kiosk-server 0.5.20

data/app/channels/kiosk_events.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require 'action_cable'
+
+# Top level, unsuffixed, because Action Cable constantizes the channel named
+# in a subscribe frame: this class name IS the wire's channel name.
+#
+#   {"command":"subscribe",
+#    "identifier":"{\"channel\":\"KioskEvents\",\"topic\":\"todo\",\"subject\":\"list_4f1e…\"}"}
+#
+class KioskEvents < ActionCable::Channel::Base
+  # The subject's reach is re-checked while the subscription stands (spec
+  # Section 8.5.6); the credential is the connection's to re-check.
+  REAUTHORISE_EVERY_SECONDS = 30
+
+  periodically :reauthorise!, every: REAUTHORISE_EVERY_SECONDS
+
+  # A cursor is a non-negative integer JSON carries exactly (spec Section
+  # 8.5.4, RFC 7493 Section 2.2).
+  MAX_CURSOR = (2**53) - 1
+
+  def subscribed
+    return reject unless connection.kiosk_credential_holds?
+
+    declaration = Kiosk::Server::Events.fetch(params[:topic].to_s)
+    return reject unless declaration && well_formed?
+
+    assign(declaration)
+    return reject unless reachable?(declaration)
+
+    open_stream!
+    transmit(subscribed_frame)
+  end
+
+  # Action Cable confirms once the pubsub subscription is live, so replay
+  # starts here: an event emitted before that reaches the client this way.
+  def transmit_subscription_confirmation
+    super
+    replay!
+  end
+
+  private
+
+  def identity_key = connection.kiosk_identity_key
+
+  def identity = connection.kiosk_identity
+
+  def store = Kiosk.configuration.event_store
+
+  # `head` is the cursor the client records; `truncated` says events after
+  # its `since` were pruned, so it re-reads state once through the verb.
+  def subscribed_frame
+    {
+      'type' => 'subscribed',
+      'topic' => @topic,
+      'subject' => @subject,
+      'head' => @head,
+      'truncated' => since ? store.truncated?(identity_key, since) : false
+    }
+  end
+
+  # Everything after `since`, or after the head read before the stream
+  # opened. An event may arrive twice; delivery is at-least-once and the
+  # client ignores an `id` it has seen.
+  def replay!
+    store.since(identity_key, since || @head).each do |event|
+      transmit(event) if for_this_subscription?(event)
+    end
+  end
+
+  def since = params[:since]
+
+  def assign(declaration)
+    @topic = params[:topic].to_s
+    @subject = params[:subject]
+    @declaration = declaration
+  end
+
+  def well_formed?
+    (since.nil? || cursor?(since)) && (params[:subject].nil? || params[:subject].is_a?(String))
+  end
+
+  def open_stream!
+    # Before the stream opens, so no event falls between head and stream.
+    @head = store.head
+
+    # Without `coder:` the block receives the raw broadcast String.
+    stream_from Kiosk::Server::EventsCable.stream_name(identity_key, @topic),
+                coder: ActiveSupport::JSON do |event|
+      transmit(event) if for_this_subscription?(event)
+    end
+  end
+
+  def cursor?(value) = value.is_a?(Integer) && value.between?(0, MAX_CURSOR)
+
+  # Its own topic (the replayed tail holds every topic) and, when named, its
+  # own subject (a stream name carries none).
+  def for_this_subscription?(event)
+    return false unless event['topic'] == @topic
+    return true if @subject.nil?
+
+    event['subject'].to_s == @subject.to_s
+  end
+
+  # Spec Sections 8.5.4 and 8.5.6. No subject, or a `published` topic, is
+  # reachable; otherwise the topic's `subject_reachable` rule answers, and a
+  # topic without one admits a named subject only under `principal` reach.
+  def reachable?(declaration)
+    return true if @subject.nil? || declaration[:reach] == :published
+
+    callable = declaration[:subject_reachable]
+    return declaration[:reach] == :principal if callable.nil?
+
+    !!callable.call(@subject, identity)
+  rescue StandardError => e
+    log_rule_failure(e)
+    false
+  end
+
+  # Logged, because the refusal alone cannot tell a broken rule from a no.
+  def log_rule_failure(error)
+    logger&.error("[kiosk] events subject rule raised for topic #{@topic.inspect}: " \
+                  "#{error.class}: #{error.message} at #{error.backtrace&.first}")
+  end
+
+  # Runs every REAUTHORISE_EVERY_SECONDS. A withdrawn reach is final for this
+  # subscription, so the declaration is dropped and the frame sent once.
+  def reauthorise!
+    return if @declaration.nil? || reachable?(@declaration)
+
+    @declaration = nil
+    # Braces required: bare pairs would be read as `transmit`'s keywords.
+    transmit({ 'type' => 'unsubscribed', 'topic' => @topic, 'reason' => 'reach_revoked' })
+    stop_all_streams
+  rescue StandardError => e
+    logger&.error("[kiosk] events re-authorisation failed: #{e.class}: #{e.message}")
+  end
+end

data/app/controllers/kiosk/server/application_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'action_controller'
+
+module Kiosk
+  module Server
+    # The base of the account holder's browser pages: a signed-in session, a
+    # CSRF token from the page's own form, and the binding module served.
+    class ApplicationController < ::ActionController::Base
+      include AccountHolderGate
+      include BindingModuleGate
+      include WrongDoor
+
+      prepend_before_action :refuse_unserved_binding
+    end
+  end
+end

data/app/controllers/kiosk/server/assistants_controller.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Server
+    # «Link an assistant» page: a signed-in account holder lists, labels,
+    # links and unlinks their assistants. Host views override
+    # app/views/kiosk/server/assistants/show.html.erb.
+    class AssistantsController < ApplicationController
+      SIGN_IN_PROMPT = 'Sign in to your account first to manage linked assistants.'
+      SIGN_IN_ALERT  = 'Please sign in to manage your linked assistants.'
+
+      WRONG_DOOR_MESSAGE = "this is the account holder's browser page, not the Kiosk wire — " \
+                           'it needs a signed-in session and a CSRF token from its own form'
+
+      layout false
+
+      def show
+        return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
+
+        render_page
+      end
+
+      # The signed-in human's role goes on the link row, as on the JSON path;
+      # `bind!` validates it at redeem.
+      def link
+        return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
+
+        result = LinkCode.mint(user_id: @identity.user_id, requested_role: @identity.role)
+        @link_code  = result[:link_code]
+        @expires_in = result[:expires_in]
+        render_page
+      end
+
+      def unlink
+        return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
+
+        AccountBinding.unlink!(agent_id: params[:agent_id].to_s, user_id: @identity.user_id)
+        @notice = 'Assistant unlinked — its key no longer signs in.'
+        render_page
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # Edits a bound assistant's label and/or spending cap and its currency (blank cap → unlimited).
+      def update
+        return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
+
+        changes = settings_changes
+        LinkedAssistants.save_settings(params[:agent_id].to_s, @identity.user_id, changes) if changes.any?
+        @notice = 'Assistant settings saved.'
+        render_page
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      private
+
+      def render_error(error)
+        @error = error.message
+        render_page(status: error.http_status)
+      end
+
+      def render_page(status: :ok)
+        @assistants = LinkedAssistants.list(@identity.user_id)
+        # Without a `config.spending_cap` seam the saved cap binds nothing; the page says so.
+        @spending_cap_enforced = !Kiosk.configuration.spending_cap.nil?
+        @page_path = request.path.sub(%r{/(link|unlink|update)\z}, '')
+        render :show, status: status
+      end
+
+      # Column name → new value; nil writes NULL.
+      def settings_changes
+        changes = {}
+        changes['human_label'] = params[:human_label].to_s if params.key?(:human_label)
+        changes['spending_cap_cents'], changes['spending_cap_currency'] = spending_cap_param if params.key?(:spending_cap_cents)
+        changes
+      end
+
+      # `[cents, currency]`, or `[nil, nil]` for no cap.
+      def spending_cap_param
+        raw = params[:spending_cap_cents].to_s
+        return [nil, nil] if raw.strip.empty?
+
+        cents = Integer(raw, exception: false) || raise(Errors::BadRequest, 'spending_cap_cents must be an integer')
+        [cents, spending_cap_currency_param]
+      end
+
+      def spending_cap_currency_param
+        code = MandateVerifier.canonical_currency(params[:spending_cap_currency])
+        return code if MandateVerifier::CURRENCY_CODE.match?(code)
+
+        raise Errors::BadRequest, 'spending_cap_currency must be a three-letter ISO 4217 code, such as EUR'
+      end
+    end
+  end
+end

data/app/controllers/kiosk/server/auth_controller.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+require 'action_controller'
+require 'json'
+
+module Kiosk
+  module Server
+    # The spec's challenge-response auth paths (§6), drawn by the engine: challenge, register, login,
+    # revoke, and the account-binding link, claim and unlink.
+    class AuthController < ::ActionController::API
+      # The JSON answers and RFC 9457 problem documents of the auth paths.
+      module Answers
+        private
+
+        def respond(payload, status)
+          Kiosk::Server::Headers.add_to(response.headers)
+          render json: payload, status: status
+        end
+
+        # The same RFC 9457 problem document as the wire (§9).
+        def render_error(err)
+          add_problem_headers(err)
+          render json: err.to_problem, status: err.http_status,
+                 content_type: Errors::PROBLEM_CONTENT_TYPE
+        end
+
+        def add_problem_headers(err)
+          Kiosk::Server::Headers.add_to(response.headers)
+          Kiosk::Server::Headers.add_cache_policy(response.headers, status: err.http_status)
+          err.response_headers.each { |name, value| response.set_header(name, value) }
+          challenge = www_authenticate_for(err)
+          response.set_header('WWW-Authenticate', challenge) if challenge
+        end
+
+        # RFC 7235 challenge header for the 402s, as on the wire.
+        def www_authenticate_for(err)
+          issuer = Kiosk.current_issuer
+          case err
+          when Errors::PowRequired          then %(Kiosk-PoW realm="#{issuer}")
+          when Errors::PaymentSetupRequired then %(Payment realm="#{issuer}", method="ap2")
+          end
+        end
+      end
+      include Answers
+
+      # The auth toll's proofs: the `Kiosk-PoW` header, schema-checked, or nil.
+      module Proofs
+        private
+
+        def proofs
+          header = request.get_header('HTTP_KIOSK_POW')
+          pow    = PowGate.proofs_from_header(header)
+          RequestValidation.validate_proofs!(pow) if Kiosk.configuration.validate_requests && pow
+          pow
+        end
+      end
+      include Proofs
+
+      # Only the binding actions depend on this origin serving binding.
+      include BindingModuleGate
+
+      prepend_before_action :refuse_unserved_binding, only: %i[link claim unlink]
+
+      # Unauthenticated: the nonce is worthless without the matching private key.
+      def challenge
+        public_key = request.query_parameters['public_key']
+        raise Errors::BadRequest, 'missing public_key query parameter' if public_key.blank?
+
+        respond(AuthChallenge.issue(public_key_pem: public_key), :ok)
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # Registers a new public key (409 if known). The optional PoW proof rides in the `Kiosk-PoW`
+      # header, so the signed body stays the same on retry.
+      def register
+        body   = parse_body!('POST <endpoint>/auth/register')
+        pow    = proofs
+        result = AgentRegistration.call(public_key_pem: body.fetch(:public_key), signed: body.fetch(:signed), pow: pow)
+        respond(result, :created)
+      rescue KeyError => e
+        render_error(Errors.missing_field(e))
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # Refresh a token for an EXISTING public key (404 if unknown → register).
+      def login
+        body   = parse_body!('POST <endpoint>/auth/login')
+        result = AgentLogin.call(public_key_pem: body.fetch(:public_key), signed: body.fetch(:signed))
+        respond(result, :ok)
+      rescue KeyError => e
+        render_error(Errors.missing_field(e))
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # Revokes every token of the caller's agent and returns a fresh one.
+      def revoke
+        identity = authenticated_agent
+        raise Errors::Unauthenticated, 'agent authentication required' if identity.nil? || identity.agent_id.nil?
+
+        Kiosk.configuration.revocation_store.revoke_all(identity.agent_id, at: Time.now.to_i)
+        token = fresh_token(identity)
+        respond({ access_token: token }, :ok)
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # Mints a link code for the signed-in holder; the holder's `user_idp` role becomes the bound assistant's.
+      def link
+        identity = authenticated_account_holder!
+        result = LinkCode.mint(user_id: identity.user_id, requested_role: identity.role)
+        respond({ link_code: result[:link_code], expires_in: result[:expires_in] }, :created)
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # §6.2's three fields only: `fresh` stays off the wire so a re-bind is indistinguishable (§6.3).
+      CLAIM_RESPONSE_FIELDS = %i[agent_id user_id access_token].freeze
+
+      # The optional PoW proof rides in the `Kiosk-PoW` header, as on register.
+      def claim
+        body   = parse_body!('POST <endpoint>/auth/claim')
+        result = LinkCode.redeem(code: body.fetch(:code), public_key_pem: body.fetch(:public_key),
+                                 signed: body.fetch(:signed), pow: proofs)
+        respond(result.slice(*CLAIM_RESPONSE_FIELDS), :created)
+      rescue KeyError => e
+        render_error(Errors.missing_field(e))
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      # Deactivates one of the signed-in holder's assistant accounts; answers 204 with no body (§6.2).
+      def unlink
+        identity = authenticated_account_holder!
+        body = parse_body!('POST <endpoint>/auth/unlink')
+        AccountBinding.unlink!(agent_id: body.fetch(:agent_id), user_id: identity.user_id)
+        Kiosk::Server::Headers.add_to(response.headers)
+        head :no_content
+      rescue KeyError => e
+        render_error(Errors.missing_field(e))
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      private
+
+      # Auth endpoints always mint through the bundled DefaultAgentIdp.
+      def fresh_token(identity)
+        AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: identity.agent_id, role: identity.role)
+      end
+
+      # The human's side of binding authenticates by the provider's session, never by an agent token.
+      # A page on another origin can post a form with that cookie, but cannot send JSON without a CORS preflight.
+      def authenticated_account_holder!
+        identity = Kiosk.configuration.user_idp&.verify(request)
+        hint = "sign in to the provider first — this endpoint authenticates via the provider's own session"
+        raise Errors::Unauthenticated.new('account session required', hint:) unless identity
+        raise Errors::BadRequest, 'Content-Type must be application/json' unless request.media_type == 'application/json'
+
+        identity
+      end
+
+      # nil for a missing, invalid or revoked bearer token.
+      def authenticated_agent
+        IdentityResolution.agent_idp.verify(request)
+      rescue Kiosk::Server::JwtIssuer::Error, Kiosk::AgentIdentityProviders::InvalidToken
+        nil
+      end
+
+      # Schema-checked before any `fetch`, so a wrong-typed member is a 400 naming it (§17).
+      def parse_body!(exchange)
+        raw = request.raw_post
+        raise Errors::BadRequest, 'request body must be a JSON object' if raw.blank?
+
+        parsed = JSON.parse(raw, symbolize_names: true)
+        raise Errors::BadRequest, 'request body must be a JSON object' unless parsed.is_a?(Hash)
+
+        RequestValidation.validate_body!(parsed, exchange: exchange)
+        parsed
+      rescue JSON::ParserError
+        raise Errors.malformed_json
+      end
+    end
+  end
+end

data/app/controllers/kiosk/server/device_verify_controller.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Server
+    # The verify page where a signed-in human approves or denies an assistant
+    # link. The role the panel shows is the role the approval stamps: the
+    # human's own, never one the assistant asked for.
+    class DeviceVerifyController < ApplicationController
+      SIGN_IN_PROMPT = 'Sign in to your account first, then re-open this page to approve the assistant link.'
+      SIGN_IN_ALERT  = 'Please sign in to approve the assistant link.'
+
+      CODE_NOT_RECOGNISED = 'That code was not recognised — it may have expired. Ask the assistant for a fresh one.'
+
+      WRONG_DOOR_MESSAGE = "this is the account holder's browser consent page, not the Kiosk wire — " \
+                           'it needs a signed-in session and a CSRF token from its own form'
+
+      # Failed code lookups per session before a 429, against 31^8 possible codes.
+      MAX_CODE_ATTEMPTS = 10
+
+      layout false
+
+      def show
+        return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
+        return render_attempts_capped if attempts_capped?
+
+        @user_code = params[:user_code].to_s
+        @authorization = find_authorization(@user_code)
+        @fingerprint = key_fingerprint(@authorization)
+        @role = @identity.role
+        render :show
+      end
+
+      def create
+        return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
+        return render_attempts_capped if attempts_capped?
+
+        @user_code = params[:user_code].to_s
+        @role      = @identity.role
+        @decision  = decide(params[:decision].to_s)
+        return render plain: 'decision must be approve or deny', status: :bad_request unless @decision
+
+        render :decided
+      rescue DeviceVerification::CodeNotFoundError
+        render_code_not_recognised
+      end
+
+      private
+
+      def find_authorization(user_code)
+        return nil if user_code.empty?
+
+        authorization = DeviceVerification.find_pending(user_code: user_code)
+        if authorization.nil?
+          record_failed_attempt
+          @error = CODE_NOT_RECOGNISED
+        end
+        authorization
+      end
+
+      def render_code_not_recognised
+        record_failed_attempt
+        @authorization = nil
+        @error = CODE_NOT_RECOGNISED
+        render :show, status: :unprocessable_content
+      end
+
+      def decide(decision)
+        case decision
+        when 'approve'
+          DeviceVerification.approve(user_code: @user_code, user_id: @identity.user_id, role: @identity.role)
+          :approved
+        when 'deny'
+          DeviceVerification.deny(user_code: @user_code)
+          :denied
+        end
+      end
+
+      def record_failed_attempt
+        session[:kiosk_verify_attempts] = session[:kiosk_verify_attempts].to_i + 1
+      end
+
+      def attempts_capped?
+        session[:kiosk_verify_attempts].to_i >= MAX_CODE_ATTEMPTS
+      end
+
+      def render_attempts_capped
+        render plain: 'Too many code attempts — sign out and back in to retry.',
+               status: :too_many_requests
+      end
+
+      # The key's RFC 7638 thumbprint, the `kid` the assistant prints.
+      def key_fingerprint(authorization)
+        return nil if authorization&.public_key_pem.nil?
+
+        SigningKey.from_pem(authorization.public_key_pem).kid
+      rescue StandardError
+        '(unreadable key)'
+      end
+    end
+  end
+end

data/app/controllers/kiosk/server/discovery_controller.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'action_controller'
+
+module Kiosk
+  module Server
+    # The public discovery documents at the host root, all rendered by
+    # {WellKnown} for `request.base_url`.
+    class DiscoveryController < ::ActionController::API
+      # Rails stamps `Vary: Accept` on a negotiated render; these documents are
+      # one answer for everybody, so a shared cache must keep one copy.
+      after_action :drop_vary
+
+      def agents_txt
+        allow_cors
+        render plain: WellKnown.agents_txt(base_url: request.base_url),
+               content_type: 'text/plain; charset=utf-8'
+      end
+
+      def agents_json
+        allow_cors
+        short_ttl
+        render json: WellKnown.agents_json(base_url: request.base_url)
+      end
+
+      def agent_configuration
+        render json: WellKnown.agent_configuration(base_url: request.base_url)
+      end
+
+      def kiosk_json
+        short_ttl
+        render json: WellKnown.build_json(base_url: request.base_url)
+      end
+
+      def api_catalog
+        allow_cors
+        short_ttl
+        render json: WellKnown.api_catalog(base_url: request.base_url),
+               content_type: 'application/linkset+json; ' \
+                             'profile="https://www.rfc-editor.org/info/rfc9727"'
+      end
+
+      def auth_md
+        allow_cors
+        render plain: WellKnown.auth_md(base_url: request.base_url),
+               content_type: 'text/markdown; charset=utf-8'
+      end
+
+      private
+
+      # agents.txt v1.0 requires `Access-Control-Allow-Origin: *`.
+      def allow_cors
+        response.set_header('Access-Control-Allow-Origin', '*')
+      end
+
+      # These carry the `?v=<digest>` schema link, so they must expire soon after a deploy.
+      def short_ttl
+        response.set_header('Cache-Control', Headers::PUBLIC_SHORT)
+      end
+
+      def drop_vary
+        response.headers.delete('Vary')
+      end
+    end
+  end
+end

data/app/controllers/kiosk/server/jwks_controller.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'action_controller'
+
+module Kiosk
+  module Server
+    # GET <endpoint>/.well-known/jwks.json — the public signing key.
+    class JwksController < ::ActionController::API
+      def show
+        Kiosk::Server::Headers.add_to(response.headers)
+        render json: Kiosk::Server::Jwks.build(keys: [Kiosk.configuration.signing_key])
+      end
+    end
+  end
+end

data/app/controllers/kiosk/server/kyc_attestation_controller.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require 'action_controller'
+require 'json'
+
+module Kiosk
+  module Server
+    # POST <endpoint>/agents/kyc `{kyc_jws}`: verifies an assistant-submitted
+    # attestation and replaces its principal's grants ({Kyc.grant!}). Refusals
+    # are problem documents: 400 body, 401 token, 403 attestation.
+    class KycAttestationController < ::ActionController::API
+      def create
+        identity = authenticate!
+        body     = parse_body!('POST <endpoint>/agents/kyc')
+        raw_jws  = body[:kyc_jws] or raise Errors.missing_field('kyc_jws')
+
+        render_granted(grant!(identity, raw_jws))
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      private
+
+      # Verifies the attestation for this principal and stores its grants.
+      def grant!(identity, raw_jws)
+        attributes = KycVerifier.verify(raw_jws: raw_jws, subject: identity.user_id)[:attributes]
+        Kyc.grant!(identity.user_id, attributes)
+        attributes
+      end
+
+      def render_granted(attributes)
+        Kiosk::Server::Headers.add_to(response.headers)
+        render json: { kyc_verified: true, attributes: attributes }, status: :ok
+      end
+
+      # A JSON object held to the shape §17 publishes for `exchange`, else 400.
+      def parse_body!(exchange)
+        raw = request.raw_post
+        raise Errors::BadRequest, 'request body must be a JSON object' if raw.blank?
+
+        parsed = JSON.parse(raw, symbolize_names: true)
+        raise Errors::BadRequest, 'request body must be a JSON object' unless parsed.is_a?(Hash)
+
+        RequestValidation.validate_body!(parsed, exchange: exchange)
+        parsed
+      rescue JSON::ParserError
+        raise Errors.malformed_json
+      end
+
+      # Only an assistant submits an attestation, so only the agent IdP answers.
+      def authenticate!
+        identity = IdentityResolution.agent_idp.verify(request)
+        raise Errors::Unauthenticated, 'missing or invalid agent token' if identity.nil?
+
+        identity
+      end
+
+      def render_error(err)
+        Kiosk::Server::Headers.add_to(response.headers)
+        Kiosk::Server::Headers.add_cache_policy(
+          response.headers, status: err.http_status
+        )
+        err.response_headers.each { |name, value| response.set_header(name, value) }
+        render json: err.to_problem, status: err.http_status,
+               content_type: Errors::PROBLEM_CONTENT_TYPE
+      end
+    end
+  end
+end