standard_id 0.33.0 → 0.34.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5341add412ad2ef395a4252d31f751e5b9eeb9df585f1eb3e5c276d7071211f
-  data.tar.gz: b53b6dc29f5aa4a5994b040f5a6cdca2441c4c0c57cb2449b1fc1aead9caf4a7
+  metadata.gz: 984924490081d96a84ec4570541802d70414cac9dcf9dd325b8aba6ee7af7be2
+  data.tar.gz: c132d58daeea53090156fe42bfd3b6a7b8d8a2393d7ae7a3766e0c4ece0e8a6d
 SHA512:
-  metadata.gz: a4162b488000bc8e889dba2887ffe2257ad8ac342d7612aff936c74fccbf30f22560f4194c39e0552446e3e6a93b2d335c2d34b3d27ceb67586fdeb188de5181
-  data.tar.gz: fd04fc771429eaf0ed9efd4fa01fa85263983be3dd8cdf9a5b3df16194959387d929aa7bcf27711681dfb0262c3d57fd1df11f64761128646f43d9bb495ad8da
+  metadata.gz: 65dac8337e2bfa0784d43308d4c29eeeb8208c3b06b721a3f1a2f040eec1916ba35c00b8e69945f72c80a7240b95cb17ed4bf46c6939fe8c78508c44bf3363b9
+  data.tar.gz: eb1acc6703201fa5955494aec635f1821ea4d9689b49f73703736f853deb166b5eeaec1adcb20fe79c083f15903301e60829da0497ec0e138af49d2f406e4b02

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.34.0] - 2026-07-31
+
+### Added
+
+- **`config.verify_issuer`** — decouples MINTING an `iss` claim from REQUIRING one. `nil` (default) follows `config.issuer`, which is the historic behaviour and changes nothing. Set `false` to stamp `iss` on new tokens without yet verifying it.
+
+  This exists because the two were one switch, which made adopting an issuer a flag day: every token already in flight was minted without an `iss`, so setting `config.issuer` rejected all of them at once — every access token and, far worse, every refresh token. An app that had never configured an issuer had no safe single step, which is where `nutripod-web` was stuck (rarebit-one/nutripod-web#1111) and why it could not retire its hand-rolled discovery controller with the rest of the estate.
+
+  Migration: set `issuer` with `verify_issuer = false`, wait out `refresh_token_lifetime` (the long pole — access tokens are short), then remove the override. Setting `true` with no issuer raises at boot rather than silently verifying against `nil` and accepting anything.
+
 ## [0.33.0] - 2026-07-30
 
 ### Added

data/lib/standard_id/config/schema.rb

@@ -12,6 +12,26 @@ StandardId::ConfigSchema.define do
     field :passwordless_email_sender, type: :any, default: nil
     field :passwordless_sms_sender, type: :any, default: nil
     field :issuer, type: :string, default: nil
+
+    # Whether `JwtService.decode` REQUIRES a matching `iss` claim.
+    #
+    # `nil` (default) means "follow the issuer": verification is on exactly
+    # when `issuer` is set. That is the historic behaviour and is what you
+    # want once an issuer has always been configured.
+    #
+    # Set `false` to MINT an `iss` claim without yet REQUIRING one. This
+    # exists because the two were coupled, and that coupling makes adopting an
+    # issuer an all-or-nothing flag day: every token already in flight was
+    # minted without an `iss`, so turning the issuer on rejected all of them at
+    # once — every access token and, far worse, every refresh token. For an app
+    # that had never set an issuer there was no safe single step, which is
+    # exactly the position nutripod-web was stuck in (rarebit-one/nutripod-web#1111).
+    #
+    # The migration is then: set `issuer` with `verify_issuer = false`, wait
+    # out `refresh_token_lifetime` (the long pole — access tokens are short),
+    # then remove the override. Setting `true` with no issuer raises at boot
+    # rather than silently verifying nothing.
+    field :verify_issuer, type: :boolean, default: nil
     field :login_url, type: :string, default: nil
     field :allowed_post_logout_redirect_uris, type: :array, default: []
     field :account_scope, type: :any, default: nil

data/lib/standard_id/jwt_service.rb

@@ -52,6 +52,30 @@ module StandardId
       SUPPORTED_ALGORITHMS[algorithm] || raise(ArgumentError, "Unsupported algorithm: #{algorithm}. Supported: #{SUPPORTED_ALGORITHMS.keys.join(', ')}")
     end
 
+    # Whether decode REQUIRES a matching `iss`. `nil` (the default) follows the
+    # issuer, which is the historic behaviour: verification on exactly when an
+    # issuer is configured.
+    #
+    # The override exists so an app can START MINTING an `iss` without yet
+    # REQUIRING one. Coupled, adopting an issuer is a flag day — every token
+    # already in flight was minted without the claim, so enabling the issuer
+    # rejects all of them at once, refresh tokens included. Decoupled, the app
+    # sets `verify_issuer = false`, waits out `refresh_token_lifetime`, and then
+    # drops the override with no window in which valid tokens are refused.
+    def self.verify_issuer?
+      configured = StandardId.config.verify_issuer
+      return StandardId.config.issuer.present? if configured.nil?
+
+      if configured && StandardId.config.issuer.blank?
+        raise StandardId::ConfigurationError,
+              "verify_issuer is true but no issuer is configured — decode would " \
+              "verify against nil and accept any token. Set config.issuer, or " \
+              "leave verify_issuer nil to follow it."
+      end
+
+      configured
+    end
+
     def self.asymmetric?
       algorithm_config[:type] == :asymmetric
     end
@@ -152,7 +176,7 @@ module StandardId
     def self.decode(token, allowed_audiences: nil)
       options = { algorithms: [algorithm] }
 
-      if StandardId.config.issuer.present?
+      if StandardId.config.issuer.present? && verify_issuer?
         options[:iss] = StandardId.config.issuer
         options[:verify_iss] = true
       end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.33.0"
+  VERSION = "0.34.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.33.0
+  version: 0.34.0
 platform: ruby
 authors:
 - Jaryl Sim