kiosk-test-support 0.5.20 → 0.6.28

data/lib/kiosk/test_helpers/conformance/checks/routes.rb

@@ -74,7 +74,7 @@ module Kiosk
             routed_name = found[:kiosk_verb].to_s
             return if routed_name == verb.name
 
-            "#{verb}: #{verb.http_method} #{path} hands the wire " \
+            "#{verb}: #{verb.http_method} #{path} hands the engine " \
               "kiosk_verb: #{routed_name.inspect} — the path segment and the " \
               '`defaults:` are two spellings of one name and must match'
           end

data/lib/kiosk/test_helpers/conformance/in_process_origin.rb

@@ -45,7 +45,7 @@ module Kiosk
           @wire.call(name, kind: kind, params: params, identity: identity_for(as))
         end
 
-        # Uses the wire's own validators, so a query's reserved `limit`/`cursor` pass as they do on the wire.
+        # Uses the protocol's own validators, so a query's reserved `limit`/`cursor` pass as they do in the protocol.
         def schema_errors(payload, schema:, verb:, kind:, slot:)
           if slot.to_s == 'input_schema'
             Kiosk::Server::RequestValidation.validate_arguments!(payload, input_schema: schema, verb: verb,

data/lib/kiosk/test_helpers/customer.rb

@@ -25,7 +25,7 @@ module Kiosk
       # How many proofs of work the assistant solved to be answered.
       def tolls_paid = @response.proofs
 
-      # The proofs of work that pay the toll this refusal demands.
+      # The proofs of work that solve the toll this refusal demands.
       def solved_toll = Wire.solve(self['challenges'])
 
       # The `Link` target with `rel="next"`: the rest of a truncated list.
@@ -40,10 +40,8 @@ module Kiosk
     class Customer
       attr_reader :principal
 
-      # An assistant holding a key and no account at its origin yet.
-      def self.newcomer(assistant)
-        new(assistant, Assistant::Principal.new(agent_id: nil, user_id: nil, token: nil, rsa_key: OpenSSL::PKey::RSA.generate(2048)))
-      end
+      # An assistant that registered its key here and acts for no person yet.
+      def self.newcomer(assistant) = new(assistant, assistant.register_client!)
 
       def initialize(assistant, principal)
         @assistant = assistant
@@ -52,7 +50,7 @@ module Kiosk
 
       def origin = @assistant.base_url
 
-      # Pays any proof-of-work toll asked for, unless `unpaid:` or carrying its own `proofs:`.
+      # Solves any proof-of-work toll asked for, unless `unpaid:` or carrying its own `proofs:`.
       def asks(query, headers: {}, unpaid: false, proofs: nil, **params)
         headers = headers.merge('Kiosk-PoW' => JSON.generate(proofs)) if proofs
         Answer.new(@assistant.query(principal, name: query.to_s, headers:, pay_tolls: !(unpaid || proofs), **params))
@@ -60,15 +58,8 @@ module Kiosk
 
       def does(action, headers: {}, **args) = Answer.new(@assistant.run(principal, name: action.to_s, headers:, **args))
 
-      # Signs intent, cart and payment mandates for `total` cents and pays.
-      def pays(total:, scope:, line_items:, currency: 'eur')
-        Answer.new(@assistant.pay(principal, **@assistant.mandates(principal, total:, scope:, line_items:, currency:)))
-      end
-
-      # Signs the `cart` an action answered with, unchanged, and pays.
-      def pays_cart(cart, scope:, currency: cart['currency'])
-        pays(total: cart['total_amount_cents'], scope:, line_items: cart['line_items'], currency:)
-      end
+      # Signs the checkout and payment mandates for the `checkout_jwt` an action answered, and pays.
+      def pays(checkout_jwt) = Answer.new(@assistant.pay(principal, checkout_jwt))
 
       # The answer says whether a card is on file, or carries the page where the person saves one.
       def sets_up_payment = does(:payment_setup)
@@ -92,21 +83,25 @@ module Kiosk
       def account = claims['sub']
       def role = claims['role']
 
-      def signs_back_in = Answer.new(@assistant.login(principal.rsa_key))
+      # Asks the token endpoint for a new token with the key it holds.
+      def signs_back_in = Answer.new(@assistant.token(principal))
 
-      # This assistant holding the credential a fresh sign-in issues.
+      # This assistant holding the credential a fresh token request issues.
       def with_a_fresh_credential = holding(signs_back_in)
 
       # Redeems the link code a person handed over; the assistant then acts for that person.
-      def redeems(link_code) = holding(Answer.new(@assistant.claim(link_code, principal.rsa_key)))
+      def redeems(link_code)
+        claimed = Answer.new(@assistant.claim(link_code, principal))
+        raise "#{origin} did not redeem #{link_code}: #{claimed}" unless claimed.ok?
 
-      # Asks to be linked to a person's account; the answer carries the code the person approves.
-      def asks_to_be_linked(client_id: 'kiosk-story')
-        Answer.new(@assistant.device_authorization(client_id:, public_key: principal.rsa_key.public_key.to_pem))
+        with_a_fresh_credential
       end
 
+      # Asks to be linked to a person's account; the answer carries the code the person approves.
+      def asks_to_be_linked = Answer.new(@assistant.device_authorization(principal))
+
       # Asks once whether the person has approved `request`.
-      def polls(request) = Answer.new(@assistant.device_token(request['device_code'], principal.rsa_key))
+      def polls(request) = Answer.new(@assistant.device_token(request['device_code'], principal))
 
       # This assistant holding the credential the person granted through `request`.
       def collects(request) = holding(polls(request))

data/lib/kiosk/test_helpers/dpop.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'digest'
+require 'jwt'
+require 'openssl'
+require 'securerandom'
+require 'uri'
+require 'kiosk/server/eddsa'
+
+module Kiosk
+  module TestHelpers
+    # The two headers of a call that carries an access token (RFC 9449): the
+    # token as `Authorization: DPoP`, and a proof that the token's key signs
+    # for this method and URL. A token request has no token yet: it sends
+    # only the proof, with no `ath`.
+    #
+    #   Dpop.headers(token, key, method: 'GET', url: 'https://shop.example/kiosk/catalog')
+    #   Dpop.headers(nil, key, method: 'POST', url: 'https://shop.example/kiosk/oauth/token')
+    module Dpop
+      module_function
+
+      # A new assistant key: Ed25519, or P-256 for `ES256`.
+      def generate_key(algorithm = 'EdDSA')
+        algorithm == 'ES256' ? OpenSSL::PKey::EC.generate('prime256v1') : OpenSSL::PKey.generate_key('ED25519')
+      end
+
+      # The JOSE algorithm the key signs with: EdDSA or ES256.
+      def algorithm(key) = Kiosk::Server::Jwk.algorithm(key)
+
+      def headers(token, key, method:, url:, iat: Time.now.to_i)
+        proof = { 'DPoP' => proof(token, key, method:, url:, iat:) }
+        token ? { 'Authorization' => "DPoP #{token}", **proof } : proof
+      end
+
+      # The same two headers as Rack env entries.
+      def env(token, key, method:, url:, iat: Time.now.to_i)
+        { 'HTTP_AUTHORIZATION' => "DPoP #{token}", 'HTTP_DPOP' => proof(token, key, method:, url:, iat:) }
+      end
+
+      # `url` loses its query and fragment: `htu` names the resource, not the arguments.
+      def proof(token, key, method:, url:, iat: Time.now.to_i)
+        uri = URI(url.to_s)
+        htu = "#{uri.scheme}://#{uri.host}#{":#{uri.port}" unless uri.port == uri.default_port}#{uri.path}"
+        payload = { jti: SecureRandom.uuid, htm: method.to_s.upcase, htu: htu, iat: iat }
+        payload[:ath] = ath(token) if token
+        JWT.encode(payload, key, algorithm(key), { typ: 'dpop+jwt', jwk: jwk(key) })
+      end
+
+      def ath(token) = Base64.urlsafe_encode64(Digest::SHA256.digest(token.to_s), padding: false)
+
+      # The RFC 7638 thumbprint of the key: a token's `cnf.jkt`, a rotation's `new_key`.
+      def thumbprint(key) = Kiosk::Server::Jwk.thumbprint(key)
+
+      # The public JWK (RFC 7517) of the key: a proof's `jwk`, a registration's `jwks` member.
+      def jwk(key) = Kiosk::Server::Jwk.public_members(key)
+    end
+  end
+end

data/lib/kiosk/test_helpers/errors.rb

@@ -13,7 +13,7 @@ module Kiosk
         DEFAULT_MESSAGE = <<~MSG.strip
           Kiosk::TestHelpers has no executor configured.
 
-          Wire one in your test helper:
+          Configure one in your test helper:
 
             # spec/spec_helper.rb or test/test_helper.rb
             require "kiosk/test_helpers/in_process_executor"
@@ -33,7 +33,7 @@ module Kiosk
         DEFAULT_MESSAGE = <<~MSG.strip
           Kiosk::TestHelpers::Conformance has no origin configured.
 
-          Wire one in your test helper:
+          Configure one in your test helper:
 
             # spec/spec_helper.rb or test/test_helper.rb
             require "kiosk/test_helpers/conformance/in_process_origin"

data/lib/kiosk/test_helpers/in_process_wire.rb

@@ -9,12 +9,13 @@ require 'rack/mock'
 require 'uri'
 require 'kiosk/server'
 require 'kiosk/test_helpers/wire'
+require 'kiosk/test_helpers/dpop'
 
 module Kiosk
   module TestHelpers
     # Calls a verb of the booted app through its route, in this process, as an
     # assistant does: one linked to the principal's account, as a person links
-    # one, and paying any proof-of-work toll. A caller with no identity sends no
+    # one, and solving any proof-of-work toll. A caller with no identity sends no
     # token.
     class InProcessWire
       # `app` defaults to the Rails application, middleware included.
@@ -22,12 +23,12 @@ module Kiosk
         @app = app
       end
 
-      # The verb's answer, or the wire error its refusal names.
+      # The verb's answer, or the Kiosk error its refusal names.
       def call(name, kind:, params:, identity:)
-        token      = token_for(identity) if identity
-        response   = request(name, kind, params, token)
+        credential = credential_for(identity) if identity
+        response   = request(name, kind, params, credential)
         challenges = toll_challenges(response)
-        response   = request(name, kind, params, token, Wire.solve(challenges)) if challenges
+        response   = request(name, kind, params, credential, Wire.solve(challenges)) if challenges
         answer(response)
       end
 
@@ -35,27 +36,40 @@ module Kiosk
 
       def app = @app || ::Rails.application
 
-      def request(name, kind, params, token, proofs = nil)
-        env = credentials(token, proofs)
+      def request(name, kind, params, credential, proofs = nil)
+        query = kind.to_sym == :query
         url = "#{Kiosk.current_issuer.to_s.chomp('/')}#{Kiosk.configuration.mount_path}/#{name}"
-        return Rack::MockRequest.new(app).get(query_url(url, params), env) if kind.to_sym == :query
+        env = credentials(credential, query ? 'GET' : 'POST', url, proofs)
+        return Rack::MockRequest.new(app).get(query_url(url, params), env) if query
 
         Rack::MockRequest.new(app).post(url, env.merge(input: JSON.generate(params), 'CONTENT_TYPE' => 'application/json'))
       end
 
-      def credentials(token, proofs)
-        { 'HTTP_AUTHORIZATION' => ("Bearer #{token}" if token),
-          'HTTP_KIOSK_POW' => (JSON.generate(proofs) if proofs) }.compact
+      # The access token with a DPoP proof its key signs for this request.
+      def credentials(credential, method, url, proofs)
+        env = credential ? Dpop.env(credential.token, credential.key, method:, url:) : {}
+        env['HTTP_KIOSK_POW'] = JSON.generate(proofs) if proofs
+        env
       end
 
       def query_url(url, params) = params.empty? ? url : "#{url}?#{URI.encode_www_form(params)}"
 
-      # The token of an assistant linked to the principal for this call.
-      def token_for(identity)
-        Kiosk::Server::AccountBinding.bind!(
-          public_key_pem: OpenSSL::PKey::RSA.generate(2048).public_key.to_pem,
-          user_id: identity.user_id, requested_role: identity.role
-        ).fetch(:access_token)
+      # The token and key of an assistant registered and linked to the principal for this call.
+      def credential_for(identity)
+        key    = Dpop.generate_key
+        client = Kiosk::Server::AccountBinding.bind!(agent_id: register(key).id, user_id: identity.user_id,
+                                                     requested_role: identity.role)
+        token  = Kiosk::Server::AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: client.id, role: client.role)
+        Wire::DpopCredential.new(token:, key:)
+      end
+
+      # Registers the key as a client, and solves the registration toll if the origin asks for one.
+      def register(key)
+        metadata = { 'jwks' => { 'keys' => [Kiosk::Server::AssistantKey.to_jwk(key)] } }
+        Kiosk::Server::ClientRegistration.call(metadata)
+      rescue Kiosk::Server::Errors::PowRequired => e
+        header = JSON.generate(Wire.solve(JSON.parse(JSON.generate(e.challenges))))
+        Kiosk::Server::ClientRegistration.call(metadata, pow: Kiosk::Server::PowGate.proofs_from_header(header))
       end
 
       def toll_challenges(response)

data/lib/kiosk/test_helpers/kyc.rb

@@ -17,21 +17,23 @@ module Kiosk
     #   rider.requests_verification
     #   the_verification_service_confirms(rider, age_over_18: true)
     module Kyc
-      ISSUER   = 'https://kyc.test.invalid'
-      SETTINGS = %i[kyc_provider kyc_issuer kyc_public_key].freeze
+      ISSUER = 'https://kyc.test.invalid'
 
-      # Opens checks without a network and signs attestations for them.
+      # Opens checks without a network and signs attestations for them, for
+      # the audience of the provider it stands in for.
       class Provider < Kiosk::KycProviders::Base
         Check = Data.define(:subject, :audience, :nonce, :callback_url)
 
-        def self.key = @key ||= OpenSSL::PKey::RSA.generate(2048)
+        def self.key = @key ||= OpenSSL::PKey.generate_key('ED25519')
 
-        def initialize
-          super
+        def initialize(audience:)
+          super(issuer: ISSUER, public_key: self.class.key, audience:)
           @checks = {}
         end
 
-        def open_verification(subject:, audience:, callback_url:, **)
+        def opens_verifications? = true
+
+        def open_verification(subject:, callback_url:, **)
           request_id = SecureRandom.uuid
           @checks[request_id] = Check.new(subject:, audience:, nonce: SecureRandom.hex(16), callback_url:)
           { request_id:, nonce: @checks[request_id].nonce, verification_url: "#{ISSUER}/verify?request=#{request_id}" }
@@ -47,7 +49,7 @@ module Kiosk
         def attest(subject, audience, attributes)
           now = Time.now.to_i
           JWT.encode({ sub: subject.to_s, level: 'verified', iss: ISSUER, aud: audience.to_s, attributes:,
-                       iat: now, exp: now + 3600 }, self.class.key, 'RS256')
+                       iat: now, exp: now + 3600 }, self.class.key, 'EdDSA')
         end
       end
 
@@ -72,7 +74,7 @@ module Kiosk
       # An attestation the provider signed for this principal, as an assistant
       # submits it to `POST <endpoint>/agents/kyc`.
       def kyc_attestation(principal, **attributes)
-        @kyc_provider.attest(principal.user_id, Kiosk.configuration.kyc_audience, attributes)
+        @kyc_provider.attest(principal.user_id, @kyc_provider.audience, attributes)
       end
 
       private
@@ -83,15 +85,13 @@ module Kiosk
 
       def stand_in_for_kyc_provider
         config = Kiosk.configuration
-        @replaced_kyc_settings = SETTINGS.to_h { [it, config.public_send(it)] }
-        @kyc_provider = Provider.new
-        config.kyc_provider   = @kyc_provider
-        config.kyc_issuer     = ISSUER
-        config.kyc_public_key = Provider.key.public_key
+        @replaced_kyc_provider = config.kyc_provider
+        @kyc_provider = Provider.new(audience: @replaced_kyc_provider&.audience)
+        config.kyc_provider = @kyc_provider
       end
 
       def restore_kyc_provider
-        @replaced_kyc_settings&.each { |setting, value| Kiosk.configuration.public_send(:"#{setting}=", value) }
+        Kiosk.configuration.kyc_provider = @replaced_kyc_provider if @kyc_provider
       end
     end
   end

data/lib/kiosk/test_helpers/live_server.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
-require 'puma'
 require 'socket'
+begin
+  require 'puma'
+rescue LoadError
+  raise LoadError, "Kiosk::TestHelpers::LiveServer serves the app with Puma. Add gem 'puma' to the Gemfile."
+end
 require 'kiosk/test_helpers/assistant'
 
 module Kiosk
@@ -18,19 +22,16 @@ module Kiosk
         base.teardown { SeededDatabase.empty }
       end
 
+      # Every table on the search path but Rails' own two.
       def self.empty
         connection = ActiveRecord::Base.connection
-        schemas = ActiveRecord.dump_schemas.split(',').map { connection.quote(it.strip) }.join(', ')
-        tables = connection.select_values(<<~SQL)
-          SELECT format('%I.%I', schemaname, tablename) FROM pg_tables
-          WHERE schemaname IN (#{schemas}) AND tablename NOT IN ('schema_migrations', 'ar_internal_metadata')
-        SQL
-        connection.execute("TRUNCATE #{tables.join(', ')} RESTART IDENTITY CASCADE") if tables.any?
+        tables = connection.tables - %w[schema_migrations ar_internal_metadata]
+        connection.execute("TRUNCATE #{tables.map { connection.quote_table_name(it) }.join(', ')} RESTART IDENTITY CASCADE") if tables.any?
       end
     end
 
     # Serves the app over HTTP from the test process, on a free port that
-    # becomes the origin's issuer, so a test drives the wire as an assistant does.
+    # becomes the origin's issuer, so a test drives the protocol as an assistant does.
     module LiveServer
       def self.included(base)
         base.include SeededDatabase

data/lib/kiosk/test_helpers/mandate.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'digest'
+require 'json'
+require 'jwt'
+require 'securerandom'
+require 'kiosk/test_helpers/dpop'
+
+module Kiosk
+  module TestHelpers
+    # The two closed AP2 v0.2 mandates an assistant signs to pay an operator's
+    # checkout, as compact SD-JWTs: what an assistant following the skill sends.
+    module Mandate
+      module_function
+
+      # @param checkout_jwt [String] the checkout an action answered, unchanged
+      # @return [Hash] `checkout:` and `payment:`, each a compact SD-JWT
+      def pay(key, checkout_jwt, instrument: 'on_file', lifetime: 600)
+        checkout = JWT.decode(checkout_jwt, nil, false).first
+        checkout_hash = digest(checkout_jwt)
+        now = Time.now.to_i
+        times = { iat: now, exp: now + lifetime }
+        { checkout: sign(key, { vct: 'mandate.checkout.1', checkout_jwt:, checkout_hash:, **times }),
+          payment: sign(key, { vct: 'mandate.payment.1', transaction_id: checkout_hash, payee: checkout['merchant'],
+                               payment_amount: { amount: checkout['total_amount_cents'], currency: checkout['currency'] },
+                               payment_instrument: { id: instrument, type: 'card' }, **times }) }
+      end
+
+      # A closed mandate: an SD-JWT whose one disclosure is `content`.
+      def sign(key, content)
+        disclosure = b64(JSON.generate([b64(SecureRandom.random_bytes(16)), content]))
+        jwt = JWT.encode({ _sd_alg: 'sha-256', delegate_payload: [{ '...' => digest(disclosure) }] }, key, Dpop.algorithm(key),
+                         { typ: 'dc+sd-jwt' })
+        "#{jwt}~#{disclosure}~"
+      end
+
+      # The disclosed mandate of `sd_jwt`, unverified.
+      def content(sd_jwt) = JSON.parse(Base64.urlsafe_decode64(sd_jwt.split('~')[1])).last
+
+      def digest(text) = b64(Digest::SHA256.digest(text))
+
+      def b64(bytes) = Base64.urlsafe_encode64(bytes, padding: false)
+    end
+  end
+end

data/lib/kiosk/test_helpers/pow_solver.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module TestHelpers
+    # The solver for a proof-of-work challenge. kiosk-pow-equihash ships the one
+    # solver here, and the host's bundle brings that gem.
+    module PowSolver
+      def self.for(challenge)
+        alg = challenge['alg']
+        raise ArgumentError, "The origin asks for a #{alg.inspect} proof of work. Wire solves only Equihash." unless alg == 'equihash'
+
+        require 'kiosk/pow/equihash/solver'
+        Kiosk::Pow::Equihash
+      rescue LoadError
+        raise LoadError, "Wire solves Equihash tolls with kiosk-pow-equihash. Add gem 'kiosk-pow-equihash' to the Gemfile."
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/skill_pin/rspec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'rspec/expectations'
+
+require 'kiosk/test_helpers/skill_pin'
+
+# `expect(Kiosk.configuration).to pin_the_served_skill(hashed_version: '0.6.28')`
+# The matcher DSL gives the keywords to the block as one Hash.
+RSpec::Matchers.define :pin_the_served_skill do |options|
+  match do |configuration|
+    @problem = Kiosk::TestHelpers::SkillPin.problem(hashed_version: options.fetch(:hashed_version), configuration:)
+    @problem.nil?
+  end
+
+  failure_message { @problem }
+  description { 'pin the SHA-256 of the skill that kiosk-server gives' }
+end

data/lib/kiosk/test_helpers/skill_pin.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'kiosk/server'
+
+module Kiosk
+  module TestHelpers
+    # Checks the skill pin of an origin. kiosk-server gives the skill URL, and
+    # each kiosk-server release gives the URL of a new skill version. The
+    # operator sets `skill_sha256`, the SHA-256 of that file, and tells this
+    # check the skill version that the digest is for. When an update of
+    # kiosk-server moves the skill to a different version, the check fails and
+    # tells the operator how to make the new digest.
+    module SkillPin
+      VERSION_IN_URL = /skill-v(\d+\.\d+\.\d+)\.md\z/
+      SHA256 = /\A\h{64}\z/
+
+      module_function
+
+      # nil when the pin is correct. Otherwise, what is wrong and what to do.
+      def problem(hashed_version:, configuration: Kiosk.configuration)
+        served = Kiosk::Configuration.new.skill_url
+        version = served[VERSION_IN_URL, 1]
+        return override(configuration.skill_url, served) unless configuration.skill_url == served
+        return if hashed_version == version && configuration.skill_sha256.to_s.match?(SHA256)
+
+        stale(served, version, hashed_version, configuration.skill_sha256)
+      end
+
+      def override(configured, served)
+        "The configuration sets skill_url to #{configured}. kiosk-server gives the skill URL " \
+          "(#{served}). Remove the line `c.skill_url = ...` from your configuration."
+      end
+
+      def stale(url, version, hashed_version, sha256)
+        <<~MESSAGE
+          #{cause(version, hashed_version, sha256)}
+          Do these steps:
+          1. Download the skill #{version} from kiosk.tech and calculate its SHA-256:
+               curl -fsS #{url} | shasum -a 256
+          2. Set `c.skill_sha256` in config/initializers/kiosk.rb to that digest.
+          3. Set `hashed_version: '#{version}'` in this test.
+        MESSAGE
+      end
+
+      def cause(version, hashed_version, sha256)
+        if hashed_version != version
+          "kiosk-server gives the skill #{version}, but skill_sha256 is the digest of the skill #{hashed_version}."
+        elsif sha256.nil?
+          "kiosk-server gives the skill #{version}, and skill_sha256 is not set."
+        else
+          "skill_sha256 is not a SHA-256 digest (64 hexadecimal characters): #{sha256.inspect}."
+        end
+      end
+
+      # The Minitest assertion:
+      #   include Kiosk::TestHelpers::SkillPin::Assertions
+      #   assert_kiosk_skill_pin hashed_version: '0.6.28'
+      module Assertions
+        def assert_kiosk_skill_pin(hashed_version:)
+          problem = SkillPin.problem(hashed_version:)
+          assert(problem.nil?, problem)
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/story.rb

@@ -18,7 +18,7 @@ module Kiosk
       # A newly registered assistant, as `as` (a demo's own Customer subclass).
       def a_customer(as: Customer) = as.new(assistant, register)
 
-      # An assistant holding a key and no account here yet.
+      # An assistant that registered its key here and acts for no person yet.
       def a_newcomer(as: Customer) = as.newcomer(assistant)
 
       # Someone with an account on the operator's site, signed in there.

data/lib/kiosk/test_helpers/version.rb

@@ -2,6 +2,6 @@
 
 module Kiosk
   module TestHelpers
-    VERSION = '0.5.20'
+    VERSION = '0.6.28'
   end
 end

data/lib/kiosk/test_helpers/wire.rb

@@ -3,7 +3,8 @@
 require 'json'
 require 'net/http'
 require 'uri'
-require 'kiosk/pow/equihash/solver'
+require 'kiosk/test_helpers/dpop'
+require 'kiosk/test_helpers/pow_solver'
 
 module Kiosk
   module TestHelpers
@@ -11,7 +12,7 @@ module Kiosk
     # `pay_tolls: true` it solves a proof-of-work toll and sends the request once more.
     #
     #   wire = Kiosk::TestHelpers::Wire.new(base_url: "http://127.0.0.1:3006")
-    #   status, problem = wire.post_json("/kiosk/edit_listing", { listing_id: "junk" }, Wire.bearer(token))
+    #   status, problem = wire.post_json("/kiosk/edit_listing", { listing_id: "junk" }, wire.dpop(token, key))
     class Wire
       # One answer: a body that is not JSON reads as `{}`, an unreachable origin as status 0.
       Response = Data.define(:status, :headers, :body, :raw_body, :proofs) do
@@ -19,7 +20,7 @@ module Kiosk
 
         def [](header) = headers[header.to_s.downcase]
 
-        # Whether the client paid a proof-of-work toll and sent the request again.
+        # Whether the client solved a proof-of-work toll and sent the request again.
         def pow_retried? = proofs.positive?
       end
 
@@ -42,10 +43,15 @@ module Kiosk
         http
       end
 
-      def self.bearer(token) = { 'Authorization' => "Bearer #{token}" }
+      # An access token and the key it is bound to. As a header value, the protocol
+      # sends it as `Authorization: DPoP <token>` with a proof for that request;
+      # with no token, as the proof alone (a token request).
+      DpopCredential = Data.define(:token, :key)
+
+      def self.dpop(token, key) = { 'Authorization' => DpopCredential.new(token:, key:) }
 
       # A solved proof of work for each challenge, as the `Kiosk-PoW` header carries them.
-      def self.solve(challenges) = challenges.map { { challenge: it, nonce: Kiosk::Pow::Equihash.solve(it) } }
+      def self.solve(challenges) = challenges.map { { challenge: it, nonce: PowSolver.for(it).solve(it) } }
 
       attr_reader :base_url
 
@@ -56,7 +62,7 @@ module Kiosk
         @read_timeout = read_timeout
       end
 
-      def bearer(token) = self.class.bearer(token)
+      def dpop(token, key) = self.class.dpop(token, key)
 
       def post_json(path, body = {}, headers = {}) = post(path, body, headers).then { [it.status, it.body] }
 
@@ -89,7 +95,7 @@ module Kiosk
         uri
       end
 
-      # The proof-of-work challenges of a toll this client pays, or nil.
+      # The proof-of-work challenges of a toll this client solves, or nil.
       def toll_challenges(answer)
         return unless @pay_tolls && answer.status == 402 && answer.body.is_a?(Hash)
 
@@ -97,10 +103,8 @@ module Kiosk
         challenges if challenges.is_a?(Array) && challenges.any?
       end
 
-      def deliver(klass, uri, body, headers)
-        request = klass.new(uri, body.nil? ? headers : { 'Content-Type' => 'application/json' }.merge(headers))
-        request.body = JSON.generate(body) unless body.nil?
-        yield request if block_given?
+      def deliver(klass, uri, body, headers, &)
+        request = build(klass, uri, body, headers, &)
         begin
           answer = self.class.http_for(uri, open_timeout: @open_timeout, read_timeout: @read_timeout).request(request)
         rescue StandardError => e
@@ -109,6 +113,25 @@ module Kiosk
         response(answer)
       end
 
+      def build(klass, uri, body, headers)
+        headers = { 'Content-Type' => 'application/json' }.merge(headers) unless body.nil?
+        request = klass.new(uri, signed(headers, klass::METHOD, uri))
+        request.body = JSON.generate(body) unless body.nil?
+        yield request if block_given?
+        request
+      end
+
+      # Each delivery signs its own DPoP proof, so a retry never reuses one.
+      def signed(headers, method, uri)
+        headers.each_with_object({}) do |(name, value), out|
+          if value.is_a?(DpopCredential)
+            out.merge!(Dpop.headers(value.token, value.key, method:, url: uri.to_s))
+          else
+            out[name] = value
+          end
+        end
+      end
+
       def response(answer)
         raw_body = answer.body.to_s
         body = begin