standard_id 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a6e84ca4e7d4d01aa3957ed1371ef774fc1203b9006da7591b99e20fadb343b4
-  data.tar.gz: cc74bfcf5f471d4bf7b76d621497598fac95fa0f833b256a74c3a4374456850b
+  metadata.gz: 3c621a201633467c0738625eacb1f0c59c0b8ee5b670903cb09b1a1a4f6bfd01
+  data.tar.gz: 2b4b97e69b5b8dba07f1df919fd3d3b5ef4dda4fa6b72ae54c317cfb96bb1320
 SHA512:
-  metadata.gz: 21932b0dd06f986340284587ccfae60cfea9b0e5075cdc670ff297e23412c0440d0e434e3974f98f65b9071fb15a118c3c36920e08b8887e9857fa612318e857
-  data.tar.gz: 7acf89c15d302da9e25da25de4c786441df085f65950a02e8b6fec71b4a90cf3f72c3167929371018869cc4787e6476d5df78036e3b2dde4833525d5c260045f
+  metadata.gz: 22613e053bfa27512b39c38af4be699686ed8ef83b296efbbd17b131e60f12923fc6efdb8b572833849807c3928fb8cecbaee4d72e1e6da60e0b37b606555a3b
+  data.tar.gz: 36e22ae1dca29a4350350c079eb7f1b4166c341f3d435bcdd666d7603b8f479de0dbee957b75fd807a42f7deeaf272d69badf6fe61d978151dcebb1f48c92401

data/app/forms/standard_id/web/reset_password_confirm_form.rb

@@ -3,6 +3,7 @@ module StandardId
     class ResetPasswordConfirmForm
       include ActiveModel::Model
       include ActiveModel::Attributes
+      include StandardId::PasswordStrength
 
       attribute :password, :string
       attribute :password_confirmation, :string
@@ -11,7 +12,6 @@ module StandardId
 
       validates :password,
         presence: { message: "cannot be blank" },
-        length: { minimum: 8, too_short: "must be at least 8 characters long" },
         confirmation: { message: "confirmation doesn't match" }
 
       def initialize(password_credential, params = {})

data/app/forms/standard_id/web/signup_form.rb

@@ -3,6 +3,7 @@ module StandardId
     class SignupForm
       include ActiveModel::Model
       include ActiveModel::Attributes
+      include StandardId::PasswordStrength
 
       attribute :email, :string
       attribute :password, :string
@@ -11,7 +12,7 @@ module StandardId
       attr_reader :account
 
       validates :email, presence: true, format: { with: URI::MailTo::EMAIL_REGEXP }
-      validates :password, presence: true, length: { minimum: 8 }, confirmation: true
+      validates :password, presence: true, confirmation: true
 
       def submit
         return false unless valid?

data/app/models/concerns/standard_id/password_strength.rb

@@ -0,0 +1,31 @@
+module StandardId
+  module PasswordStrength
+    extend ActiveSupport::Concern
+
+    included do
+      validate :password_meets_strength_requirements, if: -> { password.present? }
+    end
+
+    private
+
+    def password_meets_strength_requirements
+      config = StandardId.config.password
+
+      if password.length < config.minimum_length
+        errors.add(:password, "must be at least #{config.minimum_length} characters long")
+      end
+
+      if config.require_uppercase && password !~ /[A-Z]/
+        errors.add(:password, "must include at least one uppercase letter")
+      end
+
+      if config.require_numbers && password !~ /\d/
+        errors.add(:password, "must include at least one number")
+      end
+
+      if config.require_special_chars && password !~ /[^a-zA-Z0-9]/
+        errors.add(:password, "must include at least one special character")
+      end
+    end
+  end
+end

data/app/models/standard_id/authorization_code.rb

@@ -17,6 +17,20 @@ module StandardId
     before_validation :set_issued_and_expiry, on: :create
 
     def self.issue!(plaintext_code:, client_id:, redirect_uri:, scope: nil, audience: nil, account: nil, code_challenge: nil, code_challenge_method: nil, nonce: nil, metadata: {})
+      # Fail fast: reject unsupported PKCE methods at issuance rather than
+      # storing a code that will always fail at redemption time.
+      if code_challenge.present?
+        unless code_challenge_method.to_s.downcase == "s256"
+          raise StandardId::InvalidRequestError, "Unsupported code_challenge_method: only S256 is allowed"
+        end
+      end
+
+      # Hash the code_challenge for defense-in-depth (RAR-58).
+      # The stored value is SHA256(S256_challenge), where S256_challenge is
+      # base64url(SHA256(verifier)). This is intentionally a double-hash:
+      # S256 derives the challenge from the verifier, and we hash again for storage.
+      hashed_challenge = code_challenge.present? ? Digest::SHA256.hexdigest(code_challenge) : nil
+
       create!(
         account: account,
         code_hash: hash_for(plaintext_code),
@@ -24,7 +38,7 @@ module StandardId
         redirect_uri: redirect_uri,
         scope: scope,
         audience: audience,
-        code_challenge: code_challenge,
+        code_challenge: hashed_challenge,
         code_challenge_method: code_challenge_method,
         nonce: nonce,
         issued_at: Time.current,
@@ -58,15 +72,20 @@ module StandardId
 
       return false if code_verifier.blank?
 
-      case (code_challenge_method || "plain").downcase
-      when "s256"
-        expected = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier)).delete("=")
-        ActiveSupport::SecurityUtils.secure_compare(expected, code_challenge)
-      when "plain"
-        ActiveSupport::SecurityUtils.secure_compare(code_verifier, code_challenge)
-      else
-        false
-      end
+      # Only S256 is supported (OAuth 2.1). The "plain" method is rejected
+      # because it transmits the verifier in cleartext, defeating PKCE's purpose.
+      return false unless (code_challenge_method || "").downcase == "s256"
+
+      s256_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier)).delete("=")
+
+      # New format: stored value is SHA256(S256_challenge)
+      hashed_expected = Digest::SHA256.hexdigest(s256_challenge)
+      return true if ActiveSupport::SecurityUtils.secure_compare(hashed_expected, code_challenge)
+
+      # Legacy fallback: codes issued before RAR-58 store the raw S256 challenge.
+      # This handles in-flight codes during deployment (max 10-minute TTL).
+      # Safe to remove after one deployment cycle.
+      ActiveSupport::SecurityUtils.secure_compare(s256_challenge, code_challenge)
     end
 
     def mark_as_used!

data/app/models/standard_id/password_credential.rb

@@ -1,6 +1,7 @@
 module StandardId
   class PasswordCredential < ApplicationRecord
     include StandardId::Credentiable
+    include StandardId::PasswordStrength
 
     has_secure_password
 
@@ -13,7 +14,7 @@ module StandardId
     end
 
     validates :login, presence: true, uniqueness: true
-    validates :password, length: { minimum: 8 }, confirmation: true, if: :validate_password?
+    validates :password, confirmation: true, if: :validate_password?
 
     private
 

data/app/models/standard_id/refresh_token.rb

@@ -34,7 +34,8 @@ module StandardId
     end
 
     def revoke!
-      update!(revoked_at: Time.current) unless revoked?
+      rows = self.class.where(id: id, revoked_at: nil).update_all(revoked_at: Time.current)
+      reload if rows > 0
     end
 
     # Revoke this token and all tokens in the same family chain.
@@ -45,22 +46,18 @@ module StandardId
       family_tokens.where(revoked_at: nil).update_all(revoked_at: Time.current)
     end
 
-    # Max depth guard to prevent unbounded traversal in case of
-    # corrupted data or extremely long-lived token chains.
-    MAX_FAMILY_DEPTH = 50
-
     private
 
     # Find the root of this token's family and return all descendants.
-    # Uses iterative queries (one per generation) bounded by MAX_FAMILY_DEPTH.
-    # For typical token chain lengths (<10) this is fine; a recursive CTE
-    # would collapse to a single query if performance becomes a concern.
+    # Backward traversal uses a visited set for cycle detection in case
+    # of corrupted data. Forward traversal collects all descendants.
     def family_tokens
       root = self
-      depth = 0
-      while root.previous_token.present? && depth < MAX_FAMILY_DEPTH
+      visited = Set.new([root.id])
+      while root.previous_token.present?
+        break if visited.include?(root.previous_token_id)
+        visited.add(root.previous_token_id)
         root = root.previous_token
-        depth += 1
       end
 
       self.class.where(id: collect_family_ids(root.id))
@@ -69,15 +66,13 @@ module StandardId
     def collect_family_ids(root_id)
       ids = [root_id]
       current_ids = [root_id]
-      depth = 0
 
-      while depth < MAX_FAMILY_DEPTH
+      loop do
         next_ids = self.class.where(previous_token_id: current_ids).pluck(:id)
         break if next_ids.empty?
 
         ids.concat(next_ids)
         current_ids = next_ids
-        depth += 1
       end
 
       ids

data/app/models/standard_id/session.rb

@@ -7,7 +7,7 @@ module StandardId
     belongs_to :account, class_name: StandardId.config.account_class_name
     has_many :refresh_tokens, class_name: "StandardId::RefreshToken", dependent: :nullify
 
-    before_destroy :revoke_active_refresh_tokens
+    before_destroy :revoke_active_refresh_tokens, prepend: true
 
     scope :active, -> { where(revoked_at: nil).where("expires_at > ?", Time.current) }
     scope :expired, -> { where("expires_at <= ?", Time.current) }
@@ -38,10 +38,12 @@ module StandardId
 
     def revoke!(reason: nil)
       @reason = reason
-      update!(revoked_at: Time.current)
-      # Cascade revocation to refresh tokens. Uses update_all for efficiency;
-      # intentionally skips updated_at since revocation is tracked via revoked_at.
-      refresh_tokens.active.update_all(revoked_at: Time.current)
+      transaction do
+        update!(revoked_at: Time.current)
+        # Cascade revocation to refresh tokens. Uses update_all for efficiency;
+        # intentionally skips updated_at since revocation is tracked via revoked_at.
+        refresh_tokens.active.update_all(revoked_at: Time.current)
+      end
     end
 
     private

data/db/migrate/20260311100001_add_nullify_to_refresh_token_previous_token_fk.rb

@@ -0,0 +1,7 @@
+class AddNullifyToRefreshTokenPreviousTokenFk < ActiveRecord::Migration[8.0]
+  def change
+    remove_foreign_key :standard_id_refresh_tokens, column: :previous_token_id
+    add_foreign_key :standard_id_refresh_tokens, :standard_id_refresh_tokens,
+      column: :previous_token_id, on_delete: :nullify
+  end
+end

data/lib/standard_id/config/schema.rb

@@ -54,9 +54,9 @@ StandardConfig.schema.draw do
 
   scope :password do
     field :minimum_length, type: :integer, default: 8
-    field :require_special_chars, type: :boolean, default: false
-    field :require_uppercase, type: :boolean, default: false
-    field :require_numbers, type: :boolean, default: false
+    field :require_special_chars, type: :boolean, default: true
+    field :require_uppercase, type: :boolean, default: true
+    field :require_numbers, type: :boolean, default: true
   end
 
   scope :session do

data/lib/standard_id/oauth/refresh_token_flow.rb

@@ -4,6 +4,26 @@ module StandardId
       expect_params :refresh_token, :client_id
       permit_params :client_secret, :scope, :audience
 
+      # authenticate! runs outside the transaction so reuse-detection
+      # revocations (revoke_family!) persist even when the error propagates.
+      # Only the normal rotation path (revoke old + create new) is wrapped
+      # in a transaction for atomicity.
+      def execute
+        authenticate!
+        response = nil
+        StandardId::RefreshToken.transaction do
+          rotate_current_refresh_token!
+          response = generate_token_response
+        end
+
+        # If rotate detected a concurrent reuse (rows==0), the transaction
+        # was rolled back via ActiveRecord::Rollback and response is nil.
+        # Handle family revocation outside the transaction so it persists.
+        handle_concurrent_reuse! unless response
+
+        response
+      end
+
       def authenticate!
         validate_client_secret!(params[:client_id], params[:client_secret]) if params[:client_secret].present?
 
@@ -36,42 +56,52 @@ module StandardId
         if @current_refresh_token_record.revoked?
           # Reuse detected: this token was already rotated. Revoke entire family.
           @current_refresh_token_record.revoke_family!
-          StandardId::Events.publish(
-            StandardId::Events::OAUTH_REFRESH_TOKEN_REUSE_DETECTED,
-            account_id: @refresh_payload[:sub],
-            client_id: @refresh_payload[:client_id],
-            refresh_token_id: @current_refresh_token_record.id
-          )
+          emit_reuse_detected_event
           raise StandardId::InvalidGrantError, "Refresh token reuse detected"
         end
 
         unless @current_refresh_token_record.active?
           raise StandardId::InvalidGrantError, "Refresh token is no longer valid"
         end
+      end
+
+      # Atomically revoke the current token as part of rotation.
+      # Uses a conditional UPDATE to prevent TOCTOU race conditions — only one
+      # concurrent request can successfully revoke and proceed.
+      # Called inside a transaction with new-token creation so both succeed or
+      # both roll back.
+      def rotate_current_refresh_token!
+        return unless @current_refresh_token_record
 
-        # Atomically revoke the current token as part of rotation.
-        # Uses a conditional UPDATE to prevent TOCTOU race conditions — only one
-        # concurrent request can successfully revoke and proceed.
         rows = StandardId::RefreshToken
           .where(id: @current_refresh_token_record.id, revoked_at: nil)
           .update_all(revoked_at: Time.current)
 
-        if rows == 0
-          # A concurrent request revoked the token between the revoked? check
-          # and the UPDATE. Re-load to determine whether this is a reuse scenario.
-          @current_refresh_token_record.reload
-          if @current_refresh_token_record.revoked?
-            @current_refresh_token_record.revoke_family!
-            StandardId::Events.publish(
-              StandardId::Events::OAUTH_REFRESH_TOKEN_REUSE_DETECTED,
-              account_id: @refresh_payload[:sub],
-              client_id: @refresh_payload[:client_id],
-              refresh_token_id: @current_refresh_token_record.id
-            )
-            raise StandardId::InvalidGrantError, "Refresh token reuse detected"
-          end
-          raise StandardId::InvalidGrantError, "Refresh token is no longer valid"
+        return if rows > 0
+
+        # A concurrent request won the race. Roll back this transaction
+        # (no new token should be issued). Reuse handling happens outside
+        # the transaction in handle_concurrent_reuse! so revocations persist.
+        raise ActiveRecord::Rollback
+      end
+
+      def handle_concurrent_reuse!
+        @current_refresh_token_record&.reload
+        if @current_refresh_token_record&.revoked?
+          @current_refresh_token_record.revoke_family!
+          emit_reuse_detected_event
+          raise StandardId::InvalidGrantError, "Refresh token reuse detected"
         end
+        raise StandardId::InvalidGrantError, "Refresh token is no longer valid"
+      end
+
+      def emit_reuse_detected_event
+        StandardId::Events.publish(
+          StandardId::Events::OAUTH_REFRESH_TOKEN_REUSE_DETECTED,
+          account_id: @refresh_payload[:sub],
+          client_id: @refresh_payload[:client_id],
+          refresh_token_id: @current_refresh_token_record.id
+        )
       end
 
       def subject_id

data/lib/standard_id/testing/factories/credentials.rb

@@ -1,8 +1,8 @@
 FactoryBot.define do
   factory :standard_id_password_credential, class: "StandardId::PasswordCredential" do
     sequence(:login) { |n| "user#{n}@example.com" }
-    password { "password123" }
-    password_confirmation { "password123" }
+    password { "Password1!" }
+    password_confirmation { "Password1!" }
   end
 
   factory :standard_id_credential, class: "StandardId::Credential" do

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.8.1"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.8.1
+  version: 0.9.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -158,6 +158,7 @@ files:
 - app/mailers/standard_id/application_mailer.rb
 - app/models/concerns/standard_id/account_associations.rb
 - app/models/concerns/standard_id/credentiable.rb
+- app/models/concerns/standard_id/password_strength.rb
 - app/models/standard_id/application_record.rb
 - app/models/standard_id/authorization_code.rb
 - app/models/standard_id/browser_session.rb
@@ -197,7 +198,8 @@ files:
 - db/migrate/20250903063000_create_standard_id_authorization_codes.rb
 - db/migrate/20250907090000_create_standard_id_code_challenges.rb
 - db/migrate/20260311000000_add_provider_to_standard_id_identifiers.rb
-- db/migrate/20260311000000_create_standard_id_refresh_tokens.rb
+- db/migrate/20260311100000_create_standard_id_refresh_tokens.rb
+- db/migrate/20260311100001_add_nullify_to_refresh_token_previous_token_fk.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/standard_config.rb