standard_id 0.48.0 → 0.49.0

data/lib/standard_id/token_minter.rb

@@ -0,0 +1,74 @@
+module StandardId
+  # Mint an access token (and optionally a refresh token) for an account the
+  # host has already authenticated, through the same pipeline /oauth/token
+  # uses — so the claims, the audience → profile binding, the account-status
+  # guards and the OAUTH_TOKEN_ISSUING / OAUTH_TOKEN_ISSUED events are the ones
+  # every other token gets, instead of a hand-rolled JwtService.encode that
+  # re-derives the initializer's claim resolvers by hand.
+  #
+  #   result = StandardId::TokenMinter.mint(
+  #     account: account,
+  #     audience: "harness",
+  #     scopes: "profile permissions",
+  #     grant_type: "harness.mint",       # free-form; lands in the JWT and the audit event
+  #     claims: { permissions: scopes },  # host extras; reserved keys are dropped
+  #     expires_in: 60.minutes
+  #   )
+  #   result.access_token  # the JWT
+  #   result.jti           # what OAUTH_TOKEN_ISSUED carried
+  #
+  # What runs, in order: audience validation (oauth.allowed_audiences),
+  # audience → profile binding (oauth.audience_profile_types, fail-closed),
+  # OAUTH_TOKEN_ISSUING (AccountStatus / AccountLocking refuse here),
+  # scope_claims + claim_resolvers and custom_claims, then the host's own
+  # +claims+, then OAUTH_TOKEN_ISSUED. A refresh token is persisted only when
+  # +refresh_token: true+, bound to +client_id+'s ClientApplication when that
+  # names one. Pass +request:+ to let config.session.session_type_resolver
+  # materialise a session; without it the mint is sessionless.
+  #
+  # Raises the same errors the token endpoint would (InvalidGrantError,
+  # InvalidRequestError, NoBoundProfileError, AccountDeactivatedError, …).
+  module TokenMinter
+    Result = Data.define(:access_token, :refresh_token, :token_type, :expires_in, :scope, :jti)
+
+    module_function
+
+    # @param account [ActiveRecord::Base] a persisted account
+    # @param audience [String, Array<String>] the `aud` claim
+    # @param grant_type [String] recorded in the JWT and the audit events
+    # @param scopes [String, Array<String>, nil] the `scope` claim and the key
+    #   into oauth.scope_claims
+    # @param client_id [String, nil] the `client_id` claim; a registered
+    #   ClientApplication's id binds the refresh token to it
+    # @param claims [Hash] extra claims merged last (reserved keys dropped)
+    # @param expires_in [Integer, ActiveSupport::Duration, nil] access-token
+    #   lifetime; default is oauth.token_lifetimes[grant_type] or
+    #   oauth.default_token_lifetime
+    # @param refresh_token [Boolean] also persist and return a refresh token;
+    #   requires +client_id+, which the refresh grant matches on redemption
+    # @param request [ActionDispatch::Request, nil] lets session_type_resolver
+    #   persist a session; resolvers see `request: nil` without it
+    # @param auth_method [Symbol, String, nil] how the host authenticated the
+    #   account, recorded on the refresh token for login_method_policy; nil is
+    #   judged as :unspecified on refresh, which a restrictive policy refuses
+    # @param auth_provider [String, nil]
+    # @return [Result]
+    def mint(account:, audience:, grant_type:, scopes: nil, client_id: nil, claims: {}, expires_in: nil,
+      refresh_token: false, request: nil, auth_method: nil, auth_provider: nil)
+      flow = StandardId::Oauth::DirectMintFlow.new(
+        account: account, audience: audience, grant_type: grant_type, scopes: scopes, client_id: client_id,
+        claims: claims, expires_in: expires_in, refresh_token: refresh_token, request: request,
+        auth_method: auth_method, auth_provider: auth_provider
+      )
+      response = flow.execute
+      Result.new(
+        access_token: response[:access_token],
+        refresh_token: response[:refresh_token],
+        token_type: response[:token_type],
+        expires_in: response[:expires_in],
+        scope: response[:scope],
+        jti: flow.issued_jti
+      )
+    end
+  end
+end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.48.0"
+  VERSION = "0.49.0"
 end

data/lib/standard_id.rb

@@ -38,6 +38,7 @@ require "standard_id/auth_lineage"
 require "standard_id/account_cleanup"
 require "standard_id/oauth/audience_profile_resolver"
 require "standard_id/oauth/audience_scope_resolver"
+require "standard_id/oauth/audience_resolver"
 require "standard_id/oauth/base_request_flow"
 require "standard_id/oauth/token_lifetime_resolver"
 require "standard_id/oauth/oauth_session_persistence"
@@ -47,6 +48,8 @@ require "standard_id/oauth/authorization_code_flow"
 require "standard_id/oauth/password_flow"
 require "standard_id/oauth/refresh_token_flow"
 require "standard_id/oauth/social_flow"
+require "standard_id/oauth/direct_mint_flow"
+require "standard_id/token_minter"
 require "standard_id/oauth/authorization_flow"
 require "standard_id/oauth/authorization_code_authorization_flow"
 require "standard_id/oauth/implicit_authorization_flow"
@@ -57,6 +60,7 @@ require "standard_id/oauth/passwordless_otp_flow"
 require "standard_id/oauth/discovery_resolver"
 require "standard_id/oauth/grant_types"
 require "standard_id/oauth/discovery_document"
+require "standard_id/oauth/protected_resource_document"
 require "standard_id/routing"
 require "standard_id/oauth/consent_payload"
 require "standard_id/oauth/client_registration"

data/lib/tasks/standard_id_tasks.rake

@@ -39,8 +39,15 @@ namespace :standard_id do
       )
     end
 
+    desc "Delete dynamically registered clients that were deregistered, or never authorized, more than GRACE_DAYS ago (default 7)"
+    task dynamic_clients: :environment do
+      StandardId::PurgeStaleDynamicClientsJob.perform_now(
+        stale_after_seconds: StandardId::RakeHelpers.grace_period_seconds
+      )
+    end
+
     desc "Run all StandardId cleanup jobs with GRACE_DAYS (default 7)"
-    task all: [:sessions, :refresh_tokens, :authorization_codes, :code_challenges]
+    task all: [:sessions, :refresh_tokens, :authorization_codes, :code_challenges, :dynamic_clients]
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.48.0
+  version: 0.49.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -123,6 +123,7 @@ files:
 - app/controllers/concerns/standard_id/passwordless_flow.rb
 - app/controllers/concerns/standard_id/passwordless_strategy.rb
 - app/controllers/concerns/standard_id/rate_limit_handling.rb
+- app/controllers/concerns/standard_id/resource_server.rb
 - app/controllers/concerns/standard_id/sentry_context.rb
 - app/controllers/concerns/standard_id/set_current_request_details.rb
 - app/controllers/concerns/standard_id/social_authentication.rb
@@ -143,6 +144,7 @@ files:
 - app/controllers/standard_id/api/userinfo_controller.rb
 - app/controllers/standard_id/api/well_known/jwks_controller.rb
 - app/controllers/standard_id/api/well_known/oauth_authorization_server_controller.rb
+- app/controllers/standard_id/api/well_known/oauth_protected_resource_controller.rb
 - app/controllers/standard_id/api/well_known/openid_configuration_controller.rb
 - app/controllers/standard_id/web/account_controller.rb
 - app/controllers/standard_id/web/auth/callback/providers_controller.rb
@@ -172,6 +174,7 @@ files:
 - app/jobs/standard_id/cleanup_expired_refresh_tokens_job.rb
 - app/jobs/standard_id/cleanup_expired_sessions_job.rb
 - app/jobs/standard_id/password_reset_delivery_job.rb
+- app/jobs/standard_id/purge_stale_dynamic_clients_job.rb
 - app/jobs/standard_id/secure_mail_delivery_job.rb
 - app/mailers/standard_id/application_mailer.rb
 - app/mailers/standard_id/password_reset_mailer.rb
@@ -239,6 +242,7 @@ files:
 - db/migrate/20261002000000_create_standard_id_social_identities.rb
 - db/migrate/20261004000000_add_auth_method_to_standard_id_refresh_tokens.rb
 - db/migrate/20261020000000_add_client_application_id_to_standard_id_refresh_tokens.rb
+- db/migrate/20261020120000_add_registration_access_token_digest_to_standard_id_client_applications.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/standard_id.rb
@@ -278,6 +282,7 @@ files:
 - lib/standard_id/migration_check.rb
 - lib/standard_id/migration_helpers.rb
 - lib/standard_id/oauth/audience_profile_resolver.rb
+- lib/standard_id/oauth/audience_resolver.rb
 - lib/standard_id/oauth/audience_scope_resolver.rb
 - lib/standard_id/oauth/authorization_code_authorization_flow.rb
 - lib/standard_id/oauth/authorization_code_flow.rb
@@ -286,6 +291,7 @@ files:
 - lib/standard_id/oauth/client_credentials_flow.rb
 - lib/standard_id/oauth/client_registration.rb
 - lib/standard_id/oauth/consent_payload.rb
+- lib/standard_id/oauth/direct_mint_flow.rb
 - lib/standard_id/oauth/discovery_document.rb
 - lib/standard_id/oauth/discovery_resolver.rb
 - lib/standard_id/oauth/grant_types.rb
@@ -293,6 +299,7 @@ files:
 - lib/standard_id/oauth/oauth_session_persistence.rb
 - lib/standard_id/oauth/password_flow.rb
 - lib/standard_id/oauth/passwordless_otp_flow.rb
+- lib/standard_id/oauth/protected_resource_document.rb
 - lib/standard_id/oauth/refresh_token_flow.rb
 - lib/standard_id/oauth/social_flow.rb
 - lib/standard_id/oauth/subflows/base.rb
@@ -324,6 +331,7 @@ files:
 - lib/standard_id/testing/factory_bot.rb
 - lib/standard_id/testing/provider_examples.rb
 - lib/standard_id/testing/request_helpers.rb
+- lib/standard_id/token_minter.rb
 - lib/standard_id/utils/callable_parameter_filter.rb
 - lib/standard_id/utils/ip_normalizer.rb
 - lib/standard_id/version.rb