kiosk-server 0.5.20 → 0.6.28

data/lib/kiosk/server/wire_rendering.rb

@@ -4,7 +4,7 @@ require 'cgi'
 
 module Kiosk
   module Server
-    # How a wire answer is written: headers, cache policy, body. Success is the
+    # How a protocol answer is written: headers, cache policy, body. Success is the
     # verb's payload; a refusal is an RFC 9457 problem document.
     module WireRendering
       private
@@ -108,7 +108,7 @@ module Kiosk
         when 'pow_required'
           %(Kiosk-PoW realm="#{issuer}")
         when 'payment_setup_required'
-          %(Payment realm="#{issuer}", method="ap2")
+          %(Kiosk-Payment-Setup realm="#{issuer}")
         end
       end
     end

data/lib/kiosk/server.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# kiosk-server: the Rails engine, its wire, auth and discovery controllers, and
+# kiosk-server: the Rails engine, its protocol, auth and discovery controllers, and
 # the install generator. See https://kiosk.tech.
 
 require 'kiosk'
@@ -10,12 +10,18 @@ require 'active_support/core_ext' # the core extensions a Rails host loads, whic
 require 'zeitwerk'
 
 Zeitwerk::Loader.for_gem_extension(Kiosk).setup
+# Registers the JOSE algorithm EdDSA with ruby-jwt.
+require_relative 'server/eddsa'
 
 module Kiosk
   module Server
   end
 
-  # The user id and role of the principal the wire resolved.
+  # Kiosk's tables are `kiosk_*` in the configured schema; Rails names every
+  # model in this namespace with it: Kiosk::Settlement is `public.kiosk_settlements`.
+  def self.table_name_prefix = "#{configuration.schema}.kiosk_"
+
+  # The user id and role of the principal the protocol resolved.
   def self.current_user_id = Server::SessionContext.identity.user_id
   def self.current_role    = Server::SessionContext.identity.role
 

data/lib/kiosk/skill_link.rb

@@ -5,12 +5,16 @@ require 'active_support/concern'
 module Kiosk
   # `include Kiosk::SkillLink` in a page controller: every answer carries
   # `Link: <skill_url>; rel="kiosk"`, the discovery signal for a client that
-  # does not read HTML.
+  # does not read HTML, and the RFC 9727 `api-catalog` link.
   module SkillLink
     extend ActiveSupport::Concern
 
+    API_CATALOG = '</.well-known/api-catalog>; rel="api-catalog"'
+
     included do
-      before_action { response.set_header('Link', %(<#{Kiosk.configuration.skill_url}>; rel="kiosk")) }
+      before_action do
+        response.set_header('Link', %(<#{Kiosk.configuration.skill_url}>; rel="kiosk", #{API_CATALOG}))
+      end
     end
   end
 end

data/listen.py

@@ -8,10 +8,15 @@ cadence to invent.
 
     python3 listen.py --url wss://shop.example/kiosk/events \
                       --token-file ~/.kiosk/https_shop.example_443/token \
+                      --proof-command "python3 ~/.kiosk/dpop.py ~/.kiosk/https_shop.example_443/key.pem" \
                       --topic order_delivery:<order-id>
 
-The bearer token is read from a file, never from the command line, where every
-process listing and shell history would show it.
+The access token is read from a file, never from the command line, where every
+process listing and shell history would show it. The token works only with a
+DPoP proof (RFC 9449) that your private key signs. This file never reads that
+key: before each connection it runs your --proof-command, writes the URL to
+prove and the token to its stdin, one per line, and sends the proof that the
+command prints.
 
 WAKE ON THE EVENT: run it as a background process your runtime TRACKS and wakes
 you on when it exits. With `--until-event` it prints the first event and exits 0
@@ -21,7 +26,7 @@ on the event, tell your human, and start it again with `--since <its id>`. Keep
 process the runtime does not track -- nohup, `&`, setsid -- wakes nobody, and
 neither does a line landing in a file.
 
-    python3 listen.py --url … --token-file … --topic kyc_verification \
+    python3 listen.py --url … --token-file … --proof-command … --topic kyc_verification \
                       --until-event --max-seconds 300
 
 Each line is a JSON object with a `type`:
@@ -36,7 +41,8 @@ Each line is a JSON object with a `type`:
     {"type":"error","message":…}
 
 EXIT CODES: 0 you asked it to stop (--max-seconds), or --until-event got its
-event; 2 the arguments or the URL are wrong; 3 the operator will not have this
+event; 2 the arguments or the URL are wrong, or --proof-command printed no
+proof; 3 the operator will not have this
 token back and no --token-command was given — mint a fresh one and start it
 again; 4 nothing you asked for can arrive: every topic you named was refused,
 or the origin serves no event stream (`501 module_not_served`); 5
@@ -88,6 +94,22 @@ def problem_code(response):
         return None
 
 
+def proof_url(url):
+    """The `htu` of the upgrade: the events URL with `wss` written as `https`,
+    no query."""
+    parts = urlsplit(url)
+    scheme = {"wss": "https", "ws": "http"}[parts.scheme]
+    return urlunsplit((scheme, parts.netloc, parts.path, "", ""))
+
+
+def dpop_proof(command, url, token):
+    """The proof your --proof-command prints for this URL and token, or None."""
+    made = subprocess.run(command, shell=True, input=f"{proof_url(url)}\n{token}\n",
+                          capture_output=True, text=True, check=False)
+    proof = made.stdout.strip()
+    return proof if made.returncode == 0 and proof else None
+
+
 def stream_url(url, topics, since):
     """`?topic=` is how you subscribe: the operator reads it on connect and
     confirms each one, so a round trip per topic is not needed."""
@@ -145,7 +167,7 @@ def read_frames(socket, state, deadline):
                  reconnect=frame.get("reconnect", True))
             # `reconnect: false` is the operator saying this credential is done:
             # it expired, or the human revoked the assistant. A retry with the
-            # same bearer loses the same argument, so mint a new one or stop.
+            # same token loses the same argument, so mint a new one or stop.
             if frame.get("reconnect", True):
                 return "retry"
             return "retry" if state["refresh"] else "credential"
@@ -191,12 +213,15 @@ def main():
     parser = argparse.ArgumentParser(description="Kiosk event-stream listener")
     parser.add_argument("--url", required=True, help="the operator's events_url")
     parser.add_argument("--token-file", required=True, metavar="PATH",
-                        help="a file holding your bearer token")
+                        help="a file holding your access token")
+    parser.add_argument("--proof-command", required=True,
+                        help="shell command that reads a URL and a token on stdin and prints "
+                             "the DPoP proof your private key signs for them")
     parser.add_argument("--topic", action="append", required=True, metavar="NAME[:SUBJECT]",
                         help="repeatable; NAME:SUBJECT narrows to one row")
     parser.add_argument("--since", type=int, help="resume after this event id")
     parser.add_argument("--token-command",
-                        help="shell command printing a fresh bearer token; run when the "
+                        help="shell command printing a fresh access token; run when the "
                              "operator says this one will not be accepted back")
     parser.add_argument("--max-seconds", type=float, help="stop after this long")
     parser.add_argument("--until-event", action="store_true",
@@ -224,10 +249,15 @@ def main():
         if deadline and time.monotonic() >= deadline:
             return 5 if args.until_event else 0
         renew = True
+        proof = dpop_proof(args.proof_command, args.url, state["token"])
+        if proof is None:
+            emit(type="error", message="--proof-command produced no proof")
+            return 2
         try:
             with connect(stream_url(args.url, args.topic, state["since"]),
                          subprotocols=[SUBPROTOCOL],
-                         additional_headers={"Authorization": f"Bearer {state['token']}"},
+                         additional_headers={"Authorization": f"DPoP {state['token']}",
+                                             "DPoP": proof},
                          open_timeout=15, close_timeout=5) as socket:
                 emit(type="open")
                 attempt = 0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiosk-server
 version: !ruby/object:Gem::Version
-  version: 0.5.20
+  version: 0.6.28
 platform: ruby
 authors:
 - Phil Pirozhkov
@@ -15,21 +15,21 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.8'
+        version: '2.10'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -39,7 +39,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.8'
+        version: '2.10'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -164,18 +164,19 @@ dependencies:
 description: |
   kiosk-server is the host-side surface for Kiosk. The full surface ships:
 
-    - The controllers — the per-verb wire (GET <endpoint>/<query-name>,
+    - The controllers — the per-verb endpoints (GET <endpoint>/<query-name>,
       POST <endpoint>/<action-name>) and the reserved endpoints
       (/kiosk/schema, /kiosk/pay), a derived OpenAPI description of both,
-      the register/login proof-of-possession auth plane, JWKS, the KYC
+      OAuth client registration (RFC 7591) and the token endpoint
+      (private_key_jwt client assertions, DPoP), JWKS, the KYC
       attestation endpoint, agents.txt / agents.json / kiosk.json
-      discovery, and the account-binding ceremony (RFC 8628-shaped device
-      authorization, the possession-proof-gated token poll, the verify and
-      «Link an assistant» pages).
+      discovery, and the account-binding ceremony (RFC 8628 device
+      authorization and token poll, the verify and «Link an assistant»
+      pages).
     - Kiosk::Server::Executor — dispatches a resolved command to the
       queries and actions the host registered.
-    - Agent registration and login, with a pluggable agent-IdP.
-    - The PoW gate that enforces a kiosk-reputation policy's challenge
+    - Client registration and authentication, with a pluggable agent-IdP.
+    - The proof-of-work toll that a kiosk-reputation policy sets
       (soft dependency; zero overhead when no policy is set).
     - A Rack middleware injecting the Kiosk-Server-Version /
       Kiosk-API-Version / Kiosk-Min-Client response headers, a pure-Ruby
@@ -185,7 +186,7 @@ description: |
 
   The Rails engine serves that whole surface from one `kiosk` block in
   config/routes.rb, which mounts it at Kiosk.configuration.mount_path —
-  drawing the wire/auth/JWKS/KYC/binding routes under the mount and
+  drawing the verb/auth/JWKS/KYC/binding routes under the mount and
   installing the root-relative discovery routes (agents.txt, .well-known)
   into the host — then one route per query and action the block names. It
   also auto-injects the headers middleware.
@@ -208,20 +209,21 @@ files:
 - app/controllers/kiosk/server/kyc_attestation_controller.rb
 - app/controllers/kiosk/server/kyc_callback_controller.rb
 - app/controllers/kiosk/server/oauth_device_authorization_controller.rb
+- app/controllers/kiosk/server/oauth_registration_controller.rb
 - app/controllers/kiosk/server/oauth_token_controller.rb
 - app/controllers/kiosk/server/open_api_controller.rb
 - app/controllers/kiosk/server/payment_setup_controller.rb
 - app/controllers/kiosk/server/verb_controller.rb
 - app/controllers/kiosk/server/wire_controller.rb
-- app/models/kiosk/cart_mandate.rb
+- app/models/kiosk/checkout_mandate.rb
 - app/models/kiosk/server/application_record.rb
 - app/models/kiosk/settlement.rb
 - app/models/kiosk/visit.rb
 - app/views/kiosk/server/assistants/show.html.erb
 - app/views/kiosk/server/device_verify/decided.html.erb
 - app/views/kiosk/server/device_verify/show.html.erb
+- app/views/layouts/kiosk/server/application.html.erb
 - lib/generators/kiosk/install/install_generator.rb
-- lib/generators/kiosk/install/templates/create_kiosk_auth_challenges.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_device_authorizations.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_events.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_identity_tables.rb.tt
@@ -230,7 +232,6 @@ files:
 - lib/generators/kiosk/install/templates/create_kiosk_pow_spent.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_refunds.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_revocations.rb.tt
-- lib/generators/kiosk/install/templates/create_kiosk_schema.rb.tt
 - lib/generators/kiosk/install/templates/create_kiosk_visits.rb.tt
 - lib/generators/kiosk/install/templates/initializer.rb.tt
 - lib/kiosk/handler.rb
@@ -242,15 +243,18 @@ files:
 - lib/kiosk/server/action_event.rb
 - lib/kiosk/server/actions.rb
 - lib/kiosk/server/agent_identity_providers/default_agent_idp.rb
-- lib/kiosk/server/agent_login.rb
-- lib/kiosk/server/agent_registration.rb
+- lib/kiosk/server/agent_rotation.rb
 - lib/kiosk/server/argument_decoder.rb
+- lib/kiosk/server/assistant_accounts.rb
+- lib/kiosk/server/assistant_key.rb
 - lib/kiosk/server/audit_sink.rb
-- lib/kiosk/server/auth_challenge.rb
-- lib/kiosk/server/auth_challenge_stores.rb
 - lib/kiosk/server/auth_toll.rb
 - lib/kiosk/server/binding_module_gate.rb
 - lib/kiosk/server/caller_timezone.rb
+- lib/kiosk/server/checkout.rb
+- lib/kiosk/server/client.rb
+- lib/kiosk/server/client_assertion.rb
+- lib/kiosk/server/client_registration.rb
 - lib/kiosk/server/column_spending_cap.rb
 - lib/kiosk/server/configuration_extension.rb
 - lib/kiosk/server/controller_verb.rb
@@ -260,12 +264,15 @@ files:
 - lib/kiosk/server/device_authorization_stores.rb
 - lib/kiosk/server/device_code_grant.rb
 - lib/kiosk/server/device_verification.rb
+- lib/kiosk/server/dpop.rb
+- lib/kiosk/server/eddsa.rb
 - lib/kiosk/server/engine.rb
 - lib/kiosk/server/errors.rb
 - lib/kiosk/server/event_stores.rb
 - lib/kiosk/server/events.rb
 - lib/kiosk/server/events_cable.rb
 - lib/kiosk/server/events_connection.rb
+- lib/kiosk/server/events_replay.rb
 - lib/kiosk/server/executor.rb
 - lib/kiosk/server/executor/repeat.rb
 - lib/kiosk/server/executor/spending_cap.rb
@@ -277,6 +284,7 @@ files:
 - lib/kiosk/server/headers_middleware.rb
 - lib/kiosk/server/identity_resolution.rb
 - lib/kiosk/server/issuer_middleware.rb
+- lib/kiosk/server/jwk.rb
 - lib/kiosk/server/jwks.rb
 - lib/kiosk/server/jwt_issuer.rb
 - lib/kiosk/server/kyc.rb
@@ -284,22 +292,24 @@ files:
 - lib/kiosk/server/link_code.rb
 - lib/kiosk/server/linked_assistants.rb
 - lib/kiosk/server/mandate_verifier.rb
+- lib/kiosk/server/money.rb
+- lib/kiosk/server/oauth_answers.rb
+- lib/kiosk/server/oauth_error.rb
 - lib/kiosk/server/open_api.rb
 - lib/kiosk/server/page.rb
 - lib/kiosk/server/payment_claim.rb
 - lib/kiosk/server/payment_setup.rb
-- lib/kiosk/server/pop_verifier.rb
 - lib/kiosk/server/pow_gate.rb
 - lib/kiosk/server/pow_spent_stores.rb
 - lib/kiosk/server/pow_toll.rb
 - lib/kiosk/server/queries.rb
+- lib/kiosk/server/receipts.rb
 - lib/kiosk/server/reputation_factors.rb
 - lib/kiosk/server/request_validation.rb
 - lib/kiosk/server/response_validation.rb
 - lib/kiosk/server/result.rb
 - lib/kiosk/server/revocation_stores.rb
 - lib/kiosk/server/routing.rb
-- lib/kiosk/server/schema_definitions.rb
 - lib/kiosk/server/schema_document.rb
 - lib/kiosk/server/schema_slots.rb
 - lib/kiosk/server/schemas/auth.schema.json
@@ -307,16 +317,16 @@ files:
 - lib/kiosk/server/schemas/kyc.schema.json
 - lib/kiosk/server/schemas/mandates.schema.json
 - lib/kiosk/server/schemas/pow.schema.json
+- lib/kiosk/server/sd_jwt.rb
 - lib/kiosk/server/session_context.rb
-- lib/kiosk/server/settled_spend.rb
 - lib/kiosk/server/signing_key.rb
+- lib/kiosk/server/tolled_calls.rb
 - lib/kiosk/server/verb_registry.rb
 - lib/kiosk/server/verb_vocabulary.rb
 - lib/kiosk/server/verb_wire.rb
 - lib/kiosk/server/version.rb
 - lib/kiosk/server/well_known.rb
 - lib/kiosk/server/wire_rendering.rb
-- lib/kiosk/server/wrong_door.rb
 - lib/kiosk/skill_link.rb
 - listen.py
 - requirements.txt

data/app/models/kiosk/cart_mandate.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  # The signed cart the engine records when it settles a `pay`: the line items
-  # the assistant agreed to pay for. Read-only for the operator.
-  class CartMandate < Server::ApplicationRecord
-    def self.table_name = "#{Kiosk.configuration.schema}.cart_mandates"
-
-    has_many :settlements, class_name: 'Kiosk::Settlement', dependent: nil, inverse_of: :cart_mandate
-
-    # Carts with a line item carrying these attributes, by jsonb containment:
-    # `referencing(order_id: id)` matches `[{"order_id": id, "qty": 2}]`. The
-    # values are quoted by the adapter, never interpolated.
-    scope :referencing, lambda { |**attributes|
-      where(Arel::Nodes::InfixOperation.new(
-              '@>', arel_table[:line_items],
-              Arel::Nodes.build_quoted([attributes.transform_values(&:to_s)].to_json)
-            ))
-    }
-  end
-end

data/lib/generators/kiosk/install/templates/create_kiosk_auth_challenges.rb.tt

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-# Migration 010 — create kiosk.auth_challenges.
-# Each public key's outstanding auth challenge, so a challenge issued by one
-# process is redeemed by any other (AuthChallengeStores::ActiveRecord, the default).
-class CreateKioskAuthChallenges < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:auth_challenge) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".auth_challenges)
-  end
-end

data/lib/generators/kiosk/install/templates/create_kiosk_schema.rb.tt

@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-# Migration 001 — Kiosk schema + the four current_*() helper functions.
-#
-# `ActiveRecord::Migration[…]` resolves at host-app load time, so this
-# file picks up whatever Rails version the host is on.
-class CreateKioskSchema < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:helper_functions, guc_namespace: options[:guc_namespace], user_id_type: user_id_type) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP SCHEMA IF EXISTS "<%= options[:schema] %>" CASCADE)
-  end
-end

data/lib/kiosk/server/agent_login.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  module Server
-    # Login with an already-registered public key: proves possession and mints a
-    # fresh token. An unknown key is a 404, never a new account.
-    module AgentLogin
-      module_function
-
-      def call(public_key_pem:, signed:)
-        pem = public_key_pem.to_s.strip
-
-        # Prove possession BEFORE any lookup or state change.
-        payload = PopVerifier.verify!(public_key_pem: pem, signed: signed)
-        AuthChallenge.consume!(public_key_pem: pem, nonce: payload.fetch(:nonce))
-
-        row      = registered_agent(pem)
-        agent_id = row.fetch('id')
-        role     = primary_role(row.fetch('allowed_roles'))
-        token    = AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: agent_id, role: role)
-        { access_token: token }
-      end
-
-      def registered_agent(pem)
-        row = ::ActiveRecord::Base.lease_connection.exec_query(<<~SQL.squish, 'Kiosk agent lookup by key', [pem, Kiosk.current_issuer]).to_a.first
-          SELECT id, user_id, allowed_roles FROM #{Kiosk.configuration.schema}.agents
-          WHERE public_key = $1 AND issuer = $2 AND revoked_at IS NULL
-          LIMIT 1
-        SQL
-        return row if row
-
-        raise Errors::NotFound.new(
-          'no agent registered for this public key',
-          hint: 'POST /auth/register to create an identity for a new key'
-        )
-      end
-      private_class_method :registered_agent
-
-      # `allowed_roles` is an Array or a text[] literal ("{customer}"), by adapter.
-      def primary_role(allowed_roles)
-        case allowed_roles
-        when Array then allowed_roles.first
-        else allowed_roles.to_s.delete('{}').split(',').first
-        end
-      end
-      private_class_method :primary_role
-    end
-  end
-end

data/lib/kiosk/server/agent_registration.rb

@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-
-require 'active_record'
-require 'active_support/core_ext/string/inflections' # String#constantize
-
-module Kiosk
-  module Server
-    # Self-registration with no human: creates the assistant account, binds an
-    # agent to the key, and mints its first token.
-    module AgentRegistration
-      module_function
-
-      def call(public_key_pem:, signed:, pow: nil)
-        config = Kiosk.configuration
-        role   = registration_role(config)
-        public_key_pem = public_key_pem.to_s.strip
-
-        AuthToll.gate(verb: 'auth/register', body: { public_key: public_key_pem }, pow: pow, config: config)
-
-        # Prove possession of the private key before any lookup or write.
-        payload = PopVerifier.verify!(public_key_pem: public_key_pem, signed: signed)
-        AuthChallenge.consume!(public_key_pem: public_key_pem, nonce: payload.fetch(:nonce))
-
-        conn = ::ActiveRecord::Base.lease_connection
-        refuse_known_key!(conn, config, public_key_pem)
-        conn.transaction { register(conn, config, public_key_pem, role) }
-      end
-
-      # The operator's `assistant_creation` factory, else a bare `user_model.create!`.
-      def create_assistant_account(config, public_key_pem)
-        return config.user_model.constantize.create!.id unless config.assistant_creation
-
-        id = config.assistant_creation.call(public_key_pem)
-        return id unless id.nil?
-
-        raise Errors::ConfigurationError,
-              'config.assistant_creation returned nil. The block must create the ' \
-              'assistant account and RETURN its id (used as agents.user_id), e.g. ' \
-              'c.assistant_creation = ->(pubkey) { AssistantAccount.create!(...).id }'
-      end
-
-      # The role is the server's choice, never the agent's.
-      def registration_role(config)
-        role = config.registration_role&.to_s
-        return if role.blank?
-        return role if config.roles.map(&:to_s).include?(role)
-
-        raise Errors::ConfigurationError,
-              "registration_role #{role.inspect} is not among configured roles " \
-              "#{config.roles.inspect}"
-      end
-
-      # A known key logs in instead; it is never registered twice.
-      def refuse_known_key!(conn, config, public_key_pem)
-        existing = conn.exec_query(<<~SQL.squish, 'Kiosk agent lookup by key', [public_key_pem, Kiosk.current_issuer]).to_a.first
-          SELECT id FROM #{config.schema}.agents
-          WHERE public_key = $1 AND issuer = $2 AND revoked_at IS NULL
-          LIMIT 1
-        SQL
-        return unless existing
-
-        raise Errors::Conflict.new(
-          'public key already registered',
-          hint: 'use POST /auth/login to refresh a token for an existing key'
-        )
-      end
-
-      def register(conn, config, public_key_pem, role)
-        assistant_account_id = create_assistant_account(config, public_key_pem)
-        agent_id = insert_agent(conn, config, [assistant_account_id, public_key_pem, Kiosk.current_issuer], role)
-        token = AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: agent_id, role: role)
-        { agent_id: agent_id, user_id: assistant_account_id.to_s, access_token: token }
-      end
-
-      # No role is the empty array: `allowed_roles` is NOT NULL.
-      def insert_agent(conn, config, binds, role)
-        allowed_roles_sql, role_binds = role ? ['ARRAY[$4]::text[]', [role]] : ["'{}'::text[]", []]
-        rows = conn.exec_query(<<~SQL.squish, 'Kiosk agent insert', [*binds, *role_binds])
-          INSERT INTO #{config.schema}.agents (user_id, allowed_roles, public_key, issuer)
-          VALUES ($1, #{allowed_roles_sql}, $2, $3)
-          RETURNING id
-        SQL
-        rows.to_a.first.fetch('id')
-      end
-      private_class_method :registration_role, :refuse_known_key!, :register, :insert_agent
-    end
-  end
-end

data/lib/kiosk/server/auth_challenge.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require 'securerandom'
-
-module Kiosk
-  module Server
-    # Server side of the proof-of-possession challenge: a single-use, short-lived
-    # nonce per public key.
-    module AuthChallenge
-      module_function
-
-      # The agent signs `challenge` into its JWS; `exp` is the Unix expiry.
-      def issue(public_key_pem:, now: Time.current)
-        config = Kiosk.configuration
-        nonce  = SecureRandom.urlsafe_base64(32)
-        exp    = now.to_i + config.auth_challenge_ttl
-        config.auth_challenge_store.put(public_key_pem.to_s.strip, nonce, exp)
-        { challenge: nonce, exp: exp }
-      end
-
-      def consume!(public_key_pem:, nonce:)
-        ok = Kiosk.configuration.auth_challenge_store.take(public_key_pem.to_s.strip, nonce.to_s)
-        return true if ok
-
-        raise Errors::Unauthenticated.new(
-          'no matching auth challenge',
-          hint: 'GET /auth/challenge?public_key=… first, then sign the returned nonce; ' \
-                'challenges are single-use and short-lived'
-        )
-      end
-    end
-  end
-end