standard_id 0.54.0 → 0.54.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de8ced4a8e48a3b14437ece4082079510d1f7466737be90f3dffe3ac3959d56c
-  data.tar.gz: af90eba1873dd457c207ce3151d75215cf5de2e8a5cb37d42ab32a1227fb5017
+  metadata.gz: '047082209f6ec1b345a5500438fb424ef343c2e72f922b063ed876124b0ad957'
+  data.tar.gz: 00f773c75baff568d12c3caa98f56b49c4630da093808cf7a8afb82e5a66807a
 SHA512:
-  metadata.gz: d5bb7b2e920c26ae28e3b8ddd09ea4c475bb8b0562b89f057adf9573737fc225c43470faf94e202545d3840a4ab2b41e6abc8b17836fd8272a6b17711e47d5f6
-  data.tar.gz: b64139dbd6641e978e75d4dec5f89a14891b603755edf6e67e2a566c5ace604d678aaeb4f75a6e924f1da2d04fdd5af3de8b0f005c05c344486aa2796d45b096
+  metadata.gz: 9a2c6bb133b7eca3d39545b666b0d82b6ef03f59374110618fee49643dceaf8c839871761e188a1aa4f1f3e5c0b3dfebc28a3a61d68f4cc12fa051337f33de8c
+  data.tar.gz: 6aebcee090d61b6094f25b724e3a89bb73e7424227f2bef24e4b17606e175a081673b6e6c296a31374ab22661f5d7b0f998d9e4585aa0ba0330d2d684537f3ce

data/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.54.1] - 2026-10-22
+
+### Security
+
+- **Web email/phone verification now counts attempts.** `Web::VerifyEmail::ConfirmController`
+  and `Web::VerifyPhone::ConfirmController` looked the code up with
+  `CodeChallenge.active.find_by(code:)`, so the only brake on guessing was the per-IP
+  rate limit. `PATCH` now goes through `StandardId::Otp.verify`, which counts failed
+  attempts and burns the challenge at `passwordless.max_attempts_per_challenge`.
+  `GET` no longer checks the code at all (it answered valid/invalid without counting an
+  attempt); a wrong code is reported on submit. Because `Otp.verify` honours
+  `passwordless.bypass_code`, that code now also verifies an email or phone through these
+  pages where it is allowed (never in production, which raises).
+- **Web password reset revokes refresh tokens.** `Web::ResetPasswordConfirmForm` ran
+  `account.sessions.destroy_all`, and `Session has_many :refresh_tokens, dependent:
+  :nullify` left every refresh token active and detached. It now revokes all sessions
+  (`Session.revoke_all_for!`, reason `"password_reset"`, one `SESSION_REVOKED` each)
+  and every remaining refresh token for the account, and publishes the documented
+  `credential.password.reset_completed` event, which the gem never emitted before (a
+  raising subscriber is logged, not surfaced, since the reset has already happened).
+  Sessions are revoked, no longer deleted.
+
 ## [0.54.0] - 2026-10-22
 
 ### Added

data/app/controllers/standard_id/web/verify_email/confirm_controller.rb

@@ -3,46 +3,42 @@ module StandardId
     module VerifyEmail
       class ConfirmController < BaseController
         # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
-        # verify). The per-challenge attempt cap alone doesn't stop distributed
-        # guessing across many challenges; both show and update probe a code.
+        # verify). Otp.verify's per-challenge attempt cap alone doesn't stop
+        # distributed guessing across many challenges.
         rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
                    within: 15.minutes,
                    name: "verify-email-confirm-ip",
                    only: [:show, :update],
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-        before_action :prepare_code_challenge
-
         def show
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if target.blank? || code.blank?
+          # Does not check the code: a GET that answered valid/invalid would be
+          # a guessing oracle that never counts an attempt. PATCH verifies.
           render plain: "verify email confirm", status: :ok
         end
 
         def update
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          # Otp.verify locks the challenge, compares in constant time, counts
+          # the failed attempt and burns the challenge at the per-challenge cap.
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if code.blank?
+
+          result = StandardId::Otp.verify(realm: "verification", target: target, code: code, channel: :email, request: request)
+          return redirect_to(standard_id_web.login_path, alert: result.error) unless result.success?
 
-          identifier = StandardId::EmailIdentifier.find_by(value: @challenge.target)
-          if identifier.present?
-            identifier.verify!
-          end
-          @challenge.use!
+          StandardId::EmailIdentifier.find_by(value: target)&.verify!
 
           redirect_to standard_id_web.login_path, notice: "Your email has been verified. Please sign in.", status: :see_other
         end
 
         private
 
-        def prepare_code_challenge
-          email = params[:email].to_s.strip.downcase
-          code = params[:code].to_s
-          return @challenge = nil if email.blank? || code.blank?
-
-          @challenge = StandardId::CodeChallenge.active.find_by(
-            realm: "verification",
-            channel: "email",
-            target: email,
-            code: code
-          )
+        def target
+          @target ||= params[:email].to_s.strip.downcase
+        end
+
+        def code
+          params[:code].to_s
         end
       end
     end

data/app/controllers/standard_id/web/verify_phone/confirm_controller.rb

@@ -3,46 +3,42 @@ module StandardId
     module VerifyPhone
       class ConfirmController < BaseController
         # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
-        # verify). The per-challenge attempt cap alone doesn't stop distributed
-        # guessing across many challenges; both show and update probe a code.
+        # verify). Otp.verify's per-challenge attempt cap alone doesn't stop
+        # distributed guessing across many challenges.
         rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
                    within: 15.minutes,
                    name: "verify-phone-confirm-ip",
                    only: [:show, :update],
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-        before_action :prepare_code_challenge
-
         def show
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if target.blank? || code.blank?
+          # Does not check the code: a GET that answered valid/invalid would be
+          # a guessing oracle that never counts an attempt. PATCH verifies.
           render plain: "verify phone confirm", status: :ok
         end
 
         def update
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          # Otp.verify locks the challenge, compares in constant time, counts
+          # the failed attempt and burns the challenge at the per-challenge cap.
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if code.blank?
+
+          result = StandardId::Otp.verify(realm: "verification", target: target, code: code, channel: :sms, request: request)
+          return redirect_to(standard_id_web.login_path, alert: result.error) unless result.success?
 
-          identifier = StandardId::PhoneNumberIdentifier.find_by(value: @challenge.target)
-          if identifier.present?
-            identifier.verify!
-          end
-          @challenge.use!
+          StandardId::PhoneNumberIdentifier.find_by(value: target)&.verify!
 
           redirect_to standard_id_web.login_path, notice: "Your phone number has been verified. Please sign in.", status: :see_other
         end
 
         private
 
-        def prepare_code_challenge
-          phone = params[:phone_number].to_s.strip
-          code = params[:code].to_s
-          return @challenge = nil if phone.blank? || code.blank?
-
-          @challenge = StandardId::CodeChallenge.active.find_by(
-            realm: "verification",
-            channel: "sms",
-            target: phone,
-            code: code
-          )
+        def target
+          @target ||= params[:phone_number].to_s.strip
+        end
+
+        def code
+          params[:code].to_s
         end
       end
     end

data/app/forms/standard_id/web/reset_password_confirm_form.rb

@@ -22,16 +22,57 @@ module StandardId
       def submit
         return false unless valid?
 
+        account = @password_credential.account
+
+        # The password change and the revocation commit together, so a failure
+        # cannot leave the new password in place with old tokens still live.
+        # The SESSION_REVOKED events revoke_all_for! publishes therefore run
+        # before the commit; each is rescued, so a subscriber cannot roll the
+        # reset back, but one that reads the rows must do so after commit
+        # (e.g. from a job, which Rails enqueues after commit).
         ActiveRecord::Base.transaction do
           @password_credential.update!(password: password, password_confirmation: password_confirmation)
-          @password_credential.account.sessions.destroy_all
+          revoke_access!(account)
         end
 
+        publish_reset_completed(account)
+
         true
       rescue ActiveRecord::RecordInvalid => e
         errors.add(:base, e.record.errors.full_messages.join(", "))
         false
       end
+
+      private
+
+      # The reset has already happened, so a failing subscriber must not turn
+      # it into an error page; log and carry on, as Session does for
+      # SESSION_REVOKED.
+      def publish_reset_completed(account)
+        StandardId::Events.publish(
+          StandardId::Events::CREDENTIAL_PASSWORD_RESET_COMPLETED,
+          credential: @password_credential,
+          account: account
+        )
+      rescue StandardError => e
+        logger = StandardId.logger
+        return unless logger.respond_to?(:error)
+
+        logger.error(
+          "[StandardId::Web::ResetPasswordConfirmForm] Failed to publish " \
+          "CREDENTIAL_PASSWORD_RESET_COMPLETED for account #{account.id}: #{e.class}: #{e.message}"
+        )
+      end
+
+      # Revoke every session (and the refresh tokens under them), then any
+      # refresh token with no session (e.g. one minted by a grant flow). Revoking
+      # rather than destroying keeps the audit trail and fires SESSION_REVOKED;
+      # sessions.destroy_all used to nullify refresh_tokens.session_id
+      # (dependent: :nullify), leaving those tokens active after the reset.
+      def revoke_access!(account)
+        StandardId::Session.revoke_all_for!(account, reason: "password_reset")
+        StandardId::RefreshToken.where(account_id: account.id, revoked_at: nil).update_all(revoked_at: Time.current)
+      end
     end
   end
 end

data/app/models/standard_id/session.rb

@@ -176,7 +176,9 @@ module StandardId
       )
     end
 
-    # DB state is already committed by the time this runs; event publishing is
+    # DB state is already committed by the time this runs (unless the caller
+    # wraps revoke_all_for! in its own transaction, as Web::ResetPasswordConfirmForm
+    # does); event publishing is
     # best-effort audit emission. A failing subscriber must not short-circuit the
     # loop and leave later sessions without their SESSION_REVOKED event, which
     # would permanently desync audit-trail consumers from the DB.

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.54.0"
+  VERSION = "0.54.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.54.0
+  version: 0.54.1
 platform: ruby
 authors:
 - Jaryl Sim