standard_id 0.51.2 → 0.53.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18c7955706f1fbe444d4bd7db052f615acfb01d7310f1a9c7088717017b864c5
-  data.tar.gz: 65435d9e1d57e2bfcbd479b5ecd81353d2961f831ad3f53db911bf830d20d89e
+  metadata.gz: 1aa1e111cbaf2abc19d4b43e57a7c276054bf0522418c7303f855659cb3c259f
+  data.tar.gz: 583e0568a53fbf9880c11cd0fbf4e17ae2b98d73b52b2db2725ed5dbe4a5dab0
 SHA512:
-  metadata.gz: ec9734a8609d74823eb5b5a1b7b395d28f11c38268a19ff305618145777543ac13a5671c54f66cf2ecae5f68a9924e54dfeed495726dbc554f591d7f52f07078
-  data.tar.gz: 8616544546bd160e81490b665f40e5d4b64b03b2a612128efe896c4aacea446dbd240a8518e9d9c9a1e8bed1ef491421a406deb22ccfc52bd73f03fc6dab6a8e
+  metadata.gz: d5410924e96b90aca074e3a322cfa7e59fc54c5412e41927157b19f03c723355724295a67cc9ddb3dec70ca38e548c1bf8062431a46859c6ab153c6416f3b9e6
+  data.tar.gz: 3216249e86cd957cc0196518374b2b21073ef03f3f134988f97bedc064ecbbbd9e10a7be88a48606ae7502c9b1dcdecbd8fdd606bea9aa81b361269e2cc9cbbc

data/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.53.0] - 2026-10-22
+
+### Added
+
+- **`StandardId::Testing::RequestHelpers#sign_in_as(account, scope: nil)`.** Signs an
+  account in for the following requests in a request spec: it creates a real
+  `BrowserSession` and writes the encrypted `session_token` cookie a real sign-in
+  writes, built with the host's own cookie jar, so no test-only route is added to
+  the app. `scope:` also writes `standard_id_scopes` into the Rails session cookie
+  (cookie session store only; any other store raises `ArgumentError`, before
+  anything is created). Like a real sign-in it always replaces the Rails session
+  cookie, so a later `sign_in_as` never inherits an earlier one's scopes or any
+  other session data (flash, CSRF token). Replaces per-app controller
+  stubs and `/test/set-session` routes.
+- **`RequestHelpers#bearer_headers_for(account, **jwt_options)`:** `build_jwt` plus
+  `bearer_auth_header` in one call.
+
+### Changed
+
+- **"Production" follows `APP_ENVIRONMENT`, failing closed.** The new
+  `StandardId::AppEnvironment.production?` decides every production check in the
+  gem: the bypass-code guard (when `passwordless.production_env_detector` is
+  unset), the provider-misconfiguration `:raise` mode, and the empty
+  `allowed_audiences` boot warning. It reads `APP_ENVIRONMENT` when set (only
+  `staging`, `preview`, `development` and `test` are non-production; any other
+  value is production), else `Rails.env.production?`. A staging box with
+  `RAILS_ENV=production` and `APP_ENVIRONMENT=staging` is therefore no longer
+  treated as production, and `-> { AppEnv.production? }` detectors can be
+  deleted. Same convention as standard_audit, standard_health and
+  standard_singpass.
+- **`rails g standard_id:install` writes a minimal initializer.** It holds only
+  `account_class_name`, plus commented `issuer` and `c.preset :inertia_web` lines,
+  instead of several hundred lines of commented defaults that apps then kept
+  verbatim. `--with-reference` writes
+  the annotated initializer as before. Existing initializers are not touched.
+
+## [0.52.0] - 2026-10-22
+
+### Added
+
+- **`c.preset :inertia_web`.** Applies the settings an Inertia app with
+  passwordless or social sign-in flips: `use_inertia` and `alias_current_user`
+  true; `web.signup`, `web.password_login` and `web.password_reset` false;
+  `oauth.discovery_endpoint_base = :request`. Each setting is hand-set in four
+  of the five estate apps, though the full bundle matches only two of them. A
+  preset fills only settings the host has not assigned (via
+  `Scope#assigned?`), so explicit assignments win in either order; an unknown
+  name raises `ArgumentError`. The public defaults are unchanged.
+  Presets live in `StandardId::Config::Presets`.
+
 ## [0.51.2] - 2026-10-21
 
 ### Fixed

data/README.md

@@ -63,6 +63,13 @@ $ bundle install
 rails generate standard_id:install
 ```
 
+This writes a short `config/initializers/standard_id.rb` holding only what an
+app must decide (`account_class_name`, plus commented `issuer` and
+`c.preset :inertia_web` lines). Add a setting only when you change it from the
+default. `--with-reference` writes the annotated initializer instead, with every
+commonly changed setting and its default commented out; it is a reference to
+read, not a file to keep whole.
+
 ### 2. Configure Your Account Model
 
 ```ruby
@@ -629,6 +636,23 @@ StandardId.configure do |config|
 end
 ```
 
+   Or start from the `:inertia_web` preset, which bundles the settings an
+   Inertia app with passwordless or social sign-in usually flips:
+
+```ruby
+StandardId.configure do |config|
+  config.preset :inertia_web
+  # use_inertia = true, alias_current_user = true,
+  # web.signup / web.password_login / web.password_reset = false,
+  # oauth.discovery_endpoint_base = :request
+  config.web.passwordless_login = true # not part of the preset: your call
+end
+```
+
+   A preset fills only the settings you haven't assigned, so an explicit
+   assignment wins whether it comes before or after `preset`. An unknown name
+   raises `ArgumentError`. The public defaults are unchanged.
+
 3. Create the corresponding frontend components. The component path follows the pattern:
    `{namespace}/{ControllerName}/{action}`
 
@@ -852,15 +876,19 @@ end
 
 **Bypass code (E2E testing).** When `StandardId.config.passwordless.bypass_code` is set (and the deploy is not production), `Otp.verify` accepts the bypass code for **any realm**. This replaces per-app bypass ENV checks and works consistently across `Otp.verify` and the built-in passwordless login flow. Never set `bypass_code` in production — it will raise if you try.
 
-By default "production" means `Rails.env.production?`. Apps that distinguish a physical deploy environment from `RAILS_ENV` (e.g. a staging box that still runs `RAILS_ENV=production`) can override the decision with a callable:
+"Production" is decided by `StandardId::AppEnvironment`, the same rule every
+check in the gem uses: `APP_ENVIRONMENT` when it is set, where only `staging`,
+`preview`, `development` and `test` count as non-production (any other value,
+including a typo, is production), else `Rails.env.production?`. So a staging box
+running `RAILS_ENV=production` with `APP_ENVIRONMENT=staging` is not
+production, and needs no extra wiring:
 
 ```ruby
-# Allow the bypass code on a physically-staging box, still refused on real prod.
-c.passwordless.production_env_detector = -> { AppEnv.production? }
-c.passwordless.bypass_code = ENV["STANDARD_ID_BYPASS_CODE"] unless AppEnv.production?
+c.passwordless.bypass_code = ENV["STANDARD_ID_BYPASS_CODE"] unless StandardId::AppEnvironment.production?
 ```
 
-`production_env_detector` takes no arguments and returns a boolean; when `nil` (the default) the gem falls back to `Rails.env.production?`, so existing consumers are unaffected.
+`production_env_detector` (a callable taking no arguments, returning a boolean)
+still overrides that, for an app with a different discriminator.
 
 **Back-compat.** The existing passwordless authentication flow continues to work unchanged. `Otp.issue`/`Otp.verify` are a new addition — you can migrate direct `CodeChallenge.create!` calls at your own pace.
 
@@ -1926,6 +1954,38 @@ Notes:
 
 ## Testing
 
+### Signing in from your app's request specs
+
+```ruby
+# spec/rails_helper.rb
+require "standard_id/testing"
+
+RSpec.configure do |config|
+  config.include StandardId::Testing::RequestHelpers, type: :request
+end
+```
+
+```ruby
+sign_in_as(account)                    # a real BrowserSession, via the session_token cookie
+sign_in_as(account, scope: :platform)  # also grants standard_id_scopes (current_scope_names)
+get "/dashboard"
+
+get "/api/orders", headers: bearer_headers_for(account, scope: "orders.read")
+```
+
+`sign_in_as` creates a real `BrowserSession` and writes the same encrypted
+`session_token` cookie a real sign-in writes, so `current_account`,
+`require_browser_session!`, expiry and revocation behave exactly as in
+production. It adds nothing to your app: the cookies are built with your app's
+own encrypted cookie jar, so there is no test-only route. `scope:` writes the
+Rails session cookie and so needs the cookie session store (the Rails default);
+with another store it raises `ArgumentError`, and you sign in through your own
+scoped login request instead. It replaces controller stubbing
+(`stub_web_authentication`, `allow_any_instance_of(...).to receive(:current_user)`)
+and per-app `/test/set-session` routes.
+
+### This gem's own suite
+
 StandardId includes comprehensive test coverage:
 
 ```bash

data/lib/generators/standard_id/install/install_generator.rb

@@ -28,6 +28,8 @@ module StandardId
 
       class_option :skip_initializer, type: :boolean, default: false,
         desc: "Do not write config/initializers/standard_id.rb"
+      class_option :with_reference, type: :boolean, default: false,
+        desc: "Write the annotated initializer (every common setting with its default) instead of the minimal one"
       class_option :skip_routes, type: :boolean, default: false,
         desc: "Do not append engine mount lines to config/routes.rb"
       class_option :skip_migrations, type: :boolean, default: false,
@@ -51,7 +53,8 @@ module StandardId
       def create_initializer_file
         return say_status("skip", "config/initializers/standard_id.rb (--skip-initializer)", :yellow) if options[:skip_initializer]
 
-        template "standard_id.rb", "config/initializers/standard_id.rb"
+        source = options[:with_reference] ? "standard_id_reference.rb" : "standard_id.rb"
+        template source, "config/initializers/standard_id.rb"
       end
 
       def mount_engines