kiosk-server 0.6.1 → 0.6.28

data/app/controllers/kiosk/server/application_controller.rb

@@ -9,7 +9,6 @@ module Kiosk
     class ApplicationController < ::ActionController::Base
       include AccountHolderGate
       include BindingModuleGate
-      include WrongDoor
 
       prepend_before_action :refuse_unserved_binding
     end

data/app/controllers/kiosk/server/assistants_controller.rb

@@ -8,11 +8,8 @@ module Kiosk
     class AssistantsController < ApplicationController
       SIGN_IN_PROMPT = 'Sign in to your account first to manage linked assistants.'
       SIGN_IN_ALERT  = 'Please sign in to manage your linked assistants.'
-
-      WRONG_DOOR_MESSAGE = "this is the account holder's browser page, not the Kiosk wire — " \
-                           'it needs a signed-in session and a CSRF token from its own form'
-
-      layout false
+      CAP_NOT_AN_AMOUNT   = 'Write the spending cap as an amount, such as 50 or 12.50.'
+      CURRENCY_NOT_A_CODE = 'Write the cap currency as a three-letter currency code, such as EUR.'
 
       def show
         return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
@@ -41,7 +38,7 @@ module Kiosk
         render_error(e)
       end
 
-      # Edits a bound assistant's label and/or spending cap and its currency (blank cap → unlimited).
+      # Edits a bound assistant's label and/or spending cap and its currency (blank cap → no cap).
       def update
         return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
 
@@ -62,8 +59,9 @@ module Kiosk
 
       def render_page(status: :ok)
         @assistants = LinkedAssistants.list(@identity.user_id)
-        # Without a `config.spending_cap` seam the saved cap binds nothing; the page says so.
-        @spending_cap_enforced = !Kiosk.configuration.spending_cap.nil?
+        # The spend shows where the origin takes payments; the cap, where a `spending_cap` reads it.
+        @payments     = !Kiosk.configuration.payment_provider.nil?
+        @spending_cap = !Kiosk.configuration.spending_cap.nil?
         @page_path = request.path.sub(%r{/(link|unlink|update)\z}, '')
         render :show, status: status
       end
@@ -72,24 +70,25 @@ module Kiosk
       def settings_changes
         changes = {}
         changes['human_label'] = params[:human_label].to_s if params.key?(:human_label)
-        changes['spending_cap_cents'], changes['spending_cap_currency'] = spending_cap_param if params.key?(:spending_cap_cents)
+        changes['spending_cap_cents'], changes['spending_cap_currency'] = spending_cap_param if params.key?(:spending_cap)
         changes
       end
 
-      # `[cents, currency]`, or `[nil, nil]` for no cap.
+      # `[cents, currency]` from the amount the person typed, or `[nil, nil]` for no cap.
       def spending_cap_param
-        raw = params[:spending_cap_cents].to_s
+        raw = params[:spending_cap].to_s
         return [nil, nil] if raw.strip.empty?
 
-        cents = Integer(raw, exception: false) || raise(Errors::BadRequest, 'spending_cap_cents must be an integer')
-        [cents, spending_cap_currency_param]
+        currency = spending_cap_currency_param
+        cents = Money.parse(raw, currency) || raise(Errors::BadRequest, CAP_NOT_AN_AMOUNT)
+        [cents, currency]
       end
 
       def spending_cap_currency_param
         code = MandateVerifier.canonical_currency(params[:spending_cap_currency])
         return code if MandateVerifier::CURRENCY_CODE.match?(code)
 
-        raise Errors::BadRequest, 'spending_cap_currency must be a three-letter ISO 4217 code, such as EUR'
+        raise Errors::BadRequest, CURRENCY_NOT_A_CODE
       end
     end
   end

data/app/controllers/kiosk/server/auth_controller.rb

@@ -17,7 +17,7 @@ module Kiosk
           render json: payload, status: status
         end
 
-        # The same RFC 9457 problem document as the wire (§9).
+        # The same RFC 9457 problem document as the protocol (§9).
         def render_error(err)
           add_problem_headers(err)
           render json: err.to_problem, status: err.http_status,
@@ -32,7 +32,7 @@ module Kiosk
           response.set_header('WWW-Authenticate', challenge) if challenge
         end
 
-        # RFC 7235 challenge header for the 402s, as on the wire.
+        # RFC 7235 challenge header for the 402s, as in the protocol.
         def www_authenticate_for(err)
           issuer = Kiosk.current_issuer
           case err
@@ -119,7 +119,7 @@ module Kiosk
       def authenticated_account_holder!
         identity = Kiosk.configuration.user_idp&.verify(request)
         hint = "sign in to the provider first — this endpoint authenticates via the provider's own session"
-        raise Errors::Unauthenticated.new('account session required', hint:) unless identity
+        raise Errors::SessionRequired.new('account session required', hint:) unless identity
         raise Errors::BadRequest, 'Content-Type must be application/json' unless request.media_type == 'application/json'
 
         identity

data/app/controllers/kiosk/server/device_verify_controller.rb

@@ -11,14 +11,9 @@ module Kiosk
 
       CODE_NOT_RECOGNISED = 'That code was not recognised — it may have expired. Ask the assistant for a fresh one.'
 
-      WRONG_DOOR_MESSAGE = "this is the account holder's browser consent page, not the Kiosk wire — " \
-                           'it needs a signed-in session and a CSRF token from its own form'
-
       # Failed code lookups per session before a 429, against 31^8 possible codes.
       MAX_CODE_ATTEMPTS = 10
 
-      layout false
-
       def show
         return unless require_account_holder!(prompt: SIGN_IN_PROMPT, flash_alert: SIGN_IN_ALERT)
         return render_attempts_capped if attempts_capped?

data/app/controllers/kiosk/server/discovery_controller.rb

@@ -10,15 +10,14 @@ module Kiosk
       # Rails stamps `Vary: Accept` on a negotiated render; these documents are
       # one answer for everybody, so a shared cache must keep one copy.
       after_action :drop_vary
+      before_action :allow_cors
 
       def agents_txt
-        allow_cors
         render plain: WellKnown.agents_txt(base_url: request.base_url),
                content_type: 'text/plain; charset=utf-8'
       end
 
       def agents_json
-        allow_cors
         short_ttl
         render json: WellKnown.agents_json(base_url: request.base_url)
       end
@@ -28,17 +27,14 @@ module Kiosk
       end
 
       def oauth_protected_resource
-        allow_cors
         render json: WellKnown.oauth_protected_resource(base_url: request.base_url)
       end
 
       def agent_skills_index
-        allow_cors
         render_or_not_found WellKnown.agent_skills_index
       end
 
       def ard
-        allow_cors
         short_ttl
         render json: WellKnown.ard(base_url: request.base_url)
       end
@@ -49,7 +45,6 @@ module Kiosk
       end
 
       def api_catalog
-        allow_cors
         short_ttl
         # RFC 9727 §2: a HEAD request finds the catalog by this header.
         response.set_header('Link', %(<#{request.base_url}/.well-known/api-catalog>; rel="api-catalog"))
@@ -59,7 +54,6 @@ module Kiosk
       end
 
       def auth_md
-        allow_cors
         render plain: WellKnown.auth_md(base_url: request.base_url),
                content_type: 'text/markdown; charset=utf-8'
       end
@@ -71,6 +65,7 @@ module Kiosk
       end
 
       # agents.txt v1.0 and AI Catalog require `Access-Control-Allow-Origin: *`.
+      # Every document here answers it, so a page on any origin can read it.
       def allow_cors
         response.set_header('Access-Control-Allow-Origin', '*')
       end

data/app/controllers/kiosk/server/kyc_callback_controller.rb

@@ -7,7 +7,9 @@ module Kiosk
     class KycCallbackController < WireController
       def create
         Kyc.served!
-        Kyc.callback(parse_body!)
+        body = parse_body!
+        RequestValidation.validate_body!(body, exchange: 'POST <endpoint>/kyc/callback')
+        Kyc.callback(body)
         render json: { ok: true }, status: :ok
       end
     end

data/app/controllers/kiosk/server/oauth_device_authorization_controller.rb

@@ -24,15 +24,16 @@ module Kiosk
 
       private
 
-      # Refused, not ignored: the role is the approving human's, and the
-      # assistant does not choose it.
+      # A `role` is refused: the role is the approving human's, and the
+      # assistant does not choose it. A `scope` is ignored (RFC 6749 Section
+      # 3.3): an assistant gets another role only when a human who holds that
+      # role binds it to their account, or through the identity provider.
       def role_problem
-        offending = %i[role scope].find { |name| params.key?(name) }
-        return unless offending
+        return unless params.key?(:role)
 
-        "#{offending} is not accepted here — an assistant does not choose its own role. " \
-          "The role of a bound assistant is the approving account holder's own role, " \
-          "read from this provider's identity system when they approve at the verify page."
+        'role is not accepted here: an assistant does not choose its own role. ' \
+          'The role of a bound assistant is the role of the account holder who approves, ' \
+          "and this provider's identity system gives it at the verify page."
       end
 
       def device_authorization(result)

data/app/controllers/kiosk/server/oauth_token_controller.rb

@@ -48,7 +48,10 @@ module Kiosk
         client
       end
 
-      # RFC 6749 Section 5.1. The scope is the role of the client.
+      # RFC 6749 Section 5.1. The scope is the role of the client. A requested
+      # `scope` is ignored (RFC 6749 Section 3.3): an assistant gets another
+      # role only when a human who holds that role binds it to their account,
+      # or through the identity provider.
       def render_token(client)
         token = AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: client.id, role: client.role)
         body = { access_token: token, token_type: Dpop::SCHEME, expires_in: Kiosk.configuration.access_token_ttl }

data/app/controllers/kiosk/server/payment_setup_controller.rb

@@ -18,12 +18,11 @@ module Kiosk
 
       private
 
+      # No script and no inline style: a host Content-Security-Policy of `default-src 'self'` holds.
       def page(title, text)
         <<~HTML
-          <!DOCTYPE html><html><head><meta charset="utf-8"><title>#{title}</title></head>
-          <body style="font-family:system-ui,sans-serif;text-align:center;padding:64px">
-          <h1>#{title}</h1><p>#{text}</p>
-          </body></html>
+          <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>#{title}</title></head>
+          <body><main><h1>#{title}</h1><p>#{text}</p></main></body></html>
         HTML
       end
     end

data/app/controllers/kiosk/server/wire_controller.rb

@@ -6,8 +6,8 @@ require 'action_dispatch/http/parameters'
 module Kiosk
   module Server
     # The reserved `GET <endpoint>/schema` (public) and `POST <endpoint>/pay`,
-    # and the base every wire controller inherits its seams from.
-    # Wire response (JSON): success is the handler's payload VERBATIM; an error
+    # and the base every WireController inherits its seams from.
+    # Response (JSON): success is the handler's payload VERBATIM; an error
     # is an RFC 9457 problem document.
     class WireController < ::ActionController::API
       include VerbWire

data/app/models/kiosk/checkout_mandate.rb

@@ -5,8 +5,6 @@ module Kiosk
   # items of the operator's checkout that the assistant agreed to pay for.
   # Read-only for the operator.
   class CheckoutMandate < Server::ApplicationRecord
-    def self.table_name = "#{Kiosk.configuration.schema}.checkout_mandates"
-
     has_many :settlements, class_name: 'Kiosk::Settlement', dependent: nil, inverse_of: :checkout_mandate
 
     # Checkout mandates with a line item carrying these attributes, by jsonb

data/app/models/kiosk/settlement.rb

@@ -5,8 +5,6 @@ module Kiosk
   class Settlement < Server::ApplicationRecord
     include Kiosk::Owned
 
-    def self.table_name = "#{Kiosk.configuration.schema}.settlements"
-
     belongs_to :checkout_mandate, class_name: 'Kiosk::CheckoutMandate', inverse_of: :settlements
   end
 end

data/app/models/kiosk/visit.rb

@@ -5,8 +5,6 @@ module Kiosk
   # value counts toward the customer's recent spend, so an operator that takes
   # no payment can still lower the proof-of-work toll for a returning customer.
   class Visit < Server::ApplicationRecord
-    def self.table_name = "#{Kiosk.configuration.schema}.visits"
-
     # Call it when the visit happens, with what the visit was worth.
     def self.record!(user_id:, value_cents:) = create!(user_id:, value_cents:)
   end

data/app/views/kiosk/server/assistants/show.html.erb

@@ -1,6 +1,7 @@
 <%# «Link an assistant» page (link flow — Kiosk extension).
     Minimal on purpose — override by shipping
     app/views/kiosk/server/assistants/show.html.erb in the host app. %>
+<% content_for :title, 'Linked assistants' %>
 <main>
   <h1>Linked assistant accounts</h1>
 
@@ -21,26 +22,17 @@
   <section>
     <h2>Link a new assistant</h2>
     <p>
-      Mint a code, hand it to your assistant; the assistant redeems it with
-      its own key and is then bound to your account.
+      Get a link code and paste it into your assistant's chat. The assistant
+      uses the code once, with its own key, and is then linked to your account.
     </p>
     <form action="<%= @page_path %>/link" method="post">
       <input type="hidden" name="authenticity_token" value="<%= form_authenticity_token %>">
-      <button type="submit">Mint a link code</button>
+      <button type="submit">Get a link code</button>
     </form>
   </section>
 
   <section>
     <h2>Currently linked</h2>
-    <% unless @spending_cap_enforced %>
-      <p role="note">
-        <strong>Note:</strong> this origin configures no <code>spending_cap</code>
-        seam, so a cap saved below is recorded against the assistant but nothing
-        reads it when a charge is settled. To make it bind, set
-        <code>c.spending_cap = Kiosk::Server::ColumnSpendingCap.new</code> in the
-        Kiosk initializer.
-      </p>
-    <% end %>
     <% if @assistants.empty? %>
       <p>No assistant accounts are linked yet.</p>
     <% else %>
@@ -49,36 +41,40 @@
           <li>
             <strong><%= assistant[:human_label].to_s.empty? ? "(unnamed)" : assistant[:human_label] %></strong>
             <code><%= assistant[:fingerprint] %></code>
-            — linked <%= assistant[:created_at] %>
+            <% if assistant[:bound_at] %>— linked <%= assistant[:bound_at] %><% end %>
+            <% if @payments %>
             <p>
-              <%
-                spent = assistant[:spent_cents].map { |currency, cents| "#{cents} cents in #{currency.upcase}" }
-              %>
-              spent: <%= spent.empty? ? "0 cents" : spent.join(", ") %> —
+              <% spent = assistant[:spent_cents].map { |currency, cents| Kiosk::Server::Money.format(cents, currency) } %>
+              Spent: <%= spent.empty? ? "nothing" : spent.join(", ") %>
+              <% if @spending_cap %>
               <%
                 cap = assistant[:spending_cap_cents]
                 cap_label = if cap.nil?
-                              "cap: none"
+                              "no spending cap"
                             elsif cap.zero?
-                              "cap: disabled"
+                              "no payments allowed"
                             else
-                              "cap: #{cap} cents in #{assistant[:spending_cap_currency].upcase}"
+                              "spending cap #{Kiosk::Server::Money.format(cap, assistant[:spending_cap_currency])} per payment"
                             end
               %>
-              <%= cap_label %>
+              — <%= cap_label %>
+              <% end %>
             </p>
+            <% end %>
             <form action="<%= @page_path %>/update" method="post">
               <input type="hidden" name="authenticity_token" value="<%= form_authenticity_token %>">
               <input type="hidden" name="agent_id" value="<%= assistant[:agent_id] %>">
               <label>Label
                 <input type="text" name="human_label" value="<%= assistant[:human_label] %>">
               </label>
-              <label>Spending cap (cents, blank = no cap)
-                <input type="number" name="spending_cap_cents" min="0" value="<%= assistant[:spending_cap_cents] %>">
+              <% if @spending_cap %>
+              <label>Spending cap per payment (blank: no cap; 0: no payments)
+                <input type="text" name="spending_cap" inputmode="decimal" value="<%= assistant[:spending_cap_cents] && Kiosk::Server::Money.amount(assistant[:spending_cap_cents], assistant[:spending_cap_currency]) %>">
               </label>
-              <label>Cap currency (ISO 4217 code; the assistant cannot pay in another currency)
+              <label>Cap currency (a three-letter code such as EUR; the assistant cannot pay in another currency)
                 <input type="text" name="spending_cap_currency" maxlength="3" value="<%= assistant[:spending_cap_currency]&.upcase %>">
               </label>
+              <% end %>
               <button type="submit">Save</button>
             </form>
             <form action="<%= @page_path %>/unlink" method="post">

data/app/views/kiosk/server/device_verify/decided.html.erb

@@ -1,5 +1,6 @@
 <%# Claim-ceremony decision confirmation. Override by shipping
     app/views/kiosk/server/device_verify/decided.html.erb in the host app. %>
+<% content_for :title, 'Link an assistant' %>
 <main>
   <% if @decision == :approved %>
     <h1>Approved</h1>

data/app/views/kiosk/server/device_verify/show.html.erb

@@ -1,6 +1,7 @@
 <%# Claim-ceremony verify page. Minimal on purpose — override
     by shipping app/views/kiosk/server/device_verify/show.html.erb in the
     host app. %>
+<% content_for :title, 'Link an assistant' %>
 <main>
   <h1>Link an assistant to your account</h1>
 

data/app/views/layouts/kiosk/server/application.html.erb

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<%# The document around the account holder's pages. Override by shipping
+    app/views/layouts/kiosk/server/application.html.erb in the host app. %>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title><%= yield :title %> — <%= request.host %></title>
+</head>
+<body>
+<%= yield %>
+<footer><a href="/">Back to <%= request.host %></a></footer>
+</body>
+</html>

data/lib/generators/kiosk/install/install_generator.rb

@@ -6,24 +6,22 @@ require 'rails/generators/migration'
 
 module Kiosk
   module Generators
-    # `bin/rails g kiosk:install`: writes the Kiosk initializer, the wire routes
-    # and the migrations, with the DDL of {Kiosk::Server::SchemaDefinitions} written into each.
+    # `bin/rails g kiosk:install`: writes the Kiosk initializer, the Kiosk routes
+    # and the migrations of Kiosk's `kiosk_*` tables.
     class InstallGenerator < ::Rails::Generators::Base
       include ::Rails::Generators::Migration
 
       source_root File.expand_path('templates', __dir__)
 
       desc 'Generate the Kiosk initializer and its canonical base migrations. ' \
-           'Draws the engine mount, so the origin answers on the wire.'
+           'Draws the engine mount, so the origin answers Kiosk requests.'
 
       class_option :user_table,    type: :string, default: 'users',
                                    desc: "Provider's user table name"
-      class_option :user_id_type,  type: :string, default: 'uuid',
+      class_option :user_id_type,  type: :string, default: 'uuid', enum: %w[uuid bigint integer text],
                                    desc: 'User-id column type: uuid | bigint | integer | text'
-      class_option :schema,        type: :string, default: 'kiosk',
-                                   desc: 'Postgres schema name for Kiosk helpers and tables'
-      class_option :guc_namespace, type: :string, default: 'app',
-                                   desc: 'GUC namespace prefix used in the session GUC names'
+      class_option :schema,        type: :string, default: 'public',
+                                   desc: "Postgres schema of Kiosk's tables"
 
       # Ascending timestamps within one run, so the migrations sort in order.
       @migration_counter = 0
@@ -36,23 +34,30 @@ module Kiosk
         end
       end
 
+      MIGRATIONS = %w[identity_tables device_authorizations mandates kyc_attributes events
+                      pow_spent revocations visits refunds].freeze
+
       no_commands do
-        # One SchemaDefinitions method's DDL, indented for the migration's heredoc.
-        def ddl(name, **)
-          Kiosk::Server::SchemaDefinitions.public_send(:"#{name}_sql", schema: options[:schema], **)
-                                          .gsub(/^(?=.)/, '      ')
-        end
+        def public_schema? = options[:schema] == 'public'
+
+        # A Kiosk table as a migration names it: `:kiosk_agents`, or `"ops.kiosk_agents"`.
+        def table(name) = public_schema? ? ":kiosk_#{name}" : %("#{options[:schema]}.kiosk_#{name}")
 
-        def user_id_type = options[:user_id_type].to_sym
+        # The type of `users.id`, which every `user_id` column takes.
+        def user_id_type = ":#{options[:user_id_type]}"
+
+        # The foreign key of a `user_id` column: a row goes with its user.
+        def users_key = "{ to_table: :#{options[:user_table]}, on_delete: :cascade }"
       end
 
       def create_initializer
         template 'initializer.rb.tt', 'config/initializers/kiosk.rb'
       end
 
-      # schema.rb dumps only the search path's schemas unless told otherwise;
-      # public goes first because the kiosk tables reference the user table.
+      # schema.rb dumps only the search path's schemas unless told otherwise.
       def dump_kiosk_schema
+        return if public_schema?
+
         application %(config.active_record.dump_schemas = "public,#{options[:schema]}")
       end
 
@@ -66,54 +71,10 @@ module Kiosk
         RUBY
       end
 
-      def create_schema_migration
-        migration_template 'create_kiosk_schema.rb.tt',
-                           'db/migrate/create_kiosk_schema.rb'
-      end
-
-      def create_identity_tables_migration
-        migration_template 'create_kiosk_identity_tables.rb.tt',
-                           'db/migrate/create_kiosk_identity_tables.rb'
-      end
-
-      def create_device_authorizations_migration
-        migration_template 'create_kiosk_device_authorizations.rb.tt',
-                           'db/migrate/create_kiosk_device_authorizations.rb'
-      end
-
-      def create_mandates_migration
-        migration_template 'create_kiosk_mandates.rb.tt',
-                           'db/migrate/create_kiosk_mandates.rb'
-      end
-
-      def create_kyc_attributes_migration
-        migration_template 'create_kiosk_kyc_attributes.rb.tt',
-                           'db/migrate/create_kiosk_kyc_attributes.rb'
-      end
-
-      def create_events_migration
-        migration_template 'create_kiosk_events.rb.tt',
-                           'db/migrate/create_kiosk_events.rb'
-      end
-
-      def create_pow_spent_migration
-        migration_template 'create_kiosk_pow_spent.rb.tt',
-                           'db/migrate/create_kiosk_pow_spent.rb'
-      end
-
-      def create_revocations_migration
-        migration_template 'create_kiosk_revocations.rb.tt',
-                           'db/migrate/create_kiosk_revocations.rb'
-      end
-
-      def create_visits_migration
-        migration_template 'create_kiosk_visits.rb.tt',
-                           'db/migrate/create_kiosk_visits.rb'
-      end
-
-      def create_refunds_migration
-        migration_template 'create_kiosk_refunds.rb.tt',
-                           'db/migrate/create_kiosk_refunds.rb'
+      def create_migrations
+        MIGRATIONS.each do |name|
+          migration_template "create_kiosk_#{name}.rb.tt", "db/migrate/create_kiosk_#{name}.rb"
+        end
       end
     end
   end

data/lib/generators/kiosk/install/templates/create_kiosk_device_authorizations.rb.tt

@@ -1,17 +1,26 @@
 # frozen_string_literal: true
 
-# Migration 004 — kiosk.device_authorizations: the account-binding state
-# machine behind the RFC 8628-shaped claim and link ceremonies, in the shape
-# DeviceAuthorizationStores::ActiveRecord reads and writes (hashed device and
-# user codes, the bound public key, claim vs link).
+# The account-binding requests behind the claim and link ceremonies (RFC 8628
+# shape). The device and user codes are stored hashed. `requested_role` is the
+# role of the approving human, never one a client asks for.
 class CreateKioskDeviceAuthorizations < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:device_authorizations, user_id_type: user_id_type) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".device_authorizations)
+  def change
+    create_table <%= table :device_authorizations %>, id: :uuid do |t|
+      t.text :device_code_hash, null: false, index: { unique: true }
+      # Unique among pending requests only: a finished request may share a code with an old one.
+      t.text :user_code_hash, null: false, index: { unique: true, where: "status = 'pending'" }
+      t.text :public_key_pem
+      t.text :kind, null: false, default: 'claim'
+      t.text :client_id, null: false
+      t.text :requested_role
+      t.text :status, null: false
+      t.column :user_id, <%= user_id_type %>
+      t.timestamptz :expires_at, null: false, index: { where: "status IN ('pending', 'approved')" }
+      t.timestamptz :consumed_at
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      t.check_constraint "status IN ('pending', 'approved', 'denied', 'consumed', 'expired')",
+                         name: 'kiosk_device_authorizations_status'
+      t.check_constraint "kind IN ('claim', 'link')", name: 'kiosk_device_authorizations_kind'
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_events.rb.tt

@@ -1,22 +1,20 @@
 # frozen_string_literal: true
 
-# Migration 007 — create kiosk.events.
-# The per-identity EVENT TAIL an operator serving any topic needs. `id` is a
-# bigserial, and that is what makes the wire's event id a per-origin monotonic
-# integer — one cursor then resumes every subscription on a socket with one
-# integer comparison.
-# `identity_key` is a user_id, not an agent_id: a human's second assistant must
-# read the same tail, and a revoked assistant is stopped at the socket.
-# Laid down unconditionally, like kiosk.kyc_attributes: the route is drawn
-# whether or not this origin declares a topic, and an empty table costs nothing.
+# The event tail. `id` is the origin's one ascending cursor: a single integer
+# resumes every subscription on a socket. `identity_key` is a user id, so every
+# assistant of one person reads the same tail.
 class CreateKioskEvents < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:events) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".events)
+  def change
+    create_table <%= table :events %> do |t|
+      t.text :identity_key, null: false
+      t.text :topic, null: false
+      t.text :subject
+      t.timestamptz :occurred_at, null: false
+      t.jsonb :data, null: false
+      # The retention sweep reads it.
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }, index: true
+      # `since` for one subscriber: the cursor scan, in id order.
+      t.index %i[identity_key id]
+    end
   end
 end