kiosk-server 0.5.20 → 0.6.28

data/app/controllers/kiosk/server/oauth_token_controller.rb

@@ -4,55 +4,59 @@ require 'action_controller'
 
 module Kiosk
   module Server
-    # POST <endpoint>/oauth/token: the assistant polls the claim ceremony
-    # (RFC 8628 §3.4). Only the device_code grant is served.
+    # POST <endpoint>/oauth/token (RFC 6749 Section 3.2): a registered client
+    # authenticates with a client assertion (RFC 7523) and a DPoP proof of its
+    # registered key (RFC 9449), and gets an access token bound to that key.
+    # The client_credentials grant is always served; the device-code grant
+    # (RFC 8628 Section 3.4) only where the origin serves account binding.
     class OauthTokenController < ::ActionController::API
-      include BindingModuleGate
       include AuthController::Answers
       include AuthController::Proofs
-
-      prepend_before_action :refuse_unserved_binding
-
-      UNSUPPORTED_GRANT = 'only the device_code grant is served here — ' \
-                          'kiosk-pop (POST /auth/login) is the token-refresh path'
+      include OauthAnswers
 
       def create
         case params[:grant_type].to_s
-        when DeviceCodeGrant::GRANT_TYPE then handle_device_code_grant
-        when '' then render_oauth_error(:invalid_request, 'grant_type required', status: 400)
-        else render_oauth_error(:unsupported_grant_type, UNSUPPORTED_GRANT, status: 400)
+        when Client::CLIENT_CREDENTIALS then render_token(authenticated_client)
+        when Client::DEVICE_CODE then device_code_grant
+        when '' then raise OauthError.new(:invalid_request, 'grant_type required')
+        else raise OauthError.new(:unsupported_grant_type, unsupported_grant)
         end
+      rescue OauthError => e
+        render_oauth_error(e)
+      rescue Errors::Base => e
+        render_error(e)
       end
 
       private
 
-      # The auth toll answers with its own problem documents (§10); every other refusal is OAuth's.
-      def handle_device_code_grant
-        result = DeviceCodeGrant.exchange(device_code: params[:device_code].to_s, signed: params[:signed], pow: proofs)
-        Kiosk::Server::Headers.add_to(response.headers)
-        return render json: token_body(result) if result[:ok]
+      # The toll comes before the client authenticates and before the code is read.
+      def device_code_grant
+        device_code = params[:device_code].to_s
+        raise OauthError.new(:unsupported_grant_type, unsupported_grant) unless Kiosk.configuration.serve_account_binding
+        raise OauthError.new(:invalid_request, 'device_code parameter required') if device_code.empty?
 
-        render_grant_failure(result)
-      rescue Errors::Base => e
-        render_error(e)
+        DeviceCodeGrant.pay_toll!(device_code, proofs)
+        render_token(DeviceCodeGrant.exchange(device_code: device_code, client: authenticated_client))
       end
 
-      # RFC 6749 §5.2: invalid_client — the possession proof failed —
-      # is the one error the server SHOULD signal with 401.
-      def render_grant_failure(result)
-        status = result[:error] == 'invalid_client' ? 401 : 400
-        render json: { error: result[:error], error_description: result[:description] }, status: status
-      end
+      def unsupported_grant = "the grant types served here are #{Client.grant_types.join(', ')}"
 
-      def token_body(result)
-        body = { access_token: result[:access_token], token_type: result[:token_type], expires_in: result[:expires_in] }
-        body[:scope] = result[:scope] if result[:scope]
-        body
+      # The client assertion, then the DPoP proof of the registered key.
+      def authenticated_client
+        client = authenticate_client!
+        Dpop.verify_token_request!(request.headers['DPoP'], jkt: client.thumbprint, url: "#{Kiosk.current_issuer}#{request.path}")
+        client
       end
 
-      def render_oauth_error(code, description, status:)
-        Kiosk::Server::Headers.add_to(response.headers)
-        render json: { error: code.to_s, error_description: description }, status: status
+      # RFC 6749 Section 5.1. The scope is the role of the client. A requested
+      # `scope` is ignored (RFC 6749 Section 3.3): an assistant gets another
+      # role only when a human who holds that role binds it to their account,
+      # or through the identity provider.
+      def render_token(client)
+        token = AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: client.id, role: client.role)
+        body = { access_token: token, token_type: Dpop::SCHEME, expires_in: Kiosk.configuration.access_token_ttl }
+        body[:scope] = client.role if client.role
+        render_oauth(body)
       end
     end
   end

data/app/controllers/kiosk/server/payment_setup_controller.rb

@@ -18,12 +18,11 @@ module Kiosk
 
       private
 
+      # No script and no inline style: a host Content-Security-Policy of `default-src 'self'` holds.
       def page(title, text)
         <<~HTML
-          <!DOCTYPE html><html><head><meta charset="utf-8"><title>#{title}</title></head>
-          <body style="font-family:system-ui,sans-serif;text-align:center;padding:64px">
-          <h1>#{title}</h1><p>#{text}</p>
-          </body></html>
+          <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>#{title}</title></head>
+          <body><main><h1>#{title}</h1><p>#{text}</p></main></body></html>
         HTML
       end
     end

data/app/controllers/kiosk/server/wire_controller.rb

@@ -6,8 +6,8 @@ require 'action_dispatch/http/parameters'
 module Kiosk
   module Server
     # The reserved `GET <endpoint>/schema` (public) and `POST <endpoint>/pay`,
-    # and the base every wire controller inherits its seams from.
-    # Wire response (JSON): success is the handler's payload VERBATIM; an error
+    # and the base every WireController inherits its seams from.
+    # Response (JSON): success is the handler's payload VERBATIM; an error
     # is an RFC 9457 problem document.
     class WireController < ::ActionController::API
       include VerbWire

data/app/models/kiosk/checkout_mandate.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Kiosk
+  # The checkout mandate the engine records when it settles a `pay`: the line
+  # items of the operator's checkout that the assistant agreed to pay for.
+  # Read-only for the operator.
+  class CheckoutMandate < Server::ApplicationRecord
+    has_many :settlements, class_name: 'Kiosk::Settlement', dependent: nil, inverse_of: :checkout_mandate
+
+    # Checkout mandates with a line item carrying these attributes, by jsonb
+    # containment: `referencing(order_id: id)` matches `[{"order_id": id, "qty": 2}]`.
+    # The values are quoted by the adapter, never interpolated.
+    scope :referencing, lambda { |**attributes|
+      where(Arel::Nodes::InfixOperation.new(
+              '@>', arel_table[:line_items],
+              Arel::Nodes.build_quoted([attributes.transform_values(&:to_s)].to_json)
+            ))
+    }
+  end
+end

data/app/models/kiosk/settlement.rb

@@ -5,8 +5,6 @@ module Kiosk
   class Settlement < Server::ApplicationRecord
     include Kiosk::Owned
 
-    def self.table_name = "#{Kiosk.configuration.schema}.settlements"
-
-    belongs_to :cart_mandate, class_name: 'Kiosk::CartMandate', inverse_of: :settlements
+    belongs_to :checkout_mandate, class_name: 'Kiosk::CheckoutMandate', inverse_of: :settlements
   end
 end

data/app/models/kiosk/visit.rb

@@ -5,8 +5,6 @@ module Kiosk
   # value counts toward the customer's recent spend, so an operator that takes
   # no payment can still lower the proof-of-work toll for a returning customer.
   class Visit < Server::ApplicationRecord
-    def self.table_name = "#{Kiosk.configuration.schema}.visits"
-
     # Call it when the visit happens, with what the visit was worth.
     def self.record!(user_id:, value_cents:) = create!(user_id:, value_cents:)
   end

data/app/views/kiosk/server/assistants/show.html.erb

@@ -1,6 +1,7 @@
 <%# «Link an assistant» page (link flow — Kiosk extension).
     Minimal on purpose — override by shipping
     app/views/kiosk/server/assistants/show.html.erb in the host app. %>
+<% content_for :title, 'Linked assistants' %>
 <main>
   <h1>Linked assistant accounts</h1>
 
@@ -21,26 +22,17 @@
   <section>
     <h2>Link a new assistant</h2>
     <p>
-      Mint a code, hand it to your assistant; the assistant redeems it with
-      its own key and is then bound to your account.
+      Get a link code and paste it into your assistant's chat. The assistant
+      uses the code once, with its own key, and is then linked to your account.
     </p>
     <form action="<%= @page_path %>/link" method="post">
       <input type="hidden" name="authenticity_token" value="<%= form_authenticity_token %>">
-      <button type="submit">Mint a link code</button>
+      <button type="submit">Get a link code</button>
     </form>
   </section>
 
   <section>
     <h2>Currently linked</h2>
-    <% unless @spending_cap_enforced %>
-      <p role="note">
-        <strong>Note:</strong> this origin configures no <code>spending_cap</code>
-        seam, so a cap saved below is recorded against the assistant but nothing
-        reads it when a charge is settled. To make it bind, set
-        <code>c.spending_cap = Kiosk::Server::ColumnSpendingCap.new</code> in the
-        Kiosk initializer.
-      </p>
-    <% end %>
     <% if @assistants.empty? %>
       <p>No assistant accounts are linked yet.</p>
     <% else %>
@@ -49,36 +41,40 @@
           <li>
             <strong><%= assistant[:human_label].to_s.empty? ? "(unnamed)" : assistant[:human_label] %></strong>
             <code><%= assistant[:fingerprint] %></code>
-            — linked <%= assistant[:created_at] %>
+            <% if assistant[:bound_at] %>— linked <%= assistant[:bound_at] %><% end %>
+            <% if @payments %>
             <p>
-              <%
-                spent = assistant[:spent_cents].map { |currency, cents| "#{cents} cents in #{currency.upcase}" }
-              %>
-              spent: <%= spent.empty? ? "0 cents" : spent.join(", ") %> —
+              <% spent = assistant[:spent_cents].map { |currency, cents| Kiosk::Server::Money.format(cents, currency) } %>
+              Spent: <%= spent.empty? ? "nothing" : spent.join(", ") %>
+              <% if @spending_cap %>
               <%
                 cap = assistant[:spending_cap_cents]
                 cap_label = if cap.nil?
-                              "cap: none"
+                              "no spending cap"
                             elsif cap.zero?
-                              "cap: disabled"
+                              "no payments allowed"
                             else
-                              "cap: #{cap} cents in #{assistant[:spending_cap_currency].upcase}"
+                              "spending cap #{Kiosk::Server::Money.format(cap, assistant[:spending_cap_currency])} per payment"
                             end
               %>
-              <%= cap_label %>
+              — <%= cap_label %>
+              <% end %>
             </p>
+            <% end %>
             <form action="<%= @page_path %>/update" method="post">
               <input type="hidden" name="authenticity_token" value="<%= form_authenticity_token %>">
               <input type="hidden" name="agent_id" value="<%= assistant[:agent_id] %>">
               <label>Label
                 <input type="text" name="human_label" value="<%= assistant[:human_label] %>">
               </label>
-              <label>Spending cap (cents, blank = no cap)
-                <input type="number" name="spending_cap_cents" min="0" value="<%= assistant[:spending_cap_cents] %>">
+              <% if @spending_cap %>
+              <label>Spending cap per payment (blank: no cap; 0: no payments)
+                <input type="text" name="spending_cap" inputmode="decimal" value="<%= assistant[:spending_cap_cents] && Kiosk::Server::Money.amount(assistant[:spending_cap_cents], assistant[:spending_cap_currency]) %>">
               </label>
-              <label>Cap currency (ISO 4217 code; the assistant cannot pay in another currency)
+              <label>Cap currency (a three-letter code such as EUR; the assistant cannot pay in another currency)
                 <input type="text" name="spending_cap_currency" maxlength="3" value="<%= assistant[:spending_cap_currency]&.upcase %>">
               </label>
+              <% end %>
               <button type="submit">Save</button>
             </form>
             <form action="<%= @page_path %>/unlink" method="post">

data/app/views/kiosk/server/device_verify/decided.html.erb

@@ -1,5 +1,6 @@
 <%# Claim-ceremony decision confirmation. Override by shipping
     app/views/kiosk/server/device_verify/decided.html.erb in the host app. %>
+<% content_for :title, 'Link an assistant' %>
 <main>
   <% if @decision == :approved %>
     <h1>Approved</h1>

data/app/views/kiosk/server/device_verify/show.html.erb

@@ -1,6 +1,7 @@
 <%# Claim-ceremony verify page. Minimal on purpose — override
     by shipping app/views/kiosk/server/device_verify/show.html.erb in the
     host app. %>
+<% content_for :title, 'Link an assistant' %>
 <main>
   <h1>Link an assistant to your account</h1>
 

data/app/views/layouts/kiosk/server/application.html.erb

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<%# The document around the account holder's pages. Override by shipping
+    app/views/layouts/kiosk/server/application.html.erb in the host app. %>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title><%= yield :title %> — <%= request.host %></title>
+</head>
+<body>
+<%= yield %>
+<footer><a href="/">Back to <%= request.host %></a></footer>
+</body>
+</html>

data/lib/generators/kiosk/install/install_generator.rb

@@ -6,24 +6,22 @@ require 'rails/generators/migration'
 
 module Kiosk
   module Generators
-    # `bin/rails g kiosk:install`: writes the Kiosk initializer, the wire routes
-    # and the migrations, with the DDL of {Kiosk::Server::SchemaDefinitions} written into each.
+    # `bin/rails g kiosk:install`: writes the Kiosk initializer, the Kiosk routes
+    # and the migrations of Kiosk's `kiosk_*` tables.
     class InstallGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
 
       source_root File.expand_path('templates', __dir__)
 
       desc 'Generate the Kiosk initializer and its canonical base migrations. ' \
-           'Draws the engine mount, so the origin answers on the wire.'
+           'Draws the engine mount, so the origin answers Kiosk requests.'
 
       class_option :user_table,    type: :string, default: 'users',
                                    desc: "Provider's user table name"
-      class_option :user_id_type,  type: :string, default: 'uuid',
+      class_option :user_id_type,  type: :string, default: 'uuid', enum: %w[uuid bigint integer text],
                                    desc: 'User-id column type: uuid | bigint | integer | text'
-      class_option :schema,        type: :string, default: 'kiosk',
-                                   desc: 'Postgres schema name for Kiosk helpers and tables'
-      class_option :guc_namespace, type: :string, default: 'app',
-                                   desc: 'GUC namespace prefix used in the session GUC names'
+      class_option :schema,        type: :string, default: 'public',
+                                   desc: "Postgres schema of Kiosk's tables"
 
       # Ascending timestamps within one run, so the migrations sort in order.
       @migration_counter = 0
@@ -36,23 +34,30 @@ module Kiosk
         end
       end
 
+      MIGRATIONS = %w[identity_tables device_authorizations mandates kyc_attributes events
+                      pow_spent revocations visits refunds].freeze
+
       no_commands do
-        # One SchemaDefinitions method's DDL, indented for the migration's heredoc.
-        def ddl(name, **)
-          Kiosk::Server::SchemaDefinitions.public_send(:"#{name}_sql", schema: options[:schema], **)
-                                          .gsub(/^(?=.)/, '      ')
-        end
+        def public_schema? = options[:schema] == 'public'
+
+        # A Kiosk table as a migration names it: `:kiosk_agents`, or `"ops.kiosk_agents"`.
+        def table(name) = public_schema? ? ":kiosk_#{name}" : %("#{options[:schema]}.kiosk_#{name}")
+
+        # The type of `users.id`, which every `user_id` column takes.
+        def user_id_type = ":#{options[:user_id_type]}"
 
-        def user_id_type = options[:user_id_type].to_sym
+        # The foreign key of a `user_id` column: a row goes with its user.
+        def users_key = "{ to_table: :#{options[:user_table]}, on_delete: :cascade }"
       end
 
       def create_initializer
         template 'initializer.rb.tt', 'config/initializers/kiosk.rb'
       end
 
-      # schema.rb dumps only the search path's schemas unless told otherwise;
-      # public goes first because the kiosk tables reference the user table.
+      # schema.rb dumps only the search path's schemas unless told otherwise.
       def dump_kiosk_schema
+        return if public_schema?
+
         application %(config.active_record.dump_schemas = "public,#{options[:schema]}")
       end
 
@@ -66,59 +71,10 @@ module Kiosk
         RUBY
       end
 
-      def create_schema_migration
-        migration_template 'create_kiosk_schema.rb.tt',
-                           'db/migrate/create_kiosk_schema.rb'
-      end
-
-      def create_identity_tables_migration
-        migration_template 'create_kiosk_identity_tables.rb.tt',
-                           'db/migrate/create_kiosk_identity_tables.rb'
-      end
-
-      def create_device_authorizations_migration
-        migration_template 'create_kiosk_device_authorizations.rb.tt',
-                           'db/migrate/create_kiosk_device_authorizations.rb'
-      end
-
-      def create_mandates_migration
-        migration_template 'create_kiosk_mandates.rb.tt',
-                           'db/migrate/create_kiosk_mandates.rb'
-      end
-
-      def create_kyc_attributes_migration
-        migration_template 'create_kiosk_kyc_attributes.rb.tt',
-                           'db/migrate/create_kiosk_kyc_attributes.rb'
-      end
-
-      def create_events_migration
-        migration_template 'create_kiosk_events.rb.tt',
-                           'db/migrate/create_kiosk_events.rb'
-      end
-
-      def create_pow_spent_migration
-        migration_template 'create_kiosk_pow_spent.rb.tt',
-                           'db/migrate/create_kiosk_pow_spent.rb'
-      end
-
-      def create_revocations_migration
-        migration_template 'create_kiosk_revocations.rb.tt',
-                           'db/migrate/create_kiosk_revocations.rb'
-      end
-
-      def create_auth_challenges_migration
-        migration_template 'create_kiosk_auth_challenges.rb.tt',
-                           'db/migrate/create_kiosk_auth_challenges.rb'
-      end
-
-      def create_visits_migration
-        migration_template 'create_kiosk_visits.rb.tt',
-                           'db/migrate/create_kiosk_visits.rb'
-      end
-
-      def create_refunds_migration
-        migration_template 'create_kiosk_refunds.rb.tt',
-                           'db/migrate/create_kiosk_refunds.rb'
+      def create_migrations
+        MIGRATIONS.each do |name|
+          migration_template "create_kiosk_#{name}.rb.tt", "db/migrate/create_kiosk_#{name}.rb"
+        end
       end
     end
   end

data/lib/generators/kiosk/install/templates/create_kiosk_device_authorizations.rb.tt

@@ -1,17 +1,26 @@
 # frozen_string_literal: true
 
-# Migration 004 — kiosk.device_authorizations: the account-binding state
-# machine behind the RFC 8628-shaped claim and link ceremonies, in the shape
-# DeviceAuthorizationStores::ActiveRecord reads and writes (hashed device and
-# user codes, the bound public key, claim vs link).
+# The account-binding requests behind the claim and link ceremonies (RFC 8628
+# shape). The device and user codes are stored hashed. `requested_role` is the
+# role of the approving human, never one a client asks for.
 class CreateKioskDeviceAuthorizations < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:device_authorizations, user_id_type: user_id_type) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".device_authorizations)
+  def change
+    create_table <%= table :device_authorizations %>, id: :uuid do |t|
+      t.text :device_code_hash, null: false, index: { unique: true }
+      # Unique among pending requests only: a finished request may share a code with an old one.
+      t.text :user_code_hash, null: false, index: { unique: true, where: "status = 'pending'" }
+      t.text :public_key_pem
+      t.text :kind, null: false, default: 'claim'
+      t.text :client_id, null: false
+      t.text :requested_role
+      t.text :status, null: false
+      t.column :user_id, <%= user_id_type %>
+      t.timestamptz :expires_at, null: false, index: { where: "status IN ('pending', 'approved')" }
+      t.timestamptz :consumed_at
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      t.check_constraint "status IN ('pending', 'approved', 'denied', 'consumed', 'expired')",
+                         name: 'kiosk_device_authorizations_status'
+      t.check_constraint "kind IN ('claim', 'link')", name: 'kiosk_device_authorizations_kind'
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_events.rb.tt

@@ -1,22 +1,20 @@
 # frozen_string_literal: true
 
-# Migration 007 — create kiosk.events.
-# The per-identity EVENT TAIL an operator serving any topic needs. `id` is a
-# bigserial, and that is what makes the wire's event id a per-origin monotonic
-# integer — one cursor then resumes every subscription on a socket with one
-# integer comparison.
-# `identity_key` is a user_id, not an agent_id: a human's second assistant must
-# read the same tail, and a revoked assistant is stopped at the socket.
-# Laid down unconditionally, like kiosk.kyc_attributes: the route is drawn
-# whether or not this origin declares a topic, and an empty table costs nothing.
+# The event tail. `id` is the origin's one ascending cursor: a single integer
+# resumes every subscription on a socket. `identity_key` is a user id, so every
+# assistant of one person reads the same tail.
 class CreateKioskEvents < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:events) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".events)
+  def change
+    create_table <%= table :events %> do |t|
+      t.text :identity_key, null: false
+      t.text :topic, null: false
+      t.text :subject
+      t.timestamptz :occurred_at, null: false
+      t.jsonb :data, null: false
+      # The retention sweep reads it.
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }, index: true
+      # `since` for one subscriber: the cursor scan, in id order.
+      t.index %i[identity_key id]
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_identity_tables.rb.tt

@@ -1,16 +1,45 @@
 # frozen_string_literal: true
 
-# Migration 002 — Kiosk identity tables: agents, agent_tokens, agent_mappings.
+# Kiosk's identity tables: the registered assistants, the tolled calls of
+# each account since its last proof, and the assistant accounts that
+# registration opened, with the account each one merged into at its first binding.
 class CreateKioskIdentityTables < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:identity_tables, user_id_type: user_id_type, user_table: options[:user_table]) %>
-    SQL
-  end
+  def change
+<% unless public_schema? -%>
+    create_schema "<%= options[:schema] %>", if_not_exists: true
+
+<% end -%>
+    create_table <%= table :agents %>, id: :uuid do |t|
+      t.references :user, type: <%= user_id_type %>, null: false, foreign_key: <%= users_key %>,
+                          index: { where: 'revoked_at IS NULL' }
+      t.text :allowed_roles, array: true, null: false, default: []
+      t.text :public_key
+      t.text :human_label
+      # The most one payment may charge. NULL: no cap. 0: no payments. A cap has its currency.
+      t.bigint :spending_cap_cents
+      t.text :spending_cap_currency
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      # The time of the latest binding.
+      t.timestamptz :bound_at
+      t.timestamptz :revoked_at
+      t.text :issuer, null: false
+      t.check_constraint "spending_cap_currency ~ '^[a-z]{3}$'", name: 'kiosk_agents_spending_cap_currency_code'
+      t.check_constraint '(spending_cap_cents IS NULL) = (spending_cap_currency IS NULL)',
+                         name: 'kiosk_agents_spending_cap_currency_set'
+      # One live row per public key on an origin, enforced by the database; a revoked key can register again.
+      t.index %i[issuer public_key], unique: true, where: 'revoked_at IS NULL'
+    end
+
+    create_table <%= table :tolled_calls %>, primary_key: :user_id, id: <%= user_id_type %>, default: nil do |t|
+      t.bigint :calls_since_proof, null: false, default: 0
+      t.foreign_key :<%= options[:user_table] %>, column: :user_id, on_delete: :cascade
+    end
 
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".agent_mappings)
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".agent_tokens)
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".agents)
+    create_table <%= table :assistant_accounts %>, primary_key: :user_id, id: <%= user_id_type %>, default: nil do |t|
+      t.column :merged_into, <%= user_id_type %>, index: { where: 'merged_into IS NOT NULL' }
+      t.timestamptz :merged_at
+      t.foreign_key :<%= options[:user_table] %>, column: :user_id, on_delete: :cascade
+      t.foreign_key :<%= options[:user_table] %>, column: :merged_into, on_delete: :cascade
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_kyc_attributes.rb.tt

@@ -1,20 +1,22 @@
 # frozen_string_literal: true
 
-# Migration 006 — create kiosk.kyc_attributes.
-# ONE ROW per NAMED ANONYMIZED boolean attribute a valid KYC attestation
-# granted an agent (e.g. age_over_18, licence_a). Only the NAMES are stored —
-# never the DOB, licence number, or any underlying document.
-# There is no value column: the grant IS the row, so every gate is an EXISTS
-# and no reader has to decide which spelling of `true` counts.
-# Additive/opt-in: needed only if an Action gates on specific KYC attributes.
+# The KYC grants and the open verifications, keyed on the person. A grant is
+# one row per anonymized attribute a valid attestation granted (`age_over_18`):
+# only the name, never the document or the value behind it.
 class CreateKioskKycAttributes < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:kyc_attributes, user_id_type: user_id_type, user_table: options[:user_table]) %>
-    SQL
-  end
+  def change
+    create_table <%= table :kyc_attributes %>, primary_key: %i[user_id name] do |t|
+      t.references :user, type: <%= user_id_type %>, null: false, index: false, foreign_key: <%= users_key %>
+      t.text :name, null: false
+      t.timestamptz :granted_at, null: false, default: -> { 'now()' }
+    end
 
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".kyc_attributes)
+    create_table <%= table :kyc_requests %>, id: :text do |t|
+      t.references :user, type: <%= user_id_type %>, null: false, index: false, foreign_key: <%= users_key %>
+      t.text :nonce, null: false
+      t.timestamptz :approved_at
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      t.index %i[user_id created_at]
+    end
   end
 end