rodauth-ciba 0.1.0

data/docs/signed-requests.md

@@ -0,0 +1,162 @@
+# Optional signed CIBA requests
+
+Run the explicit client-metadata migration once:
+
+```ruby
+Rodauth::CibaSupport::Schema.add_signed_requests(db)
+```
+
+It adds nullable `backchannel_authentication_request_signing_alg` to
+`oauth_applications` without modifying pending requests or existing grants.
+Custom schemas may supply `table:` and `column:`; configure the matching
+`oauth_applications_backchannel_authentication_request_signing_alg_column` in
+Rodauth. Client verification keys use upstream `jwks` or `jwks_uri` metadata;
+the migration does not add those upstream columns.
+
+Enable explicitly, then register each signing client's algorithm and public keys:
+
+```ruby
+ciba_request_signing_algorithms ["RS256"]
+```
+
+The default is an empty list. Discovery publishes
+`backchannel_authentication_request_signing_alg_values_supported` only when
+enabled. Asymmetric RS/PS/ES algorithms and Ed25519/EdDSA (Ed25519 curve) may be configured. RS256 has actual
+request-issuance and installed-gem tests. All nine configured RS/PS/ES variants
+have direct acceptance/wrong-key tests in both gem and reference OP; installed
+issuance coverage for the other variants remains absent. Opt-in DCR composition
+is tested separately. Ed25519/EdDSA now use CIBA-local OpenSSL verification with strict OKP/Ed25519 key import; registration, Discovery, wrong-key rejection and approved issuance are tested. Other OAuth routes and
+their JAR/client-authentication policy are unchanged.
+
+A client with a registered signing algorithm must send `request`. The gem also
+rejects signed requests from clients without a registered algorithm. Algorithm
+selection is pinned to that registration and the enabled list; header values
+cannot choose another algorithm. Missing/invalid signed requests return
+`invalid_request`; a client registered for a disabled algorithm is ineligible
+(`unauthorized_client`), including for collection of pending results. Keep the
+algorithm enabled until those results have been collected or expired.
+
+The client authenticates independently using its registered method. The request
+JWT cannot substitute for a client assertion, and does not enter the client
+assertion replay ledger. Verification keys come only from the authenticated
+client's registered JWKS. The verifier filters key type, kid, optional alg/use
+and key_ops; unknown keys, encrypted objects, none/HS algorithms and unsupported
+critical headers are rejected. JWT header key URLs are never used. Registered
+remote JWKS lookup/cache behavior is delegated to upstream. Loopback HTTP tests
+use a narrowly allowed test receiver; actual fetches now pass through the
+[CIBA outbound HTTP boundary](outbound-http.md). Default private/loopback access
+is rejected without sending a receiver request. Existing cache semantics remain.
+The tests
+exercise actual Net::HTTP fetching, no-cache and max-age caching, key rotation,
+malformed/empty responses, HTTP 503 and connection refusal. Unknown kid does not
+force a cached JWKS refresh. Publish new keys before using them, retaining old
+keys during the cache overlap; removing a key does not revoke cached copies.
+After explicit upstream cache invalidation, tests verify the new key is accepted
+and the removed key rejected. This does not simulate natural TTL passage, TLS,
+production DNS, redirects or multi-process cache invalidation.
+
+During this signature-key lookup only, upstream HTTP authentication halts and
+network failures become `invalid_request`, without saving a pending request.
+An actual wrong client credential still returns 401. Before this adaptation,
+upstream HTTP 503 misleadingly returned 401 and connection refusal returned 500.
+The normalized error is a gem policy; node source can propagate
+`invalid_client_metadata` from its remote-key refresh. It is not a claim that
+all remote-key error responses are identical across the two libraries.
+
+Signature verification precedes account resolution and persistence. Require
+client issuer, OP audience membership, finite numeric exp/iat/nbf and string jti. Fractional NumericDate values are accepted. Time checks use
+`oauth_jwt_iat_leeway`; exp must remain valid and nbf must not be in the future
+beyond that tolerance. Like the reference, a future iat alone does not reject
+a signed request with valid exp/nbf. JSON duplicate members,
+malformed encodings, nested request/request_uri and payloads beyond the existing
+HTTP body limit are rejected. Like the reference, jti must be present and a
+string, but the OP does not require it to be nonempty or implement request-JWT
+replay consumption. Clients remain responsible for unique identifiers.
+
+After verification, only inner CIBA parameters are passed to the normal
+validator. Outer authentication parameters do not fill gaps or override signed
+values, matching the reference's treatment of nonconforming outer input.
+requested_expiry accepts an integer or string; claims objects, authorization
+details arrays and resource arrays enter their existing optional-feature
+validators. Exactly one enabled hint is still required. Raw request JWTs and
+authentication parameters do not enter saved requests, device snapshots or
+observation events. Applications must redact original HTTP logs separately.
+
+Like the reference default, submitting the same still-valid signed JWT again
+creates a **new pending authentication request**, not an idempotent lookup or
+reuse of an approval. Normal client/request rate controls remain necessary.
+Each accepted request needs its own new customer approval and retains the
+existing one-time token collection and replay-revocation behavior.
+
+See [reference evidence](research/signed-request-reference-contract.md),
+[local tests](validation/signed-request-tests.txt) and the installed-gem
+`examples/extensions_smoke.rb`. Production remote-JWKS scenarios, all feature-enable
+orders, Edwards HTTPS key rotation, installed issuance with all algorithms and broader dynamic-registration combinations remain incomplete;
+passing these cases is not full node parity or CIBA certification.
+
+### Edwards request signatures
+
+Configure `ciba_request_signing_algorithms %w[Ed25519 EdDSA]` and register the exact
+algorithm used in the JWT header. Both names use an OKP JWK with crv=Ed25519 and
+an unpadded base64url 32-byte public x value. X25519 and Ed448 are not accepted.
+The key's alg, use, key_ops and kid restrictions still apply. Private material
+is rejected by dynamic registration. ID Token signing, client assertions and
+non-CIBA JWT processing are not enabled for these algorithms by this setting.
+
+Verification uses Ruby OpenSSL PKey verification without prehashing and imports
+the public key as [RFC8410 SubjectPublicKeyInfo](https://www.rfc-editor.org/rfc/rfc8410.html#section-4),
+using [OpenSSL PKey verification](https://docs.ruby-lang.org/en/master/OpenSSL/PKey/PKey.html#method-i-verify). It adds no JWT global algorithm
+registration or native dependency. The existing bounded parser, required claims,
+issuer/audience/time validation and per-request approval boundary remain shared
+with RSA/EC requests.
+
+[Three-DB regression](validation/edwards-request-matrix.txt): each11 tests /
+234 assertions pass. [Reference11 algorithms](validation/node-signed-edwards.txt)
+includes acceptance and wrong-key rejection. Node/jose-generated fixed vectors now pass with inline and actual HTTP remote
+JWKS on all three DBs; modified payloads fail without creating requests.
+[Vector/remote regression](validation/edwards-vectors-matrix.txt): each4 tests /
+108 assertions. The built and isolated installed gem also accepts both fixed
+vectors with opaque/JWT access-token settings and verifies the returned ID Token
+([installed artifact](validation/edwards-installed.txt)). The installed Edwards
+fixture uses inline keys; remote Edwards HTTPS rotation is not covered by it.
+
+The public fixtures are `examples/fixtures/edwards-requests.json`, generated by
+`test/reference/full-op/edwards-vectors.mjs` with the pinned Node/jose dependency.
+They contain no private keys. Their fixed clock is injected only by tests and
+the smoke example; production time validation is unchanged. Regeneration is a
+separate explicit command, so normal test runs verify the saved foreign-generated
+signature bytes rather than signing fresh inputs with the Ruby implementation.
+
+## NumericDate alignment
+
+[CIBA Core7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1)
+requires exp, iat and nbf on signed requests.
+[RFC7519 section2](https://www.rfc-editor.org/rfc/rfc7519.html#section-2)
+defines NumericDate to allow non-integer values. The previous integer-only
+validation and additional future-iat rejection were extra gem restrictions.
+
+Provider9.12.2 over HTTP accepts fractional dates and future iat, while rejecting
+malformed iat, future nbf and expired exp. The gem now matches that boundary;
+mandatory claims, asymmetric signature checks and explicit customer approval
+remain required. This change is scoped to signed CIBA request objects, not
+upstream client assertions or ID Token hints.
+
+[Reference execution](validation/node-signed-numericdate.txt),
+[gem before correction](validation/signed-numericdate-red.txt),
+[three-DB regression](validation/signed-numericdate-matrix.txt).
+
+## Request jti versus client assertion replay
+
+The reference accepts an empty-string jti on signed authentication requests and
+rejects null/non-string values. The gem now matches that type/presence check.
+This acceptance rule does not advise clients to generate empty identifiers or
+remove their obligation to generate unique request identifiers. Repeating the
+same signed request produces a fresh auth_req_id and approval-pending state,
+including when its first request has already issued tokens. No approval or
+permission is inherited from the repeated JWT.
+
+Client authentication assertions are a separate JWT use: their existing nonempty
+jti requirement and atomic replay rejection remain unchanged.
+[Reference](validation/node-signed-jti.txt),
+[before correction](validation/signed-jti-red.txt),
+[three-DB regression](validation/signed-jti-matrix.txt).

data/docs/user-code.md

@@ -0,0 +1,73 @@
+# Optional user codes
+
+User-code registration, storage, comparison, rate limiting and recovery belong
+to the application. The gem implements the protocol boundary and does not store
+the supplied code. It is separate from customer authentication and approval.
+
+The application must use a code distinct from the user's OP login password.
+It should provide a way for the user to change that code. Code enrollment and
+change UI remain application responsibilities; a callback accepting a fixture
+string does not demonstrate them. The CIBA client must ask for the code for each
+flow and must not store it. The gem's removal of the code from its own records
+does not prove client compliance. These responsibilities follow
+[CIBA Core §7.1.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#user_code).
+
+Run `Rodauth::CibaSupport::Schema.add_user_code(db)` once to add nullable
+`backchannel_user_code_parameter` to `oauth_applications`. Existing requests and
+grants are unchanged. Custom schemas can specify `table:`/`column:` and configure
+`oauth_applications_backchannel_user_code_parameter_column` to match.
+
+Enable `ciba_user_code_enabled true` and implement:
+
+```ruby
+verify_ciba_user_code do |code, account_id:, oauth_application:|
+  # Application policy decides whether this client/user requires a code.
+  # Raise Rodauth::CibaSupport::ProtocolError, "missing_user_code" if required but absent.
+  # Return true only after accepting the code or explicitly permitting omission.
+end
+```
+
+Enabling without an implementation is a configuration error. The callback runs
+after hint resolution and account eligibility, before DB insertion, transaction
+hooks and device dispatch. It receives nil for omission; otherwise a nonempty
+UTF-8 string of at most 1024 bytes. Invalid input shapes return invalid_request.
+Only literal true accepts the request: false/nil returns invalid_user_code.
+Applications may raise ProtocolError with missing_user_code or invalid_user_code;
+unexpected exceptions return server_error and do not create a request.
+
+Client metadata is available to the callback, but the gem does not decide the
+application's per-user exceptions. A client declaring user-code support is
+ineligible while the feature is disabled. With the feature enabled, the callback
+runs for every eligible client, even when the code is omitted or client metadata
+is false/nil; the application must explicitly accept that case. Discovery's
+backchannel_user_code_parameter_supported reflects the feature flag.
+
+The raw value is removed before request persistence, hooks, device snapshots
+and observation events. Original HTTP bodies and application logging remain
+the application's responsibility. With signed requests, only the inner code
+is used; an outer code cannot fill in or override it. A successful code check
+still creates pending work requiring new customer approval. Poll does not rerun
+the code check or inherit approval from it.
+
+## Reference comparison and evidence
+
+node-oidc-provider 9.12.2 resolves the account and then calls
+`features.ciba.verifyUserCode(ctx, account, code)`. Its default callback throws
+until replaced; application policy determines omission/validation errors. The
+complete HTTP reference now has a client-specific test policy: missing/wrong
+code returns the corresponding error before device dispatch; correct code
+remains pending until approval and produces a verified ID Token afterwards.
+[Harness](../test/reference/full-op/lifecycle.mjs),
+[reference log](validation/node-full-op-lts.txt).
+
+The gem keeps this responsibility boundary but requires explicit true instead
+of node's successful callback completion, bounds input size, and removes the
+code from persisted snapshots. Those are deliberate API/storage differences.
+The test/demo policy uses a fixed fixture string; it is not a production code
+verifier. No production password hashing, account recovery, throttling or
+brute-force defense is provided by these fixtures.
+
+[Gem tests](validation/user-code-tests.txt) cover omission, rejection, unknown
+accounts, no persistence/dispatch on failure, callback exceptions, metadata,
+signed-request isolation and new approval. The installed-gem extension example
+combines codes with signed requests, hints, claims, resources and RAR.

data/docs/validation/node-alignment-tests.txt

@@ -0,0 +1,10 @@
+mise WARN  failed to write cache file: /Users/hiroshi/.cache/mise/lua/5.5.0/exec_env_3b86e418117b5590-7f2de.msgpack.z Operation not permitted (os error 1)
+Run options: --seed 24266
+
+# Running:
+
+........................................................................................................
+
+Finished in 1.224815s, 84.9108 runs/s, 618.0525 assertions/s.
+
+104 runs, 757 assertions, 0 failures, 0 errors, 0 skips

data/examples/client.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+require "net/http"
+require "json"
+require "jwt"
+
+issuer = "http://127.0.0.1:9292"
+metadata = JSON.parse(Net::HTTP.get(URI("#{issuer}/.well-known/openid-configuration")))
+def post_form(url, params)
+  uri = URI(url)
+  request = Net::HTTP::Post.new(uri)
+  request.basic_auth("demo-client", "demo-secret")
+  request.set_form_data(params)
+  response = Net::HTTP.start(uri.host, uri.port) { |http| http.request(request) }
+  [response.code.to_i, JSON.parse(response.body)]
+end
+status, request = post_form(metadata.fetch("backchannel_authentication_endpoint"),
+  scope: "openid", login_hint: "customer@example.test", binding_message: "LOCAL-DEMO")
+abort request.inspect unless status == 200
+puts "Open #{issuer}/ and approve LOCAL-DEMO as the simulated customer."
+interval = request.fetch("interval")
+deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + request.fetch("expires_in")
+loop do
+  sleep interval
+  abort "Request expired" if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+  status, result = post_form(metadata.fetch("token_endpoint"),
+    grant_type: "urn:openid:params:grant-type:ciba", auth_req_id: request.fetch("auth_req_id"))
+  if status == 200
+    keys = JSON.parse(Net::HTTP.get(URI(metadata.fetch("jwks_uri"))))
+    claims, = JWT.decode(result.fetch("id_token"), nil, true, jwks: keys, algorithms: ["RS256"],
+      verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+    puts "Verified ID Token for customer sub=#{claims.fetch('sub')}; received access token."
+    break
+  end
+  case result["error"]
+  when "authorization_pending" then next
+  when "slow_down" then interval += 5
+  else abort result.inspect
+  end
+end

data/examples/demo_app.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+require "roda"
+require "sequel"
+require "openssl"
+require "cgi"
+require "rodauth/ciba"
+
+# Local demonstration only: the customer is a simulated, fixed identity.
+module CibaDemo
+  def self.create_schema(db)
+    db.create_table(:accounts) do
+      primary_key :id
+      String :email
+      Integer :status_id, default: 2
+    end
+    db.create_table(:oauth_applications) do
+      primary_key :id
+      String :client_id
+      String :client_secret
+      String :scopes
+      String :grant_types
+      String :token_endpoint_auth_method
+      String :subject_type
+    end
+    Rodauth::CibaSupport::Schema.add_client_metadata(db)
+    db.create_table(:oauth_grants) do
+      primary_key :id
+      foreign_key :account_id, :accounts
+      foreign_key :oauth_application_id, :oauth_applications
+      %i[type code scopes token refresh_token redirect_uri nonce acr claims].each { |name| String name }
+      DateTime :expires_in
+      DateTime :revoked_at
+    end
+    Rodauth::CibaSupport::Schema.create_grants(db)
+    Rodauth::CibaSupport::Schema.add_grant_reference(db)
+    Rodauth::CibaSupport::Schema.create(db)
+    db[:accounts].insert(email: "customer@example.test")
+    db[:oauth_applications].insert(client_id: "demo-client", client_secret: "demo-secret",
+      scopes: "openid", grant_types: Rodauth::CibaSupport::GRANT_TYPE, subject_type: "public",
+      token_endpoint_auth_method: "client_secret_basic", backchannel_token_delivery_mode: "poll")
+  end
+
+  def self.build(db)
+    key = OpenSSL::PKey::RSA.generate(2048)
+    Class.new(Roda) do
+      plugin :sessions, secret: SecureRandom.hex(64)
+      plugin :json_parser, content_type_regexp: %r{\Aapplication/json\b}i
+      plugin :rodauth, json: :only do
+        enable :ciba
+        db db
+        ciba_request_lifetime 300
+        ciba_max_request_lifetime 600
+        ciba_require_tls false # Local HTTP demo only. Production defaults to true.
+        base_url "http://127.0.0.1:9292"
+        authorization_server_url "http://127.0.0.1:9292"
+        oauth_jwt_keys("RS256" => key)
+        oauth_jwt_public_keys("RS256" => key.public_key)
+        oauth_jwt_access_tokens false
+        oauth_applications_client_secret_hash_column nil # Test-only plaintext fixture.
+        hmac_secret SecureRandom.hex(64)
+        # This demo displays pending requests on its local approval page.
+        trigger_ciba_authentication_device { |_request| }
+        resolve_ciba_login_hint { |hint, oauth_application:| db[:accounts].where(email: hint).get(:id) }
+      end
+      route do |r|
+        rodauth.load_openid_configuration_route
+        r.rodauth
+        response["content-type"] = "text/html; charset=utf-8"
+        session["csrf"] ||= SecureRandom.hex(32)
+        r.get do
+          rows = rodauth.pending_ciba_requests
+          forms = rows.map do |row|
+            message = CGI.escapeHTML(row[:binding_message].to_s)
+            <<~HTML
+              <form method="post" action="/decision">
+                <input type="hidden" name="csrf" value="#{session['csrf']}">
+                <input type="hidden" name="id" value="#{row[:id]}">
+                <p>Request #{row[:id]} — binding message: #{message}</p>
+                <button name="decision" value="approve">Approve</button>
+                <button name="decision" value="deny">Deny</button>
+              </form>
+            HTML
+          end.join
+          "<!doctype html><html><meta charset=utf-8><title>CIBA local demo</title><h1>CIBA local demo</h1>" \
+            "<p>Simulated customer: customer@example.test. No real identity verification. Local testing only.</p>#{forms}</html>"
+        end
+        r.post "decision" do
+          csrf = r.params["csrf"]
+          unless csrf.is_a?(String) && Rack::Utils.secure_compare(session["csrf"], csrf)
+            response.status = 403
+            next "Invalid CSRF token"
+          end
+          customer = db[:accounts].where(email: "customer@example.test").get(:id)
+          id = Integer(r.params["id"], 10)
+          case r.params["decision"]
+          when "approve"
+            db.transaction(mode: :immediate) do
+              request = rodauth.ciba_request(id)
+              raise Rodauth::CibaSupport::IdentityMismatch unless request[:account_id] == customer
+              # Reuse the saved consent when the browser repeats the decision.
+              grant = request[:grant_id] || rodauth.create_ciba_grant(account_id: customer,
+                oauth_application_id: request[:oauth_application_id], scopes: request[:scopes])
+              rodauth.backchannel_result(id, grant)
+            end
+          when "deny"
+            request = rodauth.ciba_request(id)
+            raise Rodauth::CibaSupport::IdentityMismatch unless request[:account_id] == customer
+            rodauth.backchannel_result(id, Rodauth::CibaSupport::ProtocolError.new("access_denied"))
+          else
+            response.status = 400
+            next "Unknown decision"
+          end
+          r.redirect "/"
+        rescue ArgumentError, Rodauth::CibaSupport::CompletionError
+          response.status = 409
+          "Request unavailable"
+        end
+      end
+    end
+  end
+end

data/examples/dpop_smoke.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+# Local synthetic credentials only. Exercises the installed gem, not test helpers.
+require "rack/mock"
+require "json"
+require "base64"
+require "digest"
+require_relative "demo_app"
+
+[false, true].each do |jwt|
+  database = Sequel.sqlite
+  begin
+    CibaDemo.create_schema(database)
+    Rodauth::CibaSupport::Schema.create_client_assertions(database)
+    Rodauth::CibaSupport::Schema.create_refresh_tokens(database)
+    Rodauth::CibaSupport::Schema.add_registration_token_digest(database)
+    database.alter_table(:oauth_grants) { add_column :dpop_jkt, String }
+    database.alter_table(:oauth_applications) do
+      add_column :dpop_bound_access_tokens, TrueClass
+      add_column :name, String
+      add_column :redirect_uri, String, text: true
+      add_column :response_types, String
+      add_column :registration_access_token, String
+    end
+    application = CibaDemo.build(database)
+    nonce_secret = SecureRandom.random_bytes(32)
+    application.plugin(:rodauth) do
+      enable :oauth_dpop, :oauth_dynamic_client_registration, :oauth_token_introspection
+      ciba_dynamic_client_registration_enabled true
+      ciba_refresh_tokens_enabled true
+      oauth_application_scopes %w[openid offline_access]
+      oauth_jwt_access_tokens jwt
+      ciba_dpop_nonce_secret nonce_secret
+      oauth_dpop_use_nonce true
+      before_register do
+        authorization_required unless request.env["HTTP_AUTHORIZATION"] == "Bearer local-dpop-registration"
+      end
+    end
+    application.route do |r|
+      rodauth.load_openid_configuration_route
+      rodauth.load_oauth_server_metadata_route
+      r.rodauth
+    end
+    http = Rack::MockRequest.new(application)
+    issuer = "http://127.0.0.1:9292"
+    metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+    oauth_metadata = JSON.parse(http.get("#{issuer}/.well-known/oauth-authorization-server").body)
+    %w[introspection_endpoint introspection_endpoint_auth_methods_supported dpop_signing_alg_values_supported].each do |name|
+      raise "Discovery mismatch: #{name}" unless metadata.fetch(name) == oauth_metadata.fetch(name)
+    end
+    check = lambda do |response, status, error = nil|
+      raise "unexpected status #{response.status}: #{response.body}" unless response.status == status
+      body = JSON.parse(response.body)
+      raise "unexpected error: #{body}" if error && body["error"] != error
+      body
+    end
+    client = check.call(http.post(metadata.fetch("registration_endpoint"),
+      "HTTP_AUTHORIZATION" => "Bearer local-dpop-registration", "CONTENT_TYPE" => "application/json",
+      input: JSON.generate(grant_types: [Rodauth::CibaSupport::GRANT_TYPE, "refresh_token"],
+        response_types: [], scope: "openid offline_access", token_endpoint_auth_method: "client_secret_basic",
+        backchannel_token_delivery_mode: "poll", dpop_bound_access_tokens: true)), 201)
+    raise "DPoP policy missing" unless client.fetch("dpop_bound_access_tokens")
+    credentials = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64("#{client.fetch('client_id')}:#{client.fetch('client_secret')}")}"}
+    instance = application.new(Rack::MockRequest.env_for(issuer)).rodauth
+    approve = lambda do
+      started = check.call(http.post(metadata.fetch("backchannel_authentication_endpoint"),
+        credentials.merge(params: {scope: "openid offline_access", login_hint: "customer@example.test"})), 200)
+      request = instance.ciba_request(database[:ciba_requests].order(:id).last.fetch(:id))
+      grant = instance.create_ciba_grant(account_id: request[:account_id],
+        oauth_application_id: request[:oauth_application_id], scopes: request[:scopes])
+      instance.backchannel_result(request[:id], grant)
+      {grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: started.fetch("auth_req_id")}
+    end
+    key = OpenSSL::PKey::EC.generate("prime256v1")
+    proof = lambda do |target, method, signing_key, claims = {}|
+      JWT.encode({jti: SecureRandom.uuid, iat: Time.now.to_i, htm: method, htu: target}.merge(claims),
+        signing_key, "ES256", typ: "dpop+jwt", jwk: JWT::JWK.new(signing_key).export)
+    end
+    poll = lambda do |params, signed = nil|
+      headers = credentials.merge(params: params)
+      headers["HTTP_DPOP"] = signed if signed
+      http.post(metadata.fetch("token_endpoint"), headers)
+    end
+    params = approve.call
+    check.call(poll.call(params), 400, "invalid_grant")
+    challenge = poll.call(params, proof.call(metadata.fetch("token_endpoint"), "POST", key))
+    check.call(challenge, 400, "use_dpop_nonce")
+    nonce = challenge["DPoP-Nonce"]
+    raise "missing nonce" unless nonce.is_a?(String) && nonce.bytesize == 43
+    signed = proof.call(metadata.fetch("token_endpoint"), "POST", key, nonce: nonce, iat: 1)
+    tokens = check.call(poll.call(params, signed), 200)
+    raise "wrong token type" unless tokens.fetch("token_type") == "DPoP"
+    keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+    identity, = JWT.decode(tokens.fetch("id_token"), nil, true, jwks: keys, algorithms: ["RS256"],
+      verify_iss: true, iss: issuer, verify_aud: true, aud: client.fetch("client_id"))
+    raise "ID Token inherited DPoP binding" if identity.key?("cnf")
+    raise "wrong subject" unless identity.fetch("sub") == database[:accounts].get(:id).to_s
+    verify_binding = lambda do |issued, signing_key|
+      expected = JWT::JWK::Thumbprint.new(JWT::JWK.new(signing_key)).generate
+      if jwt
+        payload, = JWT.decode(issued.fetch("access_token"), nil, true, jwks: keys,
+          algorithms: ["RS256"], verify_iss: true, iss: issuer)
+        raise "JWT binding missing" unless payload.fetch("cnf").fetch("jkt") == expected
+      end
+      raise "stored binding missing" unless database[:oauth_grants].order(:id).last.fetch(:dpop_jkt) == expected
+    end
+    verify_binding.call(tokens, key)
+    unless jwt
+      introspected = check.call(http.post(metadata.fetch("introspection_endpoint"),
+        credentials.merge(params: {token: tokens.fetch("access_token")})), 200)
+      raise "bound token inactive" unless introspected.fetch("active")
+      raise "introspection lost type" unless introspected.fetch("token_type") == "DPoP"
+      expected = JWT::JWK::Thumbprint.new(JWT::JWK.new(key)).generate
+      raise "introspection lost binding" unless introspected.fetch("cnf").fetch("jkt") == expected
+    end
+    raise "live proof removed" unless instance.cleanup_ciba_client_assertions == 0
+    second = approve.call
+    check.call(poll.call(second, signed), 400, "invalid_grant")
+    raise "replay consumed approval" unless database[:ciba_requests].order(:id).last.fetch(:status) == "approved"
+    userinfo = metadata.fetch("userinfo_endpoint")
+    token = tokens.fetch("access_token")
+    check.call(http.get(userinfo, "HTTP_AUTHORIZATION" => "Bearer #{token}"), 401, "invalid_token")
+    ath = Base64.urlsafe_encode64(Digest::SHA256.digest(token), padding: false)
+    get = ->(signed_proof) { http.get(userinfo, "HTTP_AUTHORIZATION" => "DPoP #{token}", "HTTP_DPOP" => signed_proof) }
+    check.call(get.call(proof.call(userinfo, "GET", key, ath: ath)), 401, "use_dpop_nonce")
+    check.call(get.call(proof.call(userinfo, "GET", key, ath: "wrong", nonce: nonce)), 401, "invalid_token")
+    user_proof = proof.call(userinfo, "GET", key, ath: ath, nonce: nonce, iat: 1)
+    info = check.call(get.call(user_proof), 200)
+    raise "UserInfo subject mismatch" unless info.fetch("sub") == identity.fetch("sub")
+    check.call(get.call(user_proof), 401, "invalid_token")
+    replacement_key = OpenSSL::PKey::EC.generate("prime256v1")
+    check.call(get.call(proof.call(userinfo, "GET", replacement_key, ath: ath, nonce: nonce)), 401, "invalid_token")
+    refresh_params = {grant_type: "refresh_token", refresh_token: tokens.fetch("refresh_token")}
+    refresh_proof = proof.call(metadata.fetch("token_endpoint"), "POST", replacement_key, nonce: nonce)
+    refreshed = check.call(poll.call(refresh_params, refresh_proof), 200)
+    raise "refresh lost token type" unless refreshed.fetch("token_type") == "DPoP"
+    verify_binding.call(refreshed, replacement_key)
+    renewed_identity, = JWT.decode(refreshed.fetch("id_token"), nil, true, jwks: keys, algorithms: ["RS256"],
+      verify_iss: true, iss: issuer, verify_aud: true, aud: client.fetch("client_id"))
+    raise "refreshed ID Token inherited DPoP binding" if renewed_identity.key?("cnf")
+    refreshed_token = refreshed.fetch("access_token")
+    refreshed_ath = Base64.urlsafe_encode64(Digest::SHA256.digest(refreshed_token), padding: false)
+    refreshed_info = check.call(http.get(userinfo, "HTTP_AUTHORIZATION" => "DPoP #{refreshed_token}",
+      "HTTP_DPOP" => proof.call(userinfo, "GET", replacement_key, ath: refreshed_ath, nonce: nonce)), 200)
+    raise "refresh changed subject" unless refreshed_info.fetch("sub") == identity.fetch("sub")
+    check.call(poll.call(refresh_params, refresh_proof), 400, "invalid_grant")
+    alias_userinfo = URI(userinfo)
+    alias_userinfo.port += 1
+    alias_userinfo = alias_userinfo.to_s
+    check.call(http.get(alias_userinfo, "HTTP_AUTHORIZATION" => "DPoP #{refreshed_token}",
+      "HTTP_DPOP" => proof.call(userinfo, "GET", replacement_key, ath: refreshed_ath, nonce: nonce)), 401, "invalid_dpop_proof")
+    alias_info = check.call(http.get(alias_userinfo, "HTTP_AUTHORIZATION" => "DPoP #{refreshed_token}",
+      "HTTP_DPOP" => proof.call(alias_userinfo, "GET", replacement_key, ath: refreshed_ath, nonce: nonce)), 200)
+    raise "alias subject changed" unless alias_info.fetch("sub") == identity.fetch("sub")
+    alias_token = URI(metadata.fetch("token_endpoint"))
+    alias_token.port += 1
+    alias_token = alias_token.to_s
+    check.call(http.post(alias_token, credentials.merge(params: second,
+      "HTTP_DPOP" => proof.call(metadata.fetch("token_endpoint"), "POST", key, nonce: nonce))), 400, "invalid_dpop_proof")
+    alias_tokens = check.call(http.post(alias_token, credentials.merge(params: second,
+      "HTTP_DPOP" => proof.call(alias_token, "POST", key, nonce: nonce))), 200)
+    JWT.decode(alias_tokens.fetch("id_token"), nil, true, jwks: keys,
+      algorithms: ["RS256"], verify_iss: true, iss: issuer,
+      verify_aud: true, aud: client.fetch("client_id"))
+    puts "PASS: installed-gem #{jwt ? 'JWT' : 'opaque'} DPoP alias port binding with canonical issuer (Rack transport)"
+    puts "PASS: installed-gem #{jwt ? 'JWT' : 'opaque'} DPoP DCR, nonce/old-iat issuance, binding, UserInfo, replay and confidential refresh with new key"
+  ensure
+    database.disconnect
+  end
+end