Releases · activeadmin-plugins/activeadmin-oidc

What's Changed

on_login fires only once on a race. When two first sign-ins for the same (provider, uid) happen concurrently, the loser hits RecordNotUnique and the provisioner retries. The
retry path used to re-run on_login on the now-persisted winner row — so any non-idempotent host side effects (audit log row, webhook, welcome email, billing call) double-fired. The
retry now short-circuits after finding the winner, so the hook runs exactly once.
Disabled users are no longer persisted before being rejected. If a host's on_login flips enabled = false (or any other Devise inactivity flag) and returns truthy, the provisioner
now enforces active_for_authentication? BEFORE save!. Previously the row was written and only the controller rejected the sign-in — repeated hostile attempts grew the table.
Account adoption via unverified email refused. A pre-seeded admin row with provider: nil, uid: nil (e.g. DBA-created ceo@example.com from before SSO) could be claimed by anyone
the IdP said owned that email — including IdPs that don't verify email ownership (guest tenants, lax Keycloak realms). The provisioner now refuses adoption when the IdP explicitly
marks the email as email_verified: false. IdPs that don't emit the claim keep the previous behaviour.

ActiveAdmin::Oidc::InactiveError — raised by the provisioner when active_for_authentication? returns false. Carries the model's inactive_message symbol so the controller can
translate it via I18n.t("devise.failure.") instead of showing the generic denial flash. Falls back to :inactive if the host returns nil/blank, and to the standard
devise.failure.inactive translation if a custom symbol has no translation (so internal state like :locked_by_admin never leaks to the public flash).

SSO login form action no longer hardcoded. The login view sourced its form action from a literal /admin/auth/oidc, breaking hosts that customised Devise.omniauth_path_prefix
(different mount point, different SSO sub-prefix). Both the live view (AA v3 form_tag and AA v4 button_to branches) and the install generator templates now derive the path from
OmniAuth.config.path_prefix, which is the Rack-level value where OmniAuth actually listens.
OmniAuth failure handler now resolves the right session path under engine-mounted Devise. When the host pins helpers via the global Devise.router_name = :engine (no per-mapping
option), Devise.mappings[scope].router_name is nil. The handler now falls back to Devise.available_router_name so it finds the engine's route proxy instead of raising NoMethodError
on the controller itself.
AA v3 login button restored as so it picks up the standard ActiveAdmin theme styling without extra CSS.

Full Changelog: v2.0.0...v2.1.0