kiosk-redteam 0.5.20

data/lib/kiosk/redteam/scenarios/forged_user_id.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # B calls forge_action with A's user_id injected; the server must take the
+      # principal from the token, so A must not see the new resource.
+      class ForgedUserId < Scenario
+        # The protocol's name for a principal everywhere it appears.
+        FORGED_ARG = 'user_id'
+
+        def initialize
+          super(name: 'ForgedUserId')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, forge_action: 'no forge_action', forge_args: 'no forge_args') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          b = client.register!
+          forged_args = profile.forge_args.call(client, a, b).merge(FORGED_ARG.to_sym => a.user_id)
+          resp = client.run(b, name: profile.forge_action, **forged_args)
+          refusal_verdict(resp, profile) || ownership_verdict(client, a, resp, profile)
+        end
+
+        # The verdict when the origin refused the forged call, else nil.
+        def refusal_verdict(resp, profile)
+          stall = payment_required_stall(resp, step: "the forged-user_id #{profile.forge_action} call")
+          return stall if stall
+          return contract_refusal(resp) if contract_refusal?(resp)
+          return verdict_from(resp, expect: [401, 403], detail: 'forge_action rejected') if Kiosk::Redteam.blocked?(resp)
+
+          nil
+        end
+
+        # A 400 naming the injected property is the input schema refusing it (§8.1).
+        def contract_refusal?(resp)
+          resp.status == 400 && Kiosk::Redteam.error_code(resp) == 'bad_request' &&
+            refusal_names?(resp, FORGED_ARG)
+        end
+
+        def contract_refusal(resp)
+          blocked_verdict(resp.status,
+                          'forge_action refused by the declared input contract: 400 bad_request naming ' \
+                          "#{FORGED_ARG.inspect} — the principal is not an accepted argument")
+        end
+
+        def ownership_verdict(client, owner, resp, profile)
+          # Without per_user_query ownership cannot be verified, so this cannot pass.
+          unless profile.per_user_query
+            return breach_verdict(resp.status,
+                                  "forge_action returned #{resp.status}; cannot verify ownership (no per_user_query)")
+          end
+
+          new_id = extract_id(resp, profile.result_id_key)
+          return leak_verdict(client, owner, resp, profile, new_id) if new_id
+
+          breach_verdict(resp.status,
+                         "forge_action returned #{resp.status} but result_id_key=#{profile.result_id_key.inspect} " \
+                         'not found in response; cannot confirm ownership was enforced')
+        end
+
+        def leak_verdict(client, owner, resp, profile, new_id)
+          answer = client.query(owner, name: profile.per_user_query)
+          return unreadable(answer, profile) unless rows_answer?(answer)
+          return blocked_verdict(resp.status) if rows_from(answer).none? { |r| r[profile.row_id_key].to_s == new_id.to_s }
+
+          breach_verdict(resp.status,
+                         "forged user_id=#{owner.user_id} was honoured; resource id=#{new_id} visible in A's rows")
+        end
+
+        # An error or another shape would read as no rows, which proves nothing.
+        def rows_answer?(answer) = answer.status == 200 && answer.body.is_a?(Array)
+
+        def unreadable(answer, profile)
+          breach_verdict(answer.status, "A's #{profile.per_user_query} answered HTTP #{answer.status} " \
+                                        'without a rows array; cannot confirm ownership was enforced')
+        end
+
+        def refusal_names?(response, key)
+          return false if key.nil? || key.to_s.empty?
+
+          body = response.body
+          return false unless body.is_a?(Hash)
+
+          "#{body['detail']} #{body['hint']}".include?(key.to_s)
+        end
+
+        # An action answers its own object (§8.2); a `value` key of the operator's own is read too.
+        def extract_id(response, result_id_key)
+          body = response.body
+          return nil unless body.is_a?(Hash)
+
+          nested = body['value']
+          source = nested.is_a?(Hash) && nested.key?(result_id_key) ? nested : body
+
+          v = source[result_id_key]
+          v&.to_s&.empty? == false ? v : nil
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/kyc_attack.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # Submits a bad attestation to /kyc, then pays and runs the gated action.
+      # The attack is refused when either step refuses it.
+      module KycAttack
+        private
+
+        def kyc_attack(client, profile, attestation:, kind:, check:)
+          a = client.register!
+          kyc_resp = client.kyc(a, attestation_jws: attestation.call(a.user_id))
+          kyc_refusal(kyc_resp, kind) || gated_after_kyc(client, profile, a, kind: kind, check: check)
+        end
+
+        # The verdict when /kyc already answered the attack, else nil.
+        def kyc_refusal(kyc_resp, kind)
+          # A metered /kyc answers 402 before the attestation is examined.
+          stall = payment_required_stall(kyc_resp, step: "the #{kind} attestation this scenario submits to /kyc")
+          return stall if stall
+          # 401 and 403 both mean the attestation did not take effect.
+          return verdict_from(kyc_resp, detail: "#{kind} KYC was accepted by /kyc endpoint") if Kiosk::Redteam.blocked?(kyc_resp)
+
+          nil
+        end
+
+        def gated_after_kyc(client, profile, principal, kind:, check:)
+          owned_ref = profile.create_owned.call(client, principal)
+          failure = stage_payment(
+            client, principal, profile, owned_ref,
+            because: 'The gated action would then be refused by the payment gate, and this ' \
+                     "scenario would credit that refusal to the #{check}."
+          )
+          return failure if failure
+
+          resp = run_gated(client, principal, profile, owned_ref)
+          verdict_from(resp, detail: "#{kind} KYC accepted everywhere; gated action returned #{resp.status}")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/mandate_principal_swap.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # B pays, under its own token and key, mandates claiming A's identity: must be refused.
+      class MandatePrincipalSwap < Scenario
+        def initialize
+          super(name: 'MandatePrincipalSwap')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, pay_for: 'no pay_for', create_owned: 'no create_owned') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          b = client.register!
+          mandates = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
+          resp = client.pay(b, intent: mandates[:intent], cart: mandates[:cart])
+
+          # Only 403: a 402 or 401 means the swap was never examined.
+          verdict_from(resp, expect: 403, expect_code: %w[forbidden rls_denied],
+                             detail: "principal-swap mandate accepted (HTTP #{resp.status})")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/mandate_replay.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # B re-submits A's already-used mandate JWS under B's token: must be refused.
+      class MandateReplay < Scenario
+        def initialize
+          super(name: 'MandateReplay')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, pay_for: 'no pay_for', create_owned: 'no create_owned') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          b = client.register!
+          mandates = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
+          signed = signed_mandates(client, a, mandates)
+          client.pay(a, intent: mandates[:intent], cart: mandates[:cart])
+          resp = client.pay_raw(b, **signed)
+
+          # Only 403: a 402 decline would mean the replay was never verified.
+          verdict_from(resp, expect: 403, expect_code: %w[forbidden rls_denied],
+                             detail: "mandate replay accepted under B's token (HTTP #{resp.status})")
+        end
+
+        def signed_mandates(client, principal, mandates)
+          {
+            intent_jws: client.sign_mandate(principal, mandates[:intent]),
+            cart_jws: client.sign_mandate(principal, mandates[:cart]),
+            payment_jws: client.sign_mandate(principal, client.payment_mandate(principal, cart: mandates[:cart]))
+          }
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/missing_kyc.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # The gated action must be refused, after payment, when no KYC was submitted.
+      class MissingKyc < Scenario
+        def initialize
+          super(name: 'MissingKyc')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, requires_kyc: 'requires_kyc is false', gated_action: 'no gated_action',
+                               create_owned: 'no create_owned', pay_for: 'no pay_for') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          # No KYC call here — that is the attack.
+          owned_ref = profile.create_owned.call(client, a)
+          failure = stage_payment(
+            client, a, profile, owned_ref,
+            because: 'The gated action would then be refused by the payment gate, and this ' \
+                     'scenario would credit that refusal to the KYC gate it is meant to prove.'
+          )
+          return failure if failure
+
+          resp = run_gated(client, a, profile, owned_ref)
+          # 403 kyc_required, or 401 from an origin that treats the principal as unauthenticated.
+          verdict_from(resp, detail: "gated action succeeded without KYC (HTTP #{resp.status})")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/pay_for_other_use_self.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # B pays a mandate that references A's resource, then invokes the gated
+      # action on it: the ownership gate must refuse at use time, not only at pay time.
+      class PayForOtherUseSelf < Scenario
+        KYC_BECAUSE = 'B would otherwise be refused for want of KYC, and this scenario would ' \
+                      'credit that refusal to the ownership gate it exists to prove.'
+
+        def initialize
+          super(name: 'PayForOtherUseSelf')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, gated_action: 'no gated_action', create_owned: 'no create_owned',
+                               pay_for: 'no pay_for') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          b = client.register!
+          failure = stage_kyc(client, b, profile, step: 'the valid KYC attestation this scenario stages for B',
+                                                  because: KYC_BECAUSE)
+          return failure if failure
+
+          owned_ref_a = profile.create_owned.call(client, a)
+          pay_verdict(pay_for_owned(client, b, profile, owned_ref_a)) || use(client, b, profile, owned_ref_a)
+        end
+
+        # The verdict when B's payment already decided the attack, else nil.
+        def pay_verdict(pay_resp)
+          # Only 403 forbidden / rls_denied at pay time is the same ownership gate, moved earlier.
+          return blocked_verdict(pay_resp.status, 'blocked at pay step (early ownership check)') if pay_resp.status == 403 && %w[forbidden rls_denied].include?(error_code(pay_resp))
+
+          # Any other non-200 at pay time means the attack was never attempted.
+          setup_failure(
+            pay_resp,
+            step: "B's payment for A's resource",
+            because: 'A 403 forbidden/rls_denied here would be the ownership gate firing early ' \
+                     'and is scored as a pass; any other refusal (a 402 decline, a 401 expired ' \
+                     'token) simply means the attack below was never attempted.'
+          )
+        end
+
+        # Only the ownership gate counts: B did pay, so a 402 or kyc_required is another gate.
+        def use(client, principal, profile, owned_ref)
+          resp = run_gated(client, principal, profile, owned_ref)
+          verdict_from(resp, expect: 403, expect_code: %w[forbidden rls_denied],
+                             detail: "B used A's resource after paying for it (C2 breach, HTTP #{resp.status})")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/privilege_self_selection.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # A role injected into /auth/register must not reach the issued token.
+      # A refusal counts only if the same registration without the role succeeds.
+      class PrivilegeSelfSelection < Scenario
+        ESCALATED_ROLE = 'master'
+
+        def initialize
+          super(name: 'PrivilegeSelfSelection')
+        end
+
+        def call(client, _profile)
+          resp = client.register_raw(wire_role: ESCALATED_ROLE)
+          return refusal_verdict(client, resp) unless resp.status == 201
+          return blocked_verdict(201) unless TokenClaims.claims(access_token(resp))&.fetch('role', nil) == ESCALATED_ROLE
+
+          breach_verdict(201, "issued token carries the self-selected role #{ESCALATED_ROLE.inspect}")
+        end
+
+        private
+
+        def refusal_verdict(client, resp)
+          if resp.status >= 500 || resp.status.zero?
+            return breach_verdict(resp.status,
+                                  "register crashed on the injected role (HTTP #{resp.status}: " \
+                                  "#{resp.body.inspect}) — a crash is not a gate")
+          end
+
+          control_failure(client.register_raw, resp) || blocked_verdict(resp.status)
+        end
+
+        def control_failure(control, resp)
+          return nil if control.status == 201 && access_token(control)
+
+          breach_verdict(control.status,
+                         'CONTROL FAILED: an honest registration must return 201 with an ' \
+                         "access_token — got HTTP #{control.status} #{control.body.inspect}. " \
+                         "The injected registration's HTTP #{resp.status} refusal therefore " \
+                         'says nothing about whether the role is pinned server-side.')
+        end
+
+        def access_token(resp)
+          resp.body.is_a?(Hash) ? resp.body['access_token'] : nil
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/registration_without_pow.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # With a PoW gate, registration with no proof or a wrong one must be refused
+      # (not a 201, no token, not a crash), while a solved control registration succeeds.
+      class RegistrationWithoutPow < Scenario
+        def initialize
+          super(name: 'RegistrationWithoutPow')
+        end
+
+        def call(client, profile)
+          return skip_verdict('pow_difficulty is 0 (no PoW gate)') unless profile.pow_difficulty.positive?
+
+          attack(client)
+        end
+
+        private
+
+        def attack(client)
+          attempts = [['pow: :skip', client.register_raw(pow: :skip)], ['pow: "0"', client.register_raw(pow: '0')]]
+          problems = attempts.filter_map { |label, resp| not_a_pow_rejection(label, resp) }
+          control = control_registration(client, problems)
+
+          Verdict.new(blocked: problems.empty?, skipped: false,
+                      status: (control || attempts.last.last).status, detail: problems.join('; '))
+        end
+
+        # The control costs a real solve, so it runs only when both attempts were refused.
+        # A failed control appends its problem.
+        def control_registration(client, problems)
+          return nil unless problems.empty?
+
+          control = client.register_raw
+          problems << control_problem(control) unless honest_registration?(control)
+          control
+        end
+
+        def honest_registration?(control)
+          control.status == 201 && token_of(control)
+        end
+
+        def control_problem(control)
+          'CONTROL FAILED: a properly solved registration must return 201 with ' \
+            "an access_token — got HTTP #{control.status} #{control.body.inspect}. " \
+            'A server that refuses every registration refuses the two unproven ' \
+            'ones too, which says nothing about a PoW gate.'
+        end
+
+        # Why this attempt is not a PoW refusal, or nil when it is.
+        def not_a_pow_rejection(label, resp)
+          return "#{label} returned 201 — registration succeeded with no proof" if resp.status == 201
+          if resp.status >= 500 || resp.status.zero?
+            return "#{label} crashed (HTTP #{resp.status}: #{resp.body.inspect}) — " \
+                   'a crash is not a gate'
+          end
+          return nil unless token_of(resp)
+
+          "#{label} returned an access_token on HTTP #{resp.status}"
+        end
+
+        def token_of(resp)
+          body = resp.body
+          body.is_a?(Hash) ? body['access_token'] : nil
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/spent_resource_reuse.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # A consumed resource cannot be used again: the second gated_action call
+      # must be refused. Skipped when gated_action_consumes is false.
+      class SpentResourceReuse < Scenario
+        KYC_BECAUSE = 'The first, legitimate use below would then fail for want of KYC, and ' \
+                      'the re-use this scenario tests would never be reached.'
+        REUSE_BECAUSE = 'The resource is then not spent, so the re-use this scenario tests would never be reached.'
+
+        def initialize
+          super(name: 'SpentResourceReuse')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, gated_action: 'no gated_action', create_owned: 'no create_owned',
+                               pay_for: 'no pay_for', gated_action_consumes: 'gated_action spends nothing') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          failure = stage_kyc(client, a, profile, step: 'the valid KYC attestation this scenario stages',
+                                                  because: KYC_BECAUSE)
+          return failure if failure
+
+          owned_ref = profile.create_owned.call(client, a)
+          stage_payment(client, a, profile, owned_ref, because: REUSE_BECAUSE) ||
+            setup_failure(run_gated(client, a, profile, owned_ref),
+                          step: 'the first, legitimate gated_action', because: REUSE_BECAUSE) ||
+            reuse(client, a, profile, owned_ref)
+        end
+
+        # Only the resource-state gate's 403 counts: A paid, and the first use succeeded.
+        def reuse(client, principal, profile, owned_ref)
+          resp = run_gated(client, principal, profile, owned_ref)
+          verdict_from(resp, expect: 403, expect_code: %w[forbidden rls_denied],
+                             detail: "spent resource re-activated (HTTP #{resp.status})")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/token_tampering.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # A token whose claim was changed without re-signing must be refused 401.
+      # The probe dials per_user_query: an unrouted verb answers 404 before any credential is read.
+      class TokenTampering < Scenario
+        def initialize
+          super(name: 'TokenTampering')
+        end
+
+        NO_ROUTED_VERB = 'this profile declares no `per_user_query`, so there is no verb this ' \
+                         'origin is known to route — and a name it does not route answers a ' \
+                         'routing 404 before the credential is read, which would score a block ' \
+                         'the token check never made. Declare `per_user_query:` to run this beat.'
+
+        def call(client, profile)
+          verb = profile.per_user_query
+          return Verdict.new(blocked: false, skipped: true, status: 0, detail: NO_ROUTED_VERB) if verb.nil?
+
+          resp = client.query(tampered(client.register!), name: verb)
+          # A broken signature is an authentication failure: 403 or 402 would mean it was accepted.
+          verdict_from(resp, expect: 401, detail: "tampered token accepted (HTTP #{resp.status})")
+        end
+
+        private
+
+        def tampered(principal)
+          Kiosk::TestHelpers::Assistant::Principal.new(
+            agent_id: principal.agent_id,
+            user_id: principal.user_id,
+            token: tamper_token(principal.token),
+            rsa_key: principal.rsa_key
+          )
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/unpaid_gated_action.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # The gated action must be refused when nothing was paid for the resource.
+      class UnpaidGatedAction < Scenario
+        def initialize
+          super(name: 'UnpaidGatedAction')
+        end
+
+        def call(client, profile)
+          skip_unless(profile, gated_action: 'no gated_action', create_owned: 'no create_owned') ||
+            attack(client, profile)
+        end
+
+        private
+
+        def attack(client, profile)
+          a = client.register!
+          # A refused attestation would let the KYC gate answer in the payment gate's name.
+          failure = stage_kyc(
+            client, a, profile,
+            step: 'the valid KYC attestation this scenario stages',
+            because: 'Without it the principal is also un-attested, so the refusal below ' \
+                     'would be the KYC gate rather than the payment gate under test.'
+          )
+          return failure if failure
+
+          resp = run_gated(client, a, profile, profile.create_owned.call(client, a))
+          # 401 or 403; a 402 cannot say which of its three codes answered.
+          verdict_from(resp, detail: "gated action succeeded without payment (HTTP #{resp.status})")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/scenarios/wrong_currency_cart.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    module Scenarios
+      # A consistent mandate pair in a currency the operator does not price in
+      # must be refused by the operator at capture.
+      class WrongCurrencyCart < Scenario
+        ALTERNATIVES = %w[usd eur gbp jpy].freeze
+
+        def initialize
+          super(name: 'WrongCurrencyCart')
+        end
+
+        def call(client, profile)
+          native = profile.currency.to_s.downcase
+          return skip_verdict('no currency') if native.empty?
+
+          skip_unless(profile, create_owned: 'no create_owned', pay_for: 'no pay_for') ||
+            attack(client, profile, native)
+        end
+
+        private
+
+        def attack(client, profile, native)
+          foreign = ALTERNATIVES.find { |c| c != native }
+          a = client.register!
+          mandates = profile.pay_for.call(client, a, profile.create_owned.call(client, a))
+          resp = client.pay(a, intent: mandates[:intent].merge(currency: foreign),
+                               cart: mandates[:cart].merge(currency: foreign))
+          # A 401 would mean the cart never reached the operator's capture check.
+          verdict_from(resp, expect: 403,
+                             detail: "a #{foreign} cart settled at a #{native.upcase} operator " \
+                                     "(HTTP #{resp.status})")
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/redteam/staging.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Redteam
+    # Setup steps the scenarios share. Mixed into Scenario as private methods.
+    module Staging
+      private
+
+      def submit_valid_kyc(client, principal, profile)
+        return nil unless profile.kyc_valid
+
+        client.kyc(principal, attestation_jws: profile.kyc_valid.call(principal.user_id))
+      end
+
+      # Submits a valid attestation when the profile requires KYC. Answers a setup-failure verdict or nil.
+      def stage_kyc(client, principal, profile, step:, because:)
+        kyc_resp = (submit_valid_kyc(client, principal, profile) if profile.requires_kyc)
+        setup_failure(kyc_resp, step: step, because: because)
+      end
+
+      # Pays for +owned_ref+ as +payer+ and answers the pay response.
+      def pay_for_owned(client, payer, profile, owned_ref)
+        mandates = profile.pay_for.call(client, payer, owned_ref)
+        client.pay(payer, intent: mandates[:intent], cart: mandates[:cart])
+      end
+
+      # Pays for +owned_ref+ before a gated action. Answers a setup-failure verdict or nil.
+      def stage_payment(client, principal, profile, owned_ref, because:)
+        setup_failure(pay_for_owned(client, principal, profile, owned_ref),
+                      step: 'the payment this scenario stages before the gated action', because: because)
+      end
+
+      def run_gated(client, principal, profile, owned_ref)
+        gated_args = profile.gated_args ? profile.gated_args.call(owned_ref) : { id: owned_ref[:id] }
+        client.run(principal, name: profile.gated_action, **gated_args)
+      end
+
+      # A query answers a bare Array (§8.2); any other body reads as no rows.
+      def rows_from(response)
+        body = response.body
+        body.is_a?(Array) ? body : []
+      end
+    end
+  end
+end