strongroom-rails 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d266097d730b4561dc0e197cbfb8cb6811626b1cfea5defd21b7f018f0e39ed0
-  data.tar.gz: efc7b6166160438836119409e1c836179daa40b33913dbe4f6a9464eff9f53d3
+  metadata.gz: 2313700e0514a62dbf3f58e5f541e0c4421f4c034a8220840cd9ca243d05b816
+  data.tar.gz: 5530d843f7630a021488e36bcc230bdfd9d1137f3aec6c5a1dd8d233c3a9b09f
 SHA512:
-  metadata.gz: d9200dd2cdf23a5822286500ee92e35c254d824a2d910c8039df5bfdab0f05402a51ed2dc6e601a7069db72584353d0e8a05681d2ff4b223b4040cd15f8ab6fe
-  data.tar.gz: c109f7251482e29b24b2349ff5cce04958207eaca352d90d5a7b0311d38ca0abc7e55a763e5ec7f25309b323ee092ae8b3e6b415ac675322803e12da3cc5727b
+  metadata.gz: 5b77a81722924260a13456a6416012c2670dafe0360cb8932f21c8fd3250301a50564fd7d86e7c26425e741b5fd781a08b694a812357afece92dec857570b881
+  data.tar.gz: fce5256ee8f35e3f44e70165c0615a0d5c3a0ddc61b05d5b976cf7918368f425d0b0ef026d7009fb1c7a44a733bb0b36f8849b56eda5ee73b5cb32c2b25b4127

data/CHANGELOG.md

@@ -1 +1,17 @@
 # Changelog
+
+## [0.3.0](https://github.com/seuros/strongroom/compare/strongroom-rails-v0.2.0...strongroom-rails-v0.3.0) (2026-10-25)
+
+
+### Features
+
+* add password recovery links and self-service password change ([b4f9160](https://github.com/seuros/strongroom/commit/b4f9160b352fb0122086c57a56c701ddb29b461a))
+
+## [0.2.0](https://github.com/seuros/strongroom/compare/strongroom-rails-v0.1.0...strongroom-rails/v0.2.0) (2026-10-25)
+
+
+### Features
+
+* add self-service registration, email verification links, an unverified-login grace policy and an event feed ([b39e976](https://github.com/seuros/strongroom/commit/b39e976600085752350b333a3c82a00e4a0493bf))
+
+## Changelog

data/README.md

@@ -1,9 +1,10 @@
-# strongroom-rails — existing-user login adapter
+# strongroom-rails — login and registration adapter
 
 Rails adapter for [Strongroom](https://github.com/seuros/strongroom), a Postgres-first authentication kernel
 that acts as your application's security coprocessor: Rails never sees password
-hashes or session secrets. Registration, MFA, JWT minting and automatic routes
-are deliberately absent.
+hashes or session secrets. Registration and recovery links go through the
+kernel's service API from your server; MFA, JWT minting, mail and automatic
+routes are deliberately absent.
 
 > **Status: pre-production.** Strongroom has not been audited and is not approved
 > for production traffic or real credential imports.
@@ -30,6 +31,11 @@ Requires Ruby **4.0+** and Rails **8.1+** (currently Rails 8.x).
 - [x] Request-level resolver and an optional Warden strategy.
 - [x] Trusted subject resolution into an allowlisted local model/table, followed by
   an application-supplied active/confirmed/MFA/cohort eligibility check.
+- [x] Registration, verification links and the account event feed through the
+  kernel's service listener, with the namespace's service key (see
+  [Registration](#registration)). Sessions report `identity_verified`.
+- [x] Self-service password change and password recovery links (see
+  [Password change and recovery](#password-change-and-recovery)).
 
 It never finds users by email, creates local accounts, dynamically constantizes
 table names, overrides `current_user`, installs routes or falls back to legacy
@@ -99,7 +105,10 @@ authenticate (for example an asset build without credentials) can opt out with
 Add additional `Account` objects to the registry for other approved namespaces.
 At most 16 are supported; names, tables and same-issuer audiences must be distinct.
 Pass actual model classes, never class names from parameters/configuration.
-`register` defaults false; true records future policy only and adds no route.
+`register` defaults false; `register: true` needs a client configured with
+`service_endpoint:` and `service_key:` and enables `register_account` and
+`issue_verification` on the account; `issue_recovery` and `events` need only
+the service key. The gem still installs no route.
 
 Controllers opt in explicitly and keep their own frontend response contract:
 
@@ -281,6 +290,198 @@ sent on a connection the server then dropped raises `Unavailable`. Pools are
 per process; a forked child never touches its parent's sockets. Call
 `transport.close` to drop idle connections at shutdown.
 
+## Registration
+
+The kernel serves registration on its service listener (`server.service_listen`,
+loopback or a private network), authenticated by the namespace's service key.
+Give the client both; the key never appears in `inspect`, `pp` or YAML:
+
+```ruby
+client = Strongroom::Client.new(
+  endpoint: ENV.fetch("STRONGROOM_ENDPOINT"), issuer: "https://auth.example.com", namespace: "users",
+  org_id: ENV.fetch("STRONGROOM_USERS_ORG_ID"), app_id: ENV.fetch("STRONGROOM_USERS_APP_ID"),
+  service_endpoint: ENV.fetch("STRONGROOM_SERVICE_ENDPOINT"), service_key: ENV.fetch("STRONGROOM_USERS_SERVICE_KEY")
+)
+users = Strongroom::Rails::Account.new(client: client, table: "users", model: User, register: true,
+  resolve: ..., eligible: ...)
+
+registration = users.register_account(external_id: user.id.to_s, identity: params[:email],
+  password: params[:password])
+registration.created   # false for a replay of the same external_id and address
+VerificationMailer.with(user: user).confirm.deliver_later   # the user, never the token
+```
+
+Issue the link where the mail is built, so the token never becomes a job
+argument (ActiveJob stores and logs those):
+
+```ruby
+class VerificationMailer < ApplicationMailer
+  def confirm
+    user = params.fetch(:user)
+    link = Rails.configuration.x.strongroom_accounts.fetch(:users)
+      .issue_verification(user_id: user.strongroom_user_id)
+    # The token goes in the fragment of a link to your own page: browsers never
+    # send a fragment, so neither your logs nor a Referer header see it.
+    @url = "https://app.example.com/email/confirm##{link.token.reveal}"
+    mail(to: user.email, subject: "Confirm your address")
+  end
+end
+```
+
+If the token must travel through a job, pass it only in an argument your own
+`ActiveJob::Serializers::ObjectSerializer` encrypts (with
+`ActiveSupport::MessageEncryptor`), or call `deliver_now` from the request.
+Never pass the URL or `link.token.reveal` to `deliver_later`.
+
+The page at `/email/confirm` shows a button; its click posts the fragment to
+the kernel's public listener (the gem does not proxy it). List the page's origin
+in the kernel's `[browser] allowed_origins`:
+
+```js
+await fetch(`${STRONGROOM_ORIGIN}/accounts/users/verify`, {
+  method: "POST",
+  headers: { "Content-Type": "application/json", "X-Strongroom-Request": "1" },
+  body: JSON.stringify({ token: location.hash.slice(1) }),
+}); // 200 {"status": "verified" | "already_verified"}, 400 {"error": "invalid_token", "reason": ...}
+```
+
+A mail scanner that fetches the link only fetches your page: nothing it sends
+verifies the address.
+
+- `register` (on the client; `register_account` on an account) creates the
+  account with an unverified email identity. Replaying the same `external_id`
+  and address returns the original receipt and changes nothing, before any
+  password check. It raises `Strongroom::BindingConflict` (the external ID is
+  bound to another address), `Strongroom::IdentityTaken` (another account holds
+  the address) or `Strongroom::InvalidPassword` with `reason` `too_short`,
+  `too_long` or `invalid`. `IdentityTaken` tells your server an address has an
+  account: do not tell the person signing up.
+- `cancel_registration(external_id:)` deletes a registration whose address was
+  never verified (a squatted address, a stale sign-up); the address and the
+  external ID are free again. It raises `Strongroom::AlreadyVerified`,
+  `Strongroom::IdentityDisabled`, `Strongroom::NotFound`, or `Strongroom::Busy`
+  while one of its sessions is mid-rotation (retry).
+- `issue_verification(user_id:)` returns a `Strongroom::Verification` whose
+  `token` is redacted everywhere and is never a session credential. Earlier
+  links stop working. It raises `Strongroom::AlreadyVerified` or
+  `Strongroom::NotFound`.
+- `events(after: nil, limit: 100)` returns a `Strongroom::EventPage` of
+  `Strongroom::Event`s (`Provision`, `Register`, `RegistrationCancel`,
+  `VerificationIssue`, `IdentityVerify`, `PasswordHashUpgrade`,
+  `PasswordReplace`, `Revoke`, `RecoveryIssue`, `RecoveryComplete`,
+  `PasswordChange`); keep `page.next` and pass it as `after:`.
+  `next` is `nil` for an empty page: ask again later with the cursor you have.
+  `page.oldest_at` is the oldest event the kernel still holds; if your last
+  event is older, retention pruned events you never read. `Strongroom::CursorAhead`
+  means the kernel's database is behind your cursor (restored or failed over):
+  drop the cursor and read from the start.
+- `Strongroom::Session#identity_verified` is `false` only for an unverified
+  identity inside the namespace's `unverified_grace_hours`; with the default of
+  `0` an unverified identity cannot log in at all.
+
+Service-key refusals raise `Strongroom::ProtocolError` (a deployment error, not
+a user's), rate limits `Strongroom::RateLimited`/`Busy` with `retry_after`. The
+Railtie maps `Conflict`s to 409, `InvalidPassword` to 422 and `NotFound` to 404.
+
+## Password change and recovery
+
+### Changing a password
+
+A signed-in user changes their password through your controller; the helper
+verifies mutation intent like the others, sends the request's session to the
+kernel and replaces the encrypted cookie with the session the kernel rotated
+onto the new password. The user stays signed in; every other session of theirs
+in the org ends, in every app.
+
+```ruby
+def update # POST; verified CSRF required.
+  user = strongroom_change_password(namespace: :users,
+    current_password: params.require(:current_password), new_password: params.require(:new_password))
+  render json: {id: user.id}
+end
+```
+
+A wrong current password raises `Strongroom::Unauthorized` (401) and changes
+nothing: the session keeps working. A refused new password raises
+`Strongroom::InvalidPassword` with `reason` `too_short`, `too_long` or
+`invalid` (422), before the current password is even checked. An unverified
+identity raises `Strongroom::IdentityUnverified` (409): nobody has proven they
+own the address, so its password proves nothing; have the user confirm it
+first. A session issued with a password the identity no longer logs in with
+raises `Strongroom::CredentialChanged` (409): sign in again. The kernel's
+per-user budget raises `Strongroom::RateLimited` (429). Add your own per-IP
+`rate_limit` too, as for logins. Recovery links the user asked for keep
+working after a change. `client.change_password(token:, current_password:,
+new_password:)` (or `account.change_password`) is the same call without the
+cookie: it returns the rotated `Strongroom::IssuedSession`, confirmed through
+`/me` like a rotation. If that confirmation fails after the kernel made the
+change, the rotated session is logged out before `ProtocolError` is raised:
+the new password is set, and the user signs in with it.
+
+### Recovering a password
+
+Any namespace whose client has `service_endpoint:` and `service_key:` can
+issue recovery links, for imported and registered accounts alike; `register:`
+is not needed. Ask for a link where the mail is built, never in the request
+that asked for it, and never hand the token to a job:
+
+```ruby
+class RecoveriesController < ApplicationController
+  rate_limit to: 5, within: 10.minutes, by: -> { request.remote_ip }, only: :create
+
+  def create # POST; the same answer whether or not the address has an account.
+    RecoveryMailer.with(email: params.require(:email)).reset.deliver_later # the address, never a token
+    head :accepted
+  end
+end
+
+class RecoveryMailer < ApplicationMailer
+  def reset
+    users = Rails.configuration.x.strongroom_accounts.fetch(:users)
+    link = users.issue_recovery(identity: params.fetch(:email))
+    # The fragment of a link to your own page: browsers never send it, so
+    # neither your logs nor a Referer header see the token.
+    @url = "https://app.example.com/password/reset##{link.token.reveal}"
+    mail(to: params.fetch(:email), subject: "Choose a new password")
+  rescue Strongroom::NotFound
+    # No usable account holds the address: without `mail`, nothing is sent.
+  end
+end
+```
+
+`issue_recovery(identity:)` returns a `Strongroom::Recovery` (`token`, a
+`Strongroom::RecoveryToken` redacted everywhere and never a session credential;
+`expires_at`, by default 30 minutes away; `user_id`). Earlier links of that
+address stop working. It raises `Strongroom::NotFound` when no usable account
+holds the address in the namespace: answer your users the same way either way,
+or the form tells anyone which addresses have accounts. If the token must
+travel through a job after all, only in an argument your own
+`ActiveJob::Serializers::ObjectSerializer` encrypts.
+
+The page at `/password/reset` asks for the new password and posts it with the
+fragment to the kernel's public listener (list the page's origin in its
+`[browser] allowed_origins`; the gem does not proxy it):
+
+```js
+const reply = await fetch(`${STRONGROOM_ORIGIN}/accounts/users/recovery`, {
+  method: "POST",
+  headers: { "Content-Type": "application/json", "X-Strongroom-Request": "1" },
+  body: JSON.stringify({ token: location.hash.slice(1), password: form.password.value }),
+}); // 200 {"status": "recovered"}; 422 {"error": "invalid_password", "reason": ...} keeps the link
+    // usable; 400 {"error": "invalid_token", "reason": "invalid" | "expired"}; 503: retry
+```
+
+A completed recovery sets the new password, ends every session of the user in
+the org (in every app) and their other recovery links, and verifies an address
+that was never verified: following the link proved the mailbox. Send the
+person to your sign-in page afterwards. A second use of the link answers
+`invalid_token`. Links belong to the address across every app of the org.
+
+Do not offer recovery for an address whose registration is still unverified:
+the owner would inherit the account whoever registered it prepared (your
+records for that `external_id`), and `cancel_registration` refuses it once
+verified. Cancel such a registration and let the owner register afresh.
+
 ## Running the daemon
 
 This gem is only the client: it ships no binary and needs none to install. The
@@ -308,11 +509,14 @@ The two gems are versioned separately.
 
 - Keep direct backend access restricted and TLS/service networking trusted.
   Local eligibility checks do not synchronize kernel account state or revoke
-  all remote sessions. Password changes/resets, disablement and MFA enablement
-  still need authoritative credential/state updates and invalidation.
-- This release is an existing, confirmed, password-only cohort. Real admins,
-  MFA-required/unverified accounts and registration remain on their explicitly
-  selected legacy owner. Do not use failure fallback or mislabel MFA state.
+  all remote sessions. Disablement and MFA enablement still need authoritative
+  credential/state updates and invalidation; password changes and recoveries
+  through the kernel revoke its sessions themselves.
+- Imports remain an existing, confirmed, password-only cohort; registration
+  creates unverified accounts the kernel refuses until they are verified (or
+  until a configured grace runs out). Real admins and MFA-required accounts
+  remain on their explicitly selected legacy owner. Do not use failure fallback
+  or mislabel MFA state.
 - Define old-cookie/JWT retirement and canonical-session-bound compatibility
   before cutting an existing application over. This gem does not preserve existing JWT/frontend
   contracts automatically or share Rails signing secrets with Strongroom.
@@ -322,8 +526,8 @@ The two gems are versioned separately.
   Ruby/parser/network/framework copies cannot be reliably erased. Do not log
   headers, cookie jars, passwords, transport bodies or explicit token strings.
   The Railtie adds parameter filters; separately audit proxy/middleware/APM logs.
-- Registration/mail/recovery, bulk mapping orchestration, session families,
-  remote admin operations, deployment SLOs and production approval are not shipped.
+- Mail delivery, bulk mapping orchestration, remote admin operations,
+  deployment SLOs and production approval are not shipped.
 
 ## Local checks (no installs, network or database required)
 
@@ -395,7 +599,8 @@ directory; it may also name the RubyGems launchers of an installed `strongroomd`
   `__Host-` cookie and a free admin port, and waits for `/admin/ready`. If the
   daemon exits, the failure carries its stderr (database URL redacted).
 - Seeds only synthetic org/app bindings, then uses the actual admin CLI to
-  provision two distinct, confirmed password-only principals with the same email.
+  provision three distinct, confirmed password-only principals, two of them with
+  the same email in different namespaces.
   The `admin` fixture is a realm-isolation test, not real admin/MFA migration.
 - Installs a fresh package in a temporary consumer bundle, then uses its real
   Net::HTTP client for login, audience isolation, rotation, reuse detection,
@@ -405,8 +610,22 @@ directory; it may also name the RubyGems launchers of an installed `strongroomd`
 - Exercises the Rails helpers through in-memory Rack/HTTPS requests, encrypted
   cookies, CSRF and a full-scope trusted mapping into synthetic local records.
   It does not validate a real ActiveRecord binding store, browser TLS or an existing application.
-- Checks the database for two bcrypt upgrades, two rotations and no live sessions,
-  and the daemon's `/admin/metrics` for the exact login outcomes.
+- Registers an account through the service listener with a key minted for the
+  run, proves replay idempotency and the typed refusals, that the account
+  cannot log in before its link is confirmed and that a `GET` of the link does
+  nothing, then confirms it by `POST` on the public listener and logs in with
+  `identity_verified` true, reads the event feed, and cancels a squatted
+  registration so the address can be registered again.
+- Changes a registered account's password: a wrong current password and a weak
+  new one change nothing, the session that asked continues on the new
+  password, its other session and the old password stop working. Recovers a
+  registered account (refused weak password, one-time link, every session
+  ended, the new password logs in), an address that was never verified (the
+  recovery verifies it) and an imported bcrypt account.
+- Checks the database for the imports, the verified registrations, the bcrypt
+  upgrades, the rotations and no live sessions, and the daemon's
+  `/admin/metrics` for the exact login, registration, verification, recovery
+  and password change outcomes.
 - Bounds subprocesses and kills/reaps its owned process groups, drops its schema
   and removes temporary files on completion or handled failure/interruption.
   The caller remains responsible for stopping the supplied PostgreSQL server.

data/lib/strongroom/client.rb

@@ -8,9 +8,18 @@ module Strongroom
     TIMESTAMP = /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})\z/
     MICROSECOND = Rational(1, 1_000_000)
     ISSUER = /\A[a-z][a-z0-9+.-]*:[!-~]{1,255}\z/
-    attr_reader :endpoint, :issuer, :namespace, :org_id, :app_id, :cookie_name
+    CURSOR = /\A[A-Za-z0-9_-]{34}\z/
+    IDENTITY_STATES = %w[Unverified Verified Disabled].freeze
+    EVENT_TYPES = %w[Provision Register RegistrationCancel VerificationIssue IdentityVerify PasswordHashUpgrade
+      PasswordReplace Revoke RecoveryIssue RecoveryComplete PasswordChange].freeze
+    LOGIN = {"session_id" => :uuid, "user_id" => :uuid, "expires_at" => :timestamp,
+             "identity_verified" => :boolean}.freeze
+    METADATA = LOGIN.merge("org_id" => :uuid, "app_id" => :uuid).freeze
+    SERVICE_KEY_HEADER = "X-Strongroom-Service-Key"
+    attr_reader :endpoint, :issuer, :namespace, :org_id, :app_id, :cookie_name, :service_endpoint
 
-    def initialize(endpoint:, issuer:, namespace:, org_id:, app_id:, cookie_base: "__Host-strongroom_session", transport: nil)
+    def initialize(endpoint:, issuer:, namespace:, org_id:, app_id:, cookie_base: "__Host-strongroom_session",
+      transport: nil, service_endpoint: nil, service_key: nil, service_transport: nil)
       @endpoint = NetHTTPTransport.endpoint(endpoint)
       unless issuer.is_a?(String) && issuer.match?(ISSUER)
         raise ConfigurationError, "explicit issuer URI required (stable binding identity, not the network endpoint)"
@@ -24,13 +33,30 @@ module Strongroom
       @org_id, @app_id = [org_id, app_id].map { |value| configured_uuid(value) }
       @cookie_name = "#{cookie_base}_#{@namespace}".freeze
       @transport = transport || NetHTTPTransport.new(endpoint: @endpoint)
-      unless serves_endpoint?(@transport)
+      unless serves_endpoint?(@transport, @endpoint)
         raise ConfigurationError, "transport endpoint does not match the client endpoint"
       end
+      configure_service(service_endpoint, service_key, service_transport)
       freeze
     end
 
-    def inspect = "#<Strongroom::Client issuer=#{issuer} endpoint=#{endpoint} namespace=#{namespace}>"
+    def inspect
+      service = service? ? " service_endpoint=#{service_endpoint}" : ""
+      "#<Strongroom::Client issuer=#{issuer} endpoint=#{endpoint}#{service} namespace=#{namespace}>"
+    end
+
+    def pretty_print(printer) = printer.text(inspect)
+
+    def encode_with(coder)
+      coder.map = {"issuer" => issuer, "endpoint" => endpoint, "namespace" => namespace}
+    end
+
+    def marshal_dump
+      raise TypeError, "clients must not be serialized"
+    end
+
+    # Whether this client can reach the namespace's service API.
+    def service? = !@service_key.nil?
 
     def login(identity:, password:, identity_kind: "email")
       unless [identity, password, identity_kind].all? { |value| value.is_a?(String) }
@@ -40,7 +66,7 @@ module Strongroom
       raise InvalidRequest, "login request too large" if body.bytesize > 16_384
       response = request(:post, "auth/login", body: body)
       issue(response) do |token|
-        declared = object(response, %w[session_id user_id expires_at])
+        declared = object(response, LOGIN)
         current = session(token: token)
         raise ProtocolError, "inconsistent authentication response" unless same_login?(declared, current)
         current
@@ -63,6 +89,32 @@ module Strongroom
       end
     end
 
+    # Changes the password of the identity `token`'s session was issued for and
+    # returns that session rotated onto it, confirmed through `/me` as rotation
+    # is. Every other session of the user in the org ends. A wrong
+    # `current_password` raises `Unauthorized` and leaves the session as it was;
+    # an unverified identity raises `IdentityUnverified`, a session issued with
+    # a password the identity no longer logs in with `CredentialChanged`. If
+    # the change went through but `/me` does not confirm the rotated session,
+    # that session is logged out before `ProtocolError` is raised: the new
+    # password is set and the user signs in with it.
+    def change_password(token:, current_password:, new_password:)
+      unless [current_password, new_password].all? { |value| value.is_a?(String) }
+        raise InvalidRequest, "passwords must be strings"
+      end
+      body = JSON.generate(current_password: current_password, new_password: new_password)
+      raise InvalidRequest, "password change request too large" if body.bytesize > 16_384
+      response = request(:post, "auth/password", token: Token.coerce(token), body: body)
+      issue(response) do |successor|
+        declared = metadata(response)
+        current = session(token: successor)
+        raise ProtocolError, "inconsistent password change response" unless same_session?(declared, current)
+        current
+      end
+    rescue JSON::GeneratorError
+      raise InvalidRequest, "invalid password change payload", cause: nil
+    end
+
     def logout(token:)
       request(:delete, "auth/logout", token: Token.coerce(token), status: 204)
       nil
@@ -83,8 +135,99 @@ module Strongroom
       Subject.new(issuer: issuer, namespace: namespace, org_id: org_id, app_id: app_id, user_id: session.user_id)
     end
 
+    # Creates an account with an unverified email identity, keyed by your own
+    # `external_id`. Replaying the same external ID and identity returns the
+    # original receipt (`created: false`) and changes nothing.
+    def register(external_id:, identity:, password:)
+      unless [external_id, identity, password].all? { |value| value.is_a?(String) }
+        raise InvalidRequest, "registration fields must be strings"
+      end
+      body = JSON.generate(external_id: external_id, identity_kind: "email", identity: identity, password: password)
+      raise InvalidRequest, "registration request too large" if body.bytesize > 16_384
+      response = service_request(:post, "registrations", body: body, statuses: [200, 201])
+      values = object(response, {"user_id" => :uuid, "identity_id" => :uuid, "identity_state" => :string})
+      raise ProtocolError, "invalid registration response" unless IDENTITY_STATES.include?(values["identity_state"])
+      Registration.new(user_id: values["user_id"], identity_id: values["identity_id"],
+        identity_state: values["identity_state"], created: response.status == 201)
+    rescue JSON::GeneratorError
+      raise InvalidRequest, "invalid registration payload", cause: nil
+    end
+
+    # Withdraws a registration whose address was never verified: the account
+    # it created is deleted, and the address and external ID are free again.
+    def cancel_registration(external_id:)
+      raise InvalidRequest, "external_id must be a string" unless external_id.is_a?(String)
+      body = JSON.generate(external_id: external_id)
+      response = service_request(:post, "registrations/cancel", body: body, statuses: [200])
+      unless object(response, {"status" => :string})["status"] == "cancelled"
+        raise ProtocolError, "invalid service response"
+      end
+      nil
+    rescue JSON::GeneratorError
+      raise InvalidRequest, "invalid external_id", cause: nil
+    end
+
+    # A fresh verification link for `user_id`'s email identity; earlier links
+    # stop working. The browser confirms it: POST {"token"} to
+    # `/accounts/<namespace>/verify` on the kernel's public listener.
+    def issue_verification(user_id:)
+      raise InvalidRequest, "user_id must be a canonical UUID" unless canonical_uuid?(user_id)
+      response = service_request(:post, "verifications", body: JSON.generate(user_id: user_id), statuses: [201])
+      values = object(response, {"token" => :string, "expires_at" => :timestamp})
+      Verification.new(token: VerificationToken.new(values["token"]), expires_at: values["expires_at"])
+    end
+
+    # A recovery link for the account holding the email address `identity` in
+    # this namespace; earlier recovery links of that address stop working. The
+    # browser completes it: POST {"token", "password"} to
+    # `/accounts/<namespace>/recovery` on the kernel's public listener. Raises
+    # `NotFound` when no usable account holds the address: answer your users
+    # the same way either way.
+    def issue_recovery(identity:)
+      raise InvalidRequest, "identity must be a string" unless identity.is_a?(String)
+      body = JSON.generate(identity_kind: "email", identity: identity)
+      raise InvalidRequest, "recovery request too large" if body.bytesize > 16_384
+      response = service_request(:post, "recoveries", body: body, statuses: [201])
+      values = object(response, {"token" => :string, "expires_at" => :timestamp, "user_id" => :uuid})
+      Recovery.new(token: RecoveryToken.new(values["token"]), expires_at: values["expires_at"],
+        user_id: values["user_id"].freeze)
+    rescue JSON::GeneratorError
+      raise InvalidRequest, "invalid recovery payload", cause: nil
+    end
+
+    # One page of the namespace's event feed, in commit-safe order.
+    def events(after: nil, limit: 100)
+      unless (after.nil? || (after.is_a?(String) && after.match?(CURSOR))) &&
+          limit.is_a?(Integer) && (1..500).cover?(limit)
+        raise InvalidRequest, "after: must be a feed cursor and limit: 1 to 500"
+      end
+      query = after ? "after=#{after}&limit=#{limit}" : "limit=#{limit}"
+      response = service_request(:get, "events?#{query}", statuses: [200])
+      page = parse(response)
+      unless page.is_a?(Hash) && page.keys.sort == %w[events next oldest_at] && page["events"].is_a?(Array) &&
+          (page["next"].nil? || (page["next"].is_a?(String) && page["next"].match?(CURSOR)))
+        raise ProtocolError, "invalid event feed"
+      end
+      EventPage.new(events: page["events"].map { |event| feed_event(event) }.freeze, next: page["next"]&.freeze,
+        oldest_at: page["oldest_at"]&.then { timestamp(it) })
+    end
+
     private
 
+    def configure_service(endpoint, key, transport)
+      if endpoint.nil? && key.nil? && transport.nil?
+        @service_endpoint = @service_key = @service_transport = nil
+        return
+      end
+      raise ConfigurationError, "service_endpoint: and service_key: go together" if endpoint.nil? || key.nil?
+      @service_endpoint = NetHTTPTransport.endpoint(endpoint)
+      @service_key = ServiceKey.new(key)
+      @service_transport = transport || NetHTTPTransport.new(endpoint: @service_endpoint)
+      unless serves_endpoint?(@service_transport, @service_endpoint)
+        raise ConfigurationError, "service transport endpoint does not match the service endpoint"
+      end
+    end
+
     def issue(response)
       token = issued_token(response)
       IssuedSession.new(session: yield(token), token: token)
@@ -95,7 +238,8 @@ module Strongroom
 
     def same_login?(declared, current)
       declared["session_id"] == current.session_id && declared["user_id"] == current.user_id &&
-        same_instant?(timestamp(declared["expires_at"]), current.expires_at)
+        declared["identity_verified"] == current.identity_verified &&
+        same_instant?(declared["expires_at"], current.expires_at)
     end
 
     def same_session?(declared, current)
@@ -116,7 +260,7 @@ module Strongroom
       raise ProtocolError, "invalid authentication response", cause: nil
     end
 
-    def serves_endpoint?(transport)
+    def serves_endpoint?(transport, endpoint)
       transport.respond_to?(:call) && transport.respond_to?(:endpoint) &&
         NetHTTPTransport.endpoint(transport.endpoint) == endpoint
     rescue ConfigurationError
@@ -140,23 +284,86 @@ module Strongroom
       headers["Content-Type"] = "application/json" if body
       headers["Authorization"] = "Bearer #{token.reveal}" if token
       response = @transport.call(method, "/accounts/#{namespace}/#{suffix}", headers: headers, body: body)
-      unless response.is_a?(TransportResponse) && response.body.bytesize <= NetHTTPTransport::MAX_RESPONSE_BYTES
-        raise ProtocolError, "invalid authentication response"
-      end
+      bounded!(response)
       case response.status
       when 401 then raise Unauthorized, "authentication failed"
       when 403 then raise ProtocolError, "authentication request refused by service policy"
+      when 409 then conflict!(response)
+      when 422 then invalid_password!(response)
+      when 429 then raise RateLimited.new(retry_after: retry_after(response))
+      when 503 then raise Busy.new(retry_after: retry_after(response))
+      when 500..599 then raise Unavailable, "authentication service unavailable"
+      end
+      expected!(response, [status])
+      raise ProtocolError, "unexpected logout body" if status == 204 && !response.body.empty?
+      response
+    end
+
+    # The namespace's service API: a server-to-server call with the service
+    # key, never a browser's. Kernel refusals become typed errors.
+    def service_request(method, suffix, statuses:, body: nil)
+      raise ConfigurationError, "no service_endpoint: or service_key: configured for #{namespace}" unless service?
+      headers = {"Accept" => "application/json", "Accept-Encoding" => "identity",
+                 "Cache-Control" => "no-store", SERVICE_KEY_HEADER => @service_key.reveal}
+      headers["Content-Type"] = "application/json" if body
+      response = @service_transport.call(method, "/accounts/#{namespace}/service/#{suffix}", headers: headers, body: body)
+      bounded!(response)
+      refused!(response) unless statuses.include?(response.status)
+      expected!(response, statuses)
+      response
+    end
+
+    def refused!(response)
+      case response.status
+      when 400 then raise InvalidRequest, "service request refused"
+      when 401, 403 then raise ProtocolError, "service key or caller refused by the kernel"
+      when 404 then raise NotFound, "not found in this namespace"
+      when 409 then conflict!(response)
+      when 422 then invalid_password!(response)
       when 429 then raise RateLimited.new(retry_after: retry_after(response))
       when 503 then raise Busy.new(retry_after: retry_after(response))
       when 500..599 then raise Unavailable, "authentication service unavailable"
       end
+    end
+
+    def invalid_password!(response)
+      reason = service_error(response)&.fetch("reason", nil)
+      raise InvalidPassword.new(reason: reason) if InvalidPassword::REASONS.include?(reason)
+      raise ProtocolError, "invalid authentication response"
+    end
+
+    def conflict!(response)
+      case service_error(response)&.fetch("error", nil)
+      when "identity_taken" then raise IdentityTaken, "identity already belongs to another account"
+      when "binding_conflict" then raise BindingConflict, "external_id is bound to a different identity"
+      when "already_verified" then raise AlreadyVerified, "identity is already verified"
+      when "identity_disabled" then raise IdentityDisabled, "identity is disabled"
+      when "cursor_ahead" then raise CursorAhead, "feed cursor is ahead of the kernel's database"
+      when "identity_unverified" then raise IdentityUnverified, "identity is not verified"
+      when "credential_changed" then raise CredentialChanged, "session predates the identity's password"
+      else raise ProtocolError, "invalid service response"
+      end
+    end
+
+    def service_error(response)
+      error = parse(response)
+      error if error.is_a?(Hash) && error.values.all?(String)
+    rescue ProtocolError
+      nil
+    end
+
+    def bounded!(response)
+      unless response.is_a?(TransportResponse) && response.body.bytesize <= NetHTTPTransport::MAX_RESPONSE_BYTES
+        raise ProtocolError, "invalid authentication response"
+      end
+    end
+
+    def expected!(response, statuses)
       cache = response.headers.fetch("cache-control", []).join(",").split(",").map(&:strip)
-      unless response.status == status && cache.include?("no-store") &&
+      unless statuses.include?(response.status) && cache.include?("no-store") &&
           response.headers.fetch("content-encoding", ["identity"]) == ["identity"]
         raise ProtocolError, "unexpected authentication response"
       end
-      raise ProtocolError, "unexpected logout body" if status == 204 && !response.body.empty?
-      response
     end
 
     def retry_after(response)
@@ -166,30 +373,65 @@ module Strongroom
       value if (1..86_400).cover?(value)
     end
 
-    def object(response, keys)
+    def parse(response)
       types = response.headers.fetch("content-type", [])
       unless types.length == 1 && types[0].split(";").first.to_s.strip.casecmp?("application/json")
         raise ProtocolError, "invalid authentication response"
       end
-      result = JSON.parse(response.body)
-      unless result.is_a?(Hash) && result.keys.sort == keys.sort && result.values.all? { |value| value.is_a?(String) }
-        raise ProtocolError, "invalid authentication response"
-      end
-      result
+      JSON.parse(response.body)
     rescue JSON::ParserError, EncodingError
       raise ProtocolError, "invalid authentication response", cause: nil
     end
 
+    # Exactly `schema`'s keys, each of its kind; timestamps parsed.
+    def object(response, schema)
+      result = parse(response)
+      unless result.is_a?(Hash) && result.keys.sort == schema.keys.sort &&
+          schema.all? { |key, kind| kind?(result[key], kind) }
+        raise ProtocolError, "invalid authentication response"
+      end
+      result.to_h { |key, value| [key, schema[key] == :timestamp ? timestamp(value) : value] }
+    end
+
+    def kind?(value, kind)
+      case kind
+      when :uuid then canonical_uuid?(value)
+      when :boolean then value == true || value == false
+      when :uuid_or_nil then value.nil? || canonical_uuid?(value)
+      else value.is_a?(String)
+      end
+    end
+
     def metadata(response)
-      values = object(response, %w[session_id user_id org_id app_id expires_at])
-      unless %w[session_id user_id org_id app_id].all? { |key| canonical_uuid?(values[key]) } &&
-          values["org_id"] == org_id && values["app_id"] == app_id
+      values = object(response, METADATA)
+      unless values["org_id"] == org_id && values["app_id"] == app_id
         raise ProtocolError, "unexpected session audience"
       end
-      expiry = timestamp(values.fetch("expires_at"))
+      expiry = values.fetch("expires_at")
       raise Unauthorized, "session expired" unless expiry > Time.now
       Session.new(session_id: values["session_id"].freeze, user_id: values["user_id"].freeze,
-                  org_id: org_id, app_id: app_id, expires_at: expiry)
+                  org_id: org_id, app_id: app_id, expires_at: expiry, identity_verified: values["identity_verified"])
+    end
+
+    EVENT = {"id" => :uuid, "type" => :string, "user_id" => :uuid_or_nil, "identity_id" => :uuid_or_nil,
+             "at" => :timestamp, "meta" => :meta}.freeze
+    private_constant :EVENT
+
+    def feed_event(event)
+      unless event.is_a?(Hash) && event.keys.sort == EVENT.keys.sort && EVENT_TYPES.include?(event["type"]) &&
+          event["meta"].is_a?(Hash) && EVENT.all? { |key, kind| kind == :meta || kind?(event[key], kind) }
+        raise ProtocolError, "invalid event feed"
+      end
+      Event.new(id: event["id"].freeze, type: event["type"].freeze, user_id: event["user_id"]&.freeze,
+        identity_id: event["identity_id"]&.freeze, at: timestamp(event["at"]), meta: deep_freeze(event["meta"]))
+    end
+
+    def deep_freeze(value)
+      case value
+      when Hash then value.to_h { |key, item| [key.freeze, deep_freeze(item)] }.freeze
+      when Array then value.map { |item| deep_freeze(item) }.freeze
+      else value.freeze
+      end
     end
 
     def issued_token(response)

data/lib/strongroom/errors.rb

@@ -7,6 +7,38 @@ module Strongroom
   class Unauthorized < Error; end
   class ProtocolError < Error; end
   class Unavailable < Error; end
+  class NotFound < Error; end
+
+  # The service API refused a request that conflicts with stored state.
+  class Conflict < Error; end
+  class IdentityTaken < Conflict; end
+  class BindingConflict < Conflict; end
+  class AlreadyVerified < Conflict; end
+  class IdentityDisabled < Conflict; end
+
+  # A password change for an unverified identity: nobody has proven they own
+  # the address, so knowing its password proves nothing. Nothing changed.
+  class IdentityUnverified < Conflict; end
+
+  # A password change from a session issued with a password the identity no
+  # longer logs in with: sign in again, then change it. Nothing changed.
+  class CredentialChanged < Conflict; end
+
+  # The feed cursor names a point the kernel's database has not reached (it was
+  # restored, failed over or copied): drop the cursor and read from the start.
+  class CursorAhead < Conflict; end
+
+  # A new password the kernel's policy refuses; `reason` is `too_short`,
+  # `too_long` or `invalid`. The password itself is never kept.
+  class InvalidPassword < InvalidRequest
+    REASONS = %w[too_short too_long invalid].freeze
+    attr_reader :reason
+
+    def initialize(reason:)
+      @reason = reason
+      super("password refused: #{reason}")
+    end
+  end
 
   class RateLimited < Error
     attr_reader :retry_after

data/lib/strongroom/rails/account.rb

@@ -20,12 +20,51 @@ module Strongroom
         raise ConfigurationError, "resolve must be callable (subject -> record or nil)" unless resolve.respond_to?(:call)
         raise ConfigurationError, "eligible must be callable (record -> true)" unless eligible.respond_to?(:call)
         raise ConfigurationError, "register must be true or false" unless [true, false].include?(register)
+        if register && !client.service?
+          raise ConfigurationError, "register: true needs a client with service_endpoint: and service_key:"
+        end
         @client, @model, @table = client, model, table.dup.freeze
         @resolver, @eligible, @register = resolve, eligible, register
         @cookie_name = "strongroom_#{client.namespace}".freeze
         freeze
       end
 
+      # Self-service registration through the kernel's service API. Only a
+      # namespace configured with `register: true` (here and in the kernel) may.
+      def register_account(external_id:, identity:, password:)
+        registering!
+        client.register(external_id: external_id, identity: identity, password: password)
+      end
+
+      # Withdraws a registration whose address was never verified.
+      def cancel_registration(external_id:)
+        registering!
+        client.cancel_registration(external_id: external_id)
+      end
+
+      # A fresh verification link for a registered user's email identity.
+      def issue_verification(user_id:)
+        registering!
+        client.issue_verification(user_id: user_id)
+      end
+
+      # A recovery link for the account holding `identity`; needs only the
+      # service key, so imported and registered accounts alike can recover.
+      def issue_recovery(identity:)
+        client.issue_recovery(identity: identity)
+      end
+
+      # Changes the password of `token`'s session and returns it rotated onto
+      # the new one; prefer the controller helper, which also replaces the cookie.
+      def change_password(token:, current_password:, new_password:)
+        client.change_password(token: token, current_password: current_password, new_password: new_password)
+      end
+
+      # The namespace's event feed; needs only the service key.
+      def events(after: nil, limit: 100)
+        client.events(after: after, limit: limit)
+      end
+
       def resolve(session)
         subject = client.subject(session)
         record = @resolver.call(subject)
@@ -38,6 +77,12 @@ module Strongroom
       rescue StandardError
         raise Unavailable, "local principal lookup unavailable", cause: nil
       end
+
+      private
+
+      def registering!
+        raise ConfigurationError, "registration is not enabled for #{client.namespace} (register: false)" unless register
+      end
     end
   end
 end

data/lib/strongroom/rails/authentication.rb

@@ -50,6 +50,22 @@ module Strongroom
         strongroom_resolver.forget(namespace)
       end
 
+      # Changes the password of the request's session and replaces the cookie
+      # with the session rotated onto the new password. Every other session of
+      # the user in the org ends; a wrong current password raises
+      # `Unauthorized`, an unverified identity `IdentityUnverified`, and
+      # neither changes anything.
+      def strongroom_change_password(namespace:, current_password:, new_password:)
+        strongroom_verify_mutation!(:post)
+        account = strongroom_registry.fetch(namespace)
+        token = strongroom_resolver.credential(namespace) or raise Unauthorized, "authentication failed"
+        changed = account.change_password(token: token, current_password: current_password,
+          new_password: new_password)
+        strongroom_publish(account, changed)
+      ensure
+        strongroom_resolver.forget(namespace)
+      end
+
       def strongroom_logout(namespace:)
         strongroom_verify_mutation!(:delete)
         account = strongroom_registry.fetch(namespace)

data/lib/strongroom/rails/railtie.rb

@@ -8,7 +8,17 @@ module Strongroom
 
       config.action_dispatch.rescue_responses.merge!(
         "Strongroom::InvalidRequest" => :bad_request,
+        "Strongroom::InvalidPassword" => :unprocessable_entity,
         "Strongroom::Unauthorized" => :unauthorized,
+        "Strongroom::NotFound" => :not_found,
+        "Strongroom::Conflict" => :conflict,
+        "Strongroom::IdentityTaken" => :conflict,
+        "Strongroom::BindingConflict" => :conflict,
+        "Strongroom::AlreadyVerified" => :conflict,
+        "Strongroom::IdentityDisabled" => :conflict,
+        "Strongroom::CursorAhead" => :conflict,
+        "Strongroom::IdentityUnverified" => :conflict,
+        "Strongroom::CredentialChanged" => :conflict,
         "Strongroom::RateLimited" => :too_many_requests,
         "Strongroom::Busy" => :service_unavailable,
         "Strongroom::ProtocolError" => :service_unavailable,
@@ -16,7 +26,8 @@ module Strongroom
       )
 
       initializer "strongroom.filter_credentials" do |app|
-        app.config.filter_parameters |= %i[password password_confirmation identity authorization cookie strongroom_token]
+        app.config.filter_parameters |= %i[password password_confirmation identity authorization cookie strongroom_token
+          service_key verification_token recovery_token]
       end
 
       config.after_initialize do |app|

data/lib/strongroom/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Strongroom
   module Rails
-    VERSION = "0.1.0" # x-release-please-version
+    VERSION = "0.3.0" # x-release-please-version
   end
 end

data/lib/strongroom/session.rb

@@ -3,9 +3,24 @@
 require "time"
 
 module Strongroom
-  Session = Data.define(:session_id, :user_id, :org_id, :app_id, :expires_at)
+  Session = Data.define(:session_id, :user_id, :org_id, :app_id, :expires_at, :identity_verified)
   Subject = Data.define(:issuer, :namespace, :org_id, :app_id, :user_id)
 
+  # A registration's receipt. `created` is false for an exact replay, which
+  # changed nothing; `identity_state` is the identity's current state.
+  Registration = Data.define(:user_id, :identity_id, :identity_state, :created)
+
+  # One account event from the namespace's feed. `meta` is a frozen Hash of
+  # non-secret IDs (session, credential, token).
+  Event = Data.define(:id, :type, :user_id, :identity_id, :at, :meta)
+
+  # A page of the feed. `next` is the cursor after its last event, or nil when
+  # the page is empty: keep the previous cursor and ask again later.
+  # `oldest_at` is when the oldest event the feed still holds happened (nil if
+  # none): retention prunes from there, so a consumer whose last event is older
+  # has lost the events in between.
+  EventPage = Data.define(:events, :next, :oldest_at)
+
   class IssuedSession
     attr_reader :session, :token
 
@@ -21,4 +36,45 @@ module Strongroom
       raise TypeError, "issued credentials must not be serialized"
     end
   end
+
+  # A link's secret and its expiry. Put the token in the URL fragment of a link
+  # to your own page, which posts it to the kernel; nothing here is safe to log
+  # or serialize.
+  class Link
+    attr_reader :token, :expires_at
+
+    def initialize(token:, expires_at:)
+      @token, @expires_at = token, expires_at
+      freeze
+    end
+
+    def inspect = "#<#{self.class.name} expires_at=#{expires_at.iso8601} token=[FILTERED]>"
+    alias to_s inspect
+    def pretty_print(printer) = printer.text(inspect)
+
+    def as_json(*)
+      raise TypeError, "links must not be serialized"
+    end
+
+    def marshal_dump
+      raise TypeError, "links must not be serialized"
+    end
+  end
+
+  # A verification link: its page's button confirms the address.
+  class Verification < Link; end
+
+  # A recovery link for `user_id`: its page asks for a new password and posts
+  # both to the kernel.
+  class Recovery < Link
+    attr_reader :user_id
+
+    def initialize(token:, expires_at:, user_id:)
+      @user_id = user_id
+      super(token: token, expires_at: expires_at)
+    end
+
+    def inspect = "#<Strongroom::Recovery user_id=#{user_id} expires_at=#{expires_at.iso8601} token=[FILTERED]>"
+    alias to_s inspect
+  end
 end

data/lib/strongroom/token.rb

@@ -3,24 +3,29 @@
 require "base64"
 
 module Strongroom
-  class Token
+  # A kernel secret: a fixed prefix and 32 random bytes in canonical unpadded
+  # base64url. Redacted everywhere; never JSON, YAML or Marshal payloads.
+  class Credential
+    def self.prefix = raise(NotImplementedError, "#{self} has no wire prefix")
+    def self.refusal = [Unauthorized, "invalid credential"]
+
     def initialize(value)
-      unless value.is_a?(String) && value.bytesize == 47 && value.match?(/\Asr1_[A-Za-z0-9_-]{43}\z/)
-        raise Unauthorized, "invalid session credential", cause: nil
+      prefix = self.class.prefix
+      unless value.is_a?(String) && value.bytesize == prefix.bytesize + 43 && value.start_with?(prefix) &&
+          value.byteslice(prefix.bytesize..).match?(/\A[A-Za-z0-9_-]{43}\z/)
+        refuse
       end
-      encoded = value.delete_prefix("sr1_")
+      encoded = value.delete_prefix(prefix)
       decoded = Base64.urlsafe_decode64(encoded)
-      unless decoded.bytesize == 32 && Base64.urlsafe_encode64(decoded, padding: false) == encoded
-        raise Unauthorized, "invalid session credential", cause: nil
-      end
+      refuse unless decoded.bytesize == 32 && Base64.urlsafe_encode64(decoded, padding: false) == encoded
       @wire = value.dup.freeze
       freeze
     rescue ArgumentError
-      raise Unauthorized, "invalid session credential", cause: nil
+      refuse
     end
 
     def reveal = @wire
-    def inspect = "#<Strongroom::Token [FILTERED]>"
+    def inspect = "#<#{self.class.name} [FILTERED]>"
     alias to_s inspect
     def as_json(*) = "[FILTERED]"
     def pretty_print(printer) = printer.text(inspect)
@@ -30,12 +35,25 @@ module Strongroom
     end
 
     def init_with(_coder)
-      raise TypeError, "session tokens must not be deserialized"
+      raise TypeError, "credentials must not be deserialized"
     end
 
     def _dump(_depth)
-      raise TypeError, "session tokens must not be serialized"
+      raise TypeError, "credentials must not be serialized"
+    end
+
+    private
+
+    def refuse
+      error, message = self.class.refusal
+      raise error, message, cause: nil
     end
+  end
+
+  # A session bearer token, `sr1_...`.
+  class Token < Credential
+    def self.prefix = "sr1_"
+    def self.refusal = [Unauthorized, "invalid session credential"]
 
     def self.coerce(value)
       value.is_a?(self) ? value : new(value)
@@ -50,4 +68,28 @@ module Strongroom
       nil
     end
   end
+
+  # A verification link's secret, `srv1_...`: mail it, never log it.
+  class VerificationToken < Credential
+    def self.prefix = "srv1_"
+    def self.refusal = [ProtocolError, "invalid verification token"]
+  end
+
+  # A recovery link's secret, `srr1_...`: mail it, never log it.
+  class RecoveryToken < Credential
+    def self.prefix = "srr1_"
+    def self.refusal = [ProtocolError, "invalid recovery token"]
+  end
+
+  # A namespace's service key, `srk1_...`, sent only to the service listener.
+  class ServiceKey < Credential
+    def self.prefix = "srk1_"
+    def self.refusal = [ConfigurationError, "service_key: must be srk1_ followed by 43 base64url characters"]
+
+    def initialize(value)
+      super
+      # Every byte the same is a placeholder, as the kernel refuses too.
+      refuse if Base64.urlsafe_decode64(@wire.delete_prefix("srk1_")).bytes.uniq.size == 1
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: strongroom-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Seuros