standard_id 0.43.2 → 0.45.0

data/app/controllers/concerns/standard_id/social_authentication.rb

@@ -31,6 +31,27 @@ module StandardId
       provider.get_user_info(**resolved_params.compact)
     end
 
+    # Resolves the account for a social login, in this order:
+    #
+    # 1. (provider, sub) matches a StandardId::SocialIdentity → that account.
+    #    The provider's stable subject id is authoritative; the email it
+    #    reports is not consulted.
+    # 2. The email matches an existing EmailIdentifier → link to that account,
+    #    but only when
+    #      - the link_strategy allows it (validate_social_link!; under :strict a
+    #        provider that is trusted_for_linking? may link across providers
+    #        to a verified identifier),
+    #      - the identifier is not already linked to a DIFFERENT sub from this
+    #        provider (possible takeover), and
+    #      - the provider reports the email as verified. Without that, the
+    #        token proves nothing about who owns the address — under
+    #        :trust_provider, or for a pre-provider-tracking identifier, any
+    #        provider token for the address would otherwise take the account.
+    #    A successful link stores the sub, so step 1 matches next time.
+    # 3. Otherwise create a new account (unchanged) and store the sub.
+    #
+    # Each refusal raises StandardId::SocialLinkError (with a `reason`) after
+    # emitting SOCIAL_LINK_BLOCKED; a duplicate account is never created.
     def find_or_create_account_from_social(raw_social_info)
       social_info = raw_social_info.to_h.with_indifferent_access
       email = social_info[:email]
@@ -38,12 +59,22 @@ module StandardId
 
       emit_social_user_info_fetched(provider, social_info, email)
 
+      subject = social_subject(social_info)
+      social_identity = find_social_identity(subject)
+      if social_identity
+        emit_social_account_linked(social_identity.account, provider, social_identity.identifier)
+        return social_identity.account
+      end
+
       identifier = StandardId::EmailIdentifier.includes(:account).find_by(value: email)
 
       if identifier.present?
         validate_social_link!(identifier, provider)
-        identifier.update!(provider: provider.provider_name) if identifier.provider.nil?
-        emit_social_account_linked(identifier.account, provider, identifier)
+        validate_social_subject!(identifier, provider, subject)
+        validate_social_email_verified!(identifier, provider, social_info)
+        # SOCIAL_ACCOUNT_LINKED is published by commit_social_link!, once the
+        # link has been written — never for a staged link that is dropped.
+        stage_social_link!(identifier, subject, backfill_provider: identifier.provider.nil?, emit_linked: true)
         identifier.account
       else
         account = build_account_from_social(social_info)
@@ -52,7 +83,8 @@ module StandardId
           value: email,
           provider: provider.provider_name
         )
-        identifier.verify! if identifier.respond_to?(:verify!) && [true, "true"].include?(social_info[:email_verified])
+        identifier.verify! if identifier.respond_to?(:verify!) && social_email_verified?(social_info)
+        stage_social_link!(identifier, subject, backfill_provider: false)
         emit_social_account_created(account, provider, social_info)
         account
       end
@@ -68,15 +100,290 @@ module StandardId
 
       return if strategy == :trust_provider
       # nil provider means the identifier predates provider tracking — allow
-      # through since we can't retroactively determine its origin.
+      # through since we can't retroactively determine its origin. The
+      # email_verified check (validate_social_email_verified!) still applies.
       return if identifier.provider.nil?
       return if identifier.provider == provider.provider_name
       return if account_has_social_identifier_from?(identifier.account, provider)
+      return if trusted_cross_provider_link?(identifier, provider)
+
+      refuse_social_link!(identifier, provider, :link_required)
+    end
+
+    # The provider opted in via Providers::Base.trusted_for_linking? (only the
+    # org's own IdP, whose email claims the org verifies, should) AND the
+    # existing identifier's address is itself verified. This only lifts the
+    # :strict cross-provider refusal: validate_social_subject! and
+    # validate_social_email_verified! still run after it, so an unverified
+    # provider email or a different sub is refused exactly as before.
+    #
+    # The verified-identifier requirement closes pre-account hijacking: an
+    # account someone registered for an address they never proved must not
+    # be handed to the address's real owner arriving via the trusted IdP
+    # (the registrant would keep their own way in).
+    def trusted_cross_provider_link?(identifier, provider)
+      return false unless provider.respond_to?(:trusted_for_linking?)
+      return false unless provider.trusted_for_linking? == true
+
+      identifier.respond_to?(:verified?) && identifier.verified?
+    end
+
+    # The identifier is already linked to another subject from this provider:
+    # a second provider account is claiming the same address.
+    def validate_social_subject!(identifier, provider, subject)
+      return if subject.nil?
+      return unless StandardId::SocialIdentity.available?
 
-      emit_social_link_blocked(identifier, provider)
+      linked = StandardId::SocialIdentity.where(identifier_id: identifier.id, provider: provider.provider_name)
+      return unless linked.where.not(subject: subject).exists?
+
+      refuse_social_link!(identifier, provider, :subject_mismatch)
+    end
+
+    # Linking a login to an EXISTING account by email needs the provider to
+    # vouch for the address, under either link_strategy.
+    def validate_social_email_verified!(identifier, provider, social_info)
+      return if social_email_verified?(social_info)
+
+      refuse_social_link!(identifier, provider, :email_unverified)
+    end
+
+    def refuse_social_link!(identifier, provider, reason)
+      emit_social_link_blocked(identifier, provider, reason)
       raise StandardId::SocialLinkError.new(
         email: identifier.value,
-        provider_name: provider.provider_name
+        provider_name: provider.provider_name,
+        reason: reason
+      )
+    end
+
+    # The provider's stable subject id (OIDC `sub`), or nil when the provider
+    # reports none.
+    def social_subject(social_info)
+      social_info[:sub].presence&.to_s
+    end
+
+    # Strict: only boolean true or the string "true" (any case) count. Apple
+    # sends `email_verified` as the string "true"; Google's tokeninfo endpoint
+    # does too. Google's OAuth2 v2 userinfo endpoint names the claim
+    # `verified_email` (standard_id-google <= 0.5.0 passes it through as-is),
+    # so it is accepted as a fallback.
+    def social_email_verified?(social_info)
+      value = social_info.key?(:email_verified) ? social_info[:email_verified] : social_info[:verified_email]
+      value.to_s.strip.casecmp?("true")
+    end
+
+    def find_social_identity(subject)
+      return nil if subject.nil?
+      return nil unless social_identities_available?
+
+      StandardId::SocialIdentity.includes(:account, :identifier).find_by(provider: provider.provider_name, subject: subject)
+    end
+
+    # Writes the (provider, sub) row inside its own savepoint (it runs inside
+    # commit_social_link!'s transaction; on PostgreSQL a failed INSERT would
+    # otherwise abort it).
+    #
+    # Find-then-insert is spelled out rather than left to find_or_create_by!,
+    # because a concurrent login can commit a rival row at any point in it and
+    # each point surfaces differently: before the SELECT (the row is found),
+    # between the SELECT and validation (the uniqueness validations raise
+    # RecordInvalid), or between validation and the INSERT (the unique index
+    # raises RecordNotUnique; find_or_create_by! would turn an
+    # (identifier, provider) collision into RecordNotFound, and return a
+    # (provider, sub) winner for ANY account). Every one of them is classified
+    # by classify_social_link_race!.
+    def record_social_identity!(identifier, subject)
+      return if subject.nil?
+      return unless social_identities_available?
+
+      attributes = { provider: provider.provider_name, subject: subject }
+      existing = StandardId::SocialIdentity.find_by(attributes)
+      return classify_social_link_race!(identifier, subject) if existing
+
+      StandardId::SocialIdentity.transaction(requires_new: true) do
+        StandardId::SocialIdentity.create!(attributes.merge(account: identifier.account, identifier: identifier))
+      end
+    rescue ActiveRecord::RecordNotUnique
+      classify_social_link_race!(identifier, subject) || raise
+    rescue ActiveRecord::RecordInvalid => e
+      raise unless social_link_race_invalid?(e.record)
+
+      classify_social_link_race!(identifier, subject) || raise
+    end
+
+    # A RecordInvalid that is only the uniqueness validations losing a race.
+    # Anything else (a missing account, a host validation) is a real error.
+    def social_link_race_invalid?(record)
+      details = record&.errors&.details
+      return false if details.blank?
+
+      details.all? do |attribute, errors|
+        %i[subject identifier_id].include?(attribute) && errors.all? { |error| error[:error] == :taken }
+      end
+    end
+
+    # Another login has linked first. Returns the winning row when it links
+    # this (provider, sub) to the same account (adopt it); raises
+    # SocialLinkConflictError when it links this sub to ANOTHER account
+    # (:subject_conflict) or this identifier to this provider under ANOTHER
+    # sub (:subject_mismatch); returns nil when no rival is found (it was
+    # removed again), so the caller re-raises the original error.
+    def classify_social_link_race!(identifier, subject)
+      winner = StandardId::SocialIdentity.find_by(provider: provider.provider_name, subject: subject)
+      if winner
+        return winner if winner.account_id == identifier.account_id
+
+        raise StandardId::SocialLinkConflictError.new(SOCIAL_RETRY_MESSAGE, identifier: identifier, reason: :subject_conflict)
+      end
+
+      other_sub = StandardId::SocialIdentity.where(identifier_id: identifier.id, provider: provider.provider_name).where.not(subject: subject)
+      return nil unless other_sub.exists?
+
+      raise StandardId::SocialLinkConflictError.new(SOCIAL_RETRY_MESSAGE, identifier: identifier, reason: :subject_mismatch)
+    end
+
+    # The (provider, sub) link and the provider backfill are STAGED, not
+    # written, by find_or_create_account_from_social when the caller defers
+    # them (the web and API callbacks do), and written by commit_social_link!
+    # only once the login has been accepted. A rejected login therefore never
+    # writes a link, so rejecting it never has to delete one — and cannot
+    # delete a row a concurrent, successful callback for the same
+    # (provider, sub) has created or adopted in the meantime.
+    #
+    # Callers that do not defer (the default, e.g. host code calling
+    # find_or_create_account_from_social directly) get the link written
+    # immediately, as before.
+    def stage_social_link!(identifier, subject, backfill_provider:, emit_linked: false)
+      @pending_social_link = {
+        identifier: identifier,
+        subject: subject,
+        backfill_provider: backfill_provider,
+        emit_linked: emit_linked
+      }
+      commit_social_link! unless defer_social_link?
+    end
+
+    def defer_social_link?
+      false
+    end
+
+    # Writes the staged link in one transaction: the provider backfill and
+    # the (provider, sub) row land together or not at all, and the staged
+    # state is kept until they have, so a failure part-way leaves nothing to
+    # reverse. A block, when given, runs inside that transaction after the
+    # writes: work the login still has to get through for the link to stand
+    # (the web callback's redirect_to, which can raise). It runs even when
+    # nothing is staged. SOCIAL_ACCOUNT_LINKED is published only after the
+    # transaction has committed.
+    #
+    # The account row is locked first and must still exist. That serialises
+    # this commit with AccountCleanup.destroy_newly_created!, which takes the
+    # same lock: an account another, rejected request created and is now
+    # removing is never linked to (this login fails and can simply be
+    # retried, creating a fresh account), and an account this login has
+    # already signed in to is never removed under it (see AccountCleanup).
+    def commit_social_link!
+      pending = @pending_social_link
+      if pending.nil?
+        yield if block_given?
+        return
+      end
+
+      identifier = pending[:identifier]
+      begin
+        write_social_link!(pending, identifier) { yield if block_given? }
+      rescue StandardId::SocialLinkConflictError => e
+        # A concurrent login won the link (see the error's reasons).
+        # Published here, once the transaction has rolled back, so a
+        # subscriber that writes an audit row is not rolled back with the
+        # link; and only on this path, so never for a link that commits.
+        emit_social_link_blocked(identifier, provider, e.reason)
+        raise
+      end
+
+      @pending_social_link = nil
+      if pending[:backfill_provider]
+        identifier.provider = provider.provider_name
+        identifier.clear_attribute_changes([:provider]) if identifier.respond_to?(:clear_attribute_changes)
+      end
+      emit_committed_social_link(identifier, provider) if pending[:emit_linked]
+    end
+
+    # The transaction behind commit_social_link!.
+    def write_social_link!(pending, identifier)
+      ActiveRecord::Base.transaction do
+        if StandardId.account_class.lock.where(id: identifier.account_id).pick(:id).nil?
+          raise StandardId::InvalidGrantError, SOCIAL_RETRY_MESSAGE
+        end
+
+        if pending[:backfill_provider]
+          # Conditional, so a provider set concurrently is never overwritten.
+          StandardId::Identifier.where(id: identifier.id, provider: nil).update_all(provider: provider.provider_name)
+        end
+        record_social_identity!(identifier, pending[:subject])
+        yield if block_given?
+      end
+    end
+
+    # SOCIAL_ACCOUNT_LINKED reports a link that has already committed, so it
+    # cannot refuse the login: a subscriber that raises here would fail the
+    # callback while the link stays. Its error is logged and reported to
+    # Rails.error instead of propagating. (Guards belong on the events that
+    # run before anything is written.)
+    def emit_committed_social_link(identifier, provider)
+      emit_social_account_linked(identifier.account, provider, identifier)
+    rescue StandardError => e
+      Rails.logger&.error("[StandardId] SOCIAL_ACCOUNT_LINKED subscriber raised after the link committed: #{e.class}: #{e.message}")
+      Rails.error.report(e, handled: true, source: "standard_id")
+    end
+
+    # A social login that recorded a link (and maybe created an account) and
+    # was then rejected for ANY reason — policy, hook, invalid scope, audience
+    # binding, an unexpected error — must leave nothing behind: drop the link
+    # and remove an account this request created. Safe to call when nothing
+    # was recorded, and when the account is already gone.
+    def discard_social_attempt!(account, newly_created:)
+      rollback_social_link!
+      StandardId::AccountCleanup.destroy_newly_created!(account) if newly_created
+    end
+
+    # The login matched an account by email that a concurrent, refused
+    # request had created and has since removed (AccountCleanup). The login
+    # then fails part-way (its session insert hits the foreign key, or
+    # commit_social_link! finds the account gone); the callbacks report that
+    # as a retryable invalid_grant rather than a 500. A retry finds no
+    # account and creates a fresh one. Check before discard_social_attempt!,
+    # which removes an account THIS request created.
+    def social_account_removed_concurrently?(account, newly_created:)
+      return false if newly_created || account.nil? || account.id.nil?
+
+      !StandardId.account_class.where(id: account.id).exists?
+    end
+
+    SOCIAL_RETRY_MESSAGE = "The sign-in could not be completed. Please try again.".freeze
+
+    # Nothing was written for a deferred link, so dropping the staged one is
+    # the whole rollback. (A non-deferring caller has already committed it.)
+    def rollback_social_link!
+      @pending_social_link = nil
+    end
+
+    def social_identities_available?
+      return true if StandardId::SocialIdentity.available?
+
+      StandardId::SocialAuthentication.warn_social_identities_missing!
+      false
+    end
+
+    # Logged once per process when the host has not run the migration yet.
+    def self.warn_social_identities_missing!
+      return if @social_identities_missing_warned
+
+      @social_identities_missing_warned = true
+      Rails.logger&.warn(
+        "[StandardId] standard_id_social_identities is missing, so social logins are not matched on the " \
+        "provider's subject id. Run `bin/rails standard_id:install:migrations && bin/rails db:migrate`."
       )
     end
 
@@ -154,13 +461,14 @@ module StandardId
       )
     end
 
-    def emit_social_link_blocked(identifier, provider)
+    def emit_social_link_blocked(identifier, provider, reason = :link_required)
       StandardId::Events.publish(
         StandardId::Events::SOCIAL_LINK_BLOCKED,
         email: identifier.value,
         provider: provider,
         identifier: identifier,
-        account: identifier.account
+        account: identifier.account,
+        reason: reason
       )
     end
 

data/app/controllers/concerns/standard_id/web_authentication.rb

@@ -154,7 +154,12 @@ module StandardId
         # but before session creation. The block may raise AuthenticationDenied.
         before_session&.call(password_credential.account)
 
-        session_manager.sign_in_account(password_credential.account, scope_name: request.path_parameters[:scope])
+        session_manager.sign_in_account(
+          password_credential.account,
+          scope_name: request.path_parameters[:scope],
+          auth_method: :password,
+          flow: :web_password
+        )
         session_manager.set_remember_cookie(password_credential) if remember_me
 
         StandardId::Events.publish(

data/app/controllers/standard_id/api/authorization_controller.rb

@@ -19,7 +19,11 @@ module StandardId
         reject_invalid_redirect_uri!
         return redirect_to_consent if consent_required?
 
-        response_data = flow_strategy_class.new(flow_strategy_params, request, current_account: current_account).execute
+        response_data = flow_strategy_class.new(
+          flow_strategy_params, request,
+          current_account: current_account,
+          auth_lineage: StandardId::AuthLineage.from_session(authorization_session_manager.current_session)
+        ).execute
 
         if response_data[:redirect_to]
           redirect_to response_data[:redirect_to], status: response_data[:status] || :found, allow_other_host: true
@@ -150,10 +154,13 @@ module StandardId
       end
 
       def current_account
-        @current_account ||= begin
+        @current_account ||= authorization_session_manager.current_account
+      end
+
+      def authorization_session_manager
+        @authorization_session_manager ||= begin
           token_manager = StandardId::Web::TokenManager.new(request)
-          session_manager = StandardId::Web::SessionManager.new(token_manager, request: request, session: session, cookies: cookies)
-          session_manager.current_account
+          StandardId::Web::SessionManager.new(token_manager, request: request, session: session, cookies: cookies)
         end
       end
     end

data/app/controllers/standard_id/api/base_controller.rb

@@ -26,6 +26,11 @@ module StandardId
       rescue_from StandardId::AccountDeactivatedError, with: :handle_account_deactivated
       rescue_from StandardId::AccountLockedError, with: :handle_account_locked
 
+      # config.login_method_policy refused the method (token grants, social
+      # callback). Not an OAuthError — it is an AuthenticationDenied so the
+      # WebEngine's existing handling covers it — so it is mapped here.
+      rescue_from StandardId::LoginMethodDenied, with: :handle_login_method_denied
+
       protected
 
       def validate_content_type!
@@ -74,6 +79,17 @@ module StandardId
         render_bearer_unauthorized!(error_description: "The account is locked")
       end
 
+      # `403 access_denied`, the shape SocialLinkError already uses on the API
+      # callback. The policy only runs after the credential was proven, so the
+      # caller already controls it and the policy's message (e.g. "Staff must
+      # sign in with ...") tells them nothing they could not learn otherwise.
+      def handle_login_method_denied(error)
+        render json: {
+          error: error.oauth_error_code.to_s,
+          error_description: error.message
+        }, status: error.http_status
+      end
+
       def handle_oauth_error(error)
         render json: {
           error: error.oauth_error_code,

data/app/controllers/standard_id/api/oauth/callback/providers_controller.rb

@@ -23,28 +23,74 @@ module StandardId
           social_info = provider_response[:user_info]
           provider_tokens = provider_response[:tokens]
           account = find_or_create_account_from_social(social_info)
+          newly_created = account.previously_new_record?
 
-          flow = StandardId::Oauth::SocialFlow.new(
-            params,
-            request,
-            account:,
-            connection: provider.provider_name,
-            scopes: params[:scope]
-          )
+          # Everything after find_or_create_account_from_social can still
+          # reject the login: SocialFlow.new (InvalidScopeError), the grant's
+          # audience/profile binding (InvalidGrantError), the login-method
+          # policy, a SOCIAL_AUTH_COMPLETED subscriber, or anything unexpected.
+          # Any of them leaves no link (it is only written on acceptance), no
+          # new account, and no usable token or session from this request.
+          token_response = nil
+          flow = nil
+          begin
+            flow = StandardId::Oauth::SocialFlow.new(
+              params,
+              request,
+              account:,
+              connection: provider.provider_name,
+              scopes: params[:scope]
+            )
+            token_response = flow.execute
+            run_social_callback(
+              provider: provider.provider_name,
+              social_info:,
+              provider_tokens:,
+              account:,
+              original_request_params: forwarded_request_params
+            )
+            commit_social_link!
+          rescue StandardError
+            removed = social_account_removed_concurrently?(account, newly_created:)
+            revoke_issued_tokens!(flow)
+            discard_social_attempt!(account, newly_created: newly_created)
+            raise unless removed
+
+            # The matched account was removed under this login by a
+            # concurrent, refused request: retryable, not a 500.
+            raise StandardId::InvalidGrantError, SOCIAL_RETRY_MESSAGE
+          end
 
-          token_response = flow.execute
-          run_social_callback(
-            provider: provider.provider_name,
-            social_info:,
-            provider_tokens:,
-            account:,
-            original_request_params: forwarded_request_params
-          )
           render json: token_response, status: :ok
         end
 
         private
 
+        # Write the (provider, sub) link only once the login is accepted.
+        def defer_social_link?
+          true
+        end
+
+        # The response was never sent, but the grant may already have
+        # persisted a refresh token and a session — also when the grant itself
+        # raised after writing them (e.g. an OAUTH_TOKEN_ISSUED subscriber), so
+        # they are read from the flow, not from a token response. Revoke them
+        # so nothing from the rejected request stays usable, and so that
+        # AccountCleanup does not mistake them for a concurrent login using a
+        # new account. A token whose transaction rolled back is not persisted
+        # and is skipped (its session write was rolled back with it).
+        def revoke_issued_tokens!(flow)
+          record = flow&.issued_refresh_token
+          return unless record&.persisted?
+
+          # Loaded by id, not through the association: the record was built
+          # with only session_id, and a host with strict_loading_by_default
+          # would raise here and mask the original error.
+          session = record.session_id && StandardId::Session.find_by(id: record.session_id)
+          session.revoke!(reason: "social_sign_in_rejected") unless session.nil? || session.revoked?
+          record.revoke!
+        end
+
         # Mirror of the web callback's OAuthError handling: emit
         # SOCIAL_AUTH_FAILED for infrastructure-level provider failures
         # (HTTP/DNS/SSL/timeouts surfaced as OAuthError by provider

data/app/controllers/standard_id/web/auth/callback/providers_controller.rb

@@ -40,7 +40,13 @@ module StandardId
               newly_created = account.previously_new_record?
 
               invoke_before_sign_in(account, { mechanism: "social", provider: provider.provider_name })
-              session_manager.sign_in_account(account, scope_name: state_data&.dig("scope"))
+              session_manager.sign_in_account(
+                account,
+                scope_name: state_data&.dig("scope"),
+                auth_method: :social,
+                provider: provider.provider_name,
+                flow: :web_social
+              )
 
               provider_name = provider.provider_name
               invoke_after_account_created(account, { mechanism: "social", provider: provider_name }) if newly_created
@@ -68,8 +74,14 @@ module StandardId
               destination = redirect_override || (safe_destination?(caller_redirect_uri) ? caller_redirect_uri : safe_post_signin_default)
               redirect_options = { notice: "Successfully signed in with #{provider_name.humanize}" }
               redirect_options[:allow_other_host] = true if allow_other_host_redirect?(destination)
-              redirect_to destination, redirect_options
+
+              # Accepted: only now write the (provider, sub) link, in the same
+              # transaction as the redirect, which can still raise (e.g. an
+              # after_sign_in URL on a host that is not allowed). If it does,
+              # the link is rolled back with it.
+              commit_social_link! { redirect_to destination, redirect_options }
             rescue StandardId::AuthenticationDenied => e
+              rollback_social_link!
               handle_authentication_denied(e, account: account, newly_created: newly_created)
             rescue StandardId::SocialLinkError => e
               # Policy/link error — SOCIAL_LINK_BLOCKED has already been emitted
@@ -77,8 +89,23 @@ module StandardId
               # (which is reserved for infrastructure-level failures).
               redirect_to StandardId::WebEngine.routes.url_helpers.login_path(redirect_uri: state_data&.dig("redirect_uri")), alert: "Authentication failed: #{e.message}"
             rescue StandardId::OAuthError => e
-              emit_social_auth_failed(e, account: account)
+              discard_rejected_social_sign_in!(account, newly_created:)
+              # A (provider, sub) conflict with a concurrent login is a link
+              # refusal (SOCIAL_LINK_BLOCKED, already published), not an
+              # infrastructure failure.
+              emit_social_auth_failed(e, account: account) unless e.is_a?(StandardId::SocialLinkConflictError)
               redirect_to StandardId::WebEngine.routes.url_helpers.login_path(redirect_uri: state_data&.dig("redirect_uri")), alert: "Authentication failed: #{e.message}"
+            rescue StandardError => e
+              # Unexpected failure after the link/account may have been
+              # written: undo them, then let the error surface as before —
+              # unless the matched account was removed under this login by a
+              # concurrent, refused request, which is retryable.
+              removed = social_account_removed_concurrently?(account, newly_created:)
+              discard_rejected_social_sign_in!(account, newly_created:)
+              raise unless removed
+
+              emit_social_auth_failed(e, account: account)
+              redirect_to StandardId::WebEngine.routes.url_helpers.login_path(redirect_uri: state_data&.dig("redirect_uri")), alert: "Authentication failed: #{SOCIAL_RETRY_MESSAGE}"
             end
           end
 
@@ -103,6 +130,27 @@ module StandardId
 
           private
 
+          # A rejection after find_or_create_account_from_social leaves no
+          # link, no new account and no session — including one that
+          # sign_in_account created before raising (a failing SESSION_CREATED
+          # subscriber), which is why this reads session_manager.created_session
+          # rather than relying on sign_in_account having returned.
+          # AuthenticationDenied has its own path (handle_authentication_denied);
+          # SocialLinkError is raised before anything is written.
+          def discard_rejected_social_sign_in!(account, newly_created:)
+            created = session_manager.created_session
+            if created
+              created.revoke!(reason: "social_sign_in_rejected") unless created.revoked?
+              session_manager.clear_session!
+            end
+            discard_social_attempt!(account, newly_created: newly_created)
+          end
+
+          # Write the (provider, sub) link only once the login is accepted.
+          def defer_social_link?
+            true
+          end
+
           def callback_url_for
             "#{request.base_url}#{provider.callback_path}"
           end

data/app/controllers/standard_id/web/consent_controller.rb

@@ -81,7 +81,11 @@ module StandardId
         )
 
         result = StandardId::Oauth::AuthorizationCodeAuthorizationFlow
-          .new(@consent_request, request, current_account: current_account)
+          .new(
+            @consent_request, request,
+            current_account: current_account,
+            auth_lineage: StandardId::AuthLineage.from_session(current_session)
+          )
           .execute
 
         redirect_out(result[:redirect_to], status: result[:status] || :found)

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -52,7 +52,12 @@ module StandardId
 
         invoke_before_sign_in(account, { mechanism: "passwordless", provider: nil })
 
-        session_manager.sign_in_account(account, scope_name: request.path_parameters[:scope])
+        session_manager.sign_in_account(
+          account,
+          scope_name: request.path_parameters[:scope],
+          auth_method: :passwordless,
+          flow: :web_passwordless
+        )
         emit_authentication_succeeded(account)
 
         if newly_created

data/app/controllers/standard_id/web/signup_controller.rb

@@ -47,7 +47,12 @@ module StandardId
 
         if form.submit
           invoke_before_sign_in(form.account, { mechanism: "password", provider: nil })
-          session_manager.sign_in_account(form.account, scope_name: request.path_parameters[:scope])
+          session_manager.sign_in_account(
+            form.account,
+            scope_name: request.path_parameters[:scope],
+            auth_method: :password,
+            flow: :web_signup
+          )
           invoke_after_account_created(form.account, { mechanism: "signup", provider: nil })
 
           redirect_uri = string_param(:redirect_uri)