standard_id 0.56.0 → 0.57.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d21b27586542e7f6f9bc312ace8fed7a75a8b75c4633e470232890b869f802f
-  data.tar.gz: 46b0df7981fa6785cdbc86a0ea65e52bf30c6c293a6198671d43169dd82fb955
+  metadata.gz: c50961cc2c4446bd495efdebca4ad54a871c371fab3c63e0ff1dd6792b44e1ff
+  data.tar.gz: be9ebdaedf84eedfed63f98ade1e8fb37bfc90112b7ba4532aa8d179aefb03b9
 SHA512:
-  metadata.gz: c54196984851c658850c910a1509ffbc4231911759a0f003d9f3915002459ca5d313a61643abdd43edeac85d332ef8bc1c4173d65e9ca3fe2f747f44aff93e14
-  data.tar.gz: 44510185f41ecd77b81c1d44342e5e6b2e432c75232c91cd3347ddea25fa3115d370e05d0af2d54a878a2dbf38cc5888bd0bdb82de12d9d1888b9df60474c10a
+  metadata.gz: 55f8de3f738e3363e452842bcea0b68fbff7798e59039bdac698de7b0b5d1c1fffdb58fe693e60671aa6c9cc2743059fc3d3269e11bde54a84d7bbb23e64b8f5
+  data.tar.gz: 9c0e08fdb33cc59058c5be1be6f65b7308bb497738a8a338de1072e5cbd105f59417cbd65c4902e6f937ff53544bbd755cf7e8b8e349b2bd058583cc75eaa2bc

data/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.57.0] - 2026-10-28
+
+### Added
+
+- **Migration `20261028000000_add_value_lookup_indexes_to_standard_id_tables`.** Adds a
+  `[type, value]` index on `standard_id_identifiers`, which serves the `find_by(value:)` lookup behind
+  every sign-in, OTP start, social login and password reset (the only index containing `value` led
+  with `account_id`, so each lookup was a sequential scan). Also adds a partial
+  `client_application_id` index on `standard_id_refresh_tokens` for `PurgeStaleDynamicClientsJob`.
+  Both are built `CONCURRENTLY` on PostgreSQL and are idempotent. Run
+  `bin/rails standard_id:install:migrations && bin/rails db:migrate`.
+
+## [0.56.1] - 2026-10-27
+
+### Fixed
+
+- **`credential.password.created` from the API email + password sign-up now carries a usable
+  credential chain.** `EmailPassword::Registration` created the `Credential` row with
+  `Credential.create!`, but `PasswordCredential`'s `has_one :credential, touch: true` had already
+  read (and cached) the association as `nil` in `after_create`. A subscriber walking
+  `event[:credential].credential.identifier.account` got `nil`; it now gets the account, with the
+  whole chain loaded in memory, so strict-loading hosts never load it lazily.
+  `Web::SignupForm` was unaffected (it builds the chain with nested attributes); it now has the
+  same regression spec.
+
 ## [0.56.0] - 2026-10-26
 
 ### Added

data/db/migrate/20261028000000_add_value_lookup_indexes_to_standard_id_tables.rb

@@ -0,0 +1,73 @@
+class AddValueLookupIndexesToStandardIdTables < ActiveRecord::Migration[8.0]
+  # Indexes for two lookups nothing in the schema serves (deep audit
+  # DBP-002/DBP-011, 2026-10-27):
+  #
+  # - standard_id_identifiers [type, value]: every sign-in, OTP start, social
+  #   login and password reset resolves its identifier with
+  #   `EmailIdentifier.find_by(value:)` / `PhoneNumberIdentifier.find_by(value:)`
+  #   (STI adds `type = ?`). The only index containing `value` leads with
+  #   account_id, so each lookup is a sequential scan. Not unique: the same
+  #   value may belong to more than one account.
+  # - standard_id_refresh_tokens client_application_id: PurgeStaleDynamicClientsJob
+  #   reads refresh tokens per client (`client.refresh_tokens`) and by
+  #   `client_application_id IS NOT NULL`. Partial, because tokens not bound
+  #   to an application (social sign-in refreshes, rows minted before
+  #   20261020000000) leave it NULL.
+  #
+  # At today's table sizes these scans are cheap (Sentry, 14 days: the
+  # identifier lookup is p50 2-4ms, p95 9-15ms in every host); the cost grows
+  # with every account. Idempotent (if_not_exists / if_exists), CONCURRENTLY
+  # on Postgres, and an INVALID index left by a failed concurrent build is
+  # dropped and rebuilt, same conventions as 20260924000000.
+  disable_ddl_transaction!
+
+  INDEXES = [
+    {
+      table: :standard_id_identifiers,
+      columns: [:type, :value],
+      name: "index_standard_id_identifiers_on_type_and_value"
+    },
+    {
+      table: :standard_id_refresh_tokens,
+      columns: :client_application_id,
+      name: "index_standard_id_refresh_tokens_on_client_application_id",
+      where: "client_application_id IS NOT NULL"
+    }
+  ].freeze
+
+  def up
+    INDEXES.each do |index|
+      if postgres? && invalid_postgres_index?(index[:name])
+        remove_index index[:table], name: index[:name], if_exists: true, **concurrent
+      end
+
+      add_index index[:table], index[:columns],
+        name: index[:name], where: index[:where], if_not_exists: true, **concurrent
+    end
+  end
+
+  def down
+    INDEXES.each do |index|
+      remove_index index[:table], name: index[:name], if_exists: true, **concurrent
+    end
+  end
+
+  private
+
+  def postgres?
+    connection.adapter_name.downcase.include?("postgres")
+  end
+
+  def concurrent
+    postgres? ? { algorithm: :concurrently } : {}
+  end
+
+  def invalid_postgres_index?(name)
+    select_value(<<~SQL.squish).present?
+      SELECT 1
+      FROM pg_index i
+      INNER JOIN pg_class c ON c.oid = i.indexrelid
+      WHERE c.relname = #{connection.quote(name)} AND NOT i.indisvalid
+    SQL
+  end
+end

data/lib/standard_id/email_password/registration.rb

@@ -105,7 +105,13 @@ module StandardId
               account: account, value: email, signup_source: EmailPassword::SIGNUP_SOURCE
             )
             password_credential = StandardId::PasswordCredential.create!(login: email, password: password)
-            StandardId::Credential.create!(identifier: identifier, credentialable: password_credential)
+            # Created through the association, not Credential.create!: the
+            # has_one's touch: true reads password_credential.credential in
+            # after_create, caching nil, so a subscriber walking
+            # credential.identifier.account would get nil. Going through the
+            # association leaves the whole chain loaded in memory, which also
+            # keeps strict-loading hosts from lazily loading identifier/account.
+            password_credential.create_credential!(identifier: identifier)
 
             StandardId::Events.publish(
               StandardId::Events::ACCOUNT_CREATED,

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.56.0"
+  VERSION = "0.57.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.56.0
+  version: 0.57.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -249,6 +249,7 @@ files:
 - db/migrate/20261020000000_add_client_application_id_to_standard_id_refresh_tokens.rb
 - db/migrate/20261020120000_add_registration_access_token_digest_to_standard_id_client_applications.rb
 - db/migrate/20261022000000_add_signup_source_to_standard_id_identifiers.rb
+- db/migrate/20261028000000_add_value_lookup_indexes_to_standard_id_tables.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/generators/standard_id/install/templates/standard_id_reference.rb