standard_id 0.2.4 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 144da6f9e7281b9b22e80c7ecdee847eb8d41f85571ab07846558f9ee565df83
-  data.tar.gz: 5e3bdb2356d73520039fa35387a49beb55fe34501a5787510ff0359a4143470e
+  metadata.gz: 1943644d0423c990ca37c0c666c1bd23f3b968320b3e7ffd573a9c3ce7ee71e1
+  data.tar.gz: ddd8b3e73ec3f949e0b15b680891c0721aa7ef712c95d1fdacde275688ad5539
 SHA512:
-  metadata.gz: 2b6daa2a3da9c30167cb2648c3adce23613913226c56a722106e5fc924631ee666c444273cfd5f1e603f16f6026d29183521704c947683c4cb011250c2af23e5
-  data.tar.gz: a70e979d184c85620203291f1a67521342b2b7bb130814ecdb96f2eef384c233d5e285e557f59c6d6ac49a4512e71b7e112a1f13b73d3ce2e9b50876d6b501b2
+  metadata.gz: ee653052de174dc0c3fd6577a1edaaced24fdd530d883e08ded724e5a25a3657aa0e9ea3133d7609563ee2f6c34819278869b4476f97271be6c3e290160dacc3
+  data.tar.gz: 5c745b656babf628cf122f385f42dc7dbb33ad724e36637039462d457b28aa6edde5f77acd09a5f5e1bc0af27ec191da6ef86ef7137734f45798b45f0d0e9e87

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -44,8 +44,12 @@ StandardId.configure do |c|
   #   email: ->(account:) { account.email },
   #   display_name: ->(account:, client:) {
   #     "#{account.name} for #{client.client_id}"
+  #   },
+  #   profile_id: ->(account:, audience:) {
+  #     account.profiles.find_by(type: audience)&.id
   #   }
   # }
+  # c.oauth.allowed_audiences = %w[web mobile admin] # Empty = no validation
 
   # Events
   # Enable or disable logging emitted via the internal event system

data/lib/standard_id/config/schema.rb

@@ -50,6 +50,7 @@ StandardConfig.schema.draw do
     field :client_secret, type: :string, default: nil
     field :scope_claims, type: :hash, default: -> { {} }
     field :claim_resolvers, type: :hash, default: -> { {} }
+    field :allowed_audiences, type: :array, default: -> { [] } # Empty = no validation, any audience allowed
   end
 
   scope :social do

data/lib/standard_id/jwt_service.rb

@@ -5,7 +5,7 @@ module StandardId
   class JwtService
     ALGORITHM = "HS256"
     RESERVED_JWT_KEYS = %i[sub client_id scope grant_type exp iat aud iss nbf jti]
-    BASE_SESSION_FIELDS = %i[account_id client_id scopes grant_type]
+    BASE_SESSION_FIELDS = %i[account_id client_id scopes grant_type aud]
 
     SESSION_CLASS = Concurrent::Delay.new do
       Struct.new(*(BASE_SESSION_FIELDS + claim_resolver_keys), keyword_init: true) do
@@ -49,6 +49,7 @@ module StandardId
         client_id: payload[:client_id],
         scopes: scopes,
         grant_type: payload[:grant_type],
+        aud: payload[:aud]
       )
     end
 

data/lib/standard_id/oauth/authorization_code_flow.rb

@@ -66,6 +66,10 @@ module StandardId
       def token_account
         @authorization_code&.account
       end
+
+      def audience
+        @authorization_code&.audience
+      end
     end
   end
 end

data/lib/standard_id/oauth/refresh_token_flow.rb

@@ -41,6 +41,11 @@ module StandardId
         true
       end
 
+      # Audience is bound to the refresh token - cannot be changed on refresh
+      def audience
+        @refresh_payload[:aud]
+      end
+
       def validate_scope_narrowing!
         return unless params[:scope].present?
 

data/lib/standard_id/oauth/token_grant_flow.rb

@@ -35,6 +35,7 @@ module StandardId
       end
 
       def generate_token_response
+        validate_audience!
         emit_token_issuing
         expires_in = token_expiry
         payload = build_jwt_payload(expires_in)
@@ -77,8 +78,9 @@ module StandardId
           sub: subject_id,
           client_id: client_id,
           scope: token_scope,
+          aud: audience,
           grant_type: "refresh_token"
-        }
+        }.compact
         StandardId::JwtService.encode(payload, expires_in: refresh_token_expiry)
       end
 
@@ -110,6 +112,20 @@ module StandardId
         params[:audience]
       end
 
+      def validate_audience!
+        allowed = StandardId.config.oauth.allowed_audiences
+        return if allowed.blank? # No restriction configured
+        return if audience.blank? # Audience not provided (optional)
+
+        # aud can be string or array per JWT spec
+        requested = Array(audience)
+        invalid = requested - allowed
+
+        if invalid.any?
+          raise StandardId::InvalidRequestError, "Invalid audience: #{invalid.join(', ')}"
+        end
+      end
+
       def claims_from_scope_mapping
         scope_claims = StandardId.config.oauth.scope_claims.with_indifferent_access
         resolvers = StandardId.config.oauth.claim_resolvers.with_indifferent_access
@@ -152,7 +168,8 @@ module StandardId
         @claim_resolvers_context ||= {
           client: token_client,
           account: token_account,
-          request: request
+          request: request,
+          audience: audience
         }
       end
 

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.2.4"
+  VERSION = "0.2.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.2.5
 platform: ruby
 authors:
 - Jaryl Sim