kiosk-server 0.5.20 → 0.6.28

data/lib/kiosk/server/configuration_extension.rb

@@ -8,7 +8,7 @@ module Kiosk
       # cannot each build their own store (a double-spent proof of work).
       LAZY_STORE_MUTEX = Mutex.new
 
-      # The discovery settings: where the wire is mounted and what it advertises.
+      # The discovery settings: where the protocol is mounted and what it advertises.
       module Discovery
         # Default `/kiosk`. Discovery advertises `endpoint = origin + mount_path`.
         attr_writer :mount_path
@@ -30,13 +30,18 @@ module Kiosk
           @owner ||= {}
         end
 
-        # The skill this origin was built against. Discovery emits the `skill`
-        # block only when `skill_sha256` is set.
+        # The skill cut of this kiosk-server release. Each release gives the cut
+        # of its own version. Do not set it.
         attr_writer :skill_url
 
         def skill_url
-          @skill_url ||= 'https://kiosk.tech/skill-v0.5.20.md'
+          @skill_url ||= 'https://kiosk.tech/skill-v0.6.28.md'
         end
+
+        # The SHA-256 of the file at `skill_url`, as hex. Default nil: discovery
+        # then advertises no `skill` block. Make it with
+        # `curl -fsS <skill_url> | shasum -a 256`. Kiosk::TestHelpers::SkillPin
+        # fails when an update of kiosk-server changes `skill_url`.
         attr_accessor :skill_sha256
 
         private
@@ -57,7 +62,7 @@ module Kiosk
 
       # The proof-of-work settings: registration proofs and the reputation challenge.
       module ProofOfWork
-        # Equihash proofs asked at `POST /auth/register`, at the link-code claim and
+        # Equihash proofs asked at `POST /oauth/register`, at the link-code claim and
         # at the first token poll of each device code, at the gem's default params.
         # Default 0 (open). Above 0 needs `pow_secret` and `kiosk-pow-equihash`.
         attr_writer :registration_pow_count
@@ -107,45 +112,15 @@ module Kiosk
         def kyc_claims
           @kyc_claims || []
         end
-
-        # Must match the `iss` of submitted KYC attestations.
-        attr_writer :kyc_issuer
-
-        def kyc_issuer
-          @kyc_issuer
-        end
-
-        # The `aud` a KYC attestation must carry. Default: the origin being served.
-        attr_writer :kyc_audience
-
-        def kyc_audience
-          @kyc_audience || Kiosk.current_issuer
-        end
-
-        # The KYC provider's RSA key: an OpenSSL::PKey or a PEM string.
-        def kyc_public_key
-          @kyc_public_key
-        end
-
-        def kyc_public_key=(value)
-          @kyc_public_key = case value
-                            when OpenSSL::PKey::PKey then value
-                            when String              then OpenSSL::PKey::RSA.new(value)
-                            when nil                 then nil
-                            else
-                              raise ArgumentError,
-                                    "kyc_public_key must be an OpenSSL::PKey or PEM string, got #{value.class}"
-                            end
-        end
       end
 
       # The database settings: where Kiosk's tables live and how a request reaches them.
       module Database
-        # Postgres schema for Kiosk's own tables and functions. Default 'kiosk'.
+        # The Postgres schema of Kiosk's `kiosk_*` tables. Default 'public'.
         attr_writer :schema
 
         def schema
-          @schema ||= 'kiosk'
+          @schema ||= 'public'
         end
 
         # Prefix of the session GUCs a request sets, e.g. `app.user_id`. Default 'app'.
@@ -169,27 +144,50 @@ module Kiosk
       include Kyc
       include Database
 
-      # Required. A SigningKey or a PEM string.
+      # Required. A SigningKey or the PEM string of an Ed25519 key.
       def signing_key
         @signing_key || raise(Errors::ConfigurationError,
-                              'c.signing_key is not set. Generate one with `openssl genrsa 2048`.')
+                              "c.signing_key is not set. #{SigningKey::HINT.capitalize}.")
       end
 
       def signing_key=(value)
-        @signing_key = case value
-                       when Kiosk::Server::SigningKey, nil then value
-                       when String then Kiosk::Server::SigningKey.from_pem(value)
-                       else raise ArgumentError, "signing_key must be a SigningKey or PEM string, got #{value.class}"
-                       end
+        @signing_key = signing_key_from(value, 'signing_key')
+      end
+
+      # Optional. The key that signed before {#signing_key}: the JWKS still
+      # publishes it, and a token or checkout it signed still verifies. A public
+      # PEM is enough. Keep it for at least one access-token lifetime, and while
+      # a checkout it signed can still be paid.
+      attr_reader :previous_signing_key
+
+      def previous_signing_key=(value)
+        @previous_signing_key = signing_key_from(value, 'previous_signing_key')
+      end
+
+      # The keys the JWKS publishes and verification accepts, the current one first.
+      def signing_keys = [signing_key, previous_signing_key].compact
+
+      # The JOSE algorithms an AI assistant can sign with. Default `["EdDSA"]`:
+      # Ed25519 keys only. `%w[EdDSA ES256]` also accepts P-256 keys.
+      def assistant_algorithms
+        @assistant_algorithms || [Eddsa::NAME]
       end
 
-      # The role every self-registered agent is pinned to, and the default a
+      def assistant_algorithms=(value)
+        algorithms = Array(value).map(&:to_s)
+        valid = [[Eddsa::NAME], [Eddsa::NAME, 'ES256']].include?(algorithms)
+        raise Errors::ConfigurationError, "c.assistant_algorithms is %w[EdDSA] or %w[EdDSA ES256], got #{algorithms.inspect}" unless valid
+
+        @assistant_algorithms = algorithms.freeze
+      end
+
+      # The role every registered client is pinned to, and the default a
       # binding falls back to. Required, and one of {#roles}, when {#roles} is set.
       #   Kiosk.configure { |c| c.roles = %i[customer]; c.registration_role = :customer }
       attr_accessor :registration_role
 
-      # Optional `->(public_key) { record_id }` creating the account behind a
-      # self-registered agent. Unset: `user_model.constantize.create!`.
+      # Optional `->(public_key_pem) { record_id }` creating the account behind a
+      # registered client. Unset: `user_model.constantize.create!`.
       attr_accessor :assistant_creation
 
       # Account-binding ceremony state. Default: the shared database store.
@@ -224,7 +222,7 @@ module Kiosk
         true
       end
 
-      # Called as `(agent:, from:, to:)` when an assistant's key moves from one
+      # Called as `(agent:, from:, to:)` when an assistant's client moves from one
       # account to another, inside the rebind transaction: the place to move
       # the operator's own rows. `from` and `to` are `user_model` records.
       attr_accessor :assistant_claimed
@@ -233,18 +231,16 @@ module Kiosk
       # `account`, a `user_model` record, and its tokens are revoked.
       attr_accessor :assistant_unlinked
 
-      # Optional `(agent_id:) → { amount_cents:, currency: } | nil`, checked
-      # before capture; 0 blocks payments, and so does a cart in another currency.
+      # Optional `(agent_id:) → { amount_cents:, currency: } | nil`: the most
+      # one `pay` may charge, checked before capture. 0 blocks payments, and so
+      # does a checkout in another currency.
       # {Kiosk::Server::ColumnSpendingCap} reads
       # `agents.spending_cap_cents`, the column edited by the manage-assistants
       # page, and `agents.spending_cap_currency`.
       attr_accessor :spending_cap
 
-      # Days of settled spend summed against the cap. Default nil: all time.
-      attr_accessor :spending_cap_window_days
-
-      # `call(id, lines) → cents | String`: the payable row's price, or why the cart is refused.
-      attr_accessor :cart_price_checker
+      # `call(id, lines) → cents | String`: the payable row's price, or why the checkout is refused.
+      attr_accessor :checkout_price_checker
 
       # Optional `call(id)`, run once the settlement that paid row `id` is recorded.
       attr_accessor :after_payment
@@ -282,7 +278,8 @@ module Kiosk
         @audit_sink = value
       end
 
-      # Spent challenge ids, so a proof is accepted once. Default: the shared database table.
+      # Spent ids, so a proof-of-work proof or a client assertion is accepted once.
+      # Default: the shared database table.
       attr_writer :pow_spent_store
 
       def pow_spent_store
@@ -290,31 +287,13 @@ module Kiosk
           LAZY_STORE_MUTEX.synchronize { @pow_spent_store ||= Kiosk::Server::PowSpentStores::ActiveRecord.new }
       end
 
-      # Outstanding auth nonces. Default: the shared database table.
-      attr_writer :auth_challenge_store
-
-      def auth_challenge_store
-        @auth_challenge_store ||
-          LAZY_STORE_MUTEX.synchronize do
-            @auth_challenge_store ||= Kiosk::Server::AuthChallengeStores::ActiveRecord.new
-          end
-      end
-
-      # Seconds an access token lives. One paid proof-of-work toll lasts as long. Default 3600.
+      # Seconds an access token lives. Default 3600.
       attr_writer :access_token_ttl
 
       def access_token_ttl
         @access_token_ttl ||= JwtIssuer::DEFAULT_EXPIRES_IN
       end
 
-      # Seconds between `GET /auth/challenge` and the signed POST. Default covers
-      # the auth toll's proof-of-work window plus 60s.
-      attr_writer :auth_challenge_ttl
-
-      def auth_challenge_ttl
-        @auth_challenge_ttl ||= (pow_ttl * [registration_pow_count.to_i, 1].max) + 60
-      end
-
       # Revocation watermarks, checked on every access token. Default: the
       # shared database table, so a revoke or an unlink holds in every process.
       attr_writer :revocation_store
@@ -323,6 +302,16 @@ module Kiosk
         @revocation_store ||
           LAZY_STORE_MUTEX.synchronize { @revocation_store ||= Kiosk::Server::RevocationStores::ActiveRecord.new }
       end
+
+      private
+
+      def signing_key_from(value, name)
+        case value
+        when Kiosk::Server::SigningKey, nil then value
+        when String then Kiosk::Server::SigningKey.from_pem(value)
+        else raise ArgumentError, "#{name} must be a SigningKey or PEM string, got #{value.class}"
+        end
+      end
     end
   end
 end

data/lib/kiosk/server/current_request.rb

@@ -2,7 +2,7 @@
 
 module Kiosk
   module Server
-    # The wire request being dispatched, visible to its handler for the duration
+    # The protocol request being dispatched, visible to its handler for the duration
     # of one block. Fiber-local: a handler that hands work to another thread must
     # pass what it needs.
     module CurrentRequest

data/lib/kiosk/server/device_authorization.rb

@@ -5,7 +5,7 @@ require 'digest'
 
 module Kiosk
   module Server
-    # One account-binding request on the RFC 8628 device-grant wire: a `:claim`
+    # One account-binding request on the RFC 8628 device-grant endpoints: a `:claim`
     # the agent opens and a human approves, or a `:link` a signed-in human
     # creates already approved. Only SHA-256 digests of its two codes are kept.
     #

data/lib/kiosk/server/device_authorization_stores.rb

@@ -147,7 +147,7 @@ module Kiosk
         private
 
         def connection = ::ActiveRecord::Base.lease_connection
-        def table = %("#{Kiosk.configuration.schema}".device_authorizations)
+        def table = %("#{Kiosk.configuration.schema}".kiosk_device_authorizations)
 
         def insert_sql
           placeholders = (1..COLUMNS.size).map { |i| "$#{i}" }.join(', ')

data/lib/kiosk/server/device_code_grant.rb

@@ -2,13 +2,14 @@
 
 module Kiosk
   module Server
-    # The claim ceremony on the RFC 8628 device-grant wire: binds an agent key
-    # to an existing human account once the human approves.
+    # The claim ceremony on the RFC 8628 device-grant endpoints: binds a registered
+    # client to an existing human account once the human approves.
     #
-    #   .start    — POST /oauth/device_authorization
-    #   .exchange — POST /oauth/token (grant_type=device_code)
+    #   .start     — POST /oauth/device_authorization
+    #   .pay_toll! — POST /oauth/token (grant_type=device_code), before the client authenticates
+    #   .exchange  — POST /oauth/token (grant_type=device_code), after it authenticates
     module DeviceCodeGrant
-      GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code'
+      GRANT_TYPE = Client::DEVICE_CODE
 
       # Seconds; a faster poll gets `slow_down` (RFC 8628 §3.5).
       DEFAULT_POLL_INTERVAL = 5
@@ -18,9 +19,6 @@ module Kiosk
       @poll_registry = {}
       @poll_mutex    = Mutex.new
 
-      PROOF_REQUIRED = 'signed proof-of-possession required ' \
-                       '(GET /auth/challenge?public_key=… then sign {aud, nonce, jti})'
-
       STATUS_FAILURES = {
         pending: [:authorization_pending, 'the account holder has not yet approved'],
         denied: [:access_denied, 'the account holder denied the request'],
@@ -30,14 +28,13 @@ module Kiosk
 
       module_function
 
-      # No role parameter on purpose: the row takes the approving human's role.
-      def start(client_id:,
-                public_key_pem:,
+      # No role parameter on purpose: the client takes the approving human's role.
+      def start(client:,
                 store: Kiosk.configuration.device_authorization_store,
                 expires_in: DeviceAuthorization::DEFAULT_EXPIRES_IN,
                 now: Time.current)
         plain_device_code, plain_user_code, da = DeviceAuthorization.generate(
-          client_id: client_id, kind: :claim, public_key_pem: public_key_pem.to_s.strip,
+          client_id: client.id, kind: :claim, public_key_pem: client.public_key_pem,
           expires_in: expires_in, now: now
         )
         store.create(da)
@@ -45,26 +42,30 @@ module Kiosk
           expires_in: expires_in, interval: DEFAULT_POLL_INTERVAL, da: da }
       end
 
-      # Returns `{ok: true, access_token:, …}` or `{ok: false, error:, description:}`
-      # with an RFC 8628 §3.5 error code. The auth toll raises its own errors.
-      def exchange(device_code:, # rubocop:disable Metrics/ParameterLists -- the token controller and the specs pass these by name
-                   signed: nil,
-                   pow: nil,
+      # The first poll of each device code value is tolled; later polls
+      # of that value are free until any code could have expired. The store is
+      # not read first, so an unknown code costs the same work as a live one.
+      def pay_toll!(device_code, pow, now: Time.current)
+        config = Kiosk.configuration
+        paid   = "device_code:#{DeviceAuthorization.hash_device_code(device_code)}"
+        return if !AuthToll.on?(config) || config.pow_spent_store.spent?(paid)
+
+        AuthToll.gate(verb: 'oauth/token', body: { device_code: device_code.to_s }, pow: pow, config: config)
+        config.pow_spent_store.mark_spent(paid, now.to_i + DeviceAuthorization::DEFAULT_EXPIRES_IN)
+      end
+
+      # @return [Client] the client under the approving human's account
+      # @raise [OauthError] with an RFC 8628 §3.5 error code
+      def exchange(device_code:, client:,
                    store: Kiosk.configuration.device_authorization_store,
                    interval: DEFAULT_POLL_INTERVAL,
                    now: Time.current)
-        return failure(:invalid_request, 'device_code parameter required') if device_code.to_s.empty?
-
         hash = DeviceAuthorization.hash_device_code(device_code)
-        pay_toll_once!(device_code, hash, pow, now)
-        da = store.lookup_by_device_code_hash(hash)
-        return failure(:invalid_grant, 'unknown device_code') if da.nil?
-        return failure(:slow_down, 'polling faster than the advertised interval') if polled_too_fast?(hash, interval, now)
-
-        da = expire_if_due(da, store, now)
-        return bind_and_mint(authorization: da, signed: signed, store: store, now: now) if da.approved?
+        da = authorization_of(client, store.lookup_by_device_code_hash(hash))
+        fail!(:slow_down, 'polling faster than the advertised interval') if polled_too_fast?(hash, interval, now)
 
-        failure(*STATUS_FAILURES.fetch(da.status))
+        consume!(expire_if_due(da, store, now), store, now)
+        AccountBinding.bind!(agent_id: client.id, user_id: da.user_id, requested_role: da.requested_role)
       end
 
       def reset_poll_registry!
@@ -74,16 +75,11 @@ module Kiosk
       class << self
         private
 
-        # The first poll of each device code value pays the auth toll; later polls
-        # of that value are free until any code could have expired. The store is
-        # not read first, so an unknown code costs the same work as a live one.
-        def pay_toll_once!(device_code, hash, pow, now)
-          config = Kiosk.configuration
-          paid   = "device_code:#{hash}"
-          return if !AuthToll.on?(config) || config.pow_spent_store.spent?(paid)
+        # A claim row that this client opened; a row of another client is unknown to it.
+        def authorization_of(client, authorization)
+          return authorization if authorization&.claim? && authorization.client_id == client.id
 
-          AuthToll.gate(verb: 'oauth/token', body: { device_code: device_code.to_s }, pow: pow, config: config)
-          config.pow_spent_store.mark_spent(paid, now.to_i + DeviceAuthorization::DEFAULT_EXPIRES_IN)
+          fail!(:invalid_grant, 'unknown device_code')
         end
 
         def expire_if_due(authorization, store, now)
@@ -93,41 +89,14 @@ module Kiosk
           store.update(authorization.expire)
         end
 
-        # Possession of the row's key is proven before binding; a failed proof
-        # is `invalid_client` and leaves the row approved for a retry.
-        def bind_and_mint(authorization:, signed:, store:, now:)
-          refusal = possession_refusal(authorization.public_key_pem, signed)
-          return refusal if refusal
-          # Atomic, so two concurrent polls mint one token.
-          return failure(:invalid_grant, 'device_code already used') if store.claim_consume(authorization, now: now).nil?
-
-          token_response(authorization)
-        end
-
-        def possession_refusal(public_key_pem, signed)
-          return failure(:invalid_client, PROOF_REQUIRED) if signed.nil? || signed.to_s.empty?
-          return failure(:invalid_client, 'no public key bound to this authorization') if public_key_pem.blank?
-
-          payload = PopVerifier.verify!(public_key_pem: public_key_pem, signed: signed)
-          AuthChallenge.consume!(public_key_pem: public_key_pem, nonce: payload.fetch(:nonce))
-          nil
-        rescue Errors::Base => e
-          failure(:invalid_client, e.message)
-        end
-
-        def token_response(authorization)
-          role = authorization.requested_role
-          result = AccountBinding.bind!(public_key_pem: authorization.public_key_pem,
-                                        user_id: authorization.user_id, requested_role: role)
-          response = { ok: true, access_token: result[:access_token], token_type: 'Bearer',
-                       expires_in: Kiosk.configuration.access_token_ttl }
-          # RFC 6749 §5.1: the granted scope is the approving human's role.
-          response[:scope] = role if role
-          response
+        # Atomic, so two concurrent polls bind once.
+        def consume!(authorization, store, now)
+          fail!(*STATUS_FAILURES.fetch(authorization.status)) unless authorization.approved?
+          fail!(:invalid_grant, 'device_code already used') if store.claim_consume(authorization, now: now).nil?
         end
 
-        def failure(error, description)
-          { ok: false, error: error.to_s, description: description }
+        def fail!(error, description)
+          raise OauthError.new(error, description)
         end
 
         # Per process; a multi-process origin rate-limits at its edge.

data/lib/kiosk/server/dpop.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'digest'
+require 'jwt'
+require 'uri'
+
+module Kiosk
+  module Server
+    # RFC 9449 (spec Section 5.6): a token request, and a request that carries
+    # an access token, come with a proof that the registered key signed for
+    # this request. The proof's iat window is the replay bound; no nonce is
+    # issued and no jti is kept.
+    module Dpop
+      SCHEME = 'DPoP'
+      TYPE   = 'dpop+jwt'
+      WINDOW = 60
+      CLAIMS = %w[jti htm htu iat].freeze
+
+      # A proof that does not hold.
+      class Invalid < StandardError; end
+
+      module_function
+
+      # The `WWW-Authenticate` value of a 401 on a request that needs a token.
+      # `resource_metadata` names the protected-resource metadata (RFC 9728
+      # Section 5.1).
+      def challenge
+        %(#{SCHEME} algs="#{AssistantKey.algorithms.join(' ')}", ) +
+          %(resource_metadata="#{Kiosk.current_issuer}/.well-known/oauth-protected-resource")
+      end
+
+      def hint
+        'send `Authorization: DPoP <access_token>` and one `DPoP` header: a JWS with typ dpop+jwt, ' \
+          "alg #{AssistantKey.algorithms.join(' or ')} and the public jwk of your registered key, signed by " \
+          'that key, whose payload carries jti, htm (the method), htu (the URL with no query), iat (now) ' \
+          'and ath (base64url SHA-256 of the access token)'
+      end
+
+      def token_request_hint
+        'send one `DPoP` header: a JWS with typ dpop+jwt, ' \
+          "alg #{AssistantKey.algorithms.join(' or ')} and the public jwk of your registered " \
+          'key, signed by that key, whose payload carries jti, htm POST, htu (the token URL) ' \
+          'and iat (now)'
+      end
+
+      # The access token of an `Authorization: DPoP <token>` header, else nil.
+      def token(authorization)
+        authorization.to_s[/\A#{SCHEME}\s+(\S+)\z/io, 1]
+      end
+
+      # Raises Errors::AccessTokenRefused unless `proof` is the key `jkt`'s proof
+      # for this method, URL and token, signed within {WINDOW} seconds of now.
+      def verify!(proof, token:, jkt:, method:, url:)
+        raise Invalid, 'the access token is bound to no key' if jkt.to_s.empty?
+
+        claims = check!(proof, jkt:, method:, url:, key: 'the key the token is bound to')
+        raise Invalid, 'the DPoP proof ath is not the hash of this token' unless claims['ath'] == hash_of(token)
+      rescue Invalid => e
+        raise Errors::AccessTokenRefused, e.message
+      end
+
+      # Raises OauthError `invalid_dpop_proof` unless `proof` is the proof of
+      # the registered key `jkt` for this token request. It carries no `ath`:
+      # there is no token yet.
+      def verify_token_request!(proof, jkt:, url:)
+        check!(proof, jkt:, method: 'POST', url:, key: 'your registered key')
+      rescue Invalid => e
+        raise OauthError.new(:invalid_dpop_proof, "#{e.message}: #{token_request_hint}")
+      end
+
+      # The base64url SHA-256 of the token: the `ath` a proof carries.
+      def hash_of(token) = Base64.urlsafe_encode64(Digest::SHA256.digest(token.to_s), padding: false)
+
+      # `key` names the key `jkt` is the thumbprint of.
+      def check!(proof, jkt:, method:, url:, key:)
+        raise Invalid, 'one DPoP header is required' if proof.to_s.empty? || proof.include?(',')
+
+        signer, claims = decode(proof)
+        raise Invalid, "the DPoP proof key is not #{key}" unless AssistantKey.thumbprint(signer) == jkt
+
+        check_request!(claims, method, url)
+        claims
+      end
+
+      def check_request!(claims, method, url)
+        raise Invalid, 'the DPoP proof htm is not this request method' unless claims['htm'] == method
+        raise Invalid, 'the DPoP proof htu is not this request URL' unless same_url?(claims['htu'], url)
+        raise Invalid, 'the DPoP proof iat is not within 60 seconds of now' unless (claims['iat'].to_i - Time.now.to_i).abs <= WINDOW
+      end
+
+      # The key is the proof's own `jwk`, and its type names the one algorithm.
+      def decode(proof)
+        key = header_key(::JWT.decode(proof, nil, false).last)
+        algorithm = AssistantKey.algorithm(key)
+        claims, = ::JWT.decode(proof, key, true, algorithms: [algorithm], required_claims: CLAIMS)
+        [key, claims]
+      rescue ::JWT::IncorrectAlgorithm
+        raise Invalid, "the DPoP proof alg is not #{algorithm}, the algorithm of its jwk"
+      rescue ::JWT::DecodeError
+        raise Invalid, 'the DPoP proof is not a JWS that its jwk signed, with the claims of RFC 9449'
+      end
+
+      def header_key(header)
+        raise Invalid, 'the DPoP proof typ is not dpop+jwt' unless header['typ'] == TYPE
+
+        jwk = header['jwk']
+        raise Invalid, 'the DPoP proof carries no public jwk' unless jwk.is_a?(Hash) && !jwk.keys.intersect?(AssistantKey::PRIVATE_MEMBERS)
+
+        AssistantKey.from_jwk(jwk)
+      rescue Errors::BadRequest => e
+        raise Invalid, "the DPoP proof jwk is refused: #{e.message}"
+      end
+
+      # Scheme and host without case, a default port dropped (RFC 9449 Section 4.3).
+      def same_url?(htu, url)
+        Kiosk::Configuration.normalize_origin(htu) == Kiosk::Configuration.normalize_origin(url) &&
+          URI.parse(htu.to_s).path == URI.parse(url).path
+      rescue URI::InvalidURIError
+        false
+      end
+
+      private_class_method :check!, :check_request!, :decode, :header_key, :same_url?
+    end
+  end
+end

data/lib/kiosk/server/eddsa.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'jwt'
+require 'openssl'
+require_relative 'jwk'
+
+module Kiosk
+  module Server
+    # The JOSE algorithm EdDSA (RFC 8037) over the Ed25519 keys of OpenSSL.
+    # Loading this file registers `EdDSA` with ruby-jwt, so `JWT.encode` and
+    # `JWT.decode` accept the name.
+    class Eddsa
+      include ::JWT::JWA::SigningAlgorithm
+
+      NAME = 'EdDSA'
+
+      def initialize
+        @alg = NAME
+      end
+
+      def sign(data:, signing_key:)
+        raise_sign_error!("an EdDSA key is an Ed25519 key, got #{signing_key.class}") unless Jwk.ed25519?(signing_key)
+
+        signing_key.sign(nil, data)
+      end
+
+      def verify(data:, signature:, verification_key:)
+        raise_verify_error!("an EdDSA key is an Ed25519 key, got #{verification_key.class}") unless Jwk.ed25519?(verification_key)
+
+        verification_key.verify(nil, signature, data)
+      rescue OpenSSL::PKey::PKeyError
+        false
+      end
+
+      register_algorithm(new)
+    end
+  end
+end