rodauth-ciba 0.1.0

data/examples/ecdh_id_token_smoke.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+require "rack/mock"
+require "json"
+require_relative "demo_app"
+
+[false, true].each do |jwt|
+  database = Sequel.sqlite
+  begin
+    CibaDemo.create_schema(database)
+    Rodauth::CibaSupport::Schema.create_refresh_tokens(database)
+    database.alter_table(:oauth_applications) do
+      add_column :id_token_signed_response_alg, String
+      add_column :id_token_encrypted_response_alg, String
+      add_column :id_token_encrypted_response_enc, String
+      add_column :jwks, String, text: true
+    end
+    database[:oauth_applications].update(scopes: "openid offline_access",
+      grant_types: "#{Rodauth::CibaSupport::GRANT_TYPE} refresh_token",
+      id_token_encrypted_response_enc: "A256CBC-HS512")
+    application = CibaDemo.build(database)
+    application.plugin(:rodauth) do
+      base_url "https://op.example.test"
+      authorization_server_url "https://op.example.test"
+      ciba_require_tls true
+      oauth_jwt_access_tokens jwt
+      ciba_refresh_tokens_enabled true
+      oauth_application_scopes %w[openid offline_access]
+      ciba_id_token_encryption_enabled true
+    end
+    http = Rack::MockRequest.new(application)
+    issuer = "https://op.example.test"
+    metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+    headers = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64('demo-client:demo-secret')}"}
+    post = lambda do |endpoint, params|
+      response = http.post(endpoint, headers.merge(params: params))
+      raise response.body unless response.status == 200
+      JSON.parse(response.body)
+    end
+    {"P-256" => "prime256v1", "P-384" => "secp384r1", "P-521" => "secp521r1", "X25519" => nil}.each do |curve, group|
+      recipient = group ? OpenSSL::PKey::EC.generate(group) : OpenSSL::PKey.generate_key("X25519")
+      public_recipient = group ? JWT::JWK.new(recipient).export :
+        {kty: "OKP", crv: curve, x: Base64.urlsafe_encode64(OpenSSL::ASN1.decode(recipient.public_to_der).value.last.value, padding: false)}
+      %w[ECDH-ES ECDH-ES+A128KW ECDH-ES+A192KW ECDH-ES+A256KW].each do |algorithm|
+        database[:oauth_applications].update(id_token_encrypted_response_alg: algorithm,
+          jwks: JSON.generate(keys: [public_recipient.merge(alg: algorithm, use: "enc", kid: "recipient")]))
+        started = post.call(metadata.fetch("backchannel_authentication_endpoint"), scope: "openid offline_access", login_hint: "customer@example.test")
+        row = database[:ciba_requests].order(:id).last
+        application.new(Rack::MockRequest.env_for(issuer)).rodauth.approve_ciba_request(row[:id], account_id: row[:account_id])
+        issued = post.call(metadata.fetch("token_endpoint"), grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: started.fetch("auth_req_id"))
+        renewed = post.call(metadata.fetch("token_endpoint"), grant_type: "refresh_token", refresh_token: issued.fetch("refresh_token"))
+        [issued, renewed].each do |tokens|
+          token = tokens.fetch("id_token")
+          raise "unencrypted response" unless token.split(".").length == 5
+          parts = token.split(".", -1)
+          header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+          epk = header.fetch("epk")
+          raise "wrong curve or private ephemeral key" unless epk.fetch("crv") == curve && !epk.key?("d")
+          public_key = if group
+            JWT::JWK.import(epk).keypair
+          else
+            identifier = OpenSSL::ASN1::Sequence.new([OpenSSL::ASN1::ObjectId.new("1.3.101.110")])
+            OpenSSL::PKey.read(OpenSSL::ASN1::Sequence.new([identifier,
+              OpenSSL::ASN1::BitString.new(Base64.urlsafe_decode64(epk.fetch("x")))]).to_der)
+          end
+          bits = algorithm == "ECDH-ES" ? 512 : algorithm[/A(\d+)KW$/, 1].to_i
+          name = algorithm == "ECDH-ES" ? "A256CBC-HS512" : algorithm
+          info = [name.bytesize].pack("N") + name + [0, 0, bits].pack("N3")
+          shared = recipient.derive(public_key)
+          derived = (1..((bits + 255) / 256)).map { |counter| OpenSSL::Digest.digest("SHA256", [counter].pack("N") + shared + info) }.join.byteslice(0, bits / 8)
+          cek = algorithm == "ECDH-ES" ? derived : JWE::Alg.decrypt_cek(algorithm.split("+").last, derived, Base64.urlsafe_decode64(parts[1]))
+          signed = JWE::Enc.for("A256CBC-HS512", cek, Base64.urlsafe_decode64(parts[2]), Base64.urlsafe_decode64(parts[4]))
+            .decrypt(Base64.urlsafe_decode64(parts[3]), parts[0])
+          jwks = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+          claims, = JWT.decode(signed, nil, true, jwks: jwks, algorithms: ["RS256"],
+            verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+          raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+        end
+        puts "PASS: installed #{curve}/#{algorithm} encrypted ID Token issuance/refresh, #{jwt ? 'JWT' : 'opaque'} access token, recipient decryption and signature verified"
+      end
+    end
+  ensure
+    database.disconnect
+  end
+end

data/examples/edwards_id_token_smoke.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+# Synthetic credentials and ephemeral keys only. Optional export contains no private keys.
+require "rack/mock"
+require "json"
+require_relative "demo_app"
+
+vectors = []
+[false, true].each do |jwt|
+  database = Sequel.sqlite
+  begin
+    CibaDemo.create_schema(database)
+    database.alter_table(:oauth_applications) { add_column :id_token_signed_response_alg, String }
+    signing_keys = %w[Ed25519 EdDSA].to_h { |algorithm| [algorithm, OpenSSL::PKey.generate_key("ED25519")] }
+    application = CibaDemo.build(database)
+    application.plugin(:rodauth) do
+      base_url "https://op.example.test"
+      authorization_server_url "https://op.example.test"
+      ciba_require_tls true
+      oauth_jwt_access_tokens jwt
+      ciba_id_token_signing_keys signing_keys
+    end
+    http = Rack::MockRequest.new(application)
+    issuer = "https://op.example.test"
+    metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+    headers = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64('demo-client:demo-secret')}"}
+    signing_keys.each do |algorithm, key|
+      database[:oauth_applications].update(id_token_signed_response_alg: algorithm)
+      started = http.post(metadata.fetch("backchannel_authentication_endpoint"), headers.merge(params: {scope: "openid", login_hint: "customer@example.test"}))
+      raise started.body unless started.status == 200
+      row = database[:ciba_requests].order(:id).last
+      application.new(Rack::MockRequest.env_for(issuer)).rodauth.approve_ciba_request(row[:id], account_id: row[:account_id])
+      issued = http.post(metadata.fetch("token_endpoint"), headers.merge(params: {
+        grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: JSON.parse(started.body).fetch("auth_req_id")}))
+      raise issued.body unless issued.status == 200
+      tokens = JSON.parse(issued.body)
+      parts = tokens.fetch("id_token").split(".")
+      raise "invalid signature" unless key.verify(nil, Base64.urlsafe_decode64(parts.last), parts.first(2).join("."))
+      jwks = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+      raise "private key exported" if jwks.fetch("keys").any? { |jwk| jwk.key?("d") || jwk.key?("k") }
+      vectors << {alg: algorithm, jwt_access_token: jwt, checked_at: Time.now.to_i,
+        id_token: tokens.fetch("id_token"), access_token: tokens.fetch("access_token"), jwks: jwks}
+      puts "PASS: installed #{algorithm} ID Token, #{jwt ? 'JWT' : 'opaque'} access token, public JWKS"
+    end
+  ensure
+    database.disconnect
+  end
+end
+File.write(ENV.fetch("CIBA_EDWARDS_ID_TOKEN_EXPORT"), JSON.pretty_generate(vectors) + "\n") if ENV["CIBA_EDWARDS_ID_TOKEN_EXPORT"]

data/examples/edwards_smoke.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+# Uses public Node/jose-generated vectors from the installed artifact.
+require "rack/mock"
+require "json"
+require_relative "demo_app"
+fixture = JSON.parse(File.read(File.join(__dir__, "fixtures/edwards-requests.json")))
+[false, true].each do |jwt|
+  database = Sequel.sqlite
+  begin
+    CibaDemo.create_schema(database)
+    Rodauth::CibaSupport::Schema.add_signed_requests(database)
+    database.alter_table(:oauth_applications) { add_column :jwks, String, text: true }
+    database[:oauth_applications].update(client_id: "support")
+    application = CibaDemo.build(database)
+    application.plugin(:rodauth) do
+      base_url "https://op.example.test"
+      authorization_server_url "https://op.example.test"
+      ciba_require_tls true
+      ciba_now { fixture.fetch("now") }
+      oauth_jwt_access_tokens jwt
+      ciba_request_signing_algorithms %w[Ed25519 EdDSA]
+    end
+    http = Rack::MockRequest.new(application)
+    issuer = "https://op.example.test"
+    metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+    headers = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64('support:demo-secret')}"}
+    fixture.fetch("vectors").each do |vector|
+      database[:oauth_applications].update(backchannel_authentication_request_signing_alg: vector.fetch("alg"),
+        jwks: JSON.generate(keys: [vector.fetch("jwk")]))
+      started = http.post(metadata.fetch("backchannel_authentication_endpoint"), headers.merge(params: {request: vector.fetch("token")}))
+      raise started.body unless started.status == 200
+      id = JSON.parse(started.body).fetch("auth_req_id")
+      instance = application.new(Rack::MockRequest.env_for(issuer)).rodauth
+      row = database[:ciba_requests].order(:id).last
+      instance.approve_ciba_request(row[:id], account_id: row[:account_id])
+      issued = http.post(metadata.fetch("token_endpoint"), headers.merge(params: {grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id}))
+      raise issued.body unless issued.status == 200
+      tokens = JSON.parse(issued.body)
+      keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+      claims, = JWT.decode(tokens.fetch("id_token"), nil, true, jwks: keys, algorithms: ["RS256"],
+        verify_iss: true, iss: issuer, verify_aud: true, aud: "support")
+      raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+      raise "missing access token" unless tokens.fetch("access_token").is_a?(String)
+      puts "PASS: installed #{vector.fetch('alg')} Node/jose vector, #{jwt ? 'JWT' : 'opaque'} access token, verified ID Token"
+    end
+    Rodauth::CibaSupport::Schema.create_client_assertions(database)
+    database.alter_table(:oauth_applications) { add_column :token_endpoint_auth_signing_alg, String }
+    application.plugin(:rodauth) do
+      enable :oauth_jwt_bearer_grant
+      ciba_client_assertion_signing_algorithms %w[Ed25519 EdDSA]
+    end
+    key = OpenSSL::PKey.generate_key("ED25519")
+    raw = OpenSSL::ASN1.decode(key.public_to_der).value.last.value
+    jwk = {kty: "OKP", crv: "Ed25519", x: Base64.urlsafe_encode64(raw, padding: false), kid: "auth", use: "sig"}
+    %w[Ed25519 EdDSA].each do |algorithm|
+      database[:oauth_applications].update(backchannel_authentication_request_signing_alg: nil,
+        token_endpoint_auth_method: "private_key_jwt", token_endpoint_auth_signing_alg: algorithm,
+        jwks: JSON.generate(keys: [jwk.merge(alg: algorithm)]))
+      authentication = lambda do
+        parts = [{alg: algorithm, kid: "auth"}, {iss: "support", sub: "support", aud: issuer,
+          exp: Time.now.to_i + 60, jti: SecureRandom.uuid}].map { |part| Base64.urlsafe_encode64(JSON.generate(part), padding: false) }
+        token = (parts + [Base64.urlsafe_encode64(key.sign(nil, parts.join(".")), padding: false)]).join(".")
+        {client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer", client_assertion: token}
+      end
+      start_auth = authentication.call
+      started = http.post(metadata.fetch("backchannel_authentication_endpoint"), params: start_auth.merge(scope: "openid", login_hint: "customer@example.test"))
+      raise started.body unless started.status == 200
+      replay = http.post(metadata.fetch("backchannel_authentication_endpoint"), params: start_auth.merge(scope: "openid", login_hint: "customer@example.test"))
+      raise "assertion replay accepted" unless replay.status == 401
+      id = JSON.parse(started.body).fetch("auth_req_id")
+      instance = application.new(Rack::MockRequest.env_for(issuer)).rodauth
+      row = database[:ciba_requests].order(:id).last
+      instance.approve_ciba_request(row[:id], account_id: row[:account_id])
+      issued = http.post(metadata.fetch("token_endpoint"), params: authentication.call.merge(grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id))
+      raise issued.body unless issued.status == 200
+      tokens = JSON.parse(issued.body)
+      keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+      claims, = JWT.decode(tokens.fetch("id_token"), nil, true, jwks: keys, algorithms: ["RS256"],
+        verify_iss: true, iss: issuer, verify_aud: true, aud: "support")
+      raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+      raise "missing access token" unless tokens.fetch("access_token").is_a?(String)
+      puts "PASS: installed #{algorithm} client authentication at both endpoints, replay rejected, #{jwt ? 'JWT' : 'opaque'} access token, verified ID Token"
+    end
+  ensure
+    database.disconnect
+  end
+end

data/examples/edwards_tls_smoke.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+# Called by the installed ping fixture with its real, verified HTTPS server.
+module CibaEdwardsTlsSmoke
+  def self.run(server, untrusted:)
+    public_keys = []
+    requests = []
+    server.mount_proc("/edwards-jwks") do |request, response|
+      requests << [request.request_method, request["authorization"]]
+      response["Content-Type"] = "application/json"
+      response["Cache-Control"] = "no-cache"
+      response.body = JSON.generate(keys: public_keys)
+    end
+    endpoint = "https://127.0.0.1:#{server.config[:Port]}/edwards-jwks"
+    [false, true].each do |jwt|
+      %w[Ed25519 EdDSA].each do |algorithm|
+        database = Sequel.sqlite
+        begin
+          CibaDemo.create_schema(database)
+          Rodauth::CibaSupport::Schema.create_client_assertions(database)
+          database.alter_table(:oauth_applications) do
+            add_column :jwks_uri, String
+            add_column :token_endpoint_auth_signing_alg, String
+          end
+          database[:oauth_applications].update(token_endpoint_auth_method: "private_key_jwt",
+            token_endpoint_auth_signing_alg: algorithm, jwks_uri: endpoint)
+          key = OpenSSL::PKey.generate_key("ED25519")
+          raw = OpenSSL::ASN1.decode(key.public_to_der).value.last.value
+          public_keys = [{kty: "OKP", crv: "Ed25519", x: Base64.urlsafe_encode64(raw, padding: false), alg: algorithm, kid: "client", use: "sig"}]
+          app = CibaDemo.build(database)
+          app.plugin(:rodauth) do
+            enable :oauth_jwt_bearer_grant
+            ciba_client_assertion_signing_algorithms %w[Ed25519 EdDSA]
+            oauth_jwt_access_tokens jwt
+          end
+          app.new(Rack::MockRequest.env_for("http://127.0.0.1:9292")).rodauth.send(:http_request_cache).uncache(URI(endpoint))
+          http = Rack::MockRequest.new(app)
+          issuer = "http://127.0.0.1:9292"
+          metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+          authentication = lambda do
+            parts = [{alg: algorithm, kid: "client"}, {iss: "demo-client", sub: "demo-client", aud: issuer,
+              exp: Time.now.to_i + 60, jti: SecureRandom.uuid}].map { |part| Base64.urlsafe_encode64(JSON.generate(part), padding: false) }
+            token = (parts + [Base64.urlsafe_encode64(key.sign(nil, parts.join(".")), padding: false)]).join(".")
+            {client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer", client_assertion: token}
+          end
+          start = -> { http.post(metadata.fetch("backchannel_authentication_endpoint"), params: authentication.call.merge(scope: "openid", login_hint: "customer@example.test")) }
+          before = requests.length
+          raise "default loopback guard bypassed" unless start.call.status == 401 && requests.length == before
+          app.plugin(:rodauth) { ciba_http_address_allowed? { |address| address == "127.0.0.1" } }
+          accepted = start.call
+          if untrusted
+            raise "untrusted JWKS accepted or reached handler" unless accepted.status == 401 && requests.length == before && database[:ciba_requests].count.zero?
+            puts "PASS: installed #{algorithm} HTTPS client JWKS rejects untrusted TLS before key retrieval, #{jwt ? 'JWT' : 'opaque'} mode"
+            next
+          end
+          raise accepted.body unless accepted.status == 200
+          id = JSON.parse(accepted.body).fetch("auth_req_id")
+          row = database[:ciba_requests].first
+          app.new(Rack::MockRequest.env_for(issuer)).rodauth.approve_ciba_request(row[:id], account_id: row[:account_id])
+          issued = http.post(metadata.fetch("token_endpoint"), params: authentication.call.merge(grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id))
+          raise issued.body unless issued.status == 200
+          token = JSON.parse(issued.body).fetch("id_token")
+          keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+          claims, = JWT.decode(token, nil, true, jwks: keys, algorithms: ["RS256"], verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+          raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+          raise "JWKS credential forwarding or missing fetch" unless requests.length >= before + 2 && requests.drop(before).all? { |entry| entry == ["GET", nil] }
+          puts "PASS: installed #{algorithm} HTTPS client JWKS, both endpoint authentication, verified ID Token, #{jwt ? 'JWT' : 'opaque'} access token"
+        ensure
+          database.disconnect
+        end
+      end
+    end
+  end
+end

data/examples/encrypted_id_token_smoke.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+require "rack/mock"
+require "json"
+require_relative "demo_app"
+
+[false, true].each do |jwt|
+  database = Sequel.sqlite
+  begin
+    CibaDemo.create_schema(database)
+    Rodauth::CibaSupport::Schema.create_refresh_tokens(database)
+    database.alter_table(:oauth_applications) do
+      add_column :id_token_signed_response_alg, String
+      add_column :id_token_encrypted_response_alg, String
+      add_column :id_token_encrypted_response_enc, String
+      add_column :jwks, String, text: true
+    end
+    recipient = OpenSSL::PKey::RSA.generate(2048)
+    edwards = OpenSSL::PKey.generate_key("ED25519")
+    public_recipient = JWT::JWK.new(recipient.public_key).export.merge(use: "enc", alg: "RSA-OAEP-256", kid: "recipient")
+    database[:oauth_applications].update(scopes: "openid offline_access",
+      grant_types: "#{Rodauth::CibaSupport::GRANT_TYPE} refresh_token",
+      id_token_encrypted_response_alg: "RSA-OAEP-256", id_token_encrypted_response_enc: "A256GCM",
+      jwks: JSON.generate(keys: [public_recipient]))
+    application = CibaDemo.build(database)
+    application.plugin(:rodauth) do
+      base_url "https://op.example.test"
+      authorization_server_url "https://op.example.test"
+      ciba_require_tls true
+      oauth_jwt_access_tokens jwt
+      ciba_refresh_tokens_enabled true
+      oauth_application_scopes %w[openid offline_access]
+      ciba_id_token_encryption_enabled true
+      ciba_id_token_signing_keys("Ed25519" => edwards, "EdDSA" => edwards)
+    end
+    http = Rack::MockRequest.new(application)
+    issuer = "https://op.example.test"
+    metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+    headers = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64('demo-client:demo-secret')}"}
+    post = lambda do |endpoint, params|
+      response = http.post(endpoint, headers.merge(params: params))
+      raise response.body unless response.status == 200
+      JSON.parse(response.body)
+    end
+    %w[RS256 Ed25519 EdDSA].each do |algorithm|
+      database[:oauth_applications].update(id_token_signed_response_alg: algorithm)
+      started = post.call(metadata.fetch("backchannel_authentication_endpoint"), scope: "openid offline_access", login_hint: "customer@example.test")
+      row = database[:ciba_requests].order(:id).last
+      application.new(Rack::MockRequest.env_for(issuer)).rodauth.approve_ciba_request(row[:id], account_id: row[:account_id])
+      issued = post.call(metadata.fetch("token_endpoint"), grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: started.fetch("auth_req_id"))
+      renewed = post.call(metadata.fetch("token_endpoint"), grant_type: "refresh_token", refresh_token: issued.fetch("refresh_token"))
+      [issued, renewed].each do |tokens|
+        token = tokens.fetch("id_token")
+        raise "unencrypted response" unless token.split(".").length == 5
+        signed = JWE.decrypt(token, recipient)
+        if algorithm == "RS256"
+          jwks = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+          claims, = JWT.decode(signed, nil, true, jwks: jwks, algorithms: [algorithm],
+            verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+        else
+          parts = signed.split(".")
+          raise "invalid signature" unless edwards.verify(nil, Base64.urlsafe_decode64(parts.last), parts.first(2).join("."))
+          claims, header = JWT.decode(signed, nil, false)
+          raise "wrong algorithm" unless header.fetch("alg") == algorithm
+          raise "wrong issuer/audience" unless claims.fetch("iss") == issuer && claims.fetch("aud") == "demo-client"
+        end
+        raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+      end
+      puts "PASS: installed #{algorithm} encrypted ID Token issuance/refresh, #{jwt ? 'JWT' : 'opaque'} access token, recipient decryption and signature verified"
+    end
+  ensure
+    database.disconnect
+  end
+end

data/examples/encryption_tls_smoke.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+module CibaEncryptionTlsSmoke
+  def self.run(server, untrusted:)
+    requests = []
+    state = {keys: [], status: 200, cache: "max-age=3600", body: nil}
+    server.mount_proc("/encryption-jwks") do |request, response|
+      requests << [request.request_method, request["authorization"]]
+      response.status = state[:status]
+      response["Content-Type"] = "application/json"
+      response["Cache-Control"] = state[:cache]
+      response.body = state[:body] || JSON.generate(keys: state[:keys])
+    end
+    endpoint = "https://127.0.0.1:#{server.config[:Port]}/encryption-jwks"
+    [false, true].product([nil, "P-256", "X25519"]).each do |jwt, curve|
+      algorithm = curve == "X25519" ? "ECDH-ES+A256KW" : curve ? "ECDH-ES" : "RSA-OAEP-256"
+      database = Sequel.sqlite
+      begin
+        CibaDemo.create_schema(database)
+        Rodauth::CibaSupport::Schema.create_refresh_tokens(database)
+        database.alter_table(:oauth_applications) do
+          add_column :jwks_uri, String
+          add_column :id_token_encrypted_response_alg, String
+          add_column :id_token_encrypted_response_enc, String
+        end
+        database[:oauth_applications].update(jwks_uri: endpoint, scopes: "openid offline_access",
+          grant_types: "#{Rodauth::CibaSupport::GRANT_TYPE} refresh_token",
+          id_token_encrypted_response_alg: algorithm, id_token_encrypted_response_enc: "A256GCM")
+        old_key, new_key = 2.times.map do
+          curve == "X25519" ? OpenSSL::PKey.generate_key("X25519") : curve ? OpenSSL::PKey::EC.generate("prime256v1") : OpenSSL::PKey::RSA.generate(2048)
+        end
+        jwk = lambda do |key, kid|
+          public_key = curve == "X25519" ?
+            {kty: "OKP", crv: curve, x: Base64.urlsafe_encode64(OpenSSL::ASN1.decode(key.public_to_der).value.last.value, padding: false)} :
+            JWT::JWK.new(curve ? key : key.public_key).export
+          public_key.merge(use: "enc", alg: algorithm, kid: kid)
+        end
+        state.merge!(keys: [jwk.call(old_key, "old")], status: 200, cache: "max-age=3600", body: nil)
+        app = CibaDemo.build(database)
+        app.plugin(:rodauth) do
+          oauth_jwt_access_tokens jwt
+          ciba_id_token_encryption_enabled true
+          ciba_refresh_tokens_enabled true
+          oauth_application_scopes %w[openid offline_access]
+          report_ciba_processing_error { |_error| }
+        end
+        issuer = "http://127.0.0.1:9292"
+        http = Rack::MockRequest.new(app)
+        metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+        auth = app.new(Rack::MockRequest.env_for(issuer)).rodauth
+        auth.send(:http_request_cache).uncache(URI(endpoint))
+        headers = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64('demo-client:demo-secret')}"}
+        post = ->(path, params) { http.post(path, headers.merge(params: params)) }
+        started = post.call(metadata.fetch("backchannel_authentication_endpoint"), scope: "openid offline_access", login_hint: "customer@example.test")
+        raise started.body unless started.status == 200
+        id = JSON.parse(started.body).fetch("auth_req_id")
+        row = database[:ciba_requests].first
+        auth.approve_ciba_request(row[:id], account_id: row[:account_id])
+        poll = -> { post.call(metadata.fetch("token_endpoint"), grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id) }
+        before = requests.length
+        denied = poll.call
+        raise "default encryption destination guard bypassed: #{denied.status}" unless denied.status == 500 && requests.length == before && database[:oauth_grants].count.zero?
+        raise "failed lookup consumed request" unless database[:ciba_requests].get(:status) == "approved"
+        app.plugin(:rodauth) { ciba_http_address_allowed? { |address| address == "127.0.0.1" } }
+        issued = poll.call
+        if untrusted
+          raise "untrusted encryption key TLS accepted" unless issued.status == 500 && requests.length == before && database[:oauth_grants].count.zero?
+          raise "untrusted lookup consumed request" unless database[:ciba_requests].get(:status) == "approved"
+          puts "PASS: installed HTTPS #{curve || "RSA"}/#{algorithm} encryption keys reject untrusted TLS, #{jwt ? 'JWT' : 'opaque'} mode"
+          next
+        end
+        verify = lambda do |response, key, kid|
+          raise response.body unless response.status == 200
+          tokens = JSON.parse(response.body)
+          encrypted = tokens.fetch("id_token")
+          raise "wrong recipient kid" unless JSON.parse(Base64.urlsafe_decode64(encrypted.split('.').first)).fetch("kid") == kid
+          signed = if curve
+            parts = encrypted.split(".", -1)
+            header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+            shared = key.derive(auth.send(:ciba_ecdh_public_key, header.fetch("epk")))
+            derived = auth.send(:ciba_ecdh_derived_key, shared, algorithm, "A256GCM")
+            cek = algorithm == "ECDH-ES" ? derived : JWE::Alg.decrypt_cek("A256KW", derived, Base64.urlsafe_decode64(parts[1]))
+            JWE::Enc.for("A256GCM", cek, Base64.urlsafe_decode64(parts[2]), Base64.urlsafe_decode64(parts[4]))
+              .decrypt(Base64.urlsafe_decode64(parts[3]), parts[0])
+          else
+            JWE.decrypt(encrypted, key)
+          end
+          public_keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+          claims, = JWT.decode(signed, nil, true, jwks: public_keys, algorithms: ["RS256"],
+            verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+          raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+          tokens
+        end
+        tokens = verify.call(issued, old_key, "old")
+        refresh = tokens.fetch("refresh_token")
+        renew = -> { post.call(metadata.fetch("token_endpoint"), grant_type: "refresh_token", refresh_token: refresh) }
+        state[:keys] = [jwk.call(new_key, "new")]
+        cached_requests = requests.length
+        verify.call(renew.call, old_key, "old")
+        raise "live cache unexpectedly refreshed" unless requests.length == cached_requests
+        auth.send(:http_request_cache).uncache(URI(endpoint))
+        state[:cache] = "no-cache"
+        verify.call(renew.call, new_key, "new")
+        source = database[:ciba_refresh_tokens].where(token_digest: Digest::SHA256.hexdigest(refresh))
+        source.update(issued_at: Time.now.to_i - 800, expires_at: Time.now.to_i + 200)
+        count = database[:oauth_grants].count
+        auth.send(:http_request_cache).uncache(URI(endpoint))
+        [[503, nil], [200, "invalid JSON"]].each do |status, body|
+          state[:status], state[:body] = status, body
+          failed = renew.call
+          raise "recipient failure returned token" unless failed.status == 500
+          raise "recipient failure consumed refresh" unless source.get(:consumed_at).nil? && database[:oauth_grants].count == count && database[:ciba_refresh_tokens].count == 1
+        end
+        state[:status], state[:body] = 200, nil
+        recovered = verify.call(renew.call, new_key, "new")
+        raise "refresh did not rotate after recovery" if recovered.fetch("refresh_token") == refresh || source.get(:consumed_at).nil?
+        raise "JWKS credential forwarded" unless requests.drop(before).all? { |entry| entry == ["GET", nil] }
+        puts "PASS: installed HTTPS #{curve || "RSA"}/#{algorithm} encryption key cache/rotation, 503/malformed rollback and recovery, #{jwt ? 'JWT' : 'opaque'} mode"
+      ensure
+        database.disconnect
+      end
+    end
+  end
+end