standard_singpass 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b337f846e33125912e93e3819ad6ab9858dea86f6f2976f821650cd41eda5f2d
-  data.tar.gz: d655d89457c6a8120223dec9c266945ef03601dc79d82268e9ea5149fe7de75b
+  metadata.gz: 6a27b57ad2ae40ae92c93b8328f2fe0849d22bc95ecc1812bb1f6899f2eb36e1
+  data.tar.gz: 3d8c189d90e1cd51db83b73f7bee5fe78d4f856b90721707a12befd8af8c37e6
 SHA512:
-  metadata.gz: 0ccefce8b78a9ad7ef3213738a6266b544241c18e99ce645aa0de0bb1f6067f5bda79f793ee048757c4763cd1f990779649bc86c3d506849c5e3d7cfc19a0290
-  data.tar.gz: 6fb74b23e6fdf75e2191d7eecc76a45969aac95f6d5dd8383572b563299c15b1013dd2199c2816189248713452f0043c861c74cf9e14d33504357226a3b1f1e7
+  metadata.gz: eeca8fd0904977618487859b6aa207f4cd3394aa016943f1f6e177ee71404f9e95bdef1b68fb2a68b47d9463f5779871f5b0d8257f834fd403d954c81537816b
+  data.tar.gz: a321882ef3e389555bb2427262f863961c38dd30e2a265959cbc383bcad05de9f63b243b248115f40ca5adc5fd267f3f6a2a860a36a6d8e8cbe92c5bd6369b1f

data/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-24
+
+**Breaking.** Removes everything 0.4.0 deprecated. No other behaviour changes.
+
+### Removed
+
+- **`StandardSingpass::Myinfo::Security::DecryptionError` / `Security::ValidationError`.** These were aliases of `StandardSingpass::Myinfo::DecryptionError` / `SignatureError`, which `Security` has raised directly since 0.4.0. Referencing the old names now raises `NameError`. Rescue `DecryptionError` / `SignatureError`, or the `StandardSingpass::Myinfo::Error` base.
+- **`StandardSingpass::Myinfo::EcdhJwe.encrypt`**, the forwarder. Use `require "standard_singpass/testing"` and `StandardSingpass::Testing::EcdhJwe.encrypt` (same signature). `EcdhJwe.decrypt` is unchanged.
+- **`StandardSingpass::Myinfo::TestPersonas.reload!`**. Personas are read once per process. Restart, or point `personas_path` at a different file.
+
+### Changed
+
+- `StandardSingpass.deprecator`'s horizon is now `0.6`.
+
+### Upgrade notes
+
+- **No code change required in the one consumer, fundbright-web.** Grepped `origin/main` on 2026-09-24: no reference to `Security::DecryptionError`, `Security::ValidationError`, `EcdhJwe.encrypt` or `TestPersonas.reload!`.
+- Regenerate the gem RBI when bumping (`bin/tapioca gem standard_singpass`). `sorbet/rbi/gems/standard_singpass@0.4.0.rbi` still declares the removed constants and methods.
+
 ## [0.4.0] - 2026-09-24
 
 ### Upgrading from 0.3.x

data/README.md

@@ -215,7 +215,7 @@ All errors descend from `StandardSingpass::Myinfo::Error`, which in turn descend
 - `RateLimitError` — Singpass returned HTTP 429
 - `ConfigurationError` — gem is misconfigured (e.g. invalid ACR URN)
 
-`Security` raises `DecryptionError` / `SignatureError` directly. The pre-0.4.0 `Security::DecryptionError` / `Security::ValidationError` constants are deprecated aliases of those two classes.
+`Security` raises `DecryptionError` / `SignatureError` directly. The pre-0.4.0 `Security::DecryptionError` / `Security::ValidationError` aliases were removed in 0.5.0; rescue `DecryptionError` / `SignatureError` (or `StandardSingpass::Myinfo::Error`).
 
 `DecryptionError` and `SignatureError` usually indicate a key/cert misconfiguration rather than an upstream outage. **Usually, not always:** verifying a signature requires fetching Singpass's JWKS, so a JWKS host that is down surfaces as a `SignatureError` (or an `AuthenticationError` on the ID-token leg) too. Those carry the JWKS response's `status` / `transport?`, so ask `FailureClassifier` rather than deciding by class — including when choosing what to feed a circuit breaker.
 
@@ -301,7 +301,7 @@ bundle exec srb tc         # Sorbet typecheck — keep it green
   )
   ```
 
-  `standard_singpass/testing` is not loaded by `require "standard_singpass"`. The old `StandardSingpass::Myinfo::EcdhJwe.encrypt` still works but is deprecated.
+  `standard_singpass/testing` is not loaded by `require "standard_singpass"`. The old `StandardSingpass::Myinfo::EcdhJwe.encrypt` forwarder was removed in 0.5.0.
 - **Specs that mutate configuration** should call `StandardSingpass::Myinfo.reset_configuration!` afterwards.
 
 ## License

data/lib/standard_singpass/myinfo/ecdh_jwe.rb

@@ -41,31 +41,6 @@ module StandardSingpass
         "A256GCM" => 32
       }.freeze, T::Hash[String, Integer])
 
-      # Deprecated (0.4.0): encryption is only ever needed to build fixtures
-      # in tests — Singpass encrypts, we decrypt. It lives in
-      # `StandardSingpass::Testing::EcdhJwe` now (`require
-      # "standard_singpass/testing"`); this forwarder will be removed in a
-      # future minor release.
-      sig do
-        params(
-          payload: String,
-          public_key: OpenSSL::PKey::EC,
-          alg: String,
-          enc: String,
-          kid: T.nilable(String),
-          apu: T.nilable(String),
-          apv: T.nilable(String)
-        ).returns(String)
-      end
-      def self.encrypt(payload, public_key:, alg:, enc:, kid: nil, apu: nil, apv: nil)
-        StandardSingpass.deprecator.warn(
-          "StandardSingpass::Myinfo::EcdhJwe.encrypt is deprecated and will be removed; " \
-          "require \"standard_singpass/testing\" and use StandardSingpass::Testing::EcdhJwe.encrypt instead."
-        )
-        require "standard_singpass/testing"
-        StandardSingpass::Testing::EcdhJwe.encrypt(payload, public_key:, alg:, enc:, kid:, apu:, apv:)
-      end
-
       # Decrypts a compact-serialized JWE string.
       sig { params(jwe_string: String, private_key: OpenSSL::PKey::EC).returns(String) }
       def self.decrypt(jwe_string, private_key:)

data/lib/standard_singpass/myinfo/security.rb

@@ -5,21 +5,6 @@ module StandardSingpass
     class Security
       extend T::Sig
 
-      # Deprecated aliases (0.4.0). Security used to raise its own
-      # DecryptionError / ValidationError, which the client then translated
-      # into the public Myinfo errors. It now raises the public errors
-      # directly: JWE failures raise `Myinfo::DecryptionError`, JWS / JWKS
-      # failures raise `Myinfo::SignatureError` (carrying the JWKS response's
-      # `status`, or `transport?` when the JWKS host was unreachable, so an
-      # outage stays distinguishable from a genuinely bad signature).
-      #
-      # The old names still resolve — to the same classes, so an existing
-      # `rescue Security::ValidationError` keeps catching — and will be
-      # removed in a future minor release.
-      DecryptionError = Myinfo::DecryptionError
-      ValidationError = Myinfo::SignatureError
-      deprecate_constant :DecryptionError, :ValidationError
-
       JWKS_CACHE_TTL = T.let(1.hour, ActiveSupport::Duration)
 
       # Generates a PKCE code verifier and code challenge pair (S256).

data/lib/standard_singpass/myinfo/test_personas.rb

@@ -31,18 +31,6 @@ module StandardSingpass
         @data ||= JSON.parse(fixture_path.read).freeze
       end
 
-      # Deprecated (0.4.0) — unused by any consumer, and will be removed in a
-      # future minor release. Personas are read once per process; restart the
-      # process (or point `personas_path` at a different file) to pick up
-      # edits.
-      def self.reload!
-        StandardSingpass.deprecator.warn(
-          "StandardSingpass::Myinfo::TestPersonas.reload! is deprecated and will be removed."
-        )
-        @data = nil
-        data
-      end
-
       def self.fixture_path
         configured = StandardSingpass::Myinfo.configuration.personas_path
         configured ? Pathname.new(configured) : GEM_FIXTURE_PATH

data/lib/standard_singpass/version.rb

@@ -1,3 +1,3 @@
 module StandardSingpass
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/standard_singpass.rb

@@ -25,7 +25,7 @@ module StandardSingpass
     # with the host's `Rails.application.deprecators` by the engine, so the
     # host's deprecation behaviour (log / raise / silence) applies.
     def deprecator
-      @deprecator ||= ActiveSupport::Deprecation.new("0.5", "StandardSingpass")
+      @deprecator ||= ActiveSupport::Deprecation.new("0.6", "StandardSingpass")
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_singpass
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Jaryl Sim