kiosk-test-support 0.6.1 → 0.6.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c7eb9fc194090087a2bd0a1b771861d165f3fea55a0fbfd832ba2d1d0037a08
-  data.tar.gz: a862919840551f535559671b236ac98a84dc420e07dba3c706c30d105032b4a8
+  metadata.gz: c1a0b3e7ba79f9c1cf3f0e0ed29b2d9c7ed3deb87eed7deae9e030637d177903
+  data.tar.gz: 9df61c38d3daefdc760b862cdc84e071e049ee0753172dde44877585e9949161
 SHA512:
-  metadata.gz: 49f01347f6643ef9032955d55064c8555000336efa5a507073d29e16cd41e2c12cd851407b59ac4bc74e1c4c9dd6272e0c9cbe75aada517746c4484f8d0783ad
-  data.tar.gz: dbe42526621ccd03a3153db7d2ed4338892915d8b6cd2975478eb4079e8034c7edcbf7a083298f5cab0f3b13e8337bf8cbe3d9a9e935b13ea8cfc53dfa38a622
+  metadata.gz: dc68223d652f7b3363e8368f1651a98b9c9bc3b52ef6f67e46edc752267348df2269790975a21dc9f72cd3066db4ebab33569b812b43ce66562fbfb3c0782f4e
+  data.tar.gz: 1e1d81c8ad29a55264b2d3b4e20a56ea6a27b7b90c0eff079680396158fb863c1f67dec1db3db7fc129edbed2c8191b06fd64bf21b5bb7d6dd0f81b1657eda02

data/CHANGELOG.md

@@ -12,6 +12,119 @@ already written is edited.
 
 ## [Unreleased]
 
+## [0.6.28] — 2026-10-26
+
+- 2026-10-26: Version 0.6.28, the tree cut that matches skill 0.6.28.
+
+## [0.6.27] — 2026-10-26
+
+- 2026-10-26: Version 0.6.27, the tree cut that matches skill 0.6.27.
+## [0.6.26] — 2026-10-26
+
+- 2026-10-26: Version 0.6.26, the tree cut that matches skill 0.6.26.
+## [0.6.25] — 2026-10-26
+
+- 2026-10-26: Version 0.6.25, the tree cut that matches skill 0.6.25.
+- 2026-10-26: The README DSL example seeds, then reads, and says that the assistant helpers call the default mount path `/kiosk`.
+
+## [0.6.24] — 2026-10-26
+
+- 2026-10-26: Version 0.6.24, the tree cut that matches skill 0.6.24.
+
+## [0.6.23] — 2026-10-26
+
+- 2026-10-26: Version 0.6.23, the tree cut that matches skill 0.6.23.
+
+## [0.6.22] — 2026-10-26
+
+- 2026-10-26: Version 0.6.22, the tree cut that matches skill 0.6.22.
+
+## [0.6.21] — 2026-10-26
+
+- 2026-10-26: Version 0.6.21, the tree cut that matches skill 0.6.21.
+
+## [0.6.20] — 2026-10-26
+
+- 2026-10-26: Version 0.6.20, the tree cut that matches skill 0.6.20.
+
+## [0.6.19] — 2026-10-26
+
+- 2026-10-26: Version 0.6.19, the tree cut that matches skill 0.6.19.
+
+## [0.6.18] — 2026-10-25
+
+- 2026-10-25: Version 0.6.18, the tree cut that matches skill 0.6.18.
+- 2026-10-25: The gem description and README say that the helpers solve proof-of-work tolls.
+
+## [0.6.17] — 2026-10-25
+
+- 2026-10-25: Version 0.6.17, the tree cut that matches skill 0.6.17.
+
+## [0.6.16] — 2026-10-25
+
+- 2026-10-25: Version 0.6.16, the tree cut that matches skill 0.6.16.
+- `SeededDatabase` empties every table on the search path but Rails' own two.
+
+## [0.6.15] — 2026-10-25
+
+- 2026-10-25: Version 0.6.15, the tree cut that matches skill 0.6.15.
+
+- 2026-10-25: `Kiosk::TestHelpers::SkillPin` (Minitest and RSpec): fails when kiosk-server gives a skill that `skill_sha256` is not the digest of, and tells how to make the new digest.
+
+## [0.6.14] — 2026-10-25
+
+- 2026-10-25: Version 0.6.14, the tree cut that matches skill 0.6.14.
+
+## [0.6.13] — 2026-10-25
+
+- 2026-10-25: Version 0.6.13, the tree cut that matches skill 0.6.13.
+
+## [0.6.12] — 2026-10-24
+
+- 2026-10-24: Version 0.6.12, the tree cut that matches skill 0.6.12.
+
+- 2026-10-24: The KYC stand-in replaces `c.kyc_provider` only, and keeps the audience of the provider it stands in for.
+
+## [0.6.11] — 2026-10-24
+
+- 2026-10-24: Version 0.6.11, the tree cut that matches skill 0.6.11.
+
+## [0.6.10] — 2026-10-23
+
+- 2026-10-23: Version 0.6.10, the tree cut that matches skill 0.6.10.
+
+## [0.6.9] — 2026-10-23
+
+- 2026-10-23: Version 0.6.9, the tree cut that matches skill 0.6.9.
+
+## [0.6.8] — 2026-10-22
+
+- 2026-10-22: Version 0.6.8, the tree cut that matches skill 0.6.8.
+
+## [0.6.7] — 2026-10-22
+
+- 2026-10-22: Version 0.6.7, the tree cut that matches skill 0.6.7.
+
+## [0.6.6] — 2026-10-22
+
+- 2026-10-22: Version 0.6.6, the tree cut that matches skill 0.6.6.
+
+## [0.6.5] — 2026-10-22
+
+- 2026-10-22: Version 0.6.5, the tree cut that matches skill 0.6.5.
+
+## [0.6.4] — 2026-10-22
+
+- 2026-10-22: Version 0.6.4, the tree cut that matches skill 0.6.4.
+
+## [0.6.3] — 2026-10-22
+
+- 2026-10-22: Version 0.6.3, the tree cut that matches skill 0.6.3.
+
+## [0.6.2] — 2026-10-22
+
+- 2026-10-22: Version 0.6.2, the tree cut that matches skill 0.6.2.
+
 ## [0.6.1] — 2026-10-22
 
 - 2026-10-22: Version 0.6.1, the tree cut that matches skill 0.6.1.

data/README.md

@@ -4,54 +4,57 @@ Test helpers for [Kiosk](https://kiosk.tech) origins, and the journey-test DSL o
 
 ## What it does
 
-- `Kiosk::TestHelpers::Assistant` — registers, pays tolls, queries, runs actions, pays and listens for events against an origin, as an AI assistant does.
-- `Kiosk::TestHelpers::Wire` — the same transport without a principal: any method, any path, any headers.
+- `Kiosk::TestHelpers::Assistant` — registers, solves tolls, queries, runs actions, pays and listens for events against an origin, as an AI assistant does.
+- `Kiosk::TestHelpers::Wire` — the same transport without an assistant's credential: any method, any path, any headers.
 - `Kiosk::StoryTest` / `Kiosk::TestHelpers::Story` — a test told as a business story by customers' assistants and the people on the operator's site.
 - `Kiosk::TestHelpers::Kyc` — stands in for the operator's KYC provider, so a test decides how an identity check ends.
 - `Kiosk::TestHelpers::StripeMock` — starts a local stripe-mock that answers a confirmed charge as paid.
 - `Kiosk::TestHelpers::LiveServer` — serves the app over HTTP from the test process and gives the test an assistant for it.
 - `Kiosk::TestHelpers::SeededDatabase` — each test starts from the seeds and leaves the database empty.
 - `Kiosk::TestHelpers::DescriptorExamples` — the examples a served `/kiosk/schema` publishes, each checked against its schema.
+- `Kiosk::TestHelpers::SkillPin` — fails when an update of kiosk-server gives a skill that your `skill_sha256` is not the digest of.
 
 Carries the shared pieces of the Kiosk journey-test DSL: the `Journey` module mixed into RSpec / Minitest tests, the pluggable `executor` contract, a `NullExecutor` for self-tests, and the structured error classes that the framework-specific matchers and assertions look for.
 
 The journey DSL comes with one of the harnesses:
 
-> **Not on RubyGems yet** — so every `gem` line below carries `github: "kiosk-hq/kiosk"`, which is what makes it copy-pasteable today. Publication status and the canonical install are stated once, in the monorepo README's [Install](https://github.com/kiosk-hq/kiosk#install) section.
-
 ```ruby
 group :test do
-  gem "kiosk-rls-rspec", github: "kiosk-hq/kiosk"       # RSpec
+  gem "kiosk-rls-rspec"     # RSpec
   # or
-  gem "kiosk-rls-minitest", github: "kiosk-hq/kiosk"    # Minitest
+  gem "kiosk-rls-minitest"  # Minitest
 end
 ```
 
 Both harnesses pull `kiosk-test-support` as a transitive dependency.
 
-Your bundle brings what the helpers drive: `puma` for `LiveServer` (`rails new` writes it), and `kiosk-pow-equihash` for the solver that pays Equihash tolls. `Wire` solves no other proof of work.
+Your bundle brings what the helpers drive: `puma` for `LiveServer` (`rails new` writes it), and `kiosk-pow-equihash` for the solver that solves Equihash tolls. `Wire` solves no other proof of work.
 
 ## DSL
 
+Each `as_*` scope runs in a transaction that rolls back. `kiosk_seed` writes
+outside the scopes, so a test reads the rows that it seeds. With an `orders`
+table whose policy shows a customer only their own rows (kiosk-rls) and
+`c.enforce_db_role`:
+
 ```ruby
-as_agent_of(alice) do
-  run_action :create_order, items: ["bread"]
-end
+kiosk_seed :orders, owner: alice, item: "bread"
 
-as_user(alice) do
+as_agent_of(alice) do
   expect(query("select item from orders")).to contain_exactly({ item: "bread" })
 end
 
-as_anonymous do
-  expect { query("select * from orders") }.to be_rls_denied
+as_agent_of(bob) do
+  expect(query("select item from orders")).to be_empty
+  expect { query("insert into orders (user_id, item) values ('#{alice.id}', 'tea')") }.to be_rls_denied
 end
 ```
 
 Helpers: `as_agent_of(user, role:)`, `as_user(user, role:)`, `as_agent(name)`, `as_anonymous`, `query(sql)`, `run_query(name, **args)`, `run_action(name, **args)`, `pay_action(name, **args)`, `kiosk_seed(table, count:, owner:, **attrs)`. See the `Kiosk::TestHelpers::Journey` docstrings for full semantics.
 
-## Wiring an executor
+## Configuring an executor
 
-The DSL is inert until you wire an executor. In production-shaped tests you wire `Kiosk::TestHelpers::InProcessExecutor`, which runs against `kiosk-server` in your Rails app:
+The DSL is inert until you configure an executor. In production-shaped tests you configure `Kiosk::TestHelpers::InProcessExecutor`, which runs against `kiosk-server` in your Rails app:
 
 ```ruby
 # spec/spec_helper.rb (RSpec) or test/test_helper.rb (Minitest)
@@ -67,11 +70,11 @@ Kiosk::TestHelpers.executor = Kiosk::TestHelpers::NullExecutor.new.tap do |e|
 end
 ```
 
-The `NullExecutor` is the zero-dependency fallback for unit-shaped tests; production-shaped tests wire `Kiosk::TestHelpers::InProcessExecutor` (above).
+The `NullExecutor` is the zero-dependency fallback for unit-shaped tests; production-shaped tests configure `Kiosk::TestHelpers::InProcessExecutor` (above).
 
-## Driving the wire as an assistant
+## Driving the protocol as an assistant
 
-`Kiosk::TestHelpers::Assistant` registers its key as an OAuth client and gets DPoP-bound tokens, pays proof-of-work tolls, queries, runs, pays with closed AP2 mandates (SD-JWT) and listens on `<endpoint>/events`, against any origin — a test's own live server or a deployment:
+`Kiosk::TestHelpers::Assistant` registers its key as an OAuth client and gets DPoP-bound tokens, solves proof-of-work tolls, queries, runs, pays with closed AP2 mandates (SD-JWT) and listens on `/kiosk/events`. It calls the `/kiosk/...` paths, so it works against an origin that mounts the engine at the default path `/kiosk` — a test's own live server or a deployment. `Person` and the events client call the same paths:
 
 ```ruby
 require "kiosk/test_helpers/assistant"
@@ -83,7 +86,7 @@ events.subscribe("kyc_verification")
 assistant.run(rider, name: "reserve", scooter_code: "SK-001")
 ```
 
-Every answer carries its status, parsed body and headers. `Kiosk::TestHelpers::Wire` is the same transport without a principal: any method, any path, any headers.
+Every answer carries its status, parsed body and headers. `Kiosk::TestHelpers::Wire` is the same transport without an assistant's credential: any method, any path, any headers.
 
 ## Telling a business story
 
@@ -105,7 +108,7 @@ end
 
 - `a_customer(as:)` registers an assistant; `a_newcomer(as:)` registers a key and acts for no person yet; `published(path)` reads what the origin shows anyone.
 - `Customer#asks` and `#does` answer an `Answer` (`ok?`, `refused?(code)`, `detail`, `hint`, `rows`, `header`, `tolls_paid`, `solved_toll`, `next_page`); `asks(…, unpaid: true)` or `asks(…, proofs: […])` leaves the toll to the story.
-- `Kiosk::StoryTest#assert_refused(answer, code)` asserts the wire refused the `Answer` with `code`.
+- `Kiosk::StoryTest#assert_refused(answer, code)` asserts the protocol refused the `Answer` with `code`.
 - `Customer#sets_up_payment` and `#requests_verification` run the engine's `payment_setup` and `request_kyc`, and `#hears_verification_passed` waits for the outcome of the check it asked for last; `#pays(checkout_jwt)` signs the two closed AP2 mandates for the checkout an action answered, unchanged, and pays; on `payment_setup_required` it calls `payment_setup` and pays once more.
 - `Customer#account`, `#role` and `#claims` read its credential; `#signs_back_in` and `#with_a_fresh_credential` ask the token endpoint for a new token; `#redeems(link_code)`, `#asks_to_be_linked`, `#polls` and `#collects` are the linking ceremonies.
 - `Customer#listens_for`, `#follows(*topics, subject:, since:)` and `#hears(topic, about:, on:, **data)` read the event stream, holding each heard payload to the schema the origin publishes for its topic.
@@ -113,7 +116,7 @@ end
 
 ## Identity checks in tests
 
-A real identity check is a human showing documents to a provider; a test cannot do that, so `Kiosk::TestHelpers::Kyc` stands in for the operator's KYC provider for the length of each test and the test says how the check ends. The engine receives the provider's callback and runs the operator's code exactly as it would in production:
+A real identity check is a human showing documents to a KYC provider; a test cannot do that, so `Kiosk::TestHelpers::Kyc` stands in for the operator's KYC provider for the length of each test and the test says how the check ends. The engine receives the provider's callback and runs the operator's code exactly as it would in production:
 
 ```ruby
 require "kiosk/test_helpers/kyc"
@@ -130,13 +133,53 @@ class LicenceStory < Kiosk::StoryTest   # or an RSpec group including Kiosk::Tes
 end
 ```
 
-`kyc_attestation(principal, **attributes)` signs an attestation an assistant submits to `POST <endpoint>/agents/kyc`. A check the human refuses sends nothing, so there is no helper for it.
+`kyc_attestation(principal, **attributes)` signs an attestation an assistant submits to `POST /kiosk/agents/kyc`. A check the human refuses sends nothing, so there is no helper for it.
 
 `Kiosk::TestHelpers::StripeMock.start` fronts a local [stripe-mock](https://github.com/stripe/stripe-mock) that answers a confirmed charge as paid. stripe-mock lists a saved card for every Customer, so once `payment_setup` has mapped one, `pay` settles.
 
+## The skill pin
+
+kiosk-server gives the URL of the skill that AI assistants read, and each kiosk-server release gives the skill of its own version. You set `skill_sha256`, the SHA-256 of that file, in `config/initializers/kiosk.rb`. This command downloads the file from kiosk.tech and calculates the digest:
+
+```bash
+curl -fsS "$(bin/rails runner 'puts Kiosk.configuration.skill_url')" | shasum -a 256
+```
+
+```ruby
+c.skill_sha256 = "<the 64 hexadecimal characters that the command prints>"
+```
+
+Then add a test that names the skill version of that digest: `X.Y.Z` from `skill-vX.Y.Z.md`. Minitest:
+
+```ruby
+require "kiosk/test_helpers/skill_pin"
+
+class KioskSkillPinTest < ActiveSupport::TestCase
+  include Kiosk::TestHelpers::SkillPin::Assertions
+
+  test "skill_sha256 is the digest of the skill that kiosk-server gives" do
+    assert_kiosk_skill_pin hashed_version: "X.Y.Z"
+  end
+end
+```
+
+RSpec:
+
+```ruby
+require "kiosk/test_helpers/skill_pin/rspec"
+
+RSpec.describe "the skill pin" do
+  it "is the digest of the skill that kiosk-server gives" do
+    expect(Kiosk.configuration).to pin_the_served_skill(hashed_version: "X.Y.Z")
+  end
+end
+```
+
+After an update of kiosk-server to a release with a different skill, the test fails. Its message gives the URL of the new skill, the command that calculates its SHA-256, and the two lines to change. The test also fails when your configuration sets `skill_url`: kiosk-server gives it.
+
 ## Status
 
-Pre-v1.0 alpha. The Journey DSL surface is stable across pre-v1.0 minor bumps; the executor contract may still evolve pre-v1.0 (`Kiosk::TestHelpers::InProcessExecutor` implements it today).
+Pre-v1.0 alpha: the Journey DSL and the executor contract may change between releases. `Kiosk::TestHelpers::InProcessExecutor` implements the contract.
 
 ## License
 

data/lib/kiosk/story_test.rb

@@ -8,7 +8,7 @@ module Kiosk
   class StoryTest < ActiveSupport::TestCase
     include TestHelpers::Story
 
-    # Asserts the wire refused `response` with `code`.
+    # Asserts the protocol refused `response` with `code`.
     def assert_refused(response, code)
       assert response.refused?(code), "expected a #{code} refusal, got #{response}"
     end

data/lib/kiosk/test_helpers/assistant.rb

@@ -11,7 +11,7 @@ require 'kiosk/test_helpers/assistant/events'
 
 module Kiosk
   module TestHelpers
-    # An assistant on the wire: registers its key as an OAuth client, then
+    # An assistant over HTTP: registers its key as an OAuth client, then
     # queries, runs and pays as the principal its token names, paying every
     # proof-of-work toll it is asked for.
     #
@@ -87,7 +87,7 @@ module Kiosk
         wire.post('/kiosk/agents/kyc', { kyc_jws: attestation_jws }, credential(principal))
       end
 
-      # `pay_tolls: false` answers a proof-of-work toll instead of paying it.
+      # `pay_tolls: false` answers a proof-of-work toll instead of solving it.
       def query(principal, name:, headers: {}, pay_tolls: true, **params)
         (pay_tolls ? wire : unpaid).get("/kiosk/#{name}", params, credential(principal).merge(headers))
       end
@@ -160,7 +160,7 @@ module Kiosk
 
       def unpaid = Wire.new(base_url:)
 
-      # The principal's token and key, which the wire signs a DPoP proof with.
+      # The principal's token and key, which the protocol signs a DPoP proof with.
       def credential(principal) = wire.dpop(principal.token, principal.key)
 
       def setup_required?(answer)

data/lib/kiosk/test_helpers/conformance/checks/routes.rb

@@ -74,7 +74,7 @@ module Kiosk
             routed_name = found[:kiosk_verb].to_s
             return if routed_name == verb.name
 
-            "#{verb}: #{verb.http_method} #{path} hands the wire " \
+            "#{verb}: #{verb.http_method} #{path} hands the engine " \
               "kiosk_verb: #{routed_name.inspect} — the path segment and the " \
               '`defaults:` are two spellings of one name and must match'
           end

data/lib/kiosk/test_helpers/conformance/in_process_origin.rb

@@ -45,7 +45,7 @@ module Kiosk
           @wire.call(name, kind: kind, params: params, identity: identity_for(as))
         end
 
-        # Uses the wire's own validators, so a query's reserved `limit`/`cursor` pass as they do on the wire.
+        # Uses the protocol's own validators, so a query's reserved `limit`/`cursor` pass as they do in the protocol.
         def schema_errors(payload, schema:, verb:, kind:, slot:)
           if slot.to_s == 'input_schema'
             Kiosk::Server::RequestValidation.validate_arguments!(payload, input_schema: schema, verb: verb,

data/lib/kiosk/test_helpers/customer.rb

@@ -25,7 +25,7 @@ module Kiosk
       # How many proofs of work the assistant solved to be answered.
       def tolls_paid = @response.proofs
 
-      # The proofs of work that pay the toll this refusal demands.
+      # The proofs of work that solve the toll this refusal demands.
       def solved_toll = Wire.solve(self['challenges'])
 
       # The `Link` target with `rel="next"`: the rest of a truncated list.
@@ -50,7 +50,7 @@ module Kiosk
 
       def origin = @assistant.base_url
 
-      # Pays any proof-of-work toll asked for, unless `unpaid:` or carrying its own `proofs:`.
+      # Solves any proof-of-work toll asked for, unless `unpaid:` or carrying its own `proofs:`.
       def asks(query, headers: {}, unpaid: false, proofs: nil, **params)
         headers = headers.merge('Kiosk-PoW' => JSON.generate(proofs)) if proofs
         Answer.new(@assistant.query(principal, name: query.to_s, headers:, pay_tolls: !(unpaid || proofs), **params))

data/lib/kiosk/test_helpers/errors.rb

@@ -13,7 +13,7 @@ module Kiosk
         DEFAULT_MESSAGE = <<~MSG.strip
           Kiosk::TestHelpers has no executor configured.
 
-          Wire one in your test helper:
+          Configure one in your test helper:
 
             # spec/spec_helper.rb or test/test_helper.rb
             require "kiosk/test_helpers/in_process_executor"
@@ -33,7 +33,7 @@ module Kiosk
         DEFAULT_MESSAGE = <<~MSG.strip
           Kiosk::TestHelpers::Conformance has no origin configured.
 
-          Wire one in your test helper:
+          Configure one in your test helper:
 
             # spec/spec_helper.rb or test/test_helper.rb
             require "kiosk/test_helpers/conformance/in_process_origin"

data/lib/kiosk/test_helpers/in_process_wire.rb

@@ -15,7 +15,7 @@ module Kiosk
   module TestHelpers
     # Calls a verb of the booted app through its route, in this process, as an
     # assistant does: one linked to the principal's account, as a person links
-    # one, and paying any proof-of-work toll. A caller with no identity sends no
+    # one, and solving any proof-of-work toll. A caller with no identity sends no
     # token.
     class InProcessWire
       # `app` defaults to the Rails application, middleware included.
@@ -23,7 +23,7 @@ module Kiosk
         @app = app
       end
 
-      # The verb's answer, or the wire error its refusal names.
+      # The verb's answer, or the Kiosk error its refusal names.
       def call(name, kind:, params:, identity:)
         credential = credential_for(identity) if identity
         response   = request(name, kind, params, credential)
@@ -63,7 +63,7 @@ module Kiosk
         Wire::DpopCredential.new(token:, key:)
       end
 
-      # Registers the key as a client, and pays the registration toll if the origin asks for one.
+      # Registers the key as a client, and solves the registration toll if the origin asks for one.
       def register(key)
         metadata = { 'jwks' => { 'keys' => [Kiosk::Server::AssistantKey.to_jwk(key)] } }
         Kiosk::Server::ClientRegistration.call(metadata)

data/lib/kiosk/test_helpers/kyc.rb

@@ -17,21 +17,23 @@ module Kiosk
     #   rider.requests_verification
     #   the_verification_service_confirms(rider, age_over_18: true)
     module Kyc
-      ISSUER   = 'https://kyc.test.invalid'
-      SETTINGS = %i[kyc_provider kyc_issuer kyc_public_key].freeze
+      ISSUER = 'https://kyc.test.invalid'
 
-      # Opens checks without a network and signs attestations for them.
+      # Opens checks without a network and signs attestations for them, for
+      # the audience of the provider it stands in for.
       class Provider < Kiosk::KycProviders::Base
         Check = Data.define(:subject, :audience, :nonce, :callback_url)
 
         def self.key = @key ||= OpenSSL::PKey.generate_key('ED25519')
 
-        def initialize
-          super
+        def initialize(audience:)
+          super(issuer: ISSUER, public_key: self.class.key, audience:)
           @checks = {}
         end
 
-        def open_verification(subject:, audience:, callback_url:, **)
+        def opens_verifications? = true
+
+        def open_verification(subject:, callback_url:, **)
           request_id = SecureRandom.uuid
           @checks[request_id] = Check.new(subject:, audience:, nonce: SecureRandom.hex(16), callback_url:)
           { request_id:, nonce: @checks[request_id].nonce, verification_url: "#{ISSUER}/verify?request=#{request_id}" }
@@ -72,7 +74,7 @@ module Kiosk
       # An attestation the provider signed for this principal, as an assistant
       # submits it to `POST <endpoint>/agents/kyc`.
       def kyc_attestation(principal, **attributes)
-        @kyc_provider.attest(principal.user_id, Kiosk.configuration.kyc_audience, attributes)
+        @kyc_provider.attest(principal.user_id, @kyc_provider.audience, attributes)
       end
 
       private
@@ -83,15 +85,13 @@ module Kiosk
 
       def stand_in_for_kyc_provider
         config = Kiosk.configuration
-        @replaced_kyc_settings = SETTINGS.to_h { [it, config.public_send(it)] }
-        @kyc_provider = Provider.new
-        config.kyc_provider   = @kyc_provider
-        config.kyc_issuer     = ISSUER
-        config.kyc_public_key = Provider.key
+        @replaced_kyc_provider = config.kyc_provider
+        @kyc_provider = Provider.new(audience: @replaced_kyc_provider&.audience)
+        config.kyc_provider = @kyc_provider
       end
 
       def restore_kyc_provider
-        @replaced_kyc_settings&.each { |setting, value| Kiosk.configuration.public_send(:"#{setting}=", value) }
+        Kiosk.configuration.kyc_provider = @replaced_kyc_provider if @kyc_provider
       end
     end
   end

data/lib/kiosk/test_helpers/live_server.rb

@@ -22,19 +22,16 @@ module Kiosk
         base.teardown { SeededDatabase.empty }
       end
 
+      # Every table on the search path but Rails' own two.
       def self.empty
         connection = ActiveRecord::Base.connection
-        schemas = ActiveRecord.dump_schemas.split(',').map { connection.quote(it.strip) }.join(', ')
-        tables = connection.select_values(<<~SQL)
-          SELECT format('%I.%I', schemaname, tablename) FROM pg_tables
-          WHERE schemaname IN (#{schemas}) AND tablename NOT IN ('schema_migrations', 'ar_internal_metadata')
-        SQL
-        connection.execute("TRUNCATE #{tables.join(', ')} RESTART IDENTITY CASCADE") if tables.any?
+        tables = connection.tables - %w[schema_migrations ar_internal_metadata]
+        connection.execute("TRUNCATE #{tables.map { connection.quote_table_name(it) }.join(', ')} RESTART IDENTITY CASCADE") if tables.any?
       end
     end
 
     # Serves the app over HTTP from the test process, on a free port that
-    # becomes the origin's issuer, so a test drives the wire as an assistant does.
+    # becomes the origin's issuer, so a test drives the protocol as an assistant does.
     module LiveServer
       def self.included(base)
         base.include SeededDatabase

data/lib/kiosk/test_helpers/skill_pin/rspec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'rspec/expectations'
+
+require 'kiosk/test_helpers/skill_pin'
+
+# `expect(Kiosk.configuration).to pin_the_served_skill(hashed_version: '0.6.28')`
+# The matcher DSL gives the keywords to the block as one Hash.
+RSpec::Matchers.define :pin_the_served_skill do |options|
+  match do |configuration|
+    @problem = Kiosk::TestHelpers::SkillPin.problem(hashed_version: options.fetch(:hashed_version), configuration:)
+    @problem.nil?
+  end
+
+  failure_message { @problem }
+  description { 'pin the SHA-256 of the skill that kiosk-server gives' }
+end

data/lib/kiosk/test_helpers/skill_pin.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'kiosk/server'
+
+module Kiosk
+  module TestHelpers
+    # Checks the skill pin of an origin. kiosk-server gives the skill URL, and
+    # each kiosk-server release gives the URL of a new skill version. The
+    # operator sets `skill_sha256`, the SHA-256 of that file, and tells this
+    # check the skill version that the digest is for. When an update of
+    # kiosk-server moves the skill to a different version, the check fails and
+    # tells the operator how to make the new digest.
+    module SkillPin
+      VERSION_IN_URL = /skill-v(\d+\.\d+\.\d+)\.md\z/
+      SHA256 = /\A\h{64}\z/
+
+      module_function
+
+      # nil when the pin is correct. Otherwise, what is wrong and what to do.
+      def problem(hashed_version:, configuration: Kiosk.configuration)
+        served = Kiosk::Configuration.new.skill_url
+        version = served[VERSION_IN_URL, 1]
+        return override(configuration.skill_url, served) unless configuration.skill_url == served
+        return if hashed_version == version && configuration.skill_sha256.to_s.match?(SHA256)
+
+        stale(served, version, hashed_version, configuration.skill_sha256)
+      end
+
+      def override(configured, served)
+        "The configuration sets skill_url to #{configured}. kiosk-server gives the skill URL " \
+          "(#{served}). Remove the line `c.skill_url = ...` from your configuration."
+      end
+
+      def stale(url, version, hashed_version, sha256)
+        <<~MESSAGE
+          #{cause(version, hashed_version, sha256)}
+          Do these steps:
+          1. Download the skill #{version} from kiosk.tech and calculate its SHA-256:
+               curl -fsS #{url} | shasum -a 256
+          2. Set `c.skill_sha256` in config/initializers/kiosk.rb to that digest.
+          3. Set `hashed_version: '#{version}'` in this test.
+        MESSAGE
+      end
+
+      def cause(version, hashed_version, sha256)
+        if hashed_version != version
+          "kiosk-server gives the skill #{version}, but skill_sha256 is the digest of the skill #{hashed_version}."
+        elsif sha256.nil?
+          "kiosk-server gives the skill #{version}, and skill_sha256 is not set."
+        else
+          "skill_sha256 is not a SHA-256 digest (64 hexadecimal characters): #{sha256.inspect}."
+        end
+      end
+
+      # The Minitest assertion:
+      #   include Kiosk::TestHelpers::SkillPin::Assertions
+      #   assert_kiosk_skill_pin hashed_version: '0.6.28'
+      module Assertions
+        def assert_kiosk_skill_pin(hashed_version:)
+          problem = SkillPin.problem(hashed_version:)
+          assert(problem.nil?, problem)
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/test_helpers/version.rb

@@ -2,6 +2,6 @@
 
 module Kiosk
   module TestHelpers
-    VERSION = '0.6.1'
+    VERSION = '0.6.28'
   end
 end

data/lib/kiosk/test_helpers/wire.rb

@@ -20,7 +20,7 @@ module Kiosk
 
         def [](header) = headers[header.to_s.downcase]
 
-        # Whether the client paid a proof-of-work toll and sent the request again.
+        # Whether the client solved a proof-of-work toll and sent the request again.
         def pow_retried? = proofs.positive?
       end
 
@@ -43,7 +43,7 @@ module Kiosk
         http
       end
 
-      # An access token and the key it is bound to. As a header value, the wire
+      # An access token and the key it is bound to. As a header value, the protocol
       # sends it as `Authorization: DPoP <token>` with a proof for that request;
       # with no token, as the proof alone (a token request).
       DpopCredential = Data.define(:token, :key)
@@ -95,7 +95,7 @@ module Kiosk
         uri
       end
 
-      # The proof-of-work challenges of a toll this client pays, or nil.
+      # The proof-of-work challenges of a toll this client solves, or nil.
       def toll_challenges(answer)
         return unless @pay_tolls && answer.status == 402 && answer.body.is_a?(Hash)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiosk-test-support
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.28
 platform: ruby
 authors:
 - Phil Pirozhkov
@@ -122,11 +122,11 @@ description: |
   `run_query`, `run_action`, `pay_action`, `kiosk_seed`), the pluggable
   executor contract, a NullExecutor for self-tests, and the structured
   error classes (`RLSDenied`, `QuotaExceeded`, `ExecutorNotConfigured`).
-  It is wired into RSpec by `kiosk-rls-rspec` and into Minitest by
+  It is connected to RSpec by `kiosk-rls-rspec` and into Minitest by
   `kiosk-rls-minitest`.
 
   The ASSISTANT drives an origin over HTTP as an assistant does: it
-  registers, pays proof-of-work tolls, queries, runs, pays with signed
+  registers, solves proof-of-work tolls, queries, runs, pays with signed
   mandates and listens on the event stream. `Kyc` stands in for the
   operator's KYC provider, and `StripeMock` fronts a local stripe-mock.
 
@@ -176,6 +176,8 @@ files:
 - lib/kiosk/test_helpers/null_executor.rb
 - lib/kiosk/test_helpers/person.rb
 - lib/kiosk/test_helpers/pow_solver.rb
+- lib/kiosk/test_helpers/skill_pin.rb
+- lib/kiosk/test_helpers/skill_pin/rspec.rb
 - lib/kiosk/test_helpers/small_equihash.rb
 - lib/kiosk/test_helpers/story.rb
 - lib/kiosk/test_helpers/stripe_mock.rb