standard_singpass 0.5.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a27b57ad2ae40ae92c93b8328f2fe0849d22bc95ecc1812bb1f6899f2eb36e1
-  data.tar.gz: 3d8c189d90e1cd51db83b73f7bee5fe78d4f856b90721707a12befd8af8c37e6
+  metadata.gz: 35e2fb1210199ace98e5db77de85e6a3650ee9297bffd8f8a0f2d16f743cba8e
+  data.tar.gz: 594ff25cfe621eb103dc397889b91a21cb49316b23ba6b2e849d42f5046a5a33
 SHA512:
-  metadata.gz: eeca8fd0904977618487859b6aa207f4cd3394aa016943f1f6e177ee71404f9e95bdef1b68fb2a68b47d9463f5779871f5b0d8257f834fd403d954c81537816b
-  data.tar.gz: a321882ef3e389555bb2427262f863961c38dd30e2a265959cbc383bcad05de9f63b243b248115f40ca5adc5fd267f3f6a2a860a36a6d8e8cbe92c5bd6369b1f
+  metadata.gz: '008b3123acb642f298caf073931dfd5778645dea026cdd3baf99045d4cb46caa74834d77cee80861042dee89d8a454d58717f39c20dc3bd2746c319716157726'
+  data.tar.gz: d93185d6bb749e2413d8181f35b6383863fa95afe78642c4d6548b92bcf7f441fc8d9a0ba0a440e6f7c954883ffc4736b2684025e68b6cf4dceaae37c65882ac

data/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-10-25
+
+### Changed
+
+- **`get_person_data` now requires a `nonce` by default.** Passing `nonce: nil` (or omitting it) raises
+  `StandardSingpass::Myinfo::ConfigurationError` with a clear message. The nonce binds the id_token to
+  the session and prevents replay attacks; PKCE + DPoP substantially raise the bar but do not fully close
+  the replay window without it. The only consumer, `fundbright-web`, already passes the nonce from the
+  session on every call, so it is unaffected. To opt out for flows where no nonce was included in the PAR
+  request, pass `skip_nonce_validation: true` — this is intentionally verbose so it stands out in review.
+
+## [0.6.0] - 2026-10-22
+
+### Changed
+
+- **The mock-mode guard follows `APP_ENVIRONMENT`, failing closed.** Without a
+  `production_env_detector`, "production deploy" is now `APP_ENVIRONMENT` when it
+  is set (only `staging`, `preview`, `development` and `test` are non-production;
+  any other value is production), else `Rails.env.production?` as before. A
+  staging box with `RAILS_ENV=production` and `APP_ENVIRONMENT=staging` boots
+  with mock mode on (reported as production-like) without detector wiring. The
+  same convention as standard_id, standard_audit and standard_health. A
+  configured detector still wins, so existing hosts are unaffected.
+- **Requires Rails 8.1** (`rails >= 8.1, < 9`, was `>= 8.0`). Every consumer
+  app runs 8.1; 8.0 was never exercised in CI.
+
 ## [0.5.0] - 2026-09-24
 
 **Breaking.** Removes everything 0.4.0 deprecated. No other behaviour changes.

data/README.md

@@ -60,8 +60,9 @@ StandardSingpass::Myinfo.configure do |c|
   c.mock_mode = ENV["MYINFO_MOCK_MODE"].present?
 
   # Optional: how the gem decides whether this deploy is real production, for
-  # the mock-mode guard. Defaults to Rails.env.production?.
-  # c.production_env_detector = -> { AppEnv.production? }
+  # the mock-mode guard. Defaults to APP_ENVIRONMENT (failing closed), then
+  # Rails.env.production? — see "Mock mode" below.
+  # c.production_env_detector = -> { ... }
 end
 ```
 
@@ -115,21 +116,19 @@ opt-out — a guard you can forget to wire is a guard that isn't there.
 | Anything else | yes | Silent. |
 | Any | no | Silent. |
 
-By default "production" means `Rails.env.production?`. Staging and preview
-deploys routinely run `RAILS_ENV=production` while being entirely legitimate
-places to enable mock mode, so hosts that distinguish a physical deploy
-environment from `RAILS_ENV` should say so:
-
-```ruby
-# Mock mode stays legal on a physically-staging box, still refused on real prod.
-c.production_env_detector = -> { AppEnv.production? }
-```
-
-`production_env_detector` takes no arguments and returns a boolean; when `nil`
-(the default) the gem falls back to `Rails.env.production?`, so existing
-consumers are unaffected. The production-like tier reports through
-`Rails.error` rather than a specific error tracker, so whatever the host has
-subscribed (Sentry included) picks it up.
+"Production" follows the estate's `APP_ENVIRONMENT` convention (the same rule
+standard_id, standard_audit and standard_health use): when `APP_ENVIRONMENT` is
+set, only `staging`, `preview`, `development` and `test` are non-production and
+any other value (a typo included) is production, so a mis-set variable fails
+closed; when it is unset, `Rails.env.production?` decides. Staging and preview
+deploys routinely run `RAILS_ENV=production`, so with `APP_ENVIRONMENT=staging`
+they land in the production-like tier, where mock mode boots and is reported,
+with no extra wiring.
+
+`config.production_env_detector` (a callable taking no arguments, returning a
+boolean) overrides that, for a host with a different discriminator. The
+production-like tier reports through `Rails.error` rather than a specific error
+tracker, so whatever the host has subscribed (Sentry included) picks it up.
 
 ## Initiating the flow
 

data/lib/standard_singpass/myinfo/client.rb

@@ -101,10 +101,19 @@ module StandardSingpass
         "#{@authorize_url}?#{URI.encode_www_form(params)}"
       end
 
-      sig { params(auth_code: String, code_verifier: String, dpop_key_pair: OpenSSL::PKey::EC, nonce: T.nilable(String)).returns(T::Hash[Symbol, T.untyped]) }
-      def get_person_data(auth_code:, code_verifier:, dpop_key_pair:, nonce: nil)
+      sig { params(auth_code: String, code_verifier: String, dpop_key_pair: OpenSSL::PKey::EC, nonce: T.nilable(String), skip_nonce_validation: T::Boolean).returns(T::Hash[Symbol, T.untyped]) }
+      def get_person_data(auth_code:, code_verifier:, dpop_key_pair:, nonce: nil, skip_nonce_validation: false)
+        unless skip_nonce_validation
+          if nonce.blank?
+            raise ConfigurationError,
+              "nonce is required for id_token replay protection. " \
+              "Pass the nonce you sent in the PAR request. " \
+              "Only pass skip_nonce_validation: true for flows where no nonce was sent in the PAR request."
+          end
+        end
+
         token_data = exchange_token(auth_code:, code_verifier:, dpop_key_pair:)
-        id_token_payload = validate_id_token(token_data[:id_token], nonce:)
+        id_token_payload = validate_id_token(token_data[:id_token], nonce: skip_nonce_validation ? nil : nonce)
 
         person_data = fetch_userinfo(access_token: token_data[:access_token], dpop_key_pair:)
 

data/lib/standard_singpass/myinfo/mock_mode_guard.rb

@@ -27,10 +27,13 @@ module StandardSingpass
     # loud-but-non-fatal signal instead.
     #
     # "Production deploy" is decided by `config.production_env_detector` when
-    # set, falling back to `Rails.env.production?`. The gem cannot know about
-    # a host's own environment discriminator (`APP_ENVIRONMENT` and friends),
-    # and deliberately does not read ENV itself — the callable is the seam.
-    # This mirrors `StandardId`'s `production_env_detector`.
+    # set, else by the estate's APP_ENVIRONMENT convention (shared with
+    # standard_id, standard_audit and standard_health): APP_ENVIRONMENT when it
+    # is set, where only staging, preview, development and test are
+    # non-production and any other value (a typo included) is production, so a
+    # mis-set variable fails closed; else `Rails.env.production?`. A staging box
+    # with RAILS_ENV=production and APP_ENVIRONMENT=staging is therefore
+    # production-*like*, not production, with no detector wiring.
     #
     # Wired automatically from the engine's `after_initialize`, so a host gets
     # the guard by configuring `mock_mode` at all. There is no opt-out: a
@@ -38,6 +41,9 @@ module StandardSingpass
     module MockModeGuard
       extend T::Sig
 
+      # APP_ENVIRONMENT values that are not production; anything else is.
+      NON_PRODUCTION_APP_ENVIRONMENTS = T.let(%w[staging preview development test].freeze, T::Array[String])
+
       sig { void }
       def self.check!
         return unless StandardSingpass::Myinfo.configuration.mock_mode
@@ -50,14 +56,16 @@ module StandardSingpass
       end
 
       # Whether this deploy is real production for the purpose of the guard.
-      # Defers to config.production_env_detector when set (hosts that
-      # distinguish a physical deploy environment from RAILS_ENV), else falls
-      # back to Rails.env.production?.
+      # Defers to config.production_env_detector when set, else to
+      # APP_ENVIRONMENT (failing closed), else Rails.env.production?.
       sig { returns(T::Boolean) }
       def self.production_deploy?
         detector = StandardSingpass::Myinfo.configuration.production_env_detector
         return !!detector.call if detector
 
+        app_env = ENV["APP_ENVIRONMENT"].to_s.strip
+        return !NON_PRODUCTION_APP_ENVIRONMENTS.include?(app_env) unless app_env.empty?
+
         rails_production?
       end
 
@@ -75,7 +83,8 @@ module StandardSingpass
           "identity data that is indistinguishable from verified Myinfo " \
           "data downstream. The application refuses to boot. Unset the " \
           "mock-mode environment variable on this deploy and redeploy. If " \
-          "this deploy is not actually production, set " \
+          "this deploy is not actually production, set APP_ENVIRONMENT " \
+          "(staging, preview, development or test) or " \
           "config.production_env_detector so the gem can tell."
       end
       private_class_method :production_message

data/lib/standard_singpass/version.rb

@@ -1,3 +1,3 @@
 module StandardSingpass
-  VERSION = "0.5.0"
+  VERSION = "0.7.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_singpass
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9'