standard_id 0.52.0 → 0.53.0

data/lib/standard_id/testing/request_helpers.rb

@@ -55,6 +55,105 @@ module StandardId
       def bearer_auth_header(token)
         { "Authorization" => "Bearer #{token}" }
       end
+
+      # Bearer headers for an account, in one call: build_jwt + bearer_auth_header.
+      #
+      #   get "/api/orders", headers: bearer_headers_for(account, scope: "orders.read")
+      #
+      # @param account [Object] the account (its id becomes the sub claim)
+      # @param jwt_options [Hash] any other build_jwt keyword (scope:, client_id:, extra:, ...)
+      # @return [Hash] header hash
+      #
+      def bearer_headers_for(account, **jwt_options)
+        bearer_auth_header(build_jwt(account: account, **jwt_options))
+      end
+
+      # Sign an account in for the following requests in a request spec,
+      # without driving a login form or stubbing controllers.
+      #
+      # Creates a real BrowserSession and writes the same encrypted
+      # `session_token` cookie that Web::SessionManager writes on a real
+      # sign-in, so `current_account`, `require_browser_session!` and the
+      # session's expiry and revocation all behave exactly as in production.
+      # With `scope:`, it also writes the Rails session cookie carrying
+      # `standard_id_scopes` (what `current_scope_names` reads), which needs
+      # the cookie session store; any other store raises ArgumentError.
+      #
+      # Nothing is added to the app: the cookies are built with the app's own
+      # encrypted cookie jar and secret_key_base, so there is no test-only route
+      # to forget to remove. Like a real sign-in (which resets the session), it
+      # always replaces the Rails session cookie: an earlier request's session
+      # data, and an earlier sign_in_as's scopes, never carry over to this
+      # account.
+      #
+      #   sign_in_as(account)
+      #   sign_in_as(account, scope: :platform)
+      #   get "/dashboard"
+      #
+      # @param account [Object] the account to sign in
+      # @param scope [Symbol, String, Array, nil] scope name(s) to grant
+      # @param user_agent [String] stored on the BrowserSession
+      # @return [StandardId::BrowserSession] the session that was created
+      #
+      def sign_in_as(account, scope: nil, user_agent: "RSpec")
+        ensure_cookie_session_store! if scope
+        browser_session = create_browser_session(account, user_agent: user_agent)
+        jar = standard_id_cookie_jar
+
+        jar.encrypted[:session_token] = {
+          value: browser_session.token,
+          expires: browser_session.expires_at,
+          httponly: true
+        }
+        cookies[:session_token] = jar[:session_token]
+
+        if scope
+          write_standard_id_scopes(jar, scope)
+        elsif (key = rails_session_key)
+          cookies.delete(key)
+        end
+        browser_session
+      end
+
+      private
+
+      # The host app's cookie jar, outside any request: same secret_key_base,
+      # salts, serializer and rotations as a real request, so the cookies it
+      # writes read back exactly as Web::SessionManager's own.
+      def standard_id_cookie_jar
+        ActionDispatch::Request.new(Rails.application.env_config.deep_dup).cookie_jar
+      end
+
+      # Checked before anything is created, so a refused call leaves no session.
+      def ensure_cookie_session_store!
+        store = Rails.application.config.session_store
+        unless store.is_a?(Class) && store <= ActionDispatch::Session::CookieStore
+          raise ArgumentError,
+            "sign_in_as(scope:) writes the Rails session cookie, so it needs the cookie " \
+            "session store; this app uses #{store.inspect}. " \
+            "Sign in through the app's own scoped login request instead."
+        end
+        return if rails_session_key
+
+        raise ArgumentError,
+          "sign_in_as(scope:) needs the session cookie name (config.session_options[:key]), and it is not set"
+      end
+
+      def rails_session_key
+        Rails.application.config.session_options[:key]&.to_s
+      end
+
+      def write_standard_id_scopes(jar, scope)
+        key = rails_session_key
+        jar.encrypted[key] = {
+          value: {
+            "session_id" => SecureRandom.hex(16),
+            "standard_id_scopes" => Array(scope).map(&:to_s)
+          },
+          httponly: true
+        }
+        cookies[key] = jar[key]
+      end
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.52.0"
+  VERSION = "0.53.0"
 end

data/lib/standard_id.rb

@@ -8,6 +8,7 @@ require "standard_id/api_engine"
 require "standard_id/config_schema"
 require "standard_id/config/schema"
 require "standard_id/config/presets"
+require "standard_id/app_environment"
 require "standard_id/scope_config"
 require "standard_id/association_strict_loading"
 require "standard_id/migration_check"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.52.0
+  version: 0.53.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -245,6 +245,7 @@ files:
 - db/migrate/20261020120000_add_registration_access_token_digest_to_standard_id_client_applications.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
+- lib/generators/standard_id/install/templates/standard_id_reference.rb
 - lib/standard_id.rb
 - lib/standard_id/account_cleanup.rb
 - lib/standard_id/account_locking.rb
@@ -253,6 +254,7 @@ files:
 - lib/standard_id/api/session_manager.rb
 - lib/standard_id/api/token_manager.rb
 - lib/standard_id/api_engine.rb
+- lib/standard_id/app_environment.rb
 - lib/standard_id/association_strict_loading.rb
 - lib/standard_id/auth_lineage.rb
 - lib/standard_id/authorization_bypass.rb