standard_id 0.41.1 → 0.43.0

data/app/controllers/concerns/standard_id/passwordless_flow.rb

@@ -61,7 +61,10 @@ module StandardId
     # @param username [String] the identifier value (email or phone number)
     # @param code [String] the OTP code to verify
     # @param connection [String] the delivery channel ("email" or "sms"), defaults to "email"
-    # @param allow_registration [Boolean] whether to create a new account if none exists (default: true)
+    # @param allow_registration [Boolean] whether to create a new account if none exists (default: true).
+    #   When the including controller resolves a scope (StandardId::LifecycleHooks#current_scope_config)
+    #   and that scope sets `allow_registration: false`, registration is refused regardless —
+    #   a scope can only restrict.
     # @return [StandardId::Passwordless::VerificationService::Result] a result with:
     #   - success? -- true when verification succeeded
     #   - account  -- the authenticated/created account (nil on failure)
@@ -77,8 +80,14 @@ module StandardId
         code: code,
         connection: connection,
         request: request,
-        allow_registration: allow_registration
+        allow_registration: StandardId::ScopeConfig.registration_allowed?(allow_registration, passwordless_scope_config)
       )
     end
+
+    # The active ScopeConfig when the controller also includes
+    # StandardId::LifecycleHooks; nil otherwise (no scope → no restriction).
+    def passwordless_scope_config
+      respond_to?(:current_scope_config, true) ? current_scope_config : nil
+    end
   end
 end

data/app/controllers/concerns/standard_id/rate_limit_handling.rb

@@ -41,29 +41,15 @@ module StandardId
       end
     end
 
-    # Resolve the effective per-IP login rate limit, preferring the
-    # mechanism-agnostic `login_per_ip` alias and falling back to the deprecated
-    # `password_login_per_ip` when the host left the alias at its default (i.e.
-    # only configured the old name). The new alias wins whenever explicitly set.
-    # Mirrors the max_attempts -> max_attempts_per_challenge deprecation-alias
-    # precedent (prefer-new, fall-back-to-old).
+    # Effective per-IP login rate limit (`rate_limits.login_per_ip`). The
+    # deprecated `password_login_per_ip` fallback was removed in 0.43.
     def self.login_per_ip
-      resolve_login_alias(:login_per_ip, :password_login_per_ip)
+      StandardId.config.rate_limits.login_per_ip
     end
 
-    # Effective per-email login rate limit; see .login_per_ip.
+    # Effective per-email login rate limit (`rate_limits.login_per_email`).
     def self.login_per_email
-      resolve_login_alias(:login_per_email, :password_login_per_email)
-    end
-
-    # Return the alias value unless it still equals its schema default, in which
-    # case fall back to the deprecated field. Both fields share the same default,
-    # so the effective default is unchanged when neither is set.
-    def self.resolve_login_alias(new_field, old_field)
-      rate_limits = StandardId.config.rate_limits
-      default = StandardId.config.__schema__.field_for(:rate_limits, new_field).default_value
-      new_value = rate_limits[new_field]
-      new_value == default ? rate_limits[old_field] : new_value
+      StandardId.config.rate_limits.login_per_email
     end
 
     private

data/app/controllers/concerns/standard_id/social_authentication.rb

@@ -38,7 +38,7 @@ module StandardId
 
       emit_social_user_info_fetched(provider, social_info, email)
 
-      identifier = StandardId::EmailIdentifier.find_by(value: email)
+      identifier = StandardId::EmailIdentifier.includes(:account).find_by(value: email)
 
       if identifier.present?
         validate_social_link!(identifier, provider)

data/app/controllers/standard_id/api/oauth/callback/providers_controller.rb

@@ -55,19 +55,12 @@ module StandardId
         # must not emit. The error re-raises into the standard
         # handle_oauth_error JSON response.
         def fetch_provider_user_info
-          get_user_info_from_provider(flow: resolve_flow_for(provider.provider_name))
+          get_user_info_from_provider(flow: provider.flow_for(params))
         rescue StandardId::OAuthError => e
           emit_social_auth_failed(e)
           raise
         end
 
-        def resolve_flow_for(connection)
-          return :mobile unless connection == "apple"
-
-          flow_param = params[:flow].to_s.downcase
-          flow_param == "web" ? :web : :mobile
-        end
-
         # The `except` list is the trust boundary — non-reserved values are
         # host-supplied opaque attribution data, never interpreted by the gem.
         def forwarded_request_params

data/app/controllers/standard_id/web/login_controller.rb

@@ -11,8 +11,7 @@ module StandardId
       layout "public"
 
       # RAR-51: Rate limit login attempts by IP (20 per 15 minutes). Reads the
-      # mechanism-agnostic `login_per_ip` alias, falling back to the deprecated
-      # `password_login_per_ip` — this action branches password OR passwordless,
+      # mechanism-agnostic `login_per_ip` — this action branches password OR passwordless,
       # so on a passwordless app this governs the OTP-send limit, not a password
       # login. See StandardId::RateLimitHandling.login_per_ip.
       rate_limit to: StandardId::RateLimitHandling.login_per_ip,

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -106,6 +106,8 @@ module StandardId
         end
       end
 
+      # Global web.passwordless_registration AND the active scope's
+      # allow_registration (verify_passwordless_otp applies the scope half).
       def passwordless_registration_enabled?
         StandardId.config.web.passwordless_registration
       end

data/app/controllers/standard_id/web/verify_email/start_controller.rb

@@ -35,17 +35,21 @@ module StandardId
             render plain: "missing email", status: :unprocessable_content and return
           end
 
-          challenge = StandardId::CodeChallenge.create!(
+          # Issued through the passwordless strategy (validation, retry delay,
+          # previous-code invalidation) so delivery goes through the
+          # PASSWORDLESS_CODE_GENERATED event like every other OTP. Before 0.43
+          # this called the since-removed passwordless_email_sender directly.
+          result = StandardId::Otp.issue(
             realm: "verification",
-            channel: "email",
             target: email,
-            code: StandardId::Passwordless.generate_otp_code,
-            expires_at: 10.minutes.from_now,
-            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
-            user_agent: request.user_agent
+            channel: :email,
+            request: request,
+            expires_in: 10.minutes
           )
-
-          StandardId.config.passwordless_email_sender&.call(email, challenge.code)
+          unless result.success?
+            flash[:alert] = result.error_message
+            render plain: "invalid email", status: :unprocessable_content and return
+          end
 
           redirect_to standard_id_web.login_path, notice: "Verification code sent to your email", status: :see_other
         end

data/app/controllers/standard_id/web/verify_phone/start_controller.rb

@@ -35,17 +35,21 @@ module StandardId
             render plain: "invalid phone", status: :unprocessable_content and return
           end
 
-          challenge = StandardId::CodeChallenge.create!(
+          # Issued through the passwordless strategy (validation, retry delay,
+          # previous-code invalidation) so delivery goes through the
+          # PASSWORDLESS_CODE_GENERATED event like every other OTP. Before 0.43
+          # this called the since-removed passwordless_sms_sender directly.
+          result = StandardId::Otp.issue(
             realm: "verification",
-            channel: "sms",
             target: phone,
-            code: StandardId::Passwordless.generate_otp_code,
-            expires_at: 10.minutes.from_now,
-            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
-            user_agent: request.user_agent
+            channel: :sms,
+            request: request,
+            expires_in: 10.minutes
           )
-
-          StandardId.config.passwordless_sms_sender&.call(phone, challenge.code)
+          unless result.success?
+            flash[:alert] = result.error_message
+            render plain: "invalid phone", status: :unprocessable_content and return
+          end
 
           redirect_to standard_id_web.login_path, notice: "Verification code sent via SMS", status: :see_other
         end

data/app/jobs/standard_id/cleanup_all_job.rb

@@ -0,0 +1,46 @@
+module StandardId
+  # Runs all four expired-row cleanup jobs inline, in one job.
+  #
+  # Schedule this ONE job instead of the four individual ones when you want a
+  # single recurring entry — typically so the schedule carries one cron
+  # monitor (Sentry, Honeybadger, …) rather than four. Subclass it in the host
+  # to attach the monitor:
+  #
+  #   # app/jobs/standard_id_cleanup_job.rb
+  #   class StandardIdCleanupJob < StandardId::CleanupAllJob
+  #     include Sentry::Cron::MonitorCheckIns
+  #     sentry_monitor_check_ins slug: "standard-id-cleanup",
+  #       monitor_config: Sentry::Cron::MonitorConfig.from_crontab("7 * * * *")
+  #   end
+  #
+  # One table's DELETE failing (a lock timeout, say) does not skip the others;
+  # the first error is re-raised once all four have run, so the run still
+  # fails its cron check-in and lands in the queue's failed executions.
+  #
+  # Each job keeps its default grace windows (see README "Scheduled
+  # Maintenance"); retention is bounded by those, not by the cadence.
+  class CleanupAllJob < ApplicationJob
+    queue_as :default
+
+    # @return [Array<Class>] the cleanup jobs run, in order
+    def self.jobs
+      [
+        StandardId::CleanupExpiredSessionsJob,
+        StandardId::CleanupExpiredRefreshTokensJob,
+        StandardId::CleanupExpiredAuthorizationCodesJob,
+        StandardId::CleanupExpiredCodeChallengesJob
+      ]
+    end
+
+    def perform
+      errors = self.class.jobs.filter_map do |job|
+        job.perform_now
+        nil
+      rescue StandardError => e
+        Rails.logger.warn("[StandardId] #{job.name} failed: #{e.class}: #{e.message}")
+        e
+      end
+      raise errors.first if errors.any?
+    end
+  end
+end

data/app/jobs/standard_id/password_reset_delivery_job.rb

@@ -15,7 +15,7 @@ module StandardId
       normalized = email.to_s.strip.downcase
       return if normalized.blank?
 
-      identifier = StandardId::EmailIdentifier.find_by(value: normalized)
+      identifier = StandardId::EmailIdentifier.includes(:account).find_by(value: normalized)
       return if identifier.nil?
 
       password_credential = identifier.account

data/app/models/concerns/standard_id/credentiable.rb

@@ -3,7 +3,14 @@ module StandardId
     extend ActiveSupport::Concern
 
     included do
-      has_one :credential, as: :credentialable, touch: true
+      # strict_loading: false — `touch: true` makes Rails read this association
+      # from inside its own after_create/after_update/after_destroy callbacks
+      # (ActiveRecord::Associations::Builder::HasOne.touch_record), which no
+      # `includes` at a call site can reach. Without the exemption every save of
+      # a PasswordCredential / ClientSecretCredential raises
+      # StrictLoadingViolationError in hosts running strict_loading_by_default.
+      # It is a one-row has_one read, never an N+1.
+      has_one :credential, as: :credentialable, touch: true, strict_loading: false
       accepts_nested_attributes_for :credential
 
       delegate :account, to: :credential

data/app/models/standard_id/application_record.rb

@@ -1,5 +1,31 @@
 module StandardId
   class ApplicationRecord < ActiveRecord::Base
     self.abstract_class = true
+
+    # Load +associations+ onto already-instantiated +records+ without tripping
+    # strict loading.
+    #
+    # Gem models run under hosts that set `strict_loading_by_default = true`.
+    # A lazy `record.account` then raises ActiveRecord::StrictLoadingViolationError
+    # even for a single-row belongs_to read. Where the gem did not load the
+    # record itself (model callbacks, records handed in by host code) it cannot
+    # add `includes` at the query, so it preloads here instead — the supported
+    # Rails API, which also skips associations that are already loaded.
+    #
+    # @return [Array<ActiveRecord::Base>] the records
+    def self.preload_associations(records, *associations)
+      records = Array(records).compact
+      return records if records.empty?
+
+      ActiveRecord::Associations::Preloader.new(records: records, associations: associations).call
+      records
+    end
+
+    private
+
+    def preload_associations(*associations)
+      StandardId::ApplicationRecord.preload_associations(self, *associations)
+      self
+    end
   end
 end

data/app/models/standard_id/authorization_code.rb

@@ -60,8 +60,10 @@ module StandardId
       )
     end
 
+    # Preloads :account — every caller (the token exchange) reads it, and hosts
+    # running strict_loading_by_default would otherwise raise on the lazy read.
     def self.lookup(plaintext_code)
-      find_by(code_hash: hash_for(plaintext_code))
+      includes(:account).find_by(code_hash: hash_for(plaintext_code))
     end
 
     def self.hash_for(plaintext_code)

data/app/models/standard_id/identifier.rb

@@ -36,6 +36,7 @@ module StandardId
     end
 
     def mark_account_verified!
+      preload_associations(:account)
       return if account.nil?
 
       return unless account.has_attribute?(:verified)

data/app/models/standard_id/session.rb

@@ -181,7 +181,7 @@ module StandardId
     # loop and leave later sessions without their SESSION_REVOKED event, which
     # would permanently desync audit-trail consumers from the DB.
     def self.publish_session_revocations(sessions, account:, reason:, now:)
-      shared_account = account || sessions.first.account
+      shared_account = account || preload_associations(sessions.first, :account).first&.account
 
       sessions.each do |session|
         session.revoked_at = now
@@ -277,6 +277,7 @@ module StandardId
     end
 
     def emit_session_revoked_event
+      preload_associations(:account)
       StandardId::Events.publish(
         StandardId::Events::SESSION_REVOKED,
         session: self,

data/app/views/standard_id/web/login/_social_buttons.html.erb

@@ -6,14 +6,14 @@
 %>
 <section aria-label="Other sign-in options">
   <p>Or continue with</p>
-  <% if StandardId.config.google_client_id.present? %>
+  <% if StandardId.social_provider_enabled?(:google) %>
     <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
       <%= form.hidden_field :connection, value: "google" %>
       <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
       <button type="submit">Google</button>
     <% end %>
   <% end %>
-  <% if StandardId.config.apple_client_id.present? %>
+  <% if StandardId.social_provider_enabled?(:apple) %>
     <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
       <%= form.hidden_field :connection, value: "apple" %>
       <%= form.hidden_field :redirect_uri, value: @redirect_uri %>

data/app/views/standard_id/web/login/show.html.erb

@@ -53,7 +53,7 @@
       })();
     </script>
 
-    <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+    <% if StandardId.social_provider_enabled?(:google) || StandardId.social_provider_enabled?(:apple) %>
       <%= render "standard_id/web/login/social_buttons" %>
     <% end %>
 
@@ -128,7 +128,7 @@
           </div>
         <% end %>
 
-        <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+        <% if StandardId.social_provider_enabled?(:google) || StandardId.social_provider_enabled?(:apple) %>
           <div>
             <div class="mt-10 flex items-center gap-x-6">
               <div class="w-full flex-1 border-t border-gray-200 dark:border-white/10"></div>
@@ -137,7 +137,7 @@
             </div>
 
             <div class="mt-6 grid grid-cols-2 gap-4">
-              <% if StandardId.config.google_client_id.present? %>
+              <% if StandardId.social_provider_enabled?(:google) %>
                 <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
                   <%= form.hidden_field :connection, value: "google" %>
                   <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
@@ -153,7 +153,7 @@
                 <% end %>
               <% end %>
 
-              <% if StandardId.config.apple_client_id.present? %>
+              <% if StandardId.social_provider_enabled?(:apple) %>
                 <%= form_with url: login_path, method: :post, local: true, data: { turbo: false } do |form| %>
                   <%= form.hidden_field :connection, value: "apple" %>
                   <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
@@ -185,7 +185,7 @@
   <main>
     <h1>Sign in</h1>
     <p>No login method is enabled.</p>
-    <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+    <% if StandardId.social_provider_enabled?(:google) || StandardId.social_provider_enabled?(:apple) %>
       <%= render "standard_id/web/login/social_buttons" %>
     <% end %>
   </main>

data/app/views/standard_id/web/signup/show.html.erb

@@ -46,7 +46,7 @@
         </div>
       <% end %>
 
-      <% if StandardId.config.google_client_id.present? || StandardId.config.apple_client_id.present? %>
+      <% if StandardId.social_provider_enabled?(:google) || StandardId.social_provider_enabled?(:apple) %>
         <div>
           <div class="mt-10 flex items-center gap-x-6">
             <div class="w-full flex-1 border-t border-gray-200 dark:border-white/10"></div>
@@ -55,7 +55,7 @@
           </div>
 
           <div class="mt-6 grid grid-cols-2 gap-4">
-            <% if StandardId.config.google_client_id.present? %>
+            <% if StandardId.social_provider_enabled?(:google) %>
               <%= form_with url: signup_path, method: :post, local: true do |form| %>
                 <%= form.hidden_field :connection, value: "google" %>
                 <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
@@ -71,7 +71,7 @@
               <% end %>
             <% end %>
 
-            <% if StandardId.config.apple_client_id.present? %>
+            <% if StandardId.social_provider_enabled?(:apple) %>
               <%= form_with url: signup_path, method: :post, local: true do |form| %>
                 <%= form.hidden_field :connection, value: "apple" %>
                 <%= form.hidden_field :redirect_uri, value: @redirect_uri %>

data/db/migrate/20250830000000_create_standard_id_client_applications.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdClientApplications < ActiveRecord::Migration[7.1]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_client_applications, id: primary_key_type do |t|
       # Polymorphic owner association (Account, Organization, etc.)

data/db/migrate/20250830171553_create_standard_id_password_credentials.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdPasswordCredentials < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_password_credentials, id: primary_key_type do |t|
       t.string :login, null: false, index: { unique: true }

data/db/migrate/20250830232800_create_standard_id_identifiers.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdIdentifiers < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_identifiers, id: primary_key_type do |t|
       t.references :account, type: primary_key_type, null: false, foreign_key: { to_table: StandardId.account_class.table_name }, index: true

data/db/migrate/20250831075703_create_standard_id_credentials.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdCredentials < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_credentials, id: primary_key_type do |t|
       t.references :identifier, type: primary_key_type, null: false, foreign_key: { to_table: :standard_id_identifiers }, index: true

data/db/migrate/20250831154635_create_standard_id_sessions.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdSessions < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_sessions, id: primary_key_type do |t|
       t.references :account, type: primary_key_type, null: false, foreign_key: true, index: true

data/db/migrate/20250901134520_create_standard_id_client_secret_credentials.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdClientSecretCredentials < ActiveRecord::Migration[7.1]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_client_secret_credentials, id: primary_key_type do |t|
       t.string :name, null: false

data/db/migrate/20250903063000_create_standard_id_authorization_codes.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdAuthorizationCodes < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_authorization_codes, id: primary_key_type do |t|
       # Link to account when available (can be nil for pre-auth flows)

data/db/migrate/20250907090000_create_standard_id_code_challenges.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdCodeChallenges < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_code_challenges, id: primary_key_type do |t|
       t.string :realm, null: false         # e.g., authentication, verification

data/db/migrate/20260311100000_create_standard_id_refresh_tokens.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdRefreshTokens < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_refresh_tokens, id: primary_key_type do |t|
       t.references :account, type: primary_key_type, null: false, foreign_key: true, index: true

data/db/migrate/20260414200000_add_target_created_at_index_to_code_challenges.rb

@@ -1,3 +1,4 @@
+# Superseded by 20260416180511's partial index_code_challenges_on_active_target_created_at; hosts that installed that may skip this one (StandardId::MigrationCheck::SUPERSEDED_BY).
 class AddTargetCreatedAtIndexToCodeChallenges < ActiveRecord::Migration[8.0]
   def change
     add_index :standard_id_code_challenges,

data/db/migrate/20260416180511_add_partial_indexes_for_active_session_and_challenge_lookups.rb

@@ -7,8 +7,10 @@ class AddPartialIndexesForActiveSessionAndChallengeLookups < ActiveRecord::Migra
   # except for the GIN drop in step 3. We guard that drop with an `if_exists`
   # check so StrongMigrations/host apps that never ran the creating migration
   # (e.g. SQLite dummies) don't error. StrongMigrations considers partial-
-  # index-add and remove_index safe when concurrently + if_exists are used, so
-  # no ignore comment is needed.
+  # index-add and remove_index safe when concurrently + if_exists are used —
+  # except its "non-unique index with more than three columns" heuristic, which
+  # rejects the 4-column code_challenges index below; that one add_index is
+  # asserted safe (see #assert_safe and the comment at the call site).
   #
   # Split into def up / def down because `remove_index :table, name: "..."`
   # (name-only, no column list) is not auto-reversible via def change — Rails
@@ -55,12 +57,20 @@ class AddPartialIndexesForActiveSessionAndChallengeLookups < ActiveRecord::Migra
     # The existing [:realm, :channel, :target, :created_at] index works but
     # covers every row, including long-since-consumed ones. A partial variant
     # stays tiny (only live challenges) and matches the exact query shape.
-    add_index :standard_id_code_challenges,
-      [:realm, :channel, :target, :created_at],
-      where: "used_at IS NULL",
-      name: "index_code_challenges_on_active_target_created_at",
-      if_not_exists: true,
-      **concurrent
+    #
+    # StrongMigrations flags any non-unique index over more than three columns.
+    # The shape here is deliberate: three equality predicates plus the ORDER BY
+    # column, partial on live challenges, built CONCURRENTLY — so assert it safe
+    # rather than make every host wrap it by hand (fundbright, luminality and
+    # nutripod all had to).
+    assert_safe do
+      add_index :standard_id_code_challenges,
+        [:realm, :channel, :target, :created_at],
+        where: "used_at IS NULL",
+        name: "index_code_challenges_on_active_target_created_at",
+        if_not_exists: true,
+        **concurrent
+    end
 
     # Drop the GIN metadata index on Postgres: metadata is only written to
     # (record_failed_attempt bumps `attempts`), never queried with containment
@@ -114,4 +124,11 @@ class AddPartialIndexesForActiveSessionAndChallengeLookups < ActiveRecord::Migra
       if_exists: true,
       **concurrent
   end
+
+  private
+
+  # StrongMigrations is optional for hosts (the gem does not depend on it).
+  def assert_safe(&block)
+    respond_to?(:safety_assured) ? safety_assured(&block) : yield
+  end
 end

data/db/migrate/20260611000000_create_standard_id_client_grants.rb

@@ -1,4 +1,6 @@
 class CreateStandardIdClientGrants < ActiveRecord::Migration[8.0]
+  include StandardId::MigrationHelpers
+
   def change
     create_table :standard_id_client_grants, id: primary_key_type do |t|
       # The account that granted consent. Required — consent is per-user.