standard_id 0.29.0 → 0.29.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e92eb10b6ca75511deb6b2b825b95fc79b25db73135d1cc6c637095e7466f8e8
-  data.tar.gz: 4968ead0789aaeddb2ab68de34c224d951d988a18932e49e29125489cfa6eacb
+  metadata.gz: 4642a44dc7a0c1c24cc9a9c1d600f8cb902f79c3d2b418181e1e669d000818d7
+  data.tar.gz: 809d9802ea1d42c38f06b8675149862a837458cd6bf37c508d010f0804da7082
 SHA512:
-  metadata.gz: 4c14b2551f993b7b7f9a20694ef337af4a9ebb05270c9a1cc343f43d3f3483d6196d1360786410b4140cc6c0214e82feadf5688019c347f66e0476958fb3c7c3
-  data.tar.gz: b71083067ee12c30bfedc1a1ee5ac8b9181c47fcaf790e8ee60e00eee4d73ac5a1eadcbd496e51f7244fd08bd83ec0a5a412e2cc225901c259809645b482af9a
+  metadata.gz: 933380f52e99eb7b38352fc6c58f921a8c91a4f7992fabff910ed52d40cce731f623209de938ddf2ece269ab92f65ec1c5a525edd5ffec140400056340e7ef65
+  data.tar.gz: c7690d11c5065738e3c27a3e199d7a0d31535cdd4a3b93819ebb23356f8f91abd8b838d550c5c4347a4bf2e70d5e8ec04660e721a98e5f4083a3d3d410506319

data/app/controllers/standard_id/web/base_controller.rb

@@ -75,6 +75,19 @@ module StandardId
         return true if destination.start_with?("/") && !destination.start_with?("//")
         return true if same_origin_url?(destination)
 
+        allow_listed_redirect?(destination)
+      end
+
+      # Whether the host has explicitly allow-listed `destination`'s prefix via
+      # `StandardId.config.allowed_redirect_url_prefixes`. This is the only way a
+      # cross-origin or custom-scheme destination (e.g. "myapp://done") clears
+      # `safe_destination?`, so it is also exactly the condition under which
+      # `redirect_to` needs `allow_other_host: true` — Rails otherwise raises
+      # UnsafeRedirectError. Mirrors the pattern already used by the social
+      # callback (Web::Auth::Callback::ProvidersController).
+      def allow_listed_redirect?(destination)
+        return false if destination.blank?
+
         Array(StandardId.config.allowed_redirect_url_prefixes).any? do |entry|
           case entry
           when Regexp then entry.match?(destination)
@@ -83,6 +96,34 @@ module StandardId
         end
       end
 
+      # Redirect a just-authenticated account to an already-validated `destination`.
+      #
+      # Uses `redirect_with_inertia` rather than `redirect_to` because the sign-in
+      # submit itself may be an Inertia XHR (hosts with `use_inertia` render the
+      # WebEngine's auth pages as Inertia components) while `destination` may not be
+      # an Inertia endpoint at all — the canonical case being the ApiEngine's
+      # /api/authorize in an OAuth flow. An Inertia client follows a 303 with its
+      # X-Inertia header still attached; inertia_rails' middleware then calls
+      # #inertia_configuration on the target controller, which ActionController::API
+      # controllers never receive (inertia_rails only includes its Controller module
+      # via `on_load(:action_controller_base)`), raising NoMethodError → 500.
+      # Emitting 409 + X-Inertia-Location instead makes the client do a full page
+      # visit, which drops the header. The destination being same-origin is not
+      # enough to make a plain redirect safe, so this deliberately keys off the
+      # request being Inertia rather than off the destination.
+      #
+      # `notice` is written to `flash` instead of being passed as a redirect option
+      # because `inertia_location` ignores redirect options — writing it to the
+      # session is what lets the message survive on both branches.
+      def redirect_after_authentication(destination, notice: nil, status: :see_other)
+        flash[:notice] = notice if notice.present?
+
+        options = { status: status }
+        options[:allow_other_host] = true if allow_listed_redirect?(destination)
+
+        redirect_with_inertia destination, **options
+      end
+
       def same_origin_url?(destination)
         return false unless destination.start_with?("http://", "https://")
         URI.parse(destination).origin == URI.parse(request.base_url).origin

data/app/controllers/standard_id/web/login_controller.rb

@@ -81,7 +81,7 @@ module StandardId
           fallback = after_authentication_url
           fallback = safe_post_signin_default unless safe_destination?(fallback)
           destination = redirect_override || (safe_destination?(redirect_uri) ? redirect_uri : nil) || fallback
-          redirect_to destination, status: :see_other, notice: "Successfully signed in"
+          redirect_after_authentication destination, notice: "Successfully signed in"
         else
           flash.now[:alert] = "Invalid email or password"
           render_with_inertia action: :show, props: auth_page_props(passwordless_enabled: passwordless_enabled?), status: :unprocessable_content

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -78,7 +78,7 @@ module StandardId
         # blocks Array/Hash but not "https://evil.com/phish". Validate before redirect.
         fallback = after_authentication_url
         destination = redirect_override || (safe_destination?(fallback) ? fallback : safe_post_signin_default)
-        redirect_to destination, status: :see_other, notice: "Successfully signed in"
+        redirect_after_authentication destination, notice: "Successfully signed in"
       rescue StandardId::AuthenticationDenied => e
         session.delete(:standard_id_otp_payload)
         handle_authentication_denied(e, account: account, newly_created: newly_created)

data/app/controllers/standard_id/web/signup_controller.rb

@@ -56,7 +56,9 @@ module StandardId
           fallback = after_authentication_url
           fallback = safe_post_signin_default unless safe_destination?(fallback)
           destination = redirect_override || (safe_destination?(redirect_uri) ? redirect_uri : nil) || fallback
-          redirect_to destination, notice: "Account created successfully"
+          # status: :found preserves this action's long-standing 302 (the other
+          # post-auth redirects use 303); only the Inertia branch changes here.
+          redirect_after_authentication destination, notice: "Account created successfully", status: :found
         else
           @redirect_uri = string_param(:redirect_uri) || after_authentication_url
           @connection = params[:connection]

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.29.0"
+  VERSION = "0.29.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.29.0
+  version: 0.29.1
 platform: ruby
 authors:
 - Jaryl Sim