standard_id 0.48.0 → 0.48.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f909ccb15d7b3f3b09fff0d61bd87db9e48614652ac1c4338a6e2390a7cb056e
-  data.tar.gz: da699414b0e242675d61fc412d6e0d59f2f05fc0580778fa48e5600a3e48b874
+  metadata.gz: cdf22579e98c4ceb592cb20766d510d937d0e5d2f7f70c41074f984ddc3b0393
+  data.tar.gz: 35fbb21a24d40a307bd55279a86fa0d91549641e30f30d4101d667d9c5d7c793
 SHA512:
-  metadata.gz: ab4a5fd3ae269431574ea2e82ac3c33914a1f6769a7602c1c4618fb20434382a47304ae90fa998f09e9adbabb2f34466d34c1ffca33a2a1b0707316094dd0f79
-  data.tar.gz: 915c57e92d64784d1a65fd0f91265773fe03c087911f124b896d535d25509f8497358c149194b575cf699e21d70b0e367e3affd80547f1e63c31ec440ab16e6a
+  metadata.gz: cd202ffabe7287cb374442e6aeee83d0f2853a17d9cb7654ba816f28f48c4d6970b859b7d4d83581f09ef4a2793689b5fc620b545246bfb515691fda9a4cd1dd
+  data.tar.gz: 0e17bfff08af26fc343dedaf0d9500bbef69fe118031c305bdc29f33ede7231c8641c14b2b6156395702c4957c58b605dc6a24b54b4f975fa19618c8f4cade01

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.48.1] - 2026-10-20
+
+### Added
+
+- **`StandardId::RetryDelayError`** (an `InvalidRequestError`, with `retry_after` seconds) is what the OTP resend cooldown (`passwordless.retry_delay`) now raises, and **`Otp.issue` reports it as `error_code: :cooldown`** instead of the generic `:invalid_request`. A host that wraps `Otp.issue` can tell "a usable code was issued moments ago" apart from a real failure and keep its own cooldown copy — which is what fundbright-web needed before it could drop its advisory lock around `Otp.issue` now that the cooldown check is atomic (0.48.0). Every existing `rescue StandardId::InvalidRequestError` keeps working.
+
 ## [0.48.0] - 2026-10-20
 
 ### Added

data/README.md

@@ -1757,7 +1757,12 @@ A tripped limit raises `StandardId::RateLimitExceededError` (an `InvalidRequestE
 error handler renders as `429 rate_limit_exceeded` with `Retry-After`, the web login page shows as a
 flash, and `Otp.issue` returns as a failed result with `error_code: :rate_limited`). The per-target
 default matches the API's `api_passwordless_start_per_target`; if you raise that (or `login_per_email`)
-raise `otp_start_per_target` with it, or it becomes the binding limit. The 30-second resend
+raise `otp_start_per_target` with it, or it becomes the binding limit.
+
+The resend cooldown (`passwordless.retry_delay`) is reported separately from those limits:
+`StandardId::RetryDelayError` (an `InvalidRequestError` carrying `retry_after` seconds), which
+`Otp.issue` returns as `error_code: :cooldown`, so a host can tell "a code is already on its way"
+apart from a failure. The 30-second resend
 cooldown (`passwordless.retry_delay`) and the challenge insert run in one transaction, serialised per
 address with a PostgreSQL advisory lock, so two concurrent starts cannot both issue a code.
 

data/lib/standard_id/errors.rb

@@ -93,6 +93,21 @@ module StandardId
     def http_status = :too_many_requests
   end
 
+  # The OTP resend cooldown (`passwordless.retry_delay`) refused a start: a code
+  # for this target was issued less than retry_delay seconds ago and is still
+  # usable, so nothing new was sent. A subclass of InvalidRequestError so every
+  # existing rescue keeps working; Otp.issue reports it as `error_code:
+  # :cooldown` so a host can show its own "a code is already on its way" copy
+  # and tell it apart from a send failure. `retry_after` is the seconds left.
+  class RetryDelayError < InvalidRequestError
+    attr_reader :retry_after
+
+    def initialize(message = "Please wait before requesting another code", retry_after: nil)
+      super(message)
+      @retry_after = retry_after
+    end
+  end
+
   class InvalidClientError < OAuthError
     def oauth_error_code = :invalid_client
     def http_status = :unauthorized

data/lib/standard_id/otp.rb

@@ -74,7 +74,10 @@ module StandardId
     # - success?: true/false
     # - challenge: the created CodeChallenge (nil on failure)
     # - code: raw OTP code — only populated when delivery: :manual
-    # - error_code: machine-readable symbol on failure
+    # - error_code: machine-readable symbol on failure — :invalid_request
+    #   (bad target, username_validator rejection), :cooldown (a usable code
+    #   was issued less than passwordless.retry_delay seconds ago; nothing new
+    #   was sent), :rate_limited (rate_limits.otp_start_per_* tripped)
     # - error_message: human-readable message on failure
     IssueResult = Data.define(:success?, :challenge, :code, :error_code, :error_message) do
       # Parallel naming with VerificationService::Result, which exposes the
@@ -132,6 +135,11 @@ module StandardId
             skip_sender: delivery_sym == :manual,
             delivery: delivery_sym
           )
+        rescue StandardId::RetryDelayError => e
+          # The resend cooldown (passwordless.retry_delay): a usable code was
+          # issued moments ago and nothing new was sent. Distinct code so a
+          # caller can say "it's on its way" rather than report a failure.
+          return failure_issue_result(:cooldown, e.message)
         rescue StandardId::RateLimitExceededError => e
           # A lib-level start limit (rate_limits.otp_start_per_*) tripped.
           # Distinct code so a caller can answer 429 rather than 400.

data/lib/standard_id/passwordless/base_strategy.rb

@@ -121,8 +121,10 @@ module StandardId
         return if elapsed >= delay
 
         wait = (delay - elapsed).ceil
-        raise StandardId::InvalidRequestError,
-          "Please wait #{wait} #{'second'.pluralize(wait)} before requesting another code"
+        raise StandardId::RetryDelayError.new(
+          "Please wait #{wait} #{'second'.pluralize(wait)} before requesting another code",
+          retry_after: wait
+        )
       end
 
       def create_challenge!(username, code_length: nil, expires_in: nil, metadata: {})

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.48.0"
+  VERSION = "0.48.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.48.0
+  version: 0.48.1
 platform: ruby
 authors:
 - Jaryl Sim