standard_id 0.55.1 → 0.56.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79b115262b448690a7d1429716da8b36e6422be79e9406868684a3744e0cf3e8
-  data.tar.gz: a43dc5ed9ea2ff5bd5317809f79c9326d1df14a2115f63e631090a7fe15042cd
+  metadata.gz: 5d21b27586542e7f6f9bc312ace8fed7a75a8b75c4633e470232890b869f802f
+  data.tar.gz: 46b0df7981fa6785cdbc86a0ea65e52bf30c6c293a6198671d43169dd82fb955
 SHA512:
-  metadata.gz: a184a92b4a8f865db6e4fd4f05cbaa9e44d1156407ed61d30530ee6379269cc9cc3da0d9f64b800c7fc44461abc28d2df44ebe2d4562a6dbde96d0f69a106ec7
-  data.tar.gz: abc3fe5d187c94408406cfeba9e27a699f5542b30a1979c268c7b5fe7d2986ea29b56dcb6d4b8399b8e0df3a7ed56271951a49eec9a25076d5cd568a1a30b9c5
+  metadata.gz: c54196984851c658850c910a1509ffbc4231911759a0f003d9f3915002459ca5d313a61643abdd43edeac85d332ef8bc1c4173d65e9ca3fe2f747f44aff93e14
+  data.tar.gz: 44510185f41ecd77b81c1d44342e5e6b2e432c75232c91cd3347ddea25fa3115d370e05d0af2d54a878a2dbf38cc5888bd0bdb82de12d9d1888b9df60474c10a

data/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.56.0] - 2026-10-26
+
+### Added
+
+- **`c.events.log_login_identifiers` (default `false`).** `LoggingSubscriber` now redacts the submitted
+  email/login in `AUTHENTICATION_ATTEMPT_STARTED` (debug) and `AUTHENTICATION_FAILED` (warn) log lines by
+  default: email-shaped values are logged as `lo***@domain`; everything else as `lo***`. Set
+  `c.events.log_login_identifiers = true` to restore the previous behaviour (full value logged) for apps
+  that need it for debugging.
+
+- **Boot-time warning when `verify_issuer: false` is combined with a configured `issuer`.** The existing
+  warning fires when `issuer` is blank; this companion fires when `issuer` is set but `verify_issuer` is
+  explicitly `false`, reminding operators it is a migration flag to remove once all in-flight tokens have
+  expired.
+
+### Fixed
+
+- **Inertia history is now cleared on sign-out** for hosts that set `use_inertia = true`.
+  `Web::LogoutController#create` and the current-session branch of
+  `Web::SessionsController#destroy` now pass `inertia: { clear_history: true }` on
+  the redirect, which stores a session flag that the next Inertia render consumes
+  (`clearHistory: true` in the page JSON). Without this, the old history-encryption
+  key remained in `sessionStorage` and `Back` could still decrypt pages viewed while
+  signed in. Hosts without `use_inertia` are unaffected.
+
+  Rolling this out requires a release followed by a `/rollout-gem` to all five
+  consumers (fundbright-web, nutripod-web, jumpdrive-web, luminality-web,
+  sidekick-web).
+
 ## [0.55.1] - 2026-10-23
 
 ### Fixed

data/app/controllers/standard_id/web/logout_controller.rb

@@ -14,7 +14,8 @@ module StandardId
 
       def create
         revoke_current_session!
-        redirect_to logout_destination, notice: "Successfully signed out"
+        redirect_to logout_destination, notice: "Successfully signed out",
+                    **(use_inertia? ? { inertia: { clear_history: true } } : {})
       end
 
       private

data/app/controllers/standard_id/web/sessions_controller.rb

@@ -15,7 +15,8 @@ module StandardId
         if session == current_session
           # If revoking current session, sign out and redirect
           revoke_current_session!
-          redirect_to "/", notice: "Session revoked. You have been signed out."
+          redirect_to "/", notice: "Session revoked. You have been signed out.",
+                      **(use_inertia? ? { inertia: { clear_history: true } } : {})
         else
           # Revoke other session
           session.revoke!

data/lib/standard_id/config/schema.rb

@@ -153,6 +153,20 @@ StandardId::ConfigSchema.define do
   scope :events do
     field :enable_logging, type: :boolean, default: false
 
+    # Whether to log the full login identifier (email / username) in
+    # `AUTHENTICATION_ATTEMPT_STARTED` and `AUTHENTICATION_FAILED` log lines.
+    #
+    # Defaults to `false`: a redacted form is logged instead
+    # (`local-part[0..1]***@domain` for email-shaped values, first two
+    # characters + *** for everything else). This prevents email addresses from
+    # accumulating in log sinks (Sentry, Datadog, etc.) on every failed login
+    # attempt, including attacker probes.
+    #
+    # Set to `true` only for apps that have already accepted the privacy
+    # trade-off and need the full value for debugging — typically behind an
+    # environment flag that is off in production.
+    field :log_login_identifiers, type: :boolean, default: false
+
     # Publish `<key>_id` / `<key>_gid` alongside every record-valued payload key
     # (rarebit-one/rarebit-ops#296).
     #

data/lib/standard_id/engine.rb

@@ -81,10 +81,7 @@ module StandardId
       StandardId::Events::Subscribers::PasswordlessDeliverySubscriber.attach
       StandardId::Events::Subscribers::PasswordResetDeliverySubscriber.attach
 
-      if StandardId.config.issuer.blank?
-        Rails.logger.warn("[StandardId] No issuer configured. JWT tokens will not include or verify the 'iss' claim. " \
-                          "Set StandardId.config.issuer in your initializer for production use.")
-      end
+      StandardId::Engine.warn_about_issuer_config!
 
       # Fail loudly if `association_strict_loading` was assigned after the
       # host's Account class body already ran — that assignment has no effect,
@@ -175,5 +172,21 @@ module StandardId
         "audiences (e.g., ['web', 'api']) to close cross-audience replay vectors."
       )
     end
+
+    # Warn when the issuer configuration is missing or when `verify_issuer`
+    # is explicitly `false` with an issuer set (migration flag left behind).
+    # Extracted to a module method so specs can exercise it without booting
+    # a second Rails app.
+    def self.warn_about_issuer_config!
+      if StandardId.config.issuer.blank?
+        Rails.logger.warn("[StandardId] No issuer configured. JWT tokens will not include or verify the 'iss' claim. " \
+                          "Set StandardId.config.issuer in your initializer for production use.")
+      elsif StandardId.config.verify_issuer == false
+        Rails.logger.warn("[StandardId] verify_issuer is explicitly false but an issuer is configured " \
+                          "(#{StandardId.config.issuer.inspect}). Tokens will include the 'iss' claim but " \
+                          "incoming tokens are NOT required to carry it. This is a migration flag — remove " \
+                          "verify_issuer: false from your initializer once all in-flight tokens have expired.")
+      end
+    end
   end
 end

data/lib/standard_id/events/subscribers/logging_subscriber.rb

@@ -110,7 +110,10 @@ module StandardId
             payload[:account_id] = event[:account_id]
           end
 
-          payload[:login] = event[:account_lookup] || event[:login] || event[:username] if event[:account_lookup] || event[:login] || event[:username]
+          raw_login = event[:account_lookup] || event[:login] || event[:username]
+          if raw_login
+            payload[:login] = log_login_identifiers? ? raw_login : redact_login(raw_login)
+          end
           payload[:auth_method] = event[:auth_method] if event[:auth_method]
           payload[:grant_type] = event[:grant_type] if event[:grant_type]
           payload[:provider] = event[:provider] if event[:provider]
@@ -120,6 +123,40 @@ module StandardId
 
           payload
         end
+
+        def log_login_identifiers?
+          config = StandardId.config
+          return false unless config.respond_to?(:events)
+
+          config.events.log_login_identifiers
+        end
+
+        # Redact a login identifier for logging.
+        #
+        # Email-shaped values (`local@domain`): keep the first two characters of
+        # the local part, mask the rest as `***`, keep the domain verbatim.
+        # Everything else: keep the first two characters, mask the rest as `***`.
+        #
+        # The local part's length is not exposed (all masks are `***`), and the
+        # domain is kept so operators can still tell at a glance which service
+        # the attempt targeted (e.g. gmail.com vs corporate SSO).
+        def redact_login(value)
+          str = value.to_s
+          # Split on the FIRST '@' only (limit 2) to detect email shape without
+          # a regex. A regex such as /\A(.+)@(.+)\z/ is polynomial on strings
+          # like "a@a@a@…" because the two greedy `.+` quantifiers can match the
+          # same characters in exponentially many ways — a ReDoS vector on
+          # attacker-controlled login values. String#split is linear.
+          parts = str.split("@", 2)
+          if parts.length == 2
+            local, domain = parts
+            prefix = local.length > 2 ? local[0, 2] : local[0, 1]
+            "#{prefix}***@#{domain}"
+          else
+            prefix = str.length > 2 ? str[0, 2] : str[0, 1]
+            "#{prefix}***"
+          end
+        end
       end
     end
   end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.55.1"
+  VERSION = "0.56.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.55.1
+  version: 0.56.0
 platform: ruby
 authors:
 - Jaryl Sim