standard_id 0.51.2 → 0.53.0

data/lib/standard_id/config_schema.rb

@@ -266,6 +266,16 @@ module StandardId
 
       def registered?(scope_name) = !!self[scope_name.to_sym]&.resolver
 
+      # Applies a named settings bundle (StandardId::Config::Presets). Only
+      # settings the host has not assigned are filled, so explicit
+      # assignments win in either order.
+      #
+      #   StandardId.configure do |c|
+      #     c.preset :inertia_web
+      #     c.web.passwordless_login = true
+      #   end
+      def preset(name) = StandardId::Config::Presets.apply(self, name)
+
       def [](key)
         sym = key.to_sym
         return super if key?(sym) || __schema__.nil? || __schema__.scope?(sym)

data/lib/standard_id/engine.rb

@@ -166,7 +166,7 @@ module StandardId
     # inclusion. Extracted to a module method so specs can exercise it
     # directly without booting a second Rails app.
     def self.warn_if_allowed_audiences_empty_in_production!
-      return unless Rails.env.production?
+      return unless StandardId::AppEnvironment.production?
       return if StandardId.config.oauth.allowed_audiences.present?
 
       Rails.logger.warn(

data/lib/standard_id/passwordless/verification_service.rb

@@ -247,14 +247,14 @@ module StandardId
       end
 
       # Whether the bypass code is forbidden because this is a production
-      # deploy. Defers to config.passwordless.production_env_detector when set
-      # (host apps that distinguish a physical deploy env from RAILS_ENV), else
-      # falls back to Rails.env.production?.
+      # deploy. Defers to config.passwordless.production_env_detector when set,
+      # else StandardId::AppEnvironment (APP_ENVIRONMENT, then Rails.env; fails
+      # closed).
       def bypass_production_deploy?
         detector = StandardId.config.passwordless.production_env_detector
         return !!detector.call if detector
 
-        defined?(Rails) && Rails.env.production?
+        StandardId::AppEnvironment.production?
       end
 
       def resolve_target_and_channel!(email, phone)

data/lib/standard_id/provider_registry.rb

@@ -201,7 +201,7 @@ module StandardId
       end
 
       def production?
-        defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
+        StandardId::AppEnvironment.production?
       end
 
       def validate_provider!(provider_class)

data/lib/standard_id/testing/request_helpers.rb

@@ -55,6 +55,105 @@ module StandardId
       def bearer_auth_header(token)
         { "Authorization" => "Bearer #{token}" }
       end
+
+      # Bearer headers for an account, in one call: build_jwt + bearer_auth_header.
+      #
+      #   get "/api/orders", headers: bearer_headers_for(account, scope: "orders.read")
+      #
+      # @param account [Object] the account (its id becomes the sub claim)
+      # @param jwt_options [Hash] any other build_jwt keyword (scope:, client_id:, extra:, ...)
+      # @return [Hash] header hash
+      #
+      def bearer_headers_for(account, **jwt_options)
+        bearer_auth_header(build_jwt(account: account, **jwt_options))
+      end
+
+      # Sign an account in for the following requests in a request spec,
+      # without driving a login form or stubbing controllers.
+      #
+      # Creates a real BrowserSession and writes the same encrypted
+      # `session_token` cookie that Web::SessionManager writes on a real
+      # sign-in, so `current_account`, `require_browser_session!` and the
+      # session's expiry and revocation all behave exactly as in production.
+      # With `scope:`, it also writes the Rails session cookie carrying
+      # `standard_id_scopes` (what `current_scope_names` reads), which needs
+      # the cookie session store; any other store raises ArgumentError.
+      #
+      # Nothing is added to the app: the cookies are built with the app's own
+      # encrypted cookie jar and secret_key_base, so there is no test-only route
+      # to forget to remove. Like a real sign-in (which resets the session), it
+      # always replaces the Rails session cookie: an earlier request's session
+      # data, and an earlier sign_in_as's scopes, never carry over to this
+      # account.
+      #
+      #   sign_in_as(account)
+      #   sign_in_as(account, scope: :platform)
+      #   get "/dashboard"
+      #
+      # @param account [Object] the account to sign in
+      # @param scope [Symbol, String, Array, nil] scope name(s) to grant
+      # @param user_agent [String] stored on the BrowserSession
+      # @return [StandardId::BrowserSession] the session that was created
+      #
+      def sign_in_as(account, scope: nil, user_agent: "RSpec")
+        ensure_cookie_session_store! if scope
+        browser_session = create_browser_session(account, user_agent: user_agent)
+        jar = standard_id_cookie_jar
+
+        jar.encrypted[:session_token] = {
+          value: browser_session.token,
+          expires: browser_session.expires_at,
+          httponly: true
+        }
+        cookies[:session_token] = jar[:session_token]
+
+        if scope
+          write_standard_id_scopes(jar, scope)
+        elsif (key = rails_session_key)
+          cookies.delete(key)
+        end
+        browser_session
+      end
+
+      private
+
+      # The host app's cookie jar, outside any request: same secret_key_base,
+      # salts, serializer and rotations as a real request, so the cookies it
+      # writes read back exactly as Web::SessionManager's own.
+      def standard_id_cookie_jar
+        ActionDispatch::Request.new(Rails.application.env_config.deep_dup).cookie_jar
+      end
+
+      # Checked before anything is created, so a refused call leaves no session.
+      def ensure_cookie_session_store!
+        store = Rails.application.config.session_store
+        unless store.is_a?(Class) && store <= ActionDispatch::Session::CookieStore
+          raise ArgumentError,
+            "sign_in_as(scope:) writes the Rails session cookie, so it needs the cookie " \
+            "session store; this app uses #{store.inspect}. " \
+            "Sign in through the app's own scoped login request instead."
+        end
+        return if rails_session_key
+
+        raise ArgumentError,
+          "sign_in_as(scope:) needs the session cookie name (config.session_options[:key]), and it is not set"
+      end
+
+      def rails_session_key
+        Rails.application.config.session_options[:key]&.to_s
+      end
+
+      def write_standard_id_scopes(jar, scope)
+        key = rails_session_key
+        jar.encrypted[key] = {
+          value: {
+            "session_id" => SecureRandom.hex(16),
+            "standard_id_scopes" => Array(scope).map(&:to_s)
+          },
+          httponly: true
+        }
+        cookies[key] = jar[key]
+      end
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.51.2"
+  VERSION = "0.53.0"
 end

data/lib/standard_id.rb

@@ -7,6 +7,8 @@ require "standard_id/web_engine"
 require "standard_id/api_engine"
 require "standard_id/config_schema"
 require "standard_id/config/schema"
+require "standard_id/config/presets"
+require "standard_id/app_environment"
 require "standard_id/scope_config"
 require "standard_id/association_strict_loading"
 require "standard_id/migration_check"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.51.2
+  version: 0.53.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -245,6 +245,7 @@ files:
 - db/migrate/20261020120000_add_registration_access_token_digest_to_standard_id_client_applications.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
+- lib/generators/standard_id/install/templates/standard_id_reference.rb
 - lib/standard_id.rb
 - lib/standard_id/account_cleanup.rb
 - lib/standard_id/account_locking.rb
@@ -253,12 +254,14 @@ files:
 - lib/standard_id/api/session_manager.rb
 - lib/standard_id/api/token_manager.rb
 - lib/standard_id/api_engine.rb
+- lib/standard_id/app_environment.rb
 - lib/standard_id/association_strict_loading.rb
 - lib/standard_id/auth_lineage.rb
 - lib/standard_id/authorization_bypass.rb
 - lib/standard_id/bearer_token_extraction.rb
 - lib/standard_id/checks/migrations.rb
 - lib/standard_id/config/callable_validator.rb
+- lib/standard_id/config/presets.rb
 - lib/standard_id/config/schema.rb
 - lib/standard_id/config/scope_claims_validator.rb
 - lib/standard_id/config_schema.rb