kiosk-server 0.6.1 → 0.6.28

data/lib/generators/kiosk/install/templates/create_kiosk_identity_tables.rb.tt

@@ -1,16 +1,45 @@
 # frozen_string_literal: true
 
-# Migration 002 — Kiosk identity tables: agents, agent_tokens, agent_mappings.
+# Kiosk's identity tables: the registered assistants, the tolled calls of
+# each account since its last proof, and the assistant accounts that
+# registration opened, with the account each one merged into at its first binding.
 class CreateKioskIdentityTables < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:identity_tables, user_id_type: user_id_type, user_table: options[:user_table]) %>
-    SQL
-  end
+  def change
+<% unless public_schema? -%>
+    create_schema "<%= options[:schema] %>", if_not_exists: true
+
+<% end -%>
+    create_table <%= table :agents %>, id: :uuid do |t|
+      t.references :user, type: <%= user_id_type %>, null: false, foreign_key: <%= users_key %>,
+                          index: { where: 'revoked_at IS NULL' }
+      t.text :allowed_roles, array: true, null: false, default: []
+      t.text :public_key
+      t.text :human_label
+      # The most one payment may charge. NULL: no cap. 0: no payments. A cap has its currency.
+      t.bigint :spending_cap_cents
+      t.text :spending_cap_currency
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      # The time of the latest binding.
+      t.timestamptz :bound_at
+      t.timestamptz :revoked_at
+      t.text :issuer, null: false
+      t.check_constraint "spending_cap_currency ~ '^[a-z]{3}$'", name: 'kiosk_agents_spending_cap_currency_code'
+      t.check_constraint '(spending_cap_cents IS NULL) = (spending_cap_currency IS NULL)',
+                         name: 'kiosk_agents_spending_cap_currency_set'
+      # One live row per public key on an origin, enforced by the database; a revoked key can register again.
+      t.index %i[issuer public_key], unique: true, where: 'revoked_at IS NULL'
+    end
+
+    create_table <%= table :tolled_calls %>, primary_key: :user_id, id: <%= user_id_type %>, default: nil do |t|
+      t.bigint :calls_since_proof, null: false, default: 0
+      t.foreign_key :<%= options[:user_table] %>, column: :user_id, on_delete: :cascade
+    end
 
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".agent_mappings)
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".agent_tokens)
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".agents)
+    create_table <%= table :assistant_accounts %>, primary_key: :user_id, id: <%= user_id_type %>, default: nil do |t|
+      t.column :merged_into, <%= user_id_type %>, index: { where: 'merged_into IS NOT NULL' }
+      t.timestamptz :merged_at
+      t.foreign_key :<%= options[:user_table] %>, column: :user_id, on_delete: :cascade
+      t.foreign_key :<%= options[:user_table] %>, column: :merged_into, on_delete: :cascade
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_kyc_attributes.rb.tt

@@ -1,20 +1,22 @@
 # frozen_string_literal: true
 
-# Migration 006 — create kiosk.kyc_attributes.
-# ONE ROW per NAMED ANONYMIZED boolean attribute a valid KYC attestation
-# granted an agent (e.g. age_over_18, licence_a). Only the NAMES are stored —
-# never the DOB, licence number, or any underlying document.
-# There is no value column: the grant IS the row, so every gate is an EXISTS
-# and no reader has to decide which spelling of `true` counts.
-# Additive/opt-in: needed only if an Action gates on specific KYC attributes.
+# The KYC grants and the open verifications, keyed on the person. A grant is
+# one row per anonymized attribute a valid attestation granted (`age_over_18`):
+# only the name, never the document or the value behind it.
 class CreateKioskKycAttributes < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:kyc_attributes, user_id_type: user_id_type, user_table: options[:user_table]) %>
-    SQL
-  end
+  def change
+    create_table <%= table :kyc_attributes %>, primary_key: %i[user_id name] do |t|
+      t.references :user, type: <%= user_id_type %>, null: false, index: false, foreign_key: <%= users_key %>
+      t.text :name, null: false
+      t.timestamptz :granted_at, null: false, default: -> { 'now()' }
+    end
 
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".kyc_attributes)
+    create_table <%= table :kyc_requests %>, id: :text do |t|
+      t.references :user, type: <%= user_id_type %>, null: false, index: false, foreign_key: <%= users_key %>
+      t.text :nonce, null: false
+      t.timestamptz :approved_at
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      t.index %i[user_id created_at]
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_mandates.rb.tt

@@ -1,20 +1,56 @@
 # frozen_string_literal: true
 
-# Migration 005 — kiosk AP2 mandate trail:
-# checkout_mandates, payment_mandates, settlements.
-# See the Payment (AP2 mandates) section of the spec.
+# The AP2 trail of a `pay`: the checkout mandate, the payment mandate and the
+# settlement. `reference` is the hash of the presented SD-JWT, unique per user.
+# A checkout has one live checkout mandate: `declined_at` records a charge
+# refused with no money moved, and frees the checkout.
 class CreateKioskMandates < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:mandates, user_id_type: user_id_type) %>
-    SQL
-  end
+  def change
+    create_table <%= table :checkout_mandates %>, id: :uuid do |t|
+      t.text :reference, null: false
+      t.text :checkout_hash, null: false
+      t.column :user_id, <%= user_id_type %>, null: false
+      t.uuid :agent_id, null: false
+      t.text :issuer, null: false
+      t.jsonb :line_items, null: false
+      t.bigint :total_amount_cents, null: false
+      t.text :currency, null: false
+      t.timestamptz :expires_at, null: false
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      t.text :sd_jwt, null: false
+      t.timestamptz :declined_at
+      t.index %i[user_id reference], unique: true
+      t.index %i[user_id checkout_hash], unique: true, where: 'declined_at IS NULL'
+    end
+
+    create_table <%= table :payment_mandates %>, id: :uuid do |t|
+      t.text :reference, null: false
+      t.references :checkout_mandate, type: :uuid, null: false,
+                                      foreign_key: { to_table: <%= table :checkout_mandates %>, on_delete: :cascade }
+      t.column :user_id, <%= user_id_type %>, null: false
+      t.uuid :agent_id, null: false
+      t.text :issuer, null: false
+      t.text :payment_instrument, null: false
+      t.bigint :amount_cents, null: false
+      t.text :currency, null: false
+      t.timestamptz :expires_at
+      t.timestamptz :created_at, null: false, default: -> { 'now()' }
+      t.text :sd_jwt, null: false
+      t.index %i[user_id reference], unique: true
+    end
 
-  def down
-    # Reverse-FK order: payment_mandates and settlements both reference
-    # checkout_mandates, so both drop before it.
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".payment_mandates)
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".settlements)
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".checkout_mandates)
+    # The server writes a settlement; nobody signs it. One per checkout mandate.
+    create_table <%= table :settlements %>, id: :uuid do |t|
+      t.references :checkout_mandate, type: :uuid, null: false, index: { unique: true },
+                                      foreign_key: { to_table: <%= table :checkout_mandates %>, on_delete: :cascade }
+      t.column :user_id, <%= user_id_type %>, null: false, index: true
+      t.uuid :agent_id, null: false
+      t.text :issuer, null: false
+      t.text :psp_reference, null: false
+      t.bigint :settled_amount_cents, null: false
+      t.text :currency, null: false
+      t.text :network_confirmation_id
+      t.timestamptz :settled_at, null: false
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_pow_spent.rb.tt

@@ -1,16 +1,12 @@
 # frozen_string_literal: true
 
-# Migration 008 — create kiosk.pow_spent.
-# The spent proof-of-work challenge ids, so a proof is accepted once across
-# every process and every deploy (PowSpentStores::ActiveRecord, the default).
+# The spent ids of proof-of-work challenges and client assertions. The primary
+# key accepts each id once, in every process and across deploys.
 class CreateKioskPowSpent < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:pow_spent) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".pow_spent)
+  def change
+    create_table <%= table :pow_spent %>, id: :text do |t|
+      # The expiry sweep reads it.
+      t.timestamptz :expires_at, null: false, index: true
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_refunds.rb.tt

@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-# Migration 012 — create kiosk.refunds.
-# The refunds of settled charges (Kiosk::Server::PaymentClaim#refund), which
-# recent spend leaves out of the proof-of-work toll.
+# The refunds of settled charges, one row per PSP refund. Recent spend counts
+# a settlement less what was refunded of it.
 class CreateKioskRefunds < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:refunds) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".refunds)
+  def change
+    create_table <%= table :refunds %>, id: :uuid do |t|
+      t.references :settlement, type: :uuid, null: false,
+                                foreign_key: { to_table: <%= table :settlements %>, on_delete: :cascade }
+      t.text :psp_reference, null: false, index: { unique: true }
+      t.bigint :refunded_amount_cents, null: false
+      t.timestamptz :refunded_at, null: false
+      t.check_constraint 'refunded_amount_cents > 0', name: 'kiosk_refunds_refunded_amount_cents'
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_revocations.rb.tt

@@ -1,16 +1,12 @@
 # frozen_string_literal: true
 
-# Migration 009 — create kiosk.revocations.
-# Each agent's token revocation watermark, so a revoke or an unlink holds in
-# every process and across restarts (RevocationStores::ActiveRecord, the default).
+# Each agent's revocation watermark: a token issued before it stops verifying,
+# in every process and after a restart.
 class CreateKioskRevocations < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:revocations) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".revocations)
+  def change
+    create_table <%= table :revocations %>, primary_key: :agent_id, id: :uuid, default: nil do |t|
+      t.timestamptz :revoked_before, null: false
+      t.foreign_key <%= table :agents %>, column: :agent_id, on_delete: :cascade
+    end
   end
 end

data/lib/generators/kiosk/install/templates/create_kiosk_visits.rb.tt

@@ -1,16 +1,15 @@
 # frozen_string_literal: true
 
-# Migration 011 — create kiosk.visits.
-# The visits the operator records as fulfilled (Kiosk::Visit.record!), which
-# lower the proof-of-work toll for a returning customer.
+# The visits the operator records as fulfilled (Kiosk::Visit.record!). Their
+# value lowers the proof-of-work toll for a returning customer.
 class CreateKioskVisits < ActiveRecord::Migration[ActiveRecord::Migration.current_version]
-  def up
-    execute <<~'SQL'
-<%= ddl(:visits, user_id_type: user_id_type) %>
-    SQL
-  end
-
-  def down
-    execute %(DROP TABLE IF EXISTS "<%= options[:schema] %>".visits)
+  def change
+    create_table <%= table :visits %>, id: :uuid do |t|
+      t.column :user_id, <%= user_id_type %>, null: false
+      t.bigint :value_cents, null: false
+      t.timestamptz :visited_at, null: false, default: -> { 'now()' }
+      t.check_constraint 'value_cents >= 0', name: 'kiosk_visits_value_cents'
+      t.index %i[user_id visited_at]
+    end
   end
 end

data/lib/generators/kiosk/install/templates/initializer.rb.tt

@@ -9,17 +9,21 @@ Kiosk.configure do |c|
   # Type of users.id: :uuid (default), :bigint, :integer or :text.
   c.user_id_type   = :<%= options[:user_id_type] %>
 
-  # coerce-then-validate on the per-verb wire is UNCONDITIONAL: arguments are
+  # coerce-then-validate on the per-verb endpoints is UNCONDITIONAL: arguments are
   # always checked against the verb's `input_schema` (§8.1). This flag adds a check:
   # it validates every answer against the verb's `output_schema`. Off in production,
   # where a descriptor typo would become a 500 for a caller.
   c.validate_responses = !Rails.env.production?
 
   # GUC namespace for SET LOCAL (and RLS policies). Default "app".
-  # c.guc_namespace = "<%= options[:guc_namespace] %>"
+  # c.guc_namespace = "app"
 
-  # Postgres schema for Kiosk helper functions and tables.
-  # c.schema = "<%= options[:schema] %>"
+  # Postgres schema of Kiosk's kiosk_* tables. Default "public".
+<% if public_schema? -%>
+  # c.schema = "public"
+<% else -%>
+  c.schema = "<%= options[:schema] %>"
+<% end -%>
 
   # Opt-in Postgres RLS: add `gem "kiosk-rls"` and create these database roles yourself.
   # c.app_role        = "app_role"      # runtime role with NOBYPASSRLS
@@ -42,6 +46,11 @@ Kiosk.configure do |c|
   # Owner block surfaced in /.well-known/kiosk.json.
   # c.owner = { name: "Your Company", support: "support@example.com" }
 
+  # The SHA-256 of the skill file that kiosk-server gives. Without it, discovery advertises no skill pin.
+  #   curl -fsS "$(bin/rails runner 'puts Kiosk.configuration.skill_url')" | shasum -a 256
+  # Kiosk::TestHelpers::SkillPin (kiosk-test-support) fails when an upgrade gives a different skill.
+  # c.skill_sha256 = "<the 64 hexadecimal characters that the command prints>"
+
   # Optional: an agent IdP of your own (subclass Kiosk::AgentIdentityProviders::Base; agent ids must be UUIDs).
   # c.agent_idp = MyExternalAgentIdp.new
 

data/lib/kiosk/payable.rb

@@ -30,7 +30,7 @@ module Kiosk
 
     class_methods do
       # Adds `settled_currency`, the currency of a settlement among `settlements`
-      # whose checkout names the row, or NULL: the caller's own on the wire, all
+      # whose checkout names the row, or NULL: the caller's own in the protocol, all
       # of them in a back office.
       def with_settlement(settlements)
         select(arel_table[Arel.star],

data/lib/kiosk/server/account_binding.rb

@@ -3,12 +3,13 @@
 module Kiosk
   module Server
     # Binds a registered client to a human's account: the client keeps its
-    # agent_id and reputation and takes the role of its new holder.
+    # agent_id and reputation and takes the role of its new holder. The first
+    # binding merges the assistant account into the human's account.
     module AccountBinding
       module_function
 
       # Call only after the client has authenticated.
-      # `requested_role` always comes from a human's identity, never the wire.
+      # `requested_role` always comes from a human's identity, never the request.
       #
       # @return [Client] the client under its new holder
       def bind!(agent_id:, user_id:, requested_role: nil)
@@ -61,6 +62,7 @@ module Kiosk
           transition = client.user_id.to_s != user_id.to_s
           conn.transaction do
             Rows.rebind(conn, config.schema, client.id, user_id, role)
+            carry_reputation(client.user_id, user_id) if transition
             claimed(config, client.id, client.user_id, user_id) if transition && config.assistant_claimed
           end
           # The old holder's tokens die (§6.3). The IdP dates new mints at the
@@ -68,6 +70,13 @@ module Kiosk
           revoke_tokens(config, client.id)
         end
 
+        # The new account adds the previous account's count of tolled calls,
+        # and the first binding merges the assistant account into it.
+        def carry_reputation(from, to)
+          TolledCalls.carry!(from:, to:)
+          AssistantAccounts.merge!(from:, into: to)
+        end
+
         # §6.3: the tokens of the previous holder stop.
         def revoke_tokens(config, agent_id)
           RevocationStores.revoke_issued(agent_id, store: config.revocation_store)
@@ -122,7 +131,7 @@ module Kiosk
 
         def revoke_owned(conn, schema, agent_id, user_id)
           conn.exec_query(<<~SQL.squish, 'Kiosk agent unlink', [agent_id, user_id, Kiosk.current_issuer]).to_a.first
-            UPDATE #{schema}.agents
+            UPDATE #{schema}.kiosk_agents
             SET revoked_at = now()
             WHERE id = $1
               AND user_id = $2
@@ -137,8 +146,8 @@ module Kiosk
           role_set, role_binds =
             role ? [', allowed_roles = ARRAY[$3]::text[]', [role]] : [", allowed_roles = '{}'::text[]", []]
           conn.exec_query(<<~SQL.squish, 'Kiosk agent rebind', [user_id, agent_id, *role_binds])
-            UPDATE #{schema}.agents
-            SET user_id = $1#{role_set}
+            UPDATE #{schema}.kiosk_agents
+            SET user_id = $1, bound_at = now()#{role_set}
             WHERE id = $2
           SQL
         end

data/lib/kiosk/server/account_holder_gate.rb

@@ -4,7 +4,8 @@ module Kiosk
   module Server
     # Requires a human signed in through the operator's own session
     # (`user_idp`), never an agent token. A browser is sent to `sign_in_path`;
-    # any other caller gets a 401 naming where to sign in.
+    # any other caller gets a 401 with the `Kiosk-Session` challenge, naming
+    # where to sign in.
     module AccountHolderGate
       private
 
@@ -22,6 +23,7 @@ module Kiosk
           store_return_location
           redirect_to sign_in_path
         else
+          response.set_header('WWW-Authenticate', Errors::SessionRequired.challenge)
           render plain: sign_in_path ? "#{prompt} #{sign_in_directions(sign_in_path)}" : prompt,
                  status: :unauthorized
         end

data/lib/kiosk/server/agent_identity_providers/default_agent_idp.rb

@@ -70,7 +70,7 @@ module Kiosk
         # `columns` is always a literal from this class, never caller input.
         def agent_row(columns, agent_id)
           ::ActiveRecord::Base.lease_connection.exec_query(
-            "SELECT #{columns} FROM #{schema}.agents WHERE id = $1 AND revoked_at IS NULL",
+            "SELECT #{columns} FROM #{schema}.kiosk_agents WHERE id = $1 AND revoked_at IS NULL",
             "Kiosk agent #{columns}",
             [agent_id]
           ).to_a.first

data/lib/kiosk/server/agent_rotation.rb

@@ -51,7 +51,7 @@ module Kiosk
         conn = ::ActiveRecord::Base.lease_connection
         conn.transaction do
           conn.exec_query(<<~SQL.squish, 'Kiosk agent key rotation', [pem, agent_id])
-            UPDATE #{Kiosk.configuration.schema}.agents SET public_key = $1 WHERE id = $2
+            UPDATE #{Kiosk.configuration.schema}.kiosk_agents SET public_key = $1 WHERE id = $2
           SQL
           RevocationStores.revoke_issued(agent_id)
         end

data/lib/kiosk/server/argument_decoder.rb

@@ -56,7 +56,7 @@ module Kiosk
         end
       end
 
-      # What a caller has to send for each string `format` the wire reads.
+      # What a caller has to send for each string `format` the protocol reads.
       FORMAT_SPELLINGS = {
         'date' => 'a calendar date as YYYY-MM-DD, e.g. 2026-08-19',
         'date-time' => 'an ISO 8601 timestamp, e.g. 2026-08-19T14:00:00Z'
@@ -76,7 +76,7 @@ module Kiosk
         "an object argument's leaves are SCALARS: `o%5Bk%5D=v`, not " \
         '`o%5Bk%5D%5B%5D=v`. Anything richer is an ACTION (POST).'
 
-      # The query string's shape: what Rack can decode and the wire accepts.
+      # The query string's shape: what Rack can decode and the protocol accepts.
       module QueryShape
         module_function
 

data/lib/kiosk/server/assistant_accounts.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module Server
+    # The accounts that the engine opened for assistants at registration, in
+    # `assistant_accounts`. The first binding of the assistant merges its
+    # assistant account into the human's account: from then on the spend of
+    # the human's account includes the settlements and visits of the assistant
+    # account. Unlinking the assistant later keeps the merge.
+    module AssistantAccounts
+      module_function
+
+      # Records `user_id` as the account of a new assistant. An account that
+      # `assistant_creation` gave to an earlier key is recorded once.
+      def record!(user_id)
+        connection.exec_query(%(INSERT INTO "#{schema}".kiosk_assistant_accounts (user_id) VALUES ($1) ON CONFLICT DO NOTHING),
+                              'Kiosk assistant account', [user_id])
+        nil
+      end
+
+      # Merges the account `from` into the account `into` when `from` is an
+      # assistant account that is not merged yet. A binding moves an assistant
+      # to the account of the approving human, which is never an assistant
+      # account: so the account of one human never merges into the account of
+      # another, and merges do not form chains.
+      def merge!(from:, into:)
+        connection.exec_query(<<~SQL.squish, 'Kiosk assistant account merge', [from, into])
+          UPDATE "#{schema}".kiosk_assistant_accounts SET merged_into = $2, merged_at = now()
+          WHERE user_id = $1 AND merged_into IS NULL
+        SQL
+        nil
+      end
+
+      def connection = ::ActiveRecord::Base.lease_connection
+      def schema = Kiosk.configuration.schema
+    end
+  end
+end

data/lib/kiosk/server/auth_toll.rb

@@ -5,15 +5,15 @@ module Kiosk
     # Optional proof-of-work toll on the auth requests that come before a
     # token: `POST /oauth/register`, the link-code claim `POST /auth/claim`, and
     # the first token poll of each device code. It runs before any lookup, so
-    # the answer never tells a caller whether a key or a code exists. It bounds
-    # the cost per request, not the rate: an edge rate limit is required
-    # (deploy/README.md "Edge rate-limit").
+    # the answer never tells a caller whether a key or a code exists. It sets
+    # the cost of each request, not a rate. The shipped deploy has no edge rate
+    # limit (deploy/README.md "Edge rate-limit").
     module AuthToll
       module_function
 
       def on?(config = Kiosk.configuration) = config.registration_pow_count.to_i.positive?
 
-      # `verb` and `body` make the fingerprint, so a proof pays for this request only.
+      # `verb` and `body` make the fingerprint, so a proof clears the toll of this request only.
       def gate(verb:, body:, pow:, config: Kiosk.configuration)
         return unless on?(config)
 
@@ -26,7 +26,7 @@ module Kiosk
       end
 
       def secret!(config)
-        unless defined?(::Kiosk::Reputation) && defined?(::Kiosk::Pow::Equihash)
+        unless defined?(::Kiosk::Reputation::Challenge) && defined?(::Kiosk::Pow::Equihash.params)
           raise Errors::ConfigurationError,
                 'registration_pow_count > 0 requires kiosk-reputation and kiosk-pow-equihash. ' \
                 'Add both gems (and `require` them) to your app.'

data/lib/kiosk/server/client.rb

@@ -31,7 +31,7 @@ module Kiosk
       def self.lookup(condition, value)
         row = ::ActiveRecord::Base.lease_connection.exec_query(<<~SQL.squish, 'Kiosk client lookup', [value, Kiosk.current_issuer]).to_a.first
           SELECT id, user_id, public_key, allowed_roles, extract(epoch FROM created_at)::bigint AS issued_at
-          FROM #{Kiosk.configuration.schema}.agents
+          FROM #{Kiosk.configuration.schema}.kiosk_agents
           WHERE #{condition} AND issuer = $2 AND revoked_at IS NULL
           LIMIT 1
         SQL

data/lib/kiosk/server/client_assertion.rb

@@ -17,7 +17,8 @@ module Kiosk
       REQUIRED_CLAIMS = %w[iss sub aud exp jti].freeze
 
       # A refused client assertion. The `/oauth/*` endpoints answer it as
-      # `invalid_client`, the other endpoints as `401 unauthenticated`.
+      # `invalid_client`, the other endpoints as `401 unauthenticated` with the
+      # `Kiosk-Client-Assertion` challenge.
       class Refused < StandardError
         attr_reader :hint
 
@@ -27,7 +28,7 @@ module Kiosk
         end
 
         def to_oauth = OauthError.new(:invalid_client, "#{message}: #{hint}")
-        def to_problem = Errors::Unauthenticated.new(message, hint: hint)
+        def to_problem = Errors::ClientAssertionRefused.new(message, hint: hint)
       end
 
       # A verified assertion that is not yet spent.

data/lib/kiosk/server/client_registration.rb

@@ -69,7 +69,11 @@ module Kiosk
       def register(config, key, role)
         pem = AssistantKey.to_pem(key)
         conn = ::ActiveRecord::Base.lease_connection
-        conn.transaction(requires_new: true) { insert_agent(conn, config, [create_assistant_account(config, pem), pem], role) }
+        conn.transaction(requires_new: true) do
+          account = create_assistant_account(config, pem)
+          AssistantAccounts.record!(account)
+          insert_agent(conn, config, [account, pem], role)
+        end
         Client.with_key(key)
       rescue ::ActiveRecord::RecordNotUnique
         Client.with_key(key)
@@ -79,7 +83,7 @@ module Kiosk
       def insert_agent(conn, config, binds, role)
         allowed_roles_sql, role_binds = role ? ['ARRAY[$4]::text[]', [role]] : ["'{}'::text[]", []]
         conn.exec_query(<<~SQL.squish, 'Kiosk agent insert', [*binds, Kiosk.current_issuer, *role_binds])
-          INSERT INTO #{config.schema}.agents (user_id, public_key, issuer, allowed_roles)
+          INSERT INTO #{config.schema}.kiosk_agents (user_id, public_key, issuer, allowed_roles)
           VALUES ($1, $2, $3, #{allowed_roles_sql})
         SQL
       end

data/lib/kiosk/server/column_spending_cap.rb

@@ -14,7 +14,7 @@ module Kiosk
         # The leased connection: the cap is read inside the transaction that charges.
         row = ::ActiveRecord::Base.lease_connection.exec_query(<<~SQL.squish, 'Kiosk spending cap', [agent_id]).to_a.first
           SELECT spending_cap_cents, spending_cap_currency
-          FROM "#{Kiosk.configuration.schema}".agents
+          FROM "#{Kiosk.configuration.schema}".kiosk_agents
           WHERE id = $1 AND revoked_at IS NULL
         SQL
         return nil if row.nil? || row['spending_cap_cents'].nil?