has_helpers 5.0.2

data/spec/has_helpers/service_trust/key_spec.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::Key do
+  before { clear_service_trust! }
+  after { clear_service_trust! }
+
+  it "scopes keys by environment and active state" do
+    active = create_service_trust_key(environment: "test", kid: "active")
+    create_service_trust_key(environment: "development", kid: "dev")
+    create_service_trust_key(environment: "test", kid: "old", active: false, retired_at: 1.hour.ago)
+
+    expect(described_class.for_env("test")).to contain_exactly(active, described_class.find_by(kid: "old"))
+    expect(described_class.active_for_env("test")).to contain_exactly(active)
+    expect(described_class.verifiable_for_env("test")).to contain_exactly(active)
+  end
+
+  it "keeps future retired keys verifiable" do
+    active = create_service_trust_key(environment: "test", kid: "active")
+    retired = create_service_trust_key(environment: "test", kid: "retired", active: false, retired_at: 1.hour.from_now)
+
+    expect(described_class.verifiable_for_env("test")).to contain_exactly(active, retired)
+  end
+
+  it "round-trips private key material through the model" do
+    key = create_service_trust_key
+
+    expect(OpenSSL::PKey.read(key.reload.private_key_pem)).to be_a(OpenSSL::PKey::RSA)
+  end
+
+  it "validates one active key per environment" do
+    create_service_trust_key(environment: "test", kid: "one")
+    second = build_key(environment: "test", kid: "two")
+
+    expect(second).not_to be_valid
+    expect(second.errors[:active]).to include("already exists for environment")
+  end
+
+  def build_key(environment:, kid:)
+    keypair = OpenSSL::PKey::RSA.generate(2048)
+    described_class.new(
+      environment: environment,
+      kid: kid,
+      private_key_pem: keypair.to_pem,
+      public_key_pem: keypair.public_key.to_pem,
+      algorithm: "RS256",
+      active: true
+    )
+  end
+end

data/spec/has_helpers/service_trust/rake_tasks_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rake"
+require_relative "support"
+
+RSpec.describe "service_trust rake tasks" do
+  before(:all) do
+    %w[
+      service_trust:keys:generate
+      service_trust:keys:rotate
+      service_trust:keys:list
+      service_trust:keys:retire
+      service_trust:audit:cleanup
+    ].each { |task_name| Rake::Task[task_name].clear if Rake::Task.task_defined?(task_name) }
+    load File.expand_path("../../../lib/tasks/has_helpers/service_trust.rake", __dir__)
+    Rake::Task.define_task(:environment) unless Rake::Task.task_defined?(:environment)
+  end
+
+  before do
+    clear_service_trust!
+    configure_service_trust
+    Rake::Task.tasks.each(&:reenable)
+  end
+
+  after { clear_service_trust! }
+
+  it "generates the first key" do
+    expect do
+      Rake::Task["service_trust:keys:generate"].invoke
+    end.to change { HasHelpers::ServiceTrust::Key.count }.by(1)
+  end
+
+  it "rotates keys" do
+    create_service_trust_key(environment: "test")
+
+    expect do
+      Rake::Task["service_trust:keys:rotate"].invoke
+    end.to change { HasHelpers::ServiceTrust::Key.count }.by(1)
+  end
+
+  it "retires a key" do
+    key = create_service_trust_key(environment: "test", kid: "retire-me")
+
+    Rake::Task["service_trust:keys:retire"].invoke(key.kid)
+
+    expect(key.reload.retired_at).to be_present
+    expect(key).not_to be_active
+  end
+
+  it "cleans up audit logs" do
+    old = HasHelpers::ServiceTrust::AuditLog.create!(issuer: "app-a", audience: "app-b", outcome: "accepted", occurred_at: 31.days.ago)
+
+    Rake::Task["service_trust:audit:cleanup"].invoke
+
+    expect(HasHelpers::ServiceTrust::AuditLog.exists?(old.id)).to eq(false)
+  end
+end

data/spec/has_helpers/service_trust/rate_limiter_spec.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::RateLimiter do
+  let(:redis) { ServiceTrustMemoryRedis.new }
+
+  before do
+    clear_service_trust!
+    configure_service_trust(redis: redis)
+    HasHelpers::ServiceTrust.config.rate_limit_per_issuer = { requests: 2, per: 1.minute }
+  end
+
+  after { clear_service_trust! }
+
+  it "trips at the configured boundary" do
+    expect(described_class.check!("app-a")).to eq(true)
+    expect(described_class.check!("app-a")).to eq(true)
+
+    expect do
+      described_class.check!("app-a")
+    end.to raise_error(HasHelpers::ServiceTrust::RateLimitedError)
+  end
+
+  it "keeps issuer buckets separate" do
+    2.times { described_class.check!("app-a") }
+
+    expect(described_class.check!("app-b")).to eq(true)
+  end
+end

data/spec/has_helpers/service_trust/replay_cache_spec.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe HasHelpers::ServiceTrust::ReplayCache do
+  let(:redis) { ServiceTrustMemoryRedis.new }
+
+  before do
+    clear_service_trust!
+    configure_service_trust(redis: redis)
+  end
+
+  after { clear_service_trust! }
+
+  it "atomically claims a jti and rejects duplicates" do
+    expect(described_class.claim!("jti-1", ttl: 60)).to eq(true)
+
+    expect do
+      described_class.claim!("jti-1", ttl: 60)
+    end.to raise_error(HasHelpers::ServiceTrust::ReplayDetectedError)
+  end
+
+  it "adds clock skew to the stored ttl" do
+    described_class.claim!("jti-2", ttl: 10)
+
+    expect(redis.ttl("service_trust:jti:jti-2")).to eq(40)
+  end
+end

data/spec/has_helpers/service_trust/signer_verifier_spec.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe "HasHelpers::ServiceTrust signing and verification" do
+  let(:keypair) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:redis) { ServiceTrustMemoryRedis.new }
+
+  before do
+    clear_service_trust!
+    ENV["SERVICE_TRUST_PRIVATE_KEY"] = keypair.to_pem
+    ENV["SERVICE_TRUST_KEY_ID"] = "test-kid"
+    ENV["SERVICE_TRUST_KEY_ENVIRONMENT"] = "test"
+    configure_service_trust(redis: redis)
+    stub_public_key(issuer: "app-a", kid: "test-kid", public_key: keypair.public_key)
+    allow(HasHelpers::ServiceTrust::Audit).to receive(:record!)
+  end
+
+  after { clear_service_trust! }
+
+  it "signs required claims and verifies the token" do
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b", subject: "sync", capability: "read")
+    header, payload = HasHelpers::ServiceTrust::JwtCodec.peek(token)
+
+    expect(header["kid"]).to eq("test-kid")
+    expect(header["alg"]).to eq("RS256")
+    expect(payload).to include("iss" => "app-a", "aud" => "app-b", "sub" => "sync", "scope" => "read", "env" => "test")
+
+    result = HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    expect(result["jti"]).to be_present
+    expect(result.claims["jti"]).to be_present
+  end
+
+  it "omits scope when no capability is provided" do
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+    _header, payload = HasHelpers::ServiceTrust::JwtCodec.peek(token)
+
+    expect(payload).not_to have_key("scope")
+  end
+
+  it "writes capability narrowing to the OAuth scope claim" do
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b", capability: ["cards:write", "cards:read"])
+    _header, payload = HasHelpers::ServiceTrust::JwtCodec.peek(token)
+
+    expect(payload["scope"]).to eq("cards:write cards:read")
+  end
+
+  it "computes effective capabilities from issuer allowlists" do
+    configure_service_trust(
+      redis: redis,
+      allowed_capabilities: { "app-a" => %w[cards:read cards:write] }
+    )
+    stub_public_key(issuer: "app-a", kid: "test-kid", public_key: keypair.public_key)
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b", capability: "cards:write cards:delete")
+
+    result = HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+
+    expect(result.capabilities).to eq(["cards:write"])
+    expect(result.claims).not_to have_key("_capabilities")
+    expect(HasHelpers::ServiceTrust::Audit).to have_received(:record!).with(hash_including(capabilities: ["cards:write"], direction: "inbound"))
+  end
+
+  it "rejects replayed tokens" do
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+    HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::ReplayDetectedError)
+  end
+
+  it "rejects wrong audiences" do
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "other-app")
+    end.to raise_error(HasHelpers::ServiceTrust::AudienceMismatchError)
+  end
+
+  it "rejects alg none tokens" do
+    token = unsigned_token(
+      iss: "app-a",
+      aud: "app-b",
+      iat: Time.current.to_i,
+      nbf: Time.current.to_i,
+      exp: 1.minute.from_now.to_i,
+      jti: SecureRandom.uuid,
+      env: "test"
+    )
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::InvalidSignatureError)
+  end
+
+  it "rejects HS256 tokens before trusting the signature" do
+    token = JWT.encode(service_trust_payload, "shared-secret", "HS256", kid: "hs")
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::InvalidSignatureError)
+  end
+
+  it "rejects untrusted issuers" do
+    token = encode_token(payload: service_trust_payload(iss: "other"), keypair: keypair)
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::UntrustedIssuerError)
+  end
+
+  it "rejects env mismatches" do
+    token = encode_token(payload: service_trust_payload(env: "production"), keypair: keypair)
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::InvalidTokenError)
+  end
+
+  it "rejects tokens whose ttl exceeds the max" do
+    token = encode_token(payload: service_trust_payload(exp: 10.minutes.from_now.to_i), keypair: keypair)
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::TokenExpiredError)
+  end
+
+  it "rejects missing claims" do
+    payload = service_trust_payload
+    payload.delete(:jti)
+    token = encode_token(payload: payload, keypair: keypair)
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::InvalidTokenError)
+  end
+
+  it "rejects rate limited issuers" do
+    HasHelpers::ServiceTrust.config.rate_limit_per_issuer = { requests: 0, per: 1.minute }
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::RateLimitedError)
+  end
+
+  it "records the rejected path with inbound direction and nil capabilities" do
+    token = encode_token(payload: service_trust_payload(aud: "wrong"), keypair: keypair)
+
+    expect do
+      HasHelpers::ServiceTrust::Verifier.verify!(token, expected_audience: "app-b")
+    end.to raise_error(HasHelpers::ServiceTrust::AudienceMismatchError)
+
+    expect(HasHelpers::ServiceTrust::Audit).to have_received(:record!).with(
+      hash_including(outcome: "rejected", direction: "inbound", capabilities: nil, rejection_reason: "AudienceMismatchError")
+    )
+  end
+end

data/spec/has_helpers/service_trust/smoke_spec.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require_relative "support"
+
+RSpec.describe "ServiceTrust two-app smoke test" do
+  let(:redis) { ServiceTrustMemoryRedis.new }
+  let(:app_b) { HasHelpers::ServiceTrust::VerifyMiddleware.new(->(_env) { [200, {}, ["ok"]] }) }
+
+  before do
+    clear_service_trust!
+    allow(HasHelpers::ServiceTrust::Audit).to receive(:record!)
+  end
+
+  after { clear_service_trust! }
+
+  it "round-trips, rejects replay/tampering/wrong audience, and accepts rotated keys" do
+    configure_app_a
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+    old_key = HasHelpers::ServiceTrust::KeyManager.current_signing_key
+
+    configure_app_b(redis: redis, public_keys: [old_key])
+    expect(call_app_b(token)[0]).to eq(200)
+    expect(call_app_b(token)[0]).to eq(401)
+    expect(call_app_b("#{token}tampered")[0]).to eq(401)
+
+    configure_app_a
+    wrong_audience = HasHelpers::ServiceTrust::Signer.sign(audience: "other-app")
+    configure_app_b(redis: ServiceTrustMemoryRedis.new, public_keys: [old_key])
+    expect(call_app_b(wrong_audience)[0]).to eq(401)
+
+    configure_app_a
+    old_unused_token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+    new_key = HasHelpers::ServiceTrust::KeyManager.rotate!
+    new_token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b")
+
+    configure_app_b(redis: ServiceTrustMemoryRedis.new, public_keys: [old_key.reload, new_key])
+    expect(call_app_b(old_unused_token)[0]).to eq(200)
+    expect(call_app_b(new_token)[0]).to eq(200)
+  end
+
+  it "uses the outbound client with retry and GraphQL-shaped capability enforcement" do
+    configure_app_a
+    key = HasHelpers::ServiceTrust::KeyManager.current_signing_key
+    token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b", capability: "cards:write")
+
+    configure_app_b(
+      redis: ServiceTrustMemoryRedis.new,
+      public_keys: [key],
+      allowed_capabilities: ["cards:write"]
+    )
+    allow(HasHelpers::ServiceTrust::Signer).to receive(:bearer_header).and_return("Authorization" => "Bearer #{token}")
+    stub_graphql_http(statuses: [503, 503])
+
+    response = HasHelpers::ServiceTrust::Client.new(audience: "app-b", base_url: "http://localhost:3002", retries: 3).post(
+      "/internal_graphql",
+      body: { query: "mutation { writeCard { ok } }" },
+      capability: "cards:write"
+    )
+
+    expect(response.status).to eq(200)
+    expect(response.parsed).to eq("data" => { "writeCard" => { "ok" => true } })
+
+    configure_app_b(
+      redis: ServiceTrustMemoryRedis.new,
+      public_keys: [key],
+      allowed_capabilities: ["cards:read"]
+    )
+    stub_graphql_http
+
+    denied = HasHelpers::ServiceTrust::Client.new(audience: "app-b", base_url: "http://localhost:3002").post(
+      "/internal_graphql",
+      body: { query: "mutation { writeCard { ok } }" },
+      capability: "cards:write"
+    )
+
+    expect(denied.status).to eq(200)
+    expect(denied.parsed.fetch("errors").first.fetch("message")).to include("missing capability")
+  end
+
+  it "executes a real graphql schema through the verifier and authorizable mixin" do
+    configure_app_a
+    key = HasHelpers::ServiceTrust::KeyManager.current_signing_key
+    allowed_token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b", capability: "cards:write")
+    denied_token = HasHelpers::ServiceTrust::Signer.sign(audience: "app-b", capability: "cards:read")
+
+    configure_app_b(
+      redis: ServiceTrustMemoryRedis.new,
+      public_keys: [key],
+      allowed_capabilities: ["cards:write"]
+    )
+
+    response = call_graphql_app(allowed_token, "mutation { writeCard { ok } }")
+    expect(response[0]).to eq(200)
+    payload = JSON.parse(response[2].join)
+    expect(payload.dig("data", "writeCard", "ok")).to eq(true)
+
+    configure_app_b(
+      redis: ServiceTrustMemoryRedis.new,
+      public_keys: [key],
+      allowed_capabilities: ["cards:read"]
+    )
+
+    response = call_graphql_app(denied_token, "mutation { writeCard { ok } }")
+    expect(response[0]).to eq(200)
+    denied_payload = JSON.parse(response[2].join)
+    expect(denied_payload.dig("data", "writeCard")).to be_nil
+    expect(denied_payload.fetch("errors").first.fetch("message")).to include("missing capability")
+  end
+
+  def call_graphql_app(token, query)
+    graphql_app.call(
+      Rack::MockRequest.env_for(
+        "/internal_graphql",
+        method: "POST",
+        "HTTP_AUTHORIZATION" => "Bearer #{token}",
+        input: { query: query }.to_json
+      )
+    )
+  end
+
+  def configure_app_a
+    configure_service_trust(issuer: "app-a", environment: "test", trusted: { "app-b" => "http://localhost:3002" })
+  end
+
+  def configure_app_b(redis:, public_keys:, allowed_capabilities: [])
+    configure_service_trust(
+      issuer: "app-b",
+      environment: "test",
+      redis: redis,
+      trusted: { "app-a" => "http://localhost:3001" },
+      allowed_capabilities: { "app-a" => allowed_capabilities }
+    )
+    HasHelpers::ServiceTrust::Test.stub_issuer(
+      "app-a",
+      public_keys: public_keys.map { |key| { kid: key.kid, public_key: key.public_key } }
+    )
+  end
+
+  def call_app_b(token)
+    app_b.call(Rack::MockRequest.env_for("/internal", "HTTP_AUTHORIZATION" => "Bearer #{token}"))
+  end
+
+  def stub_graphql_http(statuses: [])
+    pending_statuses = statuses.dup
+    allow(Net::HTTP).to receive(:start) do |_host, _port, **_options, &block|
+      http = double("http")
+      allow(http).to receive(:request) do |request|
+        status = pending_statuses.shift
+        next http_response(status, "") if status
+
+        rack_status, _headers, body = graphql_app.call(
+          Rack::MockRequest.env_for(
+            request.path,
+            "HTTP_AUTHORIZATION" => request["Authorization"],
+            method: request.method,
+            input: request.body
+          )
+        )
+        http_response(rack_status, body.join)
+      end
+      block.call(http)
+    end
+  end
+
+  def graphql_app
+    schema = real_graphql_schema
+    HasHelpers::ServiceTrust::VerifyMiddleware.new(
+      lambda do |env|
+        request_body = env["rack.input"].read
+        params = request_body.empty? ? {} : JSON.parse(request_body)
+        result = schema.execute(
+          params["query"],
+          variables: params["variables"] || {},
+          operation_name: params["operationName"],
+          context: { service_trust: { capabilities: env["service_trust.capabilities"] || [] } }
+        )
+        [200, { "Content-Type" => "application/json" }, [result.to_json]]
+      end,
+      paths: %r{\A/internal_graphql\z}
+    )
+  end
+
+  def real_graphql_schema
+    mutation = Class.new(::GraphQL::Schema::Mutation) do
+      include HasHelpers::ServiceTrust::GraphQL::Authorizable
+      graphql_name "WriteCard"
+      service_trust_capability "cards:write"
+      field :ok, ::GraphQL::Types::Boolean, null: false
+
+      def resolve
+        { ok: true }
+      end
+    end
+
+    mutation_root = Class.new(::GraphQL::Schema::Object) do
+      graphql_name "Mutation"
+    end
+    mutation_root.field :write_card, mutation: mutation
+
+    query_root = Class.new(::GraphQL::Schema::Object) do
+      graphql_name "Query"
+      field :ping, ::GraphQL::Types::String, null: false
+      define_method(:ping) { "pong" }
+    end
+
+    Class.new(::GraphQL::Schema) do
+      query query_root
+      mutation mutation_root
+    end
+  end
+
+  def http_response(status, body)
+    instance_double(Net::HTTPResponse, code: status.to_s, body: body, to_hash: { "content-type" => ["application/json"] })
+  end
+end

data/spec/has_helpers/service_trust/support.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require "base64"
+require "rack/mock"
+
+class ServiceTrustMemoryRedis
+  attr_reader :values, :expires
+
+  def initialize
+    @values = {}
+    @expires = {}
+  end
+
+  def set(key, value, nx: false, ex: nil)
+    return false if nx && values.key?(key)
+
+    values[key] = value
+    expires[key] = ex if ex
+    true
+  end
+
+  def incr(key)
+    values[key] = values[key].to_i + 1
+  end
+
+  def expire(key, ttl, *)
+    expires[key] = ttl
+    true
+  end
+
+  def ttl(key)
+    expires[key]
+  end
+end
+
+module ServiceTrustSpecSupport
+  def configure_service_trust(issuer: "app-a", environment: "test", redis: ServiceTrustMemoryRedis.new, trusted: { "app-a" => "http://localhost:3000" }, allowed_capabilities: {})
+    HasHelpers::ServiceTrust.reset_configuration!
+    HasHelpers::ServiceTrust.configure do |config|
+      config.issuer = issuer
+      config.environment = environment
+      config.replay_cache_redis = -> { redis }
+      config.rate_limit_per_issuer = { requests: 10, per: 1.minute }
+      config.trusted_issuers do |_env, register|
+        trusted.each do |name, url|
+          register.call(name, url: url, allowed_capabilities: allowed_capabilities.fetch(name, []))
+        end
+      end
+    end
+    redis
+  end
+
+  def clear_service_trust!
+    ENV.delete("SERVICE_TRUST_PRIVATE_KEY")
+    ENV.delete("SERVICE_TRUST_KEY_ID")
+    ENV.delete("SERVICE_TRUST_KEY_ENVIRONMENT")
+    HasHelpers::ServiceTrust::AuditLog.delete_all if table_exists?("service_trust_audit_logs")
+    HasHelpers::ServiceTrust::Key.delete_all if table_exists?("service_trust_keys")
+    HasHelpers::ServiceTrust.reset_configuration!
+  end
+
+  def create_service_trust_key(environment: "test", kid: SecureRandom.hex(8), active: true, retired_at: nil, verifiable_until: nil)
+    keypair = OpenSSL::PKey::RSA.generate(2048)
+    HasHelpers::ServiceTrust::Key.create!(
+      kid: kid,
+      environment: environment,
+      private_key_pem: keypair.to_pem,
+      public_key_pem: keypair.public_key.to_pem,
+      algorithm: "RS256",
+      active: active,
+      retired_at: retired_at,
+      verifiable_until: verifiable_until
+    )
+  end
+
+  def use_env_key(kid: "test-kid", environment: HasHelpers::ServiceTrust.config.environment.to_s)
+    keypair = OpenSSL::PKey::RSA.generate(2048)
+    ENV["SERVICE_TRUST_PRIVATE_KEY"] = keypair.to_pem
+    ENV["SERVICE_TRUST_KEY_ID"] = kid
+    ENV["SERVICE_TRUST_KEY_ENVIRONMENT"] = environment
+    keypair
+  end
+
+  def stub_public_key(issuer:, kid:, public_key:)
+    HasHelpers::ServiceTrust::Test.stub_issuer(issuer, public_keys: [{ kid: kid, public_key: public_key }])
+  end
+
+  def encode_token(payload:, keypair:, kid: "test-kid", alg: "RS256")
+    JWT.encode(payload, keypair, alg, kid: kid, typ: "JWT")
+  end
+
+  def unsigned_token(payload)
+    header = { alg: "none", typ: "JWT" }
+    [
+      Base64.urlsafe_encode64(header.to_json, padding: false),
+      Base64.urlsafe_encode64(payload.to_json, padding: false),
+      ""
+    ].join(".")
+  end
+
+  def service_trust_payload(overrides = {})
+    now = Time.current.to_i
+    {
+      iss: "app-a",
+      aud: "app-b",
+      iat: now,
+      nbf: now,
+      exp: 1.minute.from_now.to_i,
+      jti: SecureRandom.uuid,
+      env: "test"
+    }.merge(overrides)
+  end
+
+  def table_exists?(name)
+    ActiveRecord::Base.connection.data_source_exists?(name)
+  end
+end
+
+RSpec.configure do |config|
+  config.include ServiceTrustSpecSupport
+end