standard_id 0.54.0 → 0.55.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de8ced4a8e48a3b14437ece4082079510d1f7466737be90f3dffe3ac3959d56c
-  data.tar.gz: af90eba1873dd457c207ce3151d75215cf5de2e8a5cb37d42ab32a1227fb5017
+  metadata.gz: 1b6e3c72dcbb1a915c4927a4f0607b13d6f66c791240e20825698b490b0f13a1
+  data.tar.gz: 9606c37fbf368616167772d7a32fdadc7b4abb16758c9041b7041694b697ffb4
 SHA512:
-  metadata.gz: d5bb7b2e920c26ae28e3b8ddd09ea4c475bb8b0562b89f057adf9573737fc225c43470faf94e202545d3840a4ab2b41e6abc8b17836fd8272a6b17711e47d5f6
-  data.tar.gz: b64139dbd6641e978e75d4dec5f89a14891b603755edf6e67e2a566c5ace604d678aaeb4f75a6e924f1da2d04fdd5af3de8b0f005c05c344486aa2796d45b096
+  metadata.gz: b31012a34cc04b983d754b506f13d227a046dd5a33a53774b071d2822e4d51aba4745d685a25f0d84c7c55b7c37e79378351a4efbc556b91831368095282d7d4
+  data.tar.gz: e0ad4c58dfeb705e5824da097c12b6a00b6d60450f0c248a3f0a1874fe912f5549ecebfdbd1dd199aa6810af6668fea7f8562c6ee7dad0b076f29635e36ffd44

data/CHANGELOG.md

@@ -7,6 +7,75 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.55.0] - 2026-10-22
+
+### Added
+
+- **Email + password API, opt-in (`c.email_password.enabled`).** `POST /auth/register`,
+  `/auth/verify-email`, `/auth/verify-email/resend`, `/auth/login`,
+  `/auth/password/forgot` and `/auth/password/reset` under the API mount, for JSON
+  clients. Sign-up creates an unverified account and emails a 6-digit code;
+  verification needs the code and the sign-up password and returns the usual token
+  response, refreshable through `/oauth/token`. Login answers a distinct `unverified`
+  only to the right password. Resend and forgot always answer `202`. A reset verifies
+  the address and revokes every session and refresh token. Re-submitting a pending
+  sign-up never changes its password. Errors are stable `StandardId::EmailPasswordError`
+  codes, with an `error_renderer` hook for hosts that keep their own envelope. Short
+  limits reuse `c.rate_limits`, plus new daily per-address caps
+  (`rate_limits.email_password_*`). The operations behind it
+  (`StandardId::EmailPassword::*`) are public. Migration
+  **`20261022000000_add_signup_source_to_standard_id_identifiers`** adds the
+  nullable `signup_source` column that marks these sign-ups; run it before enabling
+  the API. See the README and `docs/MIGRATION_GUIDE.md`.
+- **`c.email_password.reveal_existing_accounts`** (default `true`: `409
+  account_exists` / `social_account`). `false` answers sign-up for a registered address
+  like a new one and emails the owner (`AccountNoticeMailer#existing_account`).
+- **`StandardId::PurgeUnverifiedEmailSignupsJob`** removes sign-ups made through the
+  email + password API (`signup_source` `"email_password"`; never the web sign-up form's) left unverified for `c.email_password.unverified_purge_after` (3 days), skipping any
+  account showing use. Schedule it yourself (`docs/OPERATIONS.md`).
+- **`StandardId::EmailPassword.discard_pending_credentials!`**, for a
+  `social.account.linked` subscriber: drops a stranger's pending password from an
+  account its owner has just proven with a provider.
+- **`StandardId::AccessRevocation.revoke_all!(account, reason:, issued_before: nil)`**
+  revokes every session and every refresh token, including sessionless ones; the web
+  password reset now uses it.
+- **`login_method_policy` flow `:api_email_password`.**
+- **`Identifier#verify!(defer_event: true)`** publishes
+  `IDENTIFIER_VERIFICATION_SUCCEEDED` after the enclosing transaction commits (and not
+  at all if it rolls back). The default is unchanged.
+
+### Changed
+
+- **`SESSION_REVOKED` timing on a web password reset** (from 0.54.1, now documented):
+  the events publish inside the reset's transaction, before it commits. Each is
+  rescued, so a subscriber cannot roll the reset back, but one that reads the rows
+  must do so after commit (from a job, say).
+- **`passwordless.bypass_code` applies to the web email/phone verification pages**
+  (from 0.54.1, which routed them through `Otp.verify`). It is never accepted in
+  production, which raises.
+
+## [0.54.1] - 2026-10-22
+
+### Security
+
+- **Web email/phone verification now counts attempts.** `Web::VerifyEmail::ConfirmController`
+  and `Web::VerifyPhone::ConfirmController` looked the code up with
+  `CodeChallenge.active.find_by(code:)`, so the only brake on guessing was the per-IP
+  rate limit. `PATCH` now goes through `StandardId::Otp.verify`, which counts failed
+  attempts and burns the challenge at `passwordless.max_attempts_per_challenge`.
+  `GET` no longer checks the code at all (it answered valid/invalid without counting an
+  attempt); a wrong code is reported on submit. Because `Otp.verify` honours
+  `passwordless.bypass_code`, that code now also verifies an email or phone through these
+  pages where it is allowed (never in production, which raises).
+- **Web password reset revokes refresh tokens.** `Web::ResetPasswordConfirmForm` ran
+  `account.sessions.destroy_all`, and `Session has_many :refresh_tokens, dependent:
+  :nullify` left every refresh token active and detached. It now revokes all sessions
+  (`Session.revoke_all_for!`, reason `"password_reset"`, one `SESSION_REVOKED` each)
+  and every remaining refresh token for the account, and publishes the documented
+  `credential.password.reset_completed` event, which the gem never emitted before (a
+  raising subscriber is logged, not surfaced, since the reset has already happened).
+  Sessions are revoked, no longer deleted.
+
 ## [0.54.0] - 2026-10-22
 
 ### Added

data/README.md

@@ -1614,6 +1614,7 @@ usual "invalid" answer and never reaches the policy.
 | `:oauth_social_callback` (`/api/oauth/callback/:provider`) | `:social` + `provider` | `403 access_denied`; a just-created account is removed |
 | `:oauth_refresh_token` | the **original** sign-in's method (and provider), else `:unspecified` | `400 invalid_grant` ("Refresh token is no longer valid"), and the token family is revoked |
 | `:api_device_session` / `:api_service_session` (`Api::TokenManager#create_*_session` from host code) | what you pass, else `:unspecified` | raises `LoginMethodDenied` |
+| `:api_email_password` (`/api/auth/login`, `/api/auth/verify-email`) | `:password` | `403 {"error":"login_method_denied"}` (through `error_renderer` when set) |
 
 **Refresh tokens remember how their authentication was made.** The method
 (and provider) is recorded at sign-in and carried along: web sign-in → the
@@ -1674,6 +1675,127 @@ POST /api/passwordless/verify
 }
 ```
 
+### Email + password API (0.55+)
+
+Opt-in sign-up and sign-in with an email and a password for JSON clients
+(mobile apps, SPAs), alongside the OAuth grants. Off by default; the routes are
+not drawn until you enable it. It needs migration
+`20261022000000_add_signup_source_to_standard_id_identifiers`, so run
+`bin/rails standard_id:install:migrations && bin/rails db:migrate` before
+enabling it.
+
+```ruby
+StandardId.configure do |c|
+  c.email_password.enabled = true
+  c.email_password.reset_url = "https://app.example.com/password-reset?token={token}"
+
+  # Optional hooks (each may declare any subset of its keywords):
+  c.email_password.require_name = true
+  c.email_password.client_key = ->(request:) { MaskedNetwork.for(request) }    # default: remote IP
+  c.email_password.password_validator = ->(password:) { PwnedPasswords.check(password) } # => Array of messages
+  c.email_password.after_email_verified = ->(account:, name:) { Profile.provision!(account, name) }
+  c.email_password.account_in_use = ->(account:) { Profile.exists?(account: account) }
+end
+```
+
+| Request (under the API mount) | Body | Success |
+|---|---|---|
+| `POST /auth/register` | `email`, `password`, `name?` | `202 {"status":"verification_required","email":…}` |
+| `POST /auth/verify-email` | `email`, `code`, `password` | `200` token response |
+| `POST /auth/verify-email/resend` | `email`, `password` | `202 {"status":"verification_sent"}`, always |
+| `POST /auth/login` | `email`, `password` | `200` token response |
+| `POST /auth/password/forgot` | `email` | `202 {"status":"reset_requested"}`, always |
+| `POST /auth/password/reset` | `token`, `password`, `password_confirmation?` | `200 {"status":"password_reset"}` |
+
+Requests must be JSON. Token responses are the usual `TokenResponse` and
+refresh through `POST /oauth/token` with `client_id` =
+`c.email_password.token_client_id` (default `"email"`).
+
+The rules:
+
+- **Sign-up creates an unverified account** and emails a 6-digit code
+  (`PasswordlessMailer#verification_email`, or your own
+  `PASSWORDLESS_CODE_GENERATED` subscriber with `code_delivery = :custom`). No
+  tokens until the address is verified.
+- **Verifying needs the code and the sign-up password**, so a stranger who
+  started a sign-up for someone else's address cannot finish it with the
+  owner's code. A wrong password answers exactly like a wrong code. Outside
+  production, `passwordless.bypass_code` is accepted as the code (as everywhere
+  `Otp.verify` runs); `after_email_verified` then receives no `name`.
+- **Re-submitting sign-up for a pending address never changes its password.**
+  With the same password it sends a fresh code; with a different one it answers
+  the same `202` and sends nothing.
+- **Login answers `unverified` (403) only when the password is right**;
+  everything else (unknown address, wrong password, deactivated or locked
+  account) is one `invalid_credentials` (401).
+- **Resend and forgot-password answer the same whatever the address.** The
+  reset lookup happens in `PasswordResetDeliveryJob`.
+- **A reset link** sets the password, verifies the address (the link proved the
+  inbox; a pending sign-up's `after_email_verified` runs then) and revokes every
+  session and refresh token. It is single-use and
+  expires with `PasswordCredential`'s `password_reset` token.
+- **Existing accounts:** sign-up for an address with a verified password
+  account answers `409 account_exists`, and for a social-only account `409
+  social_account`. Set `c.email_password.reveal_existing_accounts = false` to
+  answer those like a new address instead and email the owner
+  (`AccountNoticeMailer#existing_account`).
+- **`login_method_policy`** is consulted with `flow: :api_email_password`.
+- **Hooks and events.** `ACCOUNT_CREATED` and `CREDENTIAL_PASSWORD_CREATED`
+  fire at sign-up, for an address that is not verified yet; provision anything
+  that should wait for a proven address from `after_email_verified`. That hook
+  runs once, when the address is first verified (by code or reset link), in the
+  verification's transaction: if it raises, the address stays unverified and the
+  registrant retries with a new code or link. It runs only for a sign-up made
+  through this API (its identifier's `signup_source` is `"email_password"`): a
+  web sign-up verified here, by code or reset link, is verified without it. It runs with the address's rows
+  locked, so keep slow work (an external call) in a job it enqueues.
+
+  `IDENTIFIER_VERIFICATION_SUCCEEDED` is published only after that transaction
+  commits. A failing subscriber to it is logged, not raised, since the
+  verification has already committed. Tokens are minted under the password
+  credential's row lock, so a reset racing a login or a verification either
+  lands first (that request then fails) or revokes what it minted.
+
+**Errors** are `StandardId::EmailPasswordError` codes, rendered as
+`{"error": code, "error_description": message, "details"?: {field: [messages]}}`:
+
+| Code | Status |
+|---|---|
+| `invalid_credentials` | 401 |
+| `unverified`, `login_method_denied` | 403 |
+| `account_exists`, `social_account` | 409 |
+| `invalid_code`, `invalid_reset_token`, `weak_password`, `invalid_request` | 422 |
+| `rate_limited` (with `Retry-After`) | 429 |
+
+To keep an existing envelope, return your own body from
+`c.email_password.error_renderer = ->(error:, request:) { … }`; the status stays
+`error.http_status`.
+
+**Limits.** Each endpoint has short per-client-key and per-address limits that
+reuse `c.rate_limits` (`signup_per_ip`, `login_per_*`, `verification_start_*`,
+`password_reset_start_*`, `otp_verify_per_ip`) plus
+`email_password_verify_per_email` and `email_password_reset_per_ip`; like the
+engine's other `rate_limit` declarations they are read when the controller
+loads, so set them in an initializer. Daily per-address caps sit on top:
+`email_password_failed_verifications_per_day` (then verify is refused for the
+day, even with the right code), `email_password_codes_per_day`,
+`email_password_reset_requests_per_network_per_day` and
+`email_password_reset_requests_per_day`. All of them count in
+`c.cache_store`, so a `NullStore` disables them. Only a wrong code sent with the
+right password counts toward the daily verify lockout, but the short
+`email_password_verify_per_email` limit counts every request, so anyone can
+hold an address's verification off for that window.
+
+**Housekeeping.** Schedule `StandardId::PurgeUnverifiedEmailSignupsJob` (see
+[docs/OPERATIONS.md](docs/OPERATIONS.md)). If you link social sign-ins by
+email, call `StandardId::EmailPassword.discard_pending_credentials!(account,
+issued_before:)` from a `social.account.linked` subscriber, so an owner who
+signs in with a provider does not inherit a stranger's pending password.
+
+The operations behind the controller (`EmailPassword::Registration`,
+`Authentication`, `Verification`, `PasswordReset`, `TokenFlow`) are public, so
+a host can drive them from its own controllers instead.
+
 ### API Authentication
 
 ```ruby
@@ -1770,6 +1892,7 @@ StandardId creates the following tables:
 - `GET /userinfo` - OpenID Connect userinfo
 - `POST /passwordless/start` - Start passwordless flow
 - `POST /passwordless/verify` - Verify OTP code
+- `POST /auth/register`, `/auth/login`, `/auth/verify-email`, `/auth/verify-email/resend`, `/auth/password/forgot`, `/auth/password/reset` - Email + password, when `c.email_password.enabled`
 - `GET /oauth/callback/google` - Google OAuth callback
 - `POST /oauth/callback/apple` - Apple Sign In callback
 

data/app/controllers/standard_id/api/email_password_controller.rb

@@ -0,0 +1,131 @@
+module StandardId
+  module Api
+    # Email + password sign-up and sign-in for JSON clients. Drawn only while
+    # `c.email_password.enabled` is true; the rules are in StandardId::EmailPassword.
+    #
+    #   POST /auth/register             { email, password, name? }
+    #     202 { status: "verification_required", email }
+    #   POST /auth/login                { email, password }
+    #     200 token response
+    #   POST /auth/verify-email         { email, code, password }
+    #     200 token response
+    #   POST /auth/verify-email/resend  { email, password }
+    #     202 { status: "verification_sent" }, ALWAYS
+    #   POST /auth/password/forgot      { email }
+    #     202 { status: "reset_requested" }, ALWAYS
+    #   POST /auth/password/reset       { token, password, password_confirmation? }
+    #     200 { status: "password_reset" }
+    #
+    # Token responses are the TokenResponse every other grant returns, and
+    # refresh through /oauth/token with `c.email_password.token_client_id`.
+    #
+    # Failures are StandardId::EmailPasswordError codes, rendered as
+    # `{ error, error_description, details? }` with the code's status, or by
+    # `c.email_password.error_renderer` when set.
+    #
+    # Every action is limited per client key (`c.email_password.client_key`,
+    # default the remote IP) and, where there is one, per target email.
+    class EmailPasswordController < BaseController
+      public_controller
+
+      RATE_LIMITS = {
+        register: { ip: [:signup_per_ip, 1.hour], email: [:verification_start_per_target, 15.minutes] },
+        login: { ip: [:login_per_ip, 15.minutes], email: [:login_per_email, 15.minutes] },
+        verify: { ip: [:otp_verify_per_ip, 15.minutes], email: [:email_password_verify_per_email, 15.minutes] },
+        resend: { ip: [:verification_start_per_ip, 1.hour], email: [:verification_start_per_target, 15.minutes] },
+        forgot_password: { ip: [:password_reset_start_per_ip, 1.hour], email: [:password_reset_start_per_target, 15.minutes] },
+        reset_password: { ip: [:email_password_reset_per_ip, 15.minutes] }
+      }.freeze
+
+      RATE_LIMITS.each do |action, limits|
+        limits.each do |kind, (field, within)|
+          rate_limit to: StandardId.config.rate_limits.public_send(field),
+                     within: within,
+                     name: "email-password-#{action}-#{kind}",
+                     only: action,
+                     by: kind == :ip ? -> { rate_limit_client_key } : -> { "email:#{rate_limit_email.presence || rate_limit_client_key}" },
+                     with: -> { raise StandardId::EmailPasswordError.new(:rate_limited, retry_after: within.to_i) },
+                     store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+        end
+      end
+
+      rescue_from StandardId::EmailPasswordError, with: :render_email_password_error
+
+      def register
+        email = StandardId::EmailPassword::Registration.call(
+          email: params[:email], password: params[:password], name: params[:name], request: request
+        )
+        render json: { status: "verification_required", email: email }, status: :accepted
+      end
+
+      def login
+        StandardId::EmailPassword::Authentication.call(email: params[:email], password: params[:password]) do |account|
+          render_tokens_for(account)
+        end
+      end
+
+      def verify
+        StandardId::EmailPassword::Verification.verify!(
+          email: params[:email], code: params[:code], password: params[:password], request: request
+        ) do |account|
+          render_tokens_for(account)
+        end
+      end
+
+      def resend
+        StandardId::EmailPassword::Verification.send_code(
+          email: params[:email], password: params[:password], request: request
+        )
+        render json: { status: "verification_sent" }, status: :accepted
+      end
+
+      def forgot_password
+        StandardId::EmailPassword::PasswordReset.request(email: params[:email], request: request)
+        render json: { status: "reset_requested" }, status: :accepted
+      end
+
+      def reset_password
+        StandardId::EmailPassword::PasswordReset.complete!(
+          token: params[:token],
+          password: params[:password],
+          password_confirmation: params.key?(:password_confirmation) ? params[:password_confirmation] : nil,
+          request: request
+        )
+        render json: { status: "password_reset" }, status: :ok
+      end
+
+      private
+
+      def render_tokens_for(account)
+        render json: StandardId::EmailPassword::TokenFlow.new(account: account, request: request).execute, status: :ok
+      rescue StandardId::AccountDeactivatedError, StandardId::AccountLockedError
+        # The same answer as a wrong password: this endpoint must not reveal
+        # the account's state.
+        raise StandardId::EmailPasswordError.new(:invalid_credentials)
+      rescue StandardId::LoginMethodDenied => e
+        # The password was right, so the policy's reason may be shown.
+        raise StandardId::EmailPasswordError.new(:login_method_denied, e.message)
+      end
+
+      def render_email_password_error(error)
+        response.set_header("Retry-After", error.retry_after.to_i.to_s) if error.retry_after.to_i.positive?
+
+        renderer = StandardId::EmailPassword.config.error_renderer
+        body = if renderer.respond_to?(:call)
+          StandardId::EmailPassword.call_hook(renderer, error: error, request: request)
+        else
+          { error: error.code.to_s, error_description: error.message, details: error.details.presence }.compact
+        end
+        render json: body, status: error.http_status
+      end
+
+      def rate_limit_client_key
+        StandardId::EmailPassword.client_key(request).to_s
+      end
+
+      def rate_limit_email
+        StandardId::EmailPassword.normalize_email(params[:email])
+      end
+    end
+  end
+end

data/app/controllers/standard_id/web/verify_email/confirm_controller.rb

@@ -3,46 +3,42 @@ module StandardId
     module VerifyEmail
       class ConfirmController < BaseController
         # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
-        # verify). The per-challenge attempt cap alone doesn't stop distributed
-        # guessing across many challenges; both show and update probe a code.
+        # verify). Otp.verify's per-challenge attempt cap alone doesn't stop
+        # distributed guessing across many challenges.
         rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
                    within: 15.minutes,
                    name: "verify-email-confirm-ip",
                    only: [:show, :update],
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-        before_action :prepare_code_challenge
-
         def show
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if target.blank? || code.blank?
+          # Does not check the code: a GET that answered valid/invalid would be
+          # a guessing oracle that never counts an attempt. PATCH verifies.
           render plain: "verify email confirm", status: :ok
         end
 
         def update
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          # Otp.verify locks the challenge, compares in constant time, counts
+          # the failed attempt and burns the challenge at the per-challenge cap.
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if code.blank?
+
+          result = StandardId::Otp.verify(realm: "verification", target: target, code: code, channel: :email, request: request)
+          return redirect_to(standard_id_web.login_path, alert: result.error) unless result.success?
 
-          identifier = StandardId::EmailIdentifier.find_by(value: @challenge.target)
-          if identifier.present?
-            identifier.verify!
-          end
-          @challenge.use!
+          StandardId::EmailIdentifier.find_by(value: target)&.verify!
 
           redirect_to standard_id_web.login_path, notice: "Your email has been verified. Please sign in.", status: :see_other
         end
 
         private
 
-        def prepare_code_challenge
-          email = params[:email].to_s.strip.downcase
-          code = params[:code].to_s
-          return @challenge = nil if email.blank? || code.blank?
-
-          @challenge = StandardId::CodeChallenge.active.find_by(
-            realm: "verification",
-            channel: "email",
-            target: email,
-            code: code
-          )
+        def target
+          @target ||= params[:email].to_s.strip.downcase
+        end
+
+        def code
+          params[:code].to_s
         end
       end
     end

data/app/controllers/standard_id/web/verify_phone/confirm_controller.rb

@@ -3,46 +3,42 @@ module StandardId
     module VerifyPhone
       class ConfirmController < BaseController
         # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
-        # verify). The per-challenge attempt cap alone doesn't stop distributed
-        # guessing across many challenges; both show and update probe a code.
+        # verify). Otp.verify's per-challenge attempt cap alone doesn't stop
+        # distributed guessing across many challenges.
         rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
                    within: 15.minutes,
                    name: "verify-phone-confirm-ip",
                    only: [:show, :update],
                    store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
 
-        before_action :prepare_code_challenge
-
         def show
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if target.blank? || code.blank?
+          # Does not check the code: a GET that answered valid/invalid would be
+          # a guessing oracle that never counts an attempt. PATCH verifies.
           render plain: "verify phone confirm", status: :ok
         end
 
         def update
-          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if @challenge.nil?
+          # Otp.verify locks the challenge, compares in constant time, counts
+          # the failed attempt and burns the challenge at the per-challenge cap.
+          return redirect_to(standard_id_web.login_path, alert: "Invalid or expired verification code") if code.blank?
+
+          result = StandardId::Otp.verify(realm: "verification", target: target, code: code, channel: :sms, request: request)
+          return redirect_to(standard_id_web.login_path, alert: result.error) unless result.success?
 
-          identifier = StandardId::PhoneNumberIdentifier.find_by(value: @challenge.target)
-          if identifier.present?
-            identifier.verify!
-          end
-          @challenge.use!
+          StandardId::PhoneNumberIdentifier.find_by(value: target)&.verify!
 
           redirect_to standard_id_web.login_path, notice: "Your phone number has been verified. Please sign in.", status: :see_other
         end
 
         private
 
-        def prepare_code_challenge
-          phone = params[:phone_number].to_s.strip
-          code = params[:code].to_s
-          return @challenge = nil if phone.blank? || code.blank?
-
-          @challenge = StandardId::CodeChallenge.active.find_by(
-            realm: "verification",
-            channel: "sms",
-            target: phone,
-            code: code
-          )
+        def target
+          @target ||= params[:phone_number].to_s.strip
+        end
+
+        def code
+          params[:code].to_s
         end
       end
     end

data/app/forms/standard_id/web/reset_password_confirm_form.rb

@@ -22,16 +22,56 @@ module StandardId
       def submit
         return false unless valid?
 
+        account = @password_credential.account
+
+        # The password change and the revocation commit together, so a failure
+        # cannot leave the new password in place with old tokens still live.
+        # The SESSION_REVOKED events revoke_all_for! publishes therefore run
+        # before the commit; each is rescued, so a subscriber cannot roll the
+        # reset back, but one that reads the rows must do so after commit
+        # (e.g. from a job, which Rails enqueues after commit).
         ActiveRecord::Base.transaction do
           @password_credential.update!(password: password, password_confirmation: password_confirmation)
-          @password_credential.account.sessions.destroy_all
+          revoke_access!(account)
         end
 
+        publish_reset_completed(account)
+
         true
       rescue ActiveRecord::RecordInvalid => e
         errors.add(:base, e.record.errors.full_messages.join(", "))
         false
       end
+
+      private
+
+      # The reset has already happened, so a failing subscriber must not turn
+      # it into an error page; log and carry on, as Session does for
+      # SESSION_REVOKED.
+      def publish_reset_completed(account)
+        StandardId::Events.publish(
+          StandardId::Events::CREDENTIAL_PASSWORD_RESET_COMPLETED,
+          credential: @password_credential,
+          account: account
+        )
+      rescue StandardError => e
+        logger = StandardId.logger
+        return unless logger.respond_to?(:error)
+
+        logger.error(
+          "[StandardId::Web::ResetPasswordConfirmForm] Failed to publish " \
+          "CREDENTIAL_PASSWORD_RESET_COMPLETED for account #{account.id}: #{e.class}: #{e.message}"
+        )
+      end
+
+      # Revoke every session and refresh token (StandardId::AccessRevocation).
+      # Revoking rather than destroying keeps the audit trail and fires
+      # SESSION_REVOKED; sessions.destroy_all used to nullify
+      # refresh_tokens.session_id (dependent: :nullify), leaving those tokens
+      # active after the reset.
+      def revoke_access!(account)
+        StandardId::AccessRevocation.revoke_all!(account, reason: "password_reset")
+      end
     end
   end
 end