standard_id 0.48.0 → 0.49.0

data/app/controllers/standard_id/api/well_known/oauth_protected_resource_controller.rb

@@ -0,0 +1,46 @@
+module StandardId
+  module Api
+    module WellKnown
+      # RFC 9728 OAuth 2.0 Protected Resource Metadata.
+      #
+      # `GET /.well-known/oauth-protected-resource/<resource path>` serves the
+      # document for the resource configured at that path in
+      # `config.oauth.protected_resources`; the bare form serves the default
+      # (the only configured resource, or the one marked `root: true`). 404
+      # when nothing matches, so a host with no protected resources exposes no
+      # document. Public and cacheable, like the other discovery documents.
+      #
+      # Drawn at the origin root by `standard_id_protected_resource_routes`
+      # (the challenge in StandardId::ResourceServer names that URL) and also
+      # under the engine's own mount.
+      class OauthProtectedResourceController < ActionController::API
+        include StandardId::ControllerPolicy
+        public_controller
+
+        def show
+          audience = resolve_audience
+
+          unless audience
+            render json: { error: "not_found", error_description: "No protected resource is configured at this path" },
+              status: :not_found
+            return
+          end
+
+          response.headers["Cache-Control"] = "public, max-age=3600"
+          render json: StandardId::Oauth::ProtectedResourceDocument.build(
+            audience: audience, origin: request.base_url, request: request
+          )
+        end
+
+        private
+
+        def resolve_audience
+          path = params[:resource_path].presence
+          return StandardId::Oauth::ProtectedResourceDocument.default_audience if path.nil?
+
+          StandardId::Oauth::ProtectedResourceDocument.audience_for_path("/#{path}")
+        end
+      end
+    end
+  end
+end

data/app/jobs/standard_id/cleanup_all_job.rb

@@ -1,5 +1,5 @@
 module StandardId
-  # Runs all four expired-row cleanup jobs inline, in one job.
+  # Runs all five cleanup jobs inline, in one job.
   #
   # Schedule this ONE job instead of the four individual ones when you want a
   # single recurring entry — typically so the schedule carries one cron
@@ -14,7 +14,7 @@ module StandardId
   #   end
   #
   # One table's DELETE failing (a lock timeout, say) does not skip the others;
-  # the first error is re-raised once all four have run, so the run still
+  # the first error is re-raised once all five have run, so the run still
   # fails its cron check-in and lands in the queue's failed executions.
   #
   # Each job keeps its default grace windows (see README "Scheduled
@@ -28,7 +28,8 @@ module StandardId
         StandardId::CleanupExpiredSessionsJob,
         StandardId::CleanupExpiredRefreshTokensJob,
         StandardId::CleanupExpiredAuthorizationCodesJob,
-        StandardId::CleanupExpiredCodeChallengesJob
+        StandardId::CleanupExpiredCodeChallengesJob,
+        StandardId::PurgeStaleDynamicClientsJob
       ]
     end
 

data/app/jobs/standard_id/purge_stale_dynamic_clients_job.rb

@@ -0,0 +1,73 @@
+module StandardId
+  # Garbage-collects dynamically registered clients (RFC 7591) that never
+  # amounted to anything, and deregistered ones.
+  #
+  # Open registration is unauthenticated, so bots and abandoned connectors
+  # accumulate ClientApplication rows. A client is reaped when it was
+  # registered more than `stale_after_seconds` ago and EITHER
+  #
+  #   * it was deregistered (RFC 7592 DELETE deactivates; see
+  #     ClientRegistration.deregister) more than the window ago — the row is
+  #     what lets refresh and introspection say "gone" meanwhile, or
+  #   * nobody ever used it: it is consent-gated (a completed authorization
+  #     records a ClientGrant; a client registered with `require_consent:
+  #     false` pinned never gets one, so it is only ever reaped once
+  #     deregistered), and it has no ClientGrant, no AuthorizationCode in any
+  #     state and no refresh token in any state. Consumed codes and dead
+  #     refresh tokens count as use on purpose: they are what an active client
+  #     leaves behind between authorizations, and the cleanup jobs delete them
+  #     on their own schedule.
+  #
+  # The grace window is what lets a client register now and complete consent
+  # days later. Only clients created through dynamic registration are ever
+  # touched (migration 20261020120000 marks them); the job is a no-op before
+  # that migration has run.
+  class PurgeStaleDynamicClientsJob < ApplicationJob
+    queue_as :default
+
+    # @param stale_after_seconds [Integer] registered longer ago than this
+    # @param batch_size [Integer] rows per batch
+    # @return [Integer] clients deleted
+    def perform(stale_after_seconds: 7.days.to_i, batch_size: 100)
+      return 0 unless StandardId::ClientApplication.registration_management_column?
+
+      cutoff = stale_after_seconds.seconds.ago
+      deleted = 0
+      stale_clients(cutoff).find_each(batch_size: batch_size) do |client|
+        StandardId::ClientApplication.transaction do
+          if StandardId::RefreshToken.client_binding_column?
+            client.refresh_tokens.where(revoked_at: nil).update_all(revoked_at: Time.current)
+          end
+          # Grants are keyed by the client_id string with no FK, so they would
+          # otherwise outlive the client as orphans.
+          StandardId::ClientGrant.where(client_id: client.client_id).delete_all
+          # The dependent-destroy cascade lazy-loads the client's secrets and
+          # codes, which a host running strict_loading_by_default would refuse.
+          client.strict_loading!(false)
+          client.destroy!
+        end
+        deleted += 1
+      end
+      Rails.logger.info("[StandardId] Purged #{deleted} stale dynamically registered clients older than #{cutoff}")
+      deleted
+    end
+
+    private
+
+    def stale_clients(cutoff)
+      base = StandardId::ClientApplication.dynamically_registered.where("created_at < ?", cutoff)
+
+      # A deregistered client only ever goes through the deactivated branch,
+      # whatever it did or did not do while live.
+      never_used = base
+        .where(active: true, require_consent: true)
+        .where.not(client_id: StandardId::ClientGrant.select(:client_id))
+        .where.not(client_id: StandardId::AuthorizationCode.select(:client_id))
+      if StandardId::RefreshToken.client_binding_column?
+        never_used = never_used.where.not(id: StandardId::RefreshToken.where.not(client_application_id: nil).select(:client_application_id))
+      end
+
+      base.where(active: false).where("deactivated_at < ?", cutoff).or(never_used)
+    end
+  end
+end

data/app/models/standard_id/client_application.rb

@@ -55,6 +55,9 @@ module StandardId
     # they drift (update_columns, a data fix) must read the same from a query
     # as from the instance — the refresh grant and introspection rely on it.
     scope :live, -> { where(active: true, deactivated_at: nil) }
+    # Clients created through RFC 7591 dynamic registration (migration
+    # 20261020120000): the ones RFC 7592 can manage and the purge may reap.
+    scope :dynamically_registered, -> { where.not(registration_access_token_digest: nil) }
     scope :confidential, -> { where(client_type: "confidential") }
     scope :public_clients, -> { where(client_type: "public") }
     scope :for_owner, ->(owner) { where(owner: owner) }
@@ -191,6 +194,41 @@ module StandardId
       nil
     end
 
+    # Whether the host has run migration 20261020120000. Until then the gem
+    # neither issues registration access tokens nor serves RFC 7592.
+    def self.registration_management_column?
+      column_names.include?("registration_access_token_digest")
+    rescue ActiveRecord::ActiveRecordError
+      false
+    end
+
+    # Keyed with secret_key_base like AuthorizationCode.hash_for, so a leaked
+    # table does not yield usable management credentials.
+    def self.digest_registration_access_token(token)
+      Digest::SHA256.hexdigest("#{token}:#{Rails.configuration.secret_key_base}")
+    end
+
+    def dynamically_registered?
+      self.class.registration_management_column? && registration_access_token_digest.present?
+    end
+
+    # Constant-time check of an RFC 7592 registration access token.
+    def authenticate_registration_access_token(token)
+      return false unless dynamically_registered? && token.present?
+
+      ActiveSupport::SecurityUtils.secure_compare(
+        self.class.digest_registration_access_token(token.to_s),
+        registration_access_token_digest.to_s
+      )
+    end
+
+    # The RFC 7591 token_endpoint_auth_method a client information response
+    # reports. Public clients are "none"; both confidential methods are
+    # accepted at the token endpoint, so client_secret_basic stands for either.
+    def token_endpoint_auth_method
+      public? ? "none" : "client_secret_basic"
+    end
+
     def confidential?
       client_type == "confidential"
     end

data/config/routes/api.rb

@@ -27,6 +27,11 @@ StandardId::ApiEngine.routes.draw do
       # The controller returns 404 when oauth.dynamic_registration_enabled is
       # false, so the endpoint is fully absent unless explicitly enabled.
       resource :register, only: [:create], controller: :registrations
+      # RFC 7592 client-configuration endpoint, authenticated by the
+      # registration access token issued at registration.
+      get "register/:client_id", to: "registrations#show", as: :registration
+      put "register/:client_id", to: "registrations#update"
+      delete "register/:client_id", to: "registrations#destroy"
 
       namespace :callback do
         post ":provider", to: "providers#callback", as: :provider
@@ -37,6 +42,10 @@ StandardId::ApiEngine.routes.draw do
       get "jwks.json", to: "jwks#show", as: :jwks
       get "openid-configuration", to: "openid_configuration#show", as: :openid_configuration
       get "oauth-authorization-server", to: "oauth_authorization_server#show", as: :oauth_authorization_server
+      # RFC 9728. The host also draws this at the origin root with
+      # standard_id_protected_resource_routes, which is the URL the challenge names.
+      get "oauth-protected-resource(/*resource_path)", to: "oauth_protected_resource#show",
+        as: :oauth_protected_resource, format: false
     end
   end
 end

data/db/migrate/20261020120000_add_registration_access_token_digest_to_standard_id_client_applications.rb

@@ -0,0 +1,14 @@
+# RFC 7592 client-configuration management for dynamically registered clients.
+# The registration access token is returned once, at registration, and only
+# its digest is stored; a non-NULL digest is also what marks a client as
+# dynamically registered (StandardId::ClientApplication.dynamically_registered),
+# which the stale-client purge keys on. One nullable string column, no
+# default, no index (lookup is by client_id, then a constant-time compare):
+# metadata-only on PostgreSQL. Until it has run, registration works as before
+# (no registration_access_token / registration_client_uri in the response) and
+# the management endpoints are absent (404).
+class AddRegistrationAccessTokenDigestToStandardIdClientApplications < ActiveRecord::Migration[8.0]
+  def change
+    add_column :standard_id_client_applications, :registration_access_token_digest, :string
+  end
+end

data/lib/generators/standard_id/install/install_generator.rb

@@ -44,7 +44,8 @@ module StandardId
         "standard_id_cleanup_expired_sessions" => ["StandardId::CleanupExpiredSessionsJob", "every hour at minute 6"],
         "standard_id_cleanup_expired_refresh_tokens" => ["StandardId::CleanupExpiredRefreshTokensJob", "every hour at minute 3"],
         "standard_id_cleanup_expired_authorization_codes" => ["StandardId::CleanupExpiredAuthorizationCodesJob", "every hour at minute 9"],
-        "standard_id_cleanup_expired_code_challenges" => ["StandardId::CleanupExpiredCodeChallengesJob", "every hour at minute 13"]
+        "standard_id_cleanup_expired_code_challenges" => ["StandardId::CleanupExpiredCodeChallengesJob", "every hour at minute 13"],
+        "standard_id_purge_stale_dynamic_clients" => ["StandardId::PurgeStaleDynamicClientsJob", "every day at 4am"]
       }.freeze
 
       def create_initializer_file

data/lib/standard_id/config/callable_validator.rb

@@ -45,6 +45,26 @@ module StandardId
           signature: "(account:, client:, request:, audience:)",
           kind: :keyword,
           keywords: %i[account client request audience]
+        },
+        "oauth.audience_resolver" => {
+          signature: "(client:, audience:, resource:, request:)",
+          kind: :keyword,
+          keywords: %i[client audience resource request]
+        },
+        "oauth.dynamic_registration_owner" => {
+          signature: "(metadata:, request:)",
+          kind: :keyword,
+          keywords: %i[metadata request]
+        },
+        "oauth.dynamic_registration_attributes" => {
+          signature: "(metadata:, request:)",
+          kind: :keyword,
+          keywords: %i[metadata request]
+        },
+        "oauth.audience_scope_resolver" => {
+          signature: "(audience:, client:, configured_scopes:)",
+          kind: :keyword,
+          keywords: %i[audience client configured_scopes]
         }
       }.freeze
 

data/lib/standard_id/config/schema.rb

@@ -417,6 +417,39 @@ StandardId::ConfigSchema.define do
     # When nil (default), only the static `audience_scopes` map is consulted.
     field :audience_scope_resolver, type: :any, default: nil
 
+    # How /authorize decides which audience a request is for — server-side,
+    # instead of trusting a client-supplied `audience` alone. Resolution order
+    # (StandardId::Oauth::AudienceResolver): this callable when set (any
+    # subset of client:, audience:, resource:, request:; a non-nil answer is
+    # final), else the `audience` param, else the RFC 8707 `resource` param
+    # mapped through `resource_audiences`, else the client's registered
+    # default `metadata["audience"]`. The resolved audience is bound to the
+    # authorization code and reaches the token as `aud`; `audience_scopes`
+    # (above) is then enforced at /authorize for it.
+    field :audience_resolver, type: :any, default: nil
+
+    # RFC 8707: resource indicator → audience, e.g.
+    # { "https://app.example.com/mcp" => "mcp" }. Matched with the trailing
+    # slash removed. Empty (the default) means the `resource` parameter is
+    # ignored; once set, a resource outside the map is refused with
+    # `invalid_target` rather than issued without an audience.
+    field :resource_audiences, type: :hash, default: -> { {} }
+
+    # RFC 9728 protected resources this host serves, keyed by the audience
+    # their tokens carry. `path` is required (where the resource lives, or an
+    # absolute URL on another origin); `scopes_supported` defaults to
+    # `audience_scopes[audience]`, `authorization_servers` to `[issuer]`,
+    # `bearer_methods_supported` to `["header"]`; any other RFC 9728 member is
+    # emitted as given (callables receive `{ origin:, audience:, issuer:,
+    # request: }`; nil removes a member). `root: true` picks the resource the
+    # bare /.well-known/oauth-protected-resource serves when several exist.
+    #
+    #   c.oauth.protected_resources = { "mcp" => { path: "/mcp", scopes_supported: %w[mcp mcp:read] } }
+    #
+    # Served by `standard_id_protected_resource_routes` in the host's routes
+    # file; consumed by StandardId::ResourceServer for the 401/403 challenge.
+    field :protected_resources, type: :hash, default: -> { {} }
+
     # JWT signing configuration (for asymmetric algorithms)
     # If nil, uses HS256 with Rails.application.secret_key_base
     field :signing_key, type: :any, default: nil
@@ -591,6 +624,36 @@ StandardId::ConfigSchema.define do
     #   "client_secret_post"  — confidential, secret in the request body
     field :dynamic_registration_default_auth_method, type: :string, default: "none"
 
+    # Server-pinned attributes for every dynamically registered client — what
+    # a self-registering MCP client may NOT choose for itself. A Hash, or a
+    # callable taking any subset of `metadata:` (the RFC 7591 document) and
+    # `request:` and returning one. Keys (any other raises ConfigurationError):
+    #
+    #   scopes                      String or Array; the client's scope, whatever it asked for
+    #   metadata                    Hash merged into ClientApplication#metadata
+    #                               ("audience" => "mcp" is what AudienceResolver reads)
+    #   access_token_lifetime       seconds
+    #   authorization_code_lifetime seconds
+    #   require_consent             default true
+    #   description                 String
+    #
+    # When `scopes` is not pinned but `metadata["audience"]` is, and that
+    # audience has an `audience_scopes` vocabulary, the client's scope is that
+    # vocabulary. Otherwise the requested scope (or "openid profile email").
+    #
+    #   c.oauth.dynamic_registration_attributes = {
+    #     scopes: %w[mcp mcp:read],
+    #     metadata: { "audience" => "mcp", "dcr" => true },
+    #     access_token_lifetime: 3600
+    #   }
+    field :dynamic_registration_attributes, type: :any, default: -> { {} }
+
+    # token_endpoint_auth_method values dynamic registration accepts. Narrow it
+    # to %w[none] to register public (PKCE) clients only, and advertise the
+    # same list as token_endpoint_auth_methods_supported.
+    field :dynamic_registration_auth_methods, type: :array,
+      default: -> { %w[none client_secret_basic client_secret_post] }
+
     # RFC 6749 §4.1.3 strictness at the token endpoint.
     #
     # The spec is unambiguous: if `redirect_uri` was included in the
@@ -633,6 +696,26 @@ StandardId::ConfigSchema.define do
 
   scope :social do
     field :social_account_attributes, type: :any, default: nil
+
+    # Runs on the API social callback (POST /oauth/callback/:provider) AFTER the
+    # account is found or created and BEFORE the token is minted — the one
+    # place a host can make the account ready for the mint: provision the
+    # profile the requested audience is bound to, apply a region or
+    # pending-deletion check, record a first-touch. A callable taking any
+    # subset of `account:`, `provider:`, `social_info:`, `provider_tokens:`,
+    # `audience:` and `scopes:` (the requested ones, as strings or nil),
+    # `params:` (the forwarded request params, minus the reserved OAuth ones)
+    # and `request:`. Raising refuses the sign-in through the callback's
+    # normal path: nothing is minted, a staged social link is dropped, and an
+    # account this request created is removed again. Two things to know: the
+    # hook runs BEFORE the login-method policy and the audience binding, so
+    # if those refuse the sign-in on an account that already existed, whatever
+    # the hook wrote stays (make it idempotent); and it covers the API
+    # callback only — the WebEngine's social callback does not run it.
+    # SOCIAL_AUTH_COMPLETED still fires after the mint as before. Replaces the
+    # host subclass of the callback controller that reordered these steps by
+    # copying its body.
+    field :before_mint, type: :any, default: nil
     field :allowed_redirect_url_prefixes, type: :array, default: []
     field :available_scopes, type: :array, default: -> { [] }
     # How a social login whose (provider, sub) is not linked yet may link to
@@ -734,6 +817,10 @@ StandardId::ConfigSchema.define do
     # Dynamic client registration (RFC 7591) — throttle the open registration
     # endpoint by IP so an enabled deployment can't be flooded with client rows.
     field :dynamic_registration_per_ip, type: :integer, default: 10      # per hour
+    # RFC 7592 management (GET/PUT/DELETE /oauth/register/:client_id) — its
+    # own counter, so management traffic behind a shared NAT does not compete
+    # with registrations, while still slowing token guessing.
+    field :dynamic_registration_management_per_ip, type: :integer, default: 60 # per hour
 
     # Token introspection (RFC 7662) — throttle by IP so the endpoint cannot be
     # used to bulk-classify stolen tokens. Note the limit renders the ordinary

data/lib/standard_id/errors.rb

@@ -93,6 +93,21 @@ module StandardId
     def http_status = :too_many_requests
   end
 
+  # The OTP resend cooldown (`passwordless.retry_delay`) refused a start: a code
+  # for this target was issued less than retry_delay seconds ago and is still
+  # usable, so nothing new was sent. A subclass of InvalidRequestError so every
+  # existing rescue keeps working; Otp.issue reports it as `error_code:
+  # :cooldown` so a host can show its own "a code is already on its way" copy
+  # and tell it apart from a send failure. `retry_after` is the seconds left.
+  class RetryDelayError < InvalidRequestError
+    attr_reader :retry_after
+
+    def initialize(message = "Please wait before requesting another code", retry_after: nil)
+      super(message)
+      @retry_after = retry_after
+    end
+  end
+
   class InvalidClientError < OAuthError
     def oauth_error_code = :invalid_client
     def http_status = :unauthorized
@@ -146,6 +161,13 @@ module StandardId
     def oauth_error_code = :invalid_scope
   end
 
+  # RFC 8707 §2: the `resource` parameter names something this server does not
+  # issue tokens for. Raised by StandardId::Oauth::AudienceResolver when
+  # `oauth.resource_audiences` is configured and the resource is not in it.
+  class InvalidTargetError < OAuthError
+    def oauth_error_code = :invalid_target
+  end
+
   class UnauthorizedClientError < OAuthError
     def oauth_error_code = :unauthorized_client
   end

data/lib/standard_id/oauth/audience_resolver.rb

@@ -0,0 +1,88 @@
+module StandardId
+  module Oauth
+    # Which audience an /authorize request is for — decided server-side, from
+    # what the request and the registered client say, rather than trusted from
+    # a client-supplied `audience` alone.
+    #
+    # Resolution order:
+    #   1. `config.oauth.audience_resolver`, when set: a callable taking any
+    #      subset of `client:`, `audience:` (the raw param), `resource:` (the
+    #      RFC 8707 param) and `request:`. A non-nil answer is final; nil
+    #      falls through to the defaults below.
+    #   2. The `audience` parameter, when present (what hosts' shims inject
+    #      today, so nothing changes for them).
+    #   3. The `resource` parameter (RFC 8707), mapped through
+    #      `config.oauth.resource_audiences` ({ "https://app.example/mcp" =>
+    #      "mcp" }); compared with the trailing slash removed. With no mapping
+    #      configured the parameter is ignored (MCP clients send it on every
+    #      request, and a host relying on the client default below must still
+    #      get that default). With a mapping, an unmapped resource is refused
+    #      with `invalid_target` (RFC 8707 §2), never silently issued without
+    #      an audience.
+    #   4. The client's registered default, `metadata["audience"]` — the
+    #      convention every dynamic-registration operation in the estate
+    #      stamps, and the reason each app carried an authorize shim.
+    #
+    # Nil when none of these apply: audience stays optional at /authorize.
+    module AudienceResolver
+      module_function
+
+      def resolve(client:, params:, request: nil)
+        requested = params[:audience].presence
+        resource = params[:resource].presence
+
+        custom = StandardId.config.oauth.audience_resolver
+        if custom.respond_to?(:call)
+          context = { client: client, audience: requested, resource: resource, request: request }
+          answer = custom.call(**StandardId::Utils::CallableParameterFilter.filter(custom, context))
+          return coerce_hook_answer(answer) unless answer.nil?
+        end
+
+        return requested.to_s if requested
+        return from_resource(resource) if resource && resource_mapping.any?
+
+        client_default(client)
+      end
+
+      # @raise [StandardId::InvalidTargetError] when a mapping is configured
+      #   and this resource is not in it
+      def from_resource(resource)
+        key = normalize_resource(resource)
+        resource_mapping.each do |candidate, audience|
+          return audience.to_s if normalize_resource(candidate) == key
+        end
+
+        raise StandardId::InvalidTargetError, "The resource parameter is not a resource this server issues tokens for"
+      end
+
+      def resource_mapping
+        StandardId.config.oauth.resource_audiences || {}
+      end
+
+      # The hook's contract is "nil falls through, anything else is the
+      # audience". A String or Symbol is it; a blank string is treated as "no
+      # audience" (the hook decided, and decided none). Anything else is a
+      # programming error worth failing loudly on rather than stringifying.
+      def coerce_hook_answer(answer)
+        case answer
+        when String, Symbol then answer.to_s.presence
+        else
+          raise StandardId::ConfigurationError,
+            "StandardId config: `oauth.audience_resolver` must return a String, Symbol or nil, got #{answer.class}"
+        end
+      end
+
+      def client_default(client)
+        return nil if client.nil?
+
+        metadata = client.respond_to?(:metadata) ? client.metadata : nil
+        value = metadata.is_a?(Hash) ? (metadata["audience"] || metadata[:audience]) : nil
+        value.presence&.to_s
+      end
+
+      def normalize_resource(value)
+        value.to_s.strip.delete_suffix("/")
+      end
+    end
+  end
+end

data/lib/standard_id/oauth/authorization_code_authorization_flow.rb

@@ -7,7 +7,7 @@ module StandardId
       # TokenGrantFlow#validate_audience! already no-ops when audience is blank or
       # when no allowed_audiences are configured, so omitting it is safe and lets
       # standards-compliant clients (e.g. MCP) authorize without it.
-      permit_params :audience, :scope, :redirect_uri, :state, :connection, :prompt, :organization, :invitation, :code_challenge, :code_challenge_method, :nonce
+      permit_params :audience, :resource, :scope, :redirect_uri, :state, :connection, :prompt, :organization, :invitation, :code_challenge, :code_challenge_method, :nonce
 
       private
 

data/lib/standard_id/oauth/authorization_code_flow.rb

@@ -2,7 +2,9 @@ module StandardId
   module Oauth
     class AuthorizationCodeFlow < TokenGrantFlow
       expect_params :client_id, :code
-      permit_params :client_secret, :redirect_uri, :code_verifier
+      # `resource` (RFC 8707) is accepted so a client that repeats it at the
+      # token endpoint is not refused; the audience was bound at /authorize.
+      permit_params :client_secret, :redirect_uri, :code_verifier, :resource
 
       def authenticate!
         @client = StandardId::ClientApplication.find_by(client_id: params[:client_id])

data/lib/standard_id/oauth/authorization_flow.rb

@@ -22,6 +22,7 @@ module StandardId
       def execute
         validate_params!
         authenticate_client!
+        enforce_audience_scopes!
         generate_authorization_response
       end
 
@@ -95,8 +96,27 @@ module StandardId
         params[:scope]
       end
 
+      # Resolved once, after the client is known (see AudienceResolver): the
+      # `audience` param, the RFC 8707 `resource`, or the client's registered
+      # default. Bound to the authorization code and carried to the token.
       def audience
-        params[:audience]
+        return @audience if defined?(@audience)
+
+        @audience = StandardId::Oauth::AudienceResolver.resolve(client: @client, params: params, request: request)
+      end
+
+      def resource
+        params[:resource]
+      end
+
+      # `oauth.audience_scopes` is the vocabulary an audience may be asked for;
+      # until now it was only ever consulted by hosts' own shims. A request for
+      # a scope outside it is refused here, at /authorize, before anything is
+      # issued. Unconfigured audiences (or no scope) pass through.
+      def enforce_audience_scopes!
+        return if audience.blank? || scope.blank?
+
+        StandardId::Oauth::AudienceScopeResolver.assert!(requested: scope, audience: audience, client: @client)
       end
     end
   end