standard_singpass 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b337f846e33125912e93e3819ad6ab9858dea86f6f2976f821650cd41eda5f2d
-  data.tar.gz: d655d89457c6a8120223dec9c266945ef03601dc79d82268e9ea5149fe7de75b
+  metadata.gz: 2ea89fcd5571a503ae9bec3dcc4c69f038e8109e68c3dfba9a119eb08efdf392
+  data.tar.gz: 43c8d9ee1f0344de72f0b6bffa181d0df12475c9f10c5ee6d80f92e9bd192a05
 SHA512:
-  metadata.gz: 0ccefce8b78a9ad7ef3213738a6266b544241c18e99ce645aa0de0bb1f6067f5bda79f793ee048757c4763cd1f990779649bc86c3d506849c5e3d7cfc19a0290
-  data.tar.gz: 6fb74b23e6fdf75e2191d7eecc76a45969aac95f6d5dd8383572b563299c15b1013dd2199c2816189248713452f0043c861c74cf9e14d33504357226a3b1f1e7
+  metadata.gz: b8a3c50ad2b135eef0d4ecea3d979b21f1b223a54966114544f08aa1ce78fad0d25779e28f365c8ff57c87ae1ec03836ab1290624e11d0de3c0dbc862324d884
+  data.tar.gz: c335087baa92503937ed273d6a5528bac1310ac2636a7e529e7f9619e4414b6ce64245142760899544327b4e8138fdbaebde31205e8f7cbd44ed91aa68bfa250

data/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-22
+
+### Changed
+
+- **The mock-mode guard follows `APP_ENVIRONMENT`, failing closed.** Without a
+  `production_env_detector`, "production deploy" is now `APP_ENVIRONMENT` when it
+  is set (only `staging`, `preview`, `development` and `test` are non-production;
+  any other value is production), else `Rails.env.production?` as before. A
+  staging box with `RAILS_ENV=production` and `APP_ENVIRONMENT=staging` boots
+  with mock mode on (reported as production-like) without detector wiring. The
+  same convention as standard_id, standard_audit and standard_health. A
+  configured detector still wins, so existing hosts are unaffected.
+- **Requires Rails 8.1** (`rails >= 8.1, < 9`, was `>= 8.0`). Every consumer
+  app runs 8.1; 8.0 was never exercised in CI.
+
+## [0.5.0] - 2026-09-24
+
+**Breaking.** Removes everything 0.4.0 deprecated. No other behaviour changes.
+
+### Removed
+
+- **`StandardSingpass::Myinfo::Security::DecryptionError` / `Security::ValidationError`.** These were aliases of `StandardSingpass::Myinfo::DecryptionError` / `SignatureError`, which `Security` has raised directly since 0.4.0. Referencing the old names now raises `NameError`. Rescue `DecryptionError` / `SignatureError`, or the `StandardSingpass::Myinfo::Error` base.
+- **`StandardSingpass::Myinfo::EcdhJwe.encrypt`**, the forwarder. Use `require "standard_singpass/testing"` and `StandardSingpass::Testing::EcdhJwe.encrypt` (same signature). `EcdhJwe.decrypt` is unchanged.
+- **`StandardSingpass::Myinfo::TestPersonas.reload!`**. Personas are read once per process. Restart, or point `personas_path` at a different file.
+
+### Changed
+
+- `StandardSingpass.deprecator`'s horizon is now `0.6`.
+
+### Upgrade notes
+
+- **No code change required in the one consumer, fundbright-web.** Grepped `origin/main` on 2026-09-24: no reference to `Security::DecryptionError`, `Security::ValidationError`, `EcdhJwe.encrypt` or `TestPersonas.reload!`.
+- Regenerate the gem RBI when bumping (`bin/tapioca gem standard_singpass`). `sorbet/rbi/gems/standard_singpass@0.4.0.rbi` still declares the removed constants and methods.
+
 ## [0.4.0] - 2026-09-24
 
 ### Upgrading from 0.3.x

data/README.md

@@ -60,8 +60,9 @@ StandardSingpass::Myinfo.configure do |c|
   c.mock_mode = ENV["MYINFO_MOCK_MODE"].present?
 
   # Optional: how the gem decides whether this deploy is real production, for
-  # the mock-mode guard. Defaults to Rails.env.production?.
-  # c.production_env_detector = -> { AppEnv.production? }
+  # the mock-mode guard. Defaults to APP_ENVIRONMENT (failing closed), then
+  # Rails.env.production? — see "Mock mode" below.
+  # c.production_env_detector = -> { ... }
 end
 ```
 
@@ -115,21 +116,19 @@ opt-out — a guard you can forget to wire is a guard that isn't there.
 | Anything else | yes | Silent. |
 | Any | no | Silent. |
 
-By default "production" means `Rails.env.production?`. Staging and preview
-deploys routinely run `RAILS_ENV=production` while being entirely legitimate
-places to enable mock mode, so hosts that distinguish a physical deploy
-environment from `RAILS_ENV` should say so:
+"Production" follows the estate's `APP_ENVIRONMENT` convention (the same rule
+standard_id, standard_audit and standard_health use): when `APP_ENVIRONMENT` is
+set, only `staging`, `preview`, `development` and `test` are non-production and
+any other value (a typo included) is production, so a mis-set variable fails
+closed; when it is unset, `Rails.env.production?` decides. Staging and preview
+deploys routinely run `RAILS_ENV=production`, so with `APP_ENVIRONMENT=staging`
+they land in the production-like tier, where mock mode boots and is reported,
+with no extra wiring.
 
-```ruby
-# Mock mode stays legal on a physically-staging box, still refused on real prod.
-c.production_env_detector = -> { AppEnv.production? }
-```
-
-`production_env_detector` takes no arguments and returns a boolean; when `nil`
-(the default) the gem falls back to `Rails.env.production?`, so existing
-consumers are unaffected. The production-like tier reports through
-`Rails.error` rather than a specific error tracker, so whatever the host has
-subscribed (Sentry included) picks it up.
+`config.production_env_detector` (a callable taking no arguments, returning a
+boolean) overrides that, for a host with a different discriminator. The
+production-like tier reports through `Rails.error` rather than a specific error
+tracker, so whatever the host has subscribed (Sentry included) picks it up.
 
 ## Initiating the flow
 
@@ -215,7 +214,7 @@ All errors descend from `StandardSingpass::Myinfo::Error`, which in turn descend
 - `RateLimitError` — Singpass returned HTTP 429
 - `ConfigurationError` — gem is misconfigured (e.g. invalid ACR URN)
 
-`Security` raises `DecryptionError` / `SignatureError` directly. The pre-0.4.0 `Security::DecryptionError` / `Security::ValidationError` constants are deprecated aliases of those two classes.
+`Security` raises `DecryptionError` / `SignatureError` directly. The pre-0.4.0 `Security::DecryptionError` / `Security::ValidationError` aliases were removed in 0.5.0; rescue `DecryptionError` / `SignatureError` (or `StandardSingpass::Myinfo::Error`).
 
 `DecryptionError` and `SignatureError` usually indicate a key/cert misconfiguration rather than an upstream outage. **Usually, not always:** verifying a signature requires fetching Singpass's JWKS, so a JWKS host that is down surfaces as a `SignatureError` (or an `AuthenticationError` on the ID-token leg) too. Those carry the JWKS response's `status` / `transport?`, so ask `FailureClassifier` rather than deciding by class — including when choosing what to feed a circuit breaker.
 
@@ -301,7 +300,7 @@ bundle exec srb tc         # Sorbet typecheck — keep it green
   )
   ```
 
-  `standard_singpass/testing` is not loaded by `require "standard_singpass"`. The old `StandardSingpass::Myinfo::EcdhJwe.encrypt` still works but is deprecated.
+  `standard_singpass/testing` is not loaded by `require "standard_singpass"`. The old `StandardSingpass::Myinfo::EcdhJwe.encrypt` forwarder was removed in 0.5.0.
 - **Specs that mutate configuration** should call `StandardSingpass::Myinfo.reset_configuration!` afterwards.
 
 ## License

data/lib/standard_singpass/myinfo/ecdh_jwe.rb

@@ -41,31 +41,6 @@ module StandardSingpass
         "A256GCM" => 32
       }.freeze, T::Hash[String, Integer])
 
-      # Deprecated (0.4.0): encryption is only ever needed to build fixtures
-      # in tests — Singpass encrypts, we decrypt. It lives in
-      # `StandardSingpass::Testing::EcdhJwe` now (`require
-      # "standard_singpass/testing"`); this forwarder will be removed in a
-      # future minor release.
-      sig do
-        params(
-          payload: String,
-          public_key: OpenSSL::PKey::EC,
-          alg: String,
-          enc: String,
-          kid: T.nilable(String),
-          apu: T.nilable(String),
-          apv: T.nilable(String)
-        ).returns(String)
-      end
-      def self.encrypt(payload, public_key:, alg:, enc:, kid: nil, apu: nil, apv: nil)
-        StandardSingpass.deprecator.warn(
-          "StandardSingpass::Myinfo::EcdhJwe.encrypt is deprecated and will be removed; " \
-          "require \"standard_singpass/testing\" and use StandardSingpass::Testing::EcdhJwe.encrypt instead."
-        )
-        require "standard_singpass/testing"
-        StandardSingpass::Testing::EcdhJwe.encrypt(payload, public_key:, alg:, enc:, kid:, apu:, apv:)
-      end
-
       # Decrypts a compact-serialized JWE string.
       sig { params(jwe_string: String, private_key: OpenSSL::PKey::EC).returns(String) }
       def self.decrypt(jwe_string, private_key:)

data/lib/standard_singpass/myinfo/mock_mode_guard.rb

@@ -27,10 +27,13 @@ module StandardSingpass
     # loud-but-non-fatal signal instead.
     #
     # "Production deploy" is decided by `config.production_env_detector` when
-    # set, falling back to `Rails.env.production?`. The gem cannot know about
-    # a host's own environment discriminator (`APP_ENVIRONMENT` and friends),
-    # and deliberately does not read ENV itself — the callable is the seam.
-    # This mirrors `StandardId`'s `production_env_detector`.
+    # set, else by the estate's APP_ENVIRONMENT convention (shared with
+    # standard_id, standard_audit and standard_health): APP_ENVIRONMENT when it
+    # is set, where only staging, preview, development and test are
+    # non-production and any other value (a typo included) is production, so a
+    # mis-set variable fails closed; else `Rails.env.production?`. A staging box
+    # with RAILS_ENV=production and APP_ENVIRONMENT=staging is therefore
+    # production-*like*, not production, with no detector wiring.
     #
     # Wired automatically from the engine's `after_initialize`, so a host gets
     # the guard by configuring `mock_mode` at all. There is no opt-out: a
@@ -38,6 +41,9 @@ module StandardSingpass
     module MockModeGuard
       extend T::Sig
 
+      # APP_ENVIRONMENT values that are not production; anything else is.
+      NON_PRODUCTION_APP_ENVIRONMENTS = T.let(%w[staging preview development test].freeze, T::Array[String])
+
       sig { void }
       def self.check!
         return unless StandardSingpass::Myinfo.configuration.mock_mode
@@ -50,14 +56,16 @@ module StandardSingpass
       end
 
       # Whether this deploy is real production for the purpose of the guard.
-      # Defers to config.production_env_detector when set (hosts that
-      # distinguish a physical deploy environment from RAILS_ENV), else falls
-      # back to Rails.env.production?.
+      # Defers to config.production_env_detector when set, else to
+      # APP_ENVIRONMENT (failing closed), else Rails.env.production?.
       sig { returns(T::Boolean) }
       def self.production_deploy?
         detector = StandardSingpass::Myinfo.configuration.production_env_detector
         return !!detector.call if detector
 
+        app_env = ENV["APP_ENVIRONMENT"].to_s.strip
+        return !NON_PRODUCTION_APP_ENVIRONMENTS.include?(app_env) unless app_env.empty?
+
         rails_production?
       end
 
@@ -75,7 +83,8 @@ module StandardSingpass
           "identity data that is indistinguishable from verified Myinfo " \
           "data downstream. The application refuses to boot. Unset the " \
           "mock-mode environment variable on this deploy and redeploy. If " \
-          "this deploy is not actually production, set " \
+          "this deploy is not actually production, set APP_ENVIRONMENT " \
+          "(staging, preview, development or test) or " \
           "config.production_env_detector so the gem can tell."
       end
       private_class_method :production_message

data/lib/standard_singpass/myinfo/security.rb

@@ -5,21 +5,6 @@ module StandardSingpass
     class Security
       extend T::Sig
 
-      # Deprecated aliases (0.4.0). Security used to raise its own
-      # DecryptionError / ValidationError, which the client then translated
-      # into the public Myinfo errors. It now raises the public errors
-      # directly: JWE failures raise `Myinfo::DecryptionError`, JWS / JWKS
-      # failures raise `Myinfo::SignatureError` (carrying the JWKS response's
-      # `status`, or `transport?` when the JWKS host was unreachable, so an
-      # outage stays distinguishable from a genuinely bad signature).
-      #
-      # The old names still resolve — to the same classes, so an existing
-      # `rescue Security::ValidationError` keeps catching — and will be
-      # removed in a future minor release.
-      DecryptionError = Myinfo::DecryptionError
-      ValidationError = Myinfo::SignatureError
-      deprecate_constant :DecryptionError, :ValidationError
-
       JWKS_CACHE_TTL = T.let(1.hour, ActiveSupport::Duration)
 
       # Generates a PKCE code verifier and code challenge pair (S256).

data/lib/standard_singpass/myinfo/test_personas.rb

@@ -31,18 +31,6 @@ module StandardSingpass
         @data ||= JSON.parse(fixture_path.read).freeze
       end
 
-      # Deprecated (0.4.0) — unused by any consumer, and will be removed in a
-      # future minor release. Personas are read once per process; restart the
-      # process (or point `personas_path` at a different file) to pick up
-      # edits.
-      def self.reload!
-        StandardSingpass.deprecator.warn(
-          "StandardSingpass::Myinfo::TestPersonas.reload! is deprecated and will be removed."
-        )
-        @data = nil
-        data
-      end
-
       def self.fixture_path
         configured = StandardSingpass::Myinfo.configuration.personas_path
         configured ? Pathname.new(configured) : GEM_FIXTURE_PATH

data/lib/standard_singpass/version.rb

@@ -1,3 +1,3 @@
 module StandardSingpass
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/standard_singpass.rb

@@ -25,7 +25,7 @@ module StandardSingpass
     # with the host's `Rails.application.deprecators` by the engine, so the
     # host's deprecation behaviour (log / raise / silence) applies.
     def deprecator
-      @deprecator ||= ActiveSupport::Deprecation.new("0.5", "StandardSingpass")
+      @deprecator ||= ActiveSupport::Deprecation.new("0.6", "StandardSingpass")
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_singpass
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9'