standard_id 0.57.0 → 0.58.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c50961cc2c4446bd495efdebca4ad54a871c371fab3c63e0ff1dd6792b44e1ff
-  data.tar.gz: be9ebdaedf84eedfed63f98ade1e8fb37bfc90112b7ba4532aa8d179aefb03b9
+  metadata.gz: d7d42a5b149e2cd0cdfd3329781a9a7cb56f0397fce40b9aad0388bc2b3c2824
+  data.tar.gz: 2f21ad5ca597432fe8522c1b4e97f913fb2899d29323f6387be3cdd054f0f4e7
 SHA512:
-  metadata.gz: 55f8de3f738e3363e452842bcea0b68fbff7798e59039bdac698de7b0b5d1c1fffdb58fe693e60671aa6c9cc2743059fc3d3269e11bde54a84d7bbb23e64b8f5
-  data.tar.gz: 9c0e08fdb33cc59058c5be1be6f65b7308bb497738a8a338de1072e5cbd105f59417cbd65c4902e6f937ff53544bbd755cf7e8b8e349b2bd058583cc75eaa2bc
+  metadata.gz: 39b4a7a01eef961b0314a06c9208efe24ed7f8de2f4616dbfb2a333f657f0e7686d09dea307e687757d1e5aa380cb277daa3bcd00849a5f05134397af9c936c4
+  data.tar.gz: 95349f954d9c465944299871811796d02473afae6d0583513c5c18d52466fd87628a0137df2b5b8eff9caceace26d7a827f5cf1adb4d93fce168cdc8f63ab518

data/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.58.0] - 2026-10-28
+
+### Security
+
+- **`SOCIAL_AUTH_COMPLETED` no longer publishes the provider's raw OAuth tokens (DBP-028).** The
+  `tokens:` key (access_token, refresh_token, id_token) is gone from the payload by default. An audit
+  subscriber that copies the whole payload (`standard_audit` subscribed to `standard_id.social.*`)
+  wrote the id_token to append-only rows, because `standard_audit` redacts `access_token` and
+  `refresh_token` but not `id_token`. A host that needs the tokens gets `provider_tokens:` in the
+  `social.before_account` / `before_mint` hooks, or can set the new
+  `config.events.publish_provider_tokens = true` to restore `event[:tokens]`. Rows already written
+  are not touched.
+
+### Changed
+
+- **Migration `20261028100000_remove_redundant_standard_id_indexes` (DBP-009).** Drops 11 indexes the
+  gem's own migrations created that no query needs, which cuts write amplification on sessions, refresh
+  tokens and authorization codes. Eight are redundant: another index leads with the same columns, or
+  `lookup_hash` is already unique, or (on `client_applications`) the index exactly duplicates the one
+  `t.references` created. The other three are the never-queried GIN `metadata` indexes on sessions,
+  authorization_codes and client_applications (PostgreSQL only). No unique index is touched.
+  `CONCURRENTLY` on PostgreSQL and idempotent; `down` rebuilds them. Run
+  `bin/rails standard_id:install:migrations && bin/rails db:migrate`.
+
 ## [0.57.0] - 2026-10-28
 
 ### Added

data/README.md

@@ -609,12 +609,18 @@ To handle social login completion (e.g., for analytics or audit logging), subscr
 StandardId::Events.subscribe(StandardId::Events::SOCIAL_AUTH_COMPLETED) do |event|
   Analytics.track_social_login(
     provider: event[:provider],
-    account_id: event[:account].id,
-    tokens: event[:tokens]
+    account_id: event[:account].id
   )
 end
 ```
 
+The event does not carry the provider's raw OAuth tokens (access, refresh or
+id_token) since 0.58: a subscriber that stores the whole payload, such as an
+audit log, would keep them. A host that needs them to call the provider's API
+gets `provider_tokens:` in the `social.before_account` / `before_mint` hooks.
+Setting `config.events.publish_provider_tokens = true` restores `event[:tokens]`;
+the subscriber that reads it then has to keep them out of audit rows and logs.
+
 ### Inertia.js Integration
 
 StandardId supports [Inertia.js](https://inertiajs.com/) for modern React, Vue, or Svelte frontends. When enabled, web controllers render Inertia components instead of ERB views.
@@ -1003,7 +1009,7 @@ Every StandardId event automatically carries tracing metadata (`event_id`, `time
 |  | `social.user_info.fetched` | `provider`, `social_info`, `email` | After fetching user info from the provider |
 |  | `social.account.created` | `account`, `provider`, `social_info` | When a social login creates a new account |
 |  | `social.account.linked` | `account`, `provider`, `identifier` | When a social login links to an existing account by email (published once the link is written, never for a refused login), or matches an existing link by `sub` |
-|  | `social.auth.completed` | `account`, `provider`, `tokens` | After social login completes |
+|  | `social.auth.completed` | `account`, `provider`, `social_info`, `original_request_params` (`tokens` only with `events.publish_provider_tokens`) | After social login completes |
 |  | `social.auth.failed` | `provider`, `error`, `error_class`, `account` | When social login fails due to an infrastructure error (HTTP/DNS/SSL/timeout) |
 | Credential | `credential.password.created` | `credential`, `account` | After a password credential is created |
 |  | `credential.password.reset_initiated` | `credential`, `account`, `reset_token_expires_at` | After a password reset is initiated |

data/app/controllers/concerns/standard_id/social_authentication.rb

@@ -538,15 +538,19 @@ module StandardId
       )
     end
 
+    # Raw provider tokens stay off the bus unless the host opts in: subscribers
+    # that persist the whole payload (audit) would otherwise store them. See
+    # events.publish_provider_tokens.
     def emit_social_auth_completed(provider, social_info, provider_tokens, account, original_request_params)
-      StandardId::Events.publish(
-        StandardId::Events::SOCIAL_AUTH_COMPLETED,
+      payload = {
         account: account,
         provider: provider,
         social_info: social_info,
-        tokens: provider_tokens,
         original_request_params: original_request_params
-      )
+      }
+      payload[:tokens] = provider_tokens if StandardId.config.events.publish_provider_tokens
+
+      StandardId::Events.publish(StandardId::Events::SOCIAL_AUTH_COMPLETED, payload)
     end
 
     def emit_account_creating_from_social(social_info)

data/db/migrate/20261028100000_remove_redundant_standard_id_indexes.rb

@@ -0,0 +1,89 @@
+class RemoveRedundantStandardIdIndexes < ActiveRecord::Migration[8.0]
+  # Drops indexes the gem's own migrations created that no query needs (deep
+  # audit DBP-009, 2026-10-27). Each is write amplification on the tables the
+  # auth path writes most: every sign-in inserts a session, every refresh a
+  # refresh token.
+  #
+  # Redundant: another index leads with the same column(s), so every lookup
+  # and every foreign-key check it served is served by that one. None of them
+  # is unique; no unique index is touched.
+  #
+  #   sessions [account_id]                     <- [account_id, type, expires_at]
+  #   sessions [lookup_hash, expires_at, revoked_at]
+  #                                             <- [lookup_hash] UNIQUE
+  #   refresh_tokens [account_id]               <- [account_id, revoked_at]
+  #   refresh_tokens [session_id]               <- [session_id, revoked_at]
+  #   authorization_codes [account_id]          <- [account_id, expires_at]
+  #   client_grants [account_id]                <- [account_id, client_id] UNIQUE
+  #   identifiers [account_id]                  <- [account_id, type, value] UNIQUE
+  #   client_applications [owner_type, owner_id] "idx_on_owner_type_owner_id_..."
+  #                                             <- the identical index t.references
+  #                                                created ("..._on_owner")
+  #
+  # Unused (PostgreSQL only; SQLite never had them): the GIN `metadata` indexes
+  # on sessions, authorization_codes and client_applications. Nothing in the
+  # gem, the provider plugins or the five consumer apps queries those columns
+  # with a containment operator (@>, ?, ?|, ?&); the one host query on
+  # client_applications.metadata uses `->> =`, which a GIN jsonb_ops index
+  # cannot serve. 20260416180511 dropped the code_challenges GIN for the same
+  # reason.
+  #
+  # Every name below was checked against the schema of all five consumer apps
+  # (identical everywhere, as is the covering index). Idempotent (if_exists /
+  # if_not_exists) and CONCURRENTLY on Postgres, like 20261028000000; `down`
+  # rebuilds each one as it was.
+  disable_ddl_transaction!
+
+  INDEXES = [
+    { table: :standard_id_sessions, columns: :account_id,
+      name: "index_standard_id_sessions_on_account_id" },
+    { table: :standard_id_sessions, columns: [:lookup_hash, :expires_at, :revoked_at],
+      name: "idx_on_lookup_hash_expires_at_revoked_at_34a4504c19" },
+    { table: :standard_id_refresh_tokens, columns: :account_id,
+      name: "index_standard_id_refresh_tokens_on_account_id" },
+    { table: :standard_id_refresh_tokens, columns: :session_id,
+      name: "index_standard_id_refresh_tokens_on_session_id" },
+    { table: :standard_id_authorization_codes, columns: :account_id,
+      name: "index_standard_id_authorization_codes_on_account_id" },
+    { table: :standard_id_client_grants, columns: :account_id,
+      name: "index_standard_id_client_grants_on_account_id" },
+    { table: :standard_id_identifiers, columns: :account_id,
+      name: "index_standard_id_identifiers_on_account_id" },
+    { table: :standard_id_client_applications, columns: [:owner_type, :owner_id],
+      name: "idx_on_owner_type_owner_id_936e856298" },
+    { table: :standard_id_sessions, columns: :metadata, using: :gin, postgres_only: true,
+      name: "index_standard_id_sessions_on_metadata" },
+    { table: :standard_id_authorization_codes, columns: :metadata, using: :gin, postgres_only: true,
+      name: "index_standard_id_authorization_codes_on_metadata" },
+    { table: :standard_id_client_applications, columns: :metadata, using: :gin, postgres_only: true,
+      name: "index_standard_id_client_applications_on_metadata" }
+  ].freeze
+
+  def up
+    INDEXES.each do |index|
+      next if index[:postgres_only] && !postgres?
+
+      remove_index index[:table], name: index[:name], if_exists: true, **concurrent
+    end
+  end
+
+  def down
+    INDEXES.each do |index|
+      next if index[:postgres_only] && !postgres?
+
+      options = { name: index[:name], if_not_exists: true, **concurrent }
+      options[:using] = index[:using] if index[:using]
+      add_index index[:table], index[:columns], **options
+    end
+  end
+
+  private
+
+  def postgres?
+    connection.adapter_name.downcase.include?("postgres")
+  end
+
+  def concurrent
+    postgres? ? { algorithm: :concurrently } : {}
+  end
+end

data/lib/standard_id/config/schema.rb

@@ -194,6 +194,20 @@ StandardId::ConfigSchema.define do
     # the records going away in the one after. Until a host opts in, behaviour
     # is exactly as it was.
     field :publish_records, type: :boolean, default: true
+
+    # Whether SOCIAL_AUTH_COMPLETED carries the provider's raw OAuth tokens
+    # (`tokens:` — access_token, refresh_token, id_token).
+    #
+    # Off by default since 0.58 (DBP-028). An audit subscriber that copies the
+    # whole payload wrote them to append-only rows: `standard_audit` redacts
+    # `access_token`/`refresh_token` but not `id_token`, which is a bearer
+    # credential carrying the user's email. The bus is the wrong place for a
+    # secret; a host that needs the tokens (to call the provider's API) gets
+    # them as `provider_tokens:` in `social.before_account`/`before_mint`.
+    #
+    # Turn it on only if a subscriber of yours reads `event[:tokens]`, and keep
+    # that subscriber's output out of audit rows, logs and error reports.
+    field :publish_provider_tokens, type: :boolean, default: false
   end
 
   scope :passwordless do

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.57.0"
+  VERSION = "0.58.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.57.0
+  version: 0.58.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -250,6 +250,7 @@ files:
 - db/migrate/20261020120000_add_registration_access_token_digest_to_standard_id_client_applications.rb
 - db/migrate/20261022000000_add_signup_source_to_standard_id_identifiers.rb
 - db/migrate/20261028000000_add_value_lookup_indexes_to_standard_id_tables.rb
+- db/migrate/20261028100000_remove_redundant_standard_id_indexes.rb
 - lib/generators/standard_id/install/install_generator.rb
 - lib/generators/standard_id/install/templates/standard_id.rb
 - lib/generators/standard_id/install/templates/standard_id_reference.rb