🐛 Support standalone auth-sanitizer loading

Author: pboling

CHANGELOG.md

@@ -28,6 +28,10 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Fixed
 
+- Fixed isolated `auth-sanitizer` loading when Bundler standalone setup makes
+  `auth_sanitizer/loader.rb` available on `$LOAD_PATH` without adding
+  `auth-sanitizer` to `Gem.loaded_specs` or `GEM_PATH`.
+
 ### Security
 
 ## [2.0.23] - 2026-06-13

lib/oauth2/auth_sanitizer.rb

@@ -6,18 +6,35 @@ module OAuth2
     auth_sanitizer_spec = Gem.loaded_specs["auth-sanitizer"]
     unless auth_sanitizer_spec && auth_sanitizer_requirement.satisfied_by?(auth_sanitizer_spec.version)
       # :nocov:
-      auth_sanitizer_spec = Gem::Specification.find_by_name("auth-sanitizer", auth_sanitizer_requirement)
+      begin
+        auth_sanitizer_spec = Gem::Specification.find_by_name("auth-sanitizer", auth_sanitizer_requirement)
+      rescue Gem::MissingSpecError
+        auth_sanitizer_spec = nil
+      end
       # :nocov:
     end
 
-    auth_sanitizer_loader_path = File.join(
-      auth_sanitizer_spec.full_gem_path,
-      "lib/auth_sanitizer/loader.rb"
-    )
-    unless File.file?(auth_sanitizer_loader_path)
+    auth_sanitizer_loader_path = if auth_sanitizer_spec
+      File.join(auth_sanitizer_spec.full_gem_path, "lib/auth_sanitizer/loader.rb")
+    end
+    unless auth_sanitizer_loader_path && File.file?(auth_sanitizer_loader_path)
+      auth_sanitizer_loader_path = Gem.find_files("auth_sanitizer/loader.rb").find do |path|
+        version_path = File.expand_path("../auth/sanitizer/version.rb", File.dirname(path))
+        next false unless File.file?(version_path)
+
+        version_source = File.read(version_path)
+        # Gem.find_files resolves loaders from $LOAD_PATH without exposing gemspec
+        # metadata, so validate the adjacent version file before evaluating the
+        # loader. This is intentionally limited to auth-sanitizer's VERSION file.
+        version_match = version_source.match(/VERSION\s*=\s*(["'])([^"']+)\1/)
+        version_match && auth_sanitizer_requirement.satisfied_by?(Gem::Version.new(version_match[2]))
+      end
+    end
+
+    unless auth_sanitizer_loader_path && File.file?(auth_sanitizer_loader_path)
       # :nocov:
       raise LoadError, "oauth2 requires auth-sanitizer #{auth_sanitizer_requirement}; " \
-        "loader not found at #{auth_sanitizer_loader_path}"
+        "loader not found in installed gems or on $LOAD_PATH"
       # :nocov:
     end
 

spec/oauth2/auth_sanitizer_spec.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require "open3"
+require "rbconfig"
+
 RSpec.describe "OAuth2::AUTH_SANITIZER" do
   it "keeps auth-sanitizer constants isolated inside the OAuth2 namespace" do
     expect(Object.const_defined?(:Auth, false)).to be(false)
@@ -9,4 +12,53 @@
   it "preserves the public OAuth2::FilteredAttributes alias" do
     expect(OAuth2::FilteredAttributes).to be(OAuth2::AUTH_SANITIZER::FilteredAttributes)
   end
+
+  it "loads when auth-sanitizer is only available on the load path, not GEM_PATH" do
+    oauth2_lib = File.expand_path("../../lib", __dir__)
+    auth_sanitizer_lib = File.join(Gem.loaded_specs.fetch("auth-sanitizer").full_gem_path, "lib")
+    script = <<~'RUBY'
+      require "rubygems"
+
+      Gem.loaded_specs.delete("auth-sanitizer")
+
+      class << Gem::Specification
+        alias_method :oauth2_original_find_by_name, :find_by_name
+
+        def find_by_name(name, *requirements)
+          raise Gem::MissingSpecError.new(name, requirements) if name == "auth-sanitizer"
+
+          oauth2_original_find_by_name(name, *requirements)
+        end
+      end
+
+      require "oauth2/auth_sanitizer"
+      abort("OAuth2::AUTH_SANITIZER was not loaded") unless OAuth2.const_defined?(:AUTH_SANITIZER, false)
+    RUBY
+
+    stdout, stderr, status = Open3.capture3(
+      {
+        "BUNDLE_GEMFILE" => nil,
+        "BUNDLER_VERSION" => nil,
+        "RUBYLIB" => nil,
+        "RUBYOPT" => nil,
+      },
+      RbConfig.ruby,
+      "-I",
+      oauth2_lib,
+      "-I",
+      auth_sanitizer_lib,
+      "-e",
+      script
+    )
+
+    expect(status).to be_success, <<~MSG
+      expected oauth2/auth_sanitizer to load with auth-sanitizer only on $LOAD_PATH
+
+      stdout:
+      #{stdout}
+
+      stderr:
+      #{stderr}
+    MSG
+  end
 end