_id/config/schema"
 require "standard_id/scope_config"
 require "standard_id/association_strict_loading"
+require "standard_id/migration_check"
+require "standard_id/migration_helpers"
+require "standard_id/checks/migrations"
 require "standard_id/errors"
 require "standard_id/events"
 require "standard_id/events/subscribers/base"
@@ -65,6 +70,7 @@ require "concurrent/delay"
 
 require "standard_id/providers/base"
 require "standard_id/provider_registry"
+require "standard_id/providers/plugin_railtie"
 
 module StandardId
   CONFIG = Concurrent::Delay.new { ConfigSchema.build }
@@ -105,6 +111,26 @@ module StandardId
       ScopeConfig.new(name, scope_hash)
     end
 
+    # Registered social providers the host app has switched on.
+    #
+    # @return [Hash{String => Class}] Provider name => provider class
+    # @see StandardId::Providers::Base.enabled?
+    def enabled_social_providers
+      ProviderRegistry.enabled
+    end
+
+    # Whether the named social provider is registered AND switched on.
+    #
+    # Safe to call for a provider whose plugin gem is not installed — returns
+    # false rather than raising. Prefer this over checking a client ID
+    # directly (`StandardId.config.google_client_id.present?`).
+    #
+    # @param name [Symbol, String] e.g. :google
+    # @return [Boolean]
+    def social_provider_enabled?(name)
+      ProviderRegistry.registered?(name) && ProviderRegistry.get(name).enabled?
+    end
+
     def skip_host_authorization(framework: nil, callback: nil)
       AuthorizationBypass.apply(framework: framework, callback: callback)
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.41.0
+  version: 0.42.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -57,20 +57,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
-- !ruby/object:Gem::Dependency
-  name: ostruct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
@@ -99,6 +85,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '6.5'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: StandardId is an authentication engine that provides a complete, secure-by-default
   solution for identity management, reducing boilerplate and eliminating common security
   pitfalls.
@@ -213,7 +213,6 @@ files:
 - app/views/standard_id/web/signup/show.html.erb
 - config/brakeman.ignore
 - config/initializers/generators.rb
-- config/initializers/migration_helpers.rb
 - config/routes/api.rb
 - config/routes/web.rb
 - db/migrate/20250830000000_create_standard_id_client_applications.rb
@@ -231,6 +230,7 @@ files:
 - db/migrate/20260416180511_add_partial_indexes_for_active_session_and_challenge_lookups.rb
 - db/migrate/20260611000000_create_standard_id_client_grants.rb
 - db/migrate/20260915000000_remove_refresh_token_lifetime_from_standard_id_client_applications.rb
+- db/migrate/20260924000000_add_unique_active_device_index_to_standard_id_sessions.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/standard_id.rb
@@ -243,11 +243,13 @@ files:
 - lib/standard_id/association_strict_loading.rb
 - lib/standard_id/authorization_bypass.rb
 - lib/standard_id/bearer_token_extraction.rb
+- lib/standard_id/checks/migrations.rb
 - lib/standard_id/config/callable_validator.rb
 - lib/standard_id/config/schema.rb
 - lib/standard_id/config/scope_claims_validator.rb
 - lib/standard_id/config_schema.rb
 - lib/standard_id/current_attributes.rb
+- lib/standard_id/deprecator.rb
 - lib/standard_id/engine.rb
 - lib/standard_id/errors.rb
 - lib/standard_id/events.rb
@@ -260,7 +262,10 @@ files:
 - lib/standard_id/events/subscribers/password_reset_delivery_subscriber.rb
 - lib/standard_id/events/subscribers/passwordless_delivery_subscriber.rb
 - lib/standard_id/http_client.rb
+- lib/standard_id/instrumentation.rb
 - lib/standard_id/jwt_service.rb
+- lib/standard_id/migration_check.rb
+- lib/standard_id/migration_helpers.rb
 - lib/standard_id/oauth/audience_profile_resolver.rb
 - lib/standard_id/oauth/audience_scope_resolver.rb
 - lib/standard_id/oauth/authorization_code_authorization_flow.rb
@@ -291,6 +296,7 @@ files:
 - lib/standard_id/passwordless/verification_service.rb
 - lib/standard_id/provider_registry.rb
 - lib/standard_id/providers/base.rb
+- lib/standard_id/providers/plugin_railtie.rb
 - lib/standard_id/rate_limit_store.rb
 - lib/standard_id/routing.rb
 - lib/standard_id/scope_config.rb
@@ -302,6 +308,7 @@ files:
 - lib/standard_id/testing/factories/oauth.rb
 - lib/standard_id/testing/factories/sessions.rb
 - lib/standard_id/testing/factory_bot.rb
+- lib/standard_id/testing/provider_examples.rb
 - lib/standard_id/testing/request_helpers.rb
 - lib/standard_id/utils/callable_parameter_filter.rb
 - lib/standard_id/utils/ip_normalizer.rb
@@ -336,5 +343,5 @@ requirements: []
 rubygems_version: 4.0.3
 specification_version: 4
 summary: A comprehensive authentication engine for Rails, built on the security primitives
-  introduced in Rails 7/8.
+  introduced in Rails 8.
 test_files: []

data/config/initializers/migration_helpers.rb

@@ -1,32 +0,0 @@
-# Monkey patch ActiveRecord::Migration to add primary_key_type and foreign_key_type methods
-module ActiveRecord
-  class Migration
-    class << self
-      def primary_and_foreign_key_types
-        config = Rails.configuration.generators
-        config.options[config.orm][:primary_key_type] || :bigint
-      end
-
-      def primary_key_type
-        primary_and_foreign_key_types
-      end
-
-      def foreign_key_type
-        primary_and_foreign_key_types
-      end
-    end
-
-    # Make these methods available as instance methods too
-    def primary_and_foreign_key_types
-      self.class.primary_and_foreign_key_types
-    end
-
-    def primary_key_type
-      self.class.primary_key_type
-    end
-
-    def foreign_key_type
-      self.class.foreign_key_type
-    end
-  end
-end