has_helpers 5.0.2

data/spec/has_helpers/service_trust/client_spec.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::Client do
+  before do
+    clear_service_trust!
+    configure_service_trust(issuer: "app-a")
+    allow(HasHelpers::ServiceTrust::Audit).to receive(:record!)
+    allow(HasHelpers::ServiceTrust::Client::Retry).to receive(:sleep_for)
+    allow(HasHelpers::ServiceTrust::Signer).to receive(:bearer_header).and_return("Authorization" => "Bearer signed-token")
+  end
+
+  after { clear_service_trust! }
+
+  it "signs every request and parses JSON responses" do
+    http = double("http")
+    response = response("200", { ok: true }.to_json)
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    allow(http).to receive(:request).and_return(response)
+
+    result = described_class.new(audience: "app-b", base_url: "http://localhost:3000").post(
+      "/internal",
+      body: { hello: "world" },
+      capability: "cards:write"
+    )
+
+    expect(result).to be_success
+    expect(result.parsed).to eq("ok" => true)
+    expect(HasHelpers::ServiceTrust::Signer).to have_received(:bearer_header).with(audience: "app-b", capability: "cards:write")
+    expect(http).to have_received(:request).with(
+      satisfy do |request|
+        request["Authorization"] == "Bearer signed-token" && request.body == { hello: "world" }.to_json
+      end
+    )
+  end
+
+  it "retries retryable responses and returns the eventual success" do
+    http = double("http")
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    allow(http).to receive(:request).and_return(
+      response("503", "down"),
+      response("503", "down"),
+      response("200", { ok: true }.to_json)
+    )
+
+    result = described_class.new(audience: "app-b", base_url: "http://localhost:3000", retries: 3).get("/internal")
+
+    expect(result.status).to eq(200)
+    expect(http).to have_received(:request).exactly(3).times
+  end
+
+  it "never retries 4xx responses" do
+    http = double("http")
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    allow(http).to receive(:request).and_return(response("401", "no"))
+
+    expect do
+      described_class.new(audience: "app-b", base_url: "http://localhost:3000").get("/internal")
+    end.to raise_error(HasHelpers::ServiceTrust::ClientHTTPError) do |error|
+      expect(error.status).to eq(401)
+      expect(error.body).to eq("no")
+    end
+    expect(http).to have_received(:request).once
+  end
+
+  it "converts network errors to timeout errors and retries them" do
+    http = double("http")
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    allow(http).to receive(:request).and_raise(Net::ReadTimeout.new("timed out"))
+
+    expect do
+      described_class.new(audience: "app-b", base_url: "http://localhost:3000", retries: 1).get("/internal")
+    end.to raise_error(HasHelpers::ServiceTrust::ClientTimeoutError)
+    expect(http).to have_received(:request).twice
+  end
+
+  it "writes outbound audit rows" do
+    http = double("http")
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    allow(http).to receive(:request).and_return(response("200", "{}"))
+
+    described_class.new(audience: "app-b", base_url: "http://localhost:3000").get("/internal")
+
+    expect(HasHelpers::ServiceTrust::Audit).to have_received(:record!).with(hash_including(direction: "outbound", outcome: "accepted"))
+  end
+
+  it "requires HTTPS outside development and test" do
+    HasHelpers::ServiceTrust.config.environment = "production"
+
+    expect do
+      described_class.new(audience: "app-b", base_url: "http://app-b.test").get("/internal")
+    end.to raise_error(HasHelpers::ServiceTrust::OutboundTLSError)
+  end
+
+  it "allows host.docker.internal HTTP in development and test" do
+    http = double("http")
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    allow(http).to receive(:request).and_return(response("200", "{}"))
+
+    result = described_class.new(audience: "app-b", base_url: "http://host.docker.internal:3002").get("/internal")
+
+    expect(result.status).to eq(200)
+  end
+
+  it "mixes timeouts and retryable HTTP statuses across attempts" do
+    http = double("http")
+    allow(Net::HTTP).to receive(:start).and_yield(http)
+    call_count = 0
+    allow(http).to receive(:request) do
+      call_count += 1
+      case call_count
+      when 1 then raise Net::ReadTimeout.new("first")
+      when 2 then response("503", "still flaky")
+      else response("200", { ok: true }.to_json)
+      end
+    end
+
+    result = described_class.new(audience: "app-b", base_url: "http://localhost:3000", retries: 3).get("/internal")
+
+    expect(result.status).to eq(200)
+    expect(call_count).to eq(3)
+  end
+
+  def response(code, body)
+    instance_double(Net::HTTPResponse, code: code, body: body, to_hash: { "content-type" => ["application/json"] })
+  end
+end

data/spec/has_helpers/service_trust/configuration_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe HasHelpers::ServiceTrust::Configuration do
+  after { HasHelpers::ServiceTrust.reset_configuration! }
+
+  it "registers trusted issuers by environment" do
+    config = described_class.new
+    config.environment = "test"
+    config.trusted_issuers do |env, register|
+      register.call("peer-app", url: "http://localhost:3001") if env.test?
+    end
+
+    expect(config.trusted?("peer-app")).to eq(true)
+    expect(config.trusted_issuer("peer-app").url).to eq("http://localhost:3001")
+  end
+
+  it "registers allowed capabilities for trusted issuers" do
+    config = described_class.new
+    config.environment = "test"
+    config.trusted_issuers do |_env, register|
+      register.call("peer-app", url: "http://localhost:3001", allowed_capabilities: ["cards:read cards:write"])
+      register.call("empty-peer", url: "http://localhost:3002")
+    end
+
+    expect(config.trusted_issuer("peer-app").allowed_capabilities).to eq(%w[cards:read cards:write])
+    expect(config.trusted_issuer("empty-peer").allowed_capabilities).to eq([])
+  end
+
+  it "defines service trust errors under the base error" do
+    expect(HasHelpers::ServiceTrust::ReplayDetectedError < HasHelpers::ServiceTrust::Error).to eq(true)
+    expect(HasHelpers::ServiceTrust::TLSRequiredError < HasHelpers::ServiceTrust::Error).to eq(true)
+  end
+end

data/spec/has_helpers/service_trust/engine_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe HasHelpers::ServiceTrust::Engine do
+  it "exposes the JWKS well-known route" do
+    route = described_class.routes.routes.find do |candidate|
+      candidate.path.spec.to_s == "/.well-known/jwks.json(.:format)"
+    end
+
+    expect(route.defaults).to include(controller: "has_helpers/service_trust/jwks", action: "show")
+  end
+end

data/spec/has_helpers/service_trust/errors_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe HasHelpers::ServiceTrust::Error do
+  it "is the base class for all ServiceTrust errors" do
+    expect(HasHelpers::ServiceTrust::ConfigurationError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::UntrustedIssuerError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::InvalidSignatureError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::TokenExpiredError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::AudienceMismatchError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::ReplayDetectedError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::RateLimitedError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::TLSRequiredError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::OutboundTLSError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::JwksUnavailableError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::InsufficientCapabilityError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::ClientError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::ClientTimeoutError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::ClientHTTPError < described_class).to eq(true)
+    expect(HasHelpers::ServiceTrust::GraphQLClientError < described_class).to eq(true)
+  end
+end

data/spec/has_helpers/service_trust/graphql_authentication_spec.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::GraphQLAuthentication, type: :controller do
+  controller(ActionController::Base) do
+    include HasHelpers::ServiceTrust::GraphQLAuthentication
+    service_trust_audience "app-b"
+
+    def index
+      render json: service_trust_context
+    end
+  end
+
+  let(:keypair) { OpenSSL::PKey::RSA.generate(2048) }
+
+  before do
+    clear_service_trust!
+    routes.draw { get "index" => "anonymous#index" }
+    configure_service_trust(
+      issuer: "app-b",
+      redis: ServiceTrustMemoryRedis.new,
+      trusted: { "app-a" => "http://localhost:3000" },
+      allowed_capabilities: { "app-a" => ["cards:read"] }
+    )
+    stub_public_key(issuer: "app-a", kid: "kid-1", public_key: keypair.public_key)
+    allow(HasHelpers::ServiceTrust::Audit).to receive(:record!)
+  end
+
+  after { clear_service_trust! }
+
+  it "authenticates and exposes service trust context" do
+    request.headers["Authorization"] = "Bearer #{valid_token(scope: 'cards:read cards:write')}"
+
+    get :index
+
+    expect(response).to have_http_status(:ok)
+    expect(JSON.parse(response.body)["service_trust"]).to include(
+      "issuer" => "app-a",
+      "subject" => nil,
+      "capabilities" => ["cards:read"]
+    )
+    expect(controller.service_trust_context[:authorize].call(:view, Object)).to be(true)
+  end
+
+  it "renders verification failures as HTTP errors" do
+    request.headers["Authorization"] = "Bearer #{valid_token(aud: 'wrong')}"
+
+    get :index
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(JSON.parse(response.body)).to eq("error" => "AudienceMismatchError")
+  end
+
+  def valid_token(overrides = {})
+    encode_token(payload: service_trust_payload({ iss: "app-a", aud: "app-b" }.merge(overrides)), keypair: keypair, kid: "kid-1")
+  end
+end

data/spec/has_helpers/service_trust/graphql_authorizable_spec.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe HasHelpers::ServiceTrust::GraphQL::Authorizable do
+  class ServiceTrustAuthorizableBase
+    attr_reader :context
+
+    def initialize(context)
+      @context = context
+    end
+
+    def authorized?(*)
+      true
+    end
+  end
+
+  after do
+    Object.send(:remove_const, :ServiceTrustAuthorizableOperation) if defined?(ServiceTrustAuthorizableOperation)
+  end
+
+  it "allows a declared capability when present" do
+    build_operation { service_trust_capability "cards:write" }
+
+    expect(operation(%w[cards:write]).authorized?).to eq(true)
+  end
+
+  it "raises GraphQL execution errors for capability denials" do
+    build_operation { service_trust_capability "cards:write" }
+
+    expect { operation(%w[cards:read]).authorized? }.to raise_error(::GraphQL::ExecutionError, /missing capability/)
+  end
+
+  it "fails loud when no capability is declared for service trust calls" do
+    build_operation
+
+    expect { operation(%w[cards:read]).authorized? }.to raise_error(::GraphQL::ExecutionError, /not declared/)
+  end
+
+  it "allows explicit identity-only operations" do
+    build_operation { service_trust_capability :none }
+
+    expect(operation([]).authorized?).to eq(true)
+  end
+
+  it "allows any declared capability to match" do
+    build_operation { service_trust_capability_any %w[cards:write cards:read] }
+
+    expect(operation(%w[cards:read]).authorized?).to eq(true)
+  end
+
+  it "defers non-service-trust calls to existing authorization" do
+    build_operation
+
+    expect(ServiceTrustAuthorizableOperation.new({}).authorized?).to eq(true)
+  end
+
+  it "inherits a declared capability from a base class" do
+    base = Class.new(ServiceTrustAuthorizableBase) do
+      include HasHelpers::ServiceTrust::GraphQL::Authorizable
+      service_trust_capability "cards:read"
+    end
+    child = Class.new(base)
+    Object.const_set(:ServiceTrustAuthorizableOperation, child)
+
+    expect(child.new(service_trust: { capabilities: ["cards:read"] }).authorized?).to eq(true)
+    expect { child.new(service_trust: { capabilities: ["cards:write"] }).authorized? }
+      .to raise_error(::GraphQL::ExecutionError, /missing capability/)
+  end
+
+  it "rejects :none in service_trust_capability_any at declaration time" do
+    expect do
+      Class.new(ServiceTrustAuthorizableBase) do
+        include HasHelpers::ServiceTrust::GraphQL::Authorizable
+        service_trust_capability_any [:none, "cards:read"]
+      end
+    end.to raise_error(ArgumentError, /does not accept :none/)
+  end
+
+  def build_operation(&block)
+    klass = Class.new(ServiceTrustAuthorizableBase) do
+      include HasHelpers::ServiceTrust::GraphQL::Authorizable
+      class_eval(&block) if block
+    end
+    Object.const_set(:ServiceTrustAuthorizableOperation, klass)
+  end
+
+  def operation(capabilities)
+    ServiceTrustAuthorizableOperation.new(service_trust: { capabilities: capabilities })
+  end
+end

data/spec/has_helpers/service_trust/graphql_client_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe HasHelpers::ServiceTrust::GraphQLClient do
+  let(:response) do
+    HasHelpers::ServiceTrust::Client::Response.new(
+      status: 200,
+      headers: {},
+      body: "",
+      parsed: { "data" => { "node" => "ok" }, "errors" => [], "extensions" => { "trace" => true } }
+    )
+  end
+  let(:client) { instance_double(HasHelpers::ServiceTrust::Client, post: response) }
+
+  it "sends a GraphQL POST and returns a result object" do
+    result = described_class.new(audience: "app-b", base_url: "http://localhost:3000", client: client).query(
+      "query Test { node }",
+      variables: { id: "1" },
+      operation_name: "Test",
+      capability: "cards:read"
+    )
+
+    expect(client).to have_received(:post).with(
+      "/internal_graphql",
+      body: { query: "query Test { node }", variables: { id: "1" }, operationName: "Test" },
+      capability: "cards:read"
+    )
+    expect(result).to be_success
+    expect(result.data).to eq("node" => "ok")
+    expect(result.extensions).to eq("trace" => true)
+  end
+
+  it "raises on non-successful HTTP responses" do
+    allow(client).to receive(:post).and_return(HasHelpers::ServiceTrust::Client::Response.new(status: 500, headers: {}, body: "err", parsed: nil))
+
+    expect do
+      described_class.new(audience: "app-b", base_url: "http://localhost:3000", client: client).query("{ node }")
+    end.to raise_error(HasHelpers::ServiceTrust::GraphQLClientError, "HTTP 500")
+  end
+
+  it "raises GraphQL errors from a result" do
+    result = described_class::Result.new(data: nil, errors: [{ "message" => "denied" }])
+
+    expect { result.raise_on_errors! }.to raise_error(HasHelpers::ServiceTrust::GraphQLClientError, /denied/)
+  end
+end

data/spec/has_helpers/service_trust/jwks_client_spec.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::JwksClient do
+  let(:keypair) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:jwk) { JWT::JWK.new(keypair.public_key, "kid-1").export.merge("alg" => "RS256", "use" => "sig") }
+
+  before do
+    clear_service_trust!
+    configure_service_trust(trusted: { "app-a" => "https://app-a.test" })
+    described_class.clear_cache!
+  end
+
+  after do
+    described_class.clear_cache!
+    clear_service_trust!
+  end
+
+  it "fetches and caches a peer public key" do
+    stub_jwks_response(keys: [jwk])
+
+    first = described_class.public_key_for("app-a", "kid-1")
+    second = described_class.public_key_for("app-a", "kid-1")
+
+    expect(first.to_pem).to eq(keypair.public_key.to_pem)
+    expect(second.to_pem).to eq(keypair.public_key.to_pem)
+    expect(Net::HTTP).to have_received(:start).once
+  end
+
+  it "raises when the key id is missing" do
+    stub_jwks_response(keys: [jwk])
+
+    expect do
+      described_class.public_key_for("app-a", "missing")
+    end.to raise_error(HasHelpers::ServiceTrust::InvalidSignatureError)
+  end
+
+  it "raises JwksUnavailableError on 404 responses" do
+    response = Net::HTTPNotFound.new("1.1", "404", "Not Found")
+    allow(Net::HTTP).to receive(:start).and_yield(double(get: response))
+
+    expect do
+      described_class.public_key_for("app-a", "kid-1")
+    end.to raise_error(HasHelpers::ServiceTrust::JwksUnavailableError)
+  end
+
+  it "raises JwksUnavailableError when the peer is unreachable" do
+    allow(Net::HTTP).to receive(:start).and_raise(Errno::ECONNREFUSED)
+
+    expect do
+      described_class.public_key_for("app-a", "kid-1")
+    end.to raise_error(HasHelpers::ServiceTrust::JwksUnavailableError)
+  end
+
+  it "requires HTTPS outside development and test" do
+    HasHelpers::ServiceTrust.config.environment = "production"
+    HasHelpers::ServiceTrust.config.trusted_issuers { |_env, register| register.call("app-a", url: "http://app-a.test") }
+
+    expect do
+      described_class.public_key_for("app-a", "kid-1")
+    end.to raise_error(HasHelpers::ServiceTrust::OutboundTLSError)
+  end
+
+  it "allows localhost HTTP in test" do
+    HasHelpers::ServiceTrust.config.trusted_issuers { |_env, register| register.call("app-a", url: "http://localhost:3000") }
+    stub_jwks_response(keys: [jwk])
+
+    expect(described_class.public_key_for("app-a", "kid-1").to_pem).to eq(keypair.public_key.to_pem)
+  end
+
+  it "allows host.docker.internal HTTP in test" do
+    HasHelpers::ServiceTrust.config.trusted_issuers { |_env, register| register.call("app-a", url: "http://host.docker.internal:3002") }
+    stub_jwks_response(keys: [jwk])
+
+    expect(described_class.public_key_for("app-a", "kid-1").to_pem).to eq(keypair.public_key.to_pem)
+  end
+
+  def stub_jwks_response(keys:)
+    response = Net::HTTPOK.new("1.1", "200", "OK")
+    allow(response).to receive(:body).and_return({ keys: keys }.to_json)
+    allow(Net::HTTP).to receive(:start).and_yield(double(get: response))
+  end
+end

data/spec/has_helpers/service_trust/jwks_controller_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::JwksController do
+  before do
+    clear_service_trust!
+    configure_service_trust(issuer: "app-a", environment: "test")
+  end
+
+  after { clear_service_trust! }
+
+  it "returns active and still-verifiable keys with cache headers" do
+    active = create_service_trust_key(environment: "test", kid: "active")
+    retired = create_service_trust_key(environment: "test", kid: "retired", active: false, retired_at: 30.minutes.from_now)
+    create_service_trust_key(environment: "development", kid: "dev")
+    create_service_trust_key(environment: "test", kid: "expired", active: false, retired_at: 1.minute.ago)
+
+    status, headers, body_parts = HasHelpers::ServiceTrust::Engine.routes.call(
+      Rack::MockRequest.env_for("/.well-known/jwks.json")
+    )
+    body = JSON.parse(body_parts.each.to_a.join)
+
+    expect(status).to eq(200)
+    expect(headers["Cache-Control"]).to include("max-age=3600", "public")
+    expect(body.fetch("keys").map { |key| key["kid"] }).to contain_exactly(active.kid, retired.kid)
+    expect(body.fetch("keys").first.keys).to include("kty", "use", "kid", "alg", "n", "e")
+  end
+
+  it "publishes JWKs that round-trip via JWT::JWK.import and verify a real signature" do
+    active = create_service_trust_key(environment: "test", kid: "round-trip")
+    _status, _headers, body_parts = HasHelpers::ServiceTrust::Engine.routes.call(
+      Rack::MockRequest.env_for("/.well-known/jwks.json")
+    )
+    body = JSON.parse(body_parts.each.to_a.join)
+    jwk = body.fetch("keys").find { |k| k["kid"] == "round-trip" }
+
+    public_key = JWT::JWK.import(jwk).public_key
+    payload = { iss: "app-a", aud: "app-b", iat: Time.current.to_i, exp: 1.minute.from_now.to_i }
+    token = JWT.encode(payload, active.to_openssl, "RS256", kid: active.kid)
+
+    decoded, header = JWT.decode(token, public_key, true, algorithm: "RS256")
+    expect(header["kid"]).to eq("round-trip")
+    expect(decoded["iss"]).to eq("app-a")
+  end
+end

data/spec/has_helpers/service_trust/jwt_codec_spec.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::JwtCodec do
+  let(:keypair) { OpenSSL::PKey::RSA.generate(2048) }
+
+  before do
+    clear_service_trust!
+    configure_service_trust
+  end
+
+  after { clear_service_trust! }
+
+  it "encodes, peeks, and decodes an RS256 JWT" do
+    token = described_class.encode(service_trust_payload, keypair, "kid-1", alg: "RS256")
+    header, payload = described_class.peek(token)
+
+    expect(header["kid"]).to eq("kid-1")
+    expect(payload["iss"]).to eq("app-a")
+    expect(described_class.decode!(token, keypair.public_key, alg: "RS256")["aud"]).to eq("app-b")
+  end
+
+  it "rejects unsupported algorithms" do
+    expect do
+      described_class.encode(service_trust_payload, "secret", "kid", alg: "HS256")
+    end.to raise_error(HasHelpers::ServiceTrust::InvalidSignatureError)
+  end
+end

data/spec/has_helpers/service_trust/key_manager_spec.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::KeyManager do
+  before do
+    clear_service_trust!
+    configure_service_trust(issuer: "app-a", environment: "test")
+  end
+
+  after { clear_service_trust! }
+
+  it "generates a first signing key on empty DB and reuses it" do
+    first = described_class.current_signing_key
+    second = described_class.current_signing_key
+
+    expect(first).to be_persisted
+    expect(second.id).to eq(first.id)
+    expect(HasHelpers::ServiceTrust::Key.active_for_env("test").count).to eq(1)
+  end
+
+  it "reads the current active key from the DB" do
+    key = create_service_trust_key(environment: "test", kid: "db-kid")
+
+    expect(described_class.current_signing_key.kid).to eq(key.kid)
+  end
+
+  it "prefers env-backed keys" do
+    keypair = use_env_key(kid: "env-kid")
+
+    key = described_class.current_signing_key
+
+    expect(key.kid).to eq("env-kid")
+    expect(key.private_key_pem).to eq(keypair.to_pem)
+    expect(key).not_to be_persisted
+  end
+
+  it "raises when the cached key does not match the configured environment" do
+    create_service_trust_key(environment: "test")
+    described_class.current_signing_key
+    HasHelpers::ServiceTrust.config.environment = "staging"
+
+    expect { described_class.current_signing_key }.to raise_error(HasHelpers::ServiceTrust::ConfigurationError)
+  end
+
+  it "rotates atomically and keeps the old key verifiable for one hour" do
+    old_key = create_service_trust_key(environment: "test", kid: "old")
+
+    new_key = described_class.rotate!
+
+    expect(new_key).to be_active
+    old_key.reload
+    expect(old_key).not_to be_active
+    expect(old_key.retired_at).to be_within(2.seconds).of(1.hour.from_now)
+    expect(described_class.verifiable_keys.map(&:kid)).to include(old_key.kid, new_key.kid)
+  end
+
+  it "does not create duplicate active keys during concurrent first boot" do
+    threads = 3.times.map { Thread.new { described_class.current_signing_key.kid } }
+    kids = threads.map(&:value)
+
+    expect(kids.uniq.size).to eq(1)
+    expect(HasHelpers::ServiceTrust::Key.active_for_env("test").count).to eq(1)
+  end
+
+  it "refuses ENV-loaded keys whose declared environment differs from the configured env" do
+    use_env_key(kid: "prod-kid", environment: "production")
+
+    expect { described_class.current_signing_key }.to raise_error(HasHelpers::ServiceTrust::ConfigurationError, /bound to 'production'/)
+  end
+
+  it "refuses ENV-loaded keys when SERVICE_TRUST_KEY_ENVIRONMENT is missing" do
+    keypair = OpenSSL::PKey::RSA.generate(2048)
+    ENV["SERVICE_TRUST_PRIVATE_KEY"] = keypair.to_pem
+    ENV["SERVICE_TRUST_KEY_ID"] = "kid"
+
+    expect { described_class.current_signing_key }.to raise_error(HasHelpers::ServiceTrust::ConfigurationError, /requires/)
+  end
+end