standard_id 0.41.1 → 0.43.0

data/lib/standard_id/providers/base.rb

@@ -1,3 +1,6 @@
+require "uri"
+require "active_support/security_utils"
+
 module StandardId
   module Providers
     # Base class for social login providers.
@@ -225,17 +228,116 @@ module StandardId
           []
         end
 
-        # Optional setup hook called when provider is registered.
+        # --------------------------------------------------------------------
+        # Configuration & enablement
+        # --------------------------------------------------------------------
+        #
+        # Each entry returned by {config_schema} may carry two provider-level
+        # options in addition to the ConfigSchema ones (`type:`, `default:`).
+        # They are consumed by StandardId and never reach ConfigSchema:
+        #
+        # - `env:` — the ENV variable the field falls back to when the host app
+        #   never assigns it. Defaults to the upper-cased field name
+        #   (`google_client_id` → `GOOGLE_CLIENT_ID`), which is the canonical
+        #   naming scheme. Pass a String to use another variable, or `false` to
+        #   disable the ENV fallback for that field. Explicit configuration
+        #   (`c.social.google_client_id = ...`, including an explicit `nil`)
+        #   always wins over the ENV fallback.
+        # - `required: true` — the field must be present whenever the provider
+        #   is {enabled?}. Missing required fields are reported by
+        #   {configuration_errors} and by the boot-time check (see
+        #   `c.social.provider_misconfiguration`).
+        #
+        # Both options require standard_id >= 0.42. A plugin that declares them
+        # should depend on `standard_id >= 0.42` — older versions pass the
+        # options through to ConfigSchema and raise ArgumentError.
+        #
+        # @example
+        #   def self.config_schema
+        #     {
+        #       github_client_id: { type: :string, default: nil },
+        #       github_client_secret: { type: :string, default: nil, required: true },
+        #       github_enterprise_host: { type: :string, default: nil, env: false }
+        #     }
+        #   end
+
+        # Config field whose presence switches this provider on.
         #
-        # Override this method to perform initialization tasks like:
-        # - Registering additional routes
-        # - Adding custom validations
-        # - Setting up caching for JWKS
+        # Defaults to `:"<provider_name>_client_id"` when that field is part of
+        # {config_schema}, otherwise nil (a provider with no enabling field is
+        # always enabled once registered). Override when the provider keys off a
+        # different field.
         #
-        # @return [void]
+        # @return [Symbol, nil]
+        def enabling_config_field
+          field = :"#{provider_name}_client_id"
+          config_schema.key?(field) ? field : nil
+        end
+
+        # Config fields that must be present whenever the provider is enabled.
         #
-        def setup
-          # Override in subclasses if needed
+        # Defaults to the {config_schema} fields declared with `required: true`.
+        #
+        # @return [Array<Symbol>]
+        def required_config_fields
+          config_schema.select { |_name, options| options.is_a?(Hash) && options[:required] }.keys.map(&:to_sym)
+        end
+
+        # Whether the host app has switched this provider on.
+        #
+        # True when {enabling_config_field} is present in the configuration (or
+        # when the provider has no enabling field). Says nothing about whether
+        # the rest of the configuration is complete — see {configuration_errors}
+        # and {configured?}.
+        #
+        # @return [Boolean]
+        def enabled?
+          field = enabling_config_field
+          return true if field.nil?
+
+          config_value(field).present?
+        end
+
+        # Human-readable problems with this provider's configuration.
+        #
+        # Empty when the provider is disabled: a provider nobody switched on
+        # cannot be misconfigured. Messages name fields, never their values.
+        #
+        # @return [Array<String>]
+        def configuration_errors
+          return [] unless enabled?
+
+          missing = required_config_fields.select { |field| config_value(field).blank? }
+          return [] if missing.empty?
+
+          trigger = enabling_config_field ? " when #{enabling_config_field} is set" : ""
+          missing.map { |field| "#{field} is required#{trigger}" }
+        end
+
+        # Enabled and free of {configuration_errors}.
+        #
+        # @return [Boolean]
+        def configured?
+          enabled? && configuration_errors.empty?
+        end
+
+        # The flow a native/API callback is running, used as `context[:flow]`
+        # for {resolve_params}.
+        #
+        # Called by the API callback endpoint (`/api/oauth/callback/:provider`).
+        # The default honours an explicit `flow=web` param only for providers
+        # that {supports_mobile_callback?} — those are the providers whose web
+        # and native flows differ (e.g. Apple's distinct Services ID vs bundle
+        # ID audiences). Everything else is treated as `:mobile`, which is what
+        # the API endpoint served before this hook existed. Override to
+        # recognise other flows.
+        #
+        # @param params [#[]] Request params
+        # @return [Symbol] `:web` or `:mobile`
+        def flow_for(params)
+          return :mobile unless supports_mobile_callback?
+
+          params[:flow].to_s.downcase == "web" ? :web : :mobile
         end
 
         protected
@@ -252,6 +354,118 @@ module StandardId
             tokens: tokens.compact
           }.with_indifferent_access
         end
+
+        # Read one of this provider's config fields.
+        #
+        # Goes through the top-level `StandardId.config` accessor — the same
+        # way the provider plugins read their own credentials — so the value
+        # seen here always matches the one the provider will use.
+        #
+        # @param field [Symbol, String]
+        # @return [Object, nil]
+        def config_value(field)
+          StandardId.config.public_send(field)
+        end
+
+        # Run the block, re-raising any non-OAuth error as StandardId::OAuthError.
+        #
+        # StandardId::OAuthError (and subclasses such as InvalidRequestError)
+        # propagate unchanged. Anything else — network, JSON, OpenSSL, JWT
+        # errors — is wrapped so callers only ever handle OAuthError, with the
+        # original exception kept as `cause`.
+        #
+        # @param message_prefix [String, nil] Prepended to the wrapped error's
+        #   message, e.g. "Failed to fetch JWK" → "Failed to fetch JWK: <msg>"
+        # @return [Object] the block's return value
+        # @raise [StandardId::OAuthError]
+        #
+        # @example
+        #   def fetch_user_info(access_token:)
+        #     rescue_to_oauth_error do
+        #       response = HttpClient.get_with_bearer(USERINFO_ENDPOINT, access_token)
+        #       JSON.parse(response.body)
+        #     end
+        #   end
+        #
+        def rescue_to_oauth_error(message_prefix = nil)
+          yield
+        rescue StandardId::OAuthError
+          raise
+        rescue StandardError => e
+          message = message_prefix ? "#{message_prefix}: #{e.message}" : e.message
+          raise StandardId::OAuthError, message, cause: e
+        end
+
+        # Verify an ID token's `nonce` claim against the one the server issued.
+        #
+        # No-op when `expected` is blank (flows without a server-generated
+        # nonce). Comparison is constant-time. The error message deliberately
+        # does not include either nonce: the expected value is a server-side
+        # secret for the duration of the flow, and error messages end up in
+        # redirects, logs and error trackers.
+        #
+        # @param expected [String, nil] Nonce stored when the flow started
+        # @param actual [String, nil] `nonce` claim from the verified ID token
+        # @return [void]
+        # @raise [StandardId::InvalidRequestError] on mismatch
+        def verify_nonce!(expected:, actual:)
+          return if expected.blank?
+          return if actual.is_a?(String) && ActiveSupport::SecurityUtils.secure_compare(actual, expected.to_s)
+
+          raise StandardId::InvalidRequestError, "ID token nonce mismatch"
+        end
+
+        # Build an OAuth 2.0 authorization-code URL.
+        #
+        # Emits `client_id`, `redirect_uri`, `response_type`, `state`, then one
+        # entry per {supported_authorization_params}, taking the caller's value
+        # from `options` or falling back to `defaults`. Nil values are dropped.
+        #
+        # @param endpoint [String] Provider authorization endpoint
+        # @param client_id [String]
+        # @param redirect_uri [String]
+        # @param state [String]
+        # @param options [Hash] Caller-supplied authorization params
+        # @param defaults [Hash] Per-param fallbacks (e.g. `{ scope: "openid email" }`)
+        # @param response_type [String]
+        # @return [String]
+        #
+        # @example
+        #   def self.authorization_url(state:, redirect_uri:, **options)
+        #     build_authorization_url(
+        #       endpoint: AUTH_ENDPOINT,
+        #       client_id: StandardId.config.github_client_id,
+        #       redirect_uri:, state:, options:,
+        #       defaults: { scope: DEFAULT_SCOPE }
+        #     )
+        #   end
+        #
+        def build_authorization_url(endpoint:, client_id:, redirect_uri:, state:, options: {}, defaults: {}, response_type: "code")
+          query = {
+            client_id: client_id,
+            redirect_uri: redirect_uri,
+            response_type: response_type,
+            state: state
+          }
+
+          supported_authorization_params.each do |param|
+            query[param] = options[param] || defaults[param]
+          end
+
+          "#{endpoint}?#{URI.encode_www_form(query.compact)}"
+        end
+
+        # Pick the standard tokens out of a token-endpoint response.
+        #
+        # @param parsed_token [Hash] Parsed token response (String or Symbol keys)
+        # @return [Hash{Symbol => String}] `access_token`, `refresh_token` and
+        #   `id_token`, nil entries removed
+        def extract_tokens(parsed_token)
+          %i[access_token refresh_token id_token].each_with_object({}) do |key, tokens|
+            value = parsed_token[key.to_s] || parsed_token[key]
+            tokens[key] = value unless value.nil?
+          end
+        end
       end
     end
   end

data/lib/standard_id/providers/plugin_railtie.rb

@@ -0,0 +1,59 @@
+module StandardId
+  module Providers
+    # Namespace for the Railties generated by {Providers.plugin_railtie}.
+    module Railties; end
+
+    class << self
+      # Define the Railtie that registers a provider plugin with StandardId.
+      #
+      # Replaces the hand-written `lib/standard_id/<name>/railtie.rb` every
+      # provider plugin used to carry. Call it from the plugin's entry file,
+      # after the provider class is required:
+      #
+      #   # lib/standard_id/github.rb
+      #   require "standard_id"
+      #   require "standard_id/github/providers/github"
+      #
+      #   StandardId::Providers.plugin_railtie(:github, "StandardId::Providers::GitHub")
+      #
+      # The generated Railtie (`StandardId::Providers::Railties::<Name>`)
+      # registers the provider from `config.after_initialize`, once the host's
+      # configuration is complete. Its config fields are declared earlier, before
+      # `config/initializers` run, by StandardId's own engine initializer — the
+      # plugin has nothing further to do for that.
+      #
+      # Outside Rails (no `Rails::Railtie`) nothing is defined and nil is
+      # returned, so the entry file needs no `if defined?(Rails)` guard.
+      #
+      # Idempotent: calling it again for the same name returns the existing
+      # Railtie rather than defining a second one (which would register twice).
+      #
+      # @param name [Symbol, String] Provider identifier, as passed to
+      #   ProviderRegistry.register (e.g. :google)
+      # @param provider_class [Class, String] The provider class, or its name.
+      #   A String is constantized when the Railtie runs, so the entry file may
+      #   call this before the class is loaded.
+      # @return [Class, nil] the Railtie class
+      def plugin_railtie(name, provider_class)
+        return nil unless defined?(::Rails::Railtie)
+
+        const_name = name.to_s.camelize
+        if Railties.const_defined?(const_name, false)
+          return Railties.const_get(const_name, false)
+        end
+
+        provider_name = name.to_sym
+        railtie = Class.new(::Rails::Railtie)
+        Railties.const_set(const_name, railtie)
+
+        railtie.config.after_initialize do
+          klass = provider_class.is_a?(String) ? provider_class.constantize : provider_class
+          StandardId::ProviderRegistry.register(provider_name, klass)
+          Rails.logger&.debug("[StandardId] registered provider #{provider_name}")
+        end
+
+        railtie
+      end
+    end
+  end
+end

data/lib/standard_id/scope_config.rb

@@ -1,7 +1,11 @@
 module StandardId
   class ScopeConfig
     # @!attribute [r] allow_registration
-    #   Reserved for future use — controls whether new accounts can register under this scope.
+    #   Whether passwordless sign-in under this scope may create a new account
+    #   (default true). It can only RESTRICT: registration happens iff the
+    #   global switch allows it (web.passwordless_registration for the
+    #   WebEngine; the caller's `allow_registration:` for host controllers using
+    #   StandardId::PasswordlessFlow) AND this is true. See #allow_registration?.
     # @!attribute [r] profile_types
     #   Array of profile-type class names accepted by this scope. Any profile matching any of
     #   these types satisfies the built-in profile check.
@@ -20,37 +24,35 @@ module StandardId
                 :allow_registration,
                 :authorizer
 
-    # Shared deprecator instance. Creating a new ActiveSupport::Deprecation on
-    # every extract_profile_types call bypasses the host app's configured
-    # deprecation behaviour (Rails 7.1+ routes through deprecation registries)
-    # and allocates for every scope init. One instance is enough.
-    DEPRECATOR = ActiveSupport::Deprecation.new("2.0", "StandardId")
-
     # Normalize profile-type inputs from config.
     #
-    # Accepts:
-    #   - :profile_types (plural) — array of strings (preferred).
-    #   - :profile_type  (singular) — single string, retained for back-compat. Emits a
-    #     deprecation warning when present.
+    # Accepts :profile_types — an Array of profile-type class names (a single
+    # String is wrapped). The singular :profile_type key was removed in 0.43
+    # (deprecated in 0.42) and now raises: silently ignoring it would leave the
+    # scope with NO profile requirement, admitting every account.
     #
-    # Returns an Array<String> (possibly empty).
+    # @return [Array<String>] possibly empty
+    # @raise [StandardId::ConfigurationError] when the removed :profile_type key is present
     def self.extract_profile_types(config)
-      plural = config[:profile_types]
-      singular = config[:profile_type]
-
-      if singular && plural
-        raise ArgumentError, "Scope config cannot set both :profile_type and :profile_types — use :profile_types"
+      if config.key?(:profile_type) || config.key?("profile_type")
+        raise StandardId::ConfigurationError,
+          "StandardId scope config key :profile_type was removed in StandardId 0.43. " \
+          "Use profile_types: [...] (an Array of profile-type class names) instead."
       end
 
-      if singular
-        DEPRECATOR.warn(
-          "StandardId scope config key :profile_type is deprecated and will be removed in v2.0. " \
-            "Use :profile_types (an Array of profile-type strings) instead."
-        )
-        return Array(singular).map(&:to_s).reject(&:blank?)
-      end
+      Array(config[:profile_types]).map(&:to_s).reject(&:blank?)
+    end
+
+    # Build every scope in StandardId.config.scopes once, so a scope config the
+    # gem can no longer read (e.g. the removed :profile_type key) fails at boot
+    # rather than on the first sign-in under that scope. Run by the engine.
+    #
+    # @return [void]
+    # @raise [StandardId::ConfigurationError]
+    def self.validate_all!(scopes = StandardId.config.scopes)
+      return if scopes.blank?
 
-      Array(plural).map(&:to_s).reject(&:blank?)
+      scopes.each { |name, scope_hash| new(name, scope_hash || {}) }
     end
 
     def initialize(name, config = {})
@@ -59,7 +61,8 @@ module StandardId
       @after_sign_in_path = config[:after_sign_in_path]
       @no_profile_message = config[:no_profile_message] || default_no_profile_message
       @label = config[:label] || name.to_s.humanize
-      @allow_registration = config.fetch(:allow_registration, true)
+      # A present-but-nil key means "not configured", i.e. the default (true).
+      @allow_registration = config[:allow_registration].nil? ? true : config[:allow_registration]
       @authorizer = config[:authorizer]
     end
 
@@ -82,6 +85,20 @@ module StandardId
       authorizer.respond_to?(:call)
     end
 
+    def allow_registration?
+      allow_registration != false
+    end
+
+    # Combine a global/caller registration switch with a (possibly nil) scope.
+    # No scope → the global value unchanged; a scope can only turn it off.
+    #
+    # @param global [Boolean]
+    # @param scope_config [StandardId::ScopeConfig, nil]
+    def self.registration_allowed?(global, scope_config)
+      return false unless global
+      scope_config.nil? || scope_config.allow_registration?
+    end
+
     private
 
     def default_no_profile_message

data/lib/standard_id/testing/config_helpers.rb

@@ -0,0 +1,55 @@
+module StandardId
+  module Testing
+    # Helpers for specs that exercise StandardId configuration defaults —
+    # chiefly the ENV fallback of provider fields (`GOOGLE_CLIENT_ID`,
+    # `APPLE_CLIENT_ID`, …).
+    #
+    # Those defaults are resolved ONCE, when the config is built at boot, so
+    # setting ENV inside a spec changes nothing on its own. `with_provider_env`
+    # sets the variables, re-resolves every field the host never assigned, runs
+    # the block, then restores both:
+    #
+    #   RSpec.describe "Apple sign-in" do
+    #     include StandardId::Testing::ConfigHelpers
+    #
+    #     it "is enabled once APPLE_CLIENT_ID is set" do
+    #       with_provider_env("APPLE_CLIENT_ID" => "com.example.web") do
+    #         expect(StandardId.social_provider_enabled?(:apple)).to be(true)
+    #       end
+    #     end
+    #   end
+    #
+    # (also callable as `StandardId::Testing.with_provider_env(...)`).
+    #
+    # A field the host assigned explicitly — even to nil — ignores ENV by
+    # design; `StandardId.config.social.assigned?(:apple_client_id)` tells the
+    # two cases apart (`key?` is true for every declared field, assigned or
+    # not).
+    module ConfigHelpers
+      # @param env [Hash{String => String, nil}] variables to set; nil unsets.
+      #   Usually passed brace-less (`with_provider_env("APPLE_CLIENT_ID" => "x")`),
+      #   which Ruby delivers as keywords — hence **vars.
+      # @param scope [Symbol] config scope whose defaults to re-resolve
+      # @yield with the variables set and the scope's defaults re-resolved
+      # @return [Object] the block's value
+      def with_provider_env(env = {}, scope: :social, **vars)
+        env = env.merge(vars)
+        previous = env.to_h { |name, _| [name.to_s, ENV[name.to_s]] }
+        env.each { |name, value| write_env(name.to_s, value) }
+        StandardId.config[scope].refresh_defaults!
+        yield
+      ensure
+        previous&.each { |name, value| write_env(name, value) }
+        StandardId.config[scope].refresh_defaults!
+      end
+
+      private
+
+      def write_env(name, value)
+        value.nil? ? ENV.delete(name) : ENV[name] = value.to_s
+      end
+    end
+
+    extend ConfigHelpers
+  end
+end

data/lib/standard_id/testing/provider_examples.rb

@@ -0,0 +1,117 @@
+# RSpec support for host apps (and provider plugins) that want to pin down
+# "this provider plugin is installed, registered, and its config fields are
+# writable from config/initializers/standard_id.rb".
+#
+# Loaded automatically by `require "standard_id/testing"` when RSpec is
+# present, or explicitly:
+#
+#   require "standard_id/testing/provider_examples"
+#
+# Shared example — the one-liner most apps want:
+#
+#   RSpec.describe "StandardId social providers" do
+#     it_behaves_like "a registered StandardId provider", :google
+#     it_behaves_like "a registered StandardId provider", :apple,
+#                     config_fields: %i[apple_client_id apple_private_key apple_key_id apple_team_id]
+#   end
+#
+# `config_fields:` defaults to every field in the provider's `config_schema`.
+#
+# Matcher — for ad-hoc assertions:
+#
+#   expect(:google).to be_a_registered_standard_id_provider
+#   expect(:apple).to be_a_registered_standard_id_provider.with_config_fields(:apple_client_id, :apple_team_id)
+#
+require "standard_id"
+
+module StandardId
+  module Testing
+    module ProviderExamples
+      module_function
+
+      # Problems preventing `name` from counting as a registered provider with
+      # the given social config fields. Empty when all is well.
+      #
+      # @param name [Symbol, String]
+      # @param fields [Array<Symbol>, nil] nil = the provider's config_schema keys
+      # @return [Array<String>]
+      def problems(name, fields = nil)
+        return ["provider #{name.inspect} is not registered with StandardId::ProviderRegistry"] unless StandardId::ProviderRegistry.registered?(name)
+
+        fields = config_fields_for(name) if fields.nil?
+        fields.filter_map do |field|
+          next "#{field} is not declared on the social config scope" unless StandardId::ConfigSchema.instance.field?(:social, field)
+
+          begin
+            StandardId.config.social.public_send(field)
+            nil
+          rescue StandardError => e
+            "reading social.#{field} raised #{e.class}: #{e.message}"
+          end
+        end
+      end
+
+      def config_fields_for(name)
+        StandardId::ProviderRegistry.get(name).config_schema.keys.map(&:to_sym)
+      end
+
+      # Write `value` through the same setter a host initializer uses, then
+      # restore the field exactly — including "never assigned", so an ENV
+      # fallback keeps working for later examples.
+      def round_trip(field, value)
+        social = StandardId.config.social
+        assigned = social.assigned?(field)
+        original = social.to_h[field.to_sym]
+        social.public_send(:"#{field}=", value)
+        social.public_send(field)
+      ensure
+        if assigned
+          social[field.to_sym] = original
+        else
+          social.delete(field.to_sym)
+        end
+      end
+    end
+  end
+end
+
+if defined?(RSpec::Matchers) && RSpec::Matchers.respond_to?(:define)
+  RSpec::Matchers.define :be_a_registered_standard_id_provider do
+    chain(:with_config_fields) { |*fields| @fields = fields.flatten.map(&:to_sym) }
+
+    match do |name|
+      @problems = StandardId::Testing::ProviderExamples.problems(name, @fields)
+      @problems.empty?
+    end
+
+    failure_message do |name|
+      "expected #{name.inspect} to be a registered StandardId provider, but:\n  " + @problems.join("\n  ")
+    end
+
+    failure_message_when_negated do |name|
+      "expected #{name.inspect} not to be a registered StandardId provider"
+    end
+  end
+end
+
+if defined?(RSpec) && RSpec.respond_to?(:shared_examples)
+  RSpec.shared_examples "a registered StandardId provider" do |name, config_fields: nil|
+    fields_for = -> { config_fields || StandardId::Testing::ProviderExamples.config_fields_for(name) }
+
+    it "registers the #{name} provider" do
+      expect(StandardId::ProviderRegistry.registered?(name)).to be(true),
+        "#{name.inspect} is not registered — is its plugin gem in the Gemfile, and did the app boot its Railtie?"
+    end
+
+    it "declares the #{name} config fields on the social scope" do
+      expect(name).to be_a_registered_standard_id_provider.with_config_fields(fields_for.call)
+    end
+
+    it "accepts writes to the #{name} config fields, as config/initializers/standard_id.rb does" do
+      fields_for.call.each do |field|
+        expect(StandardId::Testing::ProviderExamples.round_trip(field, "probe-value")).to eq("probe-value"),
+          "writing social.#{field} did not round-trip"
+      end
+    end
+  end
+end

data/lib/standard_id/testing.rb

@@ -1,5 +1,7 @@
 require "standard_id/testing/authentication_helpers"
 require "standard_id/testing/request_helpers"
+require "standard_id/testing/config_helpers"
+require "standard_id/testing/provider_examples" if defined?(RSpec)
 
 module StandardId
   module Testing

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.41.1"
+  VERSION = "0.43.0"
 end

data/lib/standard_id.rb

@@ -1,4 +1,6 @@
 require "standard_id/version"
+require "standard_id/deprecator"
+require "standard_id/instrumentation"
 require "standard_id/current_attributes"
 require "standard_id/engine"
 require "standard_id/web_engine"
@@ -7,6 +9,9 @@ require "standard_id/config_schema"
 require "standard_id/config/schema"
 require "standard_id/scope_config"
 require "standard_id/association_strict_loading"
+require "standard_id/migration_check"
+require "standard_id/migration_helpers"
+require "standard_id/checks/migrations"
 require "standard_id/errors"
 require "standard_id/events"
 require "standard_id/events/subscribers/base"
@@ -65,6 +70,7 @@ require "concurrent/delay"
 
 require "standard_id/providers/base"
 require "standard_id/provider_registry"
+require "standard_id/providers/plugin_railtie"
 
 module StandardId
   CONFIG = Concurrent::Delay.new { ConfigSchema.build }
@@ -105,6 +111,26 @@ module StandardId
       ScopeConfig.new(name, scope_hash)
     end
 
+    # Registered social providers the host app has switched on.
+    #
+    # @return [Hash{String => Class}] Provider name => provider class
+    # @see StandardId::Providers::Base.enabled?
+    def enabled_social_providers
+      ProviderRegistry.enabled
+    end
+
+    # Whether the named social provider is registered AND switched on.
+    #
+    # Safe to call for a provider whose plugin gem is not installed — returns
+    # false rather than raising. Prefer this over checking a client ID
+    # directly (`StandardId.config.google_client_id.present?`).
+    #
+    # @param name [Symbol, String] e.g. :google
+    # @return [Boolean]
+    def social_provider_enabled?(name)
+      ProviderRegistry.registered?(name) && ProviderRegistry.get(name).enabled?
+    end
+
     def skip_host_authorization(framework: nil, callback: nil)
       AuthorizationBypass.apply(framework: framework, callback: callback)
     end