standard_id 0.42.0 → 0.43.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e1701f28a06762afc1eac4d5d31408180ab6b89bf617d420124301ad55c0f8b
-  data.tar.gz: be9d2d78656afd4d0d2e67e17bbf1fdb3cd6c586af6ad85e5514385b1b52f025
+  metadata.gz: 8f9798d4a8c4db5cbc69cc0c4f569cc41e825b5df159124fab15f39923ca602f
+  data.tar.gz: 1b06dc3eee0795f25633df9dc93dae5376c0bc5f6e1b0cd97ef3ce37fca6fc02
 SHA512:
-  metadata.gz: 924d298113db49b3014dd440b49d038476f23bab8474cf02a661839079580a4ee772c8cdaeb0cf330bfe85fa437b6042af1ffbf1d299d8a4ecbf7ac091c0bafa
-  data.tar.gz: a9f4da6de783d8e7d0c8f862c2a5ca80c708856746a45ec61605f51160ef8d85b596b1fbad7b75bda3e5cae6311061fb43424db74005e0c24d9ba7fb3a4c55ab
+  metadata.gz: 10594cb5f3206999becca9fb582bfcc714f8371713160192ddf72fdeb39fe4f9552e9d551991fcf294af2eca71fcd8266f8c1f0a27e94c069a7f597581a54d8e
+  data.tar.gz: 1ababa07f26cea7f6240666372f25ada38a7c3672313306c1ce7eddedded43efaff08b27df71d50c1b78f75e75d6f909f421236c455d1ac9c1658015752bdc4c

data/CHANGELOG.md

@@ -7,6 +7,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.43.0] - 2026-09-24
+
+**Breaking minor.** Removes everything 0.42 deprecated. Every consumer cleared those warnings in its Phase 3 adoption, so for the five apps the upgrade is a version bump — see **Upgrade notes**.
+
+### Upgrade notes
+
+If your app boots on 0.42 with no `StandardId` deprecation warning, **you need change nothing**. Checked against `origin/main` of fundbright-web, jumpdrive-web, luminality-web, nutripod-web and sidekick-web: none assigns a removed setting, uses the singular scope `profile_type:`, calls `Otp.issue(delivery: :custom)`, defines `Providers::Base.setup` or references a `DEPRECATOR` constant. What remains is comments (jumpdrive-web and luminality-web's initializers still carry the old commented-out `# c.passwordless_*_sender` lines; jumpdrive-web the commented `# c.rate_limits.password_login_per_*` lines) — worth deleting, harmless to keep.
+
+| Removed | What to do instead |
+|---|---|
+| `c.passwordless_email_sender`, `c.passwordless_sms_sender` | A `StandardId::Events::PASSWORDLESS_CODE_GENERATED` subscriber (skip when `event[:skip_sender]`), with `c.passwordless.delivery = :custom` (the default) — as fundbright-web already does. |
+| `c.passwordless.enabled` | `c.web.passwordless_login` (it had no effect since 0.8). |
+| `c.oauth.client_id`, `c.oauth.client_secret` | Delete — never read. |
+| `c.rate_limits.password_login_per_ip`, `password_login_per_email` | `c.rate_limits.login_per_ip`, `login_per_email`. `RateLimitHandling.login_per_ip` / `.login_per_email` now read only these. |
+| Scope config `profile_type: "X"` | `profile_types: ["X"]`. |
+| `Providers::Base.setup` (called with a warning when a provider defined it) | Initialize in the plugin's Railtie; `setup` is no longer called. standard_id-apple 0.6, standard_id-google 0.5 and standard_id-provider define none. |
+| `StandardId::ScopeConfig::DEPRECATOR`, `StandardId::ProviderRegistry::DEPRECATOR` | `StandardId.deprecator` (still registered as `Rails.application.deprecators[:standard_id]`). |
+
+Assigning a removed setting now raises `StandardId::ConfigurationError` **at boot**, with the replacement in the message (`StandardId.config.oauth.client_id was removed in StandardId 0.43: …`), rather than the generic "Unknown field" — and, for the two base-scope senders written through the top-level config, rather than being silently stored and ignored. Reading `StandardId.config.passwordless_email_sender` still returns `nil`, so a host spec asserting it is unset (fundbright-web's `spec/lib/otp_delivery_spec.rb`) keeps passing. A scope still using `profile_type:` raises at boot too (`ScopeConfig.validate_all!`, run by the engine): ignoring the key would have left the scope with no profile requirement at all.
+
+`ignored_columns` for `ClientApplication#refresh_token_lifetime` is **kept**. All five apps have merged the column-drop migration, but it only runs with each app's next production deploy, and ignoring an absent column is harmless. It goes in a later minor.
+
+`ostruct` was already dropped from the runtime dependencies in 0.42 (nothing in `app/` or `lib/` uses `OpenStruct`); it stays a development dependency for the specs.
+
+### Changed
+
+- **`StandardId::Otp.issue(delivery: :custom)` no longer needs a sender callback.** It hard-required `passwordless_email_sender` / `passwordless_sms_sender` (raising `ConfigurationError` without one) even after 0.42 deprecated them. It now publishes `PASSWORDLESS_CODE_GENERATED` like the other modes, with `delivery: :custom` in the payload; the engine's `PasswordlessDeliverySubscriber` skips such events even when `c.passwordless.delivery` is `:built_in`, so the host's own subscriber is the only one that delivers. Nothing is sent unless the host subscribes. The YARD docs and README table, which still said `:custom` "calls `passwordless_email_sender`", are fixed.
+- **`PASSWORDLESS_CODE_GENERATED` payload gains `delivery:`** — the `Otp.issue` mode (`:built_in` / `:custom` / `:manual`), `nil` when the code was not issued through `Otp.issue` (sign-in). `skip_sender` is unchanged.
+- **WebEngine `verify_email` / `verify_phone` start actions issue their code through `Otp.issue`** (realm `"verification"`, 10-minute expiry as before), so delivery goes through the event — the built-in mailer under `delivery: :built_in`, the host subscriber otherwise. They used to call the sender callbacks directly and sent nothing without them. They now also get the strategy's format validation, `username_validator`, retry-delay cooldown and previous-code invalidation; a rejected target renders 422.
+- The passwordless strategies no longer have a `sender_callback`.
+
+### Added
+
+- **`StandardId::CleanupAllJob`** runs the four cleanup jobs inline — one recurring entry, so the schedule can carry one cron monitor (the gem's jobs carry none). A failure in one does not skip the rest; the first error is re-raised afterwards so the run still fails its check-in. Subclass it to attach a Sentry cron monitor — README *Scheduled Maintenance* has the snippet. This is jumpdrive-web's `StandardIdCleanupJob`, upstreamed: jumpdrive-web can make its job a subclass (keeping its monitor); the other four apps can collapse their four entries into one if they want a monitor.
+- **`ConfigSchema::Scope#assigned?(field)`** — true only when the host assigned the field (even to `nil`). `key?` is true for every declared field, since defaults are written at config build, so it could not tell a provider field set in the initializer from one falling back to ENV.
+- **`ConfigSchema::Scope#refresh_defaults!`** re-resolves the default of every unassigned field — including provider ENV fallbacks, which are otherwise read once at boot.
+- **`StandardId::Testing::ConfigHelpers#with_provider_env`** (`require "standard_id/testing"`; also `StandardId::Testing.with_provider_env`): sets ENV variables, re-resolves unassigned fields, runs the block and restores both, so a host can test "set `APPLE_CLIENT_ID` → provider enabled". The provider round-trip helper now restores a never-assigned field via `assigned?`.
+- `ConfigSchema` DSL `removed :name, "hint"` for settings taken out of the schema.
+
+### Documentation
+
+- README Sentry span snippet: `finish` now guards `set_span(parent)` (`Scope#set_span` raises `ArgumentError` on `nil`) and says why a missing parent means no span.
+- README: ENV-fallback resolution timing, `assigned?` and `with_provider_env`; the passwordless-delivery section shows the `skip_sender` guard and every payload key.
+- `docs/MIGRATION_GUIDE.md`: a 0.42 → 0.43 section.
+
 ## [0.42.0] - 2026-09-24
 
 ### Upgrade

data/README.md

@@ -299,6 +299,30 @@ Assign a field only to read it from somewhere else — a differently named
 variable, Rails credentials. An explicit assignment, even of `nil`, always wins
 over the ENV fallback.
 
+The fallback is resolved **once, when the config is built at boot** — setting
+`ENV` later (in a spec, say) changes nothing by itself. Two helpers (0.43+):
+
+- `StandardId.config.social.assigned?(:apple_client_id)` is true only when the
+  host assigned the field. (`key?` is true for every declared field, assigned or
+  not, because defaults are written into the scope at build time.)
+- In specs, `with_provider_env` (from `require "standard_id/testing"`) sets the
+  variables, re-resolves every unassigned field, runs the block and restores
+  both — so "set the env var → provider enabled" is testable:
+
+  ```ruby
+  RSpec.describe "Apple sign-in" do
+    include StandardId::Testing::ConfigHelpers
+
+    it "turns on with APPLE_CLIENT_ID" do
+      with_provider_env("APPLE_CLIENT_ID" => "com.example.web") do
+        expect(StandardId.social_provider_enabled?(:apple)).to be(true)
+      end
+    end
+  end
+  ```
+
+  A field your initializer assigns explicitly ignores ENV, inside the helper too.
+
 ```ruby
 StandardId.configure do |config|
   # Only needed when not using the canonical ENV names above:
@@ -518,6 +542,7 @@ Subscribe to the `PASSWORDLESS_CODE_GENERATED` event to deliver OTP codes:
 ```ruby
 # config/initializers/standard_id_events.rb
 StandardId::Events.subscribe(StandardId::Events::PASSWORDLESS_CODE_GENERATED) do |event|
+  next if event[:skip_sender] # Otp.issue(delivery: :manual) — the caller delivers
   case event[:channel]
   when "email"
     UserMailer.send_code(event[:identifier], event[:code_challenge].code).deliver_now
@@ -527,13 +552,21 @@ StandardId::Events.subscribe(StandardId::Events::PASSWORDLESS_CODE_GENERATED) do
 end
 ```
 
+Set `c.passwordless.delivery = :custom` (the default) so the engine's built-in
+`PasswordlessMailer` stays out of the way; with `:built_in` the engine emails
+the code itself. The subscriber runs synchronously inside the request, so
+`I18n.locale`, `Current.*` and the like are still available.
+
 Event payload includes:
 - `channel` - `"email"` or `"sms"`
 - `identifier` - The email address or phone number
 - `code_challenge` - The code challenge object with `.code` method
 - `expires_at` - When the code expires
+- `realm` - The OTP realm (`"authentication"` for sign-in)
+- `skip_sender` - `true` for `Otp.issue(delivery: :manual)`; don't deliver
+- `delivery` - The `Otp.issue` delivery mode (`:built_in` / `:custom` / `:manual`), `nil` otherwise
 
-> **Note**: If you're using the deprecated `passwordless_email_sender` or `passwordless_sms_sender` callbacks, see the [Migration Guide](docs/MIGRATION_GUIDE.md) for upgrade instructions.
+> **Note**: `passwordless_email_sender` / `passwordless_sms_sender` were removed in 0.43; see the [Migration Guide](docs/MIGRATION_GUIDE.md).
 
 ### Using OTP for non-authentication flows
 
@@ -575,9 +608,9 @@ end
 
 | Mode        | Behavior                                                                 |
 |-------------|--------------------------------------------------------------------------|
-| `:built_in` | Uses the engine's bundled `PasswordlessMailer` (email only).             |
-| `:custom`   | Invokes `passwordless_email_sender` / `passwordless_sms_sender` callback.|
-| `:manual`   | Skips delivery; returns the raw `code` on the result for caller to deliver. |
+| `:built_in` (default) | Follows `c.passwordless.delivery`: the engine's `PasswordlessMailer` (email only) when that is `:built_in`, otherwise your `PASSWORDLESS_CODE_GENERATED` subscriber. |
+| `:custom`   | Your `PASSWORDLESS_CODE_GENERATED` subscriber delivers (payload `delivery: :custom`); the engine mailer never does, even under a global `:built_in`. Nothing is sent unless you subscribe. |
+| `:manual`   | Skips delivery (payload `skip_sender: true`); returns the raw `code` on the result for the caller to deliver. |
 
 **Realm isolation.** `realm:` is a free-form string that partitions challenges by purpose. A code issued for realm `"widget_contact_verification"` cannot be used to verify against realm `"authentication"` (or any other realm) — even for the same `target`. Choose a stable string per flow.
 
@@ -795,6 +828,7 @@ module StandardIdSentrySpans
   def self.start(name, _id, payload)
     scope = Sentry.get_current_scope
     parent = scope&.get_span
+    # No transaction in progress (a job, a console) → no parent → no span.
     span = parent&.start_child(
       op: "standard_id.#{name.delete_suffix('.standard_id')}",
       description: Array(payload[:audience]).join(", ").presence
@@ -808,7 +842,10 @@ module StandardIdSentrySpans
     return unless span
 
     span.finish
-    Sentry.get_current_scope.set_span(parent)
+    # Restore the parent. Guarded: Scope#set_span raises ArgumentError on nil,
+    # and the current scope may have changed since #start.
+    scope = Sentry.get_current_scope
+    scope.set_span(parent) if scope && parent
   end
 end
 
@@ -1350,7 +1387,8 @@ end
 | `rescue_to_oauth_error(message_prefix = nil) { ... }` | Lets `StandardId::OAuthError` through; wraps anything else in one, keeping `cause` |
 
 A plugin using `env:`, `required:` or these helpers should depend on
-`standard_id >= 0.42`. `Providers::Base.setup` was removed in 0.42 — do
+`standard_id >= 0.42`. `Providers::Base.setup` is no longer called (removed
+from the base class in 0.42; the call-with-a-warning shim went in 0.43) — do
 one-off initialization in your own Railtie instead.
 
 **Testing a plugin, or an app that uses one:**
@@ -1482,6 +1520,23 @@ Retention is bounded by the grace windows, not the cadence; each job is a single
     schedule: every hour at minute 13
 ```
 
+**One entry, one cron monitor (0.43+).** `StandardId::CleanupAllJob` runs all four inline; a failure in one does not skip the rest, and the first error is re-raised afterwards so the run still fails. Schedule it instead of the four when you want a single recurring entry — e.g. to put the schedule under one Sentry cron monitor (the gem's jobs carry none). Subclass it to attach the monitor:
+
+```ruby
+# app/jobs/standard_id_cleanup_job.rb
+class StandardIdCleanupJob < StandardId::CleanupAllJob
+  include Sentry::Cron::MonitorCheckIns
+  sentry_monitor_check_ins slug: "standard-id-cleanup",
+    monitor_config: Sentry::Cron::MonitorConfig.from_crontab("7 * * * *", checkin_margin: 5, max_runtime: 10)
+end
+```
+
+```yaml
+  standard_id_cleanup:
+    class: StandardIdCleanupJob
+    schedule: every hour at minute 7
+```
+
 Rake wrappers (`standard_id:cleanup:all`, `:sessions`, `:refresh_tokens`, `:authorization_codes`, `:code_challenges`) run the same jobs inline. See [docs/OPERATIONS.md](docs/OPERATIONS.md) for sidekiq-cron, whenever and system-cron examples.
 
 ## Contributing

data/app/controllers/concerns/standard_id/rate_limit_handling.rb

@@ -41,29 +41,15 @@ module StandardId
       end
     end
 
-    # Resolve the effective per-IP login rate limit, preferring the
-    # mechanism-agnostic `login_per_ip` alias and falling back to the deprecated
-    # `password_login_per_ip` when the host left the alias at its default (i.e.
-    # only configured the old name). The new alias wins whenever explicitly set.
-    # Mirrors the max_attempts -> max_attempts_per_challenge deprecation-alias
-    # precedent (prefer-new, fall-back-to-old).
+    # Effective per-IP login rate limit (`rate_limits.login_per_ip`). The
+    # deprecated `password_login_per_ip` fallback was removed in 0.43.
     def self.login_per_ip
-      resolve_login_alias(:login_per_ip, :password_login_per_ip)
+      StandardId.config.rate_limits.login_per_ip
     end
 
-    # Effective per-email login rate limit; see .login_per_ip.
+    # Effective per-email login rate limit (`rate_limits.login_per_email`).
     def self.login_per_email
-      resolve_login_alias(:login_per_email, :password_login_per_email)
-    end
-
-    # Return the alias value unless it still equals its schema default, in which
-    # case fall back to the deprecated field. Both fields share the same default,
-    # so the effective default is unchanged when neither is set.
-    def self.resolve_login_alias(new_field, old_field)
-      rate_limits = StandardId.config.rate_limits
-      default = StandardId.config.__schema__.field_for(:rate_limits, new_field).default_value
-      new_value = rate_limits[new_field]
-      new_value == default ? rate_limits[old_field] : new_value
+      StandardId.config.rate_limits.login_per_email
     end
 
     private

data/app/controllers/standard_id/web/login_controller.rb

@@ -11,8 +11,7 @@ module StandardId
       layout "public"
 
       # RAR-51: Rate limit login attempts by IP (20 per 15 minutes). Reads the
-      # mechanism-agnostic `login_per_ip` alias, falling back to the deprecated
-      # `password_login_per_ip` — this action branches password OR passwordless,
+      # mechanism-agnostic `login_per_ip` — this action branches password OR passwordless,
       # so on a passwordless app this governs the OTP-send limit, not a password
       # login. See StandardId::RateLimitHandling.login_per_ip.
       rate_limit to: StandardId::RateLimitHandling.login_per_ip,

data/app/controllers/standard_id/web/verify_email/start_controller.rb

@@ -35,17 +35,21 @@ module StandardId
             render plain: "missing email", status: :unprocessable_content and return
           end
 
-          challenge = StandardId::CodeChallenge.create!(
+          # Issued through the passwordless strategy (validation, retry delay,
+          # previous-code invalidation) so delivery goes through the
+          # PASSWORDLESS_CODE_GENERATED event like every other OTP. Before 0.43
+          # this called the since-removed passwordless_email_sender directly.
+          result = StandardId::Otp.issue(
             realm: "verification",
-            channel: "email",
             target: email,
-            code: StandardId::Passwordless.generate_otp_code,
-            expires_at: 10.minutes.from_now,
-            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
-            user_agent: request.user_agent
+            channel: :email,
+            request: request,
+            expires_in: 10.minutes
           )
-
-          StandardId.config.passwordless_email_sender&.call(email, challenge.code)
+          unless result.success?
+            flash[:alert] = result.error_message
+            render plain: "invalid email", status: :unprocessable_content and return
+          end
 
           redirect_to standard_id_web.login_path, notice: "Verification code sent to your email", status: :see_other
         end

data/app/controllers/standard_id/web/verify_phone/start_controller.rb

@@ -35,17 +35,21 @@ module StandardId
             render plain: "invalid phone", status: :unprocessable_content and return
           end
 
-          challenge = StandardId::CodeChallenge.create!(
+          # Issued through the passwordless strategy (validation, retry delay,
+          # previous-code invalidation) so delivery goes through the
+          # PASSWORDLESS_CODE_GENERATED event like every other OTP. Before 0.43
+          # this called the since-removed passwordless_sms_sender directly.
+          result = StandardId::Otp.issue(
             realm: "verification",
-            channel: "sms",
             target: phone,
-            code: StandardId::Passwordless.generate_otp_code,
-            expires_at: 10.minutes.from_now,
-            ip_address: StandardId::Utils::IpNormalizer.normalize(request.remote_ip),
-            user_agent: request.user_agent
+            channel: :sms,
+            request: request,
+            expires_in: 10.minutes
           )
-
-          StandardId.config.passwordless_sms_sender&.call(phone, challenge.code)
+          unless result.success?
+            flash[:alert] = result.error_message
+            render plain: "invalid phone", status: :unprocessable_content and return
+          end
 
           redirect_to standard_id_web.login_path, notice: "Verification code sent via SMS", status: :see_other
         end

data/app/jobs/standard_id/cleanup_all_job.rb

@@ -0,0 +1,46 @@
+module StandardId
+  # Runs all four expired-row cleanup jobs inline, in one job.
+  #
+  # Schedule this ONE job instead of the four individual ones when you want a
+  # single recurring entry — typically so the schedule carries one cron
+  # monitor (Sentry, Honeybadger, …) rather than four. Subclass it in the host
+  # to attach the monitor:
+  #
+  #   # app/jobs/standard_id_cleanup_job.rb
+  #   class StandardIdCleanupJob < StandardId::CleanupAllJob
+  #     include Sentry::Cron::MonitorCheckIns
+  #     sentry_monitor_check_ins slug: "standard-id-cleanup",
+  #       monitor_config: Sentry::Cron::MonitorConfig.from_crontab("7 * * * *")
+  #   end
+  #
+  # One table's DELETE failing (a lock timeout, say) does not skip the others;
+  # the first error is re-raised once all four have run, so the run still
+  # fails its cron check-in and lands in the queue's failed executions.
+  #
+  # Each job keeps its default grace windows (see README "Scheduled
+  # Maintenance"); retention is bounded by those, not by the cadence.
+  class CleanupAllJob < ApplicationJob
+    queue_as :default
+
+    # @return [Array<Class>] the cleanup jobs run, in order
+    def self.jobs
+      [
+        StandardId::CleanupExpiredSessionsJob,
+        StandardId::CleanupExpiredRefreshTokensJob,
+        StandardId::CleanupExpiredAuthorizationCodesJob,
+        StandardId::CleanupExpiredCodeChallengesJob
+      ]
+    end
+
+    def perform
+      errors = self.class.jobs.filter_map do |job|
+        job.perform_now
+        nil
+      rescue StandardError => e
+        Rails.logger.warn("[StandardId] #{job.name} failed: #{e.class}: #{e.message}")
+        e
+      end
+      raise errors.first if errors.any?
+    end
+  end
+end

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -253,10 +253,10 @@ StandardId.configure do |c|
   #   Account.create!(email: identifier.value)
   # }
 
-  # c.passwordless_email_sender / c.passwordless_sms_sender are DEPRECATED
-  # (assigning them emits a StandardId deprecation warning). Deliver codes from
-  # an event subscriber instead — it runs synchronously in the request, so
-  # I18n.locale etc. are still available:
+  # With c.passwordless.delivery = :custom, deliver codes from an event
+  # subscriber (c.passwordless_email_sender / _sms_sender were removed in
+  # 0.43). It runs synchronously in the request, so I18n.locale etc. are still
+  # available. The same subscriber delivers Otp.issue(delivery: :custom) codes.
   #
   # StandardId::Events.subscribe(StandardId::Events::PASSWORDLESS_CODE_GENERATED) do |event|
   #   next if event[:skip_sender] # Otp.issue(delivery: :manual)
@@ -510,8 +510,7 @@ StandardId.configure do |c|
 
   # Login limits. The login action branches password OR passwordless, so on a
   # passwordless app these govern the OTP-SEND limit. Prefer the
-  # mechanism-agnostic names; the old password_login_per_ip/_per_email names
-  # still work but emit a deprecation warning (the new name wins when both are set).
+  # mechanism-agnostic names (password_login_per_ip/_per_email were removed in 0.43).
   # c.rate_limits.login_per_ip                   = 20  # per 15 minutes
   # c.rate_limits.login_per_email                = 5   # per 15 minutes
   # c.rate_limits.otp_verify_per_ip              = 20  # per 15 minutes

data/lib/standard_id/config/schema.rb

@@ -9,11 +9,12 @@ StandardId::ConfigSchema.define do
     field :cache_store, type: :any, default: nil
     field :logger, type: :any, default: nil
     field :web_layout, type: :string, default: nil
-    # Deprecated since 0.1.7 (see docs/MIGRATION_GUIDE.md), still honoured.
-    field :passwordless_email_sender, type: :any, default: nil,
-      deprecated: "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber instead (it runs synchronously in the request, so I18n.locale is still available; skip it when event[:skip_sender] is true) and call Otp.issue with its default delivery: :built_in. Removal in v2.0; see docs/MIGRATION_GUIDE.md."
-    field :passwordless_sms_sender, type: :any, default: nil,
-      deprecated: "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber instead (it runs synchronously in the request, so I18n.locale is still available; skip it when event[:skip_sender] is true) and call Otp.issue with its default delivery: :built_in. Removal in v2.0; see docs/MIGRATION_GUIDE.md."
+    # Removed in 0.43 (deprecated since 0.1.7): assigning either raises
+    # StandardId::ConfigurationError with this hint.
+    removed :passwordless_email_sender,
+      "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber (it runs synchronously in the request, so I18n.locale is still available; skip it when event[:skip_sender] is true) and set c.passwordless.delivery = :custom. See docs/MIGRATION_GUIDE.md."
+    removed :passwordless_sms_sender,
+      "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber (skip it when event[:skip_sender] is true). See docs/MIGRATION_GUIDE.md."
     field :issuer, type: :string, default: nil
 
     # Whether `JwtService.decode` REQUIRES a matching `iss` claim.
@@ -72,9 +73,8 @@ StandardId::ConfigSchema.define do
     # Scope-aware authentication: maps scope names to profile-based access config.
     # Each scope is a hash with keys: :profile_types (Array<String>), :after_sign_in_path,
     # :no_profile_message, :label, :allow_registration, :authorizer.
-    # The legacy :profile_type (singular String) key is still accepted for backward
-    # compatibility and coerced into a single-element :profile_types array (deprecation
-    # warning fires on use).
+    # The legacy :profile_type (singular) key was removed in 0.43; a scope that still
+    # sets it raises StandardId::ConfigurationError at boot.
     field :scopes, type: :any, default: {}
 
     # Callable that resolves the active scope name for a given request/session.
@@ -153,11 +153,8 @@ StandardId::ConfigSchema.define do
   end
 
   scope :passwordless do
-    # Deprecated since 0.8: use web.passwordless_login to control WebEngine
-    # passwordless login. Never read; retained so host initializers that set it
-    # still boot.
-    field :enabled, type: :boolean, default: false,
-      deprecated: "it has had no effect since 0.8. Use web.passwordless_login (WebEngine) instead, and remove this line. Removal in v2.0."
+    # Removed in 0.43 (no effect since 0.8).
+    removed :enabled, "it had no effect since 0.8. Use web.passwordless_login (WebEngine) instead, and delete this line."
     field :connection, type: :string, default: "email"
     field :code_ttl, type: :integer, default: 600 # 10 minutes in seconds
 
@@ -312,12 +309,10 @@ StandardId::ConfigSchema.define do
     # RefreshTokenFlow::MAX_REUSE_LEEWAY_SECONDS.
     field :refresh_token_reuse_leeway, type: :integer, default: 0
     field :token_lifetimes, type: :hash, default: -> { {} }
-    # Never read by the gem. OAuth clients are StandardId::ClientApplication
-    # rows with ClientSecretCredential secrets.
-    field :client_id, type: :string, default: nil,
-      deprecated: "it is not read anywhere — OAuth clients are StandardId::ClientApplication records. Remove this line. Removal in v2.0."
-    field :client_secret, type: :string, default: nil,
-      deprecated: "it is not read anywhere — client secrets are StandardId::ClientSecretCredential records. Remove this line. Removal in v2.0."
+    # Removed in 0.43 — never read by the gem. OAuth clients are
+    # StandardId::ClientApplication rows with ClientSecretCredential secrets.
+    removed :client_id, "it was never read — OAuth clients are StandardId::ClientApplication records. Delete this line."
+    removed :client_secret, "it was never read — client secrets are StandardId::ClientSecretCredential records. Delete this line."
     field :scope_claims, type: :hash, default: -> { {} }
     field :claim_resolvers, type: :hash, default: -> { {} }
     # List of audience values that tokens issued and accepted by this app may
@@ -601,17 +596,9 @@ StandardId::ConfigSchema.define do
     field :login_per_ip, type: :integer, default: 20                 # per 15 minutes
     field :login_per_email, type: :integer, default: 5               # per 15 minutes
 
-    # Deprecated mechanism-specific names, retained for backwards compatibility.
-    # The schema raises ConfigurationError on unknown fields at boot, so these
-    # must NOT be removed while hosts still set them. When a host leaves the
-    # `login_per_*` alias at its default, the login controller falls back to
-    # these values (see StandardId::RateLimitHandling.login_per_ip). New name
-    # wins when explicitly set. Mirrors the max_attempts ->
-    # max_attempts_per_challenge deprecation-alias precedent.
-    field :password_login_per_ip, type: :integer, default: 20, # per 15 minutes; deprecated alias of login_per_ip
-      deprecated: "use rate_limits.login_per_ip (same meaning; it also governs passwordless OTP sends). Removal in v2.0."
-    field :password_login_per_email, type: :integer, default: 5, # per 15 minutes; deprecated alias of login_per_email
-      deprecated: "use rate_limits.login_per_email (same meaning; it also governs passwordless OTP sends). Removal in v2.0."
+    # Removed in 0.43: the mechanism-specific names of login_per_ip / login_per_email.
+    removed :password_login_per_ip, "use rate_limits.login_per_ip (same meaning; it also governs passwordless OTP sends)."
+    removed :password_login_per_email, "use rate_limits.login_per_email (same meaning; it also governs passwordless OTP sends)."
 
     # RAR-60: OTP verification
     field :otp_verify_per_ip, type: :integer, default: 20            # per 15 minutes
@@ -630,7 +617,7 @@ StandardId::ConfigSchema.define do
     field :signup_per_ip, type: :integer, default: 10                    # per hour
 
     # API OTP-initiation limits — the API counterpart of the web *login* limits
-    # (login_per_* / the deprecated password_login_*): the API passwordless
+    # (login_per_*): the API passwordless
     # `start` action and the web login action both drive the passwordless
     # `start!` strategy. NOT the counterpart of verification_start_*
     # (email/phone verification), which bypasses the strategy via a direct

data/lib/standard_id/config_schema.rb

@@ -28,7 +28,11 @@ module StandardId
       def build = instance.apply(Config.new)
     end
 
-    def initialize = @scopes = Concurrent::Map.new
+    def initialize
+      @scopes = Concurrent::Map.new
+      @removed = Concurrent::Map.new
+    end
+
     def scopes = @scopes
     def scope?(name) = @scopes.key?(name.to_sym)
     def field?(scope_name, field_name) = !!@scopes[scope_name.to_sym]&.key?(field_name.to_sym)
@@ -44,6 +48,18 @@ module StandardId
       fields.compute_if_absent(name.to_sym) { Field.new(name.to_sym, type, default, deprecated) }
     end
 
+    # Record a field that has been REMOVED from the schema. Assigning it raises
+    # StandardId::ConfigurationError carrying +message+ (what to do instead),
+    # rather than the generic "Unknown field" — or, for a base-scope field
+    # assigned through the top-level config, rather than being silently
+    # stored on the top-level OrderedOptions and ignored.
+    def add_removed_field(scope:, name:, message:)
+      @removed[[scope.to_sym, name.to_sym]] = message
+    end
+
+    # @return [String, nil] the removal hint for a removed field, else nil
+    def removed_field_message(scope_name, field_name) = @removed[[scope_name.to_sym, field_name.to_sym]]
+
     # Register a scope without adding a field. Allows `define { scope :foo }` so
     # provider gems can later `add_field(scope: :foo, ...)` against an existing scope.
     def ensure_scope(name)
@@ -107,6 +123,10 @@ module StandardId
       def field(name, type: :string, default: nil, deprecated: nil, **)
         @schema.add_field(scope: @scope_name, name: name, type: type, default: default, deprecated: deprecated)
       end
+
+      def removed(name, message)
+        @schema.add_removed_field(scope: @scope_name, name: name, message: message)
+      end
     end
 
     # Per-scope OrderedOptions. Validates writes, casts and dups Array/Hash values
@@ -127,9 +147,45 @@ module StandardId
       def []=(key, value)
         validate!(key)
         warn_if_deprecated(key, value)
+        assigned_keys << key.to_sym
         super(key.to_sym, value)
       end
 
+      # Whether the host explicitly assigned +key+ (even to nil).
+      #
+      # Unlike #key?, which is also true for every field whose schema default
+      # was written when the config was built (so it is true for a provider
+      # field the host never touched), this is only true after an assignment.
+      #
+      # @param key [Symbol, String]
+      # @return [Boolean]
+      def assigned?(key) = assigned_keys.include?(key.to_sym)
+
+      # Deleting a key also forgets that it was assigned, so reads fall back
+      # to the (live) schema default again.
+      def delete(key)
+        assigned_keys.delete(key.to_sym)
+        super(key.to_sym)
+      end
+
+      # Re-evaluate the schema default of every field the host never assigned.
+      #
+      # Defaults are resolved once, when the config is built — including the
+      # ENV fallback of provider fields (`GOOGLE_CLIENT_ID` etc.). Call this
+      # after changing ENV to make unassigned fields pick the new value up;
+      # explicitly assigned fields are left alone. Meant for tests — see
+      # StandardId::Testing.with_provider_env.
+      #
+      # @return [self]
+      def refresh_defaults!
+        @schema.scopes[@scope_name]&.each_value do |field|
+          next if assigned?(field.name)
+
+          RAW_SET.bind_call(self, field.name, field.default_value)
+        end
+        self
+      end
+
       def [](key)
         sym = key.to_sym
         validate!(sym) unless key?(sym) || resolver
@@ -153,8 +209,14 @@ module StandardId
 
       private
 
+      def assigned_keys = (@assigned_keys ||= Set.new)
+
       def validate!(key)
         return if @schema.field?(@scope_name, key)
+        if (message = @schema.removed_field_message(@scope_name, key))
+          raise StandardId::ConfigurationError,
+            "StandardId.config.#{config_path(key)} was removed in StandardId 0.43: #{message}"
+        end
         raise StandardId::ConfigurationError,
           "Unknown field '#{key}' for scope '#{@scope_name}'. Valid fields: #{@schema.scopes[@scope_name]&.keys}"
       end
@@ -215,6 +277,9 @@ module StandardId
         sym = key.to_sym
         if __schema__ && !__schema__.scope?(sym) && !key?(sym) && (target = unique_scope_for(sym))
           self[target][sym] = value
+        elsif __schema__ && (message = __schema__.removed_field_message(:base, sym))
+          raise StandardId::ConfigurationError,
+            "StandardId.config.#{sym} was removed in StandardId 0.43: #{message}"
         else
           super(sym, value)
         end

data/lib/standard_id/engine.rb

@@ -97,6 +97,7 @@ module StandardId
       # surfaces typos at boot instead of at callback time in production.
       StandardId::Config::CallableValidator.validate!
       StandardId::Config::ScopeClaimsValidator.validate!
+      StandardId::ScopeConfig.validate_all!
 
       StandardId::Engine.verify_host_cookie_encryption!(app)
       StandardId::MigrationCheck.verify_at_boot!

data/lib/standard_id/events/subscribers/passwordless_delivery_subscriber.rb

@@ -11,6 +11,9 @@ module StandardId
           # challenges, etc.) and would otherwise receive a duplicate email
           # from this subscriber when c.passwordless.delivery == :built_in.
           return if event[:skip_sender]
+          # Otp.issue(delivery: :custom): the host's own subscriber delivers
+          # this code, even where the engine mailer is the global default.
+          return if event[:delivery]&.to_sym == :custom
           return unless built_in_delivery?
           return unless event[:channel] == "email"
 

data/lib/standard_id/otp.rb

@@ -44,15 +44,24 @@ module StandardId
   #
   # == Delivery modes
   #
-  # * +:built_in+ — uses the engine's bundled mailer
-  #   (+StandardId::PasswordlessMailer+) when
-  #   +StandardId.config.passwordless.delivery+ is +:built_in+. Works for
-  #   +channel: :email+ only.
-  # * +:custom+ — calls the configured +passwordless_email_sender+ or
-  #   +passwordless_sms_sender+ callback.
-  # * +:manual+ — skip delivery entirely; the raw +code+ is returned on the
-  #   result so the caller can deliver it however they like. Useful for
-  #   custom widget/embedded flows that want full control over the channel.
+  # Every mode publishes +StandardId::Events::PASSWORDLESS_CODE_GENERATED+
+  # (synchronously, inside the call); the payload carries +delivery:+ and
+  # +skip_sender:+ so subscribers can tell the modes apart.
+  #
+  # * +:built_in+ (default) — follow the global
+  #   +StandardId.config.passwordless.delivery+: when that is +:built_in+ the
+  #   engine's +PasswordlessMailer+ sends the code (+channel: :email+ only);
+  #   otherwise the host's own +PASSWORDLESS_CODE_GENERATED+ subscriber does.
+  # * +:custom+ — the host's +PASSWORDLESS_CODE_GENERATED+ subscriber delivers
+  #   this code; the engine mailer never does, even when the global setting is
+  #   +:built_in+. Use it for a realm whose message differs from the sign-in
+  #   email. Nothing is sent unless the host subscribes. (Before 0.43 this
+  #   called +passwordless_email_sender+ / +passwordless_sms_sender+, both
+  #   removed in 0.43.)
+  # * +:manual+ — no subscriber should deliver (+skip_sender: true+); the raw
+  #   +code+ is returned on the result so the caller can deliver it however
+  #   they like. Useful for custom widget/embedded flows that want full
+  #   control over the channel.
   module Otp
     VALID_CHANNELS  = %w[email sms].freeze
     VALID_DELIVERIES = %i[built_in custom manual].freeze
@@ -112,13 +121,6 @@ module StandardId
           return failure_issue_result(:invalid_request, "target: is required")
         end
 
-        # Fail loud when the caller asked for :custom delivery but has not
-        # configured the corresponding sender callback. Without this guard
-        # BaseStrategy#start! would silently skip delivery (the sender_callback
-        # is nil and `&.call` no-ops) while Otp.issue still returned a success
-        # result — making host apps believe the OTP was sent when it was not.
-        assert_custom_sender_configured!(channel_s) if delivery_sym == :custom
-
         strategy = build_strategy(channel_s, request, realm: realm_s)
 
         begin
@@ -127,7 +129,8 @@ module StandardId
             code_length: code_length,
             expires_in: normalize_expires_in(expires_in),
             metadata: metadata,
-            skip_sender: delivery_sym == :manual
+            skip_sender: delivery_sym == :manual,
+            delivery: delivery_sym
           )
         rescue StandardId::InvalidRequestError => e
           # Validation failures from the strategy (invalid email/phone format,
@@ -226,17 +229,6 @@ module StandardId
           error_message: error_message
         )
       end
-
-      def assert_custom_sender_configured!(channel)
-        attr = channel == "email" ? :passwordless_email_sender : :passwordless_sms_sender
-        sender = StandardId.config.public_send(attr)
-        return if sender.respond_to?(:call)
-
-        raise StandardId::ConfigurationError,
-          "Otp.issue(delivery: :custom) requires StandardId.config.#{attr} to be a callable " \
-          "(got #{sender.inspect}). Configure it in an initializer, or use delivery: :built_in " \
-          "to let the engine's event subscriber deliver, or delivery: :manual to receive the raw code."
-      end
     end
 
     # Minimal stand-in used when no request is available (e.g. jobs, tests).

data/lib/standard_id/passwordless/base_strategy.rb

@@ -12,14 +12,23 @@ module StandardId
         raise NotImplementedError
       end
 
-      # Start flow: validate recipient, create challenge, and trigger sender
-      # attrs: { connection:, username:, code_length:, expires_in:, metadata:, skip_sender: }
+      # Start flow: validate recipient, create challenge, and publish
+      # PASSWORDLESS_CODE_GENERATED — delivery happens in a subscriber to that
+      # event (the engine's PasswordlessDeliverySubscriber when
+      # c.passwordless.delivery == :built_in, otherwise the host's own).
+      #
+      # attrs: { connection:, username:, code_length:, expires_in:, metadata:, skip_sender:, delivery: }
+      #
+      # +delivery+ (:built_in / :custom / :manual, or nil when not called via
+      # StandardId::Otp.issue) is forwarded in the event payload; see
+      # Otp.issue for what each value means to the subscribers.
       def start!(attrs)
         username = attrs[:username]
         code_length = attrs[:code_length]
         expires_in = attrs[:expires_in]
         metadata = attrs[:metadata] || {}
         skip_sender = attrs[:skip_sender] == true
+        delivery = attrs[:delivery]&.to_sym
 
         validate_username!(username)
         run_username_validator!(username)
@@ -33,11 +42,10 @@ module StandardId
         )
         # skip_sender is forwarded into the event payload so subscribers that
         # deliver on PASSWORDLESS_CODE_GENERATED (e.g. PasswordlessDeliverySubscriber)
-        # can honor a per-call manual-delivery request — not just the legacy
-        # sender_callback. Without this, Otp.issue(delivery: :manual) silently
-        # double-delivers when c.passwordless.delivery == :built_in.
-        emit_code_generated(challenge, username, skip_sender: skip_sender)
-        sender_callback&.call(username, challenge.code) unless skip_sender
+        # can honor a per-call manual-delivery request. Without this,
+        # Otp.issue(delivery: :manual) silently double-delivers when
+        # c.passwordless.delivery == :built_in.
+        emit_code_generated(challenge, username, skip_sender: skip_sender, delivery: delivery)
         emit_code_sent(username) unless skip_sender
         challenge
       end
@@ -156,11 +164,6 @@ module StandardId
         raise NotImplementedError
       end
 
-      def sender_callback
-        # Implement in subclasses
-        nil
-      end
-
       private
 
       # Extract request parameters safely. Returns an empty hash if the request
@@ -187,7 +190,7 @@ module StandardId
         )
       end
 
-      def emit_code_generated(challenge, username, skip_sender: false)
+      def emit_code_generated(challenge, username, skip_sender: false, delivery: nil)
         StandardId::Events.publish(
           StandardId::Events::PASSWORDLESS_CODE_GENERATED,
           code_challenge: challenge,
@@ -195,7 +198,8 @@ module StandardId
           channel: connection_type,
           realm: @realm,
           expires_at: challenge.expires_at,
-          skip_sender: skip_sender
+          skip_sender: skip_sender,
+          delivery: delivery
         )
       end
 

data/lib/standard_id/passwordless/email_strategy.rb

@@ -20,11 +20,6 @@ module StandardId
         identifier = StandardId::EmailIdentifier.includes(:account).find_by(value: normalized)
         identifier&.account
       end
-
-      def sender_callback
-        return nil if StandardId.config.passwordless.delivery == :built_in
-        StandardId.config.passwordless_email_sender
-      end
     end
   end
 end

data/lib/standard_id/passwordless/sms_strategy.rb

@@ -25,10 +25,6 @@ module StandardId
         identifier = StandardId::PhoneNumberIdentifier.includes(:account).find_by(value: phone_number)
         identifier&.account
       end
-
-      def sender_callback
-        StandardId.config.passwordless_sms_sender
-      end
     end
   end
 end

data/lib/standard_id/provider_registry.rb

@@ -9,11 +9,6 @@ module StandardId
     # StandardId (see Providers::Base) rather than to ConfigSchema.
     PROVIDER_FIELD_OPTIONS = %i[env required].freeze
 
-    # The gem-wide StandardId.deprecator (registered in
-    # Rails.application.deprecators), kept as a constant for existing callers.
-    # The Base.setup message names its own removal version (1.0).
-    DEPRECATOR = StandardId.deprecator
-
     @providers = Concurrent::Map.new
 
     class << self
@@ -28,7 +23,6 @@ module StandardId
         validate_provider!(provider_class)
         providers[name.to_s] = provider_class
         declare_config_schema(provider_class)
-        run_deprecated_setup(provider_class)
         provider_class
       end
 
@@ -53,9 +47,8 @@ module StandardId
       # populated before any initializer runs.
       #
       # Only FIELD DECLARATION moves earlier. Full `register` — which also runs
-      # `validate_provider!` and the provider's `setup` — deliberately stays in
-      # `after_initialize`, where the host's configuration is complete and
-      # `setup` can rely on it.
+      # `validate_provider!` — deliberately stays in `after_initialize`, where
+      # the host's configuration is complete.
       #
       # Idempotent: `ConfigSchema#add_field` uses `compute_if_absent`, so a field
       # already declared here is untouched when the plugin later calls `register`.
@@ -207,20 +200,6 @@ module StandardId
         end
       end
 
-      # Providers::Base.setup was removed in 0.42: no known plugin overrode
-      # it, and register — its only caller — runs from after_initialize, where
-      # a plugin's own Railtie can do the same work. A provider that still
-      # defines `setup` keeps working, with a deprecation warning.
-      def run_deprecated_setup(provider_class)
-        return unless provider_class.respond_to?(:setup)
-
-        DEPRECATOR.warn(
-          "#{provider_class.name || provider_class}.setup is deprecated and will not be called " \
-          "by StandardId 1.0. Move provider initialization into the plugin's Railtie."
-        )
-        provider_class.setup
-      end
-
       def production?
         defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
       end

data/lib/standard_id/scope_config.rb

@@ -24,35 +24,35 @@ module StandardId
                 :allow_registration,
                 :authorizer
 
-    # Kept as an alias for hosts/specs that reference it; it is the gem-wide
-    # StandardId.deprecator, registered in Rails.application.deprecators.
-    DEPRECATOR = StandardId.deprecator
-
     # Normalize profile-type inputs from config.
     #
-    # Accepts:
-    #   - :profile_types (plural) — array of strings (preferred).
-    #   - :profile_type  (singular) — single string, retained for back-compat. Emits a
-    #     deprecation warning when present.
+    # Accepts :profile_types — an Array of profile-type class names (a single
+    # String is wrapped). The singular :profile_type key was removed in 0.43
+    # (deprecated in 0.42) and now raises: silently ignoring it would leave the
+    # scope with NO profile requirement, admitting every account.
     #
-    # Returns an Array<String> (possibly empty).
+    # @return [Array<String>] possibly empty
+    # @raise [StandardId::ConfigurationError] when the removed :profile_type key is present
     def self.extract_profile_types(config)
-      plural = config[:profile_types]
-      singular = config[:profile_type]
-
-      if singular && plural
-        raise ArgumentError, "Scope config cannot set both :profile_type and :profile_types — use :profile_types"
+      if config.key?(:profile_type) || config.key?("profile_type")
+        raise StandardId::ConfigurationError,
+          "StandardId scope config key :profile_type was removed in StandardId 0.43. " \
+          "Use profile_types: [...] (an Array of profile-type class names) instead."
       end
 
-      if singular
-        DEPRECATOR.warn(
-          "StandardId scope config key :profile_type is deprecated and will be removed in v2.0. " \
-            "Use :profile_types (an Array of profile-type strings) instead."
-        )
-        return Array(singular).map(&:to_s).reject(&:blank?)
-      end
+      Array(config[:profile_types]).map(&:to_s).reject(&:blank?)
+    end
+
+    # Build every scope in StandardId.config.scopes once, so a scope config the
+    # gem can no longer read (e.g. the removed :profile_type key) fails at boot
+    # rather than on the first sign-in under that scope. Run by the engine.
+    #
+    # @return [void]
+    # @raise [StandardId::ConfigurationError]
+    def self.validate_all!(scopes = StandardId.config.scopes)
+      return if scopes.blank?
 
-      Array(plural).map(&:to_s).reject(&:blank?)
+      scopes.each { |name, scope_hash| new(name, scope_hash || {}) }
     end
 
     def initialize(name, config = {})

data/lib/standard_id/testing/config_helpers.rb

@@ -0,0 +1,55 @@
+module StandardId
+  module Testing
+    # Helpers for specs that exercise StandardId configuration defaults —
+    # chiefly the ENV fallback of provider fields (`GOOGLE_CLIENT_ID`,
+    # `APPLE_CLIENT_ID`, …).
+    #
+    # Those defaults are resolved ONCE, when the config is built at boot, so
+    # setting ENV inside a spec changes nothing on its own. `with_provider_env`
+    # sets the variables, re-resolves every field the host never assigned, runs
+    # the block, then restores both:
+    #
+    #   RSpec.describe "Apple sign-in" do
+    #     include StandardId::Testing::ConfigHelpers
+    #
+    #     it "is enabled once APPLE_CLIENT_ID is set" do
+    #       with_provider_env("APPLE_CLIENT_ID" => "com.example.web") do
+    #         expect(StandardId.social_provider_enabled?(:apple)).to be(true)
+    #       end
+    #     end
+    #   end
+    #
+    # (also callable as `StandardId::Testing.with_provider_env(...)`).
+    #
+    # A field the host assigned explicitly — even to nil — ignores ENV by
+    # design; `StandardId.config.social.assigned?(:apple_client_id)` tells the
+    # two cases apart (`key?` is true for every declared field, assigned or
+    # not).
+    module ConfigHelpers
+      # @param env [Hash{String => String, nil}] variables to set; nil unsets.
+      #   Usually passed brace-less (`with_provider_env("APPLE_CLIENT_ID" => "x")`),
+      #   which Ruby delivers as keywords — hence **vars.
+      # @param scope [Symbol] config scope whose defaults to re-resolve
+      # @yield with the variables set and the scope's defaults re-resolved
+      # @return [Object] the block's value
+      def with_provider_env(env = {}, scope: :social, **vars)
+        env = env.merge(vars)
+        previous = env.to_h { |name, _| [name.to_s, ENV[name.to_s]] }
+        env.each { |name, value| write_env(name.to_s, value) }
+        StandardId.config[scope].refresh_defaults!
+        yield
+      ensure
+        previous&.each { |name, value| write_env(name, value) }
+        StandardId.config[scope].refresh_defaults!
+      end
+
+      private
+
+      def write_env(name, value)
+        value.nil? ? ENV.delete(name) : ENV[name] = value.to_s
+      end
+    end
+
+    extend ConfigHelpers
+  end
+end

data/lib/standard_id/testing/provider_examples.rb

@@ -60,7 +60,7 @@ module StandardId
       # fallback keeps working for later examples.
       def round_trip(field, value)
         social = StandardId.config.social
-        assigned = social.key?(field.to_sym)
+        assigned = social.assigned?(field)
         original = social.to_h[field.to_sym]
         social.public_send(:"#{field}=", value)
         social.public_send(field)

data/lib/standard_id/testing.rb

@@ -1,5 +1,6 @@
 require "standard_id/testing/authentication_helpers"
 require "standard_id/testing/request_helpers"
+require "standard_id/testing/config_helpers"
 require "standard_id/testing/provider_examples" if defined?(RSpec)
 
 module StandardId

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.42.0"
+  VERSION = "0.43.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.42.0
+  version: 0.43.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -166,6 +166,7 @@ files:
 - app/forms/standard_id/web/signup_form.rb
 - app/helpers/standard_id/application_helper.rb
 - app/jobs/standard_id/application_job.rb
+- app/jobs/standard_id/cleanup_all_job.rb
 - app/jobs/standard_id/cleanup_expired_authorization_codes_job.rb
 - app/jobs/standard_id/cleanup_expired_code_challenges_job.rb
 - app/jobs/standard_id/cleanup_expired_refresh_tokens_job.rb
@@ -303,6 +304,7 @@ files:
 - lib/standard_id/session_type_resolver.rb
 - lib/standard_id/testing.rb
 - lib/standard_id/testing/authentication_helpers.rb
+- lib/standard_id/testing/config_helpers.rb
 - lib/standard_id/testing/factories/credentials.rb
 - lib/standard_id/testing/factories/identifiers.rb
 - lib/standard_id/testing/factories/oauth.rb