standard_id 0.54.1 → 0.55.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '047082209f6ec1b345a5500438fb424ef343c2e72f922b063ed876124b0ad957'
-  data.tar.gz: 00f773c75baff568d12c3caa98f56b49c4630da093808cf7a8afb82e5a66807a
+  metadata.gz: 1b6e3c72dcbb1a915c4927a4f0607b13d6f66c791240e20825698b490b0f13a1
+  data.tar.gz: 9606c37fbf368616167772d7a32fdadc7b4abb16758c9041b7041694b697ffb4
 SHA512:
-  metadata.gz: 9a2c6bb133b7eca3d39545b666b0d82b6ef03f59374110618fee49643dceaf8c839871761e188a1aa4f1f3e5c0b3dfebc28a3a61d68f4cc12fa051337f33de8c
-  data.tar.gz: 6aebcee090d61b6094f25b724e3a89bb73e7424227f2bef24e4b17606e175a081673b6e6c296a31374ab22661f5d7b0f998d9e4585aa0ba0330d2d684537f3ce
+  metadata.gz: b31012a34cc04b983d754b506f13d227a046dd5a33a53774b071d2822e4d51aba4745d685a25f0d84c7c55b7c37e79378351a4efbc556b91831368095282d7d4
+  data.tar.gz: e0ad4c58dfeb705e5824da097c12b6a00b6d60450f0c248a3f0a1874fe912f5549ecebfdbd1dd199aa6810af6668fea7f8562c6ee7dad0b076f29635e36ffd44

data/CHANGELOG.md

@@ -7,6 +7,53 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.55.0] - 2026-10-22
+
+### Added
+
+- **Email + password API, opt-in (`c.email_password.enabled`).** `POST /auth/register`,
+  `/auth/verify-email`, `/auth/verify-email/resend`, `/auth/login`,
+  `/auth/password/forgot` and `/auth/password/reset` under the API mount, for JSON
+  clients. Sign-up creates an unverified account and emails a 6-digit code;
+  verification needs the code and the sign-up password and returns the usual token
+  response, refreshable through `/oauth/token`. Login answers a distinct `unverified`
+  only to the right password. Resend and forgot always answer `202`. A reset verifies
+  the address and revokes every session and refresh token. Re-submitting a pending
+  sign-up never changes its password. Errors are stable `StandardId::EmailPasswordError`
+  codes, with an `error_renderer` hook for hosts that keep their own envelope. Short
+  limits reuse `c.rate_limits`, plus new daily per-address caps
+  (`rate_limits.email_password_*`). The operations behind it
+  (`StandardId::EmailPassword::*`) are public. Migration
+  **`20261022000000_add_signup_source_to_standard_id_identifiers`** adds the
+  nullable `signup_source` column that marks these sign-ups; run it before enabling
+  the API. See the README and `docs/MIGRATION_GUIDE.md`.
+- **`c.email_password.reveal_existing_accounts`** (default `true`: `409
+  account_exists` / `social_account`). `false` answers sign-up for a registered address
+  like a new one and emails the owner (`AccountNoticeMailer#existing_account`).
+- **`StandardId::PurgeUnverifiedEmailSignupsJob`** removes sign-ups made through the
+  email + password API (`signup_source` `"email_password"`; never the web sign-up form's) left unverified for `c.email_password.unverified_purge_after` (3 days), skipping any
+  account showing use. Schedule it yourself (`docs/OPERATIONS.md`).
+- **`StandardId::EmailPassword.discard_pending_credentials!`**, for a
+  `social.account.linked` subscriber: drops a stranger's pending password from an
+  account its owner has just proven with a provider.
+- **`StandardId::AccessRevocation.revoke_all!(account, reason:, issued_before: nil)`**
+  revokes every session and every refresh token, including sessionless ones; the web
+  password reset now uses it.
+- **`login_method_policy` flow `:api_email_password`.**
+- **`Identifier#verify!(defer_event: true)`** publishes
+  `IDENTIFIER_VERIFICATION_SUCCEEDED` after the enclosing transaction commits (and not
+  at all if it rolls back). The default is unchanged.
+
+### Changed
+
+- **`SESSION_REVOKED` timing on a web password reset** (from 0.54.1, now documented):
+  the events publish inside the reset's transaction, before it commits. Each is
+  rescued, so a subscriber cannot roll the reset back, but one that reads the rows
+  must do so after commit (from a job, say).
+- **`passwordless.bypass_code` applies to the web email/phone verification pages**
+  (from 0.54.1, which routed them through `Otp.verify`). It is never accepted in
+  production, which raises.
+
 ## [0.54.1] - 2026-10-22
 
 ### Security

data/README.md

@@ -1614,6 +1614,7 @@ usual "invalid" answer and never reaches the policy.
 | `:oauth_social_callback` (`/api/oauth/callback/:provider`) | `:social` + `provider` | `403 access_denied`; a just-created account is removed |
 | `:oauth_refresh_token` | the **original** sign-in's method (and provider), else `:unspecified` | `400 invalid_grant` ("Refresh token is no longer valid"), and the token family is revoked |
 | `:api_device_session` / `:api_service_session` (`Api::TokenManager#create_*_session` from host code) | what you pass, else `:unspecified` | raises `LoginMethodDenied` |
+| `:api_email_password` (`/api/auth/login`, `/api/auth/verify-email`) | `:password` | `403 {"error":"login_method_denied"}` (through `error_renderer` when set) |
 
 **Refresh tokens remember how their authentication was made.** The method
 (and provider) is recorded at sign-in and carried along: web sign-in → the
@@ -1674,6 +1675,127 @@ POST /api/passwordless/verify
 }
 ```
 
+### Email + password API (0.55+)
+
+Opt-in sign-up and sign-in with an email and a password for JSON clients
+(mobile apps, SPAs), alongside the OAuth grants. Off by default; the routes are
+not drawn until you enable it. It needs migration
+`20261022000000_add_signup_source_to_standard_id_identifiers`, so run
+`bin/rails standard_id:install:migrations && bin/rails db:migrate` before
+enabling it.
+
+```ruby
+StandardId.configure do |c|
+  c.email_password.enabled = true
+  c.email_password.reset_url = "https://app.example.com/password-reset?token={token}"
+
+  # Optional hooks (each may declare any subset of its keywords):
+  c.email_password.require_name = true
+  c.email_password.client_key = ->(request:) { MaskedNetwork.for(request) }    # default: remote IP
+  c.email_password.password_validator = ->(password:) { PwnedPasswords.check(password) } # => Array of messages
+  c.email_password.after_email_verified = ->(account:, name:) { Profile.provision!(account, name) }
+  c.email_password.account_in_use = ->(account:) { Profile.exists?(account: account) }
+end
+```
+
+| Request (under the API mount) | Body | Success |
+|---|---|---|
+| `POST /auth/register` | `email`, `password`, `name?` | `202 {"status":"verification_required","email":…}` |
+| `POST /auth/verify-email` | `email`, `code`, `password` | `200` token response |
+| `POST /auth/verify-email/resend` | `email`, `password` | `202 {"status":"verification_sent"}`, always |
+| `POST /auth/login` | `email`, `password` | `200` token response |
+| `POST /auth/password/forgot` | `email` | `202 {"status":"reset_requested"}`, always |
+| `POST /auth/password/reset` | `token`, `password`, `password_confirmation?` | `200 {"status":"password_reset"}` |
+
+Requests must be JSON. Token responses are the usual `TokenResponse` and
+refresh through `POST /oauth/token` with `client_id` =
+`c.email_password.token_client_id` (default `"email"`).
+
+The rules:
+
+- **Sign-up creates an unverified account** and emails a 6-digit code
+  (`PasswordlessMailer#verification_email`, or your own
+  `PASSWORDLESS_CODE_GENERATED` subscriber with `code_delivery = :custom`). No
+  tokens until the address is verified.
+- **Verifying needs the code and the sign-up password**, so a stranger who
+  started a sign-up for someone else's address cannot finish it with the
+  owner's code. A wrong password answers exactly like a wrong code. Outside
+  production, `passwordless.bypass_code` is accepted as the code (as everywhere
+  `Otp.verify` runs); `after_email_verified` then receives no `name`.
+- **Re-submitting sign-up for a pending address never changes its password.**
+  With the same password it sends a fresh code; with a different one it answers
+  the same `202` and sends nothing.
+- **Login answers `unverified` (403) only when the password is right**;
+  everything else (unknown address, wrong password, deactivated or locked
+  account) is one `invalid_credentials` (401).
+- **Resend and forgot-password answer the same whatever the address.** The
+  reset lookup happens in `PasswordResetDeliveryJob`.
+- **A reset link** sets the password, verifies the address (the link proved the
+  inbox; a pending sign-up's `after_email_verified` runs then) and revokes every
+  session and refresh token. It is single-use and
+  expires with `PasswordCredential`'s `password_reset` token.
+- **Existing accounts:** sign-up for an address with a verified password
+  account answers `409 account_exists`, and for a social-only account `409
+  social_account`. Set `c.email_password.reveal_existing_accounts = false` to
+  answer those like a new address instead and email the owner
+  (`AccountNoticeMailer#existing_account`).
+- **`login_method_policy`** is consulted with `flow: :api_email_password`.
+- **Hooks and events.** `ACCOUNT_CREATED` and `CREDENTIAL_PASSWORD_CREATED`
+  fire at sign-up, for an address that is not verified yet; provision anything
+  that should wait for a proven address from `after_email_verified`. That hook
+  runs once, when the address is first verified (by code or reset link), in the
+  verification's transaction: if it raises, the address stays unverified and the
+  registrant retries with a new code or link. It runs only for a sign-up made
+  through this API (its identifier's `signup_source` is `"email_password"`): a
+  web sign-up verified here, by code or reset link, is verified without it. It runs with the address's rows
+  locked, so keep slow work (an external call) in a job it enqueues.
+
+  `IDENTIFIER_VERIFICATION_SUCCEEDED` is published only after that transaction
+  commits. A failing subscriber to it is logged, not raised, since the
+  verification has already committed. Tokens are minted under the password
+  credential's row lock, so a reset racing a login or a verification either
+  lands first (that request then fails) or revokes what it minted.
+
+**Errors** are `StandardId::EmailPasswordError` codes, rendered as
+`{"error": code, "error_description": message, "details"?: {field: [messages]}}`:
+
+| Code | Status |
+|---|---|
+| `invalid_credentials` | 401 |
+| `unverified`, `login_method_denied` | 403 |
+| `account_exists`, `social_account` | 409 |
+| `invalid_code`, `invalid_reset_token`, `weak_password`, `invalid_request` | 422 |
+| `rate_limited` (with `Retry-After`) | 429 |
+
+To keep an existing envelope, return your own body from
+`c.email_password.error_renderer = ->(error:, request:) { … }`; the status stays
+`error.http_status`.
+
+**Limits.** Each endpoint has short per-client-key and per-address limits that
+reuse `c.rate_limits` (`signup_per_ip`, `login_per_*`, `verification_start_*`,
+`password_reset_start_*`, `otp_verify_per_ip`) plus
+`email_password_verify_per_email` and `email_password_reset_per_ip`; like the
+engine's other `rate_limit` declarations they are read when the controller
+loads, so set them in an initializer. Daily per-address caps sit on top:
+`email_password_failed_verifications_per_day` (then verify is refused for the
+day, even with the right code), `email_password_codes_per_day`,
+`email_password_reset_requests_per_network_per_day` and
+`email_password_reset_requests_per_day`. All of them count in
+`c.cache_store`, so a `NullStore` disables them. Only a wrong code sent with the
+right password counts toward the daily verify lockout, but the short
+`email_password_verify_per_email` limit counts every request, so anyone can
+hold an address's verification off for that window.
+
+**Housekeeping.** Schedule `StandardId::PurgeUnverifiedEmailSignupsJob` (see
+[docs/OPERATIONS.md](docs/OPERATIONS.md)). If you link social sign-ins by
+email, call `StandardId::EmailPassword.discard_pending_credentials!(account,
+issued_before:)` from a `social.account.linked` subscriber, so an owner who
+signs in with a provider does not inherit a stranger's pending password.
+
+The operations behind the controller (`EmailPassword::Registration`,
+`Authentication`, `Verification`, `PasswordReset`, `TokenFlow`) are public, so
+a host can drive them from its own controllers instead.
+
 ### API Authentication
 
 ```ruby
@@ -1770,6 +1892,7 @@ StandardId creates the following tables:
 - `GET /userinfo` - OpenID Connect userinfo
 - `POST /passwordless/start` - Start passwordless flow
 - `POST /passwordless/verify` - Verify OTP code
+- `POST /auth/register`, `/auth/login`, `/auth/verify-email`, `/auth/verify-email/resend`, `/auth/password/forgot`, `/auth/password/reset` - Email + password, when `c.email_password.enabled`
 - `GET /oauth/callback/google` - Google OAuth callback
 - `POST /oauth/callback/apple` - Apple Sign In callback
 

data/app/controllers/standard_id/api/email_password_controller.rb

@@ -0,0 +1,131 @@
+module StandardId
+  module Api
+    # Email + password sign-up and sign-in for JSON clients. Drawn only while
+    # `c.email_password.enabled` is true; the rules are in StandardId::EmailPassword.
+    #
+    #   POST /auth/register             { email, password, name? }
+    #     202 { status: "verification_required", email }
+    #   POST /auth/login                { email, password }
+    #     200 token response
+    #   POST /auth/verify-email         { email, code, password }
+    #     200 token response
+    #   POST /auth/verify-email/resend  { email, password }
+    #     202 { status: "verification_sent" }, ALWAYS
+    #   POST /auth/password/forgot      { email }
+    #     202 { status: "reset_requested" }, ALWAYS
+    #   POST /auth/password/reset       { token, password, password_confirmation? }
+    #     200 { status: "password_reset" }
+    #
+    # Token responses are the TokenResponse every other grant returns, and
+    # refresh through /oauth/token with `c.email_password.token_client_id`.
+    #
+    # Failures are StandardId::EmailPasswordError codes, rendered as
+    # `{ error, error_description, details? }` with the code's status, or by
+    # `c.email_password.error_renderer` when set.
+    #
+    # Every action is limited per client key (`c.email_password.client_key`,
+    # default the remote IP) and, where there is one, per target email.
+    class EmailPasswordController < BaseController
+      public_controller
+
+      RATE_LIMITS = {
+        register: { ip: [:signup_per_ip, 1.hour], email: [:verification_start_per_target, 15.minutes] },
+        login: { ip: [:login_per_ip, 15.minutes], email: [:login_per_email, 15.minutes] },
+        verify: { ip: [:otp_verify_per_ip, 15.minutes], email: [:email_password_verify_per_email, 15.minutes] },
+        resend: { ip: [:verification_start_per_ip, 1.hour], email: [:verification_start_per_target, 15.minutes] },
+        forgot_password: { ip: [:password_reset_start_per_ip, 1.hour], email: [:password_reset_start_per_target, 15.minutes] },
+        reset_password: { ip: [:email_password_reset_per_ip, 15.minutes] }
+      }.freeze
+
+      RATE_LIMITS.each do |action, limits|
+        limits.each do |kind, (field, within)|
+          rate_limit to: StandardId.config.rate_limits.public_send(field),
+                     within: within,
+                     name: "email-password-#{action}-#{kind}",
+                     only: action,
+                     by: kind == :ip ? -> { rate_limit_client_key } : -> { "email:#{rate_limit_email.presence || rate_limit_client_key}" },
+                     with: -> { raise StandardId::EmailPasswordError.new(:rate_limited, retry_after: within.to_i) },
+                     store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+        end
+      end
+
+      rescue_from StandardId::EmailPasswordError, with: :render_email_password_error
+
+      def register
+        email = StandardId::EmailPassword::Registration.call(
+          email: params[:email], password: params[:password], name: params[:name], request: request
+        )
+        render json: { status: "verification_required", email: email }, status: :accepted
+      end
+
+      def login
+        StandardId::EmailPassword::Authentication.call(email: params[:email], password: params[:password]) do |account|
+          render_tokens_for(account)
+        end
+      end
+
+      def verify
+        StandardId::EmailPassword::Verification.verify!(
+          email: params[:email], code: params[:code], password: params[:password], request: request
+        ) do |account|
+          render_tokens_for(account)
+        end
+      end
+
+      def resend
+        StandardId::EmailPassword::Verification.send_code(
+          email: params[:email], password: params[:password], request: request
+        )
+        render json: { status: "verification_sent" }, status: :accepted
+      end
+
+      def forgot_password
+        StandardId::EmailPassword::PasswordReset.request(email: params[:email], request: request)
+        render json: { status: "reset_requested" }, status: :accepted
+      end
+
+      def reset_password
+        StandardId::EmailPassword::PasswordReset.complete!(
+          token: params[:token],
+          password: params[:password],
+          password_confirmation: params.key?(:password_confirmation) ? params[:password_confirmation] : nil,
+          request: request
+        )
+        render json: { status: "password_reset" }, status: :ok
+      end
+
+      private
+
+      def render_tokens_for(account)
+        render json: StandardId::EmailPassword::TokenFlow.new(account: account, request: request).execute, status: :ok
+      rescue StandardId::AccountDeactivatedError, StandardId::AccountLockedError
+        # The same answer as a wrong password: this endpoint must not reveal
+        # the account's state.
+        raise StandardId::EmailPasswordError.new(:invalid_credentials)
+      rescue StandardId::LoginMethodDenied => e
+        # The password was right, so the policy's reason may be shown.
+        raise StandardId::EmailPasswordError.new(:login_method_denied, e.message)
+      end
+
+      def render_email_password_error(error)
+        response.set_header("Retry-After", error.retry_after.to_i.to_s) if error.retry_after.to_i.positive?
+
+        renderer = StandardId::EmailPassword.config.error_renderer
+        body = if renderer.respond_to?(:call)
+          StandardId::EmailPassword.call_hook(renderer, error: error, request: request)
+        else
+          { error: error.code.to_s, error_description: error.message, details: error.details.presence }.compact
+        end
+        render json: body, status: error.http_status
+      end
+
+      def rate_limit_client_key
+        StandardId::EmailPassword.client_key(request).to_s
+      end
+
+      def rate_limit_email
+        StandardId::EmailPassword.normalize_email(params[:email])
+      end
+    end
+  end
+end

data/app/forms/standard_id/web/reset_password_confirm_form.rb

@@ -64,14 +64,13 @@ module StandardId
         )
       end
 
-      # Revoke every session (and the refresh tokens under them), then any
-      # refresh token with no session (e.g. one minted by a grant flow). Revoking
-      # rather than destroying keeps the audit trail and fires SESSION_REVOKED;
-      # sessions.destroy_all used to nullify refresh_tokens.session_id
-      # (dependent: :nullify), leaving those tokens active after the reset.
+      # Revoke every session and refresh token (StandardId::AccessRevocation).
+      # Revoking rather than destroying keeps the audit trail and fires
+      # SESSION_REVOKED; sessions.destroy_all used to nullify
+      # refresh_tokens.session_id (dependent: :nullify), leaving those tokens
+      # active after the reset.
       def revoke_access!(account)
-        StandardId::Session.revoke_all_for!(account, reason: "password_reset")
-        StandardId::RefreshToken.where(account_id: account.id, revoked_at: nil).update_all(revoked_at: Time.current)
+        StandardId::AccessRevocation.revoke_all!(account, reason: "password_reset")
       end
     end
   end

data/app/jobs/standard_id/purge_unverified_email_signups_job.rb

@@ -0,0 +1,141 @@
+module StandardId
+  # Deletes email + password sign-ups (StandardId::EmailPassword) that were
+  # never verified. A no-op unless `c.email_password.enabled`; not part of
+  # CleanupAllJob, so schedule it yourself (daily is plenty).
+  #
+  # A sign-up that sits unverified is dead weight at best and, at worst, a
+  # stranger squatting someone else's address (see
+  # EmailPassword::Registration). After `c.email_password.unverified_purge_after`
+  # seconds (3 days by default, far beyond the code TTL and the daily code cap)
+  # the pending password credential and its email identifier are removed, and
+  # the account too when nothing else is left on it.
+  #
+  # Only an email identifier that is unverified, has no provider, carries a
+  # password credential, is older than the cutoff AND was created by
+  # EmailPassword::Registration (`signup_source`, EmailPassword.api_signup?)
+  # is considered. That last condition keeps the job away from other
+  # unverified password sign-ups, such as Web::SignupForm's.
+  # Even then the whole account is skipped, unchanged, at any sign of real use:
+  #   * any verified identifier, or any with a provider (a social sign-in
+  #     linked to it does not verify the identifier, so the provider is
+  #     checked separately);
+  #   * any session or refresh token;
+  #   * `c.email_password.account_in_use` returning true (e.g. the host's
+  #     profile rows);
+  #   * any other row still referencing the account: the delete is guarded by
+  #     restrict / foreign keys, and a guard failure rolls the unit back.
+  # A sign-up whose owner asked for a code within
+  # `c.email_password.purge_recent_code_window` seconds is kept, so someone
+  # who comes back on day 4 is not deleted minutes before typing the code in.
+  # So is one whose address asked for a password reset in the last 24 hours
+  # (EmailPassword::DailyLimit's counter; a reset leaves no row), so the
+  # link in flight still works. That check is only as good as the rate-limit
+  # store: with a null store it never fires.
+  # Each sign-up is re-checked under a row lock in its own transaction, so a
+  # verification that lands mid-run wins. The locks are taken in the order
+  # verify and reset take them (password credential, then identifier); a
+  # deadlock or lock wait timeout anyway leaves the sign-up for the next run.
+  class PurgeUnverifiedEmailSignupsJob < ApplicationJob
+    queue_as :default
+
+    # @param older_than_seconds [Integer, nil] defaults to
+    #   c.email_password.unverified_purge_after
+    # @return [Hash] `{ purged_count:, skipped_count: }`
+    def perform(older_than_seconds: nil)
+      return { purged_count: 0, skipped_count: 0 } unless StandardId::EmailPassword.enabled?
+
+      cutoff = (older_than_seconds || config.unverified_purge_after).to_i.seconds.ago
+      purged = 0
+      skipped = 0
+
+      candidates(cutoff).find_each do |identifier|
+        if purge(identifier, cutoff)
+          purged += 1
+        else
+          skipped += 1
+        end
+      end
+
+      Rails.logger.info("[StandardId] Purged #{purged} unverified email sign-ups older than #{cutoff} (skipped #{skipped})")
+      { purged_count: purged, skipped_count: skipped }
+    end
+
+    private
+
+    def config
+      StandardId::EmailPassword.config
+    end
+
+    def candidates(cutoff)
+      StandardId::EmailIdentifier
+        .where(verified_at: nil, provider: nil, signup_source: StandardId::EmailPassword::SIGNUP_SOURCE)
+        .where(created_at: ...cutoff)
+        .where(id: StandardId::Credential.where(credentialable_type: StandardId::PasswordCredential.name).select(:identifier_id))
+    end
+
+    # true when the sign-up was removed, false when it was left alone.
+    def purge(identifier, cutoff)
+      ActiveRecord::Base.transaction do
+        lock_password_credentials(identifier)
+        identifier.lock!
+        return false unless identifier.verified_at.nil? && identifier.provider.nil? && identifier.created_at < cutoff &&
+          StandardId::EmailPassword.api_signup?(identifier)
+
+        account = StandardId.account_class.find_by(id: identifier.account_id)
+        return false if account.nil? || account_in_use?(account)
+        return false if recent_code_requested?(identifier.value) || reset_requested?(identifier.value)
+
+        credentials = StandardId::Credential.where(identifier_id: identifier.id).to_a
+        return false unless credentials.all? { |c| c.credentialable_type == StandardId::PasswordCredential.name }
+
+        password_credentials = StandardId::PasswordCredential.where(id: credentials.map(&:credentialable_id)).to_a
+        credentials.each(&:destroy!)
+        password_credentials.each(&:destroy!)
+        identifier.destroy!
+
+        unless StandardId::Identifier.exists?(account_id: account.id)
+          # The dependent-destroy cascade lazy-loads associations, which a host
+          # running strict_loading_by_default would refuse.
+          account.strict_loading!(false)
+          account.destroy!
+        end
+        true
+      end
+    rescue ActiveRecord::DeleteRestrictionError, ActiveRecord::InvalidForeignKey, ActiveRecord::RecordNotDestroyed,
+      ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout => e
+      Rails.logger.warn("[StandardId] Left unverified email sign-up #{identifier.id} alone: #{e.class}")
+      false
+    end
+
+    def lock_password_credentials(identifier)
+      StandardId::PasswordCredential
+        .where(id: StandardId::Credential
+          .where(identifier_id: identifier.id, credentialable_type: StandardId::PasswordCredential.name)
+          .select(:credentialable_id))
+        .order(:id)
+        .lock
+        .to_a
+    end
+
+    def account_in_use?(account)
+      return true if StandardId::Identifier.where(account_id: account.id).where("verified_at IS NOT NULL OR provider IS NOT NULL").exists?
+      return true if StandardId::Session.where(account_id: account.id).exists?
+      return true if StandardId::RefreshToken.where(account_id: account.id).exists?
+
+      hook = config.account_in_use
+      # Any truthy answer keeps the account: when in doubt, keep.
+      hook.respond_to?(:call) && StandardId::EmailPassword.call_hook(hook, account: account) ? true : false
+    end
+
+    def reset_requested?(email)
+      StandardId::EmailPassword::DailyLimit.count(:reset_requested, email).positive?
+    end
+
+    def recent_code_requested?(email)
+      StandardId::CodeChallenge
+        .where(realm: config.verification_realm, target: StandardId::EmailPassword.normalize_email(email))
+        .where(created_at: config.purge_recent_code_window.to_i.seconds.ago..)
+        .exists?
+    end
+  end
+end

data/app/mailers/standard_id/account_notice_mailer.rb

@@ -0,0 +1,33 @@
+module StandardId
+  # Notices about an account, sent to its address rather than to whoever made
+  # the request.
+  #
+  # * #existing_account: sign-up was attempted for an address that already has
+  #   an account, while `c.email_password.reveal_existing_accounts` is false
+  #   (the API then answers as if the sign-up went ahead). The owner learns
+  #   about it and how to get in; the requester learns nothing.
+  #
+  # Copy lives under `standard_id.account_notice_mailer.<action>.*` in
+  # config/locales/en.yml; override any key in the host's locale files, or the
+  # templates in app/views/standard_id/account_notice_mailer/.
+  class AccountNoticeMailer < ApplicationMailer
+    layout false
+
+    helper_method :notice_copy
+
+    # @param email [String]
+    def existing_account
+      @email = params[:email]
+
+      mail(to: @email, from: StandardId.config.passwordless.mailer_from, subject: notice_copy(:subject))
+    end
+
+    # Copy for the current action, falling back to the gem's English (see
+    # PasswordlessMailer#otp_copy).
+    def notice_copy(key, default: nil, **options)
+      scope = "standard_id.account_notice_mailer.#{action_name}"
+      english = I18n.t(key, scope: scope, locale: :en, default: default, **options)
+      I18n.t(key, scope: scope, default: english, **options)
+    end
+  end
+end

data/app/models/standard_id/identifier.rb

@@ -20,9 +20,17 @@ module StandardId
       verified_at.present?
     end
 
-    def verify!
+    # +defer_event+ holds IDENTIFIER_VERIFICATION_SUCCEEDED until the
+    # enclosing transaction commits, and drops it if that rolls back. The
+    # verification has committed by the time it fires, so a failing
+    # subscriber is logged rather than raised.
+    def verify!(defer_event: false)
       update!(verified_at: Time.current)
-      emit_verification_succeeded
+      if defer_event
+        ActiveRecord.after_all_transactions_commit { emit_verification_succeeded_after_commit }
+      else
+        emit_verification_succeeded
+      end
     end
 
     def unverify!
@@ -63,6 +71,18 @@ module StandardId
       )
     end
 
+    def emit_verification_succeeded_after_commit
+      emit_verification_succeeded
+    rescue StandardError => e
+      logger = StandardId.logger
+      return unless logger.respond_to?(:error)
+
+      logger.error(
+        "[StandardId::Identifier] Failed to publish IDENTIFIER_VERIFICATION_SUCCEEDED " \
+        "for identifier #{id}: #{e.class}: #{e.message}"
+      )
+    end
+
     def emit_account_verified
       StandardId::Events.publish(
         StandardId::Events::ACCOUNT_VERIFIED,

data/app/models/standard_id/session.rb

@@ -176,10 +176,10 @@ module StandardId
       )
     end
 
-    # DB state is already committed by the time this runs (unless the caller
-    # wraps revoke_all_for! in its own transaction, as Web::ResetPasswordConfirmForm
-    # does); event publishing is
-    # best-effort audit emission. A failing subscriber must not short-circuit the
+    # DB state is already committed by the time this runs, unless the caller
+    # wraps revoke_all_for! in its own transaction, as StandardId::AccessRevocation
+    # does for the password-reset paths (Web::ResetPasswordConfirmForm and
+    # EmailPassword::PasswordReset). Event publishing is best-effort audit emission. A failing subscriber must not short-circuit the
     # loop and leave later sessions without their SESSION_REVOKED event, which
     # would permanently desync audit-trail consumers from the DB.
     def self.publish_session_revocations(sessions, account:, reason:, now:)

data/app/views/standard_id/account_notice_mailer/existing_account.html.erb

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; background-color: #f5f5f5; margin: 0; padding: 0; }
+    .container { max-width: 480px; margin: 40px auto; background-color: #ffffff; border-radius: 8px; padding: 40px; }
+    .footer { margin-top: 32px; font-size: 13px; color: #888888; text-align: center; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <p><%= notice_copy(:greeting) %></p>
+    <p><%= notice_copy(:intro) %></p>
+    <p><%= notice_copy(:action) %></p>
+    <p><%= notice_copy(:ignore) %></p>
+    <div class="footer">
+      <p><%= notice_copy(:footer) %></p>
+    </div>
+  </div>
+</body>
+</html>

data/app/views/standard_id/account_notice_mailer/existing_account.text.erb

@@ -0,0 +1,10 @@
+<%= notice_copy(:greeting) %>
+
+<%= notice_copy(:intro) %>
+
+<%= notice_copy(:action) %>
+
+<%= notice_copy(:ignore) %>
+
+--
+<%= notice_copy(:footer) %>

data/config/locales/en.yml

@@ -20,3 +20,11 @@ en:
           other: "This code will expire in %{count} minutes."
         ignore: "If you did not request this code, you can safely ignore this email."
         footer: "This is an automated message. Please do not reply."
+    account_notice_mailer:
+      existing_account:
+        subject: "Someone tried to sign up with your email"
+        greeting: "Hi,"
+        intro: "Someone just tried to create an account with this email address, but you already have one."
+        action: "If that was you, sign in the way you did before, or reset your password if you have forgotten it."
+        ignore: "If it wasn't you, you can safely ignore this email. Your account has not changed."
+        footer: "This is an automated message. Please do not reply."

data/config/routes/api.rb

@@ -10,6 +10,20 @@ StandardId::ApiEngine.routes.draw do
       post :start
     end
 
+    # Email + password for JSON clients (StandardId::EmailPassword). Drawn
+    # always but matched only while c.email_password.enabled is true, so the
+    # endpoints 404 otherwise.
+    constraints(->(_request) { StandardId::EmailPassword.enabled? }) do
+      scope "auth", controller: :email_password, as: :email_password do
+        post "register", action: :register, as: :register
+        post "login", action: :login, as: :login
+        post "verify-email", action: :verify, as: :verify
+        post "verify-email/resend", action: :resend, as: :resend
+        post "password/forgot", action: :forgot_password, as: :forgot_password
+        post "password/reset", action: :reset_password, as: :reset_password
+      end
+    end
+
     namespace :oidc do
       resource :logout, only: [:show], controller: :logout
     end