kiosk-server 0.5.20 → 0.6.1

data/lib/kiosk/server/wire_rendering.rb

@@ -108,7 +108,7 @@ module Kiosk
         when 'pow_required'
           %(Kiosk-PoW realm="#{issuer}")
         when 'payment_setup_required'
-          %(Payment realm="#{issuer}", method="ap2")
+          %(Kiosk-Payment-Setup realm="#{issuer}")
         end
       end
     end

data/lib/kiosk/server.rb

@@ -10,6 +10,8 @@ require 'active_support/core_ext' # the core extensions a Rails host loads, whic
 require 'zeitwerk'
 
 Zeitwerk::Loader.for_gem_extension(Kiosk).setup
+# Registers the JOSE algorithm EdDSA with ruby-jwt.
+require_relative 'server/eddsa'
 
 module Kiosk
   module Server

data/lib/kiosk/skill_link.rb

@@ -5,12 +5,16 @@ require 'active_support/concern'
 module Kiosk
   # `include Kiosk::SkillLink` in a page controller: every answer carries
   # `Link: <skill_url>; rel="kiosk"`, the discovery signal for a client that
-  # does not read HTML.
+  # does not read HTML, and the RFC 9727 `api-catalog` link.
   module SkillLink
     extend ActiveSupport::Concern
 
+    API_CATALOG = '</.well-known/api-catalog>; rel="api-catalog"'
+
     included do
-      before_action { response.set_header('Link', %(<#{Kiosk.configuration.skill_url}>; rel="kiosk")) }
+      before_action do
+        response.set_header('Link', %(<#{Kiosk.configuration.skill_url}>; rel="kiosk", #{API_CATALOG}))
+      end
     end
   end
 end

data/listen.py

@@ -8,10 +8,15 @@ cadence to invent.
 
     python3 listen.py --url wss://shop.example/kiosk/events \
                       --token-file ~/.kiosk/https_shop.example_443/token \
+                      --proof-command "python3 ~/.kiosk/dpop.py ~/.kiosk/https_shop.example_443/key.pem" \
                       --topic order_delivery:<order-id>
 
-The bearer token is read from a file, never from the command line, where every
-process listing and shell history would show it.
+The access token is read from a file, never from the command line, where every
+process listing and shell history would show it. The token works only with a
+DPoP proof (RFC 9449) that your private key signs. This file never reads that
+key: before each connection it runs your --proof-command, writes the URL to
+prove and the token to its stdin, one per line, and sends the proof that the
+command prints.
 
 WAKE ON THE EVENT: run it as a background process your runtime TRACKS and wakes
 you on when it exits. With `--until-event` it prints the first event and exits 0
@@ -21,7 +26,7 @@ on the event, tell your human, and start it again with `--since <its id>`. Keep
 process the runtime does not track -- nohup, `&`, setsid -- wakes nobody, and
 neither does a line landing in a file.
 
-    python3 listen.py --url … --token-file … --topic kyc_verification \
+    python3 listen.py --url … --token-file … --proof-command … --topic kyc_verification \
                       --until-event --max-seconds 300
 
 Each line is a JSON object with a `type`:
@@ -36,7 +41,8 @@ Each line is a JSON object with a `type`:
     {"type":"error","message":…}
 
 EXIT CODES: 0 you asked it to stop (--max-seconds), or --until-event got its
-event; 2 the arguments or the URL are wrong; 3 the operator will not have this
+event; 2 the arguments or the URL are wrong, or --proof-command printed no
+proof; 3 the operator will not have this
 token back and no --token-command was given — mint a fresh one and start it
 again; 4 nothing you asked for can arrive: every topic you named was refused,
 or the origin serves no event stream (`501 module_not_served`); 5
@@ -88,6 +94,22 @@ def problem_code(response):
         return None
 
 
+def proof_url(url):
+    """The `htu` of the upgrade: the events URL with `wss` written as `https`,
+    no query."""
+    parts = urlsplit(url)
+    scheme = {"wss": "https", "ws": "http"}[parts.scheme]
+    return urlunsplit((scheme, parts.netloc, parts.path, "", ""))
+
+
+def dpop_proof(command, url, token):
+    """The proof your --proof-command prints for this URL and token, or None."""
+    made = subprocess.run(command, shell=True, input=f"{proof_url(url)}\n{token}\n",
+                          capture_output=True, text=True, check=False)
+    proof = made.stdout.strip()
+    return proof if made.returncode == 0 and proof else None
+
+
 def stream_url(url, topics, since):
     """`?topic=` is how you subscribe: the operator reads it on connect and
     confirms each one, so a round trip per topic is not needed."""
@@ -145,7 +167,7 @@ def read_frames(socket, state, deadline):
                  reconnect=frame.get("reconnect", True))
             # `reconnect: false` is the operator saying this credential is done:
             # it expired, or the human revoked the assistant. A retry with the
-            # same bearer loses the same argument, so mint a new one or stop.
+            # same token loses the same argument, so mint a new one or stop.
             if frame.get("reconnect", True):
                 return "retry"
             return "retry" if state["refresh"] else "credential"
@@ -191,12 +213,15 @@ def main():
     parser = argparse.ArgumentParser(description="Kiosk event-stream listener")
     parser.add_argument("--url", required=True, help="the operator's events_url")
     parser.add_argument("--token-file", required=True, metavar="PATH",
-                        help="a file holding your bearer token")
+                        help="a file holding your access token")
+    parser.add_argument("--proof-command", required=True,
+                        help="shell command that reads a URL and a token on stdin and prints "
+                             "the DPoP proof your private key signs for them")
     parser.add_argument("--topic", action="append", required=True, metavar="NAME[:SUBJECT]",
                         help="repeatable; NAME:SUBJECT narrows to one row")
     parser.add_argument("--since", type=int, help="resume after this event id")
     parser.add_argument("--token-command",
-                        help="shell command printing a fresh bearer token; run when the "
+                        help="shell command printing a fresh access token; run when the "
                              "operator says this one will not be accepted back")
     parser.add_argument("--max-seconds", type=float, help="stop after this long")
     parser.add_argument("--until-event", action="store_true",
@@ -224,10 +249,15 @@ def main():
         if deadline and time.monotonic() >= deadline:
             return 5 if args.until_event else 0
         renew = True
+        proof = dpop_proof(args.proof_command, args.url, state["token"])
+        if proof is None:
+            emit(type="error", message="--proof-command produced no proof")
+            return 2
         try:
             with connect(stream_url(args.url, args.topic, state["since"]),
                          subprotocols=[SUBPROTOCOL],
-                         additional_headers={"Authorization": f"Bearer {state['token']}"},
+                         additional_headers={"Authorization": f"DPoP {state['token']}",
+                                             "DPoP": proof},
                          open_timeout=15, close_timeout=5) as socket:
                 emit(type="open")
                 attempt = 0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiosk-server
 version: !ruby/object:Gem::Version
-  version: 0.5.20
+  version: 0.6.1
 platform: ruby
 authors:
 - Phil Pirozhkov
@@ -15,21 +15,21 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.8'
+        version: '2.10'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -39,7 +39,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.8'
+        version: '2.10'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -167,14 +167,15 @@ description: |
     - The controllers — the per-verb wire (GET <endpoint>/<query-name>,
       POST <endpoint>/<action-name>) and the reserved endpoints
       (/kiosk/schema, /kiosk/pay), a derived OpenAPI description of both,
-      the register/login proof-of-possession auth plane, JWKS, the KYC
+      OAuth client registration (RFC 7591) and the token endpoint
+      (private_key_jwt client assertions, DPoP), JWKS, the KYC
       attestation endpoint, agents.txt / agents.json / kiosk.json
-      discovery, and the account-binding ceremony (RFC 8628-shaped device
-      authorization, the possession-proof-gated token poll, the verify and
-      «Link an assistant» pages).
+      discovery, and the account-binding ceremony (RFC 8628 device
+      authorization and token poll, the verify and «Link an assistant»
+      pages).
     - Kiosk::Server::Executor — dispatches a resolved command to the
       queries and actions the host registered.
-    - Agent registration and login, with a pluggable agent-IdP.
+    - Client registration and authentication, with a pluggable agent-IdP.
     - The PoW gate that enforces a kiosk-reputation policy's challenge
       (soft dependency; zero overhead when no policy is set).
     - A Rack middleware injecting the Kiosk-Server-Version /
@@ -208,12 +209,13 @@ files:
 - app/controllers/kiosk/server/kyc_attestation_controller.rb
 - app/controllers/kiosk/server/kyc_callback_controller.rb
 - app/controllers/kiosk/server/oauth_device_authorization_controller.rb
+- app/controllers/kiosk/server/oauth_registration_controller.rb
 - app/controllers/kiosk/server/oauth_token_controller.rb
 - app/controllers/kiosk/server/open_api_controller.rb
 - app/controllers/kiosk/server/payment_setup_controller.rb
 - app/controllers/kiosk/server/verb_controller.rb
 - app/controllers/kiosk/server/wire_controller.rb
-- app/models/kiosk/cart_mandate.rb
+- app/models/kiosk/checkout_mandate.rb
 - app/models/kiosk/server/application_record.rb
 - app/models/kiosk/settlement.rb
 - app/models/kiosk/visit.rb
@@ -221,7 +223,6 @@ files:
 - app/views/kiosk/server/device_verify/decided.html.erb
 - app/views/kiosk/server/device_verify/show.html.erb
 - lib/generators/kiosk/install/install_generator.rb
-- lib/generators/kiosk/install/templates/create_kiosk_auth_challenges.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_device_authorizations.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_events.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_identity_tables.rb.tt
@@ -242,15 +243,17 @@ files:
 - lib/kiosk/server/action_event.rb
 - lib/kiosk/server/actions.rb
 - lib/kiosk/server/agent_identity_providers/default_agent_idp.rb
-- lib/kiosk/server/agent_login.rb
-- lib/kiosk/server/agent_registration.rb
+- lib/kiosk/server/agent_rotation.rb
 - lib/kiosk/server/argument_decoder.rb
+- lib/kiosk/server/assistant_key.rb
 - lib/kiosk/server/audit_sink.rb
-- lib/kiosk/server/auth_challenge.rb
-- lib/kiosk/server/auth_challenge_stores.rb
 - lib/kiosk/server/auth_toll.rb
 - lib/kiosk/server/binding_module_gate.rb
 - lib/kiosk/server/caller_timezone.rb
+- lib/kiosk/server/checkout.rb
+- lib/kiosk/server/client.rb
+- lib/kiosk/server/client_assertion.rb
+- lib/kiosk/server/client_registration.rb
 - lib/kiosk/server/column_spending_cap.rb
 - lib/kiosk/server/configuration_extension.rb
 - lib/kiosk/server/controller_verb.rb
@@ -260,6 +263,8 @@ files:
 - lib/kiosk/server/device_authorization_stores.rb
 - lib/kiosk/server/device_code_grant.rb
 - lib/kiosk/server/device_verification.rb
+- lib/kiosk/server/dpop.rb
+- lib/kiosk/server/eddsa.rb
 - lib/kiosk/server/engine.rb
 - lib/kiosk/server/errors.rb
 - lib/kiosk/server/event_stores.rb
@@ -277,6 +282,7 @@ files:
 - lib/kiosk/server/headers_middleware.rb
 - lib/kiosk/server/identity_resolution.rb
 - lib/kiosk/server/issuer_middleware.rb
+- lib/kiosk/server/jwk.rb
 - lib/kiosk/server/jwks.rb
 - lib/kiosk/server/jwt_issuer.rb
 - lib/kiosk/server/kyc.rb
@@ -284,15 +290,17 @@ files:
 - lib/kiosk/server/link_code.rb
 - lib/kiosk/server/linked_assistants.rb
 - lib/kiosk/server/mandate_verifier.rb
+- lib/kiosk/server/oauth_answers.rb
+- lib/kiosk/server/oauth_error.rb
 - lib/kiosk/server/open_api.rb
 - lib/kiosk/server/page.rb
 - lib/kiosk/server/payment_claim.rb
 - lib/kiosk/server/payment_setup.rb
-- lib/kiosk/server/pop_verifier.rb
 - lib/kiosk/server/pow_gate.rb
 - lib/kiosk/server/pow_spent_stores.rb
 - lib/kiosk/server/pow_toll.rb
 - lib/kiosk/server/queries.rb
+- lib/kiosk/server/receipts.rb
 - lib/kiosk/server/reputation_factors.rb
 - lib/kiosk/server/request_validation.rb
 - lib/kiosk/server/response_validation.rb
@@ -307,6 +315,7 @@ files:
 - lib/kiosk/server/schemas/kyc.schema.json
 - lib/kiosk/server/schemas/mandates.schema.json
 - lib/kiosk/server/schemas/pow.schema.json
+- lib/kiosk/server/sd_jwt.rb
 - lib/kiosk/server/session_context.rb
 - lib/kiosk/server/settled_spend.rb
 - lib/kiosk/server/signing_key.rb

data/app/models/kiosk/cart_mandate.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  # The signed cart the engine records when it settles a `pay`: the line items
-  # the assistant agreed to pay for. Read-only for the operator.
-  class CartMandate < Server::ApplicationRecord
-    def self.table_name = "#{Kiosk.configuration.schema}.cart_mandates"
-
-    has_many :settlements, class_name: 'Kiosk::Settlement', dependent: nil, inverse_of: :cart_mandate
-
-    # Carts with a line item carrying these attributes, by jsonb containment:
-    # `referencing(order_id: id)` matches `[{"order_id": id, "qty": 2}]`. The
-    # values are quoted by the adapter, never interpolated.
-    scope :referencing, lambda { |**attributes|
-      where(Arel::Nodes::InfixOperation.new(
-              '@>', arel_table[:line_items],
-              Arel::Nodes.build_quoted([attributes.transform_values(&:to_s)].to_json)
-            ))
-    }
-  end
-end

data/lib/generators/kiosk/install/templates/create_kiosk_auth_challenges.rb.tt

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-# Migration 010 — create kiosk.auth_challenges.
-# Each public key's outstanding auth challenge, so a challenge issued by one
-# process is redeemed by any other (AuthChallengeStores::ActiveRecord, the default).
-class CreateKioskAuthChallenges < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:auth_challenge) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".auth_challenges)
-  end
-end

data/lib/kiosk/server/agent_login.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  module Server
-    # Login with an already-registered public key: proves possession and mints a
-    # fresh token. An unknown key is a 404, never a new account.
-    module AgentLogin
-      module_function
-
-      def call(public_key_pem:, signed:)
-        pem = public_key_pem.to_s.strip
-
-        # Prove possession BEFORE any lookup or state change.
-        payload = PopVerifier.verify!(public_key_pem: pem, signed: signed)
-        AuthChallenge.consume!(public_key_pem: pem, nonce: payload.fetch(:nonce))
-
-        row      = registered_agent(pem)
-        agent_id = row.fetch('id')
-        role     = primary_role(row.fetch('allowed_roles'))
-        token    = AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: agent_id, role: role)
-        { access_token: token }
-      end
-
-      def registered_agent(pem)
-        row = ::ActiveRecord::Base.lease_connection.exec_query(<<~SQL.squish, 'Kiosk agent lookup by key', [pem, Kiosk.current_issuer]).to_a.first
-          SELECT id, user_id, allowed_roles FROM #{Kiosk.configuration.schema}.agents
-          WHERE public_key = $1 AND issuer = $2 AND revoked_at IS NULL
-          LIMIT 1
-        SQL
-        return row if row
-
-        raise Errors::NotFound.new(
-          'no agent registered for this public key',
-          hint: 'POST /auth/register to create an identity for a new key'
-        )
-      end
-      private_class_method :registered_agent
-
-      # `allowed_roles` is an Array or a text[] literal ("{customer}"), by adapter.
-      def primary_role(allowed_roles)
-        case allowed_roles
-        when Array then allowed_roles.first
-        else allowed_roles.to_s.delete('{}').split(',').first
-        end
-      end
-      private_class_method :primary_role
-    end
-  end
-end

data/lib/kiosk/server/agent_registration.rb

@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-
-require 'active_record'
-require 'active_support/core_ext/string/inflections' # String#constantize
-
-module Kiosk
-  module Server
-    # Self-registration with no human: creates the assistant account, binds an
-    # agent to the key, and mints its first token.
-    module AgentRegistration
-      module_function
-
-      def call(public_key_pem:, signed:, pow: nil)
-        config = Kiosk.configuration
-        role   = registration_role(config)
-        public_key_pem = public_key_pem.to_s.strip
-
-        AuthToll.gate(verb: 'auth/register', body: { public_key: public_key_pem }, pow: pow, config: config)
-
-        # Prove possession of the private key before any lookup or write.
-        payload = PopVerifier.verify!(public_key_pem: public_key_pem, signed: signed)
-        AuthChallenge.consume!(public_key_pem: public_key_pem, nonce: payload.fetch(:nonce))
-
-        conn = ::ActiveRecord::Base.lease_connection
-        refuse_known_key!(conn, config, public_key_pem)
-        conn.transaction { register(conn, config, public_key_pem, role) }
-      end
-
-      # The operator's `assistant_creation` factory, else a bare `user_model.create!`.
-      def create_assistant_account(config, public_key_pem)
-        return config.user_model.constantize.create!.id unless config.assistant_creation
-
-        id = config.assistant_creation.call(public_key_pem)
-        return id unless id.nil?
-
-        raise Errors::ConfigurationError,
-              'config.assistant_creation returned nil. The block must create the ' \
-              'assistant account and RETURN its id (used as agents.user_id), e.g. ' \
-              'c.assistant_creation = ->(pubkey) { AssistantAccount.create!(...).id }'
-      end
-
-      # The role is the server's choice, never the agent's.
-      def registration_role(config)
-        role = config.registration_role&.to_s
-        return if role.blank?
-        return role if config.roles.map(&:to_s).include?(role)
-
-        raise Errors::ConfigurationError,
-              "registration_role #{role.inspect} is not among configured roles " \
-              "#{config.roles.inspect}"
-      end
-
-      # A known key logs in instead; it is never registered twice.
-      def refuse_known_key!(conn, config, public_key_pem)
-        existing = conn.exec_query(<<~SQL.squish, 'Kiosk agent lookup by key', [public_key_pem, Kiosk.current_issuer]).to_a.first
-          SELECT id FROM #{config.schema}.agents
-          WHERE public_key = $1 AND issuer = $2 AND revoked_at IS NULL
-          LIMIT 1
-        SQL
-        return unless existing
-
-        raise Errors::Conflict.new(
-          'public key already registered',
-          hint: 'use POST /auth/login to refresh a token for an existing key'
-        )
-      end
-
-      def register(conn, config, public_key_pem, role)
-        assistant_account_id = create_assistant_account(config, public_key_pem)
-        agent_id = insert_agent(conn, config, [assistant_account_id, public_key_pem, Kiosk.current_issuer], role)
-        token = AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: agent_id, role: role)
-        { agent_id: agent_id, user_id: assistant_account_id.to_s, access_token: token }
-      end
-
-      # No role is the empty array: `allowed_roles` is NOT NULL.
-      def insert_agent(conn, config, binds, role)
-        allowed_roles_sql, role_binds = role ? ['ARRAY[$4]::text[]', [role]] : ["'{}'::text[]", []]
-        rows = conn.exec_query(<<~SQL.squish, 'Kiosk agent insert', [*binds, *role_binds])
-          INSERT INTO #{config.schema}.agents (user_id, allowed_roles, public_key, issuer)
-          VALUES ($1, #{allowed_roles_sql}, $2, $3)
-          RETURNING id
-        SQL
-        rows.to_a.first.fetch('id')
-      end
-      private_class_method :registration_role, :refuse_known_key!, :register, :insert_agent
-    end
-  end
-end

data/lib/kiosk/server/auth_challenge.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require 'securerandom'
-
-module Kiosk
-  module Server
-    # Server side of the proof-of-possession challenge: a single-use, short-lived
-    # nonce per public key.
-    module AuthChallenge
-      module_function
-
-      # The agent signs `challenge` into its JWS; `exp` is the Unix expiry.
-      def issue(public_key_pem:, now: Time.current)
-        config = Kiosk.configuration
-        nonce  = SecureRandom.urlsafe_base64(32)
-        exp    = now.to_i + config.auth_challenge_ttl
-        config.auth_challenge_store.put(public_key_pem.to_s.strip, nonce, exp)
-        { challenge: nonce, exp: exp }
-      end
-
-      def consume!(public_key_pem:, nonce:)
-        ok = Kiosk.configuration.auth_challenge_store.take(public_key_pem.to_s.strip, nonce.to_s)
-        return true if ok
-
-        raise Errors::Unauthenticated.new(
-          'no matching auth challenge',
-          hint: 'GET /auth/challenge?public_key=… first, then sign the returned nonce; ' \
-                'challenges are single-use and short-lived'
-        )
-      end
-    end
-  end
-end

data/lib/kiosk/server/auth_challenge_stores.rb

@@ -1,74 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  module Server
-    # The challenge store, shared by every process on the database (§15.2).
-    module AuthChallengeStores
-      # The default: the `<schema>.auth_challenges` table ({SchemaDefinitions.auth_challenge_sql}).
-      class ActiveRecord
-        # Seconds between expired-row sweeps; a sweep bounds growth, not correctness.
-        DEFAULT_PRUNE_INTERVAL = 60
-
-        def initialize(prune_interval: DEFAULT_PRUNE_INTERVAL)
-          @prune_interval = prune_interval
-          @last_prune_at  = 0
-          @mutex          = Mutex.new
-        end
-
-        # Replaces any earlier challenge for the key.
-        def put(public_key_pem, nonce, exp)
-          return if public_key_pem.nil?
-
-          prune_if_due!
-          sql = <<~SQL.squish
-            INSERT INTO #{table} AS c (public_key, nonce, expires_at)
-            VALUES ($1, $2, to_timestamp($3))
-            ON CONFLICT (public_key) DO UPDATE
-              SET nonce = EXCLUDED.nonce, expires_at = EXCLUDED.expires_at
-          SQL
-          connection.exec_query(sql, 'Kiosk auth_challenge put', [public_key_pem, nonce, exp.to_i])
-          nil
-        end
-
-        # One atomic DELETE, so two processes presenting one challenge get one `true`.
-        def take(public_key_pem, nonce) # rubocop:disable Naming/PredicateMethod -- `take` is the store contract `config.auth_challenge_store` names
-          return false if public_key_pem.nil? || nonce.nil?
-
-          sql = <<~SQL.squish
-            DELETE FROM #{table}
-            WHERE public_key = $1 AND nonce = $2 AND expires_at > now()
-            RETURNING public_key
-          SQL
-          rows = connection.exec_query(
-            sql, 'Kiosk auth_challenge take', [public_key_pem, nonce]
-          ).to_a
-          !rows.empty?
-        end
-
-        def prune!
-          connection.exec_query(%(DELETE FROM #{table} WHERE expires_at <= now()),
-                                'Kiosk auth_challenge prune')
-          nil
-        end
-
-        private
-
-        def prune_if_due!
-          now = Time.now.to_i
-          due = @mutex.synchronize do
-            if now - @last_prune_at >= @prune_interval
-              @last_prune_at = now
-              true
-            else
-              false
-            end
-          end
-          prune! if due
-        end
-
-        def connection = ::ActiveRecord::Base.lease_connection
-        def table = %("#{Kiosk.configuration.schema}".auth_challenges)
-      end
-    end
-  end
-end

data/lib/kiosk/server/pop_verifier.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-require 'jwt'
-require 'openssl'
-require 'rails'
-
-module Kiosk
-  module Server
-    # Verifies an agent's proof-of-possession JWS: RS256 by the presented key,
-    # `aud` equal to this origin (the relay defence), and the challenge `nonce`.
-    # The caller burns the nonce only after a clean verify.
-    module PopVerifier
-      # Names no origin: an echoed one is what a relaying server would exploit.
-      AUDIENCE_HINT =
-        'sign `aud` = the origin you connected to, taken from your own request ' \
-        'URL — never from a value echoed back in a response'
-
-      PROOF_REQUIRED_CLAIMS = %w[aud nonce jti].freeze
-
-      MAX_KEY_BITS = 4096
-
-      PROOF_CLAIMS_HINT =
-        "a proof's payload carries #{PROOF_REQUIRED_CLAIMS.join(', ')} — `aud` is the origin " \
-        'you connected to, `nonce` the value GET /auth/challenge just issued for this key, ' \
-        '`jti` a unique id for this proof'.freeze
-
-      PROOF_SIGNATURE_HINT =
-        'a proof is a compact RS256 JWS — header.payload.signature — signed with the ' \
-        'private key matching the public_key you sent'
-
-      module_function
-
-      def verify!(public_key_pem:, signed:)
-        pem = public_key_pem.to_s.strip
-        payload = decode(signed, load_public_key(pem))
-        check_audience!(payload[:aud])
-        raise Errors::Unauthenticated, 'proof key thumbprint mismatch' if payload.key?(:pub) && payload[:pub] != SigningKey.from_pem(pem).kid
-
-        payload
-      end
-
-      def decode(signed, key)
-        payload, = ::JWT.decode(signed.to_s, key, true, algorithms: ['RS256'], required_claims: PROOF_REQUIRED_CLAIMS)
-        payload.transform_keys(&:to_sym)
-      rescue ::JWT::MissingRequiredClaim
-        raise Errors::Unauthenticated.new('proof is missing a required claim', hint: PROOF_CLAIMS_HINT)
-      rescue ::JWT::DecodeError
-        raise Errors::Unauthenticated.new('proof signature invalid', hint: PROOF_SIGNATURE_HINT)
-      end
-
-      def check_audience!(signed_aud)
-        issuer = Kiosk.current_issuer
-        return if signed_aud == issuer
-
-        log_audience_mismatch(signed_aud: signed_aud, issuer: issuer)
-        raise Errors::Unauthenticated.new('proof audience mismatch', hint: AUDIENCE_HINT)
-      end
-
-      # Operator log only, since the response must not name an origin: the
-      # caller signed a wrong value, or the origin it reached is not served.
-      def log_audience_mismatch(signed_aud:, issuer:)
-        message = "[kiosk] PoP audience mismatch: caller signed aud=#{signed_aud.inspect}, " \
-                  "the issuer for this request is #{issuer.inspect}. If the signed value is " \
-                  'an origin your assistants actually reach, list it in `c.issuer` or ' \
-                  '`c.additional_origins`.'
-        logger = ::Rails.logger
-        logger ? logger.warn(message) : warn(message)
-      end
-
-      # Also the key bounds of account binding.
-      def load_public_key(pem)
-        OpenSSL::PKey::RSA.new(pem).tap { require_key_size!(it.n.num_bits) }
-      rescue OpenSSL::PKey::PKeyError
-        raise Errors::BadRequest.new(
-          'invalid public key',
-          hint: "send a PEM-encoded RSA public key of #{SigningKey::MIN_KEY_BITS} to #{MAX_KEY_BITS} bits " \
-                '(-----BEGIN PUBLIC KEY----- …)'
-        )
-      end
-
-      def require_key_size!(bits)
-        raise Errors::BadRequest, "public key too small (#{bits} bits; minimum #{SigningKey::MIN_KEY_BITS})" if bits < SigningKey::MIN_KEY_BITS
-        raise Errors::BadRequest, "public key too large (#{bits} bits; maximum #{MAX_KEY_BITS})" if bits > MAX_KEY_BITS
-      end
-    end
-  end
-end