standard_id 0.46.0 → 0.47.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a825be521399d2fbb91a820cbc0da601d24865a12fc549d1a8697ea1d6c97cb
-  data.tar.gz: da555da47e6a9ae99f1c888e5ef93c2fc4a02d21b11993300c67d02df6ef5d01
+  metadata.gz: 8c487f3a2265110f88e093a27b30e78742ecc04cbf460e94cbe35df02dbd2621
+  data.tar.gz: 6ad0ecc9edb3a9c2e5cbc51096ac08f6164b7bcb4671098f85806d3a1f605f6e
 SHA512:
-  metadata.gz: f54bf303a4cc32095b3117df9636b9f3e04ebe4483de5b79f513a0089b44d45a36a3ff7dbaf54d0858a4c29c657e11452f9e7b4ffe89e7418fbf55598ecf75a7
-  data.tar.gz: 157b2b4ffdca2f4a22eaf78207ba28579ef71c59693d6f8587159be19bd36d9540c008e9ede3bbbcc9f313f10d5ef762b9553e898428ffe4f37f7f513c83c2ef
+  metadata.gz: 818624622fef93866c46945cbe85c5a5e5898aea0d9770dab65596ab2524f03470f3f51b26286cea93a3cca639823be9566a7ef270cdbeec34794c6ebd4772e0
+  data.tar.gz: cea418b10ae16fa7d90caa16dfc4c394aa9445d4b6085380d38950c15c1d381a17b7bace3e786327fd21ac82b165525a95ad73b72a087b6cbb0b3c78ef13bf4a

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.47.0] - 2026-10-19
+
+### Added
+
+- **`c.oauth.disabled_grant_types`** (array, default `[]`): grant types the token endpoint refuses even though the engine implements them. A disabled grant answers exactly like an unknown one — 400 `unsupported_grant_type`, "Unsupported grant_type: <name>" — before the flow's parameters are read, so a caller cannot distinguish "disabled" from "never implemented", and both discovery documents drop it from `grant_types_supported`. Hosts that routed email+password sign-in through their own API and closed the resource-owner password grant with a `prepend` on `PasswordFlow` / `TokensController` (luminality-web `config/initializers/standard_id_password_grant.rb`) can replace the patch with `c.oauth.disabled_grant_types = %w[password]`.
+- **`c.oauth.password_grant_requires_verified_identifier`** (boolean, default `false`): when on, `grant_type=password` refuses a credential whose identifier is unverified with the same 400 `invalid_grant` / "Invalid username or password" it gives a wrong password, and publishes `AUTHENTICATION_FAILED` with `error_code: "identifier_unverified"`. Until now the grant minted tokens for a sign-up that never confirmed its email, bypassing verification the host enforces on its other login paths. Off by default so an upgrade changes nothing; turn it on wherever the grant stays enabled.
+
+### Changed
+
+- `PasswordFlow#emit_authentication_failed` takes optional `error_code:` / `error_message:` (defaults unchanged) so the verified-identifier refusal can be told apart in audit subscribers.
+- `StandardId::Oauth::GrantTypes` (`.disabled`, `.disabled?(name)`) is the single reader of `oauth.disabled_grant_types`, used by both the token endpoint and the discovery documents so they cannot normalise the list differently (#375).
+
 ## [0.46.0] - 2026-10-05
 
 ### Added

data/README.md

@@ -189,6 +189,24 @@ StandardId.configure do |config|
 end
 ```
 
+Two further settings close the resource-owner password grant, or harden it, for
+hosts whose email+password sign-in lives in their own API:
+
+```ruby
+StandardId.configure do |config|
+  # Refuse grant types you do not want on the token endpoint. A disabled grant
+  # answers exactly like an unknown one (400 unsupported_grant_type, before the
+  # flow's params are read) and is dropped from `grant_types_supported` in both
+  # discovery documents. Values are the grant_type strings.
+  config.oauth.disabled_grant_types = %w[password]
+
+  # If the password grant stays enabled: refuse credentials whose identifier is
+  # not verified, with the same invalid_grant answer as a wrong password, and
+  # publish AUTHENTICATION_FAILED with error_code "identifier_unverified".
+  config.oauth.password_grant_requires_verified_identifier = true
+end
+```
+
 Under `:grant`, revoking a **stateless access token is a no-op** — this engine
 has no per-access-token store, so it cannot invalidate one before its `exp`
 (the response is still `200`, per RFC 7009 §2.2). Clients that need revocation

data/app/controllers/standard_id/api/oauth/tokens_controller.rb

@@ -86,7 +86,9 @@ module StandardId
             end
 
             klass = FLOW_STRATEGIES[grant_type]
-            unless klass
+            # A disabled grant is indistinguishable from an unknown one: same
+            # error, same message, raised before the flow's params are read.
+            if klass.nil? || StandardId::Oauth::GrantTypes.disabled?(grant_type)
               raise StandardId::UnsupportedGrantTypeError, "Unsupported grant_type: #{grant_type}"
             end
             klass

data/lib/standard_id/config/schema.rb

@@ -457,6 +457,33 @@ StandardId::ConfigSchema.define do
     # immediately.
     field :introspection_enabled, type: :boolean, default: false
 
+    # Grant types the token endpoint refuses even though the engine implements
+    # them. Values are the `grant_type` strings: "authorization_code",
+    # "refresh_token", "client_credentials", "password", "passwordless_otp".
+    #
+    # A disabled grant answers exactly like an unknown one — 400
+    # `unsupported_grant_type`, "Unsupported grant_type: <name>" — before the
+    # flow's parameters are read, so a caller cannot tell a disabled grant from
+    # one that was never implemented, and the discovery documents drop it from
+    # `grant_types_supported`. Typical use: a host whose email+password sign-in
+    # runs through its own API (verification, per-email limits, generic
+    # answers) and must not leave the resource-owner password grant open as a
+    # second, weaker door to the same credentials.
+    #
+    # Empty (default) = every implemented grant is available, as before.
+    field :disabled_grant_types, type: :array, default: -> { [] }
+
+    # When true, the resource-owner password grant refuses a credential whose
+    # identifier has not been verified (`StandardId::Identifier#verified_at`
+    # nil) with the same 400 `invalid_grant` / "Invalid username or password"
+    # it gives a wrong password, and publishes AUTHENTICATION_FAILED with
+    # `error_code: "identifier_unverified"`. Without it a sign-up that never
+    # confirmed its email can mint tokens through `grant_type=password`,
+    # bypassing whatever verification the host enforces on its web and API
+    # login paths. Default false so an upgrade changes nothing; turn it on
+    # wherever the grant stays enabled.
+    field :password_grant_requires_verified_identifier, type: :boolean, default: false
+
     # Where the discovery documents say the ENDPOINTS live.
     #
     # The issuer and the endpoint base are different things. The issuer is a

data/lib/standard_id/oauth/discovery_document.rb

@@ -64,7 +64,9 @@ module StandardId
           revocation_endpoint: "#{base}/oauth/revoke",
           userinfo_endpoint: "#{base}/userinfo",
           response_types_supported: %w[code],
-          grant_types_supported: %w[authorization_code refresh_token client_credentials],
+          # Minus anything the host turned off with `oauth.disabled_grant_types`,
+          # so a client is never pointed at a grant the token endpoint refuses.
+          grant_types_supported: %w[authorization_code refresh_token client_credentials] - StandardId::Oauth::GrantTypes.disabled,
           subject_types_supported: %w[public],
           id_token_signing_alg_values_supported: [StandardId.config.oauth.signing_algorithm.to_s.upcase],
           # "none" advertises public-client support (PKCE-only token exchange,

data/lib/standard_id/oauth/grant_types.rb

@@ -0,0 +1,18 @@
+module StandardId
+  module Oauth
+    # The one reader for `config.oauth.disabled_grant_types`, so the token
+    # endpoint (which refuses a disabled grant) and the discovery documents
+    # (which stop advertising it) can never normalise the list differently.
+    module GrantTypes
+      # @return [Array<String>] grant_type strings the host has turned off
+      def self.disabled
+        Array(StandardId.config.oauth.disabled_grant_types).map(&:to_s)
+      end
+
+      # @param name [String, Symbol, nil] a `grant_type` value
+      def self.disabled?(name)
+        disabled.include?(name.to_s)
+      end
+    end
+  end
+end

data/lib/standard_id/oauth/password_flow.rb

@@ -19,6 +19,13 @@ module StandardId
           raise StandardId::InvalidGrantError, "Invalid username or password"
         end
 
+        # Same answer as a wrong password on purpose: the grant must not reveal
+        # which addresses exist but are unverified.
+        if unverified_identifier_refused?
+          emit_authentication_failed(error_code: "identifier_unverified", error_message: "Identifier not verified")
+          raise StandardId::InvalidGrantError, "Invalid username or password"
+        end
+
         emit_password_validated
         validate_requested_scope!
       end
@@ -33,16 +40,23 @@ module StandardId
         )
       end
 
-      def emit_authentication_failed
+      def emit_authentication_failed(error_code: "invalid_credentials", error_message: "Invalid username or password")
         StandardId::Events.publish(
           StandardId::Events::AUTHENTICATION_FAILED,
           account_lookup: params[:username],
           auth_method: "password",
-          error_code: "invalid_credentials",
-          error_message: "Invalid username or password"
+          error_code: error_code,
+          error_message: error_message
         )
       end
 
+      def unverified_identifier_refused?
+        return false unless StandardId.config.oauth.password_grant_requires_verified_identifier
+
+        identifier = @credential&.credential&.identifier
+        identifier.nil? || !identifier.verified?
+      end
+
       def emit_password_validated
         StandardId::Events.publish(
           StandardId::Events::PASSWORD_VALIDATED,

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.46.0"
+  VERSION = "0.47.0"
 end

data/lib/standard_id.rb

@@ -55,6 +55,7 @@ require "standard_id/oauth/subflows/traditional_code_grant"
 require "standard_id/oauth/subflows/social_login_grant"
 require "standard_id/oauth/passwordless_otp_flow"
 require "standard_id/oauth/discovery_resolver"
+require "standard_id/oauth/grant_types"
 require "standard_id/oauth/discovery_document"
 require "standard_id/routing"
 require "standard_id/oauth/consent_payload"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.46.0
+  version: 0.47.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -287,6 +287,7 @@ files:
 - lib/standard_id/oauth/consent_payload.rb
 - lib/standard_id/oauth/discovery_document.rb
 - lib/standard_id/oauth/discovery_resolver.rb
+- lib/standard_id/oauth/grant_types.rb
 - lib/standard_id/oauth/implicit_authorization_flow.rb
 - lib/standard_id/oauth/oauth_session_persistence.rb
 - lib/standard_id/oauth/password_flow.rb