standard_id 0.44.0 → 0.46.0

data/app/controllers/concerns/standard_id/social_authentication.rb

@@ -18,19 +18,32 @@ module StandardId
       raise StandardId::InvalidRequestError, e.message
     end
 
-    def get_user_info_from_provider(redirect_uri: nil, nonce: nil, flow: :web)
+    # `callback_iss` is the callback's RFC 9207 `iss` parameter (a String
+    # only; anything else is dropped), for providers that defend against
+    # authorization-server mix-up. `code_verifier` is passed only by the web
+    # callback, from the server-held flow state, for providers that opt in to
+    # core-managed PKCE (Providers::Base.supports_pkce?). Nil values are not
+    # passed, so a provider that ignores both sees no change.
+    def get_user_info_from_provider(redirect_uri: nil, nonce: nil, code_verifier: nil, flow: :web)
       provider_params = {
         code: params[:code],
         id_token: params[:id_token],
         access_token: params[:access_token],
         redirect_uri:,
-        nonce:
+        nonce:,
+        callback_iss: callback_iss_param,
+        code_verifier:
       }
 
       resolved_params = provider.resolve_params(provider_params, context: { flow: flow })
       provider.get_user_info(**resolved_params.compact)
     end
 
+    def callback_iss_param
+      iss = params[:iss]
+      iss.is_a?(String) && iss.present? ? iss : nil
+    end
+
     # Resolves the account for a social login, in this order:
     #
     # 1. (provider, sub) matches a StandardId::SocialIdentity → that account.
@@ -38,7 +51,9 @@ module StandardId
     #    reports is not consulted.
     # 2. The email matches an existing EmailIdentifier → link to that account,
     #    but only when
-    #      - the link_strategy allows it (validate_social_link!),
+    #      - the link_strategy allows it (validate_social_link!; under :strict a
+    #        provider that is trusted_for_linking? may link across providers
+    #        to a verified identifier),
     #      - the identifier is not already linked to a DIFFERENT sub from this
     #        provider (possible takeover), and
     #      - the provider reports the email as verified. Without that, the
@@ -70,9 +85,9 @@ module StandardId
         validate_social_link!(identifier, provider)
         validate_social_subject!(identifier, provider, subject)
         validate_social_email_verified!(identifier, provider, social_info)
-        identifier.update!(provider: provider.provider_name) if identifier.provider.nil?
-        record_social_identity!(identifier, subject)
-        emit_social_account_linked(identifier.account, provider, identifier)
+        # SOCIAL_ACCOUNT_LINKED is published by commit_social_link!, once the
+        # link has been written — never for a staged link that is dropped.
+        stage_social_link!(identifier, subject, backfill_provider: identifier.provider.nil?, emit_linked: true)
         identifier.account
       else
         account = build_account_from_social(social_info)
@@ -82,7 +97,7 @@ module StandardId
           provider: provider.provider_name
         )
         identifier.verify! if identifier.respond_to?(:verify!) && social_email_verified?(social_info)
-        record_social_identity!(identifier, subject)
+        stage_social_link!(identifier, subject, backfill_provider: false)
         emit_social_account_created(account, provider, social_info)
         account
       end
@@ -103,10 +118,29 @@ module StandardId
       return if identifier.provider.nil?
       return if identifier.provider == provider.provider_name
       return if account_has_social_identifier_from?(identifier.account, provider)
+      return if trusted_cross_provider_link?(identifier, provider)
 
       refuse_social_link!(identifier, provider, :link_required)
     end
 
+    # The provider opted in via Providers::Base.trusted_for_linking? (only the
+    # org's own IdP, whose email claims the org verifies, should) AND the
+    # existing identifier's address is itself verified. This only lifts the
+    # :strict cross-provider refusal: validate_social_subject! and
+    # validate_social_email_verified! still run after it, so an unverified
+    # provider email or a different sub is refused exactly as before.
+    #
+    # The verified-identifier requirement closes pre-account hijacking: an
+    # account someone registered for an address they never proved must not
+    # be handed to the address's real owner arriving via the trusted IdP
+    # (the registrant would keep their own way in).
+    def trusted_cross_provider_link?(identifier, provider)
+      return false unless provider.respond_to?(:trusted_for_linking?)
+      return false unless provider.trusted_for_linking? == true
+
+      identifier.respond_to?(:verified?) && identifier.verified?
+    end
+
     # The identifier is already linked to another subject from this provider:
     # a second provider account is claiming the same address.
     def validate_social_subject!(identifier, provider, subject)
@@ -159,19 +193,239 @@ module StandardId
       StandardId::SocialIdentity.includes(:account, :identifier).find_by(provider: provider.provider_name, subject: subject)
     end
 
+    # Writes the (provider, sub) row inside its own savepoint (it runs inside
+    # commit_social_link!'s transaction; on PostgreSQL a failed INSERT would
+    # otherwise abort it).
+    #
+    # Find-then-insert is spelled out rather than left to find_or_create_by!,
+    # because a concurrent login can commit a rival row at any point in it and
+    # each point surfaces differently: before the SELECT (the row is found),
+    # between the SELECT and validation (the uniqueness validations raise
+    # RecordInvalid), or between validation and the INSERT (the unique index
+    # raises RecordNotUnique; find_or_create_by! would turn an
+    # (identifier, provider) collision into RecordNotFound, and return a
+    # (provider, sub) winner for ANY account). Every one of them is classified
+    # by classify_social_link_race!.
+    #
+    # A row found by the first lookup can be removed again (e.g. by a
+    # concurrent account cleanup) before classify_social_link_race! re-reads
+    # it. The (provider, sub) is then free, so the insert goes ahead: returning
+    # instead would let commit_social_link! backfill the provider and publish
+    # SOCIAL_ACCOUNT_LINKED for a link no row records.
     def record_social_identity!(identifier, subject)
       return if subject.nil?
       return unless social_identities_available?
 
-      StandardId::SocialIdentity.find_or_create_by!(
-        provider: provider.provider_name,
-        subject: subject
-      ) do |social_identity|
-        social_identity.account = identifier.account
-        social_identity.identifier = identifier
+      attributes = { provider: provider.provider_name, subject: subject }
+      if StandardId::SocialIdentity.find_by(attributes)
+        winner = classify_social_link_race!(identifier, subject)
+        return winner if winner
+      end
+
+      StandardId::SocialIdentity.transaction(requires_new: true) do
+        StandardId::SocialIdentity.create!(attributes.merge(account: identifier.account, identifier: identifier))
+      end
+    rescue ActiveRecord::RecordNotUnique
+      classify_social_link_race!(identifier, subject) || raise
+    rescue ActiveRecord::RecordInvalid => e
+      raise unless social_link_race_invalid?(e.record)
+
+      classify_social_link_race!(identifier, subject) || insert_past_stale_uniqueness!(e.record, identifier, subject)
+    end
+
+    # The uniqueness validations said `taken`, but the locking re-read in
+    # classify_social_link_race! finds no rival: the validations read a stale
+    # snapshot. Under MySQL/InnoDB REPEATABLE READ they read the transaction's
+    # snapshot, which still holds a row a concurrent cleanup has since removed
+    # (the vanished-row case above), and every later validation would say
+    # `taken` again. Every other validation passed (social_link_race_invalid?),
+    # and both uniqueness rules are backed by unique indexes, so insert once
+    # without validating and let the indexes decide; a rival that commits in
+    # the meantime surfaces as RecordNotUnique and is classified as usual.
+    def insert_past_stale_uniqueness!(record, identifier, subject)
+      StandardId::SocialIdentity.transaction(requires_new: true) { record.save!(validate: false) }
+      record
+    rescue ActiveRecord::RecordNotUnique
+      classify_social_link_race!(identifier, subject) || raise
+    end
+
+    # A RecordInvalid that is only the uniqueness validations losing a race.
+    # Anything else (a missing account, a host validation) is a real error.
+    def social_link_race_invalid?(record)
+      details = record&.errors&.details
+      return false if details.blank?
+
+      details.all? do |attribute, errors|
+        %i[subject identifier_id].include?(attribute) && errors.all? { |error| error[:error] == :taken }
+      end
+    end
+
+    # Another login has linked first. Returns the winning row when it links
+    # this (provider, sub) to the same account (adopt it); raises
+    # SocialLinkConflictError when it links this sub to ANOTHER account
+    # (:subject_conflict) or this identifier to this provider under ANOTHER
+    # sub (:subject_mismatch); returns nil when no rival is found (it was
+    # removed again), so the caller re-raises the original error.
+    #
+    # Both lookups are locking reads (SELECT ... FOR UPDATE). They run inside
+    # commit_social_link!'s transaction, and under MySQL/InnoDB's default
+    # REPEATABLE READ a plain SELECT there reads the snapshot taken by the
+    # transaction's first plain read (record_social_identity!'s own lookup),
+    # which predates the rival that just made the INSERT fail: the rival
+    # would be invisible, the race unclassified, and the login a 500 with no
+    # SOCIAL_LINK_BLOCKED. A locking read always reads the latest committed
+    # row. Under PostgreSQL's READ COMMITTED (and on SQLite, where `lock` is
+    # a no-op) a plain read already saw it; the lock only holds the rival row
+    # until this transaction ends.
+    def classify_social_link_race!(identifier, subject)
+      winner = StandardId::SocialIdentity.lock.find_by(provider: provider.provider_name, subject: subject)
+      if winner
+        return winner if winner.account_id == identifier.account_id
+
+        raise StandardId::SocialLinkConflictError.new(SOCIAL_RETRY_MESSAGE, identifier: identifier, reason: :subject_conflict)
+      end
+
+      other_sub = StandardId::SocialIdentity.where(identifier_id: identifier.id, provider: provider.provider_name).where.not(subject: subject)
+      return nil unless other_sub.lock.exists?
+
+      raise StandardId::SocialLinkConflictError.new(SOCIAL_RETRY_MESSAGE, identifier: identifier, reason: :subject_mismatch)
+    end
+
+    # The (provider, sub) link and the provider backfill are STAGED, not
+    # written, by find_or_create_account_from_social when the caller defers
+    # them (the web and API callbacks do), and written by commit_social_link!
+    # only once the login has been accepted. A rejected login therefore never
+    # writes a link, so rejecting it never has to delete one — and cannot
+    # delete a row a concurrent, successful callback for the same
+    # (provider, sub) has created or adopted in the meantime.
+    #
+    # Callers that do not defer (the default, e.g. host code calling
+    # find_or_create_account_from_social directly) get the link written
+    # immediately, as before.
+    def stage_social_link!(identifier, subject, backfill_provider:, emit_linked: false)
+      @pending_social_link = {
+        identifier: identifier,
+        subject: subject,
+        backfill_provider: backfill_provider,
+        emit_linked: emit_linked
+      }
+      commit_social_link! unless defer_social_link?
+    end
+
+    def defer_social_link?
+      false
+    end
+
+    # Writes the staged link in one transaction: the provider backfill and
+    # the (provider, sub) row land together or not at all, and the staged
+    # state is kept until they have, so a failure part-way leaves nothing to
+    # reverse. A block, when given, runs inside that transaction after the
+    # writes: work the login still has to get through for the link to stand
+    # (the web callback's redirect_to, which can raise). It runs even when
+    # nothing is staged. SOCIAL_ACCOUNT_LINKED is published only after the
+    # transaction has committed.
+    #
+    # The account row is locked first and must still exist. That serialises
+    # this commit with AccountCleanup.destroy_newly_created!, which takes the
+    # same lock: an account another, rejected request created and is now
+    # removing is never linked to (this login fails and can simply be
+    # retried, creating a fresh account), and an account this login has
+    # already signed in to is never removed under it (see AccountCleanup).
+    def commit_social_link!
+      pending = @pending_social_link
+      if pending.nil?
+        yield if block_given?
+        return
+      end
+
+      identifier = pending[:identifier]
+      begin
+        write_social_link!(pending, identifier) { yield if block_given? }
+      rescue StandardId::SocialLinkConflictError => e
+        # A concurrent login won the link (see the error's reasons).
+        # Published here, once the transaction has rolled back, so a
+        # subscriber that writes an audit row is not rolled back with the
+        # link; and only on this path, so never for a link that commits.
+        emit_social_link_blocked(identifier, provider, e.reason)
+        raise
+      end
+
+      @pending_social_link = nil
+      if pending[:backfill_provider]
+        identifier.provider = provider.provider_name
+        identifier.clear_attribute_changes([:provider]) if identifier.respond_to?(:clear_attribute_changes)
+      end
+      emit_committed_social_link(identifier, provider) if pending[:emit_linked]
+    end
+
+    # The transaction behind commit_social_link!.
+    def write_social_link!(pending, identifier)
+      ActiveRecord::Base.transaction do
+        if StandardId.account_class.lock.where(id: identifier.account_id).pick(:id).nil?
+          raise StandardId::InvalidGrantError, SOCIAL_RETRY_MESSAGE
+        end
+
+        if pending[:backfill_provider]
+          # Conditional, so a provider set concurrently is never overwritten.
+          StandardId::Identifier.where(id: identifier.id, provider: nil).update_all(provider: provider.provider_name)
+        end
+        record_social_identity!(identifier, pending[:subject])
+        yield if block_given?
+      end
+    end
+
+    # SOCIAL_ACCOUNT_LINKED reports a link that has already committed, so it
+    # cannot refuse the login: a subscriber that raises here would fail the
+    # callback while the link stays. Its error is logged and reported to
+    # Rails.error instead of propagating. (Guards belong on the events that
+    # run before anything is written.)
+    def emit_committed_social_link(identifier, provider)
+      emit_social_account_linked(identifier.account, provider, identifier)
+    rescue StandardError => e
+      Rails.logger&.error("[StandardId] SOCIAL_ACCOUNT_LINKED subscriber raised after the link committed: #{e.class}: #{e.message}")
+      Rails.error.report(e, handled: true, source: "standard_id")
+    end
+
+    # A social login that recorded a link (and maybe created an account) and
+    # was then rejected for ANY reason — policy, hook, invalid scope, audience
+    # binding, an unexpected error — must leave nothing behind: drop the link
+    # and remove an account this request created. Safe to call when nothing
+    # was recorded, and when the account is already gone.
+    #
+    # When the login matched an EXISTING account, `sessions` / `refresh_tokens`
+    # are what this request issued (and has revoked): if a concurrent, refused
+    # request kept that account only because this login had signed in to it,
+    # the account is removed after all (AccountCleanup.reclaim_for_failed_adopter!).
+    def discard_social_attempt!(account, newly_created:, sessions: [], refresh_tokens: [])
+      rollback_social_link!
+      if newly_created
+        StandardId::AccountCleanup.destroy_newly_created!(account)
+      else
+        StandardId::AccountCleanup.reclaim_for_failed_adopter!(account, sessions:, refresh_tokens:)
       end
     end
 
+    # The login matched an account by email that a concurrent, refused
+    # request had created and has since removed (AccountCleanup). The login
+    # then fails part-way (its session insert hits the foreign key, or
+    # commit_social_link! finds the account gone); the callbacks report that
+    # as a retryable invalid_grant rather than a 500. A retry finds no
+    # account and creates a fresh one. Check before discard_social_attempt!,
+    # which removes an account THIS request created.
+    def social_account_removed_concurrently?(account, newly_created:)
+      return false if newly_created || account.nil? || account.id.nil?
+
+      !StandardId.account_class.where(id: account.id).exists?
+    end
+
+    SOCIAL_RETRY_MESSAGE = "The sign-in could not be completed. Please try again.".freeze
+
+    # Nothing was written for a deferred link, so dropping the staged one is
+    # the whole rollback. (A non-deferring caller has already committed it.)
+    def rollback_social_link!
+      @pending_social_link = nil
+    end
+
     def social_identities_available?
       return true if StandardId::SocialIdentity.available?
 

data/app/controllers/concerns/standard_id/web/social_login_params.rb

@@ -8,7 +8,10 @@ module StandardId
 
       private
 
-      def store_oauth_request(state:, nonce: nil, params:)
+      # `code_verifier` is the PKCE verifier for providers that opt in with
+      # `supports_pkce?`; like the nonce it stays server-held (the cookie is
+      # encrypted) and is handed back to the provider at the callback.
+      def store_oauth_request(state:, params:, nonce: nil, code_verifier: nil)
         pending_requests = load_pending_requests || {}
 
         cleanup_expired_requests!(pending_requests)
@@ -16,6 +19,7 @@ module StandardId
         pending_requests[state] = {
           "params" => params,
           "nonce" => nonce,
+          "code_verifier" => code_verifier,
           "expires_at" => REQUEST_EXPIRY.from_now.to_i
         }
 
@@ -43,7 +47,7 @@ module StandardId
           save_pending_requests(pending_requests)
         end
 
-        request_data.slice("params", "nonce")
+        request_data.slice("params", "nonce", "code_verifier")
       rescue JSON::ParserError => e
         StandardId.logger.error({
           subject: "standard_id.consume_oauth_request.error",

data/app/controllers/concerns/standard_id/web_authentication.rb

@@ -154,7 +154,12 @@ module StandardId
         # but before session creation. The block may raise AuthenticationDenied.
         before_session&.call(password_credential.account)
 
-        session_manager.sign_in_account(password_credential.account, scope_name: request.path_parameters[:scope])
+        session_manager.sign_in_account(
+          password_credential.account,
+          scope_name: request.path_parameters[:scope],
+          auth_method: :password,
+          flow: :web_password
+        )
         session_manager.set_remember_cookie(password_credential) if remember_me
 
         StandardId::Events.publish(

data/app/controllers/standard_id/api/authorization_controller.rb

@@ -19,7 +19,11 @@ module StandardId
         reject_invalid_redirect_uri!
         return redirect_to_consent if consent_required?
 
-        response_data = flow_strategy_class.new(flow_strategy_params, request, current_account: current_account).execute
+        response_data = flow_strategy_class.new(
+          flow_strategy_params, request,
+          current_account: current_account,
+          auth_lineage: StandardId::AuthLineage.from_session(authorization_session_manager.current_session)
+        ).execute
 
         if response_data[:redirect_to]
           redirect_to response_data[:redirect_to], status: response_data[:status] || :found, allow_other_host: true
@@ -150,10 +154,13 @@ module StandardId
       end
 
       def current_account
-        @current_account ||= begin
+        @current_account ||= authorization_session_manager.current_account
+      end
+
+      def authorization_session_manager
+        @authorization_session_manager ||= begin
           token_manager = StandardId::Web::TokenManager.new(request)
-          session_manager = StandardId::Web::SessionManager.new(token_manager, request: request, session: session, cookies: cookies)
-          session_manager.current_account
+          StandardId::Web::SessionManager.new(token_manager, request: request, session: session, cookies: cookies)
         end
       end
     end

data/app/controllers/standard_id/api/base_controller.rb

@@ -26,6 +26,11 @@ module StandardId
       rescue_from StandardId::AccountDeactivatedError, with: :handle_account_deactivated
       rescue_from StandardId::AccountLockedError, with: :handle_account_locked
 
+      # config.login_method_policy refused the method (token grants, social
+      # callback). Not an OAuthError — it is an AuthenticationDenied so the
+      # WebEngine's existing handling covers it — so it is mapped here.
+      rescue_from StandardId::LoginMethodDenied, with: :handle_login_method_denied
+
       protected
 
       def validate_content_type!
@@ -74,6 +79,17 @@ module StandardId
         render_bearer_unauthorized!(error_description: "The account is locked")
       end
 
+      # `403 access_denied`, the shape SocialLinkError already uses on the API
+      # callback. The policy only runs after the credential was proven, so the
+      # caller already controls it and the policy's message (e.g. "Staff must
+      # sign in with ...") tells them nothing they could not learn otherwise.
+      def handle_login_method_denied(error)
+        render json: {
+          error: error.oauth_error_code.to_s,
+          error_description: error.message
+        }, status: error.http_status
+      end
+
       def handle_oauth_error(error)
         render json: {
           error: error.oauth_error_code,

data/app/controllers/standard_id/api/oauth/callback/providers_controller.rb

@@ -14,7 +14,7 @@ module StandardId
         # (UTM, campaign IDs, deep-link slugs) to the signing-in account.
         RESERVED_CALLBACK_PARAMS = %w[
           id_token code scope scopes audience redirect_uri flow
-          state nonce provider controller action format
+          state nonce iss provider controller action format
           authenticity_token utf8 _method
         ].freeze
 
@@ -23,28 +23,78 @@ module StandardId
           social_info = provider_response[:user_info]
           provider_tokens = provider_response[:tokens]
           account = find_or_create_account_from_social(social_info)
+          newly_created = account.previously_new_record?
 
-          flow = StandardId::Oauth::SocialFlow.new(
-            params,
-            request,
-            account:,
-            connection: provider.provider_name,
-            scopes: params[:scope]
-          )
+          # Everything after find_or_create_account_from_social can still
+          # reject the login: SocialFlow.new (InvalidScopeError), the grant's
+          # audience/profile binding (InvalidGrantError), the login-method
+          # policy, a SOCIAL_AUTH_COMPLETED subscriber, or anything unexpected.
+          # Any of them leaves no link (it is only written on acceptance), no
+          # new account, and no usable token or session from this request.
+          token_response = nil
+          flow = nil
+          begin
+            flow = StandardId::Oauth::SocialFlow.new(
+              params,
+              request,
+              account:,
+              connection: provider.provider_name,
+              scopes: params[:scope]
+            )
+            token_response = flow.execute
+            run_social_callback(
+              provider: provider.provider_name,
+              social_info:,
+              provider_tokens:,
+              account:,
+              original_request_params: forwarded_request_params
+            )
+            commit_social_link!
+          rescue StandardError
+            removed = social_account_removed_concurrently?(account, newly_created:)
+            issued = revoke_issued_tokens!(flow)
+            discard_social_attempt!(account, newly_created: newly_created, **issued)
+            raise unless removed
+
+            # The matched account was removed under this login by a
+            # concurrent, refused request: retryable, not a 500.
+            raise StandardId::InvalidGrantError, SOCIAL_RETRY_MESSAGE
+          end
 
-          token_response = flow.execute
-          run_social_callback(
-            provider: provider.provider_name,
-            social_info:,
-            provider_tokens:,
-            account:,
-            original_request_params: forwarded_request_params
-          )
           render json: token_response, status: :ok
         end
 
         private
 
+        # Write the (provider, sub) link only once the login is accepted.
+        def defer_social_link?
+          true
+        end
+
+        # The response was never sent, but the grant may already have
+        # persisted a refresh token and a session — also when the grant itself
+        # raised after writing them (e.g. an OAUTH_TOKEN_ISSUED subscriber), so
+        # they are read from the flow, not from a token response. Revoke them
+        # so nothing from the rejected request stays usable, and so that
+        # AccountCleanup does not mistake them for a concurrent login using a
+        # new account. A token whose transaction rolled back is not persisted
+        # and is skipped (its session write was rolled back with it).
+        #
+        # Returns what was revoked, as discard_social_attempt!'s `sessions:` /
+        # `refresh_tokens:`.
+        def revoke_issued_tokens!(flow)
+          record = flow&.issued_refresh_token
+          return { sessions: [], refresh_tokens: [] } unless record&.persisted?
+
+          # Loaded by id, not through the association: the record was built
+          # with only session_id, and a host with strict_loading_by_default
+          # would raise here and mask the original error.
+          session = record.session_id && StandardId::Session.find_by(id: record.session_id)
+          session.revoke!(reason: "social_sign_in_rejected") unless session.nil? || session.revoked?
+          record.revoke!
+          { sessions: [session].compact, refresh_tokens: [record] }
+        end
+
         # Mirror of the web callback's OAuthError handling: emit
         # SOCIAL_AUTH_FAILED for infrastructure-level provider failures
         # (HTTP/DNS/SSL/timeouts surfaced as OAuthError by provider
@@ -54,6 +104,12 @@ module StandardId
         # ...) are policy/client errors, not infrastructure failures, and
         # must not emit. The error re-raises into the standard
         # handle_oauth_error JSON response.
+        #
+        # The provider receives the request's `iss` as `callback_iss:` (as on
+        # the web callback) but never a `code_verifier:`: this endpoint has no
+        # server-held flow state, and a client-supplied `code_verifier` param
+        # is not forwarded. A provider that opts in to core-managed PKCE
+        # (supports_pkce?) gets no verifier here and should refuse.
         def fetch_provider_user_info
           get_user_info_from_provider(flow: provider.flow_for(params))
         rescue StandardId::OAuthError => e