rodauth-ciba 0.1.0

data/examples/registration_smoke.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+# Installed-artifact check, using only local synthetic identities/credentials.
+require "rack/mock"
+require "json"
+require "base64"
+require_relative "demo_app"
+
+db = Sequel.sqlite
+CibaDemo.create_schema(db)
+db.alter_table(:oauth_applications) do
+  add_column :name, String
+  add_column :redirect_uri, String, text: true
+  add_column :response_types, String
+  add_column :registration_access_token, String
+end
+Rodauth::CibaSupport::Schema.add_registration_token_digest(db)
+app = CibaDemo.build(db)
+app.plugin(:rodauth) do
+  enable :oauth_dynamic_client_registration
+  ciba_dynamic_client_registration_enabled true
+  before_register do
+    authorization_required unless request.env["HTTP_AUTHORIZATION"] == "Bearer local-registration-fixture"
+  end
+end
+app.route do |r|
+  rodauth.load_openid_configuration_route
+  r.rodauth
+  rodauth.load_registration_client_uri_routes
+end
+http = Rack::MockRequest.new(app)
+issuer = "http://127.0.0.1:9292"
+metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+params = {grant_types: [Rodauth::CibaSupport::GRANT_TYPE], response_types: [],
+  scope: "openid", token_endpoint_auth_method: "client_secret_basic",
+  backchannel_token_delivery_mode: "poll"}
+response = http.post(metadata.fetch("registration_endpoint"),
+  "HTTP_AUTHORIZATION" => "Bearer local-registration-fixture",
+  "CONTENT_TYPE" => "application/json", input: JSON.generate(params))
+raise response.body unless response.status == 201
+client = JSON.parse(response.body)
+credentials = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64("#{client.fetch('client_id')}:#{client.fetch('client_secret')}")}"}
+response = http.post(metadata.fetch("backchannel_authentication_endpoint"),
+  credentials.merge(params: {scope: "openid", login_hint: "customer@example.test"}))
+raise response.body unless response.status == 200
+id = JSON.parse(response.body).fetch("auth_req_id")
+instance = app.new(Rack::MockRequest.env_for(issuer)).rodauth
+request = instance.ciba_request(db[:ciba_requests].get(:id))
+grant = instance.create_ciba_grant(account_id: request[:account_id],
+  oauth_application_id: request[:oauth_application_id], scopes: request[:scopes])
+instance.backchannel_result(request[:id], grant)
+response = http.post(metadata.fetch("token_endpoint"), credentials.merge(
+  params: {grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id}))
+raise response.body unless response.status == 200
+keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+JWT.decode(JSON.parse(response.body).fetch("id_token"), nil, true, jwks: keys,
+  algorithms: ["RS256"], verify_iss: true, iss: issuer, verify_aud: true, aud: client.fetch("client_id"))
+
+uri = client.fetch("registration_client_uri")
+bearer = {"HTTP_AUTHORIZATION" => "Bearer #{client.fetch('registration_access_token')}"}
+raise "management read failed" unless http.get(uri, bearer).status == 200
+response = http.put(uri, bearer.merge("CONTENT_TYPE" => "application/json",
+  input: JSON.generate(params.merge(client_id: client.fetch("client_id"), client_name: "Updated fixture"))))
+raise response.body unless response.status == 200
+updated = JSON.parse(response.body)
+raise "credential not rotated" if updated.fetch("registration_access_token") == client.fetch("registration_access_token")
+raise "old credential accepted" unless http.get(uri, bearer).status == 401
+bearer = {"HTTP_AUTHORIZATION" => "Bearer #{updated.fetch('registration_access_token')}"}
+raise "delete failed" unless http.delete(uri, bearer).status == 204
+raise "client retained" if db[:oauth_applications].where(client_id: client.fetch("client_id")).first
+raise "issued grant retained" unless db[:oauth_grants].empty?
+raise "unrelated client removed" unless db[:oauth_applications].where(client_id: "demo-client").first
+puts "PASS: installed-gem dynamic registration, verified CIBA issuance, management rotation and dependent deletion"
+db.disconnect

data/examples/server.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+require "tmpdir"
+require "rackup/handler/webrick"
+require_relative "demo_app"
+
+Dir.mktmpdir("ciba-demo-") do |directory|
+  db = Sequel.sqlite(File.join(directory, "demo.db"))
+  CibaDemo.create_schema(db)
+  begin
+    Rackup::Handler::WEBrick.run(CibaDemo.build(db), Host: "127.0.0.1", Port: 9292)
+  ensure
+    db.disconnect
+  end
+end

data/examples/smoke.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+# Runs from an installed gem without loading the repository's lib directory.
+require "rack/mock"
+require "json"
+require_relative "demo_app"
+db = Sequel.sqlite
+CibaDemo.create_schema(db)
+app = CibaDemo.build(db)
+http = Rack::MockRequest.new(app)
+issuer = "http://127.0.0.1:9292"
+headers = {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64('demo-client:demo-secret')}"}
+metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+response = http.post(metadata.fetch("backchannel_authentication_endpoint"), headers.merge(params: {scope: "openid", login_hint: "customer@example.test"}))
+raise response.body unless response.status == 200
+id = JSON.parse(response.body).fetch("auth_req_id")
+instance = app.new(Rack::MockRequest.env_for(issuer)).rodauth
+request = instance.ciba_request(db[:ciba_requests].get(:id))
+consent = instance.create_ciba_grant(account_id: request[:account_id],
+  oauth_application_id: request[:oauth_application_id], scopes: request[:scopes])
+instance.backchannel_result(request[:id], consent)
+response = http.post(metadata.fetch("token_endpoint"), headers.merge(params: {grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id}))
+raise response.body unless response.status == 200
+tokens = JSON.parse(response.body)
+keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+claims, = JWT.decode(tokens.fetch("id_token"), nil, true, jwks: keys, algorithms: ["RS256"], verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+raise "wrong subject" unless claims["sub"] == db[:accounts].get(:id).to_s
+raise "unexpected refresh token" if tokens.key?("refresh_token")
+raise "wrong consent reference" unless db[:oauth_grants].get(:ciba_grant_id) == consent[:id]
+replay = http.post(metadata.fetch("token_endpoint"), headers.merge(params: {grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: id}))
+raise "request reused" unless replay.status == 400 && JSON.parse(replay.body)["error"] == "invalid_grant"
+raise "replay did not revoke token" unless db[:oauth_grants].get(:revoked_at)
+instance.revoke_ciba_grant(consent[:id])
+raise "token not revoked" unless db[:oauth_grants].get(:revoked_at)
+puts "PASS: installed-gem discovery, acceptance, saved consent/result API, poll, verified ID Token, replay rejection and revocation"
+response = http.post(metadata.fetch("backchannel_authentication_endpoint"), headers.merge(params: {scope: "openid", login_hint: "customer@example.test"}))
+raise response.body unless response.status == 200
+failed_id = JSON.parse(response.body).fetch("auth_req_id")
+instance.backchannel_result(db[:ciba_requests].order(:id).last[:id],
+  Rodauth::CibaSupport::ProtocolError.new("application_failure"))
+%w[application_failure invalid_grant].each do |expected|
+  result = http.post(metadata.fetch("token_endpoint"), headers.merge(params: {grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: failed_id}))
+  raise result.body unless result.status == 400 && JSON.parse(result.body)["error"] == expected
+end
+raise "failure issued a token" unless db[:oauth_grants].count == 1
+puts "PASS: installed-gem custom completion error returned once without token issuance"
+db.disconnect

data/examples/symmetric_id_token_smoke.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+require "rack/mock"
+require "json"
+require_relative "demo_app"
+
+[false, true].product([false, true]).each do |jwt, hashed|
+  database = Sequel.sqlite
+  begin
+    CibaDemo.create_schema(database)
+    Rodauth::CibaSupport::Schema.create_refresh_tokens(database)
+    database.alter_table(:oauth_applications) do
+      add_column :id_token_encrypted_response_alg, String
+      add_column :id_token_encrypted_response_enc, String
+      add_column :jwks_uri, String
+    end
+    secret = "c" * 64
+    database[:oauth_applications].update(scopes: "openid offline_access",
+      grant_types: "#{Rodauth::CibaSupport::GRANT_TYPE} refresh_token",
+      token_endpoint_auth_method: hashed ? "client_secret_basic" : "client_secret_post",
+      client_secret: hashed ? BCrypt::Password.create(secret, cost: 4).to_s : secret,
+      jwks_uri: "https://unused.invalid/jwks")
+    app = CibaDemo.build(database)
+    app.plugin(:rodauth) do
+      base_url "https://op.example.test"
+      authorization_server_url "https://op.example.test"
+      ciba_require_tls true
+      oauth_jwt_access_tokens jwt
+      ciba_refresh_tokens_enabled true
+      oauth_application_scopes %w[openid offline_access]
+      ciba_id_token_encryption_enabled true
+      oauth_applications_client_secret_hash_column(hashed ? :client_secret : nil)
+      http_request { |*| raise "unexpected recipient HTTP request" }
+    end
+    http = Rack::MockRequest.new(app)
+    issuer = "https://op.example.test"
+    metadata = JSON.parse(http.get("#{issuer}/.well-known/openid-configuration").body)
+    keys = JSON.parse(http.get(metadata.fetch("jwks_uri")).body)
+    post = lambda do |endpoint, params|
+      headers = hashed ? {"HTTP_AUTHORIZATION" => "Basic #{Base64.strict_encode64("demo-client:#{secret}")}"} : {}
+      params = params.merge(client_id: "demo-client", client_secret: secret) unless hashed
+      response = http.post(endpoint, headers.merge(params: params))
+      raise response.body unless response.status == 200
+      JSON.parse(response.body)
+    end
+    %w[dir A128KW A192KW A256KW A128GCMKW A192GCMKW A256GCMKW].each do |algorithm|
+      raise "missing Discovery algorithm" unless metadata.fetch("id_token_encryption_alg_values_supported").include?(algorithm)
+      method = "A256CBC-HS512"
+      database[:oauth_applications].update(id_token_encrypted_response_alg: algorithm, id_token_encrypted_response_enc: method)
+      started = post.call(metadata.fetch("backchannel_authentication_endpoint"), scope: "openid offline_access", login_hint: "customer@example.test")
+      row = database[:ciba_requests].order(:id).last
+      app.new(Rack::MockRequest.env_for(issuer)).rodauth.approve_ciba_request(row[:id], account_id: row[:account_id])
+      initial = post.call(metadata.fetch("token_endpoint"), grant_type: Rodauth::CibaSupport::GRANT_TYPE, auth_req_id: started.fetch("auth_req_id"))
+      renewed = post.call(metadata.fetch("token_endpoint"), grant_type: "refresh_token", refresh_token: initial.fetch("refresh_token"))
+      length = algorithm == "dir" ? 64 : algorithm[/\d+/].to_i / 8
+      key = OpenSSL::Digest.digest(length > 32 ? "SHA512" : "SHA256", secret)[0, length]
+      [initial, renewed].each do |tokens|
+        token = tokens.fetch("id_token")
+        signed = if algorithm.end_with?("GCMKW")
+          parts = token.split(".")
+          header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+          raise "wrong key algorithm" unless header.fetch("alg") == algorithm
+          wrapper = OpenSSL::Cipher.new("aes-#{length * 8}-gcm")
+          wrapper.decrypt
+          wrapper.key = key
+          wrapper.iv = Base64.urlsafe_decode64(header.fetch("iv"))
+          wrapper.auth_tag = Base64.urlsafe_decode64(header.fetch("tag"))
+          wrapper.auth_data = ""
+          cek = wrapper.update(Base64.urlsafe_decode64(parts[1])) + wrapper.final
+          JWE::Enc.for(method, cek, Base64.urlsafe_decode64(parts[2]), Base64.urlsafe_decode64(parts[4]))
+            .decrypt(Base64.urlsafe_decode64(parts[3]), parts[0])
+        else
+          JWE.decrypt(token, key)
+        end
+        claims, = JWT.decode(signed, nil, true, jwks: keys, algorithms: ["RS256"],
+          verify_iss: true, iss: issuer, verify_aud: true, aud: "demo-client")
+        raise "wrong subject" unless claims.fetch("sub") == row[:account_id].to_s
+      end
+      puts "PASS: installed #{algorithm}/#{method}, #{hashed ? 'hashed Basic' : 'plaintext POST'}, #{jwt ? 'JWT' : 'opaque'}; initial/refresh decrypted and signatures verified; no remote recipient lookup"
+    end
+  ensure
+    database.disconnect
+  end
+end

data/lib/rodauth/ciba/authorization_details.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+require "json"
+
+module Rodauth
+  module CibaSupport
+    # Structural validation only. Type registration, client eligibility and
+    # permission narrowing belong to the application/protocol integration.
+    module AuthorizationDetails
+      class Invalid < ArgumentError; end
+
+      ARRAY_FIELDS = %w[locations actions datatypes privileges].freeze
+      MAX_BYTES = 8192
+      MAX_ENTRIES = 32
+      MAX_NESTING = 10
+
+      def self.parse(json)
+        unless json.is_a?(String) && json.bytesize <= MAX_BYTES
+          raise Invalid, "invalid authorization-details JSON"
+        end
+        json = json.dup.force_encoding(Encoding::UTF_8)
+        raise Invalid, "invalid authorization-details encoding" unless json.valid_encoding?
+        data = immutable(JSON.parse(json, max_nesting: MAX_NESTING, allow_duplicate_key: false))
+        unless data.is_a?(Array) && data.size <= MAX_ENTRIES
+          raise Invalid, "authorization details must be a bounded array"
+        end
+        data.each do |detail|
+          unless detail.is_a?(Hash) && nonempty_string?(detail["type"])
+            raise Invalid, "authorization detail must have a type"
+          end
+          ARRAY_FIELDS.each do |field|
+            next unless detail.key?(field)
+            values = detail[field]
+            unless values.is_a?(Array) && values.all? { |value| nonempty_string?(value) }
+              raise Invalid, "invalid authorization-details array field"
+            end
+          end
+          if detail.key?("identifier") && !nonempty_string?(detail["identifier"])
+            raise Invalid, "invalid authorization-details identifier"
+          end
+        end
+        data
+      rescue JSON::ParserError
+        raise Invalid, "invalid authorization-details JSON"
+      end
+
+      def self.nonempty_string?(value)
+        value.is_a?(String) && !value.empty?
+      end
+
+      def self.immutable(value)
+        case value
+        when Hash then value.to_h { |key, item| [key.freeze, immutable(item)] }.freeze
+        when Array then value.map { |item| immutable(item) }.freeze
+        else value.freeze
+        end
+      end
+      private_class_method :nonempty_string?, :immutable
+    end
+  end
+end

data/lib/rodauth/ciba/dpop.rb

@@ -0,0 +1,250 @@
+# frozen_string_literal: true
+
+module Rodauth
+  module CibaSupport
+    # CIBA token and UserInfo proof boundary. External resource servers still
+    # need their own validation of access-token signatures and sender binding.
+    module Dpop
+      private
+
+      def ciba_dpop_userinfo_candidate?(token)
+        return false unless token.is_a?(String)
+        return true if token.start_with?("ciba_at_")
+        return false if token.bytesize > 8192
+        if token.count(".") == 2
+          claims = JWT::EncodedToken.new(token).unverified_payload
+          # Unverified claims select a stricter path only. Signature, expiry,
+          # client, subject and stored grant checks still precede authorization.
+          return claims.is_a?(Hash) && claims.key?("urn:rodauth:ciba:token_id")
+        end
+        return false if token.bytesize > 1024
+        column = oauth_grants_token_hash_column || oauth_grants_token_column
+        value = oauth_grants_token_hash_column ? generate_token_hash(token) : token
+        db[oauth_grants_table].where(column => value, oauth_grants_type_column => GRANT_TYPE).any?
+      rescue JWT::DecodeError
+        false
+      end
+
+      def ciba_dpop_protected_request?
+        @ciba_dpop_userinfo || ciba_dpop_token_request?
+      end
+
+      def ciba_dpop_error(code = "invalid_dpop_proof")
+        if @ciba_dpop_userinfo
+          response["WWW-Authenticate"] = "DPoP error=\"#{code}\""
+          ciba_error(code, 401)
+        end
+        ciba_error(code)
+      end
+
+      def decode_access_token(token = fetch_access_token)
+        return super unless @ciba_dpop_userinfo
+        decoded = oauth_jwt_access_tokens ? super : oauth_grant_by_token(token)
+        ciba_dpop_error("invalid_token") unless decoded
+        if decoded[oauth_grants_type_column] == GRANT_TYPE && decoded[oauth_grants_dpop_jkt_column]
+          decoded = decoded.merge("cnf" => {"jkt" => decoded[oauth_grants_dpop_jkt_column]})
+        end
+        decoded
+      end
+
+      def valid_oauth_grant_ds(grant_params = nil)
+        return super unless @ciba_dpop_userinfo || @ciba_dpop_userinfo_checked
+        # Upstream's OR thumbprint filter widens the complete predicate. Keep
+        # revocation, expiration, identity and key binding conjunctive here.
+        ds = db[oauth_grants_table].where(oauth_grants_revoked_at_column => nil,
+          oauth_grants_type_column => GRANT_TYPE,
+          oauth_grants_dpop_jkt_column => @dpop_thumbprint)
+          .where(Sequel.expr(Sequel[oauth_grants_expires_in_column]) >= Sequel::CURRENT_TIMESTAMP)
+        ds = ds.where(grant_params) if grant_params
+        ds = ds.where(oauth_grants_id_column => @ciba_userinfo_grant_id) if @ciba_userinfo_grant_id
+        ds
+      end
+
+      def oauth_grant_by_token_ds(token)
+        if features.include?(:oauth_dpop) && features.include?(:oauth_token_introspection) &&
+            request.path == introspect_path && ciba_dpop_userinfo_candidate?(token)
+          # Authenticated introspection reports binding to the caller; it is not
+          # a resource request proving possession of the access token's key.
+          column = oauth_grants_token_hash_column || oauth_grants_token_column
+          value = oauth_grants_token_hash_column ? generate_token_hash(token) : token
+          return db[oauth_grants_table].where(column => value,
+            oauth_grants_type_column => GRANT_TYPE, oauth_grants_revoked_at_column => nil)
+            .where(Sequel.expr(Sequel[oauth_grants_expires_in_column]) >= Sequel::CURRENT_TIMESTAMP)
+        end
+        return super unless @ciba_dpop_userinfo || @ciba_dpop_userinfo_checked
+        column = oauth_grants_token_hash_column || oauth_grants_token_column
+        value = oauth_grants_token_hash_column ? generate_token_hash(token) : token
+        valid_oauth_grant_ds.where(column => value)
+      end
+
+      def json_token_introspect_payload(grant)
+        super.tap do |payload|
+          if features.include?(:oauth_dpop) && payload[:active] &&
+              grant && grant[oauth_grants_type_column] == GRANT_TYPE &&
+              (jkt = grant[oauth_grants_dpop_jkt_column])
+            payload[:cnf] = {jkt: jkt}
+            payload[:token_type] = "DPoP"
+          end
+        end
+      end
+
+      def authorization_token
+        return super if @ciba_dpop_userinfo_checked
+        return super unless features.include?(:oauth_dpop) && request.path == userinfo_path
+        access = fetch_access_token_from_authorization_header("dpop") || fetch_access_token
+        return super unless ciba_dpop_userinfo_candidate?(access)
+        @ciba_dpop_userinfo = true
+        ciba_dpop_error("invalid_token") if access.bytesize > 8192
+        @dpop_access_token = fetch_access_token_from_authorization_header("dpop")
+        if @dpop_access_token
+          validate_dpop_token(fetch_dpop_token)
+          validate_ath(@dpop_claims, access)
+          @authorization_token = decode_access_token(access)
+        end
+        token = super
+        ciba_dpop_error("invalid_token") unless token
+        if @dpop_access_token
+          stored_jkt = db[oauth_grants_table].where(oauth_grants_id_column => @ciba_userinfo_grant_id)
+            .get(oauth_grants_dpop_jkt_column)
+          ciba_dpop_error("invalid_token") unless token["cnf"].is_a?(Hash) &&
+            token["cnf"]["jkt"] == @dpop_thumbprint && stored_jkt == @dpop_thumbprint
+          ciba_claim_dpop_proof!(token.fetch("client_id"))
+        elsif token[oauth_grants_dpop_jkt_column] || token.dig("cnf", "jkt")
+          ciba_dpop_error("invalid_token")
+        end
+        @ciba_dpop_userinfo_checked = true
+        token
+      rescue Sequel::UniqueConstraintViolation
+        raise unless @ciba_dpop_userinfo
+        ciba_dpop_error("invalid_token")
+      ensure
+        @ciba_dpop_userinfo = false
+      end
+
+      def validate_ath(claims, access_token)
+        return super unless @ciba_dpop_userinfo
+        expected = Base64.urlsafe_encode64(Digest::SHA256.digest(access_token), padding: false)
+        ciba_dpop_error("invalid_token") unless claims["ath"] == expected
+      end
+
+      def ciba_dpop_token_request?
+        features.include?(:oauth_dpop) && request.path == token_path &&
+          (param("grant_type") == GRANT_TYPE || ciba_refresh_request?)
+      end
+
+      def validate_token_params
+        if ciba_dpop_token_request? && !fetch_dpop_token && dpop_bound_access_tokens_required?
+          ciba_error("invalid_grant")
+        end
+        super
+      end
+
+      def dpop_use_nonce?
+        return super unless ciba_dpop_protected_request?
+        oauth_dpop_use_nonce
+      end
+
+      def ciba_dpop_nonce_for(step)
+        bytes = OpenSSL::KDF.hkdf(ciba_dpop_nonce_secret, salt: [step].pack("Q>"),
+          info: "DPoP", length: 32, hash: "SHA256")
+        Base64.urlsafe_encode64(bytes, padding: false)
+      end
+
+      def validate_nonce(claims)
+        return super unless ciba_dpop_protected_request?
+        @ciba_dpop_nonce_verified = false
+        nonce = claims["nonce"]
+        ciba_dpop_error if claims.key?("nonce") && !nonce.is_a?(String)
+        step = ciba_now / 60
+        next_nonce = ciba_dpop_nonce_for(step + 1) if ciba_dpop_nonce_secret
+        challenge = lambda do
+          response["DPoP-Nonce"] = next_nonce
+          ciba_dpop_error("use_dpop_nonce")
+        end
+        if nonce && !nonce.empty?
+          ciba_dpop_error unless next_nonce
+          valid = nonce.bytesize == 43 && (-2..2).map do |offset|
+            OpenSSL.fixed_length_secure_compare(ciba_dpop_nonce_for(step + offset), nonce)
+          end.reduce(false, :|)
+          challenge.call unless valid
+          @ciba_dpop_nonce_verified = true
+        else
+          if (ciba_now - claims.fetch("iat")).abs > 300
+            challenge.call if next_nonce
+            ciba_dpop_error
+          end
+          challenge.call if dpop_use_nonce?
+        end
+        response["DPoP-Nonce"] = next_nonce if next_nonce && nonce != next_nonce
+      end
+
+      def dpop_decode(proof)
+        return super unless ciba_dpop_protected_request?
+        ciba_dpop_error unless proof.is_a?(String) && proof.bytesize <= 8192
+        header = JWT::EncodedToken.new(proof).header
+        unless header.is_a?(Hash) && header["jwk"].is_a?(Hash) && !header.key?("crit") &&
+            verify_dpop_jwt_headers(header)
+          ciba_dpop_error
+        end
+        # The generic OP decoder applies its issuer-token iat policy. Proof
+        # freshness has its own window, checked below, including future iat.
+        claims, = JWT.decode(proof, jwk_key(header["jwk"]), true,
+          algorithms: [header["alg"]], verify_iat: false)
+        claims
+      rescue JWT::DecodeError, JWT::JWKError, ArgumentError, TypeError, OpenSSL::PKey::PKeyError
+        raise unless ciba_dpop_protected_request?
+        ciba_dpop_error
+      end
+
+      def validate_dpop_jwt_claims(claims)
+        return super unless ciba_dpop_protected_request?
+        iat, jti = claims.values_at("iat", "jti")
+        unless iat.is_a?(Numeric) && iat.finite? && !iat.zero? &&
+            jti.is_a?(String) && !jti.empty? && jti.bytesize <= 1024 &&
+            claims["htm"] == request.request_method
+          ciba_dpop_error
+        end
+        uri = URI.parse(claims["htu"]) if claims["htu"].is_a?(String)
+        ciba_dpop_error unless uri.is_a?(URI::HTTP) && uri.host && !uri.userinfo
+        uri.query = uri.fragment = nil
+        # Bind the proof to the endpoint actually reached, including an
+        # application-owned alias, rather than the canonical issuer's URL.
+        expected = URI.parse(ciba_dpop_endpoint_uri)
+        expected.query = expected.fragment = nil
+        ciba_dpop_error unless uri.normalize == expected.normalize
+      rescue URI::InvalidURIError
+        raise unless ciba_dpop_protected_request?
+        ciba_dpop_error
+      end
+
+      def validate_dpop_proof_usage(claims)
+        return super unless ciba_dpop_protected_request?
+        # Pending polls do not reserve proofs. Issuance claims inside its token
+        # transaction; UserInfo claims after token provenance and key checks.
+      end
+
+      def generate_token(grant_params = {}, should_generate_refresh_token = true)
+        if ciba_dpop_token_request? && @dpop_claims
+          begin
+            ciba_claim_dpop_proof!(oauth_application[oauth_applications_client_id_column])
+          rescue Sequel::UniqueConstraintViolation
+            # Raise through the outer token transaction, preserving approval
+            # on rejection instead of committing a partially consumed request.
+            raise ProtocolError, "invalid_grant"
+          end
+        end
+        super
+      end
+
+      def ciba_claim_dpop_proof!(client_id)
+        digest = Digest::SHA256.hexdigest(JSON.generate(["ciba_dpop", client_id, @dpop_claims.fetch("jti")]))
+        # A valid server nonce replaces the proof iat as freshness evidence.
+        # An ancient iat must never cause immediate replay-ledger cleanup.
+        expires_at = @ciba_dpop_nonce_verified ? ciba_now + 301 : (@dpop_claims.fetch("iat") + 300).ceil + 1
+        ciba_transaction do
+          db[ciba_client_assertions_table].insert(digest: digest, expires_at: expires_at)
+        end
+      end
+    end
+  end
+end

data/lib/rodauth/ciba/http.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+require "ipaddr"
+require "net/http"
+require "socket"
+require "timeout"
+
+module Rodauth
+  module CibaSupport
+    module HTTP
+      class Error < StandardError; end
+      # Based on the reference provider's special-use ranges; also block multicast
+      # and IPv4-compatible IPv6. IPAddr handles mapped addresses without text tricks.
+      BLOCKED = %w[
+        0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16
+        172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.31.196.0/24
+        192.52.193.0/24 192.88.99.0/24 192.168.0.0/16 192.175.48.0/24
+        198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
+        ::/96 64:ff9b::/96 64:ff9b:1::/48 100::/64 100:0:0:1::/64
+        2001::/23 2001:db8::/32 2002::/16 2620:4f:8000::/48 3fff::/20
+        5f00::/16 fc00::/7 fe80::/10 ff00::/8
+      ].map { |range| IPAddr.new(range) }.freeze
+      TIMEOUT = 2.5
+      MAX_BODY_BYTES = 65_536
+
+      def self.public_address?(address)
+        return false unless address.is_a?(String) && !address.include?("%") && !address.include?("/")
+        ip = IPAddr.new(address)
+        ip = ip.native if ip.ipv4_mapped?
+        BLOCKED.none? { |range| range.include?(ip) }
+      rescue IPAddr::InvalidAddressError
+        false
+      end
+
+      def self.request(uri, request, address_allowed: method(:public_address?), read_body: true)
+        uri = URI(uri.to_s)
+        unless %w[http https].include?(uri.scheme) && uri.hostname && !uri.hostname.empty? && !uri.userinfo && !uri.fragment
+          raise Error, "invalid outbound URI"
+        end
+        Timeout.timeout(TIMEOUT) do
+          addresses = Addrinfo.getaddrinfo(uri.hostname, uri.port, nil, :STREAM).map(&:ip_address).uniq
+          raise Error, "outbound address rejected" if addresses.empty? || addresses.any? { |address| address_allowed.call(address) != true }
+          # Disable ambient proxies: otherwise the validated IP would not be the peer.
+          http = Net::HTTP.new(uri.hostname, uri.port, nil)
+          http.ipaddr = addresses.first
+          http.use_ssl = uri.scheme == "https"
+          http.open_timeout = http.read_timeout = http.write_timeout = TIMEOUT
+          result = nil
+          http.start do |connection|
+            connection.request(request) do |response|
+              # Nonlocal return unwinds Net::HTTP.start's ensure and closes the
+              # socket without its normal implicit response-body drain.
+              return response unless read_body
+              body = +""
+              response.read_body do |chunk|
+                raise Error, "outbound response too large" if body.bytesize + chunk.bytesize > MAX_BODY_BYTES
+                body << chunk
+              end
+              response.body = body
+              result = response
+            end
+          end
+          result
+        end
+      rescue URI::InvalidURIError
+        raise Error, "invalid outbound URI"
+      end
+    end
+  end
+end