kiosk-user-idp-devise 0.5.20

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: eaa5961003f556d23c16fae8b4715be095b5b75dcf922a4e45965789c0bfc9e5
+  data.tar.gz: c9ca748caede6c73d2582e2872a98a6e1631a2a4b2211c6dd1a80dc1fd7846c9
+SHA512:
+  metadata.gz: 21e4d2e6b82c2ff6ce89e8a7c201fb8f634c6f9562773a070719d28f39df2a6b8ab38297e27f34875b6d63efce9c51d4a2571b74296096ca07663bc8478c335c
+  data.tar.gz: a79089492e3efec13c759bd13ee2159970ba102aba9dd61289b449282c21a36d825881f400c6836313ab622efdbdccbb2f1a1e6869a6d46c6f43da0e84e7ce58

data/CHANGELOG.md

@@ -0,0 +1,122 @@
+# Changelog
+
+All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/).
+
+How to write an entry, and what a release section means: `CHANGELOG-RULE.md` at
+the root of this repository —
+<https://github.com/kiosk-hq/kiosk/blob/main/CHANGELOG-RULE.md>. In short: under
+200 characters, one or two sentences, the essence rather than the content; write it
+under `## [Unreleased]`; a cut renames that heading to
+`## [MAJOR.MINOR.PATCH] — <date>` and opens a fresh empty one above it; nothing
+already written is edited.
+
+## [Unreleased]
+
+## [0.5.20] — 2026-10-20
+
+- 2026-10-20: Version 0.5.20, the tree cut that matches skill 0.5.20.
+
+## [0.5.19] — 2026-10-20
+
+- 2026-10-19: `DeviseSession` connects to an origin that names an IPv6 literal, such as `http://[::1]:3000`.
+
+## [0.5.18] — 2026-10-18
+
+- 2026-10-18: Version 0.5.18, the tree cut that matches skill 0.5.18.
+
+## [0.5.17] — 2026-10-18
+
+- 2026-10-18: Version 0.5.17, the tree cut that matches skill 0.5.17.
+
+## [0.5.16] — 2026-10-18
+
+- 2026-10-18: `Kiosk::UserIdentityProviders::DeviseSession#sign_out!` is removed.
+## [0.5.15] — 2026-10-18
+
+- The README names the human-side page gate and the link endpoints as the callers of the adapter.
+
+## [0.5.14] — 2026-10-18
+
+- 2026-10-18: Version 0.5.14, the tree cut that matches skill 0.5.14.
+
+- 2026-10-17: `user_id_column` is a setting of this gem, default `:id`; `Kiosk.configure` sets it as before.
+
+## [0.5.13] — 2026-10-11
+
+- 2026-10-11: Version 0.5.13, the tree cut that matches skill 0.5.13.
+
+- `WireSignpost` and `SessionsController` answer a JSON caller at the Devise sign-in and sign-out pages with a pointer to `/.well-known/kiosk.json`, so an operator need not write them.
+
+## [0.5.12] — 2026-10-08
+
+- 2026-10-08: Version 0.5.12, the tree cut that matches skill 0.5.12; this gem's surface is unchanged.
+
+## [0.5.11] — 2026-10-08
+
+- 2026-10-08: Version 0.5.11, the tree cut that matches skill 0.5.11; this gem's surface is unchanged.
+
+## [0.5.10] — 2026-10-08
+
+- 2026-10-08: Version 0.5.10, the tree cut that matches skill 0.5.10; this gem's surface is unchanged.
+
+## [0.5.9] — 2026-10-08
+
+- 2026-10-08: Version 0.5.9, the tree cut that matches skill 0.5.9; this gem's surface is unchanged.
+
+## [0.5.8] — 2026-10-07
+
+- 2026-10-07: Version 0.5.8, the tree cut that matches skill 0.5.8; this gem's surface is unchanged.
+
+## [0.5.7] — 2026-10-07
+
+- 2026-10-07: Version 0.5.7, the tree cut that matches skill 0.5.7; this gem's surface is unchanged.
+
+## [0.5.6] — 2026-10-07
+
+- 2026-10-07: Version 0.5.6, the tree cut that matches skill 0.5.6; this gem's surface is unchanged.
+
+## [0.5.5] — 2026-10-07
+
+- 2026-10-07: Version 0.5.5, the tree cut that matches skill 0.5.5; this gem's surface is unchanged.
+
+## [0.5.4] — 2026-10-07
+
+- 2026-10-07: Version 0.5.4, the tree cut that matches skill 0.5.4; this gem's surface is unchanged.
+
+## [0.5.3] — 2026-10-06
+
+- 2026-10-06: Version 0.5.3, the tree cut that matches skill 0.5.3; this gem's surface is unchanged.
+
+## [0.5.2] — 2026-10-06
+
+- 2026-10-06: Version 0.5.2, the tree cut that matches skill 0.5.2; this gem's surface is unchanged.
+
+## [0.5.0] — 2026-09-26
+
+### Changed
+
+- **`DeviseSession` reads TLS off the target's scheme.** It opened every socket in cleartext, so an `https://` server URL could not be dialled at all.
+
+- README: every `gem` line in the install section now carries `github: "kiosk-hq/kiosk"`, so a copied line resolves before publication; the banner above them states what the block does rather than asking the reader to add it.
+
+### Added
+
+- `Kiosk::UserIdentityProviders::DeviseSession` (`require "kiosk/user_identity_providers/devise_session"`) — the CLIENT end of this adapter. `Devise` reads the Warden user off an incoming request; this drives the shipped Devise form to create the session that read finds: GET `/users/sign_in` for the cookie and the CSRF token, POST the credentials, keep the Set-Cookie. `session: true` is the only knob, and it is opt-in per request so an agent's Bearer call never carries the human's cookies.
+
+- Initial skeleton — `Kiosk::UserIdentityProviders::Devise` extending `Kiosk::UserIdentityProviders::Base`.
+- `#verify(request)` reads the signed-in user from the request's Warden proxy (`request.env["warden"].user` — the shipped wire, where kiosk-server's `IdentityResolution.resolve` passes an `ActionDispatch::Request`) and returns a `Kiosk::Identity` with `actor: "human"`. Returns `nil` when no user is signed in — which covers unauthenticated, locked, and unconfirmed users uniformly since Devise's `active_for_authentication?` already gates the Warden user.
+- Also accepts a controller-shaped object exposing `#current_user`, and a bare Rack `env` Hash carrying `env["warden"]`, for hosts that pass either directly.
+- Role resolution: `user.kiosk_role` if defined, else first of `Kiosk.configuration.roles`. Raises `Kiosk::UserIdentityProviders::Devise::ConfigurationError` with a help-style message when both fall through.
+- Honours `Kiosk.configuration.user_id_column` (default `:id`).
+- Inherits the default `user_active?` from {Kiosk::UserIdentityProviders::Base} — embedded mode relies on Devise's per-request `active_for_authentication?` hook rather than an opt-in callback.
+
+### Design decisions
+
+- **No hard `devise` runtime dependency.** The adapter only reads the request's Warden user (`request.env["warden"].user`); the provider's installed Devise satisfies the requirement. Documenting this in `README.md` is cleaner than forcing a Bundler constraint that doesn't match reality (kiosk-server's `IdentityResolution.resolve` passes an `ActionDispatch::Request` — Devise itself isn't a constructor argument).
+- **No test-time `devise` dependency.** Tests use a stub `current_user`; loading Devise just to verify a one-line read would be ceremony.
+
+### Out of scope for first release
+
+- `Kiosk::HumanContext` cross-channel session mixing.
+- Full Rails controller integration test (needs a host app — lands with kiosk-server's request specs).
+- `kiosk-devise` — the broader Devise integration with kiosk-server's controllers, generators, and approval-form partial.

data/LICENSE.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/README.md

@@ -0,0 +1,105 @@
+# kiosk-user-idp-devise
+
+The Devise user-IdP adapter for [Kiosk](https://kiosk.tech) — for Rails providers that authenticate principals through Devise. Install it explicitly; it is not bundled by `kiosk-all`.
+
+## What it does
+
+Reads the signed-in user from the incoming request's Warden proxy and returns a `Kiosk::Identity` for the human-side surfaces: the device-verify page, the linked-assistants page, and `POST /kiosk/auth/link` and `/kiosk/auth/unlink`. The wire and the event stream never take it; they accept only the assistant's bearer token.
+
+The adapter is **agnostic about how the user logged in**: Devise's `database_authenticatable` and `omniauthable` modules both populate the request's Warden user, so the same read covers password login, passwordless magic-link, and every OmniAuth strategy (Google, GitHub, SAML, …).
+
+**Lockable / confirmable handling is implicit.** Devise's `active_for_authentication?` already gates the Warden user, so a locked or unconfirmed user yields no signed-in user and the request fails as unauthenticated. No extra code in the adapter.
+
+## Install
+
+> **Not on RubyGems yet** — so every `gem` line below carries `github: "kiosk-hq/kiosk"`, which is what makes it copy-pasteable today. Publication status and the canonical install are stated once, in the monorepo README's [Install](https://github.com/kiosk-hq/kiosk#install) section.
+
+Add the adapter explicitly — the `kiosk-all` meta-gem pulls in only `kiosk-core` and `kiosk-server`, so IdP adapters are opt-in per provider:
+
+```ruby
+gem "kiosk-user-idp-devise", github: "kiosk-hq/kiosk"
+```
+
+The adapter declares no hard runtime dependency on `devise` — it only reads the request's Warden user, and your provider's already-installed Devise satisfies the requirement.
+
+## Wire up
+
+```ruby
+# config/initializers/kiosk.rb
+require "kiosk/user_identity_providers/devise"
+
+Kiosk.configure do |c|
+  c.user_idp = Kiosk::UserIdentityProviders::Devise.new
+  c.roles    = %i[customer]
+  # Required whenever `c.roles` is set, and refused at boot without it: the
+  # default role an assistant lands on when nothing else resolves one. Declaring
+  # no roles at all is the other supported shape, and then neither line is set.
+  c.registration_role = :customer
+end
+```
+
+## Pointing assistants at the wire
+
+An assistant that POSTs JSON at the sign-in page, or signs out with no session, gets a JSON body naming `/.well-known/kiosk.json` (`422 invalid_authenticity_token`, `401 not_signed_in`) instead of an empty error. Browsers are answered as before.
+
+```ruby
+class ApplicationController < ActionController::Base
+  include Kiosk::UserIdentityProviders::Devise::WireSignpost
+end
+```
+
+```ruby
+# config/routes.rb
+devise_for :users, controllers: { sessions: "kiosk/user_identity_providers/devise/sessions" }
+```
+
+## Driving the sign-in from a script
+
+An origin wired to this adapter has no stub user-IdP, so anything that needs the HUMAN half of a ceremony — approving an assistant on the device-verify page, minting a link code, unlinking — has to hold a real browser session. `DeviseSession` is that session, and it is the client end of the same contract the adapter above serves:
+
+```ruby
+require "kiosk/user_identity_providers/devise_session"
+
+session = Kiosk::UserIdentityProviders::DeviseSession.new(ENV.fetch("SERVER_URL"))
+session.sign_in!(email: "alice@example.com", password: "…")
+
+rc, link = session.post_json("/kiosk/auth/link", {}, { session: true })
+```
+
+Nothing in it is a test double — it drives the shipped Devise routes over real HTTP exactly as a browser does. `session: true` is the only knob: it marks the calls that are the HUMAN's, so an agent's own Bearer calls never carry the human's cookie jar.
+
+## Role resolution
+
+Each Kiosk token carries exactly one active role. For a Devise-authenticated human:
+
+1. If the user model defines `#kiosk_role`, that wins.
+2. Otherwise, the first symbol in `Kiosk.configuration.roles` is used.
+3. If `roles` is empty AND `#kiosk_role` is absent, `Kiosk::UserIdentityProviders::Devise::ConfigurationError` is raised.
+
+```ruby
+class User < ApplicationRecord
+  devise :database_authenticatable
+
+  # Optional — only if you need per-user role choice.
+  def kiosk_role
+    support_staff? ? :customer_support : :customer
+  end
+end
+```
+
+## Request shape
+
+kiosk-server calls the adapter with an `ActionDispatch::Request` from the human-side page gate and from the link endpoints. The adapter reads the signed-in user from the Warden proxy of that request, `request.env["warden"].user`. Devise sets this proxy when its middleware has run. The adapter also accepts an object that has `#current_user`, such as a controller, and a bare Rack `env` Hash that has `env["warden"]`.
+
+## Status
+
+Pre-v1.0 alpha. API surface stable across pre-v1.0 minor bumps.
+
+## License
+
+Apache-2.0 — see `LICENSE.txt`.
+
+## Links
+
+- [kiosk.tech](https://kiosk.tech)
+- [Issue tracker](https://github.com/kiosk-hq/kiosk/issues)

data/lib/kiosk/user_identity_providers/devise/configuration_extension.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Kiosk
+  module UserIdentityProviders
+    class Devise
+      # The Devise adapter's setting, added to {Kiosk::Configuration}.
+      module ConfigurationExtension
+        # The user model's column that holds the customer's id. Default :id.
+        attr_writer :user_id_column
+
+        def user_id_column
+          @user_id_column ||= :id
+        end
+      end
+    end
+  end
+end
+
+Kiosk::Configuration.include(Kiosk::UserIdentityProviders::Devise::ConfigurationExtension)

data/lib/kiosk/user_identity_providers/devise/sessions_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'kiosk/user_identity_providers/devise/wire_signpost'
+
+module Kiosk
+  module UserIdentityProviders
+    class Devise
+      # Devise's sign-in and sign-out, answering a JSON sign-out with no session
+      # to end with a pointer to the wire. Route it with
+      # `devise_for :users, controllers: { sessions: "kiosk/user_identity_providers/devise/sessions" }`.
+      class SessionsController < ::Devise::SessionsController
+        include WireSignpost
+
+        private
+
+        def respond_to_on_destroy(non_navigational_status: :no_content)
+          return super unless non_navigational_status == :unauthorized && kiosk_json_request?
+
+          render_wire_signpost :unauthorized, 'not_signed_in',
+                               message: 'there is no human web session to end — /users/sign_out closes a ' \
+                                        'browser session on this site, not a Kiosk credential',
+                               hint: 'assistant credentials live on the wire and are dropped there: GET ' \
+                                     "#{request.base_url}/.well-known/kiosk.json for the register/login " \
+                                     'and revoke endpoints'
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/user_identity_providers/devise/version.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# Standalone so the gemspec can read the version without loading kiosk-core.
+module Kiosk
+  module UserIdentityProviders
+    module DeviseVersion
+      VERSION = '0.5.20'
+    end
+  end
+end

data/lib/kiosk/user_identity_providers/devise/wire_signpost.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'active_support/concern'
+require 'kiosk/user_identity_providers/devise'
+
+module Kiosk
+  module UserIdentityProviders
+    class Devise
+      # Answers a JSON caller at a human page with a pointer to the Kiosk wire
+      # instead of an empty error. Include it in ApplicationController.
+      module WireSignpost
+        extend ActiveSupport::Concern
+
+        included do
+          rescue_from ActionController::InvalidAuthenticityToken do |error|
+            raise error unless kiosk_json_request?
+
+            render_wire_signpost :unprocessable_entity, 'invalid_authenticity_token',
+                                 message: 'this is the human sign-in page, not the Kiosk wire — it needs a ' \
+                                          'browser session and a CSRF token from its own form',
+                                 hint: 'assistants authenticate with their own keypair: GET ' \
+                                       "#{request.base_url}/.well-known/kiosk.json for the register/login " \
+                                       'endpoints, the catalog link and the modules this origin serves'
+          end
+        end
+
+        private
+
+        def kiosk_json_request?
+          request.format.json? || !!request.content_mime_type&.json?
+        rescue StandardError
+          false
+        end
+
+        def render_wire_signpost(status, code, message:, hint:)
+          render status:, json: { ok: false, error: { code:, message:, hint: } }
+        end
+      end
+    end
+  end
+end

data/lib/kiosk/user_identity_providers/devise.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'kiosk'
+
+module Kiosk
+  module UserIdentityProviders
+    # The user-IdP for a Rails origin whose humans sign in through Devise: it
+    # reads the request's Warden user, so password, magic-link and OmniAuth
+    # sign-ins all resolve, and a locked or unconfirmed user resolves to nil.
+    class Devise < Base
+      autoload :SessionsController, 'kiosk/user_identity_providers/devise/sessions_controller'
+      autoload :WireSignpost,       'kiosk/user_identity_providers/devise/wire_signpost'
+
+      # Raised when neither the user model nor the configuration names a role.
+      class ConfigurationError < StandardError; end
+
+      NO_ROLE = <<~MSG.strip
+        Cannot resolve a role for the Devise principal: \
+        `Kiosk.configuration.roles` is empty and the user model does not \
+        define `#kiosk_role`. Configure at least one role — e.g. \
+        `Kiosk.configure { |c| c.roles = %i[customer] }` — or add \
+        `def kiosk_role; :customer; end` to your user model.
+      MSG
+
+      # @param request [#env, #current_user, Hash] an ActionDispatch::Request,
+      #   a controller exposing `#current_user`, or a Rack env Hash
+      # @return [Kiosk::Identity, nil] nil when no user is signed in
+      def verify(request)
+        user = current_user_from(request)
+        return nil if user.nil?
+
+        Kiosk::Identity.new(
+          user_id: user.public_send(Kiosk.configuration.user_id_column),
+          role: role_for(user),
+          actor: 'human',
+          agent_id: nil,
+          claims: {}
+        )
+      end
+
+      private
+
+      def current_user_from(request)
+        return request.current_user if request.respond_to?(:current_user)
+
+        env = rack_env_for(request)
+        return nil if env.nil?
+
+        warden = env['warden']
+        warden&.user
+      end
+
+      def rack_env_for(request)
+        return request.env if request.respond_to?(:env)
+        return request     if request.is_a?(Hash)
+
+        nil
+      end
+
+      # The model's `#kiosk_role` verbatim, nil included; else the first configured role.
+      def role_for(user)
+        return user.kiosk_role if user.respond_to?(:kiosk_role)
+
+        roles = Kiosk.configuration.roles
+        raise ConfigurationError, NO_ROLE if Array(roles).empty?
+
+        roles.first
+      end
+    end
+  end
+end
+
+require 'kiosk/user_identity_providers/devise/version'
+require 'kiosk/user_identity_providers/devise/configuration_extension'
+
+Kiosk::UserIdentityProviders::Devise::VERSION =
+  Kiosk::UserIdentityProviders::DeviseVersion::VERSION

data/lib/kiosk/user_identity_providers/devise_session.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'net/http'
+require 'uri'
+
+module Kiosk
+  module UserIdentityProviders
+    # Signs a human in to a Devise origin through its real form and keeps the
+    # session cookie; `session: true` on a call sends that cookie, so an
+    # assistant's own Bearer calls never carry it.
+    class DeviseSession
+      # Raised when the sign-in handshake does not reach a signed-in session.
+      class SignInError < StandardError; end
+
+      attr_reader :server, :cookies
+
+      def initialize(server)
+        @server  = server.to_s.sub(%r{/\z}, '')
+        @uri     = URI(@server)
+        @cookies = {}
+      end
+
+      # Raises SignInError unless Devise answers the form with a redirect.
+      def sign_in!(email:, password:)
+        form = get_html('/users/sign_in')
+        raise SignInError, "sign-in form: #{form.code}" unless form.code.to_i == 200
+
+        res = post_form('/users/sign_in',
+                        'authenticity_token' => csrf_token(form.body),
+                        'user[email]' => email,
+                        'user[password]' => password)
+        raise SignInError, "sign-in failed: #{res.code}" unless [302, 303].include?(res.code.to_i)
+
+        self
+      end
+
+      # GET an HTML page over the session (cookies attached — this is the human).
+      def get_html(path)
+        req = Net::HTTP::Get.new(uri_for(path))
+        req['Cookie'] = cookie_header unless @cookies.empty?
+        request(req)
+      end
+
+      # POST a form over the session (cookies attached — this is the human).
+      def post_form(path, form, headers = {})
+        req = Net::HTTP::Post.new(uri_for(path), headers)
+        req['Cookie'] = cookie_header unless @cookies.empty?
+        req.set_form_data(form)
+        request(req)
+      end
+
+      # `session: true` in the headers sends the human's cookies.
+      def post_json(path, body, headers = {})
+        headers = headers.dup
+        session = headers.delete(:session)
+        req = Net::HTTP::Post.new(uri_for(path), { 'Content-Type' => 'application/json' }.merge(headers))
+        req['Cookie'] = cookie_header if session
+        req.body = JSON.generate(body)
+        parsed(request(req))
+      end
+
+      # `session: true` in the headers sends the human's cookies.
+      def get_json(path, params = {}, headers = {})
+        headers = headers.dup
+        session = headers.delete(:session)
+        uri = uri_for(path)
+        uri.query = URI.encode_www_form(params) unless params.empty?
+        req = Net::HTTP::Get.new(uri, headers)
+        req['Cookie'] = cookie_header if session
+        parsed(request(req))
+      end
+
+      # The CSRF token Rails embeds in a rendered form.
+      def csrf_token(html)
+        html[/name="authenticity_token" value="([^"]+)"/, 1]
+      end
+
+      def cookie_header = @cookies.map { |k, v| "#{k}=#{v}" }.join('; ')
+
+      # Sends a request built by the caller, absorbing every Set-Cookie; TLS follows the target's scheme.
+      def request(req)
+        target = req.uri || @uri
+        http = Net::HTTP.new(target.hostname, target.port)
+        http.use_ssl = target.scheme == 'https'
+        res = http.request(req)
+        Array(res.get_fields('set-cookie')).each do |line|
+          name, value = line.split(';').first.split('=', 2)
+          @cookies[name] = value
+        end
+        res
+      end
+
+      private
+
+      def uri_for(path)
+        path.to_s.start_with?('http') ? URI(path) : URI("#{@server}#{path}")
+      end
+
+      def parsed(res)
+        [res.code.to_i, begin
+          JSON.parse(res.body)
+        rescue StandardError
+          {}
+        end]
+      end
+    end
+  end
+end

data/lib/kiosk-user-idp-devise.rb

@@ -0,0 +1,5 @@
+# rubocop:disable Naming/FileName -- Bundler.require loads the file named after the gem.
+# frozen_string_literal: true
+
+require 'kiosk/user_identity_providers/devise'
+# rubocop:enable Naming/FileName

metadata

@@ -0,0 +1,88 @@
+--- !ruby/object:Gem::Specification
+name: kiosk-user-idp-devise
+version: !ruby/object:Gem::Version
+  version: 0.5.20
+platform: ruby
+authors:
+- Phil Pirozhkov
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: kiosk-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.5.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.5.0
+description: |
+  kiosk-user-idp-devise is the opt-in user-IdP adapter for Rails
+  providers that authenticate principals through Devise. Add it to your
+  Gemfile explicitly — the kiosk-all meta-gem pulls in only kiosk-core
+  and kiosk-server, so IdP adapters are chosen per provider.
+
+  It reads the signed-in user from the request's Warden proxy
+  (`request.env["warden"].user`) passed by kiosk-server and returns a
+  {Kiosk::Identity} value object. Covers both Devise paths —
+  `database_authenticatable` and `omniauthable` — since both populate the
+  Warden user, so the adapter is agnostic to how the user logged in.
+
+  Lockable / confirmable handling comes for free: Devise's
+  `active_for_authentication?` already gates the Warden user, so a locked
+  or unconfirmed user yields no signed-in user and the request fails as
+  unauthenticated with no extra code.
+
+  No hard runtime dependency on Devise itself — the adapter only reads the
+  request's Warden user, so the provider's already-installed Devise
+  satisfies the requirement.
+email:
+- hello@fili.pp.ru
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/kiosk-user-idp-devise.rb
+- lib/kiosk/user_identity_providers/devise.rb
+- lib/kiosk/user_identity_providers/devise/configuration_extension.rb
+- lib/kiosk/user_identity_providers/devise/sessions_controller.rb
+- lib/kiosk/user_identity_providers/devise/version.rb
+- lib/kiosk/user_identity_providers/devise/wire_signpost.rb
+- lib/kiosk/user_identity_providers/devise_session.rb
+homepage: https://kiosk.tech
+licenses:
+- Apache-2.0
+metadata:
+  homepage_uri: https://kiosk.tech
+  source_code_uri: https://github.com/kiosk-hq/kiosk
+  changelog_uri: https://github.com/kiosk-hq/kiosk/blob/main/kiosk-user-idp-devise/CHANGELOG.md
+  bug_tracker_uri: https://github.com/kiosk-hq/kiosk/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '4.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.3
+specification_version: 4
+summary: Devise user-IdP adapter for the Kiosk framework
+test_files: []