standard_id 0.42.0 → 0.43.1

data/lib/standard_id/config/schema.rb

@@ -9,11 +9,12 @@ StandardId::ConfigSchema.define do
     field :cache_store, type: :any, default: nil
     field :logger, type: :any, default: nil
     field :web_layout, type: :string, default: nil
-    # Deprecated since 0.1.7 (see docs/MIGRATION_GUIDE.md), still honoured.
-    field :passwordless_email_sender, type: :any, default: nil,
-      deprecated: "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber instead (it runs synchronously in the request, so I18n.locale is still available; skip it when event[:skip_sender] is true) and call Otp.issue with its default delivery: :built_in. Removal in v2.0; see docs/MIGRATION_GUIDE.md."
-    field :passwordless_sms_sender, type: :any, default: nil,
-      deprecated: "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber instead (it runs synchronously in the request, so I18n.locale is still available; skip it when event[:skip_sender] is true) and call Otp.issue with its default delivery: :built_in. Removal in v2.0; see docs/MIGRATION_GUIDE.md."
+    # Removed in 0.43 (deprecated since 0.1.7): assigning either raises
+    # StandardId::ConfigurationError with this hint.
+    removed :passwordless_email_sender,
+      "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber (it runs synchronously in the request, so I18n.locale is still available; skip it when event[:skip_sender] is true) and set c.passwordless.delivery = :custom. See docs/MIGRATION_GUIDE.md."
+    removed :passwordless_sms_sender,
+      "deliver the code from a StandardId::Events::PASSWORDLESS_CODE_GENERATED subscriber (skip it when event[:skip_sender] is true). See docs/MIGRATION_GUIDE.md."
     field :issuer, type: :string, default: nil
 
     # Whether `JwtService.decode` REQUIRES a matching `iss` claim.
@@ -72,9 +73,8 @@ StandardId::ConfigSchema.define do
     # Scope-aware authentication: maps scope names to profile-based access config.
     # Each scope is a hash with keys: :profile_types (Array<String>), :after_sign_in_path,
     # :no_profile_message, :label, :allow_registration, :authorizer.
-    # The legacy :profile_type (singular String) key is still accepted for backward
-    # compatibility and coerced into a single-element :profile_types array (deprecation
-    # warning fires on use).
+    # The legacy :profile_type (singular) key was removed in 0.43; a scope that still
+    # sets it raises StandardId::ConfigurationError at boot.
     field :scopes, type: :any, default: {}
 
     # Callable that resolves the active scope name for a given request/session.
@@ -153,11 +153,8 @@ StandardId::ConfigSchema.define do
   end
 
   scope :passwordless do
-    # Deprecated since 0.8: use web.passwordless_login to control WebEngine
-    # passwordless login. Never read; retained so host initializers that set it
-    # still boot.
-    field :enabled, type: :boolean, default: false,
-      deprecated: "it has had no effect since 0.8. Use web.passwordless_login (WebEngine) instead, and remove this line. Removal in v2.0."
+    # Removed in 0.43 (no effect since 0.8).
+    removed :enabled, "it had no effect since 0.8. Use web.passwordless_login (WebEngine) instead, and delete this line."
     field :connection, type: :string, default: "email"
     field :code_ttl, type: :integer, default: 600 # 10 minutes in seconds
 
@@ -312,12 +309,10 @@ StandardId::ConfigSchema.define do
     # RefreshTokenFlow::MAX_REUSE_LEEWAY_SECONDS.
     field :refresh_token_reuse_leeway, type: :integer, default: 0
     field :token_lifetimes, type: :hash, default: -> { {} }
-    # Never read by the gem. OAuth clients are StandardId::ClientApplication
-    # rows with ClientSecretCredential secrets.
-    field :client_id, type: :string, default: nil,
-      deprecated: "it is not read anywhere — OAuth clients are StandardId::ClientApplication records. Remove this line. Removal in v2.0."
-    field :client_secret, type: :string, default: nil,
-      deprecated: "it is not read anywhere — client secrets are StandardId::ClientSecretCredential records. Remove this line. Removal in v2.0."
+    # Removed in 0.43 — never read by the gem. OAuth clients are
+    # StandardId::ClientApplication rows with ClientSecretCredential secrets.
+    removed :client_id, "it was never read — OAuth clients are StandardId::ClientApplication records. Delete this line."
+    removed :client_secret, "it was never read — client secrets are StandardId::ClientSecretCredential records. Delete this line."
     field :scope_claims, type: :hash, default: -> { {} }
     field :claim_resolvers, type: :hash, default: -> { {} }
     # List of audience values that tokens issued and accepted by this app may
@@ -601,17 +596,9 @@ StandardId::ConfigSchema.define do
     field :login_per_ip, type: :integer, default: 20                 # per 15 minutes
     field :login_per_email, type: :integer, default: 5               # per 15 minutes
 
-    # Deprecated mechanism-specific names, retained for backwards compatibility.
-    # The schema raises ConfigurationError on unknown fields at boot, so these
-    # must NOT be removed while hosts still set them. When a host leaves the
-    # `login_per_*` alias at its default, the login controller falls back to
-    # these values (see StandardId::RateLimitHandling.login_per_ip). New name
-    # wins when explicitly set. Mirrors the max_attempts ->
-    # max_attempts_per_challenge deprecation-alias precedent.
-    field :password_login_per_ip, type: :integer, default: 20, # per 15 minutes; deprecated alias of login_per_ip
-      deprecated: "use rate_limits.login_per_ip (same meaning; it also governs passwordless OTP sends). Removal in v2.0."
-    field :password_login_per_email, type: :integer, default: 5, # per 15 minutes; deprecated alias of login_per_email
-      deprecated: "use rate_limits.login_per_email (same meaning; it also governs passwordless OTP sends). Removal in v2.0."
+    # Removed in 0.43: the mechanism-specific names of login_per_ip / login_per_email.
+    removed :password_login_per_ip, "use rate_limits.login_per_ip (same meaning; it also governs passwordless OTP sends)."
+    removed :password_login_per_email, "use rate_limits.login_per_email (same meaning; it also governs passwordless OTP sends)."
 
     # RAR-60: OTP verification
     field :otp_verify_per_ip, type: :integer, default: 20            # per 15 minutes
@@ -630,7 +617,7 @@ StandardId::ConfigSchema.define do
     field :signup_per_ip, type: :integer, default: 10                    # per hour
 
     # API OTP-initiation limits — the API counterpart of the web *login* limits
-    # (login_per_* / the deprecated password_login_*): the API passwordless
+    # (login_per_*): the API passwordless
     # `start` action and the web login action both drive the passwordless
     # `start!` strategy. NOT the counterpart of verification_start_*
     # (email/phone verification), which bypasses the strategy via a direct

data/lib/standard_id/config_schema.rb

@@ -28,7 +28,11 @@ module StandardId
       def build = instance.apply(Config.new)
     end
 
-    def initialize = @scopes = Concurrent::Map.new
+    def initialize
+      @scopes = Concurrent::Map.new
+      @removed = Concurrent::Map.new
+    end
+
     def scopes = @scopes
     def scope?(name) = @scopes.key?(name.to_sym)
     def field?(scope_name, field_name) = !!@scopes[scope_name.to_sym]&.key?(field_name.to_sym)
@@ -44,6 +48,18 @@ module StandardId
       fields.compute_if_absent(name.to_sym) { Field.new(name.to_sym, type, default, deprecated) }
     end
 
+    # Record a field that has been REMOVED from the schema. Assigning it raises
+    # StandardId::ConfigurationError carrying +message+ (what to do instead),
+    # rather than the generic "Unknown field" — or, for a base-scope field
+    # assigned through the top-level config, rather than being silently
+    # stored on the top-level OrderedOptions and ignored.
+    def add_removed_field(scope:, name:, message:)
+      @removed[[scope.to_sym, name.to_sym]] = message
+    end
+
+    # @return [String, nil] the removal hint for a removed field, else nil
+    def removed_field_message(scope_name, field_name) = @removed[[scope_name.to_sym, field_name.to_sym]]
+
     # Register a scope without adding a field. Allows `define { scope :foo }` so
     # provider gems can later `add_field(scope: :foo, ...)` against an existing scope.
     def ensure_scope(name)
@@ -107,6 +123,10 @@ module StandardId
       def field(name, type: :string, default: nil, deprecated: nil, **)
         @schema.add_field(scope: @scope_name, name: name, type: type, default: default, deprecated: deprecated)
       end
+
+      def removed(name, message)
+        @schema.add_removed_field(scope: @scope_name, name: name, message: message)
+      end
     end
 
     # Per-scope OrderedOptions. Validates writes, casts and dups Array/Hash values
@@ -127,9 +147,45 @@ module StandardId
       def []=(key, value)
         validate!(key)
         warn_if_deprecated(key, value)
+        assigned_keys << key.to_sym
         super(key.to_sym, value)
       end
 
+      # Whether the host explicitly assigned +key+ (even to nil).
+      #
+      # Unlike #key?, which is also true for every field whose schema default
+      # was written when the config was built (so it is true for a provider
+      # field the host never touched), this is only true after an assignment.
+      #
+      # @param key [Symbol, String]
+      # @return [Boolean]
+      def assigned?(key) = assigned_keys.include?(key.to_sym)
+
+      # Deleting a key also forgets that it was assigned, so reads fall back
+      # to the (live) schema default again.
+      def delete(key)
+        assigned_keys.delete(key.to_sym)
+        super(key.to_sym)
+      end
+
+      # Re-evaluate the schema default of every field the host never assigned.
+      #
+      # Defaults are resolved once, when the config is built — including the
+      # ENV fallback of provider fields (`GOOGLE_CLIENT_ID` etc.). Call this
+      # after changing ENV to make unassigned fields pick the new value up;
+      # explicitly assigned fields are left alone. Meant for tests — see
+      # StandardId::Testing.with_provider_env.
+      #
+      # @return [self]
+      def refresh_defaults!
+        @schema.scopes[@scope_name]&.each_value do |field|
+          next if assigned?(field.name)
+
+          RAW_SET.bind_call(self, field.name, field.default_value)
+        end
+        self
+      end
+
       def [](key)
         sym = key.to_sym
         validate!(sym) unless key?(sym) || resolver
@@ -153,8 +209,14 @@ module StandardId
 
       private
 
+      def assigned_keys = (@assigned_keys ||= Set.new)
+
       def validate!(key)
         return if @schema.field?(@scope_name, key)
+        if (message = @schema.removed_field_message(@scope_name, key))
+          raise StandardId::ConfigurationError,
+            "StandardId.config.#{config_path(key)} was removed in StandardId 0.43: #{message}"
+        end
         raise StandardId::ConfigurationError,
           "Unknown field '#{key}' for scope '#{@scope_name}'. Valid fields: #{@schema.scopes[@scope_name]&.keys}"
       end
@@ -215,6 +277,9 @@ module StandardId
         sym = key.to_sym
         if __schema__ && !__schema__.scope?(sym) && !key?(sym) && (target = unique_scope_for(sym))
           self[target][sym] = value
+        elsif __schema__ && (message = __schema__.removed_field_message(:base, sym))
+          raise StandardId::ConfigurationError,
+            "StandardId.config.#{sym} was removed in StandardId 0.43: #{message}"
         else
           super(sym, value)
         end

data/lib/standard_id/engine.rb

@@ -97,6 +97,7 @@ module StandardId
       # surfaces typos at boot instead of at callback time in production.
       StandardId::Config::CallableValidator.validate!
       StandardId::Config::ScopeClaimsValidator.validate!
+      StandardId::ScopeConfig.validate_all!
 
       StandardId::Engine.verify_host_cookie_encryption!(app)
       StandardId::MigrationCheck.verify_at_boot!

data/lib/standard_id/events/subscribers/passwordless_delivery_subscriber.rb

@@ -1,28 +1,56 @@
 module StandardId
   module Events
     module Subscribers
+      # Built-in OTP email delivery (`c.passwordless.delivery = :built_in`).
+      #
+      # Sign-in codes (realm "authentication") get PasswordlessMailer#otp_email;
+      # every other realm — WebEngine email verification, Otp.issue step-up /
+      # contact verification — gets #verification_email, so a verification code
+      # never arrives as "your sign-in code". There is no built-in SMS delivery.
+      #
+      # On a successful enqueue it marks the code challenge
+      # (CodeChallenge#built_in_delivered), which is how the strategy knows to
+      # report PASSWORDLESS_CODE_SENT as "sent" rather than "failed".
       class PasswordlessDeliverySubscriber < Base
         subscribe_to StandardId::Events::PASSWORDLESS_CODE_GENERATED
 
+        # Whether the built-in mailer is responsible for delivering this
+        # PASSWORDLESS_CODE_GENERATED payload.
+        #
+        # @param payload [Hash] event payload (symbol or string keys)
+        # @return [Boolean]
+        def self.handles?(payload)
+          payload = payload.with_indifferent_access
+          # Per-call manual delivery (Otp.issue(delivery: :manual)) and
+          # Otp.issue(delivery: :custom) leave delivery to the caller / host
+          # subscriber, even when the engine mailer is the global default.
+          return false if payload[:skip_sender]
+          return false if payload[:delivery]&.to_sym == :custom
+
+          StandardId.config.passwordless.delivery == :built_in && payload[:channel].to_s == "email"
+        end
+
         def call(event)
-          # Per-call manual-delivery request takes precedence over the global
-          # delivery config. Honors Otp.issue(delivery: :manual) callers who
-          # deliver the code themselves (custom widget flows, step-up
-          # challenges, etc.) and would otherwise receive a duplicate email
-          # from this subscriber when c.passwordless.delivery == :built_in.
-          return if event[:skip_sender]
-          return unless built_in_delivery?
-          return unless event[:channel] == "email"
+          return unless self.class.handles?(event.payload)
 
           identifier = event[:identifier]
-          code = event[:code_challenge]&.code
+          challenge = event[:code_challenge]
+          code = challenge&.code
 
           return if identifier.blank? || code.blank?
 
-          StandardId::PasswordlessMailer.with(
+          enqueued = StandardId::PasswordlessMailer.with(
             email: identifier,
-            otp_code: code
-          ).otp_email.deliver_later
+            otp_code: code,
+            realm: event[:realm],
+            expires_in_minutes: expires_in_minutes(event[:expires_at])
+          ).public_send(mailer_action(event[:realm])).deliver_later
+
+          # deliver_later returns false (without raising) when Active Job
+          # refuses the enqueue, e.g. an aborting before_enqueue callback.
+          if enqueued && challenge.respond_to?(:built_in_delivered=)
+            challenge.built_in_delivered = true
+          end
         end
 
         def handle_error(error, event)
@@ -34,8 +62,17 @@ module StandardId
 
         private
 
-        def built_in_delivery?
-          StandardId.config.passwordless.delivery == :built_in
+        def mailer_action(realm)
+          realm.blank? || realm.to_s == StandardId::Passwordless::DEFAULT_REALM ? :otp_email : :verification_email
+        end
+
+        def expires_in_minutes(expires_at)
+          return nil if expires_at.blank?
+
+          expires_at = Time.zone.parse(expires_at) if expires_at.is_a?(String)
+          [((expires_at - Time.current) / 60.0).ceil, 1].max
+        rescue ArgumentError, TypeError, NoMethodError
+          nil
         end
       end
     end

data/lib/standard_id/otp.rb

@@ -44,15 +44,24 @@ module StandardId
   #
   # == Delivery modes
   #
-  # * +:built_in+ — uses the engine's bundled mailer
-  #   (+StandardId::PasswordlessMailer+) when
-  #   +StandardId.config.passwordless.delivery+ is +:built_in+. Works for
-  #   +channel: :email+ only.
-  # * +:custom+ — calls the configured +passwordless_email_sender+ or
-  #   +passwordless_sms_sender+ callback.
-  # * +:manual+ — skip delivery entirely; the raw +code+ is returned on the
-  #   result so the caller can deliver it however they like. Useful for
-  #   custom widget/embedded flows that want full control over the channel.
+  # Every mode publishes +StandardId::Events::PASSWORDLESS_CODE_GENERATED+
+  # (synchronously, inside the call); the payload carries +delivery:+ and
+  # +skip_sender:+ so subscribers can tell the modes apart.
+  #
+  # * +:built_in+ (default) — follow the global
+  #   +StandardId.config.passwordless.delivery+: when that is +:built_in+ the
+  #   engine's +PasswordlessMailer+ sends the code (+channel: :email+ only);
+  #   otherwise the host's own +PASSWORDLESS_CODE_GENERATED+ subscriber does.
+  # * +:custom+ — the host's +PASSWORDLESS_CODE_GENERATED+ subscriber delivers
+  #   this code; the engine mailer never does, even when the global setting is
+  #   +:built_in+. Use it for a realm whose message differs from the sign-in
+  #   email. Nothing is sent unless the host subscribes. (Before 0.43 this
+  #   called +passwordless_email_sender+ / +passwordless_sms_sender+, both
+  #   removed in 0.43.)
+  # * +:manual+ — no subscriber should deliver (+skip_sender: true+); the raw
+  #   +code+ is returned on the result so the caller can deliver it however
+  #   they like. Useful for custom widget/embedded flows that want full
+  #   control over the channel.
   module Otp
     VALID_CHANNELS  = %w[email sms].freeze
     VALID_DELIVERIES = %i[built_in custom manual].freeze
@@ -112,13 +121,6 @@ module StandardId
           return failure_issue_result(:invalid_request, "target: is required")
         end
 
-        # Fail loud when the caller asked for :custom delivery but has not
-        # configured the corresponding sender callback. Without this guard
-        # BaseStrategy#start! would silently skip delivery (the sender_callback
-        # is nil and `&.call` no-ops) while Otp.issue still returned a success
-        # result — making host apps believe the OTP was sent when it was not.
-        assert_custom_sender_configured!(channel_s) if delivery_sym == :custom
-
         strategy = build_strategy(channel_s, request, realm: realm_s)
 
         begin
@@ -127,7 +129,8 @@ module StandardId
             code_length: code_length,
             expires_in: normalize_expires_in(expires_in),
             metadata: metadata,
-            skip_sender: delivery_sym == :manual
+            skip_sender: delivery_sym == :manual,
+            delivery: delivery_sym
           )
         rescue StandardId::InvalidRequestError => e
           # Validation failures from the strategy (invalid email/phone format,
@@ -226,17 +229,6 @@ module StandardId
           error_message: error_message
         )
       end
-
-      def assert_custom_sender_configured!(channel)
-        attr = channel == "email" ? :passwordless_email_sender : :passwordless_sms_sender
-        sender = StandardId.config.public_send(attr)
-        return if sender.respond_to?(:call)
-
-        raise StandardId::ConfigurationError,
-          "Otp.issue(delivery: :custom) requires StandardId.config.#{attr} to be a callable " \
-          "(got #{sender.inspect}). Configure it in an initializer, or use delivery: :built_in " \
-          "to let the engine's event subscriber deliver, or delivery: :manual to receive the raw code."
-      end
     end
 
     # Minimal stand-in used when no request is available (e.g. jobs, tests).

data/lib/standard_id/passwordless/base_strategy.rb

@@ -12,14 +12,23 @@ module StandardId
         raise NotImplementedError
       end
 
-      # Start flow: validate recipient, create challenge, and trigger sender
-      # attrs: { connection:, username:, code_length:, expires_in:, metadata:, skip_sender: }
+      # Start flow: validate recipient, create challenge, and publish
+      # PASSWORDLESS_CODE_GENERATED — delivery happens in a subscriber to that
+      # event (the engine's PasswordlessDeliverySubscriber when
+      # c.passwordless.delivery == :built_in, otherwise the host's own).
+      #
+      # attrs: { connection:, username:, code_length:, expires_in:, metadata:, skip_sender:, delivery: }
+      #
+      # +delivery+ (:built_in / :custom / :manual, or nil when not called via
+      # StandardId::Otp.issue) is forwarded in the event payload; see
+      # Otp.issue for what each value means to the subscribers.
       def start!(attrs)
         username = attrs[:username]
         code_length = attrs[:code_length]
         expires_in = attrs[:expires_in]
         metadata = attrs[:metadata] || {}
         skip_sender = attrs[:skip_sender] == true
+        delivery = attrs[:delivery]&.to_sym
 
         validate_username!(username)
         run_username_validator!(username)
@@ -33,12 +42,11 @@ module StandardId
         )
         # skip_sender is forwarded into the event payload so subscribers that
         # deliver on PASSWORDLESS_CODE_GENERATED (e.g. PasswordlessDeliverySubscriber)
-        # can honor a per-call manual-delivery request — not just the legacy
-        # sender_callback. Without this, Otp.issue(delivery: :manual) silently
-        # double-delivers when c.passwordless.delivery == :built_in.
-        emit_code_generated(challenge, username, skip_sender: skip_sender)
-        sender_callback&.call(username, challenge.code) unless skip_sender
-        emit_code_sent(username) unless skip_sender
+        # can honor a per-call manual-delivery request. Without this,
+        # Otp.issue(delivery: :manual) silently double-delivers when
+        # c.passwordless.delivery == :built_in.
+        generated_payload = emit_code_generated(challenge, username, skip_sender: skip_sender, delivery: delivery)
+        emit_code_sent(username, delivery_status: delivery_status_for(challenge, generated_payload)) unless skip_sender
         challenge
       end
 
@@ -156,11 +164,6 @@ module StandardId
         raise NotImplementedError
       end
 
-      def sender_callback
-        # Implement in subclasses
-        nil
-      end
-
       private
 
       # Extract request parameters safely. Returns an empty hash if the request
@@ -187,25 +190,41 @@ module StandardId
         )
       end
 
-      def emit_code_generated(challenge, username, skip_sender: false)
-        StandardId::Events.publish(
-          StandardId::Events::PASSWORDLESS_CODE_GENERATED,
+      # @return [Hash] the published payload (used to decide the delivery status)
+      def emit_code_generated(challenge, username, skip_sender: false, delivery: nil)
+        payload = {
           code_challenge: challenge,
           identifier: username,
           channel: connection_type,
           realm: @realm,
           expires_at: challenge.expires_at,
-          skip_sender: skip_sender
-        )
+          skip_sender: skip_sender,
+          delivery: delivery
+        }
+        StandardId::Events.publish(StandardId::Events::PASSWORDLESS_CODE_GENERATED, payload)
+        payload
+      end
+
+      # delivery_status of PASSWORDLESS_CODE_SENT:
+      # - "sent"      — the built-in mailer (delivery :built_in) enqueued the email.
+      # - "failed"    — the built-in mailer was responsible but did not enqueue
+      #                 it (its error was logged by the subscriber).
+      # - "delegated" — delivery belongs to the host's PASSWORDLESS_CODE_GENERATED
+      #                 subscriber (delivery :custom, or SMS); the engine cannot
+      #                 know whether it sent anything.
+      def delivery_status_for(challenge, generated_payload)
+        return "delegated" unless StandardId::Events::Subscribers::PasswordlessDeliverySubscriber.handles?(generated_payload)
+
+        challenge.built_in_delivered ? "sent" : "failed"
       end
 
-      def emit_code_sent(username)
+      def emit_code_sent(username, delivery_status:)
         StandardId::Events.publish(
           StandardId::Events::PASSWORDLESS_CODE_SENT,
           identifier: username,
           channel: connection_type,
           realm: @realm,
-          delivery_status: "sent"
+          delivery_status: delivery_status
         )
       end
     end

data/lib/standard_id/passwordless/email_strategy.rb

@@ -20,11 +20,6 @@ module StandardId
         identifier = StandardId::EmailIdentifier.includes(:account).find_by(value: normalized)
         identifier&.account
       end
-
-      def sender_callback
-        return nil if StandardId.config.passwordless.delivery == :built_in
-        StandardId.config.passwordless_email_sender
-      end
     end
   end
 end

data/lib/standard_id/passwordless/sms_strategy.rb

@@ -25,10 +25,6 @@ module StandardId
         identifier = StandardId::PhoneNumberIdentifier.includes(:account).find_by(value: phone_number)
         identifier&.account
       end
-
-      def sender_callback
-        StandardId.config.passwordless_sms_sender
-      end
     end
   end
 end

data/lib/standard_id/provider_registry.rb

@@ -9,11 +9,6 @@ module StandardId
     # StandardId (see Providers::Base) rather than to ConfigSchema.
     PROVIDER_FIELD_OPTIONS = %i[env required].freeze
 
-    # The gem-wide StandardId.deprecator (registered in
-    # Rails.application.deprecators), kept as a constant for existing callers.
-    # The Base.setup message names its own removal version (1.0).
-    DEPRECATOR = StandardId.deprecator
-
     @providers = Concurrent::Map.new
 
     class << self
@@ -28,7 +23,6 @@ module StandardId
         validate_provider!(provider_class)
         providers[name.to_s] = provider_class
         declare_config_schema(provider_class)
-        run_deprecated_setup(provider_class)
         provider_class
       end
 
@@ -53,9 +47,8 @@ module StandardId
       # populated before any initializer runs.
       #
       # Only FIELD DECLARATION moves earlier. Full `register` — which also runs
-      # `validate_provider!` and the provider's `setup` — deliberately stays in
-      # `after_initialize`, where the host's configuration is complete and
-      # `setup` can rely on it.
+      # `validate_provider!` — deliberately stays in `after_initialize`, where
+      # the host's configuration is complete.
       #
       # Idempotent: `ConfigSchema#add_field` uses `compute_if_absent`, so a field
       # already declared here is untouched when the plugin later calls `register`.
@@ -207,20 +200,6 @@ module StandardId
         end
       end
 
-      # Providers::Base.setup was removed in 0.42: no known plugin overrode
-      # it, and register — its only caller — runs from after_initialize, where
-      # a plugin's own Railtie can do the same work. A provider that still
-      # defines `setup` keeps working, with a deprecation warning.
-      def run_deprecated_setup(provider_class)
-        return unless provider_class.respond_to?(:setup)
-
-        DEPRECATOR.warn(
-          "#{provider_class.name || provider_class}.setup is deprecated and will not be called " \
-          "by StandardId 1.0. Move provider initialization into the plugin's Railtie."
-        )
-        provider_class.setup
-      end
-
       def production?
         defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
       end

data/lib/standard_id/scope_config.rb

@@ -24,35 +24,35 @@ module StandardId
                 :allow_registration,
                 :authorizer
 
-    # Kept as an alias for hosts/specs that reference it; it is the gem-wide
-    # StandardId.deprecator, registered in Rails.application.deprecators.
-    DEPRECATOR = StandardId.deprecator
-
     # Normalize profile-type inputs from config.
     #
-    # Accepts:
-    #   - :profile_types (plural) — array of strings (preferred).
-    #   - :profile_type  (singular) — single string, retained for back-compat. Emits a
-    #     deprecation warning when present.
+    # Accepts :profile_types — an Array of profile-type class names (a single
+    # String is wrapped). The singular :profile_type key was removed in 0.43
+    # (deprecated in 0.42) and now raises: silently ignoring it would leave the
+    # scope with NO profile requirement, admitting every account.
     #
-    # Returns an Array<String> (possibly empty).
+    # @return [Array<String>] possibly empty
+    # @raise [StandardId::ConfigurationError] when the removed :profile_type key is present
     def self.extract_profile_types(config)
-      plural = config[:profile_types]
-      singular = config[:profile_type]
-
-      if singular && plural
-        raise ArgumentError, "Scope config cannot set both :profile_type and :profile_types — use :profile_types"
+      if config.key?(:profile_type) || config.key?("profile_type")
+        raise StandardId::ConfigurationError,
+          "StandardId scope config key :profile_type was removed in StandardId 0.43. " \
+          "Use profile_types: [...] (an Array of profile-type class names) instead."
       end
 
-      if singular
-        DEPRECATOR.warn(
-          "StandardId scope config key :profile_type is deprecated and will be removed in v2.0. " \
-            "Use :profile_types (an Array of profile-type strings) instead."
-        )
-        return Array(singular).map(&:to_s).reject(&:blank?)
-      end
+      Array(config[:profile_types]).map(&:to_s).reject(&:blank?)
+    end
+
+    # Build every scope in StandardId.config.scopes once, so a scope config the
+    # gem can no longer read (e.g. the removed :profile_type key) fails at boot
+    # rather than on the first sign-in under that scope. Run by the engine.
+    #
+    # @return [void]
+    # @raise [StandardId::ConfigurationError]
+    def self.validate_all!(scopes = StandardId.config.scopes)
+      return if scopes.blank?
 
-      Array(plural).map(&:to_s).reject(&:blank?)
+      scopes.each { |name, scope_hash| new(name, scope_hash || {}) }
     end
 
     def initialize(name, config = {})