Filter OIDC token params at any depth again

A nested id_token or refresh_token is always a secret, so only the generic callback names (code, state, session_state, nonce) need the top-level limit that keeps host attributes like data.attributes.state visible.

Co-Authored-By: Clanker

Author: senid231

CHANGELOG.md

@@ -2,4 +2,4 @@
 
 ## Unreleased
 
-- Fix: the OIDC `filter_parameters` entry now matches only the exact top-level keys `code`, `code_verifier`, `state`, `session_state`, `nonce`, `id_token`, `access_token` and `refresh_token`, so host params such as `code_id`, `state_eq` or `order[state]` are no longer filtered from logs. If you relied on the old substring match to hide params like `invite_code` or `reset_code`, add them to your own `filter_parameters`.
+- Fix: the OIDC `filter_parameters` entries now match exact keys instead of substrings. `code_verifier`, `id_token`, `access_token` and `refresh_token` are filtered at any depth; `code`, `state`, `session_state` and `nonce` only at the top level. Host params such as `code_id`, `state_eq` or `order[state]` are no longer filtered from logs. If you relied on the old substring match to hide params like `invite_code` or `reset_code`, add them to your own `filter_parameters`.

README.md

@@ -83,7 +83,7 @@ The gem's Rails engine handles several things so host apps don't have to:
 * **Login view override** — the engine prepends an SSO-only login page (no email/password fields) to the sessions controller's view path. If your host app ships its own `app/views/active_admin/devise/sessions/new.html.erb`, the gem detects it and backs off — your view wins.
 * **Session routes** — the engine mounts `GET /admin/login` (renders the SSO landing page) and `DELETE /admin/logout` under `devise_scope`, with the scope name derived from `config.admin_user_class`. Devise normally generates session routes as a side effect of `:database_authenticatable`; without that module the route helpers would not exist and ActiveAdmin's login redirect would 404.
 * **Path prefix** — the engine registers the strategy with `path_prefix: '/admin/auth'` so the middleware intercepts requests under ActiveAdmin's mount point, and sets `Devise.omniauth_path_prefix` to the prefix Devise declares its routes with. Compatible with Rails 7.2+ and Rails 8's lazy route loading.
-* **Parameter filtering** — top-level `code`, `code_verifier`, `state`, `session_state`, `nonce`, `id_token`, `access_token` and `refresh_token` params are added to `Rails.application.config.filter_parameters`. Only those exact top-level keys are matched, so host params like `code_id`, `state_eq` or `order[state]` stay visible.
+* **Parameter filtering** — the OIDC keys are added to `Rails.application.config.filter_parameters` as exact-key matches. `code_verifier`, `id_token`, `access_token` and `refresh_token` are filtered at any depth. The generic `code`, `state`, `session_state` and `nonce` are filtered only as top-level params, where the callback sends them, so host params like `code_id`, `state_eq` or `order[state]` stay visible.
 
 ## Configuration
 
@@ -410,7 +410,7 @@ The gem also adds a unique `(provider, uid)` partial index in its own install mi
 
 ### What's filtered from logs
 
-The engine adds the top-level OIDC callback keys (`code`, `code_verifier`, `state`, `session_state`, `nonce`, `id_token`, `access_token`, `refresh_token`) to `Rails.application.config.filter_parameters`, so a mid-callback crash can't dump them into production logs. Only those exact top-level keys are matched: `code_id`, `state_eq` and nested params like `order[state]` are not filtered. Your own `filter_parameters` entries are preserved.
+The engine adds the OIDC keys to `Rails.application.config.filter_parameters`, so a mid-callback crash can't dump them into production logs. Keys are matched exactly. `code_verifier`, `id_token`, `access_token` and `refresh_token` are filtered at any depth; `code`, `state`, `session_state` and `nonce` only as top-level params. So `code_id`, `state_eq` and nested params like `order[state]` are not filtered. Your own `filter_parameters` entries are preserved.
 
 ## Logger
 

lib/activeadmin/oidc/engine.rb

@@ -137,9 +137,13 @@ def controllers
 
       initializer 'activeadmin_oidc.filter_parameters' do |app|
         # ActiveSupport::ParameterFilter matches a regexp containing "\." against the dotted
-        # full key (order.state), so this hides only top-level keys, where the IdP callback puts them.
-        oidc_params = %w[code code_verifier state session_state nonce id_token access_token refresh_token]
-        app.config.filter_parameters |= [/\A(?!.*\.)(?:#{Regexp.union(oidc_params).source})\z/i]
+        # full key (data.attributes.state), so the generic callback names stay visible when nested.
+        callback_params = %w[code state session_state nonce]
+        token_params = %w[code_verifier id_token access_token refresh_token]
+        app.config.filter_parameters |= [
+          /\A(?!.*\.)(?:#{Regexp.union(callback_params).source})\z/i,
+          /\A(?:#{Regexp.union(token_params).source})\z/i
+        ]
       end
 
       # The gem is OIDC-first: mount our SSO landing page at /admin/login

spec/security_spec.rb

@@ -14,17 +14,22 @@
     # dump the whole params hash (including `code`, `id_token`,
     # `access_token`, `refresh_token`) straight into production logs.
     let(:oidc_keys) { %w[code code_verifier state session_state nonce id_token access_token refresh_token] }
-    let(:host_params) { { "code_id" => "1", "state_eq" => "2", "order" => { "state" => "shipped", "code" => "X" } } }
+    let(:host_params) do
+      { "code_id" => "1", "state_eq" => "2", "data" => { "attributes" => { "state" => "shipped", "code" => "X" } } }
+    end
+    let(:nested_tokens) { %w[code_verifier id_token access_token refresh_token] }
 
     [
       ["raw", ->(filters) { filters }],
       ["precompiled", ->(filters) { ActiveSupport::ParameterFilter.precompile_filters(filters) }]
     ].each do |form, compile|
-      it "filters the top-level OIDC keys and leaves host params visible (#{form} filters)" do
+      it "filters OIDC keys and nested tokens, and leaves host params visible (#{form} filters)" do
         filter = ActiveSupport::ParameterFilter.new(compile.call(Rails.application.config.filter_parameters))
-        result = filter.filter(oidc_keys.index_with("secret").merge(host_params))
+        params = oidc_keys.index_with("secret").merge(host_params, "auth" => nested_tokens.index_with("secret"))
+        result = filter.filter(params)
 
-        expect(result).to eq(oidc_keys.index_with("[FILTERED]").merge(host_params))
+        expect(result).to eq(oidc_keys.index_with("[FILTERED]")
+                               .merge(host_params, "auth" => nested_tokens.index_with("[FILTERED]")))
       end
     end
   end