kiosk-redteam 0.5.20 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f685eaaad2b4f5c00e9a30b853c7b955944b5ebfe3cc2232da9595a5deb5325b
-  data.tar.gz: 5e7361227cfe0ac60f95085a875af20451992d0ed0a0514ca1ef3d7f50101efa
+  metadata.gz: 2c56649c77866230a9cf50c19996d61c4dc830e8482119f6a8bc572e1089ecf1
+  data.tar.gz: ace8f750f4f8f5d28b995b2e52f0249f5a57b18eed50a71a61e46e2059746afb
 SHA512:
-  metadata.gz: c59a347eb3eb6261fd991cb85047c3698bac43d6d29d3dbbfcb1bbcc6cec4a86d1957dbc47a5853cd9be412b55219cfc45ac5821b8ac4d2b4ef659000adf7a54
-  data.tar.gz: 043e887db0d72927446207bf3e0c3dff8aee07d44f976890c74c40f72660ee0e4d2f74d6ff12d93f47809884a6c067db5e8b89b044b931b0a4e05fbe0d030625
+  metadata.gz: 7c01e1cf090a73e15c30dfa2a47646d3681839c65d1e232ee2e473aee737c4876a91a8e5c6b8428bbc076588f30997aaee38a21c5cf2c7a349bbe08f7584fc90
+  data.tar.gz: e4b0bdba33d9b7f322bdf0aae993bafbfa0a51b2bab7e025e237dab437d4aef133a8690d446ff236981e393d2e187448d8162f903407c9a8f8915da4de073c2a

data/CHANGELOG.md

@@ -12,6 +12,47 @@ already written is edited.
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-10-22
+
+- 2026-10-22: Version 0.6.1, the tree cut that matches skill 0.6.1.
+- 2026-10-21: The bundle that runs a battery against an Equihash origin holds `kiosk-pow-equihash`; kiosk-test-support does not bring it.
+
+## [0.6.0] — 2026-10-21
+
+- 2026-10-21: Scenarios and batteries sign with Ed25519 keys, and the KYC test issuer signs EdDSA.
+- 2026-10-21: Version 0.6.0, the tree cut that matches skill 0.6.0.
+
+## [0.5.27] — 2026-10-21
+
+- 2026-10-21: Scenarios and batteries register at `oauth/register` and get tokens by client assertion and DPoP; the device-grant probes sign with a registered client.
+- 2026-10-21: Version 0.5.27, the tree cut that matches skill 0.5.27.
+
+## [0.5.26] — 2026-10-21
+
+- 2026-10-21: Version 0.5.26, the tree cut that matches skill 0.5.26.
+
+## [0.5.25] — 2026-10-21
+
+- 2026-10-21: Version 0.5.25, the tree cut that matches skill 0.5.25.
+
+## [0.5.24] — 2026-10-21
+
+- 2026-10-21: Version 0.5.24, the tree cut that matches skill 0.5.24.
+
+## [0.5.23] — 2026-10-21
+
+- 2026-10-21: `Scenarios::StolenToken` asserts that a real access token without its key is refused 401. Every suite and scenario sends tokens with a DPoP proof.
+- 2026-10-21: Version 0.5.23, the tree cut that matches skill 0.5.23.
+
+## [0.5.22] — 2026-10-21
+
+- 2026-10-21: The payment scenarios attack the signed checkout and the two AP2 v0.2 mandates; `WrongCurrencyCart` is `WrongCurrencyPayment`.
+- 2026-10-21: Version 0.5.22, the tree cut that matches skill 0.5.22.
+
+## [0.5.21] — 2026-10-21
+
+- 2026-10-21: Version 0.5.21, the tree cut that matches skill 0.5.21.
+
 ## [0.5.20] — 2026-10-20
 
 - 2026-10-20: Version 0.5.20, the tree cut that matches skill 0.5.20.

data/README.md

@@ -15,7 +15,7 @@ regression.
 **No Rails.** The harness speaks the wire and nothing else, so
 it can be pointed at any Kiosk origin — your own app in CI, or a third party's
 deployment. Everything provider-specific (which verbs exist, how to create an
-owned row, how to build a mandate) lives in a `Profile` you supply; no provider
+owned row, which checkout pays for it) lives in a `Profile` you supply; no provider
 name is hard-coded in the gem.
 
 **`http` or `https` is decided by the base URL you pass and by nothing else.**
@@ -66,8 +66,9 @@ gem "kiosk-redteam", github: "kiosk-hq/kiosk", group: :development
 ```
 
 The registration toll is real Equihash: the assistant client solves the server's
-402 challenges with the reference solver that ships inside `kiosk-pow-equihash`,
-so the machine running the battery needs **`python3` with `numpy`** on `PATH`. Point a battery at an
+402 challenges with the reference solver that ships inside `kiosk-pow-equihash`.
+The bundle that runs the battery holds that gem, as the origin's bundle does,
+and the machine needs **`python3` with `numpy`** on `PATH`. Point a battery at an
 origin whose PoW is off and nothing is solved and nothing is needed.
 
 ## Usage
@@ -81,7 +82,7 @@ require "kiosk/redteam"
 SERVER = ENV.fetch("SERVER_URL", "http://127.0.0.1:3000")
 
 profile = Kiosk::Redteam::Profile.new(
-  # >0 means this origin is expected to gate /auth/register with a toll.
+  # >0 means this origin is expected to gate oauth/register with a toll.
   pow_difficulty: 1,
   # The roles this origin declares (Kiosk.configuration.roles), as strings.
   declared_roles: %w[customer],
@@ -108,6 +109,7 @@ battery.absorb(runner.run([
   Kiosk::Redteam::Scenarios::CrossTenantRead.new,
   Kiosk::Redteam::Scenarios::ForgedUserId.new,
   Kiosk::Redteam::Scenarios::TokenTampering.new,
+  Kiosk::Redteam::Scenarios::StolenToken.new,
   Kiosk::Redteam::Scenarios::RegistrationWithoutPow.new,
   Kiosk::Redteam::Scenarios::DeviceGrantRoleSelfSelection.new,
 ]))
@@ -137,16 +139,17 @@ scenarios share:
 |---|---|
 | `CrossTenantRead` | B's per-user query must not return rows owned by A |
 | `ForgedUserId` | a caller-supplied `user_id` never decides ownership |
-| `PrivilegeSelfSelection` | a client-chosen registration role is ignored — the role is server-pinned |
-| `DeviceGrantRoleSelfSelection` | the claim ceremony's unauthenticated opening request refuses `role`/`scope`, at a DECLARED value as well as an invented one |
+| `PrivilegeSelfSelection` | a role in the registration body does not reach the client's token — the role is server-pinned |
+| `DeviceGrantRoleSelfSelection` | the claim ceremony's opening request, signed by a registered client, refuses `role`/`scope`, at a DECLARED value as well as an invented one |
 | `SpentResourceReuse` | a consumed resource cannot be re-activated |
 | `PayForOtherUseSelf` | B paying for A's resource does not let B use it |
 | `TokenTampering` | a JWT with a flipped claim and the original signature is 401 |
+| `StolenToken` | a real access token without its key is 401: as a bearer token, and with a DPoP proof that another key signs |
 | `RegistrationWithoutPow` | a missing or bad proof is rejected when the origin charges a toll |
-| `MandatePrincipalSwap` | B signing a mandate that carries A's identity is rejected |
-| `MandateReplay` | A's signed mandate JWS re-submitted under B's token is rejected |
+| `MandatePrincipalSwap` | B paying, with its own key, the checkout the operator signed for A is rejected |
+| `MandateReplay` | A's signed mandates re-submitted under B's token are rejected |
 | `UnpaidGatedAction` | the gated action without a prior settled payment is denied |
-| `WrongCurrencyCart` | a chain-consistent cart denominated in a currency the operator does not price in is refused at capture |
+| `WrongCurrencyPayment` | a payment mandate in a currency other than its checkout's is refused before any capture |
 | `MissingKyc` | the gated action after payment but without an attestation is denied |
 | `ExpiredKyc` | an attestation whose `exp` has passed is rejected |
 | `ForgedKyc` | an attestation with a wrong issuer or a bad signature is rejected |
@@ -154,8 +157,8 @@ scenarios share:
 Beside them the gem ships `Profile`, `Scenario`, `Verdict`, `Runner`,
 `Battery` and `LeakScan`, which decides whether a refusal leaked the runtime's
 own vocabulary, discounting needles the attack itself supplied. A scenario
-receives a `Kiosk::TestHelpers::Assistant` — register, query, run, pay with
-signed mandates, kyc, and the device-authorization request — and its
+receives a `Kiosk::TestHelpers::Assistant` — register, token, query, run, pay
+with closed AP2 mandates, kyc, and the device-authorization request — and its
 `events(principal)` is the assistant's side of `<endpoint>/events`.
 
 ## Your own beats, in the same battery
@@ -168,7 +171,7 @@ library scenario can sit in one run.
 
 `Kiosk::TestHelpers::Wire` is the raw wire: an arbitrary method at an arbitrary path with arbitrary
 headers, which is what an attack on the REQUEST rather than on the principal
-needs — a forged or absent `Authorization`, a verb nobody registered, the wrong
+needs — a forged or absent `Authorization`, a token without its key, a verb nobody registered, the wrong
 method at a real verb's path, an assertion on `Allow:` rather than on a body. A
 body that is not JSON reads as `{}` and a connection error reads as status `0`,
 so a hostile answer is asserted on instead of crashing the run; the bytes stay
@@ -183,7 +186,7 @@ client  = Kiosk::TestHelpers::Assistant.new(base_url: SERVER)
 battery = Kiosk::Redteam::Battery.new
 
 # your own beat, against your own verb
-status, rows = wire.get_json("/kiosk/my_listings", {}, wire.bearer(bob.token))
+status, rows = wire.get_json("/kiosk/my_listings", {}, wire.dpop(bob.token, bob.key))
 battery.record("CrossTenantRead", status == 200 && !ids(rows).include?(alice_row),
                "Bob's rows #{ids(rows).inspect} exclude Alice's #{alice_row}")
 

data/lib/kiosk/redteam/profile.rb

@@ -5,20 +5,20 @@ module Kiosk
     # What an origin tells the generic scenarios about itself. A nil field skips
     # the scenarios that need that surface.
     #
-    #   pow_difficulty        >0 when /register is gated by a PoW toll; 0 skips RegistrationWithoutPow
+    #   pow_difficulty        >0 when oauth/register is gated by a PoW toll; 0 skips RegistrationWithoutPow
     #   declared_roles        the roles the origin declares; DeviceGrantRoleSelfSelection needs a real one
     #   requires_kyc          whether the gated action needs a KYC attestation
-    #   currency              the ISO 4217 code the origin prices in, lower case (WrongCurrencyCart)
+    #   currency              the ISO 4217 code the origin prices in, lower case (WrongCurrencyPayment)
     #   per_user_query        query returning the caller's own rows (CrossTenantRead)
     #   row_id_key            key of a row's id in query results
     #   result_id_key         key of the new resource's id in forge_action's result
-    #   create_owned          (client, principal) -> Hash with at least :id
+    #   create_owned          (client, principal) -> Hash with at least :id, and :checkout_jwt where it is paid for
     #   forge_action          action whose caller-supplied user_id the server must ignore
     #   forge_args            (client, principal_a, principal_b) -> Hash, without user_id
     #   gated_action          action gated behind payment (and KYC when requires_kyc)
     #   gated_action_consumes false when calling gated_action twice is correct (skips SpentResourceReuse)
     #   gated_args            (owned_ref) -> Hash
-    #   pay_for               (client, principal, owned_ref) -> { intent:, cart: }
+    #   pay_for               (client, principal, owned_ref) -> the checkout_jwt that pays for owned_ref
     #   kyc_valid             (user_id) -> a valid attestation JWS
     #   kyc_expired           (user_id) -> an expired attestation JWS
     #   kyc_forged            (user_id) -> an attestation with a wrong issuer or signature

data/lib/kiosk/redteam/scenario.rb

@@ -25,6 +25,11 @@ module Kiosk
 
       private
 
+      # The client a 201 registration answer names, with the key it registered. No token yet.
+      def registered_principal(resp, key)
+        Kiosk::TestHelpers::Assistant::Principal.new(agent_id: resp.body['client_id'], user_id: nil, token: nil, key: key)
+      end
+
       # Changes a payload claim and keeps the original signature.
       def tamper_token(token)
         TokenClaims.tamper(token)

data/lib/kiosk/redteam/scenarios/device_grant_role_self_selection.rb

@@ -5,10 +5,11 @@ require 'openssl'
 module Kiosk
   module Redteam
     module Scenarios
-      # The unauthenticated device_authorization request must refuse a
-      # client-chosen role or scope. Probed with roles the origin actually
-      # declares, since a vulnerable origin refuses an undeclared one too; the
-      # role-less request must still open the ceremony.
+      # The device_authorization request, which a registered client signs with
+      # its client assertion, must refuse a client-chosen role or scope. Probed
+      # with roles the origin actually declares, since a vulnerable origin
+      # refuses an undeclared one too; the role-less request must still open
+      # the ceremony.
       class DeviceGrantRoleSelfSelection < Scenario
         # Refused by a vulnerable origin too; probed only to show both filters in the detail.
         UNDECLARED_ROLE = 'master'
@@ -21,28 +22,30 @@ module Kiosk
         end
 
         def call(client, profile)
-          wire_role, setup = wire_declared_role(client)
+          principal, setup = registered_client(client)
+          setup || attack(client, principal, profile)
+        end
+
+        private
+
+        def attack(client, principal, profile)
+          wire_role, setup = wire_declared_role(client, principal)
           return setup if setup
 
           declared = (profile.declared_roles + [wire_role]).compact.uniq
           return skip_verdict(no_declared_role_reason) if declared.empty?
 
-          probes = probe(client, declared)
-          control_ok, control_detail = control(client)
+          probes = probe(client, principal, declared)
+          control_ok, control_detail = control(client, principal)
           refused = probes.all?(&:first)
           Verdict.new(blocked: refused && control_ok, skipped: false, status: refused ? 400 : 200,
                       detail: summary(probes, control_detail, declared, wire_role))
         end
 
-        private
-
         # [refused?, detail] for each role or scope the request names.
-        def probe(client, declared)
-          pem = OpenSSL::PKey::RSA.generate(2048).public_key.to_pem
+        def probe(client, principal, declared)
           probe_labels(declared).map do |label, param, value|
-            resp = client.device_authorization(
-              client_id: 'redteam-device-grant-role', public_key: pem, param => value
-            )
+            resp = client.device_authorization(principal, param => value)
             [resp.status == 400 && body_field(resp, 'error') == 'invalid_request',
              "#{label} -> HTTP #{resp.status} error=#{body_field(resp, 'error').inspect}"]
           end
@@ -51,7 +54,7 @@ module Kiosk
         def summary(probes, control_detail, declared, wire_role)
           "#{probes.map(&:last).join('; ')}; #{control_detail} " \
             "[declared roles probed: #{declared.inspect} " \
-            "(#{wire_role.inspect} read off this origin's own registration token); " \
+            "(#{wire_role.inspect} read off this origin's own client_credentials token); " \
             'want every role/scope refused 400 invalid_request AND the role-less ' \
             'ceremony still opening]'
         end
@@ -71,38 +74,41 @@ module Kiosk
           end
         end
 
-        def control(client)
-          key  = OpenSSL::PKey::RSA.generate(2048)
-          resp = client.device_authorization(
-            client_id: 'redteam-device-grant-role', public_key: key.public_key.to_pem
-          )
+        def control(client, principal)
+          resp = client.device_authorization(principal)
           code = resp.body.is_a?(Hash) ? resp.body['user_code'].to_s : ''
           [resp.status == 200 && code.match?(USER_CODE),
            "CONTROL role-less request -> HTTP #{resp.status} user_code=#{code.inspect}"]
         end
 
-        # The `role` claim of a token this origin mints at registration.
-        def wire_declared_role(client)
-          resp = client.register_raw
-          failure = (registration_failure(resp) unless resp.status == 201)
-          return [nil, failure] if failure
+        # The client that signs every request of this scenario, or the verdict of a failed registration.
+        def registered_client(client)
+          key  = OpenSSL::PKey.generate_key('ED25519')
+          resp = client.register_raw(key:)
+          return [registered_principal(resp, key), nil] if resp.status == 201
 
-          [token_role(body_field(resp, 'access_token')), nil]
+          [nil, untested_verdict(resp.status, 'SETUP FAILED: the registration of the client that signs the probes ' \
+                                              "returned HTTP #{resp.status} #{resp.body.inspect}.")]
         end
 
-        def registration_failure(resp)
-          setup_failure(
+        # The `role` claim of the first token this origin mints for the client.
+        def wire_declared_role(client, principal)
+          resp = client.token(principal)
+          failure = setup_failure(
             resp,
-            step: 'the CONTROL registration this scenario reads a declared role from',
+            step: 'the CONTROL token request this scenario reads a declared role from',
             because: 'without a role the origin actually declares, the only probe left is an ' \
                      'invented one — which even a vulnerable origin refuses, so the battery ' \
                      'would print BLOCKED without testing anything.'
           )
+          return [nil, failure] if failure
+
+          [token_role(body_field(resp, 'access_token')), nil]
         end
 
         def no_declared_role_reason
           'this origin declares no role — `declared_roles` is empty in the profile AND the ' \
-            'token it minted at registration carries no `role` claim, so a client-chosen ' \
+            'first token it minted carries no `role` claim, so a client-chosen ' \
             'DECLARED role has nothing to name here'
         end
 

data/lib/kiosk/redteam/scenarios/mandate_principal_swap.rb

@@ -3,7 +3,7 @@
 module Kiosk
   module Redteam
     module Scenarios
-      # B pays, under its own token and key, mandates claiming A's identity: must be refused.
+      # B pays, under its own token and key, the checkout the operator signed for A: must be refused.
       class MandatePrincipalSwap < Scenario
         def initialize
           super(name: 'MandatePrincipalSwap')
@@ -19,12 +19,11 @@ module Kiosk
         def attack(client, profile)
           a = client.register!
           b = client.register!
-          mandates = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
-          resp = client.pay(b, intent: mandates[:intent], cart: mandates[:cart])
+          resp = client.pay(b, profile.pay_for.call(client, a, profile.create_owned.call(client, a)))
 
           # Only 403: a 402 or 401 means the swap was never examined.
           verdict_from(resp, expect: 403, expect_code: %w[forbidden rls_denied],
-                             detail: "principal-swap mandate accepted (HTTP #{resp.status})")
+                             detail: "B paid the checkout signed for A (HTTP #{resp.status})")
         end
       end
     end

data/lib/kiosk/redteam/scenarios/mandate_replay.rb

@@ -3,7 +3,7 @@
 module Kiosk
   module Redteam
     module Scenarios
-      # B re-submits A's already-used mandate JWS under B's token: must be refused.
+      # B re-submits A's already-used mandates, signed by A's key, under B's token: must be refused.
       class MandateReplay < Scenario
         def initialize
           super(name: 'MandateReplay')
@@ -19,23 +19,14 @@ module Kiosk
         def attack(client, profile)
           a = client.register!
           b = client.register!
-          mandates = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
-          signed = signed_mandates(client, a, mandates)
-          client.pay(a, intent: mandates[:intent], cart: mandates[:cart])
+          signed = Kiosk::TestHelpers::Mandate.pay(a.key, profile.pay_for.call(client, a, profile.create_owned.call(client, a)))
+          client.pay_raw(a, **signed)
           resp = client.pay_raw(b, **signed)
 
           # Only 403: a 402 decline would mean the replay was never verified.
           verdict_from(resp, expect: 403, expect_code: %w[forbidden rls_denied],
                              detail: "mandate replay accepted under B's token (HTTP #{resp.status})")
         end
-
-        def signed_mandates(client, principal, mandates)
-          {
-            intent_jws: client.sign_mandate(principal, mandates[:intent]),
-            cart_jws: client.sign_mandate(principal, mandates[:cart]),
-            payment_jws: client.sign_mandate(principal, client.payment_mandate(principal, cart: mandates[:cart]))
-          }
-        end
       end
     end
   end

data/lib/kiosk/redteam/scenarios/pay_for_other_use_self.rb

@@ -3,8 +3,8 @@
 module Kiosk
   module Redteam
     module Scenarios
-      # B pays a mandate that references A's resource, then invokes the gated
-      # action on it: the ownership gate must refuse at use time, not only at pay time.
+      # B pays the checkout of A's resource, then invokes the gated action on
+      # it: the ownership gate must refuse at use time, not only at pay time.
       class PayForOtherUseSelf < Scenario
         KYC_BECAUSE = 'B would otherwise be refused for want of KYC, and this scenario would ' \
                       'credit that refusal to the ownership gate it exists to prove.'

data/lib/kiosk/redteam/scenarios/privilege_self_selection.rb

@@ -1,10 +1,13 @@
 # frozen_string_literal: true
 
+require 'openssl'
+
 module Kiosk
   module Redteam
     module Scenarios
-      # A role injected into /auth/register must not reach the issued token.
-      # A refusal counts only if the same registration without the role succeeds.
+      # A role injected into the registration body must not reach the token
+      # that the client then gets. A refusal counts only if the same
+      # registration without the role succeeds.
       class PrivilegeSelfSelection < Scenario
         ESCALATED_ROLE = 'master'
 
@@ -13,15 +16,24 @@ module Kiosk
         end
 
         def call(client, _profile)
-          resp = client.register_raw(wire_role: ESCALATED_ROLE)
+          key  = OpenSSL::PKey.generate_key('ED25519')
+          resp = client.register_raw(wire_role: ESCALATED_ROLE, key:)
           return refusal_verdict(client, resp) unless resp.status == 201
-          return blocked_verdict(201) unless TokenClaims.claims(access_token(resp))&.fetch('role', nil) == ESCALATED_ROLE
 
-          breach_verdict(201, "issued token carries the self-selected role #{ESCALATED_ROLE.inspect}")
+          issued = client.token(registered_principal(resp, key))
+          setup_failure(issued, step: 'the token request after the registration with the injected role',
+                                because: 'without a token there is no role to read.') || role_verdict(issued)
         end
 
         private
 
+        def role_verdict(issued)
+          role = TokenClaims.claims(issued.body['access_token'])&.fetch('role', nil)
+          return blocked_verdict(201) unless [role, issued.body['scope']].include?(ESCALATED_ROLE)
+
+          breach_verdict(issued.status, "issued token carries the self-selected role #{ESCALATED_ROLE.inspect}")
+        end
+
         def refusal_verdict(client, resp)
           if resp.status >= 500 || resp.status.zero?
             return breach_verdict(resp.status,
@@ -33,18 +45,14 @@ module Kiosk
         end
 
         def control_failure(control, resp)
-          return nil if control.status == 201 && access_token(control)
+          return nil if control.status == 201 && control.body.is_a?(Hash) && control.body['client_id']
 
           breach_verdict(control.status,
-                         'CONTROL FAILED: an honest registration must return 201 with an ' \
-                         "access_token — got HTTP #{control.status} #{control.body.inspect}. " \
+                         'CONTROL FAILED: an honest registration must return 201 with a ' \
+                         "client_id — got HTTP #{control.status} #{control.body.inspect}. " \
                          "The injected registration's HTTP #{resp.status} refusal therefore " \
                          'says nothing about whether the role is pinned server-side.')
         end
-
-        def access_token(resp)
-          resp.body.is_a?(Hash) ? resp.body['access_token'] : nil
-        end
       end
     end
   end

data/lib/kiosk/redteam/scenarios/registration_without_pow.rb

@@ -4,7 +4,7 @@ module Kiosk
   module Redteam
     module Scenarios
       # With a PoW gate, registration with no proof or a wrong one must be refused
-      # (not a 201, no token, not a crash), while a solved control registration succeeds.
+      # (not a 201, no client_id, not a crash), while a solved control registration succeeds.
       class RegistrationWithoutPow < Scenario
         def initialize
           super(name: 'RegistrationWithoutPow')
@@ -38,12 +38,12 @@ module Kiosk
         end
 
         def honest_registration?(control)
-          control.status == 201 && token_of(control)
+          control.status == 201 && client_id_of(control)
         end
 
         def control_problem(control)
           'CONTROL FAILED: a properly solved registration must return 201 with ' \
-            "an access_token — got HTTP #{control.status} #{control.body.inspect}. " \
+            "a client_id — got HTTP #{control.status} #{control.body.inspect}. " \
             'A server that refuses every registration refuses the two unproven ' \
             'ones too, which says nothing about a PoW gate.'
         end
@@ -55,14 +55,14 @@ module Kiosk
             return "#{label} crashed (HTTP #{resp.status}: #{resp.body.inspect}) — " \
                    'a crash is not a gate'
           end
-          return nil unless token_of(resp)
+          return nil unless client_id_of(resp)
 
-          "#{label} returned an access_token on HTTP #{resp.status}"
+          "#{label} returned a client_id on HTTP #{resp.status}"
         end
 
-        def token_of(resp)
+        def client_id_of(resp)
           body = resp.body
-          body.is_a?(Hash) ? body['access_token'] : nil
+          body.is_a?(Hash) ? body['client_id'] : nil
         end
       end
     end

data/lib/kiosk/redteam/scenarios/stolen_token.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # A copied access token without its private key buys no request (RFC 9449):
+      # sent as a bearer token, or with a DPoP proof that another key signs, it
+      # must be refused 401. The token with its own key is the control.
+      class StolenToken < Scenario
+        def initialize
+          super(name: 'StolenToken')
+        end
+
+        def call(client, profile)
+          verb = profile.per_user_query
+          return skipped if verb.nil?
+
+          victim  = client.register!
+          control = client.query(victim, name: verb)
+          return vacuous(control) unless control.status == 200
+
+          accepted(attacks(client, victim, verb))
+        end
+
+        private
+
+        def skipped = Verdict.new(blocked: false, skipped: true, status: 0, detail: TokenTampering::NO_ROUTED_VERB)
+
+        # Blocked when every attack was refused 401; else the first accepted one.
+        def accepted(attacks)
+          label, resp = attacks.find { |_, answer| !verdict_from(answer, expect: 401).blocked }
+          return blocked_verdict(401) unless resp
+
+          breach_verdict(resp.status, "a stolen token was accepted #{label} (HTTP #{resp.status})")
+        end
+
+        def vacuous(control)
+          breach_verdict(control.status, "the token with its own key was refused (HTTP #{control.status}): the refusals prove nothing")
+        end
+
+        def attacks(client, victim, verb)
+          path = "/kiosk/#{verb}"
+          { 'as a bearer token' => client.wire.get(path, {}, 'Authorization' => "Bearer #{victim.token}"),
+            "with the thief's own key" => client.query(victim.with(key: OpenSSL::PKey.generate_key('ED25519')), name: verb) }
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/token_tampering.rb

@@ -31,7 +31,7 @@ module Kiosk
             agent_id: principal.agent_id,
             user_id: principal.user_id,
             token: tamper_token(principal.token),
-            rsa_key: principal.rsa_key
+            key: principal.key
           )
         end
       end

data/lib/kiosk/redteam/scenarios/{wrong_currency_cart.rb → wrong_currency_payment.rb}

@@ -3,13 +3,13 @@
 module Kiosk
   module Redteam
     module Scenarios
-      # A consistent mandate pair in a currency the operator does not price in
-      # must be refused by the operator at capture.
-      class WrongCurrencyCart < Scenario
+      # A payment mandate in a currency other than the checkout's, with the
+      # same amount, must be refused before any capture.
+      class WrongCurrencyPayment < Scenario
         ALTERNATIVES = %w[usd eur gbp jpy].freeze
 
         def initialize
-          super(name: 'WrongCurrencyCart')
+          super(name: 'WrongCurrencyPayment')
         end
 
         def call(client, profile)
@@ -25,12 +25,12 @@ module Kiosk
         def attack(client, profile, native)
           foreign = ALTERNATIVES.find { |c| c != native }
           a = client.register!
-          mandates = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
-          resp = client.pay(a, intent: mandates[:intent].merge(currency: foreign),
-                               cart: mandates[:cart].merge(currency: foreign))
-          # A 401 would mean the cart never reached the operator's capture check.
+          checkout_jwt = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
+          amount = JWT.decode(checkout_jwt, nil, false).first['total_amount_cents']
+          resp = client.pay_raw(a, **mandates_with_payment(a, checkout_jwt, payment_amount: { amount:, currency: foreign }))
+          # A 401 would mean the payment never reached the mandate check.
           verdict_from(resp, expect: 403,
-                             detail: "a #{foreign} cart settled at a #{native.upcase} operator " \
+                             detail: "a #{foreign} payment of a #{native.upcase} checkout settled " \
                                      "(HTTP #{resp.status})")
         end
       end

data/lib/kiosk/redteam/staging.rb

@@ -20,8 +20,21 @@ module Kiosk
 
       # Pays for +owned_ref+ as +payer+ and answers the pay response.
       def pay_for_owned(client, payer, profile, owned_ref)
-        mandates = profile.pay_for.call(client, payer, owned_ref)
-        client.pay(payer, intent: mandates[:intent], cart: mandates[:cart])
+        client.pay(payer, profile.pay_for.call(client, payer, owned_ref))
+      end
+
+      # The claims of +checkout_jwt+ with +changes+, signed again by a key the operator never held.
+      def tampered_checkout(checkout_jwt, **changes)
+        claims, header = JWT.decode(checkout_jwt, nil, false)
+        JWT.encode(claims.merge(changes.transform_keys(&:to_s)), OpenSSL::PKey.generate_key('ED25519'), 'EdDSA',
+                   header.slice('kid', 'typ'))
+      end
+
+      # The two mandates for +checkout_jwt+, with the payment mandate's fields changed and signed again.
+      def mandates_with_payment(principal, checkout_jwt, **changes)
+        mandates = Kiosk::TestHelpers::Mandate.pay(principal.key, checkout_jwt)
+        payment = Kiosk::TestHelpers::Mandate.content(mandates[:payment]).merge(changes.transform_keys(&:to_s))
+        mandates.merge(payment: Kiosk::TestHelpers::Mandate.sign(principal.key, payment))
       end
 
       # Pays for +owned_ref+ before a gated action. Answers a setup-failure verdict or nil.

data/lib/kiosk/redteam/version.rb

@@ -2,6 +2,6 @@
 
 module Kiosk
   module Redteam
-    VERSION = '0.5.20'
+    VERSION = '0.6.1'
   end
 end

data/lib/kiosk/redteam.rb

@@ -14,6 +14,7 @@ require 'kiosk/redteam/scenarios/forged_user_id'
 require 'kiosk/redteam/scenarios/mandate_principal_swap'
 require 'kiosk/redteam/scenarios/mandate_replay'
 require 'kiosk/redteam/scenarios/token_tampering'
+require 'kiosk/redteam/scenarios/stolen_token'
 require 'kiosk/redteam/scenarios/registration_without_pow'
 require 'kiosk/redteam/scenarios/privilege_self_selection'
 require 'kiosk/redteam/scenarios/device_grant_role_self_selection'
@@ -23,7 +24,7 @@ require 'kiosk/redteam/scenarios/expired_kyc'
 require 'kiosk/redteam/scenarios/forged_kyc'
 require 'kiosk/redteam/scenarios/spent_resource_reuse'
 require 'kiosk/redteam/scenarios/pay_for_other_use_self'
-require 'kiosk/redteam/scenarios/wrong_currency_cart'
+require 'kiosk/redteam/scenarios/wrong_currency_payment'
 
 module Kiosk
   # Adversarial regression harness: drives hostile HTTP scenarios against a

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiosk-redteam
 version: !ruby/object:Gem::Version
-  version: 0.5.20
+  version: 0.6.1
 platform: ruby
 authors:
 - Phil Pirozhkov
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 description: |
   kiosk-redteam drives hostile HTTP scenarios against any Kiosk provider
   and asserts each attack is correctly blocked — a deliberate refusal, never
@@ -76,9 +76,10 @@ files:
 - lib/kiosk/redteam/scenarios/privilege_self_selection.rb
 - lib/kiosk/redteam/scenarios/registration_without_pow.rb
 - lib/kiosk/redteam/scenarios/spent_resource_reuse.rb
+- lib/kiosk/redteam/scenarios/stolen_token.rb
 - lib/kiosk/redteam/scenarios/token_tampering.rb
 - lib/kiosk/redteam/scenarios/unpaid_gated_action.rb
-- lib/kiosk/redteam/scenarios/wrong_currency_cart.rb
+- lib/kiosk/redteam/scenarios/wrong_currency_payment.rb
 - lib/kiosk/redteam/staging.rb
 - lib/kiosk/redteam/token_claims.rb
 - lib/kiosk/redteam/verdict.rb