kiosk-test-support 0.5.20

data/lib/kiosk/test_helpers/assistant.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'openssl'
+require 'securerandom'
+require 'uri'
+require 'jwt'
+require 'kiosk/test_helpers/wire'
+require 'kiosk/test_helpers/assistant/events'
+
+module Kiosk
+  module TestHelpers
+    # An assistant on the wire: registers, then queries, runs and pays as the
+    # principal it registered, paying every proof-of-work toll it is asked for.
+    #
+    #   assistant = Kiosk::TestHelpers::Assistant.new(base_url: live_url)
+    #   rider     = assistant.register!
+    #   assistant.run(rider, name: "reserve", scooter_code: "SK-001")
+    class Assistant
+      class RegistrationError < StandardError; end
+
+      # The account an assistant registered, and the key that signs its mandates.
+      Principal = Data.define(:agent_id, :user_id, :token, :rsa_key)
+
+      attr_reader :wire
+
+      def initialize(base_url:)
+        @wire = Wire.new(base_url:, pay_tolls: true)
+      end
+
+      def base_url = wire.base_url
+
+      # `pow:` is `:solve`, `:skip` (send no proof) or a String sent verbatim as
+      # the proof; `wire_role:` puts a `role` the engine must ignore into the body.
+      def register_raw(pow: :solve, wire_role: nil)
+        register(pow:, wire_role:).first
+      end
+
+      def register!(pow: :solve)
+        response, key = register(pow:)
+        raise RegistrationError, "register! expected 201, got #{response.status}: #{response.body.inspect}" unless response.status == 201
+
+        Principal.new(agent_id: response.body.fetch('agent_id'), user_id: response.body.fetch('user_id'),
+                      token: response.body.fetch('access_token'), rsa_key: key)
+      end
+
+      # The unauthenticated request that opens the account-binding ceremony (RFC 8628 §3.1).
+      def device_authorization(client_id:, public_key:, **extra)
+        wire.post_form('/kiosk/oauth/device_authorization',
+                       { 'client_id' => client_id, 'public_key' => public_key }.merge(extra.transform_keys(&:to_s)))
+      end
+
+      def kyc(principal, attestation_jws:)
+        wire.post('/kiosk/agents/kyc', { kyc_jws: attestation_jws }, wire.bearer(principal.token))
+      end
+
+      # `pay_tolls: false` answers a proof-of-work toll instead of paying it.
+      def query(principal, name:, headers: {}, pay_tolls: true, **params)
+        (pay_tolls ? wire : unpaid).get("/kiosk/#{name}", params, wire.bearer(principal.token).merge(headers))
+      end
+
+      def run(principal, name:, headers: {}, **args)
+        wire.post("/kiosk/#{name}", args, wire.bearer(principal.token).merge(headers))
+      end
+
+      # The intent and cart mandates for a quote of `total` cents, for #pay.
+      def mandates(principal, total:, scope:, line_items:, currency: 'eur')
+        now    = Time.now.to_i
+        common = { user_id: principal.user_id, agent_id: principal.agent_id, iss: base_url, currency:, iat: now, exp: now + 600 }
+        intent = common.merge(id: SecureRandom.uuid, scope:, cap_amount_cents: total)
+        { intent:, cart: common.merge(id: SecureRandom.uuid, intent_mandate_id: intent[:id], total_amount_cents: total, line_items:) }
+      end
+
+      def pay(principal, intent:, cart:, payment_method: 'pm_demo')
+        payment = payment_mandate(principal, cart:, payment_method:)
+        pay_raw(principal, intent_jws: sign_mandate(principal, intent), cart_jws: sign_mandate(principal, cart),
+                           payment_jws: sign_mandate(principal, payment))
+      end
+
+      # On a 402 `payment_setup_required` it calls `payment_setup`, as the hint
+      # asks, and sends the same mandates once more. Against stripe-mock the
+      # Customer that `payment_setup` maps already lists a card, so that answer settles.
+      def pay_raw(principal, intent_jws:, cart_jws:, payment_jws:)
+        body   = { intent_mandate_jws: intent_jws, cart_mandate_jws: cart_jws, payment_mandate_jws: payment_jws }
+        answer = wire.post('/kiosk/pay', body, wire.bearer(principal.token))
+        return answer unless setup_required?(answer)
+
+        run(principal, name: 'payment_setup')
+        wire.post('/kiosk/pay', body, wire.bearer(principal.token))
+      end
+
+      def payment_mandate(principal, cart:, payment_method: 'pm_demo')
+        cart = cart.transform_keys(&:to_sym)
+        now  = Time.now.to_i
+        { id: SecureRandom.uuid, cart_mandate_id: cart[:id], user_id: principal.user_id, agent_id: principal.agent_id,
+          iss: cart[:iss], payment_method:, amount_cents: cart[:total_amount_cents], currency: cart[:currency],
+          exp: now + 600, iat: now }
+      end
+
+      def sign_mandate(principal, payload) = JWT.encode(payload, principal.rsa_key, 'RS256')
+
+      # Signs in again with the key it holds.
+      def login(key) = wire.post('/kiosk/auth/login', possession(key))
+
+      # Redeems a link code a person minted on the operator's site.
+      def claim(code, key) = wire.post('/kiosk/auth/claim', { code: }.merge(possession(key)))
+
+      # Polls for the credential a person grants on the operator's site (RFC 8628 §3.4).
+      def device_token(device_code, key)
+        wire.post_form('/kiosk/oauth/token', 'grant_type' => 'urn:ietf:params:oauth:grant-type:device_code',
+                                             'device_code' => device_code, 'signed' => proof_of_possession(key))
+      end
+
+      # A proof that the assistant holds `key`, over a fresh challenge and bound to this origin.
+      def proof_of_possession(key)
+        _, challenge = wire.get_json('/kiosk/auth/challenge', public_key: key.public_key.to_pem)
+        JWT.encode({ aud: base_url, nonce: challenge['challenge'], jti: SecureRandom.uuid, iat: Time.now.to_i }, key, 'RS256')
+      end
+
+      # What the origin publishes about itself at `/kiosk/schema`.
+      def schema = @schema ||= wire.get_json('/kiosk/schema').last
+
+      def events(principal) = Events.new(base_url:, token: principal.token).tap { (@connections ||= []) << it }
+
+      # Closes every event connection it opened.
+      def disconnect = @connections&.each(&:close)
+
+      private
+
+      def register(pow:, wire_role: nil)
+        key  = OpenSSL::PKey::RSA.generate(2048)
+        body = possession(key)
+        body[:role] = wire_role if wire_role
+        response = case pow
+                   when :solve then wire.post('/kiosk/auth/register', body)
+                   when :skip then unpaid.post('/kiosk/auth/register', body)
+                   else unpaid.post('/kiosk/auth/register', body, 'Kiosk-PoW' => pow)
+                   end
+        [response, key]
+      end
+
+      def possession(key) = { public_key: key.public_key.to_pem, signed: proof_of_possession(key) }
+
+      def unpaid = Wire.new(base_url:)
+
+      def setup_required?(answer)
+        answer.status == 402 && answer.body.is_a?(Hash) && answer.body['code'] == 'payment_setup_required'
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/conformance/checks/declared_shape.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module TestHelpers
+    module Conformance
+      module Checks
+        # The arguments satisfy the verb's input_schema and its answer satisfies
+        # its output_schema; the two failures are reported separately.
+        module DeclaredShape
+          extend Helpers
+
+          module_function
+
+          def call(origin, name, params:, as:)
+            verb = find_verb(origin, name)
+            return verb if verb.is_a?(Outcome)
+
+            arguments = arguments_for(verb, params)
+            missing_schema(verb) ||
+              input_rejected(origin, verb, params, arguments) ||
+              answer_checked(origin, verb, params, as)
+          end
+
+          def missing_schema(verb)
+            return no_input_schema(verb) if verb.input_schema.nil?
+
+            no_output_schema(verb) if verb.output_schema.nil?
+          end
+
+          def no_input_schema(verb)
+            Conformance.fail(
+              :declared_shape, subject: verb.name,
+                               message: "#{verb} publishes no input_schema. Both schemas are required of every " \
+                                        'verb; declare one (a verb that takes nothing declares the closed empty ' \
+                                        'object) rather than leaving callers to guess.'
+            )
+          end
+
+          def no_output_schema(verb)
+            Conformance.fail(
+              :declared_shape, subject: verb.name,
+                               message: "#{verb} publishes no output_schema, so nothing states the shape of its " \
+                                        'answer. Declare one — with no response envelope it is the only ' \
+                                        'machine-readable statement a caller has.'
+            )
+          end
+
+          def input_rejected(origin, verb, params, arguments)
+            errors = schema_errors(origin, arguments, verb.input_schema, verb, 'input_schema')
+            return if errors.empty?
+
+            Conformance.fail(
+              :declared_shape, subject: verb.name,
+                               message: "the arguments#{params_provenance(verb, params)} do not satisfy #{verb}'s " \
+                                        "own input_schema: #{errors.join('; ')}. Fix whichever is wrong — a " \
+                                        'published example an assistant cannot copy is worse than none.',
+                               details: { verb: verb.name, stage: :input, errors: errors, params: arguments }
+            )
+          end
+
+          def answer_checked(origin, verb, params, as)
+            executed = Checks.executes(origin, verb.name, params: params, as: as)
+            return executed if executed.failed?
+
+            answer = executed.details[:answer]
+            errors = schema_errors(origin, answer, verb.output_schema, verb, 'output_schema')
+            errors.empty? ? answer_accepted(verb, answer) : answer_rejected(verb, answer, errors)
+          end
+
+          def answer_accepted(verb, answer)
+            Conformance.pass(
+              :declared_shape, subject: verb.name,
+                               message: "#{verb} answered a payload its own output_schema accepts",
+                               details: { verb: verb.name, answer: answer }
+            )
+          end
+
+          def answer_rejected(verb, answer, errors)
+            Conformance.fail(
+              :declared_shape, subject: verb.name,
+                               message: "#{verb} rendered a payload its own output_schema rejects: " \
+                                        "#{errors.join('; ')}. The descriptor and the handler disagree; fix " \
+                                        'whichever is wrong.',
+                               details: { verb: verb.name, stage: :output, errors: errors, answer: answer }
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/conformance/checks/executes.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module TestHelpers
+    module Conformance
+      module Checks
+        # Called with these arguments as this principal, the verb answers rather than refusing.
+        module Executes
+          extend Helpers
+
+          module_function
+
+          def call(origin, name, params:, as:)
+            verb = find_verb(origin, name)
+            return verb if verb.is_a?(Outcome)
+
+            run(origin, verb, params, arguments_for(verb, params), as)
+          end
+
+          def run(origin, verb, params, arguments, as)
+            begin
+              answer = origin.call(verb.name, kind: verb.kind, params: arguments, as: as)
+            rescue StandardError => e
+              return refused(verb, params, arguments, e)
+            end
+
+            answered(verb, params, arguments, answer)
+          end
+
+          def refused(verb, params, arguments, error)
+            Conformance.fail(
+              :executes, subject: verb.name,
+                         message: "#{verb} did not execute: #{describe_error(error)}. " \
+                                  "Arguments were #{arguments.inspect}#{params_provenance(verb, params)}.",
+                         details: error_details(verb, arguments, error)
+            )
+          end
+
+          def error_details(verb, arguments, error)
+            { verb: verb.name, kind: verb.kind, error: error.class.name, params: arguments,
+              error_code: (error.code if error.respond_to?(:code)),
+              error_status: (error.http_status if error.respond_to?(:http_status)) }
+          end
+
+          def answered(verb, params, arguments, answer)
+            Conformance.pass(
+              :executes, subject: verb.name,
+                         message: "#{verb} executed#{params_provenance(verb, params)} and answered " \
+                                  "#{summarise_answer(answer)}",
+                         details: { verb: verb.name, kind: verb.kind, params: arguments, answer: answer }
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/conformance/checks/helpers.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'json_schemer'
+
+module Kiosk
+  module TestHelpers
+    module Conformance
+      module Checks
+        # `params:` default: the verb's own `example_params`, else `{}`.
+        EXAMPLE = :__kiosk_example_params__
+
+        # Refusing the second principal outright scopes as well as narrowing does;
+        # a 400 or 500 stays a failure.
+        SCOPING_REFUSALS = [403, 404].freeze
+
+        # Functions the four checks share.
+        module Helpers
+          module_function
+
+          # The verb by name, or a failing Outcome listing the declared ones.
+          def find_verb(origin, name)
+            wanted = name.to_s
+            found  = origin.verbs.find { |verb| verb.name == wanted }
+            return found if found
+
+            known = origin.verbs.map(&:name).sort
+            Conformance.fail(
+              :unknown_verb, subject: wanted,
+                             message: "no verb named #{wanted.inspect} is declared by this origin. " \
+                                      "Declared: #{known.empty? ? '(none at all)' : known.join(', ')}.",
+                             details: { asked: wanted, known: known }
+            )
+          end
+
+          # «403 forbidden», or nil when the outcome is not a scoping refusal.
+          def refusal_status(outcome)
+            return nil unless outcome.failed?
+
+            status = outcome.details[:error_status]
+            return nil unless SCOPING_REFUSALS.include?(status)
+
+            [status, outcome.details[:error_code]].compact.join(' ')
+          end
+
+          def principal_label(subject)
+            subject.respond_to?(:id) ? "#{subject.class}(#{subject.id})" : subject.inspect
+          end
+
+          def arguments_for(verb, params)
+            return normalize(params) unless params.equal?(EXAMPLE)
+
+            normalize(verb.example_params || {})
+          end
+
+          def params_provenance(verb, params)
+            return '' unless params.equal?(EXAMPLE)
+
+            verb.example_params.nil? ? ' (no arguments)' : ' with its own example_params'
+          end
+
+          # Some routers raise for "no route", others return nil.
+          def recognize(origin, path, http_method)
+            origin.recognize(path, method: http_method)
+          rescue StandardError
+            nil
+          end
+
+          # Schema failures as strings; an origin that validates for itself answers them.
+          def schema_errors(origin, payload, schema, verb, slot)
+            if origin.respond_to?(:schema_errors)
+              return Array(origin.schema_errors(payload, schema: schema, verb: verb.name,
+                                                         kind: verb.kind, slot: slot))
+            end
+
+            JSONSchemer.schema(normalize(schema)).validate(normalize(payload)).map do |error|
+              pointer = error['data_pointer'].to_s
+              "#{pointer.empty? ? '(root)' : pointer}: #{error['error']}"
+            end
+          end
+
+          # The value as a caller receives it, after the JSON round trip.
+          def normalize(value)
+            JSON.parse(JSON.generate([value])).first
+          end
+
+          # An action's single object counts as one row.
+          def rows_of(answer)
+            normalized = normalize(answer)
+            normalized.is_a?(Array) ? normalized : [normalized].compact
+          end
+
+          def summarise_answer(answer)
+            case answer
+            when Array then "#{answer.length} row(s)"
+            when Hash  then "an object with keys #{answer.keys.map(&:to_s).sort.inspect}"
+            when nil   then 'nothing'
+            else answer.class.name
+            end
+          end
+
+          def describe_error(error)
+            parts = ["#{error.class.name}: #{error.message}"]
+            parts << "code=#{error.code}" if error.respond_to?(:code) && error.code
+            parts << "hint: #{error.hint}" if error.respond_to?(:hint) && error.hint
+            parts.join(', ')
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/conformance/checks/principal_scope.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module TestHelpers
+    module Conformance
+      module Checks
+        # No row `as:` sees reaches `and_not:`, compared whole-row. An empty first
+        # answer fails (no positive control), and so does a `published` verb.
+        module PrincipalScope
+          extend Helpers
+
+          # What each principal saw. `refused` is the scoping refusal, or nil.
+          Sighting = Data.define(:verb, :as, :and_not, :own, :other, :refused)
+
+          module_function
+
+          def call(origin, name, as:, and_not:, params:)
+            verb = find_verb(origin, name)
+            return verb if verb.is_a?(Outcome)
+            return published(verb) if verb.reach == 'published'
+
+            compare(origin, verb, arguments_for(verb, params), as, and_not)
+          end
+
+          def compare(origin, verb, arguments, as, and_not)
+            mine = Checks.executes(origin, verb.name, params: arguments, as: as)
+            return mine if mine.failed?
+
+            theirs  = Checks.executes(origin, verb.name, params: arguments, as: and_not)
+            refused = refusal_status(theirs)
+            return theirs if theirs.failed? && refused.nil?
+
+            other = refused ? [] : rows_of(theirs.details[:answer])
+            verdict(Sighting.new(verb: verb, as: as, and_not: and_not,
+                                 own: rows_of(mine.details[:answer]), other: other, refused: refused))
+          end
+
+          def verdict(sighting)
+            return nothing_own(sighting) if sighting.own.empty?
+
+            leaked = sighting.own & sighting.other
+            leaked.empty? ? scoped(sighting) : leak(sighting, leaked)
+          end
+
+          def published(verb)
+            Conformance.fail(
+              :principal_scope, subject: verb.name,
+                                message: "#{verb} declares `reach: :published`, which says every authenticated " \
+                                         'caller sees the same rows. Asserting that two principals see different ' \
+                                         'rows asserts the opposite of the descriptor — assert the descriptor, or ' \
+                                         'narrow the reach.',
+                                details: { verb: verb.name, reach: verb.reach }
+            )
+          end
+
+          def nothing_own(sighting)
+            verb = sighting.verb
+            Conformance.fail(
+              :principal_scope, subject: verb.name,
+                                message: "#{verb} answered #{principal_label(sighting.as)} with nothing, so there is nothing for " \
+                                         "#{principal_label(sighting.and_not)} to be scoped out of. Seed a row that belongs to the " \
+                                         'first principal — a scoping assertion with no positive control passes ' \
+                                         'on a verb that answers everybody with nothing.',
+                                details: { verb: verb.name, reach: verb.reach, own: sighting.own, other: sighting.other }
+            )
+          end
+
+          def scoped(sighting)
+            verb = sighting.verb
+            Conformance.pass(
+              :principal_scope, subject: verb.name,
+                                message: sighting.refused ? refused_message(sighting) : narrowed_message(sighting),
+                                details: { verb: verb.name, reach: verb.reach, own: sighting.own,
+                                           other: sighting.other, refused: sighting.refused }
+            )
+          end
+
+          def refused_message(sighting)
+            "#{sighting.verb} answered #{principal_label(sighting.as)} with #{sighting.own.length} row(s) and REFUSED " \
+              "#{principal_label(sighting.and_not)} outright (#{sighting.refused}), which is the strongest " \
+              "spelling of reach: :#{sighting.verb.reach}"
+          end
+
+          def narrowed_message(sighting)
+            "#{sighting.verb} answered #{principal_label(sighting.as)} with #{sighting.own.length} row(s), none of " \
+              "which reached #{principal_label(sighting.and_not)} (declared reach: #{sighting.verb.reach})"
+          end
+
+          def leak(sighting, rows)
+            verb = sighting.verb
+            Conformance.fail(
+              :principal_scope, subject: verb.name,
+                                message: "#{verb} is declared `reach: :#{verb.reach}` but leaked #{rows.length} " \
+                                         "row(s) belonging to #{principal_label(sighting.as)} into " \
+                                         "#{principal_label(sighting.and_not)}'s answer: " \
+                                         "#{rows.first(3).inspect}. Scope the handler to the calling principal.",
+                                details: { verb: verb.name, reach: verb.reach, leaked: rows }
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/conformance/checks/routes.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module TestHelpers
+    module Conformance
+      module Checks
+        # Every declared verb is routed under its own name to the action that answers it.
+        module Routes
+          extend Helpers
+
+          module_function
+
+          def call(origin)
+            verbs = origin.verbs
+            return no_verbs if verbs.empty?
+
+            mount    = origin.mount_path.to_s.chomp('/')
+            problems = verbs.flat_map { |verb| problems_for(origin, verb, mount) }
+            problems.empty? ? routed(verbs, mount) : unrouted(verbs, mount, problems)
+          end
+
+          def no_verbs
+            Conformance.fail(
+              :routes,
+              message: 'this origin declares no verbs at all, so there is nothing to route. ' \
+                       'Either app/controllers/kiosk holds no handler controller, ' \
+                       'or the registry was read before the engine populated it — build the ' \
+                       'origin inside the example, not at file load.'
+            )
+          end
+
+          def routed(verbs, mount)
+            Conformance.pass(
+              :routes,
+              message: "all #{verbs.length} declared verbs are routed under #{mount}/ " \
+                       'with the method their kind requires',
+              details: { verbs: verbs.map(&:name), mount_path: mount }
+            )
+          end
+
+          def unrouted(verbs, mount, problems)
+            Conformance.fail(
+              :routes,
+              message: "#{problems.length} of this origin's #{verbs.length} declared verbs are " \
+                       "not routed as their kind requires:\n  - #{problems.join("\n  - ")}",
+              details: { problems: problems, verbs: verbs.map(&:name), mount_path: mount }
+            )
+          end
+
+          def problems_for(origin, verb, mount)
+            path  = "#{mount}/#{verb.name}"
+            found = recognize(origin, path, verb.http_method)
+            return [not_routed(verb, path)] if found.nil?
+
+            [wrong_endpoint(verb, path, found), wrong_name(verb, path, found),
+             other_method(origin, verb, path)].compact
+          end
+
+          def not_routed(verb, path)
+            "#{verb}: nothing answers #{verb.http_method} #{path} — declared and " \
+              'never routed, which is a 404 to every caller'
+          end
+
+          def wrong_endpoint(verb, path, found)
+            endpoint = "#{found[:controller]}##{found[:action]}"
+            return if endpoint == verb.endpoint
+
+            "#{verb}: #{verb.http_method} #{path} reaches #{endpoint}, not " \
+              "#{verb.endpoint} — a route drawn straight at a handler answers " \
+              '404 to every caller; name the verb in the `kiosk` block'
+          end
+
+          def wrong_name(verb, path, found)
+            routed_name = found[:kiosk_verb].to_s
+            return if routed_name == verb.name
+
+            "#{verb}: #{verb.http_method} #{path} hands the wire " \
+              "kiosk_verb: #{routed_name.inspect} — the path segment and the " \
+              '`defaults:` are two spellings of one name and must match'
+          end
+
+          def other_method(origin, verb, path)
+            other = recognize(origin, path, verb.other_http_method)
+            return unless other && other[:kiosk_verb].to_s == verb.name
+
+            "#{verb}: #{path} also reaches the verb on " \
+              "#{verb.other_http_method} — the method follows the kind, so a " \
+              "#{verb.kind} answers #{verb.http_method} and nothing else"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/conformance/checks.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'kiosk/test_helpers/conformance/outcome'
+require 'kiosk/test_helpers/conformance/verb'
+require 'kiosk/test_helpers/conformance/checks/helpers'
+require 'kiosk/test_helpers/conformance/checks/routes'
+require 'kiosk/test_helpers/conformance/checks/executes'
+require 'kiosk/test_helpers/conformance/checks/declared_shape'
+require 'kiosk/test_helpers/conformance/checks/principal_scope'
+
+module Kiosk
+  module TestHelpers
+    module Conformance
+      # The four conformance checks, as pure functions of an origin returning an
+      # {Outcome}; the Minitest and RSpec adapters render its message verbatim.
+      module Checks
+        module_function
+
+        # Every declared verb is routed under its own name to the action that
+        # answers it, GET for a query and POST for an action. No verbs at all fails.
+        def routes(origin)
+          Routes.call(origin)
+        end
+
+        # Called with these arguments as this principal, the verb answers rather than refusing.
+        def executes(origin, name, params: EXAMPLE, as: nil)
+          Executes.call(origin, name, params: params, as: as)
+        end
+
+        # The arguments satisfy the verb's input_schema and its answer satisfies
+        # its output_schema; the two failures are reported separately.
+        def declared_shape(origin, name, params: EXAMPLE, as: nil)
+          DeclaredShape.call(origin, name, params: params, as: as)
+        end
+
+        # No row `as:` sees reaches `and_not:`, compared whole-row. An empty first
+        # answer fails, because a scoping assertion with no positive control passes
+        # on a verb that answers everybody with nothing. A `published` verb fails too.
+        def principal_scope(origin, name, as:, and_not:, params: EXAMPLE)
+          PrincipalScope.call(origin, name, as: as, and_not: and_not, params: params)
+        end
+      end
+    end
+  end
+end