standard_id 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79293d8af473e409c125e4412da31b1438fc0099efea935116d9036978251395
-  data.tar.gz: 568d1a2c768b0bbf17385c02781ec8193ef6a6b94da5118d1b4383755718ccbb
+  metadata.gz: 112cdb26b4fc96d4be1830bde78fada616b87a79f6d7adff9657df72d8942a57
+  data.tar.gz: 4efeaf6a5f3f5bfdaf3747bebc0f5f9c3ccf22b02642c69e7b59c8a3d4aec74a
 SHA512:
-  metadata.gz: 855acbd34604cd3a626d041daf889f3329259cdd23aab12e5f0055e1e75ddd55b728be1103b9b286602d045b1f37f34ef2be6251d96a77609e7e1f69414aa557
-  data.tar.gz: 3c99a235eb70e8713093d8bc4231677c888eae0f392aed5ccd72bcc09f65147d74c3e6355b877c5928d27a5c40622df6c4e450030da2b2d9affdc5264258d4dd
+  metadata.gz: eea26565c62749d409acbdf38a282f63edf16ed907872d9673fea58057ede62ea679adb1765cd1e55855a48ca67cdabc5baeb7fa52277529828366c560462e7e
+  data.tar.gz: c250360c48f34dc9d52b6f1391e7816735dd1d3e9be63d7d80a0e8ae9b87d7ee178f8c78867eead4b7c792ac62b6a753ea90be73caf9e1f60e4c94415c57f1fd

data/app/controllers/concerns/standard_id/inertia_rendering.rb

@@ -42,8 +42,23 @@ module StandardId
         social_providers: {
           google_enabled: StandardId.config.google_client_id.present?,
           apple_enabled: StandardId.config.apple_client_id.present?
-        }
+        },
+        enabled_mechanisms: web_enabled_mechanisms
       }.deep_merge(additional_props)
     end
+
+    def web_enabled_mechanisms
+      web = StandardId.config.web
+      {
+        password_login: web.password_login,
+        signup: web.signup,
+        passwordless_login: web.passwordless_login,
+        social_login: web.social_login,
+        password_reset: web.password_reset,
+        email_verification: web.email_verification,
+        phone_verification: web.phone_verification,
+        sessions_management: web.sessions_management
+      }
+    end
   end
 end

data/app/controllers/concerns/standard_id/lifecycle_hooks.rb

@@ -0,0 +1,72 @@
+module StandardId
+  module LifecycleHooks
+    extend ActiveSupport::Concern
+
+    private
+
+    # Invoke the after_sign_in hook if configured.
+    #
+    # @param account [Object] the authenticated account
+    # @param context [Hash] context about the sign-in
+    #   - :connection [String] "email", "password", or "social"
+    #   - :provider [String, nil] e.g. "google", "apple", or nil
+    #   - :first_sign_in [Boolean] whether this is the account's first browser session
+    # @return [String, nil] redirect path override, or nil for default
+    # @raise [StandardId::AuthenticationDenied] to reject the sign-in
+    def invoke_after_sign_in(account, context)
+      hook = StandardId.config.after_sign_in
+      return nil unless hook.respond_to?(:call)
+
+      context = context.merge(first_sign_in: first_sign_in?(account))
+      hook.call(account, request, context)
+    end
+
+    # Invoke the after_account_created hook if configured.
+    #
+    # @param account [Object] the newly created account
+    # @param context [Hash] context about the creation
+    #   - :mechanism [String] "passwordless", "social", or "signup"
+    #   - :provider [String, nil] e.g. "google", "apple", or nil
+    # @return [void]
+    def invoke_after_account_created(account, context)
+      hook = StandardId.config.after_account_created
+      return unless hook.respond_to?(:call)
+
+      hook.call(account, request, context)
+    end
+
+    # Determine if this is the account's first browser session.
+    # A count of 1 means the session just created is the only one.
+    def first_sign_in?(account)
+      account.sessions.where(type: "StandardId::BrowserSession").active.count <= 1
+    end
+
+    # Handle AuthenticationDenied by revoking the session and redirecting to login.
+    # If the account was just created, clean it up to avoid orphaned records.
+    #
+    # @param error [StandardId::AuthenticationDenied] the denial error
+    # @param account [Object, nil] the account to clean up if newly created
+    # @param newly_created [Boolean] whether the account was created during this request
+    def handle_authentication_denied(error, account: nil, newly_created: false)
+      session_manager.revoke_current_session!
+      destroy_newly_created_account(account) if newly_created
+      message = error.message
+      # When raised without arguments, StandardError#message returns the class name
+      message = "Sign-in was denied" if message.blank? || message == error.class.name
+      redirect_to StandardId::WebEngine.routes.url_helpers.login_path, alert: message
+    end
+
+    # Destroy a newly created account and all its dependents.
+    # Used when after_sign_in rejects a just-created account to avoid orphans.
+    def destroy_newly_created_account(account)
+      return unless account&.persisted?
+
+      ActiveRecord::Base.transaction do
+        account.sessions.destroy_all
+        account.identifiers.each { |i| i.credentials.destroy_all }
+        account.identifiers.destroy_all
+        account.destroy
+      end
+    end
+  end
+end

data/app/controllers/concerns/standard_id/web_mechanism_gate.rb

@@ -0,0 +1,28 @@
+module StandardId
+  module WebMechanismGate
+    extend ActiveSupport::Concern
+
+    class_methods do
+      # Declares which web mechanism this controller requires.
+      # If the mechanism is disabled via config, requests return 404.
+      #
+      #   class SignupController < BaseController
+      #     requires_web_mechanism :signup
+      #   end
+      def requires_web_mechanism(mechanism_name)
+        before_action -> { enforce_web_mechanism!(mechanism_name) }
+      end
+    end
+
+    private
+
+    def enforce_web_mechanism!(mechanism_name)
+      unless StandardId.config.web.respond_to?(mechanism_name)
+        raise ArgumentError, "Unknown web mechanism: #{mechanism_name.inspect}. " \
+              "Valid mechanisms: #{StandardId.config.web.class.instance_methods(false).grep_v(/=/).sort.join(', ')}"
+      end
+
+      head :not_found unless StandardId.config.web.public_send(mechanism_name)
+    end
+  end
+end

data/app/controllers/standard_id/web/auth/callback/providers_controller.rb

@@ -4,10 +4,12 @@ module StandardId
       module Callback
         class ProvidersController < StandardId::Web::BaseController
           public_controller
+          requires_web_mechanism :social_login
 
           include StandardId::WebAuthentication
           include StandardId::SocialAuthentication
           include StandardId::Web::SocialLoginParams
+          include StandardId::LifecycleHooks
 
           # Social callbacks must be accessible without an existing browser session
           # because they create/sign-in the session upon successful callback.
@@ -28,21 +30,35 @@ module StandardId
               provider_response = get_user_info_from_provider(redirect_uri:, nonce:)
               social_info = provider_response[:user_info]
               provider_tokens = provider_response[:tokens]
-              account = find_or_create_account_from_social(social_info)
+              begin
+                account = find_or_create_account_from_social(social_info)
+              rescue ActiveRecord::RecordNotUnique
+                # Race condition: concurrent request created the account first — retry to find it
+                account = find_or_create_account_from_social(social_info)
+              end
+              newly_created = account.previously_new_record?
               session_manager.sign_in_account(account)
 
+              provider_name = provider.provider_name
+              invoke_after_account_created(account, { mechanism: "social", provider: provider_name }) if newly_created
+
               run_social_callback(
-                provider: provider.provider_name,
+                provider: provider_name,
                 social_info: social_info,
                 provider_tokens: provider_tokens,
                 account: account,
                 original_request_params: state_data
               )
 
-              destination = state_data["redirect_uri"]
-              redirect_options = { notice: "Successfully signed in with #{provider.provider_name.humanize}" }
+              context = { connection: "social", provider: provider_name }
+              redirect_override = invoke_after_sign_in(account, context)
+
+              destination = redirect_override || state_data["redirect_uri"]
+              redirect_options = { notice: "Successfully signed in with #{provider_name.humanize}" }
               redirect_options[:allow_other_host] = true if allow_other_host_redirect?(destination)
               redirect_to destination, redirect_options
+            rescue StandardId::AuthenticationDenied => e
+              handle_authentication_denied(e, account: account, newly_created: newly_created)
             rescue StandardId::OAuthError => e
               redirect_to StandardId::WebEngine.routes.url_helpers.login_path(redirect_uri: state_data&.dig("redirect_uri")), alert: "Authentication failed: #{e.message}"
             end

data/app/controllers/standard_id/web/base_controller.rb

@@ -4,6 +4,7 @@ module StandardId
       include StandardId::ControllerPolicy
       include StandardId::WebAuthentication
       include StandardId::SetCurrentRequestDetails
+      include StandardId::WebMechanismGate
 
       include StandardId::WebEngine.routes.url_helpers
       helper StandardId::WebEngine.routes.url_helpers

data/app/controllers/standard_id/web/login_controller.rb

@@ -6,6 +6,7 @@ module StandardId
       include StandardId::InertiaRendering
       include StandardId::Web::SocialLoginParams
       include StandardId::PasswordlessStrategy
+      include StandardId::LifecycleHooks
 
       layout "public"
 
@@ -32,16 +33,23 @@ module StandardId
       private
 
       def passwordless_enabled?
-        StandardId.config.passwordless.enabled
+        StandardId.config.web.passwordless_login
       end
 
       def handle_password_login
+        return head(:not_found) unless StandardId.config.web.password_login
+
         if sign_in_account(login_params)
-          redirect_to params[:redirect_uri] || after_authentication_url, status: :see_other, notice: "Successfully signed in"
+          context = { connection: "password", provider: nil }
+          redirect_override = invoke_after_sign_in(current_account, context)
+          destination = redirect_override || params[:redirect_uri] || after_authentication_url
+          redirect_to destination, status: :see_other, notice: "Successfully signed in"
         else
           flash.now[:alert] = "Invalid email or password"
           render_with_inertia action: :show, props: auth_page_props(passwordless_enabled: passwordless_enabled?), status: :unprocessable_content
         end
+      rescue StandardId::AuthenticationDenied => e
+        handle_authentication_denied(e)
       end
 
       def handle_passwordless_login

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -2,14 +2,14 @@ module StandardId
   module Web
     class LoginVerifyController < BaseController
       public_controller
+      requires_web_mechanism :passwordless_login
 
       include StandardId::InertiaRendering
+      include StandardId::LifecycleHooks
 
       layout "public"
 
       skip_before_action :require_browser_session!, only: [:show, :update]
-
-      before_action :ensure_passwordless_enabled!
       before_action :redirect_if_authenticated, only: [:show]
       before_action :require_otp_payload!
 
@@ -39,23 +39,28 @@ module StandardId
           return
         end
 
-        session_manager.sign_in_account(result.account)
-        emit_authentication_succeeded(result.account)
+        account = result.account
+        newly_created = account.previously_new_record?
 
-        session.delete(:standard_id_otp_payload)
+        session_manager.sign_in_account(account)
+        emit_authentication_succeeded(account)
 
-        redirect_to after_authentication_url, status: :see_other, notice: "Successfully signed in"
-      end
+        invoke_after_account_created(account, { mechanism: "passwordless", provider: nil }) if newly_created
 
-      private
+        context = { connection: @otp_data[:connection], provider: nil }
+        redirect_override = invoke_after_sign_in(account, context)
 
-      def ensure_passwordless_enabled!
-        return if StandardId.config.passwordless.enabled
+        session.delete(:standard_id_otp_payload)
 
+        destination = redirect_override || after_authentication_url
+        redirect_to destination, status: :see_other, notice: "Successfully signed in"
+      rescue StandardId::AuthenticationDenied => e
         session.delete(:standard_id_otp_payload)
-        redirect_to login_path, alert: "Passwordless login is not available"
+        handle_authentication_denied(e, account: account, newly_created: newly_created)
       end
 
+      private
+
       def redirect_if_authenticated
         redirect_to after_authentication_url, status: :see_other if authenticated?
       end

data/app/controllers/standard_id/web/reset_password/confirm_controller.rb

@@ -3,6 +3,7 @@ module StandardId
     module ResetPassword
       class ConfirmController < BaseController
         public_controller
+        requires_web_mechanism :password_reset
 
         layout "public"
 

data/app/controllers/standard_id/web/reset_password/start_controller.rb

@@ -3,6 +3,7 @@ module StandardId
     module ResetPassword
       class StartController < BaseController
         public_controller
+        requires_web_mechanism :password_reset
 
         layout "public"
 

data/app/controllers/standard_id/web/sessions_controller.rb

@@ -2,6 +2,7 @@ module StandardId
   module Web
     class SessionsController < BaseController
       authenticated_controller
+      requires_web_mechanism :sessions_management
 
       def index
         @sessions = current_account.sessions.active.order(created_at: :desc)

data/app/controllers/standard_id/web/signup_controller.rb

@@ -2,8 +2,10 @@ module StandardId
   module Web
     class SignupController < BaseController
       public_controller
+      requires_web_mechanism :signup
 
       include StandardId::InertiaRendering
+      include StandardId::LifecycleHooks
 
       layout "public"
 
@@ -38,14 +40,20 @@ module StandardId
 
         if form.submit
           session_manager.sign_in_account(form.account)
-          redirect_to params[:redirect_uri] || after_authentication_url,
-                      notice: "Account created successfully"
+          invoke_after_account_created(form.account, { mechanism: "signup", provider: nil })
+
+          context = { connection: "password", provider: nil }
+          redirect_override = invoke_after_sign_in(form.account, context)
+          destination = redirect_override || params[:redirect_uri] || after_authentication_url
+          redirect_to destination, notice: "Account created successfully"
         else
           @redirect_uri = params[:redirect_uri] || after_authentication_url
           @connection = params[:connection]
           flash.now[:alert] = form.errors.full_messages.join(", ")
           render_with_inertia action: :show, props: auth_page_props(errors: form.errors.to_hash), status: :unprocessable_content
         end
+      rescue StandardId::AuthenticationDenied => e
+        handle_authentication_denied(e, account: form.account, newly_created: form.account&.previously_new_record?)
       end
 
       def social_signup_url

data/app/controllers/standard_id/web/verify_email/base_controller.rb

@@ -3,6 +3,7 @@ module StandardId
     module VerifyEmail
       class BaseController < StandardId::Web::BaseController
         public_controller
+        requires_web_mechanism :email_verification
 
         skip_before_action :require_browser_session!
       end

data/app/controllers/standard_id/web/verify_phone/base_controller.rb

@@ -3,6 +3,7 @@ module StandardId
     module VerifyPhone
       class BaseController < StandardId::Web::BaseController
         public_controller
+        requires_web_mechanism :phone_verification
 
         skip_before_action :require_browser_session!
       end

data/config/brakeman.ignore

@@ -1,9 +1,5 @@
 {
   "ignored_warnings": [
-    {
-      "fingerprint": "24fc02735a2ad863d6bf1171a4a329b208e9e7c41841fa0149d8e6878d4ce299",
-      "note": "Auth engine intentionally redirects to params[:redirect_uri] after signup for OAuth/post-auth flow"
-    },
     {
       "fingerprint": "6b35e9906d62a9b9cd0dff9cf53924d40e74bc4f96cfccf27e67e93551113243",
       "note": "Auth engine intentionally redirects to params[:redirect_uri] after logout for OAuth/post-auth flow"
@@ -16,15 +12,19 @@
       "fingerprint": "bdbc72619da2ba771b1185ccf16acce801066689bf51adf116eab8c8714b39af",
       "note": "HEAD vs GET distinction is inconsequential here; storing return URL on GET-only is safe"
     },
-    {
-      "fingerprint": "16bd6ec7c3fa130eb80c15fc90c87f9859d89b37258807bfaffe4101366611a6",
-      "note": "Auth engine intentionally redirects to params[:redirect_uri] after login for OAuth/post-auth flow"
-    },
     {
       "fingerprint": "e4f96cb212c73c3165c3db6eaa6368c29d362b61264f034e80c9fa6705d72e5b",
       "note": "Auth engine intentionally redirects to params[:redirect_uri] when user is not authenticated"
+    },
+    {
+      "fingerprint": "68be03a57d3ef2cfb68582fc78ac2eb6b96aaa0a9897a9a975c24b889fdbb2aa",
+      "note": "after_sign_in hook redirect is controlled by the host app configuration, not user input"
+    },
+    {
+      "fingerprint": "277cf277d1c94f46d0abaeba9c51312d1d17e6f62c2e8d457dda47a6aad422aa",
+      "note": "after_sign_in hook redirect is controlled by the host app configuration, not user input"
     }
   ],
-  "updated": "2026-02-27",
-  "brakeman_version": "8.0.2"
+  "updated": "2026-03-21",
+  "brakeman_version": "8.0.4"
 }

data/lib/standard_id/config/schema.rb

@@ -21,6 +21,20 @@ StandardConfig.schema.draw do
     # Callable (lambda/proc) that returns a Hash of extra Sentry user context fields.
     # Receives (account, session) where session may be nil. Non-callable values are ignored.
     field :sentry_context, type: :any, default: nil
+
+    # Post-authentication lifecycle hooks (synchronous, WebEngine only)
+    #
+    # after_sign_in: Called after successful sign-in, before redirect.
+    #   Receives: (account, request, context)
+    #   Context: { first_sign_in: bool, connection: "email"/"password"/"social", provider: nil/"google"/"apple" }
+    #   Return: nil (default redirect) or a path string (override redirect)
+    #   Raise StandardId::AuthenticationDenied.new("message") to reject sign-in.
+    field :after_sign_in, type: :any, default: nil
+
+    # after_account_created: Called after a new account is created via any mechanism.
+    #   Receives: (account, request, context)
+    #   Context: { mechanism: "passwordless"/"social"/"signup", provider: nil/"google"/"apple" }
+    field :after_account_created, type: :any, default: nil
   end
 
   scope :events do
@@ -28,6 +42,8 @@ StandardConfig.schema.draw do
   end
 
   scope :passwordless do
+    # Deprecated: use web.passwordless_login to control WebEngine passwordless login.
+    # Retained for backwards compatibility with consuming apps that set this field.
     field :enabled, type: :boolean, default: false
     field :connection, type: :string, default: "email"
     field :code_ttl, type: :integer, default: 600 # 10 minutes in seconds
@@ -81,4 +97,15 @@ StandardConfig.schema.draw do
     field :allowed_redirect_url_prefixes, type: :array, default: []
     field :available_scopes, type: :array, default: -> { [] }
   end
+
+  scope :web do
+    field :password_login, type: :boolean, default: true
+    field :signup, type: :boolean, default: true
+    field :passwordless_login, type: :boolean, default: false
+    field :social_login, type: :boolean, default: true
+    field :password_reset, type: :boolean, default: true
+    field :email_verification, type: :boolean, default: true
+    field :phone_verification, type: :boolean, default: true
+    field :sessions_management, type: :boolean, default: true
+  end
 end

data/lib/standard_id/errors.rb

@@ -70,6 +70,9 @@ module StandardId
     def oauth_error_code = :unsupported_response_type
   end
 
+  # Lifecycle hook errors
+  class AuthenticationDenied < StandardError; end
+
   # Audience verification errors
   class InvalidAudienceError < StandardError
     attr_reader :required, :actual

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.7.1"
+  VERSION = "0.8.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.8.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -112,12 +112,14 @@ files:
 - app/controllers/concerns/standard_id/controller_policy.rb
 - app/controllers/concerns/standard_id/inertia_rendering.rb
 - app/controllers/concerns/standard_id/inertia_support.rb
+- app/controllers/concerns/standard_id/lifecycle_hooks.rb
 - app/controllers/concerns/standard_id/passwordless_strategy.rb
 - app/controllers/concerns/standard_id/sentry_context.rb
 - app/controllers/concerns/standard_id/set_current_request_details.rb
 - app/controllers/concerns/standard_id/social_authentication.rb
 - app/controllers/concerns/standard_id/web/social_login_params.rb
 - app/controllers/concerns/standard_id/web_authentication.rb
+- app/controllers/concerns/standard_id/web_mechanism_gate.rb
 - app/controllers/standard_id/api/authorization_controller.rb
 - app/controllers/standard_id/api/base_controller.rb
 - app/controllers/standard_id/api/oauth/base_controller.rb
@@ -265,6 +267,7 @@ metadata:
   homepage_uri: https://github.com/rarebit-one/standard_id
   source_code_uri: https://github.com/rarebit-one/standard_id
   changelog_uri: https://github.com/rarebit-one/standard_id/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/rarebit-one/standard_id/issues
 rdoc_options: []
 require_paths:
 - lib