kiosk-server 0.5.20 → 0.6.1

data/lib/kiosk/server/schemas/kyc.schema.json

@@ -8,106 +8,49 @@
     "attestation": {
       "type": "object",
       "description": "Signed by the KYC provider, verified with its configured public key.",
-      "required": [
-        "sub",
-        "level",
-        "iss",
-        "aud",
-        "exp"
-      ],
+      "required": ["sub", "level", "iss", "aud", "exp"],
       "properties": {
-        "sub": {
-          "type": "string",
-          "description": "MUST equal the authenticated user_id."
-        },
-        "level": {
-          "const": "verified",
-          "description": "Binary; anything other than \"verified\" is rejected."
-        },
-        "iss": {
-          "type": "string",
-          "description": "MUST equal the provider-configured KYC issuer."
-        },
-        "aud": {
-          "type": "string",
-          "description": "OPERATOR-BINDING. The operator the attestation was minted for. MUST equal the operator's configured kyc_audience (its origin, or a stable handle it declares); the operator rejects any other aud. This stops a claim minted for operator A being replayed to operator B."
-        },
-        "iat": {
-          "type": "integer",
-          "description": "Issued-at timestamp. Not enforced by the verifier."
-        },
-        "exp": {
-          "type": "integer",
-          "description": "One year after iat. An expired attestation is rejected."
-        },
-        "attributes": {
-          "$ref": "#/$defs/attributes"
-        }
+        "sub": { "type": "string", "description": "MUST equal the authenticated user_id." },
+        "level": { "const": "verified", "description": "Binary; anything other than \"verified\" is rejected." },
+        "iss": { "type": "string", "description": "MUST equal the provider-configured KYC issuer." },
+        "aud": { "type": "string", "description": "OPERATOR-BINDING. The operator the attestation was minted for. MUST equal the operator's configured kyc_audience (its origin, or a stable handle it declares); the operator rejects any other aud. This stops a claim minted for operator A being replayed to operator B." },
+        "iat": { "type": "integer", "description": "Issued-at timestamp. Not enforced by the verifier." },
+        "exp": { "type": "integer", "description": "One year after iat. An expired attestation is rejected." },
+        "attributes": { "$ref": "#/$defs/attributes" }
       }
     },
     "attributes": {
       "type": "object",
       "description": "Optional named boolean attributes that the KYC provider vouches for, e.g. age_over_18. Only a value that is literally true counts; an action MAY require named attributes and refuse with kyc_required (403).",
-      "additionalProperties": {
-        "type": "boolean"
-      }
+      "additionalProperties": { "type": "boolean" }
     },
     "request": {
       "type": "object",
-      "required": [
-        "kyc_jws"
-      ],
+      "required": ["kyc_jws"],
       "properties": {
-        "kyc_jws": {
-          "type": "string",
-          "description": "The attestation as a compact RS256 JWS."
-        }
+        "kyc_jws": { "type": "string", "description": "The attestation as a compact EdDSA JWS." }
       }
     },
     "verification": {
       "type": "object",
       "description": "The answer to the request_kyc action: a verification opened at the KYC provider, whose page the AI assistant relays to its human.",
       "additionalProperties": false,
-      "required": [
-        "request_id",
-        "verification_url",
-        "status"
-      ],
+      "required": ["request_id", "verification_url", "status"],
       "properties": {
-        "request_id": {
-          "type": "string",
-          "description": "The provider's id for this verification; the kyc_verification event carries it back."
-        },
-        "verification_url": {
-          "type": "string",
-          "description": "The provider page the human completes."
-        },
-        "status": {
-          "const": "pending"
-        }
+        "request_id": { "type": "string", "description": "The provider's id for this verification; the kyc_verification event carries it back." },
+        "verification_url": { "type": "string", "description": "The provider page the human completes." },
+        "status": { "const": "pending" }
       }
     },
     "verificationEvent": {
       "type": "object",
       "description": "The data of a kyc_verification event: the human approved, and the event carries the provider-signed attestation to submit to POST /kiosk/agents/kyc.",
       "additionalProperties": false,
-      "required": [
-        "request_id",
-        "status",
-        "kyc_jws"
-      ],
+      "required": ["request_id", "status", "kyc_jws"],
       "properties": {
-        "request_id": {
-          "type": "string",
-          "description": "The request_id request_kyc returned."
-        },
-        "status": {
-          "const": "approved"
-        },
-        "kyc_jws": {
-          "type": "string",
-          "description": "The attestation as a compact RS256 JWS."
-        }
+        "request_id": { "type": "string", "description": "The request_id request_kyc returned." },
+        "status": { "const": "approved" },
+        "kyc_jws": { "type": "string", "description": "The attestation as a compact EdDSA JWS." }
       }
     }
   }

data/lib/kiosk/server/schemas/mandates.schema.json

@@ -2,73 +2,157 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://kiosk.tech/spec/schemas/mandates.schema.json",
   "$comment": "VENDORED copy of the normative kiosk.tech schema at spec/schemas/mandates.schema.json. It is here so RequestValidation can hold a reserved-plane request body to it at runtime, and so e2e/schema_conformance.rb can validate this origin's LIVE wire bytes against the PUBLISHED schema -- both with no second checkout and no network fetch. Identical to the upstream copy as PARSED JSON once this $comment is removed.",
-  "title": "Kiosk AP2 payment mandates",
-  "description": "The decoded JWS payloads of the three AP2 mandates and the POST /kiosk/pay request body. On the wire each mandate is an RS256 compact JWS string; these schemas describe the decoded claim sets.",
+  "title": "Kiosk payment: the checkout and the AP2 v0.2 mandates",
+  "description": "The checkout an operator signs, the two closed AP2 v0.2 mandates an AI assistant signs to pay it, the POST <endpoint>/pay request body, the settlement it answers and the two receipts in it. On the wire the checkout is a compact EdDSA JWT, and each mandate is a compact SD-JWT whose one disclosure is the mandate; these schemas describe the decoded objects.",
   "$defs": {
-    "baseClaims": {
+    "currency": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[A-Za-z]{3}$",
+      "description": "An ISO 4217 ALPHA-3 code, and the `pattern` is the domain: three ASCII letters, either case. An operator MAY refuse more (Section 11.1)."
+    },
+    "merchant": {
+      "type": "object",
+      "description": "The AP2 Merchant object. In a Kiosk checkout, `id` and `website` are the operator's issuer.",
+      "required": ["id", "name"],
+      "properties": {
+        "id": { "type": "string" },
+        "name": { "type": "string" },
+        "website": { "type": "string" }
+      }
+    },
+    "checkout": {
       "type": "object",
-      "description": "Claims every mandate MUST carry.",
-      "required": ["id", "user_id", "agent_id", "iss", "iat", "exp"],
+      "description": "The claims of the `checkout_jwt` an operator answers for an item to pay for: a JWT it signs EdDSA with the key of its JWKS (Section 11.7).",
+      "required": ["iss", "sub", "iat", "jti", "merchant", "currency", "total_amount_cents", "line_items"],
       "properties": {
-        "id": { "type": "string", "description": "Unique mandate id." },
-        "user_id": { "type": "string", "description": "MUST match the authenticated identity (string-compared)." },
-        "agent_id": { "type": "string", "description": "MUST match the authenticated identity (string-compared)." },
-        "iss": { "type": "string", "description": "MUST equal the provider issuer from /.well-known/kiosk.json, verbatim." },
+        "iss": { "type": "string", "description": "The operator's issuer, verbatim from kiosk.json." },
+        "sub": { "type": "string", "description": "The account the checkout is for. Only that account can pay it." },
         "iat": { "type": "integer" },
-        "exp": { "type": "integer", "description": "An exp already in the past is rejected." }
+        "jti": { "type": "string", "minLength": 22, "description": "At least 128 random bits, base64url. An EdDSA signature is the same for the same claims, so this value makes the hash of each checkout impossible to guess." },
+        "merchant": { "$ref": "#/$defs/merchant" },
+        "currency": { "$ref": "#/$defs/currency" },
+        "total_amount_cents": { "type": "integer", "minimum": 1, "description": "MUST be positive." },
+        "line_items": { "type": "array", "minItems": 1, "items": { "type": "object" }, "description": "The first names the item to pay for; the others carry `qty` and `price_cents`, which sum to the total." }
       }
     },
-    "intent": {
-      "allOf": [{ "$ref": "#/$defs/baseClaims" }],
+    "sdJwtPayload": {
       "type": "object",
-      "required": ["cap_amount_cents", "currency"],
+      "description": "The payload of the issuer-signed JWT of a mandate. Its header is {\"alg\": \"EdDSA\", \"typ\": \"dc+sd-jwt\"}, signed with the AI assistant's registered key; a P-256 key signs ES256. `delegate_payload` holds one digest, and the one disclosure it names is the mandate.",
+      "required": ["delegate_payload"],
       "properties": {
-        "cap_amount_cents": { "type": "integer", "minimum": 1, "description": "Spending cap; there is no \"no cap\" spelling -- a nil cap is rejected. MUST be positive; a non-positive amount is rejected." },
-        "currency": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z]{3}$", "description": "An ISO 4217 ALPHA-3 code, and the `pattern` is the domain: three ASCII letters, either case. An operator MAY refuse more (Section 11.1)."},
-        "scope": { "type": "string", "description": "Provider-defined scope." }
+        "_sd_alg": { "const": "sha-256" },
+        "delegate_payload": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["..."],
+            "properties": { "...": { "type": "string" } },
+            "additionalProperties": false
+          }
+        }
       }
     },
-    "cart": {
-      "allOf": [{ "$ref": "#/$defs/baseClaims" }],
+    "lifetime": {
       "type": "object",
-      "required": ["intent_mandate_id", "total_amount_cents", "currency", "line_items"],
+      "required": ["iat", "exp"],
       "properties": {
-        "intent_mandate_id": { "type": "string", "description": "MUST equal the intent mandate id; cart total MUST NOT exceed the intent cap." },
-        "total_amount_cents": { "type": "integer", "minimum": 1, "description": "MUST be positive; a non-positive amount is rejected." },
-        "currency": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z]{3}$", "description": "MUST equal the intent currency, and MUST be an ISO 4217 alpha-3 code -- see the intent's note; equality to another empty string, or to another currency NAME, is not a check." },
-        "line_items": { "type": "array", "minItems": 1, "description": "Provider-defined line items, at least one. The operator matches a settlement to its own record through them." }
+        "iat": { "type": "integer" },
+        "exp": { "type": "integer", "description": "At most 24 hours ahead. An exp already in the past is rejected." }
       }
     },
-    "payment": {
-      "allOf": [{ "$ref": "#/$defs/baseClaims" }],
+    "checkoutMandate": {
+      "allOf": [{ "$ref": "#/$defs/lifetime" }],
       "type": "object",
-      "required": ["cart_mandate_id", "amount_cents", "currency"],
+      "description": "The closed AP2 Checkout Mandate.",
+      "required": ["vct", "checkout_jwt", "checkout_hash"],
       "properties": {
-        "cart_mandate_id": { "type": "string", "description": "MUST equal the cart mandate id." },
-        "amount_cents": { "type": "integer", "minimum": 1, "description": "MUST equal the cart total, same currency. MUST be positive; a non-positive amount is rejected." },
-        "currency": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z]{3}$", "description": "MUST equal the cart currency, and MUST be an ISO 4217 alpha-3 code." },
-        "payment_method": { "type": "string", "description": "PSP method identifier (e.g. \"on_file\")." }
+        "vct": { "const": "mandate.checkout.1" },
+        "checkout_jwt": { "type": "string", "description": "The checkout_jwt the operator answered, unchanged." },
+        "checkout_hash": { "type": "string", "description": "The base64url SHA-256 of checkout_jwt, with no padding." }
+      }
+    },
+    "paymentMandate": {
+      "allOf": [{ "$ref": "#/$defs/lifetime" }],
+      "type": "object",
+      "description": "The closed AP2 Payment Mandate.",
+      "required": ["vct", "transaction_id", "payee", "payment_amount", "payment_instrument"],
+      "properties": {
+        "vct": { "const": "mandate.payment.1" },
+        "transaction_id": { "type": "string", "description": "The checkout_hash of the checkout mandate." },
+        "payee": { "$ref": "#/$defs/merchant", "description": "The checkout's merchant: its id is the operator's issuer." },
+        "payment_amount": {
+          "type": "object",
+          "required": ["amount", "currency"],
+          "properties": {
+            "amount": { "type": "integer", "minimum": 1, "description": "The checkout's total_amount_cents." },
+            "currency": { "$ref": "#/$defs/currency", "description": "The checkout's currency, compared as a code." }
+          }
+        },
+        "payment_instrument": {
+          "type": "object",
+          "required": ["id", "type"],
+          "properties": {
+            "id": { "type": "string", "minLength": 1, "description": "\"on_file\" pays with the card the human saved through payment_setup." },
+            "type": { "type": "string", "minLength": 1 },
+            "description": { "type": "string" }
+          }
+        }
       }
     },
     "payRequest": {
       "type": "object",
-      "description": "The POST /kiosk/pay request body: the three mandates as compact JWS strings.",
-      "required": ["intent_mandate_jws", "cart_mandate_jws", "payment_mandate_jws"],
+      "description": "The POST <endpoint>/pay request body: the two closed mandates as compact SD-JWT strings.",
+      "required": ["checkout_mandate", "payment_mandate"],
       "properties": {
-        "intent_mandate_jws": { "type": "string" },
-        "cart_mandate_jws": { "type": "string" },
-        "payment_mandate_jws": { "type": "string" }
+        "checkout_mandate": { "type": "string", "pattern": "~$" },
+        "payment_mandate": { "type": "string", "pattern": "~$" }
       }
     },
     "settlement": {
       "type": "object",
       "description": "The pay response body, answered verbatim: there is no envelope, no ok flag and no kind discriminator (protocol.md 8.2, 11.3).",
-      "required": ["settlement_id", "psp_reference", "settled_amount_cents", "currency"],
+      "required": ["settlement_id", "psp_reference", "settled_amount_cents", "currency", "checkout_receipt", "payment_receipt"],
       "properties": {
         "settlement_id": { "type": "string" },
         "psp_reference": { "type": "string" },
-        "settled_amount_cents": { "type": "integer", "minimum": 1, "description": "The captured amount; equals the cart total. MUST be positive: a settlement exists only for a completed capture, and every mandate amount is already positive." },
-        "currency": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z]{3}$", "description": "The currency of the capture: the cart's currency in the OPERATOR's canonical spelling, which MAY differ byte for byte from the spelling the assistant signed (protocol.md 11.3, 11.5). Compare it as an ISO 4217 code, never as bytes." }
+        "settled_amount_cents": { "type": "integer", "minimum": 1, "description": "The captured amount; equals the checkout total. MUST be positive: a settlement exists only for a completed capture." },
+        "currency": { "$ref": "#/$defs/currency", "description": "The currency of the capture, in the OPERATOR's canonical spelling, which MAY differ byte for byte from the spelling in the checkout (protocol.md 11.3, 11.5). Compare it as an ISO 4217 code, never as bytes." },
+        "checkout_receipt": { "$ref": "#/$defs/compactJwt", "description": "The AP2 checkout receipt: a compact JWT the operator signs EdDSA with the key of its JWKS. Its claims are `checkoutReceipt` (protocol.md 11.3)." },
+        "payment_receipt": { "$ref": "#/$defs/compactJwt", "description": "The AP2 payment receipt: a compact JWT the operator signs EdDSA with the key of its JWKS. Its claims are `paymentReceipt` (protocol.md 11.3)." }
+      }
+    },
+    "compactJwt": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$",
+      "description": "A compact JWS: three base64url segments."
+    },
+    "checkoutReceipt": {
+      "type": "object",
+      "description": "The claims of the checkout receipt a successful pay answers (AP2 v0.2 checkout_receipt.json, status Success).",
+      "required": ["status", "iss", "iat", "reference", "order_id"],
+      "properties": {
+        "status": { "const": "Success" },
+        "iss": { "type": "string", "description": "The operator's issuer." },
+        "iat": { "type": "integer" },
+        "reference": { "type": "string", "description": "The reference of the checkout mandate: the base64url SHA-256 of its compact SD-JWT." },
+        "order_id": { "type": "string", "description": "The id in the first line item of the checkout." }
+      }
+    },
+    "paymentReceipt": {
+      "type": "object",
+      "description": "The claims of the payment receipt a successful pay answers (AP2 v0.2 payment_receipt.json, status Success). `network_confirmation_id` is present only when the payment provider reports it; AP2 requires it, so a receipt without it does not satisfy AP2's schema (protocol.md 11.3).",
+      "required": ["status", "iss", "iat", "reference", "payment_id", "psp_confirmation_id"],
+      "properties": {
+        "status": { "const": "Success" },
+        "iss": { "type": "string", "description": "The operator's issuer." },
+        "iat": { "type": "integer" },
+        "reference": { "type": "string", "description": "The reference of the payment mandate: the base64url SHA-256 of its compact SD-JWT." },
+        "payment_id": { "type": "string", "description": "The settlement_id." },
+        "psp_confirmation_id": { "type": "string", "description": "The psp_reference." },
+        "network_confirmation_id": { "type": "string", "description": "The card network's id of the transaction." }
       }
     }
   }

data/lib/kiosk/server/sd_jwt.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'digest'
+require 'json'
+require 'jwt'
+
+module Kiosk
+  module Server
+    # The part of SD-JWT (RFC 9901) that an AP2 closed mandate needs: a compact
+    # SD-JWT with no key-binding JWT, its issuer-signed JWT verified with one
+    # key, and each disclosure put back in place of its digest.
+    module SdJwt
+      # The token is not a well-formed SD-JWT, or its disclosures do not match it.
+      class Invalid < StandardError
+      end
+
+      SD_ALG = 'sha-256'
+
+      module_function
+
+      # @return [Array(Hash, Hash)] the payload with every disclosure in place, and the JWT header
+      # @raise [Invalid, JWT::DecodeError]
+      def verify(token, key:, algorithm:)
+        jwt, disclosures = split(token)
+        payload, header = ::JWT.decode(jwt, key, true, algorithms: [algorithm])
+        sd_alg = payload.delete('_sd_alg') || SD_ALG
+        raise Invalid, "_sd_alg is #{sd_alg.inspect}; only #{SD_ALG} is accepted" unless sd_alg == SD_ALG
+
+        [disclose(payload, disclosures), header]
+      end
+
+      # The base64url SHA-256 of `text`: a disclosure's digest, and a mandate's reference.
+      def digest(text) = Base64.urlsafe_encode64(Digest::SHA256.digest(text), padding: false)
+
+      # `payload` with each disclosure in place. RFC 9901 §7.1: a disclosure that
+      # no digest names, or two disclosures with one digest, refuse the token.
+      def disclose(payload, disclosures)
+        pending = disclosures.to_h { |d| [digest(d), decode_disclosure(d)] }
+        raise Invalid, 'two disclosures have the same digest' if pending.size < disclosures.size
+
+        resolved = resolve(payload, pending)
+        raise Invalid, 'a disclosure is not named by any digest' unless pending.empty?
+
+        resolved
+      end
+
+      # A compact SD-JWT ends in `~`: anything after it is a key-binding JWT,
+      # and an empty part is a chain of SD-JWTs.
+      def split(token)
+        raise Invalid, 'an SD-JWT is a string' unless token.is_a?(String)
+
+        jwt, *disclosures, binding = token.split('~', -1)
+        raise Invalid, 'an SD-JWT ends with "~" and has no key-binding JWT' unless binding == ''
+        raise Invalid, 'an SD-JWT has no empty part' if jwt.to_s.empty? || disclosures.any?(&:empty?)
+
+        [jwt, disclosures]
+      end
+
+      def decode_disclosure(disclosure)
+        array = JSON.parse(Base64.urlsafe_decode64(disclosure))
+        return array if array.is_a?(Array) && [2, 3].include?(array.size) && array.first.is_a?(String)
+
+        raise Invalid, 'a disclosure is an array of [salt, value] or [salt, name, value]'
+      rescue ArgumentError, JSON::ParserError
+        raise Invalid, 'a disclosure is base64url-encoded JSON'
+      end
+
+      def resolve(value, pending)
+        case value
+        when Hash  then resolve_object(value, pending)
+        when Array then value.each_with_object([]) { |element, out| resolve_element(element, pending, out) }
+        else value
+        end
+      end
+
+      # The `_sd` digests become properties; a digest with no disclosure is a decoy.
+      def resolve_object(object, pending)
+        result = object.except('_sd').transform_values { |v| resolve(v, pending) }
+        Array(object['_sd']).each do |d|
+          disclosure = pending.delete(d) || next
+          raise Invalid, 'an object disclosure is [salt, name, value]' unless disclosure.size == 3
+
+          _salt, name, value = disclosure
+          raise Invalid, "the disclosed name #{name.inspect} is already in the object" if result.key?(name)
+
+          result[name] = resolve(value, pending)
+        end
+        result
+      end
+
+      # `{"...": digest}` becomes the disclosed element; one with no disclosure is left out.
+      def resolve_element(element, pending, out)
+        return out << resolve(element, pending) unless element.is_a?(Hash) && element.keys == ['...']
+
+        disclosure = pending.delete(element['...']) || return
+        raise Invalid, 'an array disclosure is [salt, value]' unless disclosure.size == 2
+
+        out << resolve(disclosure.last, pending)
+      end
+      private_class_method :split, :decode_disclosure, :resolve, :resolve_object, :resolve_element
+    end
+  end
+end

data/lib/kiosk/server/signing_key.rb

@@ -1,82 +1,48 @@
 # frozen_string_literal: true
 
 require 'openssl'
-require 'base64'
-require 'digest'
-require 'json'
 
 module Kiosk
   module Server
-    # The RSA key that signs this deployment's JWTs, and its public JWK.
+    # The Ed25519 key that signs this deployment's JWTs (EdDSA, RFC 8037): its
+    # access tokens, checkouts and receipts. Its public JWK names `alg` EdDSA.
     class SigningKey
-      MIN_KEY_BITS = 2048
+      HINT = 'generate one with `openssl genpkey -algorithm ed25519`'
 
-      ALGORITHM = 'RS256'
+      attr_reader :key
 
-      attr_reader :rsa
+      def initialize(key)
+        raise ArgumentError, "the signing key is an Ed25519 key, got #{key.class}; #{HINT}" unless Jwk.ed25519?(key)
 
-      def initialize(rsa)
-        raise ArgumentError, "expected OpenSSL::PKey::RSA, got #{rsa.class}" unless rsa.is_a?(OpenSSL::PKey::RSA)
-        if rsa.n.num_bits < MIN_KEY_BITS
-          raise ArgumentError,
-                "RSA key is #{rsa.n.num_bits} bits; minimum is #{MIN_KEY_BITS}"
-        end
-        @rsa = rsa
+        @key = key
       end
 
-      def self.generate(bits: MIN_KEY_BITS)
-        new(OpenSSL::PKey::RSA.generate(bits))
+      def self.generate
+        new(OpenSSL::PKey.generate_key('ED25519'))
       end
 
-      # A public-only PEM verifies; a full keypair also signs.
+      # A public-only PEM verifies; a private PEM also signs.
       def self.from_pem(pem)
-        new(OpenSSL::PKey::RSA.new(pem))
+        new(OpenSSL::PKey.read(pem))
+      rescue OpenSSL::PKey::PKeyError
+        raise ArgumentError, "the signing key is not a PEM key; #{HINT}"
       end
 
-      delegate :public_key, to: :rsa
-
-      delegate :private?, to: :rsa
+      def private? = Jwk.private?(key)
 
       def to_pem
         raise 'cannot export PEM: signing key is public-only' unless private?
 
-        rsa.to_pem
+        key.private_to_pem
       end
 
       # The RFC 7638 thumbprint.
       def kid
-        @kid ||= compute_thumbprint
-      end
-
-      # RFC 7517 §4; never the private parameters.
-      def to_jwk
-        {
-          kty: 'RSA',
-          use: 'sig',
-          alg: ALGORITHM,
-          kid: kid,
-          n: b64url(rsa.n.to_s(2)),
-          e: b64url(rsa.e.to_s(2))
-        }
+        @kid ||= Jwk.thumbprint(key)
       end
 
-      private
-
-      def compute_thumbprint
-        # RFC 7638 §3.2: the required members, in alphabetical order.
-        canonical = JSON.generate(
-          {
-            e: b64url(rsa.e.to_s(2)),
-            kty: 'RSA',
-            n: b64url(rsa.n.to_s(2))
-          }
-        )
-        b64url(Digest::SHA256.digest(canonical))
-      end
-
-      def b64url(bytes)
-        Base64.urlsafe_encode64(bytes, padding: false)
-      end
+      # RFC 7517 §4; never the private member.
+      def to_jwk = { **Jwk.public_members(key), use: 'sig', alg: Eddsa::NAME, kid: kid }
     end
   end
 end

data/lib/kiosk/server/verb_wire.rb

@@ -18,7 +18,7 @@ module Kiosk
 
       def resolve_identity!
         identity = IdentityResolution.resolve(request)
-        raise Errors::Unauthenticated, 'no identity resolved from request' if identity.nil?
+        raise Errors::AccessTokenRefused if identity.nil?
 
         identity
       end

data/lib/kiosk/server/version.rb

@@ -2,6 +2,6 @@
 
 module Kiosk
   module Server
-    VERSION = '0.5.20'
+    VERSION = '0.6.1'
   end
 end