standard_id 0.51.0 → 0.51.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70dbbe49421726d198ba1ee5502ec80abcce347b4ed006073ed81c99de743321
-  data.tar.gz: dcb5337f9cfc348a256f8317dbb5a946f3b8d5e10f64829287cceb1108d38ac4
+  metadata.gz: 18c7955706f1fbe444d4bd7db052f615acfb01d7310f1a9c7088717017b864c5
+  data.tar.gz: 65435d9e1d57e2bfcbd479b5ecd81353d2961f831ad3f53db911bf830d20d89e
 SHA512:
-  metadata.gz: c469c67c58017cd97529b1e1eb47c5368c1c0e878f1123806796267f31c7791e4233bdb57597958fb460fb838ff8ae2f9ddf50864671d981f04796d5372ddfa5
-  data.tar.gz: bb7d5b2686415c1aa2d0198da73cb2df31372fc7ff36454ac879959bc0628552aafba5da7cd2aedf43bbd47801a673c6e172762abba4c8d3eabdbc6abb557534
+  metadata.gz: ec9734a8609d74823eb5b5a1b7b395d28f11c38268a19ff305618145777543ac13a5671c54f66cf2ecae5f68a9924e54dfeed495726dbc554f591d7f52f07078
+  data.tar.gz: 8616544546bd160e81490b665f40e5d4b64b03b2a612128efe896c4aacea446dbd240a8518e9d9c9a1e8bed1ef491421a406deb22ccfc52bd73f03fc6dab6a8e

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.51.2] - 2026-10-21
+
+### Fixed
+
+- **`claim_resolvers` and `custom_claims` may declare `profile:`.** The grant flows (and `TokenMinter`) have always passed the bound profile as `profile:` in the resolver context, but the boot-time `Config::CallableValidator` rejected the keyword, so a resolver could not actually use it — including the explicit `TokenMinter.mint(profile:)` added in 0.51.0.
+
+## [0.51.1] - 2026-10-20
+
+### Added
+
+- **`TokenMinter.mint(requested_scopes:)`**: what `OAUTH_TOKEN_ISSUED` reports as `requested_scopes` for a direct mint, for a caller whose audit trail records the permissions it granted (carried in a host claim such as `permissions`) rather than the OAuth scope words. Default unchanged (the scope words); an Array or space-delimited String; the token is never affected. Lets sidekick-web move its staff/test mint sites onto `TokenMinter` without its `auth.oauth.token.issued` audit rows losing the grant (rarebit-sre#478).
+
 ## [0.51.0] - 2026-10-20
 
 ### Added

data/README.md

@@ -925,7 +925,7 @@ Every StandardId event automatically carries tracing metadata (`event_id`, `time
 |  | `oauth.authorization.granted` | `authorization_code`, `client_id`, `account`, `scope` | After an authorization code is created |
 |  | `oauth.authorization.denied` | `client_id`, `account`, `reason` | When a user denies authorization |
 |  | `oauth.token.issuing` | `grant_type`, `client_id`, `account`, `scope` | Before generating access/refresh tokens |
-|  | `oauth.token.issued` | `access_token_id`, `grant_type`, `client_id`, `account`, `expires_in` | After tokens are generated |
+|  | `oauth.token.issued` | `access_token_id`, `grant_type`, `client_id`, `account`, `expires_in` | After tokens are generated. For a `TokenMinter` mint, `requested_scopes` may be caller-supplied (`requested_scopes:`) rather than the token's `scope` |
 |  | `oauth.token.refreshed` | `old_token_id`, `new_token_id`, `client_id`, `account` | After a refresh token is redeemed |
 |  | `oauth.code.consumed` | `authorization_code`, `client_id`, `account` | After an authorization code is exchanged |
 |  | `oauth.client.registered` | `client_application`, `client_id`, `client_name`, `client_type`, `redirect_uris`, `scope`, `owner_type`, `owner_id`, `client_metadata` | After a dynamic registration (RFC 7591) commits. Never fails the registration: a raising subscriber is logged |

data/lib/standard_id/config/callable_validator.rb

@@ -42,9 +42,9 @@ module StandardId
           keywords: %i[account auth_method provider request flow]
         },
         "oauth.custom_claims" => {
-          signature: "(account:, client:, request:, audience:)",
+          signature: "(account:, client:, request:, audience:, profile:)",
           kind: :keyword,
-          keywords: %i[account client request audience]
+          keywords: %i[account client request audience profile]
         },
         "oauth.audience_resolver" => {
           signature: "(client:, audience:, resource:, request:)",
@@ -73,8 +73,11 @@ module StandardId
         }
       }.freeze
 
-      # Keys available to claim_resolvers callables at invocation time.
-      CLAIM_RESOLVER_KEYWORDS = %i[client account request audience].freeze
+      # Keys available to claim_resolvers callables at invocation time
+      # (TokenGrantFlow#claim_resolvers_context). `profile` is the profile the
+      # audience binding resolved, or the one passed to TokenMinter; nil when
+      # the audience has no binding.
+      CLAIM_RESOLVER_KEYWORDS = %i[client account request audience profile].freeze
 
       class << self
         def validate!(config = StandardId.config)

data/lib/standard_id/oauth/direct_mint_flow.rb

@@ -16,9 +16,11 @@ module StandardId
       AUDIT_ERROR_MODES = %i[raise report].freeze
 
       def initialize(account:, audience:, grant_type:, scopes: nil, client_id: nil, claims: {}, expires_in: nil,
-        refresh_token: false, request: nil, auth_method: nil, auth_provider: nil, profile: nil, audit_errors: :raise)
+        refresh_token: false, request: nil, auth_method: nil, auth_provider: nil, profile: nil, audit_errors: :raise,
+        requested_scopes: nil)
         super({ audience: audience }, request || NullRequest.new)
         @profile = profile
+        @audit_requested_scopes = normalize_audit_scopes(requested_scopes)
         @audit_errors = audit_errors.to_s.to_sym
         unless AUDIT_ERROR_MODES.include?(@audit_errors)
           raise ArgumentError, "audit_errors must be one of #{AUDIT_ERROR_MODES.join(', ')} (got #{audit_errors.inspect})"
@@ -121,6 +123,12 @@ module StandardId
         end
       end
 
+      # A direct mint's caller may record what it actually granted (a
+      # permission set carried in a host claim) rather than the scope words.
+      def issued_event_requested_scopes
+        @audit_requested_scopes.nil? ? super : @audit_requested_scopes
+      end
+
       # No new authentication happened here: the host vouches for the account.
       def login_method_policy_context
         nil
@@ -181,6 +189,14 @@ module StandardId
         super
       end
 
+      # nil keeps the scope words; otherwise an Array or a space-delimited
+      # String, split like `scopes`.
+      def normalize_audit_scopes(scopes)
+        return nil if scopes.nil?
+
+        Array(scopes).flat_map { |s| s.to_s.split(/\s+/) }.reject(&:blank?).uniq
+      end
+
       def normalize_scopes(scopes)
         list = Array(scopes).flat_map { |s| s.to_s.split(/\s+/) }.reject(&:blank?).uniq
         list.empty? ? nil : list.join(" ")

data/lib/standard_id/oauth/token_grant_flow.rb

@@ -487,9 +487,14 @@ module StandardId
           profile_id: @resolved_profile&.id,
           audience: audience,
           jti: @issued_jti,
-          requested_scopes: current_scopes
+          requested_scopes: issued_event_requested_scopes
         )
       end
+
+      # What OAUTH_TOKEN_ISSUED reports as `requested_scopes`: the scope words.
+      def issued_event_requested_scopes
+        current_scopes
+      end
     end
   end
 end

data/lib/standard_id/token_minter.rb

@@ -71,13 +71,22 @@ module StandardId
     #   caller whose contract is that an audit failure never costs it the
     #   credential. Report it to your error tracker: the gem only logs it.
     #   OAUTH_TOKEN_ISSUING (the status / locking guards) always raises.
+    # @param requested_scopes [Array<String>, String, nil] what OAUTH_TOKEN_ISSUED
+    #   reports as `requested_scopes`, for a caller whose audit trail records
+    #   the permissions it granted (carried in a host claim) rather than the
+    #   OAuth scope words; default (nil) is the scope words, like every grant.
+    #   A String is split on whitespace. Changes the event only, never the
+    #   token — so for a direct mint, the event's requested_scopes may be
+    #   caller-supplied rather than what the token's `scope` claim says.
     # @return [Result]
     def mint(account:, audience:, grant_type:, scopes: nil, client_id: nil, claims: {}, expires_in: nil,
-      refresh_token: false, request: nil, auth_method: nil, auth_provider: nil, profile: nil, audit_errors: :raise)
+      refresh_token: false, request: nil, auth_method: nil, auth_provider: nil, profile: nil, audit_errors: :raise,
+      requested_scopes: nil)
       flow = StandardId::Oauth::DirectMintFlow.new(
         account: account, audience: audience, grant_type: grant_type, scopes: scopes, client_id: client_id,
         claims: claims, expires_in: expires_in, refresh_token: refresh_token, request: request,
-        auth_method: auth_method, auth_provider: auth_provider, profile: profile, audit_errors: audit_errors
+        auth_method: auth_method, auth_provider: auth_provider, profile: profile, audit_errors: audit_errors,
+        requested_scopes: requested_scopes
       )
       response = flow.execute
       Result.new(

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.51.0"
+  VERSION = "0.51.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.51.0
+  version: 0.51.2
 platform: ruby
 authors:
 - Jaryl Sim