edgeway 0.1.0

data/lib/edgeway/db/sqlite.rb

@@ -0,0 +1,190 @@
+# SQLite through Spinel's FFI (libsqlite3). Only Spinel builds load this file:
+# ffi_lib is Spinel's, so CRuby can't read it (like service/cloudflare/d1; the
+# CRuby tests use edgeway/db/memory). Needs libsqlite3 (libsqlite3-dev on
+# Debian/Ubuntu) at link time.
+require "json"
+require_relative "adapter"
+
+module Edgeway
+  module DB
+    module SQLiteFFI
+      ffi_lib "sqlite3"
+
+      ffi_const :OK,   0
+      ffi_const :ROW,  100
+      ffi_const :DONE, 101
+
+      ffi_func :sqlite3_open,            [:str, :ptr],                      :int
+      ffi_func :sqlite3_close,           [:ptr],                            :int
+      ffi_func :sqlite3_exec,            [:ptr, :str, :ptr, :ptr, :ptr],    :int
+      ffi_func :sqlite3_prepare_v2,      [:ptr, :str, :int, :ptr, :ptr],    :int
+      ffi_func :sqlite3_bind_text,       [:ptr, :int, :str, :int, :ptr],    :int
+      ffi_func :sqlite3_bind_int64,      [:ptr, :int, :long],               :int
+      ffi_func :sqlite3_bind_double,     [:ptr, :int, :double],             :int
+      ffi_func :sqlite3_bind_null,       [:ptr, :int],                      :int
+      ffi_func :sqlite3_step,            [:ptr],                            :int
+      ffi_func :sqlite3_finalize,        [:ptr],                            :int
+      ffi_func :sqlite3_column_count,    [:ptr],                            :int
+      ffi_func :sqlite3_column_name,     [:ptr, :int],                      :str
+      ffi_func :sqlite3_column_type,     [:ptr, :int],                      :int
+      ffi_func :sqlite3_column_int64,    [:ptr, :int],                      :long
+      ffi_func :sqlite3_column_double,   [:ptr, :int],                      :double
+      ffi_func :sqlite3_column_text,     [:ptr, :int],                      :str
+      ffi_func :sqlite3_errmsg,          [:ptr],                            :str
+      ffi_func :sqlite3_last_insert_rowid, [:ptr],                          :long
+      ffi_func :sqlite3_changes,         [:ptr],                            :int
+      ffi_func :sqlite3_libversion_number, [],                              :int
+
+      ffi_buffer :db_out,   8
+      ffi_buffer :stmt_out, 8
+      ffi_read_ptr :read_ptr, 0
+    end
+
+    class SQLiteAdapter < Adapter
+      INTEGER = 1
+      FLOAT = 2
+      NULL = 5
+
+      attr_reader :log
+
+      def initialize(path = ":memory:")
+        @log = []
+        rc = SQLiteFFI.sqlite3_open(path, SQLiteFFI.db_out)
+        raise DatabaseError, "sqlite3_open failed: #{rc}" if rc != SQLiteFFI::OK
+        @db = SQLiteFFI.read_ptr(SQLiteFFI.db_out)
+        run_script("PRAGMA foreign_keys = ON")
+        @returning = SQLiteFFI.sqlite3_libversion_number >= 3035000
+      end
+
+      def close
+        SQLiteFFI.sqlite3_close(@db)
+      end
+
+      def supports_returning? = @returning
+
+      def select_all(sql, binds)
+        stmt = start(sql, binds)
+        rows = []
+        rc = SQLiteFFI.sqlite3_step(stmt)
+        while rc == SQLiteFFI::ROW
+          rows << read_row(stmt)
+          rc = SQLiteFFI.sqlite3_step(stmt)
+        end
+        finish(stmt, rc)
+        rows
+      end
+
+      def execute(sql, binds)
+        stmt = start(sql, binds)
+        rc = SQLiteFFI.sqlite3_step(stmt)
+        while rc == SQLiteFFI::ROW
+          rc = SQLiteFFI.sqlite3_step(stmt)
+        end
+        finish(stmt, rc)
+        { "changes" => SQLiteFFI.sqlite3_changes(@db), "last_insert_id" => SQLiteFFI.sqlite3_last_insert_rowid(@db) }
+      end
+
+      def batch(statements)
+        @log << "BATCH #{statements.size}"
+        run_script("BEGIN")
+        results = []
+        begin
+          statements.each { |s| results << execute(s[0], s[1]) }
+        rescue => e
+          run_script("ROLLBACK")
+          raise e
+        end
+        run_script("COMMIT")
+        results
+      end
+
+      # Runs SQL text of one or more statements (a schema or a migration).
+      def load_schema(sql_text)
+        @log << sql_text
+        run_script(sql_text)
+      end
+
+      # Applies dir/*.sql in file name order (db/migrations); the file names.
+      def apply_migrations(dir)
+        files = Dir.glob(File.join(dir, "*.sql")).sort
+        files.each { |f| load_schema(File.read(f)) }
+        files
+      end
+
+      private
+
+      def run_script(sql_text)
+        rc = SQLiteFFI.sqlite3_exec(@db, sql_text, nil, nil, nil)
+        fail_with(SQLiteFFI.sqlite3_errmsg(@db)) if rc != SQLiteFFI::OK
+      end
+
+      # A prepared statement with the binds set. On failure the statement is
+      # finalized before the error is raised.
+      def start(sql, binds)
+        @log << "#{sql} | #{JSON.generate(binds)}"
+        rc = SQLiteFFI.sqlite3_prepare_v2(@db, sql, -1, SQLiteFFI.stmt_out, nil)
+        if rc != SQLiteFFI::OK
+          message = SQLiteFFI.sqlite3_errmsg(@db)
+          fail_with(message)
+        end
+        stmt = SQLiteFFI.read_ptr(SQLiteFFI.stmt_out)
+        i = 0
+        while i < binds.size
+          rc = bind(stmt, i + 1, binds[i])
+          if rc != SQLiteFFI::OK
+            message = SQLiteFFI.sqlite3_errmsg(@db)
+            SQLiteFFI.sqlite3_finalize(stmt)
+            fail_with(message)
+          end
+          i += 1
+        end
+        stmt
+      end
+
+      def bind(stmt, n, value)
+        if value.nil?
+          SQLiteFFI.sqlite3_bind_null(stmt, n)
+        elsif value.is_a?(Integer)
+          SQLiteFFI.sqlite3_bind_int64(stmt, n, value)
+        elsif value.is_a?(Float)
+          SQLiteFFI.sqlite3_bind_double(stmt, n, value)
+        elsif value == true
+          SQLiteFFI.sqlite3_bind_int64(stmt, n, 1)
+        elsif value == false
+          SQLiteFFI.sqlite3_bind_int64(stmt, n, 0)
+        else
+          # -1: SQLITE_TRANSIENT, SQLite copies the text.
+          SQLiteFFI.sqlite3_bind_text(stmt, n, value.to_s, -1, -1)
+        end
+      end
+
+      # Finalizes the statement; raises if its last step failed.
+      def finish(stmt, rc)
+        message = rc == SQLiteFFI::DONE ? "" : SQLiteFFI.sqlite3_errmsg(@db)
+        SQLiteFFI.sqlite3_finalize(stmt)
+        fail_with(message) if rc != SQLiteFFI::DONE
+      end
+
+      def read_row(stmt)
+        row = {}
+        n = SQLiteFFI.sqlite3_column_count(stmt)
+        i = 0
+        while i < n
+          name = SQLiteFFI.sqlite3_column_name(stmt, i)
+          type = SQLiteFFI.sqlite3_column_type(stmt, i)
+          if type == NULL
+            row[name] = nil
+          elsif type == INTEGER
+            row[name] = SQLiteFFI.sqlite3_column_int64(stmt, i)
+          elsif type == FLOAT
+            row[name] = SQLiteFFI.sqlite3_column_double(stmt, i)
+          else
+            row[name] = SQLiteFFI.sqlite3_column_text(stmt, i)
+          end
+          i += 1
+        end
+        row
+      end
+    end
+  end
+end

data/lib/edgeway/errors.rb

@@ -0,0 +1,61 @@
+module Edgeway
+  # The base of Edgeway's errors.
+  class Error < StandardError; end
+
+  # A request that can't be read (bad JSON, invalid UTF-8 in the query or a
+  # form body): 400.
+  class BadRequest < Error; end
+
+  # params.require(:x) found nothing: 400.
+  class ParameterMissing < BadRequest; end
+
+  # Unpermitted Parameters given to a model (Todo.create!(params) without
+  # permit): 500, with the details only in the log, since it is a bug in the
+  # app.
+  class ForbiddenAttributes < Error; end
+
+  # No route for the method and path: 404.
+  class RoutingError < Error; end
+
+  # The request has no credentials (no Authorization: Bearer token): 401 with
+  # "WWW-Authenticate: Bearer". The default answer has a fixed body; the
+  # message is for the log.
+  class Unauthorized < Error; end
+
+  # The token is not accepted (bad signature, expired, wrong issuer or
+  # audience...): 401 with "WWW-Authenticate: Bearer error=\"invalid_token\"".
+  # The message says why, for the log: the default answer has a fixed body
+  # ({"error":"invalid token"}) and the challenge no description.
+  class InvalidToken < Unauthorized; end
+
+  # A record that doesn't exist: 404.
+  class RecordNotFound < Error; end
+
+  # An unknown column or attribute named in a query: 400.
+  class UnknownColumn < BadRequest; end
+
+  # The app is set up wrongly (no database connection and so on): 500.
+  class ConfigurationError < Error; end
+
+  # A response header with a bad name or a CR/LF in its value: 500, with the
+  # details only in the log.
+  class InvalidHeader < Error; end
+
+  # A failure in the database adapter: 500.
+  class DatabaseError < Error; end
+
+  # A write the database refused for a UNIQUE (or PRIMARY KEY) constraint: 409
+  # with a fixed body. The message names the table and columns, so it goes to
+  # the log only.
+  class RecordNotUnique < DatabaseError; end
+
+  # A record that failed its validations: 422 with {"errors": [...]}.
+  class RecordInvalid < Error
+    attr_reader :errors
+
+    def initialize(errors)
+      @errors = errors
+      super("validation failed: #{errors.join(", ")}")
+    end
+  end
+end

data/lib/edgeway/generators/app/templates/.gitignore

@@ -0,0 +1,6 @@
+/build/
+/node_modules/
+/.wrangler/
+/tmp/
+/.dev.vars
+/.env*

data/lib/edgeway/generators/app/templates/Gemfile.tt

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+gem "edgeway"
+gem "spinel_test-unit", "~> 0.1", group: :test

data/lib/edgeway/generators/app/templates/README.md.tt

@@ -0,0 +1,22 @@
+# <%= @name %>
+
+An Edgeway app.
+
+```sh
+bin/setup                                     # mise, bundle, <%= PackageManager.name %> and the local D1 migrations, in one go
+
+# or step by step:
+mise install                                  # Spinel and the WASI SDK (mise.toml)
+bundle install
+<%= PackageManager.install %>
+bundle exec edgeway build                     # build/app.wasm (or bin/build)
+<%= PackageManager.exec %> wrangler d1 migrations apply <%= @name %>-db --local
+<%= PackageManager.exec %> wrangler dev                              # http://localhost:8787/health
+bundle exec edgeway routes
+```
+
+Without mise, set `SPINEL` to the Spinel compiler and `WASI_SDK` to the WASI SDK.
+
+Tests (`test/`) run with `bundle exec edgeway test [ARGS]`. Always use it rather than `spinel_test-unit` directly: it rewrites `tmp/test_app.rb` (git-ignored) from `app/` on every run, so new files are picked up. Each test gets a fresh in-memory SQLite database with `db/migrations/*.sql` applied, so running the tests requires SQLite (sqlite3): its development library has to be installed to link (`apt install libsqlite3-dev` on Debian/Ubuntu, `dnf install sqlite-devel` on Fedora; macOS has it).
+
+Model tests inherit `Edgeway::UnitTest` (a database, no requests), request tests `Edgeway::IntegrationTest` (a `UnitTest` that also has `get`, `post`, `json`, `assert_response`).

data/lib/edgeway/generators/app/templates/app/controllers/application_controller.rb

@@ -0,0 +1,9 @@
+class ApplicationController < Edgeway::Controller::Base
+  rescue_from Edgeway::RecordNotFound, with: :not_found
+
+  private
+
+  def not_found(e)
+    render json: { "error" => "not found" }, status: :not_found
+  end
+end

data/lib/edgeway/generators/app/templates/app/controllers/health_controller.rb

@@ -0,0 +1,3 @@
+class HealthController < ApplicationController
+  def show = render json: { "status" => "ok" }
+end

data/lib/edgeway/generators/app/templates/app/models/application_model.rb

@@ -0,0 +1,3 @@
+class ApplicationModel < Edgeway::Model::Base
+  extend Edgeway::Model::Macros
+end

data/lib/edgeway/generators/app/templates/bin/build.tt

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Compiles the app to build/app.wasm, like `bundle exec edgeway build`.
+# Arguments go to it (--env ENV).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+exec bundle exec edgeway build "$@"

data/lib/edgeway/generators/app/templates/bin/deploy.tt

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Builds the app, applies pending D1 migrations to the remote database, and
+# deploys it to Cloudflare. Needs a Cloudflare login and the D1 database's id
+# in wrangler.toml (see bin/setup). Arguments go to `wrangler deploy`.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+bin/build
+<%= PackageManager.exec %> wrangler d1 migrations apply <%= @name %>-db --remote
+<%= PackageManager.exec %> wrangler deploy "$@"

data/lib/edgeway/generators/app/templates/bin/setup.tt

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Sets up the app for development. Safe to run again.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# Spinel and the WASI SDK, from mise.toml. `edgeway test` also links libsqlite3
+# (libsqlite3-dev on Debian/Ubuntu; part of macOS).
+if command -v mise >/dev/null 2>&1; then
+  mise trust --quiet
+  mise install
+else
+  echo "bin/setup: mise is not installed (https://mise.jdx.dev/)." >&2
+  echo "Install Spinel and the WASI SDK yourself, and set SPINEL and WASI_SDK." >&2
+fi
+
+bundle install
+
+# wrangler, from package.json.
+if ! command -v <%= PackageManager.name %> >/dev/null 2>&1; then
+  echo "bin/setup: <%= PackageManager.name %> is not installed; install it to get wrangler." >&2
+  exit 1
+fi
+<%= PackageManager.install %>
+
+# The local D1 database `wrangler dev` uses.
+<%= PackageManager.exec %> wrangler d1 migrations apply <%= @name %>-db --local
+
+# Deploying needs a Cloudflare login and a D1 database; neither is required
+# for development, so only say what is missing.
+if ! <%= PackageManager.exec %> wrangler whoami 2>/dev/null | grep -qi "associated with the email"; then
+  echo
+  echo "To deploy, log in to Cloudflare: <%= PackageManager.exec %> wrangler login"
+  echo "Then create the database:        <%= PackageManager.exec %> wrangler d1 create <%= @name %>-db"
+  echo "and put its database_id in wrangler.toml."
+fi
+
+echo
+echo "Done. Next: bin/build && <%= PackageManager.exec %> wrangler dev"

data/lib/edgeway/generators/app/templates/config/database.yml

@@ -0,0 +1,14 @@
+# The database of each environment (edgeway build --env ENV), compiled into
+# the wasm. adapter: d1 uses the D1 binding named by binding:, which must
+# match a binding in wrangler.toml (wrangler.toml says which D1 database it
+# is); memory is for tests.
+development:
+  adapter: d1
+  binding: DB
+
+production:
+  adapter: d1
+  binding: DB
+
+test:
+  adapter: memory

data/lib/edgeway/generators/app/templates/config/routes.rb

@@ -0,0 +1,4 @@
+Edgeway.application.routes.draw do |r|
+  r.get "/health", to: "health#show"
+  r.root to: "health#show"
+end

data/lib/edgeway/generators/app/templates/mise.toml.tt

@@ -0,0 +1,24 @@
+# The tools `edgeway build` needs, and Node.js and <%= PackageManager.name %> for wrangler: `mise install`.
+
+[plugins]
+spinel = "https://github.com/y-yagi/mise-spinel"
+
+[tools]
+# Its bin/ (clang, ar, ...) must not shadow the system's compilers, so
+# bin_path points at a directory that doesn't exist and only WASI_SDK below
+# says where it is.
+"github:WebAssembly/wasi-sdk" = { version = "wasi-sdk-34", bin_path = "no-bin" }
+
+# A commit of matz/spinel (mise-spinel builds any git ref from source):
+# Edgeway needs fixes newer than the 2026.09.12 release. A commit rather than
+# master, so an install (and CI's cache of it) is the Spinel that was tested.
+# depends: the wasi-sdk is installed first, so the build also makes Spinel's
+# wasm32-wasi runtime (mise-spinel does when WASI_SDK, set below, is there).
+spinel = { version = "530ba2b17", depends = ["github:WebAssembly/wasi-sdk"] }
+
+# wrangler (package.json) runs on Node.js.
+node = "lts"
+<%= PackageManager.name %> = "latest"
+
+[env]
+WASI_SDK = { value = "{{ tools['github:WebAssembly/wasi-sdk'].path | default(value='') }}", tools = true }

data/lib/edgeway/generators/app/templates/package.json.tt

@@ -0,0 +1,7 @@
+{
+  "name": "<%= @name %>",
+  "private": true,
+  "devDependencies": {
+    "wrangler": "4.149.0"
+  }
+}

data/lib/edgeway/generators/app/templates/src/worker.js

@@ -0,0 +1,4 @@
+import app from "../build/app.wasm";
+import { createWorker } from "../build/edgeway/cloudflare.js";
+
+export default createWorker(app);

data/lib/edgeway/generators/app/templates/test/controllers/health_test.rb

@@ -0,0 +1,16 @@
+require "edgeway/test"
+require "test_helper"
+
+class HealthTest < Edgeway::IntegrationTest
+  def test_health
+    get "/health"
+    assert_response 200
+    assert_equal "ok", json["status"]
+  end
+
+  def test_root_is_the_health_check
+    get "/"
+    assert_response 200
+    assert_equal "ok", json["status"]
+  end
+end

data/lib/edgeway/generators/app/templates/test/test_helper.rb

@@ -0,0 +1 @@
+require "edgeway/test"

data/lib/edgeway/generators/app/templates/wrangler.toml.tt

@@ -0,0 +1,23 @@
+name = "<%= @name %>"
+main = "src/worker.js"
+compatibility_date = "2026-10-01"
+
+# CORS, for a frontend on another origin (see the README's "CORS"): the
+# origins allowed, comma-separated and compared exactly (no trailing slash).
+# Unset, CORS is off. CORS_HEADERS defaults to "Authorization, Content-Type",
+# CORS_MAX_AGE to 600. Variables are not inherited by an [env.*]: write them
+# again under [env.<name>.vars]. The app sees only the framework's settings
+# (JWT_*) and variables named APP_*, read with Edgeway.config("APP_NAME").
+# [vars]
+# CORS_ORIGINS = "http://localhost:3000, https://app.example"
+
+# Simulated locally by `wrangler dev`. Create tables with
+# `<%= PackageManager.exec %> wrangler d1 migrations apply <%= @name %>-db --local`.
+# database_id is a placeholder (all zeros): that is enough for --local and
+# `wrangler dev`, which ignore it. Before a deploy, create the database
+# (`<%= PackageManager.exec %> wrangler d1 create <%= @name %>-db`) and put the id it prints here.
+[[d1_databases]]
+binding = "DB"
+database_name = "<%= @name %>-db"
+database_id = "00000000-0000-0000-0000-000000000000"
+migrations_dir = "db/migrations"

data/lib/edgeway/http/auth/jwt.rb

@@ -0,0 +1,127 @@
+module Edgeway
+  module Auth
+    # Checks a token's signature and algorithm. verify answers JSON text:
+    #
+    #   {"header": {...}, "payload": {...}}   the token is genuine
+    #   {"error": "message"}                  it is not
+    #   {"error": "message", "unavailable": true}  it could not be checked
+    #                                         (a missing setting, no JWKS)
+    #
+    # The base answers "unavailable", for an app that set no verifier.
+    class Verifier
+      def verify(token)
+        JSON.generate({ "error" => "no JWT verifier is set", "unavailable" => true })
+      end
+    end
+
+    class JWT
+      # Seconds of clock skew allowed when JWT_LEEWAY is not set.
+      DEFAULT_LEEWAY = 5
+      # The most JWT_LEEWAY may be: a larger skew would keep expired tokens alive.
+      MAX_LEEWAY = 300
+
+      # The settings come from the Worker's variables: JWT_ISSUER and
+      # JWT_AUDIENCE (both required: decode fails closed when either is
+      # empty, see decode), JWT_LEEWAY (seconds of clock skew to allow,
+      # default DEFAULT_LEEWAY; "0" for none; a whole number of seconds, at
+      # most MAX_LEEWAY: anything else is a ConfigurationError).
+      def self.from_config
+        new(Auth.verifier, issuer: Edgeway.config("JWT_ISSUER"), audience: Edgeway.config("JWT_AUDIENCE"),
+            leeway: parse_leeway(Edgeway.config("JWT_LEEWAY", DEFAULT_LEEWAY.to_s)))
+      end
+
+      # JWT_LEEWAY as an Integer. Fails closed: a typo must not become 0 or
+      # a huge skew.
+      def self.parse_leeway(text)
+        unless text.match?(/\A[0-9]+\z/) && text.length <= 6 && text.to_i <= MAX_LEEWAY
+          raise ConfigurationError, "jwt: JWT_LEEWAY must be a whole number of seconds, 0 to #{MAX_LEEWAY}"
+        end
+        text.to_i
+      end
+
+      # now: the time as Unix seconds, for tests (0: the clock).
+      def initialize(verifier, issuer: "", audience: "", leeway: DEFAULT_LEEWAY, now: 0)
+        @verifier = verifier
+        @issuer = issuer
+        @audience = audience
+        @leeway = leeway
+        @now = now
+      end
+
+      # The token's claims (a Hash). Raises InvalidToken when the token is
+      # not genuine or a claim fails, ConfigurationError when it could not
+      # be checked. An empty issuer or audience is a misconfiguration (500,
+      # never a pass), found before the token is looked at, for every
+      # algorithm: without them a token from the same IdP for another API
+      # (or, for Firebase, another project) would be accepted.
+      def decode(token)
+        raise ConfigurationError, "jwt: JWT_ISSUER is not set" if @issuer.empty?
+        raise ConfigurationError, "jwt: JWT_AUDIENCE is not set" if @audience.empty?
+        unless @leeway.is_a?(Integer) && @leeway >= 0 && @leeway <= MAX_LEEWAY
+          raise ConfigurationError, "jwt: JWT_LEEWAY must be a whole number of seconds, 0 to #{MAX_LEEWAY}"
+        end
+        res = JSON.parse(@verifier.verify(token))
+        if res.key?("error")
+          raise ConfigurationError, "jwt: #{res["error"]}" if res.key?("unavailable")
+          raise InvalidToken, res["error"].to_s
+        end
+        claims = res["payload"]
+        check_claims(claims)
+        claims
+      end
+
+      private
+
+      def check_claims(claims)
+        now = (@now == 0 ? Time.now.to_i : @now).to_f
+        # A token that never expires is not accepted.
+        raise InvalidToken, "exp is missing" unless claims.key?("exp")
+        raise InvalidToken, "token expired" if now - @leeway >= number(claims, "exp")
+        raise InvalidToken, "token is not valid yet" if claims.key?("nbf") && now + @leeway < number(claims, "nbf")
+        raise InvalidToken, "token is issued in the future" if claims.key?("iat") && now + @leeway < number(claims, "iat")
+        # auth_time (OIDC) is optional; when there, the login must not be in the future.
+        raise InvalidToken, "authenticated in the future" if claims.key?("auth_time") && now + @leeway < number(claims, "auth_time")
+        raise InvalidToken, "iss is missing" unless claims.key?("iss")
+        raise InvalidToken, "issuer is not accepted" if claims["iss"] != @issuer
+        raise InvalidToken, "aud is missing" unless claims.key?("aud")
+        raise InvalidToken, "audience is not accepted" unless audience?(claims["aud"])
+        # Apps scope their data by sub, so a missing or empty one must not pass
+        # (a missing sub would match "user_id IS NULL", an empty one is shared).
+        raise InvalidToken, "sub is missing" unless claims.key?("sub")
+        raise InvalidToken, "sub is not a non-empty string" unless claims["sub"].is_a?(String) && !claims["sub"].empty?
+      end
+
+      # A time claim as a Float; anything else is a bad token. (JSON numbers
+      # parse as Integer or Float.)
+      def number(claims, name)
+        v = claims[name]
+        raise InvalidToken, "#{name} is not a number" unless v.is_a?(Integer) || v.is_a?(Float)
+        v.to_f
+      end
+
+      # aud is a string or an array of strings.
+      def audience?(aud)
+        if aud.is_a?(String)
+          aud == @audience
+        elsif aud.is_a?(Array)
+          aud.include?(@audience)
+        else
+          false
+        end
+      end
+    end
+
+    @verifier = Verifier.new
+
+    def self.verifier = @verifier
+
+    def self.verifier=(verifier)
+      @verifier = verifier
+    end
+
+    # The claims of a token, checked with the app's settings.
+    def self.decode(token)
+      JWT.from_config.decode(token)
+    end
+  end
+end

data/lib/edgeway/http/auth/stub.rb

@@ -0,0 +1,29 @@
+require_relative "jwt"
+
+module Edgeway
+  module Auth
+    class StubVerifier < Verifier
+      def initialize
+        @answers = {}
+      end
+
+      def allow(token, payload)
+        @answers[token] = JSON.generate({ "header" => { "alg" => "stub" }, "payload" => payload })
+      end
+
+      def reject(token, message)
+        # .dup: since matz/spinel 44119ab30 (Strings shared by reference),
+        # Spinel refuses this String as it is, or emits C that doesn't compile.
+        @answers[token] = JSON.generate({ "error" => message.dup })
+      end
+
+      def unavailable(token, message)
+        @answers[token] = JSON.generate({ "error" => message, "unavailable" => true })
+      end
+
+      def verify(token)
+        @answers[token] || JSON.generate({ "error" => "signature is not valid" })
+      end
+    end
+  end
+end

data/lib/edgeway/http/json_body.rb

@@ -0,0 +1,37 @@
+module Edgeway
+  module HTTP
+    class JSONBody
+      attr_reader :value, :params
+
+      def initialize(text)
+        @value = parse(text)
+        @params = {}
+        flatten if @value.is_a?(Hash)
+      end
+
+      private
+
+      def parse(text)
+        JSON.parse(text)
+      rescue JSON::ParserError
+        raise BadRequest, "bad JSON body"
+      end
+
+      def flatten
+        @value.each do |k, v|
+          if v.is_a?(Hash)
+            v.each do |k2, v2|
+              put("#{k}[#{k2}]", v2) unless v2.is_a?(Hash) || v2.is_a?(Array)
+            end
+          elsif !v.is_a?(Array)
+            put(k.to_s, v)
+          end
+        end
+      end
+
+      def put(key, value)
+        @params[key] = value.nil? ? "" : value.to_s
+      end
+    end
+  end
+end