kiosk-server 0.5.20 → 0.6.28

data/lib/kiosk/server/auth_challenge_stores.rb

@@ -1,74 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  module Server
-    # The challenge store, shared by every process on the database (§15.2).
-    module AuthChallengeStores
-      # The default: the `<schema>.auth_challenges` table ({SchemaDefinitions.auth_challenge_sql}).
-      class ActiveRecord
-        # Seconds between expired-row sweeps; a sweep bounds growth, not correctness.
-        DEFAULT_PRUNE_INTERVAL = 60
-
-        def initialize(prune_interval: DEFAULT_PRUNE_INTERVAL)
-          @prune_interval = prune_interval
-          @last_prune_at  = 0
-          @mutex          = Mutex.new
-        end
-
-        # Replaces any earlier challenge for the key.
-        def put(public_key_pem, nonce, exp)
-          return if public_key_pem.nil?
-
-          prune_if_due!
-          sql = <<~SQL.squish
-            INSERT INTO #{table} AS c (public_key, nonce, expires_at)
-            VALUES ($1, $2, to_timestamp($3))
-            ON CONFLICT (public_key) DO UPDATE
-              SET nonce = EXCLUDED.nonce, expires_at = EXCLUDED.expires_at
-          SQL
-          connection.exec_query(sql, 'Kiosk auth_challenge put', [public_key_pem, nonce, exp.to_i])
-          nil
-        end
-
-        # One atomic DELETE, so two processes presenting one challenge get one `true`.
-        def take(public_key_pem, nonce) # rubocop:disable Naming/PredicateMethod -- `take` is the store contract `config.auth_challenge_store` names
-          return false if public_key_pem.nil? || nonce.nil?
-
-          sql = <<~SQL.squish
-            DELETE FROM #{table}
-            WHERE public_key = $1 AND nonce = $2 AND expires_at > now()
-            RETURNING public_key
-          SQL
-          rows = connection.exec_query(
-            sql, 'Kiosk auth_challenge take', [public_key_pem, nonce]
-          ).to_a
-          !rows.empty?
-        end
-
-        def prune!
-          connection.exec_query(%(DELETE FROM #{table} WHERE expires_at <= now()),
-                                'Kiosk auth_challenge prune')
-          nil
-        end
-
-        private
-
-        def prune_if_due!
-          now = Time.now.to_i
-          due = @mutex.synchronize do
-            if now - @last_prune_at >= @prune_interval
-              @last_prune_at = now
-              true
-            else
-              false
-            end
-          end
-          prune! if due
-        end
-
-        def connection = ::ActiveRecord::Base.lease_connection
-        def table = %("#{Kiosk.configuration.schema}".auth_challenges)
-      end
-    end
-  end
-end

data/lib/kiosk/server/pop_verifier.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-require 'jwt'
-require 'openssl'
-require 'rails'
-
-module Kiosk
-  module Server
-    # Verifies an agent's proof-of-possession JWS: RS256 by the presented key,
-    # `aud` equal to this origin (the relay defence), and the challenge `nonce`.
-    # The caller burns the nonce only after a clean verify.
-    module PopVerifier
-      # Names no origin: an echoed one is what a relaying server would exploit.
-      AUDIENCE_HINT =
-        'sign `aud` = the origin you connected to, taken from your own request ' \
-        'URL — never from a value echoed back in a response'
-
-      PROOF_REQUIRED_CLAIMS = %w[aud nonce jti].freeze
-
-      MAX_KEY_BITS = 4096
-
-      PROOF_CLAIMS_HINT =
-        "a proof's payload carries #{PROOF_REQUIRED_CLAIMS.join(', ')} — `aud` is the origin " \
-        'you connected to, `nonce` the value GET /auth/challenge just issued for this key, ' \
-        '`jti` a unique id for this proof'.freeze
-
-      PROOF_SIGNATURE_HINT =
-        'a proof is a compact RS256 JWS — header.payload.signature — signed with the ' \
-        'private key matching the public_key you sent'
-
-      module_function
-
-      def verify!(public_key_pem:, signed:)
-        pem = public_key_pem.to_s.strip
-        payload = decode(signed, load_public_key(pem))
-        check_audience!(payload[:aud])
-        raise Errors::Unauthenticated, 'proof key thumbprint mismatch' if payload.key?(:pub) && payload[:pub] != SigningKey.from_pem(pem).kid
-
-        payload
-      end
-
-      def decode(signed, key)
-        payload, = ::JWT.decode(signed.to_s, key, true, algorithms: ['RS256'], required_claims: PROOF_REQUIRED_CLAIMS)
-        payload.transform_keys(&:to_sym)
-      rescue ::JWT::MissingRequiredClaim
-        raise Errors::Unauthenticated.new('proof is missing a required claim', hint: PROOF_CLAIMS_HINT)
-      rescue ::JWT::DecodeError
-        raise Errors::Unauthenticated.new('proof signature invalid', hint: PROOF_SIGNATURE_HINT)
-      end
-
-      def check_audience!(signed_aud)
-        issuer = Kiosk.current_issuer
-        return if signed_aud == issuer
-
-        log_audience_mismatch(signed_aud: signed_aud, issuer: issuer)
-        raise Errors::Unauthenticated.new('proof audience mismatch', hint: AUDIENCE_HINT)
-      end
-
-      # Operator log only, since the response must not name an origin: the
-      # caller signed a wrong value, or the origin it reached is not served.
-      def log_audience_mismatch(signed_aud:, issuer:)
-        message = "[kiosk] PoP audience mismatch: caller signed aud=#{signed_aud.inspect}, " \
-                  "the issuer for this request is #{issuer.inspect}. If the signed value is " \
-                  'an origin your assistants actually reach, list it in `c.issuer` or ' \
-                  '`c.additional_origins`.'
-        logger = ::Rails.logger
-        logger ? logger.warn(message) : warn(message)
-      end
-
-      # Also the key bounds of account binding.
-      def load_public_key(pem)
-        OpenSSL::PKey::RSA.new(pem).tap { require_key_size!(it.n.num_bits) }
-      rescue OpenSSL::PKey::PKeyError
-        raise Errors::BadRequest.new(
-          'invalid public key',
-          hint: "send a PEM-encoded RSA public key of #{SigningKey::MIN_KEY_BITS} to #{MAX_KEY_BITS} bits " \
-                '(-----BEGIN PUBLIC KEY----- …)'
-        )
-      end
-
-      def require_key_size!(bits)
-        raise Errors::BadRequest, "public key too small (#{bits} bits; minimum #{SigningKey::MIN_KEY_BITS})" if bits < SigningKey::MIN_KEY_BITS
-        raise Errors::BadRequest, "public key too large (#{bits} bits; maximum #{MAX_KEY_BITS})" if bits > MAX_KEY_BITS
-      end
-    end
-  end
-end

data/lib/kiosk/server/schema_definitions.rb

@@ -1,351 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  module Server
-    # The SQL of the migrations `kiosk:install` emits, one method per
-    # migration, each creating its tables in their final shape. No database
-    # connection; the host's migrations `execute` it.
-    # rubocop:disable-next Metrics/ModuleLength, Metrics/MethodLength -- each method returns one migration's DDL as one SQL heredoc
-    module SchemaDefinitions
-      module_function
-
-      # 001: the schema and the `current_*()` GUC readers.
-      def helper_functions_sql(schema: nil, guc_namespace: nil, user_id_type: nil)
-        schema ||= Kiosk.configuration.schema
-        guc_namespace ||= Kiosk.configuration.guc_namespace
-        user_id_type  ||= Kiosk.configuration.user_id_type
-        cast = user_id_cast(user_id_type)
-
-        <<~DDL.strip
-          CREATE SCHEMA IF NOT EXISTS "#{schema}";
-
-          CREATE OR REPLACE FUNCTION "#{schema}".current_user_id() RETURNS #{cast} LANGUAGE sql STABLE AS $$
-            SELECT NULLIF(current_setting('#{guc_namespace}.current_user_id', true), '')::#{cast}
-          $$;
-
-          CREATE OR REPLACE FUNCTION "#{schema}".current_role() RETURNS text LANGUAGE sql STABLE AS $$
-            SELECT NULLIF(current_setting('#{guc_namespace}.current_role', true), '')
-          $$;
-
-          CREATE OR REPLACE FUNCTION "#{schema}".current_actor() RETURNS text LANGUAGE sql STABLE AS $$
-            SELECT NULLIF(current_setting('#{guc_namespace}.current_actor', true), '')
-          $$;
-
-          CREATE OR REPLACE FUNCTION "#{schema}".current_agent_id() RETURNS uuid LANGUAGE sql STABLE AS $$
-            SELECT NULLIF(current_setting('#{guc_namespace}.current_agent_id', true), '')::uuid
-          $$;
-        DDL
-      end
-
-      # 002: `agents` (`spending_cap_cents`: NULL unlimited, 0 disabled; a cap
-      # has its `spending_cap_currency`), `agent_tokens`, `agent_mappings`.
-      def identity_tables_sql(schema: nil, user_id_type: nil, user_table: 'users')
-        schema ||= Kiosk.configuration.schema
-        user_id_type ||= Kiosk.configuration.user_id_type
-        col_type = user_id_cast(user_id_type)
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".agents (
-            id                  uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            user_id             #{col_type} NOT NULL REFERENCES "#{user_table}"(id) ON DELETE CASCADE,
-            allowed_roles       text[] NOT NULL DEFAULT '{}'::text[],
-            public_key          text,
-            human_label         text,
-            spending_cap_cents  bigint,
-            spending_cap_currency text CHECK (spending_cap_currency ~ '^[a-z]{3}$'),
-            created_at          timestamptz NOT NULL DEFAULT now(),
-            revoked_at          timestamptz,
-            issuer              text NOT NULL,
-            CONSTRAINT agents_spending_cap_currency_set
-              CHECK ((spending_cap_cents IS NULL) = (spending_cap_currency IS NULL))
-          );
-
-          CREATE INDEX IF NOT EXISTS idx_agents_user_id ON "#{schema}".agents (user_id) WHERE revoked_at IS NULL;
-          -- Dedupe at the DB, not via SELECT-then-INSERT (TOCTOU): two LIVE
-          -- rows for one public key on one origin cannot coexist. Partial
-          -- (WHERE revoked_at IS NULL) so a revoked key can re-register.
-          CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_issuer_public_key_live
-            ON "#{schema}".agents (issuer, public_key) WHERE revoked_at IS NULL;
-
-          CREATE TABLE IF NOT EXISTS "#{schema}".agent_tokens (
-            id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            agent_id    uuid NOT NULL REFERENCES "#{schema}".agents(id) ON DELETE CASCADE,
-            token_hash  text NOT NULL,
-            issued_at   timestamptz NOT NULL DEFAULT now(),
-            expires_at  timestamptz NOT NULL,
-            revoked_at  timestamptz
-          );
-          CREATE INDEX IF NOT EXISTS idx_agent_tokens_agent_id ON "#{schema}".agent_tokens (agent_id);
-          CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_tokens_hash ON "#{schema}".agent_tokens (token_hash);
-
-          CREATE TABLE IF NOT EXISTS "#{schema}".agent_mappings (
-            provider     text NOT NULL,
-            external_id  text NOT NULL,
-            agent_id     uuid NOT NULL REFERENCES "#{schema}".agents(id) ON DELETE CASCADE,
-            PRIMARY KEY (provider, external_id)
-          );
-        DDL
-      end
-
-      # 004: account-binding requests; codes are stored hashed only.
-      # `requested_role` is the approving human's role, never a client's.
-      def device_authorizations_sql(schema: nil, user_id_type: nil)
-        schema ||= Kiosk.configuration.schema
-        user_id_type ||= Kiosk.configuration.user_id_type
-        col_type = user_id_cast(user_id_type)
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".device_authorizations (
-            id               uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            device_code_hash text NOT NULL,
-            user_code_hash   text NOT NULL,
-            public_key_pem   text,
-            kind             text NOT NULL DEFAULT 'claim',
-            client_id        text NOT NULL,
-            requested_role   text,
-            status           text NOT NULL,
-            user_id          #{col_type},
-            expires_at       timestamptz NOT NULL,
-            consumed_at      timestamptz,
-            created_at       timestamptz NOT NULL DEFAULT now(),
-            CONSTRAINT device_authorizations_status_check
-              CHECK (status IN ('pending', 'approved', 'denied', 'consumed', 'expired')),
-            CONSTRAINT device_authorizations_kind_check
-              CHECK (kind IN ('claim', 'link'))
-          );
-          CREATE UNIQUE INDEX IF NOT EXISTS idx_device_authorizations_code_hash
-            ON "#{schema}".device_authorizations (device_code_hash);
-          -- Only `pending` rows need a unique user_code; approved/consumed
-          -- rows may share codes from past flows without collision.
-          CREATE UNIQUE INDEX IF NOT EXISTS idx_device_authorizations_user_code_pending
-            ON "#{schema}".device_authorizations (user_code_hash)
-            WHERE status = 'pending';
-          CREATE INDEX IF NOT EXISTS idx_device_authorizations_expiry
-            ON "#{schema}".device_authorizations (expires_at)
-            WHERE status IN ('pending', 'approved');
-        DDL
-      end
-
-      # 005: the AP2 trail. `id` is server-generated; the signed mandate id is
-      # `mandate_id`, unique per principal. A cart's `declined_at` records a
-      # charge refused with no money moved. A settlement is server-minted, so it
-      # carries no `raw_jws`.
-      def mandates_sql(schema: nil, user_id_type: nil)
-        schema       ||= Kiosk.configuration.schema
-        user_id_type ||= Kiosk.configuration.user_id_type
-        col_type = user_id_cast(user_id_type)
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".intent_mandates (
-            id                uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            mandate_id        text NOT NULL,
-            user_id           #{col_type} NOT NULL,
-            agent_id          uuid NOT NULL,
-            issuer            text NOT NULL,
-            scope             text NOT NULL,
-            cap_amount_cents  bigint NOT NULL,
-            currency          text NOT NULL,
-            expires_at        timestamptz NOT NULL,
-            created_at        timestamptz NOT NULL DEFAULT now(),
-            raw_jws           text NOT NULL,
-            UNIQUE (user_id, mandate_id)
-          );
-          CREATE INDEX IF NOT EXISTS idx_intent_mandates_user_id  ON "#{schema}".intent_mandates (user_id);
-          CREATE INDEX IF NOT EXISTS idx_intent_mandates_agent_id ON "#{schema}".intent_mandates (agent_id);
-
-          CREATE TABLE IF NOT EXISTS "#{schema}".cart_mandates (
-            id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            mandate_id         text NOT NULL,
-            intent_mandate_id  uuid NOT NULL REFERENCES "#{schema}".intent_mandates(id) ON DELETE CASCADE,
-            user_id            #{col_type} NOT NULL,
-            agent_id           uuid NOT NULL,
-            issuer             text NOT NULL,
-            line_items         jsonb NOT NULL,
-            total_amount_cents bigint NOT NULL,
-            currency           text NOT NULL,
-            expires_at         timestamptz NOT NULL,
-            created_at         timestamptz NOT NULL DEFAULT now(),
-            raw_jws            text NOT NULL,
-            declined_at        timestamptz,
-            UNIQUE (user_id, mandate_id)
-          );
-          CREATE INDEX IF NOT EXISTS idx_cart_mandates_user_id ON "#{schema}".cart_mandates (user_id);
-          CREATE INDEX IF NOT EXISTS idx_cart_mandates_intent  ON "#{schema}".cart_mandates (intent_mandate_id);
-
-          CREATE TABLE IF NOT EXISTS "#{schema}".payment_mandates (
-            id               uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            mandate_id       text NOT NULL,
-            cart_mandate_id  uuid NOT NULL REFERENCES "#{schema}".cart_mandates(id) ON DELETE CASCADE,
-            user_id          #{col_type} NOT NULL,
-            agent_id         uuid NOT NULL,
-            issuer           text NOT NULL,
-            payment_method   text NOT NULL,
-            amount_cents     bigint NOT NULL,
-            currency         text NOT NULL,
-            expires_at       timestamptz,
-            created_at       timestamptz NOT NULL DEFAULT now(),
-            raw_jws          text NOT NULL,
-            UNIQUE (user_id, mandate_id)
-          );
-          CREATE INDEX IF NOT EXISTS idx_payment_mandates_user_id ON "#{schema}".payment_mandates (user_id);
-          CREATE INDEX IF NOT EXISTS idx_payment_mandates_cart    ON "#{schema}".payment_mandates (cart_mandate_id);
-
-          CREATE TABLE IF NOT EXISTS "#{schema}".settlements (
-            id                   uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            cart_mandate_id      uuid NOT NULL REFERENCES "#{schema}".cart_mandates(id) ON DELETE CASCADE,
-            user_id              #{col_type} NOT NULL,
-            agent_id             uuid NOT NULL,
-            issuer               text NOT NULL,
-            psp_reference        text NOT NULL,
-            settled_amount_cents bigint NOT NULL,
-            currency             text NOT NULL,
-            settled_at           timestamptz NOT NULL,
-            UNIQUE (cart_mandate_id)
-          );
-          CREATE INDEX IF NOT EXISTS idx_settlements_user_id ON "#{schema}".settlements (user_id);
-          CREATE INDEX IF NOT EXISTS idx_settlements_cart    ON "#{schema}".settlements (cart_mandate_id);
-        DDL
-      end
-
-      # 006: KYC grants and open verifications, keyed on the person.
-      def kyc_attributes_sql(schema: nil, user_id_type: nil, user_table: nil)
-        schema       ||= Kiosk.configuration.schema
-        user_id_type ||= Kiosk.configuration.user_id_type
-        user_table   ||= configured_user_table
-        col_type = user_id_cast(user_id_type)
-        person   = %(#{col_type} NOT NULL REFERENCES "#{user_table}"(id) ON DELETE CASCADE)
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".kyc_attributes (
-            user_id    #{person},
-            name       text NOT NULL,
-            granted_at timestamptz NOT NULL DEFAULT now(),
-            PRIMARY KEY (user_id, name)
-          );
-
-          CREATE TABLE IF NOT EXISTS "#{schema}".kyc_requests (
-            id          text PRIMARY KEY,
-            user_id     #{person},
-            nonce       text NOT NULL,
-            approved_at timestamptz,
-            created_at  timestamptz NOT NULL DEFAULT now()
-          );
-          CREATE INDEX IF NOT EXISTS idx_kyc_requests_user_id ON "#{schema}".kyc_requests (user_id, created_at);
-        DDL
-      end
-
-      # 007: the event tail; `id` is the origin's one monotonic cursor.
-      def events_sql(schema: nil)
-        schema ||= Kiosk.configuration.schema
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".events (
-            id           bigserial   PRIMARY KEY,
-            identity_key text        NOT NULL,
-            topic        text        NOT NULL,
-            subject      text,
-            occurred_at  timestamptz NOT NULL,
-            data         jsonb       NOT NULL,
-            created_at   timestamptz NOT NULL DEFAULT now()
-          );
-          -- `since` for one subscriber: the cursor scan, in id order.
-          CREATE INDEX IF NOT EXISTS idx_events_identity_key_id
-            ON "#{schema}".events (identity_key, id);
-          -- The retention sweep only.
-          CREATE INDEX IF NOT EXISTS idx_events_created_at
-            ON "#{schema}".events (created_at);
-        DDL
-      end
-
-      # 008: spent proof-of-work challenge ids; the primary key is the single-use gate.
-      def pow_spent_sql(schema: nil)
-        schema ||= Kiosk.configuration.schema
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".pow_spent (
-            id         text        PRIMARY KEY,
-            expires_at timestamptz NOT NULL
-          );
-          -- Supports the TTL sweep only; the PK above is what enforces
-          -- single-use.
-          CREATE INDEX IF NOT EXISTS idx_pow_spent_expires_at
-            ON "#{schema}".pow_spent (expires_at);
-        DDL
-      end
-
-      # 009: each agent's revocation watermark: a token issued before it stops verifying.
-      def revocations_sql(schema: nil)
-        schema ||= Kiosk.configuration.schema
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".revocations (
-            agent_id       uuid        PRIMARY KEY REFERENCES "#{schema}".agents(id) ON DELETE CASCADE,
-            revoked_before timestamptz NOT NULL
-          );
-        DDL
-      end
-
-      # 011: the visits an operator records as fulfilled; reputation counts their value.
-      def visits_sql(schema: nil, user_id_type: nil)
-        schema ||= Kiosk.configuration.schema
-        col_type = user_id_cast(user_id_type || Kiosk.configuration.user_id_type)
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".visits (
-            id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            user_id     #{col_type} NOT NULL,
-            value_cents bigint NOT NULL CHECK (value_cents >= 0),
-            visited_at  timestamptz NOT NULL DEFAULT now()
-          );
-          CREATE INDEX IF NOT EXISTS idx_visits_user_id ON "#{schema}".visits (user_id, visited_at);
-        DDL
-      end
-
-      # 012: the refunds of settled charges, one row per PSP refund; recent
-      # spend counts a settlement less what was refunded of it.
-      def refunds_sql(schema: nil)
-        schema ||= Kiosk.configuration.schema
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".refunds (
-            id                    uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-            settlement_id         uuid NOT NULL REFERENCES "#{schema}".settlements(id) ON DELETE CASCADE,
-            psp_reference         text NOT NULL UNIQUE,
-            refunded_amount_cents bigint NOT NULL CHECK (refunded_amount_cents > 0),
-            refunded_at           timestamptz NOT NULL
-          );
-          CREATE INDEX IF NOT EXISTS idx_refunds_settlement_id ON "#{schema}".refunds (settlement_id);
-        DDL
-      end
-
-      # 010: each public key's outstanding auth challenge; the primary key keeps it single.
-      def auth_challenge_sql(schema: nil)
-        schema ||= Kiosk.configuration.schema
-
-        <<~DDL.strip
-          CREATE TABLE IF NOT EXISTS "#{schema}".auth_challenges (
-            public_key text        PRIMARY KEY,
-            nonce      text        NOT NULL,
-            expires_at timestamptz NOT NULL
-          );
-          -- Supports the TTL sweep only.
-          CREATE INDEX IF NOT EXISTS idx_auth_challenges_expires_at
-            ON "#{schema}".auth_challenges (expires_at);
-        DDL
-      end
-
-      def configured_user_table = Kiosk.configuration.user_model.to_s.constantize.table_name
-
-      def user_id_cast(user_id_type)
-        case user_id_type.to_sym
-        when :uuid               then 'uuid'
-        when :bigint, :integer   then user_id_type.to_s
-        when :text               then 'text'
-        else
-          raise ArgumentError,
-                "user_id_type must be one of :uuid, :bigint, :integer, :text — got #{user_id_type.inspect}"
-        end
-      end
-    end
-  end
-end

data/lib/kiosk/server/settled_spend.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Kiosk
-  module Server
-    # What an assistant spent: each settlement less what was refunded of it,
-    # never below zero, one tally per currency. The «Link an assistant» page
-    # shows this figure. The spending cap counts it plus the carts in flight.
-    module SettledSpend
-      module_function
-
-      # The net cents of the current `settlements` row.
-      def net_cents_sql(schema)
-        <<~SQL.squish
-          GREATEST(settlements.settled_amount_cents - (
-            SELECT COALESCE(SUM(r.refunded_amount_cents), 0) FROM #{schema}.refunds r WHERE r.settlement_id = settlements.id
-          ), 0)
-        SQL
-      end
-    end
-  end
-end

data/lib/kiosk/server/wrong_door.rb

@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-require 'active_support/concern'
-
-module Kiosk
-  module Server
-    # The account holder's browser pages. A JSON caller without a CSRF token is
-    # an assistant at the wrong door: the answer points it at the wire. Browser
-    # requests re-raise untouched. Each page's controller sets WRONG_DOOR_MESSAGE.
-    module WrongDoor
-      extend ActiveSupport::Concern
-
-      included do
-        rescue_from ::ActionController::InvalidAuthenticityToken do |error|
-          raise error unless json_request?
-
-          render json: wrong_door_envelope, status: :unprocessable_entity
-        end
-      end
-
-      private
-
-      # An explicit JSON Accept or a JSON body; anything ambiguous counts as a browser.
-      def json_request?
-        return true if request.format.json?
-
-        !!request.content_mime_type&.json?
-      rescue StandardError
-        false
-      end
-
-      # Not a wire problem document or wire error code: this page is not the wire.
-      def wrong_door_envelope
-        hint = "assistants use the wire: GET #{request.base_url}/.well-known/kiosk.json " \
-               'for the register/login endpoints, then GET <endpoint>/schema ' \
-               '(public) for the verbs this origin serves'
-        { ok: false,
-          error: { code: 'invalid_authenticity_token', message: self.class::WRONG_DOOR_MESSAGE, hint: hint } }
-      end
-    end
-  end
-end