standard_id 0.49.0 → 0.49.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 960b6bdf3cc6fd613e1f3cdb6a172f9b30fb42f2c215174787f7858f0c532075
-  data.tar.gz: 654fde0c77971e868578805a3d033909adbe49da8006ca1f1174110975e2b255
+  metadata.gz: 8b5e02f9651266077753a98125e3772a99bd2cf935da68d17f98df4bfd59505e
+  data.tar.gz: e703964c3b6c2c0ffd10a5475f370c9dea0f6f4873fd6827606ee9869a12726d
 SHA512:
-  metadata.gz: f5a099d1243e7ac19872b907c402937941a3718efec2caffa7fc75af717893bc6b685671d528929e99c658bc08187cb58d776fc36c744978190f1c850bf5c457
-  data.tar.gz: db01eff1f65d191da0166de6f09def5231d88a9675d6240efd0d2c0eddd02b91553b2aad9f1d062d026fccfcf9d17ee1ffca4e04c2b6e1cfe4b627229d8a56be
+  metadata.gz: 4091588b0c3b2cc3f06c25682e840cb2a1293a94d67abaf25eb81cce6331fe7a8325aea577fd69ceb5405c09dd0aa39fc0e70ed17df493a92da566fd8da10343
+  data.tar.gz: a10b76363a599b3c5fc29681665f8a20d564476cb6682a32c8555f4e2464945f41e0ccfcc7897db8c65df57483f8be3b927294282121d47bbc3226564e3dc0b2

data/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.49.1] - 2026-10-20
+
+### Fixed
+
+- **Dynamic registration refuses non-https redirect URIs** (`invalid_redirect_uri`): https, or http only on a loopback host (RFC 8252 §7.3), and at most 10 entries — the rules every consumer's own registration operation enforced and the gem's model (which also serves operator-registered clients) does not. Applies to RFC 7592 updates too.
+- **A refused registration no longer leaves an owner row behind**: the `dynamic_registration_owner` callable now runs inside the registration transaction, so a host creating a per-registration owner record gets it rolled back when the client is invalid.
+- **`StandardId::ResourceServer`'s scope check defers to the auth layer**: with no session (the action skipped `verify_access_token!`, e.g. a 405 responder) it no longer raises `NotAuthenticatedError` itself, matching `AudienceVerification`.
+
 ## [0.49.0] - 2026-10-20
 
 ### Added

data/app/controllers/concerns/standard_id/resource_server.rb

@@ -81,8 +81,12 @@ module StandardId
         raise(StandardId::ConfigurationError, "#{self.class.name} includes StandardId::ResourceServer but never called protected_resource")
     end
 
+    # Like verify_audience!: without a session there is nothing to check, and
+    # either the auth layer is answering the 401 or the action skipped
+    # verify_access_token! on purpose (a 405 responder, say).
     def verify_protected_resource_scopes!
       return if _protected_resource_scopes.empty?
+      return unless current_session
 
       require_scopes!(*_protected_resource_scopes)
     end

data/lib/standard_id/oauth/client_registration.rb

@@ -37,6 +37,8 @@ module StandardId
       # Keys `config.oauth.dynamic_registration_attributes` may pin.
       PINNABLE_ATTRIBUTES = %w[scopes metadata access_token_lifetime authorization_code_lifetime require_consent description].freeze
       REGISTRATION_ACCESS_TOKEN_BYTES = 32
+      # A self-registered client gets a handful of callbacks, not a list.
+      MAX_REDIRECT_URIS = 10
 
       # Minimal result object mirroring the gem's `result.success?` /
       # `result.value` convention. `client_secret` is the one-time plaintext for
@@ -88,18 +90,23 @@ module StandardId
         client
       end
 
+      # Everything, the owner resolver included, runs inside one transaction:
+      # a host whose resolver creates a per-registration owner row must not be
+      # left with that row when the client itself is refused.
       def call
-        attrs = mapped_attributes
+        validate_redirect_uris!
         registration_access_token = nil
-        if StandardId::ClientApplication.registration_management_column?
-          registration_access_token = SecureRandom.urlsafe_base64(REGISTRATION_ACCESS_TOKEN_BYTES)
-          attrs[:registration_access_token_digest] =
-            StandardId::ClientApplication.digest_registration_access_token(registration_access_token)
-        end
-        client = StandardId::ClientApplication.new(attrs)
-
         secret_plaintext = nil
+        client = nil
+
         StandardId::ClientApplication.transaction do
+          attrs = mapped_attributes
+          if StandardId::ClientApplication.registration_management_column?
+            registration_access_token = SecureRandom.urlsafe_base64(REGISTRATION_ACCESS_TOKEN_BYTES)
+            attrs[:registration_access_token_digest] =
+              StandardId::ClientApplication.digest_registration_access_token(registration_access_token)
+          end
+          client = StandardId::ClientApplication.new(attrs)
           client.save!
           if client.confidential?
             secret_plaintext = SecureRandom.hex(32)
@@ -117,6 +124,7 @@ module StandardId
       end
 
       def update(client)
+        validate_redirect_uris!
         if metadata[:client_id].present? && metadata[:client_id].to_s != client.client_id
           raise StandardId::InvalidClientMetadataError, "client_id does not match the client being updated"
         end
@@ -191,7 +199,34 @@ module StandardId
       # the model and let its redirect-uri validation surface an invalid_redirect_uri
       # error — keeping a single source of truth for URI rules.
       def redirect_uris
-        Array(metadata[:redirect_uris]).map { |u| u.to_s.strip }.reject(&:blank?).join(" ")
+        redirect_uri_list.join(" ")
+      end
+
+      def redirect_uri_list
+        value = metadata[:redirect_uris]
+        list = value.is_a?(Array) ? value : value.to_s.split(/\s+/)
+        list.map { |u| u.to_s.strip }.reject(&:blank?)
+      end
+
+      # What the model does not enforce for a client an operator registers by
+      # hand, but a self-registering client must meet: https, or http only on a
+      # loopback host (RFC 8252 §7.3, for native apps on an ephemeral port), and
+      # a bounded list. Absent or empty is left to the model's presence check.
+      def validate_redirect_uris!
+        list = redirect_uri_list
+        return if list.empty?
+
+        if list.size > MAX_REDIRECT_URIS
+          raise StandardId::InvalidRedirectUriError, "redirect_uris must not contain more than #{MAX_REDIRECT_URIS} entries"
+        end
+
+        list.each do |uri|
+          parsed = StandardId::ClientApplication.parse_redirect_uri(uri)
+          next if parsed && (parsed.scheme == "https" || StandardId::ClientApplication.loopback_redirect_uri?(parsed))
+
+          raise StandardId::InvalidRedirectUriError,
+            "redirect_uri #{uri.inspect} must use https (http is allowed only for loopback hosts)"
+        end
       end
 
       def client_name

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.49.0"
+  VERSION = "0.49.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.49.0
+  version: 0.49.1
 platform: ruby
 authors:
 - Jaryl Sim