standard_id 0.49.0 → 0.50.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 960b6bdf3cc6fd613e1f3cdb6a172f9b30fb42f2c215174787f7858f0c532075
-  data.tar.gz: 654fde0c77971e868578805a3d033909adbe49da8006ca1f1174110975e2b255
+  metadata.gz: f6f93f66f3e1a4d95ac6effab590e560e39f2993dd072010676a3121efec6098
+  data.tar.gz: 6934ab15f5b9c394db6d15eb37ca91d41965421589553135c2a05fea1ebbf551
 SHA512:
-  metadata.gz: f5a099d1243e7ac19872b907c402937941a3718efec2caffa7fc75af717893bc6b685671d528929e99c658bc08187cb58d776fc36c744978190f1c850bf5c457
-  data.tar.gz: db01eff1f65d191da0166de6f09def5231d88a9675d6240efd0d2c0eddd02b91553b2aad9f1d062d026fccfcf9d17ee1ffca4e04c2b6e1cfe4b627229d8a56be
+  metadata.gz: 73eab42991c65471c2f77d7be554b4ec1d002eacb73e62d8d77bc79003b5121f4b64bd9750ce8991113ff451556313f54165cfd75b642501251dcb947c0f3900
+  data.tar.gz: 6a0b2b9e4628842eb1ab6d56acf348c829abc083a00e29671c3efadca5dc57e56aa63d958577c884a7ca224f6e768aebedc66755d5c1128912fe4ef1d9eed576

data/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.50.0] - 2026-10-20
+
+### Changed
+
+- **`AudienceResolver`: the client's registered `metadata["audience"]` now outranks the `audience` parameter.** The registered default is set by the server (`dynamic_registration_attributes`) or an operator; letting the request's `audience` beat it meant an openly registered client could ask `/authorize` for another allowed audience, which every consumer's shim had prevented by stripping the parameter. New order: `audience_resolver` hook → registered default → `audience` param → RFC 8707 `resource`. Hosts that set `audience_resolver` to return the registered default are unaffected; a client with no registered default behaves as before.
+
+### Added
+
+- **`c.oauth.authorize_scope_resolver`**: normalise the requested scope at `/authorize` once the client and audience are known and before `audience_scopes` is enforced — collapse a hierarchy, narrow to what the audience consumes, append a default. Callable `(scope:, audience:, client:, request:)` returning a String, Array or nil (unchanged); the answer is what the code is issued with and what consent shows. Validated at boot.
+
+## [0.49.1] - 2026-10-20
+
+### Fixed
+
+- **Dynamic registration refuses non-https redirect URIs** (`invalid_redirect_uri`): https, or http only on a loopback host (RFC 8252 §7.3), and at most 10 entries — the rules every consumer's own registration operation enforced and the gem's model (which also serves operator-registered clients) does not. Applies to RFC 7592 updates too.
+- **A refused registration no longer leaves an owner row behind**: the `dynamic_registration_owner` callable now runs inside the registration transaction, so a host creating a per-registration owner record gets it rolled back when the client is invalid.
+- **`StandardId::ResourceServer`'s scope check defers to the auth layer**: with no session (the action skipped `verify_access_token!`, e.g. a 405 responder) it no longer raises `NotAuthenticatedError` itself, matching `AudienceVerification`.
+
 ## [0.49.0] - 2026-10-20
 
 ### Added

data/README.md

@@ -1367,9 +1367,9 @@ redirect_to "/api/authorize?" + {
 
 **Which audience is the token for?** `/authorize` resolves it server-side
 (`StandardId::Oauth::AudienceResolver`), in this order: `config.oauth.audience_resolver`
-when set; the `audience` parameter; the RFC 8707 `resource` parameter mapped through
-`config.oauth.resource_audiences`; the client's registered default
-`metadata["audience"]`. The result is bound to the authorization code and reaches
+when set; the client's registered default `metadata["audience"]` (server-set, so it
+outranks the request); the `audience` parameter; the RFC 8707 `resource` parameter
+mapped through `config.oauth.resource_audiences`. The result is bound to the authorization code and reaches
 the token as `aud`, and `config.oauth.audience_scopes` is enforced for it at
 `/authorize` (a scope outside the audience's vocabulary is `invalid_scope`). So a
 dynamically registered MCP client whose registration stamps
@@ -1378,10 +1378,28 @@ in front of the endpoint. The `resource` parameter is ignored until
 `resource_audiences` is set; once it is, an unmapped resource is `invalid_target`
 (RFC 8707 §2).
 
-A client-supplied `audience` still outranks the registered default, so
-`audience_scopes` enforcement is only as strong as `config.oauth.allowed_audiences`
-at the token endpoint. A host that wants the registered default to be the only
-answer sets `audience_resolver` to `->(client:) { client.metadata["audience"] }`.
+For a client with no registered default, a client-supplied `audience` is taken as
+is, so `audience_scopes` enforcement for such clients is only as strong as
+`config.oauth.allowed_audiences` at the token endpoint.
+
+**Which scope?** `config.oauth.authorize_scope_resolver` normalises the requested
+scope once the client and audience are known and before `audience_scopes` is
+enforced — collapse a hierarchy, narrow to what the audience consumes, append a
+default — and its answer is what the code is issued with and the consent screen
+shows:
+
+```ruby
+config.oauth.authorize_scope_resolver = ->(scope:, audience:) {
+  tokens = scope.to_s.split
+  next nil unless audience == "mcp" && tokens.include?("mcp")   # nil leaves the request as is
+
+  tokens - ["mcp:read"]   # "mcp" already implies read; an Array or a String is fine
+}
+```
+
+It runs again when a consent resumes, so make it idempotent (its own output must
+come back unchanged); it also decides what the consent screen shows and what the
+grant records.
 
 ```ruby
 StandardId.configure do |config|

data/app/controllers/concerns/standard_id/resource_server.rb

@@ -81,8 +81,12 @@ module StandardId
         raise(StandardId::ConfigurationError, "#{self.class.name} includes StandardId::ResourceServer but never called protected_resource")
     end
 
+    # Like verify_audience!: without a session there is nothing to check, and
+    # either the auth layer is answering the 401 or the action skipped
+    # verify_access_token! on purpose (a 405 responder, say).
     def verify_protected_resource_scopes!
       return if _protected_resource_scopes.empty?
+      return unless current_session
 
       require_scopes!(*_protected_resource_scopes)
     end

data/app/controllers/standard_id/api/authorization_controller.rb

@@ -74,7 +74,7 @@ module StandardId
         !StandardId::ClientGrant.granted?(
           account: current_account,
           client_id: client.client_id,
-          requested_scope: params[:scope]
+          requested_scope: consent_scope
         )
       end
 
@@ -82,6 +82,21 @@ module StandardId
         @consent_client ||= StandardId::ClientApplication.active.find_by(client_id: params[:client_id])
       end
 
+      # The scope consent is checked against, shown and recorded: the request's,
+      # normalised by `oauth.authorize_scope_resolver` exactly as the flow will
+      # normalise it when the code is issued, so the screen and the grant never
+      # disagree with the token. Needs the client and the resolved audience, so
+      # it is computed here rather than inside the flow.
+      def consent_scope
+        return @consent_scope if defined?(@consent_scope)
+
+        client = consent_client
+        audience = StandardId::Oauth::AudienceResolver.resolve(client: client, params: params, request: request)
+        @consent_scope = StandardId::Oauth::AuthorizeScopeResolver.resolve(
+          scope: params[:scope], audience: audience, client: client, request: request
+        )
+      end
+
       def redirect_to_consent
         payload = StandardId::Oauth::ConsentPayload.encode(authorize_params_for_resume)
         base = StandardId.config.login_url.present? ? consent_base_from_login_url : "/consent"
@@ -98,13 +113,14 @@ module StandardId
 
       # The exact params required to resume authorization-code issuance after
       # approval. Carried through a signed payload so they cannot be tampered
-      # with; redirect_uri + PKCE are revalidated when the flow re-runs.
+      # with; redirect_uri + PKCE are revalidated when the flow re-runs. The
+      # scope is the normalised one the user is shown (see #consent_scope).
       def authorize_params_for_resume
         {
           response_type: response_type,
           client_id: params[:client_id],
           redirect_uri: params[:redirect_uri],
-          scope: params[:scope],
+          scope: consent_scope,
           audience: params[:audience],
           resource: params[:resource],
           state: params[:state],

data/lib/standard_id/config/callable_validator.rb

@@ -61,6 +61,11 @@ module StandardId
           kind: :keyword,
           keywords: %i[metadata request]
         },
+        "oauth.authorize_scope_resolver" => {
+          signature: "(scope:, audience:, client:, request:)",
+          kind: :keyword,
+          keywords: %i[scope audience client request]
+        },
         "oauth.audience_scope_resolver" => {
           signature: "(audience:, client:, configured_scopes:)",
           kind: :keyword,

data/lib/standard_id/config/schema.rb

@@ -421,13 +421,31 @@ StandardId::ConfigSchema.define do
     # instead of trusting a client-supplied `audience` alone. Resolution order
     # (StandardId::Oauth::AudienceResolver): this callable when set (any
     # subset of client:, audience:, resource:, request:; a non-nil answer is
-    # final), else the `audience` param, else the RFC 8707 `resource` param
-    # mapped through `resource_audiences`, else the client's registered
-    # default `metadata["audience"]`. The resolved audience is bound to the
-    # authorization code and reaches the token as `aud`; `audience_scopes`
+    # final), else the client's registered default `metadata["audience"]`
+    # (server-set, so it outranks the request), else the `audience` param,
+    # else the RFC 8707 `resource` param mapped through `resource_audiences`.
+    # The resolved audience is bound to the authorization code and reaches the
+    # token as `aud`; `audience_scopes`
     # (above) is then enforced at /authorize for it.
     field :audience_resolver, type: :any, default: nil
 
+    # Normalise the scope an /authorize request asks for, once the client and
+    # audience are known and before `audience_scopes` is enforced — the place
+    # for what hosts used to do in a shim: collapse a hierarchy ("mcp mcp:read"
+    # → "mcp"), narrow a request to what the chosen audience consumes, append
+    # a default. A callable taking any subset of `scope:` (the raw param),
+    # `audience:` (resolved), `client:` and `request:`; returns the scope as a
+    # String or Array, or nil to leave the request unchanged. The result is
+    # what the code is issued with, what the consent screen shows and what the
+    # grant is checked against and recorded as. It runs again on the consent
+    # resume, so it must be idempotent (its own output must come back unchanged).
+    #
+    #   c.oauth.authorize_scope_resolver = ->(scope:, audience:) {
+    #     tokens = scope.to_s.split
+    #     audience == "mcp" && tokens.include?("mcp") ? tokens - ["mcp:read"] : nil
+    #   }
+    field :authorize_scope_resolver, type: :any, default: nil
+
     # RFC 8707: resource indicator → audience, e.g.
     # { "https://app.example.com/mcp" => "mcp" }. Matched with the trailing
     # slash removed. Empty (the default) means the `resource` parameter is

data/lib/standard_id/oauth/audience_resolver.rb

@@ -9,9 +9,14 @@ module StandardId
     #      subset of `client:`, `audience:` (the raw param), `resource:` (the
     #      RFC 8707 param) and `request:`. A non-nil answer is final; nil
     #      falls through to the defaults below.
-    #   2. The `audience` parameter, when present (what hosts' shims inject
-    #      today, so nothing changes for them).
-    #   3. The `resource` parameter (RFC 8707), mapped through
+    #   2. The client's registered default, `metadata["audience"]` — set by the
+    #      server at registration (`dynamic_registration_attributes`) or by an
+    #      operator, so it is the one input here the client did not choose, and
+    #      it outranks what the request says (0.50.0; before that the
+    #      `audience` parameter came first, which let an openly registered
+    #      client ask for another allowed audience).
+    #   3. The `audience` parameter, when present.
+    #   4. The `resource` parameter (RFC 8707), mapped through
     #      `config.oauth.resource_audiences` ({ "https://app.example/mcp" =>
     #      "mcp" }); compared with the trailing slash removed. With no mapping
     #      configured the parameter is ignored (MCP clients send it on every
@@ -19,9 +24,6 @@ module StandardId
     #      get that default). With a mapping, an unmapped resource is refused
     #      with `invalid_target` (RFC 8707 §2), never silently issued without
     #      an audience.
-    #   4. The client's registered default, `metadata["audience"]` — the
-    #      convention every dynamic-registration operation in the estate
-    #      stamps, and the reason each app carried an authorize shim.
     #
     # Nil when none of these apply: audience stays optional at /authorize.
     module AudienceResolver
@@ -38,10 +40,12 @@ module StandardId
           return coerce_hook_answer(answer) unless answer.nil?
         end
 
+        registered = client_default(client)
+        return registered if registered
         return requested.to_s if requested
         return from_resource(resource) if resource && resource_mapping.any?
 
-        client_default(client)
+        nil
       end
 
       # @raise [StandardId::InvalidTargetError] when a mapping is configured

data/lib/standard_id/oauth/authorization_flow.rb

@@ -92,8 +92,19 @@ module StandardId
         params[:state]
       end
 
+      # The requested scope, normalised by `oauth.authorize_scope_resolver`
+      # when set (a host that collapses a scope hierarchy, or narrows a
+      # request to what the chosen audience consumes, does it here instead of
+      # in a shim in front of this endpoint). Resolved once, after the client
+      # and audience are known; nil from the hook leaves the request as is.
       def scope
-        params[:scope]
+        return @scope if defined?(@scope)
+
+        @scope = resolve_scope(params[:scope])
+      end
+
+      def resolve_scope(requested)
+        StandardId::Oauth::AuthorizeScopeResolver.resolve(scope: requested, audience: audience, client: @client, request: request)
       end
 
       # Resolved once, after the client is known (see AudienceResolver): the

data/lib/standard_id/oauth/authorize_scope_resolver.rb

@@ -0,0 +1,36 @@
+module StandardId
+  module Oauth
+    # Applies `config.oauth.authorize_scope_resolver` to an /authorize request's
+    # scope once the client and audience are known. Shared by the authorize
+    # flows (what the code is issued with) and the consent gate (what the user
+    # is shown, what the grant is checked against and recorded as), so the two
+    # cannot disagree.
+    #
+    # The consent resume re-runs the flow with the already-normalised scope, so
+    # a resolver must be idempotent: applying it to its own output must change
+    # nothing. Collapsing, filtering and appending a default all are; an
+    # append that does not check for presence is not (the Array/String output
+    # is de-duplicated, which covers the common case).
+    module AuthorizeScopeResolver
+      module_function
+
+      # @return [String, nil] the normalised scope (nil/blank in → nil/blank out
+      #   unless the resolver answers)
+      def resolve(scope:, audience:, client:, request: nil)
+        custom = StandardId.config.oauth.authorize_scope_resolver
+        return scope unless custom.respond_to?(:call)
+
+        context = { scope: scope, audience: audience, client: client, request: request }
+        answer = custom.call(**StandardId::Utils::CallableParameterFilter.filter(custom, context))
+        case answer
+        when nil then scope
+        when Array then answer.map(&:to_s).reject(&:blank?).uniq.join(" ")
+        when String, Symbol then answer.to_s.split.uniq.join(" ")
+        else
+          raise StandardId::ConfigurationError,
+            "StandardId config: `oauth.authorize_scope_resolver` must return a String, Array, Symbol or nil, got #{answer.class}"
+        end
+      end
+    end
+  end
+end

data/lib/standard_id/oauth/client_registration.rb

@@ -37,6 +37,8 @@ module StandardId
       # Keys `config.oauth.dynamic_registration_attributes` may pin.
       PINNABLE_ATTRIBUTES = %w[scopes metadata access_token_lifetime authorization_code_lifetime require_consent description].freeze
       REGISTRATION_ACCESS_TOKEN_BYTES = 32
+      # A self-registered client gets a handful of callbacks, not a list.
+      MAX_REDIRECT_URIS = 10
 
       # Minimal result object mirroring the gem's `result.success?` /
       # `result.value` convention. `client_secret` is the one-time plaintext for
@@ -88,18 +90,23 @@ module StandardId
         client
       end
 
+      # Everything, the owner resolver included, runs inside one transaction:
+      # a host whose resolver creates a per-registration owner row must not be
+      # left with that row when the client itself is refused.
       def call
-        attrs = mapped_attributes
+        validate_redirect_uris!
         registration_access_token = nil
-        if StandardId::ClientApplication.registration_management_column?
-          registration_access_token = SecureRandom.urlsafe_base64(REGISTRATION_ACCESS_TOKEN_BYTES)
-          attrs[:registration_access_token_digest] =
-            StandardId::ClientApplication.digest_registration_access_token(registration_access_token)
-        end
-        client = StandardId::ClientApplication.new(attrs)
-
         secret_plaintext = nil
+        client = nil
+
         StandardId::ClientApplication.transaction do
+          attrs = mapped_attributes
+          if StandardId::ClientApplication.registration_management_column?
+            registration_access_token = SecureRandom.urlsafe_base64(REGISTRATION_ACCESS_TOKEN_BYTES)
+            attrs[:registration_access_token_digest] =
+              StandardId::ClientApplication.digest_registration_access_token(registration_access_token)
+          end
+          client = StandardId::ClientApplication.new(attrs)
           client.save!
           if client.confidential?
             secret_plaintext = SecureRandom.hex(32)
@@ -117,6 +124,7 @@ module StandardId
       end
 
       def update(client)
+        validate_redirect_uris!
         if metadata[:client_id].present? && metadata[:client_id].to_s != client.client_id
           raise StandardId::InvalidClientMetadataError, "client_id does not match the client being updated"
         end
@@ -191,7 +199,34 @@ module StandardId
       # the model and let its redirect-uri validation surface an invalid_redirect_uri
       # error — keeping a single source of truth for URI rules.
       def redirect_uris
-        Array(metadata[:redirect_uris]).map { |u| u.to_s.strip }.reject(&:blank?).join(" ")
+        redirect_uri_list.join(" ")
+      end
+
+      def redirect_uri_list
+        value = metadata[:redirect_uris]
+        list = value.is_a?(Array) ? value : value.to_s.split(/\s+/)
+        list.map { |u| u.to_s.strip }.reject(&:blank?)
+      end
+
+      # What the model does not enforce for a client an operator registers by
+      # hand, but a self-registering client must meet: https, or http only on a
+      # loopback host (RFC 8252 §7.3, for native apps on an ephemeral port), and
+      # a bounded list. Absent or empty is left to the model's presence check.
+      def validate_redirect_uris!
+        list = redirect_uri_list
+        return if list.empty?
+
+        if list.size > MAX_REDIRECT_URIS
+          raise StandardId::InvalidRedirectUriError, "redirect_uris must not contain more than #{MAX_REDIRECT_URIS} entries"
+        end
+
+        list.each do |uri|
+          parsed = StandardId::ClientApplication.parse_redirect_uri(uri)
+          next if parsed && (parsed.scheme == "https" || StandardId::ClientApplication.loopback_redirect_uri?(parsed))
+
+          raise StandardId::InvalidRedirectUriError,
+            "redirect_uri #{uri.inspect} must use https (http is allowed only for loopback hosts)"
+        end
       end
 
       def client_name

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.49.0"
+  VERSION = "0.50.0"
 end

data/lib/standard_id.rb

@@ -39,6 +39,7 @@ require "standard_id/account_cleanup"
 require "standard_id/oauth/audience_profile_resolver"
 require "standard_id/oauth/audience_scope_resolver"
 require "standard_id/oauth/audience_resolver"
+require "standard_id/oauth/authorize_scope_resolver"
 require "standard_id/oauth/base_request_flow"
 require "standard_id/oauth/token_lifetime_resolver"
 require "standard_id/oauth/oauth_session_persistence"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.49.0
+  version: 0.50.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -287,6 +287,7 @@ files:
 - lib/standard_id/oauth/authorization_code_authorization_flow.rb
 - lib/standard_id/oauth/authorization_code_flow.rb
 - lib/standard_id/oauth/authorization_flow.rb
+- lib/standard_id/oauth/authorize_scope_resolver.rb
 - lib/standard_id/oauth/base_request_flow.rb
 - lib/standard_id/oauth/client_credentials_flow.rb
 - lib/standard_id/oauth/client_registration.rb