standard_id 0.23.0 → 0.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed15fb7068e789bc80676ae7d191b1b154c79adeedc60a58aa55c3c5e5e1c29f
-  data.tar.gz: 95cce0258343786169a8afcda56c91534e96f684b74f2764b7c8a66d838c4aab
+  metadata.gz: 96bb41b62e41b340083b98a19c91913d8a1342a1895150d68595cba6a576d039
+  data.tar.gz: b85e690728fad61be9a1ab5fa047096cf3db2b97bea9b9403774cd53895216f6
 SHA512:
-  metadata.gz: 41efa2cbf81c06d2bbc8747b68bb8f1f76a13684eda0512710d4bdc756132cfd1765c7b2d1580d938e326eb3ad19e04e6b627cc86d27f27bb1c718803864cadb
-  data.tar.gz: 07c359414b5800fd8151e5915bef1c51044cca4285c796c16c43e05c9593f903c8071c6da257d826cb3273d678c35faed27700807442f67e16ee1cc2cf3bcd28
+  metadata.gz: 4bebc333835970bebc067517014364dce32cfa6f3d9165a64aa7b82f3464f5862439c9fd7e40d73ae6d79a478490abe749609804c168d9ae8669d29e7d6d861e
+  data.tar.gz: 23a59d0a655a3d933ed953923ce5f2c4f63240543b06f094faa182366c6d147e27b769c6c6230821d0a1c60501399ac7569296840255403b95953faf37a5ba8b

data/app/controllers/standard_id/web/consent_controller.rb

@@ -84,11 +84,26 @@ module StandardId
           .new(@consent_request, request, current_account: current_account)
           .execute
 
-        redirect_to result[:redirect_to], status: result[:status] || :found, allow_other_host: true
+        redirect_out(result[:redirect_to], status: result[:status] || :found)
       end
 
       def deny!
-        redirect_to denied_redirect_uri, status: :found, allow_other_host: true
+        redirect_out(denied_redirect_uri, status: :found)
+      end
+
+      # Redirect to the OAuth client's (external) redirect_uri in a way that
+      # works for BOTH plain-browser and Inertia consumers of the consent
+      # screen. An Inertia visit is an XHR — it cannot follow a 302 to a
+      # non-Inertia, cross-origin URL (the browser stays on the consent page),
+      # so for Inertia requests we emit an Inertia-Location (409 +
+      # X-Inertia-Location) which the client turns into a hard `window.location`
+      # navigation. Plain (ERB) form posts keep the ordinary redirect.
+      def redirect_out(url, status: :found)
+        if request.respond_to?(:inertia?) && request.inertia?
+          inertia_location(url)
+        else
+          redirect_to url, status: status, allow_other_host: true
+        end
       end
 
       def denied_redirect_uri

data/lib/standard_id/config/schema.rb

@@ -289,6 +289,21 @@ StandardId::ConfigSchema.define do
     # silently failing the model's presence validation — so misconfiguration is
     # caught loudly at request time.
     field :dynamic_registration_owner, type: :any, default: nil
+
+    # Default `token_endpoint_auth_method` applied to clients created via RFC 7591
+    # Dynamic Client Registration when the request omits `token_endpoint_auth_method`.
+    #
+    # Controls whether self-registered clients default to PUBLIC (PKCE-only, no
+    # secret) or to a CONFIDENTIAL secret-bearing method. The default `"none"`
+    # preserves the historical behaviour (DCR clients are public unless they ask
+    # for a secret) and is the right default for interactive/native/MCP clients,
+    # which cannot keep a secret.
+    #
+    # Valid values (validated at use in StandardId::Oauth::ClientRegistration):
+    #   "none"                — public client, authenticates via PKCE alone
+    #   "client_secret_basic" — confidential, secret via HTTP Basic
+    #   "client_secret_post"  — confidential, secret in the request body
+    field :dynamic_registration_default_auth_method, type: :string, default: "none"
   end
 
   scope :social do

data/lib/standard_id/oauth/authorization_code_flow.rb

@@ -1,11 +1,21 @@
 module StandardId
   module Oauth
     class AuthorizationCodeFlow < TokenGrantFlow
-      expect_params :client_id, :client_secret, :code
-      permit_params :redirect_uri, :code_verifier
+      expect_params :client_id, :code
+      permit_params :client_secret, :redirect_uri, :code_verifier
 
       def authenticate!
-        @credential = validate_client_secret!(params[:client_id], params[:client_secret])
+        @client = StandardId::ClientApplication.find_by(client_id: params[:client_id])
+        raise StandardId::InvalidClientError, "Client authentication failed" if @client.nil?
+
+        # Confidential clients authenticate with a client secret. Public clients
+        # (e.g. native/SPA/MCP clients per RFC 8252 / OAuth 2.1) cannot keep a
+        # secret and authenticate via PKCE alone — they MUST NOT send one.
+        if @client.confidential?
+          @credential = validate_client_secret!(params[:client_id], params[:client_secret])
+        elsif params[:client_secret].present?
+          raise StandardId::InvalidClientError, "Public clients must not send a client_secret"
+        end
 
         @authorization_code = find_authorization_code(params[:code])
         unless @authorization_code&.valid_for_client?(params[:client_id])
@@ -16,6 +26,14 @@ module StandardId
           raise StandardId::InvalidGrantError, "Redirect URI mismatch"
         end
 
+        # Fail closed: a public client's only authentication factor is PKCE, so a
+        # code minted without a code_challenge offers no client authentication at
+        # all. (pkce_valid? returns true when code_challenge is blank, which is
+        # safe for confidential clients but would be a bypass for public ones.)
+        if @client.public? && @authorization_code.code_challenge.blank?
+          raise StandardId::InvalidGrantError, "PKCE is required for public clients"
+        end
+
         unless @authorization_code.pkce_valid?(params[:code_verifier])
           raise StandardId::InvalidGrantError, "Invalid PKCE code_verifier"
         end
@@ -30,7 +48,7 @@ module StandardId
         StandardId::Events.publish(
           StandardId::Events::OAUTH_CODE_CONSUMED,
           authorization_code: @authorization_code,
-          client_id: @credential.client_id,
+          client_id: @client.client_id,
           account: @authorization_code.account
         )
       end
@@ -40,7 +58,7 @@ module StandardId
       end
 
       def client_id
-        @credential.client_id
+        @client.client_id
       end
 
       def token_scope
@@ -60,7 +78,7 @@ module StandardId
       end
 
       def token_client
-        @credential&.client_application
+        @client
       end
 
       def token_account

data/lib/standard_id/oauth/client_registration.rb

@@ -25,7 +25,7 @@ module StandardId
       # token_endpoint_auth_method -> client_type mapping.
       PUBLIC_AUTH_METHOD = "none".freeze
       CONFIDENTIAL_AUTH_METHODS = %w[client_secret_basic client_secret_post].freeze
-      DEFAULT_AUTH_METHOD = PUBLIC_AUTH_METHOD
+      SUPPORTED_AUTH_METHODS = (CONFIDENTIAL_AUTH_METHODS + [PUBLIC_AUTH_METHOD]).freeze
       DEFAULT_SCOPE = "openid profile email".freeze
 
       # Minimal result object mirroring the gem's `result.success?` /
@@ -132,7 +132,22 @@ module StandardId
 
       def auth_method
         method = metadata[:token_endpoint_auth_method].to_s.strip
-        method.presence || DEFAULT_AUTH_METHOD
+        method.presence || default_auth_method
+      end
+
+      # Fallback token_endpoint_auth_method when the registration request omits
+      # one. Reads the first-class config value (default "none"). A misconfigured
+      # value is a host-app bug, so it raises ConfigurationError loudly rather
+      # than silently registering a malformed client.
+      def default_auth_method
+        configured = StandardId.config.oauth.dynamic_registration_default_auth_method.to_s
+        unless SUPPORTED_AUTH_METHODS.include?(configured)
+          raise StandardId::ConfigurationError,
+            "oauth.dynamic_registration_default_auth_method must be one of " \
+            "#{SUPPORTED_AUTH_METHODS.join(', ')} (got #{configured.inspect})"
+        end
+
+        configured
       end
 
       def client_type
@@ -142,7 +157,7 @@ module StandardId
 
         raise StandardId::InvalidClientMetadataError,
           "Unsupported token_endpoint_auth_method: #{method.inspect}. " \
-          "Allowed: #{(CONFIDENTIAL_AUTH_METHODS + [PUBLIC_AUTH_METHOD]).join(', ')}"
+          "Allowed: #{SUPPORTED_AUTH_METHODS.join(', ')}"
       end
 
       # Public clients are always forced onto PKCE/S256 (the model also validates

data/lib/standard_id/oauth/discovery_document.rb

@@ -39,7 +39,9 @@ module StandardId
           grant_types_supported: %w[authorization_code refresh_token client_credentials],
           subject_types_supported: %w[public],
           id_token_signing_alg_values_supported: [StandardId.config.oauth.signing_algorithm.to_s.upcase],
-          token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post],
+          # "none" advertises public-client support (PKCE-only token exchange,
+          # no client_secret) per RFC 8414 — required by native/SPA/MCP clients.
+          token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post none],
           # PKCE is always enforced (require_pkce defaults true and cannot be
           # disabled for public clients), so advertise the supported method.
           code_challenge_methods_supported: %w[S256]

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.23.0"
+  VERSION = "0.24.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.23.0
+  version: 0.24.0
 platform: ruby
 authors:
 - Jaryl Sim