standard_id 0.55.1 → 0.56.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79b115262b448690a7d1429716da8b36e6422be79e9406868684a3744e0cf3e8
-  data.tar.gz: a43dc5ed9ea2ff5bd5317809f79c9326d1df14a2115f63e631090a7fe15042cd
+  metadata.gz: 076ceacf137b604ea48f42f6955f7eb9786656cab0112adc5967f06d5b6a178b
+  data.tar.gz: cb179e91df123b9d5c996626a6af219b170faa1e458c6d185dc6ad597f32c044
 SHA512:
-  metadata.gz: a184a92b4a8f865db6e4fd4f05cbaa9e44d1156407ed61d30530ee6379269cc9cc3da0d9f64b800c7fc44461abc28d2df44ebe2d4562a6dbde96d0f69a106ec7
-  data.tar.gz: abc3fe5d187c94408406cfeba9e27a699f5542b30a1979c268c7b5fe7d2986ea29b56dcb6d4b8399b8e0df3a7ed56271951a49eec9a25076d5cd568a1a30b9c5
+  metadata.gz: e8f41357e84dbe80520836d321dd3f65e1b81329fe50c34e5c005975612fb77a1bf3d919eb87289c6ddf3ba29f95a22bc84ac45c7d1c9815411ae3efcb6161ae
+  data.tar.gz: 7c9637e8e58f301576d8d5564843b19ae2d58599aa94427cf8ffd3985385badbdb5a9b2b2fe9052fa4ef3a55989b59c1362e5a95e39d933c1cd444062830f0c7

data/CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.56.1] - 2026-10-27
+
+### Fixed
+
+- **`credential.password.created` from the API email + password sign-up now carries a usable
+  credential chain.** `EmailPassword::Registration` created the `Credential` row with
+  `Credential.create!`, but `PasswordCredential`'s `has_one :credential, touch: true` had already
+  read (and cached) the association as `nil` in `after_create`. A subscriber walking
+  `event[:credential].credential.identifier.account` got `nil`; it now gets the account, with the
+  whole chain loaded in memory, so strict-loading hosts never load it lazily.
+  `Web::SignupForm` was unaffected (it builds the chain with nested attributes); it now has the
+  same regression spec.
+
+## [0.56.0] - 2026-10-26
+
+### Added
+
+- **`c.events.log_login_identifiers` (default `false`).** `LoggingSubscriber` now redacts the submitted
+  email/login in `AUTHENTICATION_ATTEMPT_STARTED` (debug) and `AUTHENTICATION_FAILED` (warn) log lines by
+  default: email-shaped values are logged as `lo***@domain`; everything else as `lo***`. Set
+  `c.events.log_login_identifiers = true` to restore the previous behaviour (full value logged) for apps
+  that need it for debugging.
+
+- **Boot-time warning when `verify_issuer: false` is combined with a configured `issuer`.** The existing
+  warning fires when `issuer` is blank; this companion fires when `issuer` is set but `verify_issuer` is
+  explicitly `false`, reminding operators it is a migration flag to remove once all in-flight tokens have
+  expired.
+
+### Fixed
+
+- **Inertia history is now cleared on sign-out** for hosts that set `use_inertia = true`.
+  `Web::LogoutController#create` and the current-session branch of
+  `Web::SessionsController#destroy` now pass `inertia: { clear_history: true }` on
+  the redirect, which stores a session flag that the next Inertia render consumes
+  (`clearHistory: true` in the page JSON). Without this, the old history-encryption
+  key remained in `sessionStorage` and `Back` could still decrypt pages viewed while
+  signed in. Hosts without `use_inertia` are unaffected.
+
+  Rolling this out requires a release followed by a `/rollout-gem` to all five
+  consumers (fundbright-web, nutripod-web, jumpdrive-web, luminality-web,
+  sidekick-web).
+
 ## [0.55.1] - 2026-10-23
 
 ### Fixed

data/app/controllers/standard_id/web/logout_controller.rb

@@ -14,7 +14,8 @@ module StandardId
 
       def create
         revoke_current_session!
-        redirect_to logout_destination, notice: "Successfully signed out"
+        redirect_to logout_destination, notice: "Successfully signed out",
+                    **(use_inertia? ? { inertia: { clear_history: true } } : {})
       end
 
       private

data/app/controllers/standard_id/web/sessions_controller.rb

@@ -15,7 +15,8 @@ module StandardId
         if session == current_session
           # If revoking current session, sign out and redirect
           revoke_current_session!
-          redirect_to "/", notice: "Session revoked. You have been signed out."
+          redirect_to "/", notice: "Session revoked. You have been signed out.",
+                      **(use_inertia? ? { inertia: { clear_history: true } } : {})
         else
           # Revoke other session
           session.revoke!

data/lib/standard_id/config/schema.rb

@@ -153,6 +153,20 @@ StandardId::ConfigSchema.define do
   scope :events do
     field :enable_logging, type: :boolean, default: false
 
+    # Whether to log the full login identifier (email / username) in
+    # `AUTHENTICATION_ATTEMPT_STARTED` and `AUTHENTICATION_FAILED` log lines.
+    #
+    # Defaults to `false`: a redacted form is logged instead
+    # (`local-part[0..1]***@domain` for email-shaped values, first two
+    # characters + *** for everything else). This prevents email addresses from
+    # accumulating in log sinks (Sentry, Datadog, etc.) on every failed login
+    # attempt, including attacker probes.
+    #
+    # Set to `true` only for apps that have already accepted the privacy
+    # trade-off and need the full value for debugging — typically behind an
+    # environment flag that is off in production.
+    field :log_login_identifiers, type: :boolean, default: false
+
     # Publish `<key>_id` / `<key>_gid` alongside every record-valued payload key
     # (rarebit-one/rarebit-ops#296).
     #

data/lib/standard_id/email_password/registration.rb

@@ -105,7 +105,13 @@ module StandardId
               account: account, value: email, signup_source: EmailPassword::SIGNUP_SOURCE
             )
             password_credential = StandardId::PasswordCredential.create!(login: email, password: password)
-            StandardId::Credential.create!(identifier: identifier, credentialable: password_credential)
+            # Created through the association, not Credential.create!: the
+            # has_one's touch: true reads password_credential.credential in
+            # after_create, caching nil, so a subscriber walking
+            # credential.identifier.account would get nil. Going through the
+            # association leaves the whole chain loaded in memory, which also
+            # keeps strict-loading hosts from lazily loading identifier/account.
+            password_credential.create_credential!(identifier: identifier)
 
             StandardId::Events.publish(
               StandardId::Events::ACCOUNT_CREATED,

data/lib/standard_id/engine.rb

@@ -81,10 +81,7 @@ module StandardId
       StandardId::Events::Subscribers::PasswordlessDeliverySubscriber.attach
       StandardId::Events::Subscribers::PasswordResetDeliverySubscriber.attach
 
-      if StandardId.config.issuer.blank?
-        Rails.logger.warn("[StandardId] No issuer configured. JWT tokens will not include or verify the 'iss' claim. " \
-                          "Set StandardId.config.issuer in your initializer for production use.")
-      end
+      StandardId::Engine.warn_about_issuer_config!
 
       # Fail loudly if `association_strict_loading` was assigned after the
       # host's Account class body already ran — that assignment has no effect,
@@ -175,5 +172,21 @@ module StandardId
         "audiences (e.g., ['web', 'api']) to close cross-audience replay vectors."
       )
     end
+
+    # Warn when the issuer configuration is missing or when `verify_issuer`
+    # is explicitly `false` with an issuer set (migration flag left behind).
+    # Extracted to a module method so specs can exercise it without booting
+    # a second Rails app.
+    def self.warn_about_issuer_config!
+      if StandardId.config.issuer.blank?
+        Rails.logger.warn("[StandardId] No issuer configured. JWT tokens will not include or verify the 'iss' claim. " \
+                          "Set StandardId.config.issuer in your initializer for production use.")
+      elsif StandardId.config.verify_issuer == false
+        Rails.logger.warn("[StandardId] verify_issuer is explicitly false but an issuer is configured " \
+                          "(#{StandardId.config.issuer.inspect}). Tokens will include the 'iss' claim but " \
+                          "incoming tokens are NOT required to carry it. This is a migration flag — remove " \
+                          "verify_issuer: false from your initializer once all in-flight tokens have expired.")
+      end
+    end
   end
 end

data/lib/standard_id/events/subscribers/logging_subscriber.rb

@@ -110,7 +110,10 @@ module StandardId
             payload[:account_id] = event[:account_id]
           end
 
-          payload[:login] = event[:account_lookup] || event[:login] || event[:username] if event[:account_lookup] || event[:login] || event[:username]
+          raw_login = event[:account_lookup] || event[:login] || event[:username]
+          if raw_login
+            payload[:login] = log_login_identifiers? ? raw_login : redact_login(raw_login)
+          end
           payload[:auth_method] = event[:auth_method] if event[:auth_method]
           payload[:grant_type] = event[:grant_type] if event[:grant_type]
           payload[:provider] = event[:provider] if event[:provider]
@@ -120,6 +123,40 @@ module StandardId
 
           payload
         end
+
+        def log_login_identifiers?
+          config = StandardId.config
+          return false unless config.respond_to?(:events)
+
+          config.events.log_login_identifiers
+        end
+
+        # Redact a login identifier for logging.
+        #
+        # Email-shaped values (`local@domain`): keep the first two characters of
+        # the local part, mask the rest as `***`, keep the domain verbatim.
+        # Everything else: keep the first two characters, mask the rest as `***`.
+        #
+        # The local part's length is not exposed (all masks are `***`), and the
+        # domain is kept so operators can still tell at a glance which service
+        # the attempt targeted (e.g. gmail.com vs corporate SSO).
+        def redact_login(value)
+          str = value.to_s
+          # Split on the FIRST '@' only (limit 2) to detect email shape without
+          # a regex. A regex such as /\A(.+)@(.+)\z/ is polynomial on strings
+          # like "a@a@a@…" because the two greedy `.+` quantifiers can match the
+          # same characters in exponentially many ways — a ReDoS vector on
+          # attacker-controlled login values. String#split is linear.
+          parts = str.split("@", 2)
+          if parts.length == 2
+            local, domain = parts
+            prefix = local.length > 2 ? local[0, 2] : local[0, 1]
+            "#{prefix}***@#{domain}"
+          else
+            prefix = str.length > 2 ? str[0, 2] : str[0, 1]
+            "#{prefix}***"
+          end
+        end
       end
     end
   end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.55.1"
+  VERSION = "0.56.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.55.1
+  version: 0.56.1
 platform: ruby
 authors:
 - Jaryl Sim