scalio-connect 0.1.0__tar.gz

scalio_connect-0.1.0/PKG-INFO

@@ -0,0 +1,78 @@
+Metadata-Version: 2.4
+Name: scalio-connect
+Version: 0.1.0
+Summary: Signed calls between the Scalio apps and Compass (format v2)
+License: Proprietary
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+Provides-Extra: web
+Requires-Dist: pymongo>=4.6; extra == "web"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pymongo>=4.6; extra == "dev"
+Requires-Dist: mongomock-motor>=0.0.29; extra == "dev"
+Requires-Dist: typing_extensions>=4.9; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+
+# scalio-connect
+
+Signed calls between the Scalio apps and Compass. One format ("v2", header `Scalio-Signature`) for every
+direction:
+
+- Compass -> app: control key K3 on `/api/provision/*` (replaces the old `X-Provision-Control-Signature`)
+- app -> Compass: instance key on the support intake `/api/support/v1/*` (planned)
+
+Contract: scalio-docs `interfaces/signed-request-v2.md`. Decision: scalio-docs ADR 0020.
+
+## What is signed
+
+```
+Scalio-Signature: v=2,kid=k3,ts=1793131200,nonce=vector-nonce-0000000001,sig=<base64 Ed25519>
+
+scalio-sig-v2
+<kid>
+<METHOD>
+<audience = receiver origin, e.g. https://acme.eu.scalionexus.com>
+<path and query as sent, e.g. /api/provision/admin>
+<ts>
+<nonce>
+<sha256 of the raw body, hex>
+```
+
+Lines joined by `\n`, no line break at the end. Time window +-300 s, each (kid, nonce) once.
+Because receiver and path are signed, a captured request does not work on another instance or another
+endpoint (security review H9).
+
+## Usage
+
+```python
+from scalio_connect import sign, verify, SignatureError
+from scalio_connect.nonces import use_nonce
+
+# sender
+headers = sign(private_key, "k3", "POST", "https://acme.eu.scalionexus.com/api/provision/admin", body)
+
+# receiver (raw body bytes, path with query as received)
+try:
+    v = verify(request.headers["Scalio-Signature"], request.method, path_with_query, body,
+               audiences=["https://acme.eu.scalionexus.com"], keys_for=lambda kid: k3_keys if kid == "k3" else [])
+except SignatureError:
+    raise HTTPException(401)
+if not await use_nonce(db, v.kid, v.nonce):
+    raise HTTPException(401)
+```
+
+`audiences` are the receiver's own public origins from its configuration. Do not take them from the
+`Host` header.
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check . && pytest -q
+```
+
+`tests/vector.json` is the shared test vector (throwaway seed). Compass and every app test against the same file.
+Release: bump `pyproject.toml`, CHANGELOG line, merge, then "Publish" (cockpit or Actions) with the version, no `v`.

scalio_connect-0.1.0/README.md

@@ -0,0 +1,60 @@
+# scalio-connect
+
+Signed calls between the Scalio apps and Compass. One format ("v2", header `Scalio-Signature`) for every
+direction:
+
+- Compass -> app: control key K3 on `/api/provision/*` (replaces the old `X-Provision-Control-Signature`)
+- app -> Compass: instance key on the support intake `/api/support/v1/*` (planned)
+
+Contract: scalio-docs `interfaces/signed-request-v2.md`. Decision: scalio-docs ADR 0020.
+
+## What is signed
+
+```
+Scalio-Signature: v=2,kid=k3,ts=1793131200,nonce=vector-nonce-0000000001,sig=<base64 Ed25519>
+
+scalio-sig-v2
+<kid>
+<METHOD>
+<audience = receiver origin, e.g. https://acme.eu.scalionexus.com>
+<path and query as sent, e.g. /api/provision/admin>
+<ts>
+<nonce>
+<sha256 of the raw body, hex>
+```
+
+Lines joined by `\n`, no line break at the end. Time window +-300 s, each (kid, nonce) once.
+Because receiver and path are signed, a captured request does not work on another instance or another
+endpoint (security review H9).
+
+## Usage
+
+```python
+from scalio_connect import sign, verify, SignatureError
+from scalio_connect.nonces import use_nonce
+
+# sender
+headers = sign(private_key, "k3", "POST", "https://acme.eu.scalionexus.com/api/provision/admin", body)
+
+# receiver (raw body bytes, path with query as received)
+try:
+    v = verify(request.headers["Scalio-Signature"], request.method, path_with_query, body,
+               audiences=["https://acme.eu.scalionexus.com"], keys_for=lambda kid: k3_keys if kid == "k3" else [])
+except SignatureError:
+    raise HTTPException(401)
+if not await use_nonce(db, v.kid, v.nonce):
+    raise HTTPException(401)
+```
+
+`audiences` are the receiver's own public origins from its configuration. Do not take them from the
+`Host` header.
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check . && pytest -q
+```
+
+`tests/vector.json` is the shared test vector (throwaway seed). Compass and every app test against the same file.
+Release: bump `pyproject.toml`, CHANGELOG line, merge, then "Publish" (cockpit or Actions) with the version, no `v`.

scalio_connect-0.1.0/pyproject.toml

@@ -0,0 +1,30 @@
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "scalio-connect"
+version = "0.1.0"
+description = "Signed calls between the Scalio apps and Compass (format v2)"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Proprietary" }
+dependencies = ["cryptography>=42"]
+
+[project.optional-dependencies]
+web = ["pymongo>=4.6"]
+dev = ["pytest>=8", "pytest-asyncio>=0.23", "pymongo>=4.6", "mongomock-motor>=0.0.29", "typing_extensions>=4.9", "ruff>=0.6"]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B"]

scalio_connect-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

scalio_connect-0.1.0/src/scalio_connect/__init__.py

@@ -0,0 +1,18 @@
+"""Signed calls between the Scalio apps and Compass. See README.md."""
+from .signing import (
+    HEADER,
+    SKEW_SECONDS,
+    SignatureError,
+    Verified,
+    canonical,
+    load_private_key,
+    origin,
+    parse_header,
+    public_key_b64,
+    sign,
+    verify,
+)
+
+__all__ = ["HEADER", "SKEW_SECONDS", "SignatureError", "Verified", "canonical", "load_private_key", "origin",
+           "parse_header", "public_key_b64", "sign", "verify"]
+__version__ = "0.1.0"

scalio_connect-0.1.0/src/scalio_connect/nonces.py

@@ -0,0 +1,26 @@
+"""Single use of nonces, stored in MongoDB (Motor or mongomock-motor).
+
+Each (kid, nonce) pair is accepted once. Entries expire after NONCE_TTL_SECONDS, which is longer than the
+time window, so a nonce cannot come back after it was deleted.
+"""
+from datetime import datetime, timezone
+
+from .signing import NONCE_TTL_SECONDS
+
+COLLECTION = "scalio_sig_nonces"
+
+
+async def ensure_indexes(db):
+    await db[COLLECTION].create_index([("kid", 1), ("nonce", 1)], unique=True)
+    await db[COLLECTION].create_index("used_at", expireAfterSeconds=NONCE_TTL_SECONDS)
+
+
+async def use_nonce(db, kid: str, nonce: str) -> bool:
+    """True the first time this nonce is seen for this kid, False on a replay."""
+    from pymongo.errors import DuplicateKeyError
+    await ensure_indexes(db)
+    try:
+        await db[COLLECTION].insert_one({"kid": kid, "nonce": nonce, "used_at": datetime.now(timezone.utc)})
+    except DuplicateKeyError:
+        return False
+    return True

scalio_connect-0.1.0/src/scalio_connect/signing.py

@@ -0,0 +1,179 @@
+"""Signed requests, format v2 ("Scalio-Signature").
+
+One format for every signed call between Scalio services: Compass -> app (K3), app -> Compass (instance key),
+later Compass -> engine. Contract: scalio-docs interfaces/signed-request-v2.md.
+
+The signature covers key id, method, receiver origin, path with query, time, nonce and a hash of the body. A
+signed request therefore only works once, only at the receiver it was made for and only on that endpoint.
+
+    Scalio-Signature: v=2,kid=k3,ts=1793131200,nonce=4f0c...,sig=<base64 Ed25519>
+
+Signed text (UTF-8, lines joined by "\\n", no line break at the end):
+
+    scalio-sig-v2
+    <kid>
+    <METHOD>
+    <audience>        receiver origin, e.g. https://acme.eu.scalionexus.com
+    <path>            path and query exactly as sent, e.g. /api/provision/admin
+    <ts>
+    <nonce>
+    <sha256 of the raw body, lower-case hex>
+"""
+import base64
+import binascii
+import hashlib
+import re
+import secrets
+import time
+from dataclasses import dataclass
+from typing import Callable, Iterable
+from urllib.parse import urlsplit
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+
+HEADER = "Scalio-Signature"
+VERSION = "2"
+PREFIX = "scalio-sig-v2"
+SKEW_SECONDS = 300
+NONCE_TTL_SECONDS = 2 * SKEW_SECONDS + 60
+
+_KID = re.compile(r"^[A-Za-z0-9_.:-]{1,64}$")
+_NONCE = re.compile(r"^[A-Za-z0-9_-]{16,128}$")
+_METHOD = re.compile(r"^[A-Z]{3,7}$")
+
+
+class SignatureError(Exception):
+    """The request is not signed correctly. The text is for the log, not for the caller."""
+
+
+@dataclass(frozen=True)
+class Verified:
+    kid: str
+    nonce: str
+    ts: int
+
+
+def b64d(s: str) -> bytes:
+    s = (s or "").strip()
+    return base64.b64decode(s + "=" * (-len(s) % 4), validate=True)
+
+
+def b64e(b: bytes) -> str:
+    return base64.b64encode(b).decode()
+
+
+def origin(url: str) -> str:
+    """Normalised origin "scheme://host[:port]" (lower case, default ports dropped), "" if not a http(s) URL."""
+    parts = urlsplit((url or "").strip())
+    scheme = parts.scheme.lower()
+    if scheme not in ("http", "https") or not parts.hostname or parts.username or parts.password:
+        return ""
+    host = parts.hostname.lower()
+    if ":" in host:
+        host = f"[{host}]"
+    try:
+        port = parts.port
+    except ValueError:
+        return ""
+    if port and not ((scheme == "https" and port == 443) or (scheme == "http" and port == 80)):
+        host = f"{host}:{port}"
+    return f"{scheme}://{host}"
+
+
+def body_hash(body: bytes | None) -> str:
+    return hashlib.sha256(body or b"").hexdigest()
+
+
+def canonical(kid: str, method: str, audience: str, path: str, ts: int | str, nonce: str, body: bytes | None) -> bytes:
+    """The exact bytes that are signed."""
+    aud = origin(audience)
+    if not aud:
+        raise SignatureError("audience is not an http(s) origin")
+    if not _KID.match(kid or ""):
+        raise SignatureError("invalid kid")
+    if not _NONCE.match(nonce or ""):
+        raise SignatureError("invalid nonce")
+    m = (method or "").upper()
+    if not _METHOD.match(m):
+        raise SignatureError("invalid method")
+    if not path or not path.startswith("/") or "\n" in path:
+        raise SignatureError("invalid path")
+    lines = [PREFIX, kid, m, aud, path, str(int(ts)), nonce, body_hash(body)]
+    return "\n".join(lines).encode("utf-8")
+
+
+def new_nonce() -> str:
+    return secrets.token_urlsafe(24)
+
+
+def load_private_key(seed_b64: str) -> Ed25519PrivateKey:
+    return Ed25519PrivateKey.from_private_bytes(b64d(seed_b64))
+
+
+def public_key_b64(key: Ed25519PrivateKey) -> str:
+    from cryptography.hazmat.primitives import serialization
+    raw = key.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)
+    return b64e(raw)
+
+
+def sign(key: Ed25519PrivateKey, kid: str, method: str, url: str, body: bytes | None = None,
+         ts: int | None = None, nonce: str | None = None) -> dict:
+    """Headers to add to the request to `url` (full URL with path and query, as it is sent)."""
+    parts = urlsplit(url)
+    path = (parts.path or "/") + (f"?{parts.query}" if parts.query else "")
+    ts = int(time.time()) if ts is None else int(ts)
+    nonce = nonce or new_nonce()
+    sig = key.sign(canonical(kid, method, url, path, ts, nonce, body))
+    return {HEADER: f"v={VERSION},kid={kid},ts={ts},nonce={nonce},sig={b64e(sig)}"}
+
+
+def parse_header(value: str) -> dict:
+    fields = {}
+    for part in (value or "").split(","):
+        k, sep, v = part.strip().partition("=")
+        if not sep or k in fields:
+            raise SignatureError("malformed signature header")
+        fields[k] = v.strip()
+    if fields.get("v") != VERSION:
+        raise SignatureError("unsupported signature version")
+    for k in ("kid", "ts", "nonce", "sig"):
+        if not fields.get(k):
+            raise SignatureError(f"signature header without {k}")
+    return fields
+
+
+def verify(header: str, method: str, path: str, body: bytes | None, audiences: Iterable[str],
+           keys_for: Callable[[str], Iterable[str]], now: float | None = None) -> Verified:
+    """Check a received request. Raises SignatureError, else returns kid, nonce and time.
+
+    audiences: the receiver's own public origins; the signed audience must be one of them.
+    keys_for(kid): base64 public keys allowed for that kid (empty = unknown kid).
+    The caller must still claim the nonce once (see nonces.use_nonce) before acting.
+    """
+    f = parse_header(header)
+    try:
+        ts = int(f["ts"])
+    except ValueError as e:
+        raise SignatureError("invalid timestamp") from e
+    if abs((time.time() if now is None else now) - ts) > SKEW_SECONDS:
+        raise SignatureError("timestamp outside the allowed window")
+    allowed = {origin(a) for a in audiences} - {""}
+    if not allowed:
+        raise SignatureError("receiver has no audience configured")
+    try:
+        sig = b64d(f["sig"])
+    except (binascii.Error, ValueError) as e:
+        raise SignatureError("signature is not base64") from e
+    keys = [k for k in (keys_for(f["kid"]) or []) if k]
+    if not keys:
+        raise SignatureError("unknown kid")
+    for aud in sorted(allowed):
+        msg = canonical(f["kid"], method, aud, path, ts, f["nonce"], body)
+        for k in keys:
+            try:
+                Ed25519PublicKey.from_public_bytes(b64d(k)).verify(sig, msg)
+                return Verified(kid=f["kid"], nonce=f["nonce"], ts=ts)
+            except (InvalidSignature, ValueError, binascii.Error):
+                continue
+    raise SignatureError("signature does not match")

scalio_connect-0.1.0/src/scalio_connect.egg-info/PKG-INFO

@@ -0,0 +1,78 @@
+Metadata-Version: 2.4
+Name: scalio-connect
+Version: 0.1.0
+Summary: Signed calls between the Scalio apps and Compass (format v2)
+License: Proprietary
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+Provides-Extra: web
+Requires-Dist: pymongo>=4.6; extra == "web"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pymongo>=4.6; extra == "dev"
+Requires-Dist: mongomock-motor>=0.0.29; extra == "dev"
+Requires-Dist: typing_extensions>=4.9; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+
+# scalio-connect
+
+Signed calls between the Scalio apps and Compass. One format ("v2", header `Scalio-Signature`) for every
+direction:
+
+- Compass -> app: control key K3 on `/api/provision/*` (replaces the old `X-Provision-Control-Signature`)
+- app -> Compass: instance key on the support intake `/api/support/v1/*` (planned)
+
+Contract: scalio-docs `interfaces/signed-request-v2.md`. Decision: scalio-docs ADR 0020.
+
+## What is signed
+
+```
+Scalio-Signature: v=2,kid=k3,ts=1793131200,nonce=vector-nonce-0000000001,sig=<base64 Ed25519>
+
+scalio-sig-v2
+<kid>
+<METHOD>
+<audience = receiver origin, e.g. https://acme.eu.scalionexus.com>
+<path and query as sent, e.g. /api/provision/admin>
+<ts>
+<nonce>
+<sha256 of the raw body, hex>
+```
+
+Lines joined by `\n`, no line break at the end. Time window +-300 s, each (kid, nonce) once.
+Because receiver and path are signed, a captured request does not work on another instance or another
+endpoint (security review H9).
+
+## Usage
+
+```python
+from scalio_connect import sign, verify, SignatureError
+from scalio_connect.nonces import use_nonce
+
+# sender
+headers = sign(private_key, "k3", "POST", "https://acme.eu.scalionexus.com/api/provision/admin", body)
+
+# receiver (raw body bytes, path with query as received)
+try:
+    v = verify(request.headers["Scalio-Signature"], request.method, path_with_query, body,
+               audiences=["https://acme.eu.scalionexus.com"], keys_for=lambda kid: k3_keys if kid == "k3" else [])
+except SignatureError:
+    raise HTTPException(401)
+if not await use_nonce(db, v.kid, v.nonce):
+    raise HTTPException(401)
+```
+
+`audiences` are the receiver's own public origins from its configuration. Do not take them from the
+`Host` header.
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check . && pytest -q
+```
+
+`tests/vector.json` is the shared test vector (throwaway seed). Compass and every app test against the same file.
+Release: bump `pyproject.toml`, CHANGELOG line, merge, then "Publish" (cockpit or Actions) with the version, no `v`.

scalio_connect-0.1.0/src/scalio_connect.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/scalio_connect/__init__.py
+src/scalio_connect/nonces.py
+src/scalio_connect/signing.py
+src/scalio_connect.egg-info/PKG-INFO
+src/scalio_connect.egg-info/SOURCES.txt
+src/scalio_connect.egg-info/dependency_links.txt
+src/scalio_connect.egg-info/requires.txt
+src/scalio_connect.egg-info/top_level.txt
+tests/test_nonces.py
+tests/test_signing.py

scalio_connect-0.1.0/src/scalio_connect.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

scalio_connect-0.1.0/src/scalio_connect.egg-info/requires.txt

@@ -0,0 +1,12 @@
+cryptography>=42
+
+[dev]
+pytest>=8
+pytest-asyncio>=0.23
+pymongo>=4.6
+mongomock-motor>=0.0.29
+typing_extensions>=4.9
+ruff>=0.6
+
+[web]
+pymongo>=4.6

scalio_connect-0.1.0/src/scalio_connect.egg-info/top_level.txt

@@ -0,0 +1 @@
+scalio_connect

scalio_connect-0.1.0/tests/test_nonces.py

@@ -0,0 +1,10 @@
+from mongomock_motor import AsyncMongoMockClient
+
+from scalio_connect.nonces import use_nonce
+
+
+async def test_nonce_only_once_per_kid():
+    db = AsyncMongoMockClient()["t"]
+    assert await use_nonce(db, "k3", "n" * 16) is True
+    assert await use_nonce(db, "k3", "n" * 16) is False
+    assert await use_nonce(db, "inst-1", "n" * 16) is True

scalio_connect-0.1.0/tests/test_signing.py

@@ -0,0 +1,169 @@
+import json
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from scalio_connect import (
+    HEADER,
+    SignatureError,
+    canonical,
+    load_private_key,
+    origin,
+    parse_header,
+    public_key_b64,
+    sign,
+    verify,
+)
+
+VECTOR = json.loads((Path(__file__).parent / "vector.json").read_text())
+NOW = 1793131200
+URL = "https://acme.eu.scalionexus.com/api/provision/admin"
+BODY = b'{"email":"admin@acme.example"}'
+
+
+@pytest.fixture
+def key():
+    return Ed25519PrivateKey.generate()
+
+
+def keys_for(key, kid="k3"):
+    return lambda k: [public_key_b64(key)] if k == kid else []
+
+
+def _verify(header, key, method="POST", path="/api/provision/admin", body=BODY,
+            audiences=("https://acme.eu.scalionexus.com",), now=NOW, kid="k3"):
+    return verify(header, method, path, body, audiences, keys_for(key, kid), now=now)
+
+
+# Shared vector: Compass and every app must produce and accept exactly this.
+
+def test_vector_canonical_and_header():
+    k = load_private_key(VECTOR["seed"])
+    assert public_key_b64(k) == VECTOR["public_key"]
+    body = VECTOR["body"].encode()
+    msg = canonical(VECTOR["kid"], VECTOR["method"], VECTOR["url"], VECTOR["path"], VECTOR["ts"], VECTOR["nonce"], body)
+    assert msg.decode() == VECTOR["canonical"]
+    h = sign(k, VECTOR["kid"], VECTOR["method"], VECTOR["url"], body, ts=VECTOR["ts"], nonce=VECTOR["nonce"])
+    assert h[HEADER] == VECTOR["header"]
+
+
+def test_vector_verifies():
+    v = verify(VECTOR["header"], VECTOR["method"], VECTOR["path"], VECTOR["body"].encode(), [VECTOR["url"]],
+               lambda kid: [VECTOR["public_key"]], now=VECTOR["ts"])
+    assert (v.kid, v.nonce, v.ts) == ("k3", VECTOR["nonce"], VECTOR["ts"])
+
+
+# Normal use
+
+def test_roundtrip(key):
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    v = _verify(h, key)
+    assert v.kid == "k3" and len(v.nonce) >= 16
+
+
+def test_query_is_signed(key):
+    h = sign(key, "k3", "GET", "https://compass.example/api/support/v1/tickets?mine=1", None, ts=NOW)[HEADER]
+    verify(h, "GET", "/api/support/v1/tickets?mine=1", b"", ["https://compass.example"], keys_for(key), now=NOW)
+    with pytest.raises(SignatureError):
+        verify(h, "GET", "/api/support/v1/tickets?mine=0", b"", ["https://compass.example"], keys_for(key), now=NOW)
+
+
+def test_rotation_accepts_any_listed_key(key):
+    old = Ed25519PrivateKey.generate()
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    v = verify(h, "POST", "/api/provision/admin", BODY, [URL], lambda k: [public_key_b64(old), public_key_b64(key)],
+               now=NOW)
+    assert v.kid == "k3"
+
+
+def test_receiver_with_several_origins(key):
+    h = sign(key, "k3", "POST", "https://custom.acme.example/api/provision/admin", BODY, ts=NOW)[HEADER]
+    _verify(h, key, audiences=("https://acme.eu.scalionexus.com", "https://custom.acme.example"))
+
+
+# What H9 is about: a captured request must not work anywhere else.
+
+def test_replay_to_other_instance_rejected(key):
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key, audiences=("https://other.eu.scalionexus.com",))
+
+
+def test_replay_to_other_endpoint_rejected(key):
+    h = sign(key, "k3", "POST", "https://acme.eu.scalionexus.com/api/provision/suspend", b"{}", ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key, path="/api/provision/resume", body=b"{}")
+
+
+def test_other_method_rejected(key):
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key, method="PUT")
+
+
+def test_changed_body_rejected(key):
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key, body=b'{"email":"evil@example.com"}')
+
+
+def test_other_kid_rejected(key):
+    h = sign(key, "inst-1", "POST", URL, BODY, ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key, kid="inst-2")
+    # the kid is part of the signed text: swapping it in the header breaks the signature
+    swapped = h.replace("kid=inst-1", "kid=inst-2")
+    with pytest.raises(SignatureError):
+        verify(swapped, "POST", "/api/provision/admin", BODY, [URL], lambda k: [public_key_b64(key)], now=NOW)
+
+
+def test_wrong_key_rejected(key):
+    h = sign(Ed25519PrivateKey.generate(), "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key)
+
+
+@pytest.mark.parametrize("delta", [-301, 301])
+def test_time_window(key, delta):
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    _verify(h, key, now=NOW + delta - (1 if delta > 0 else -1))
+    with pytest.raises(SignatureError):
+        _verify(h, key, now=NOW + delta)
+
+
+def test_receiver_without_audience_refuses(key):
+    h = sign(key, "k3", "POST", URL, BODY, ts=NOW)[HEADER]
+    with pytest.raises(SignatureError):
+        _verify(h, key, audiences=("", "not a url"))
+
+
+# Header and input checks
+
+@pytest.mark.parametrize("header", [
+    "", "v=1,kid=k3,ts=1,nonce=aaaaaaaaaaaaaaaa,sig=AA==", "v=2,kid=k3,ts=1,nonce=aaaaaaaaaaaaaaaa",
+    "v=2,v=2,kid=k3,ts=1,nonce=aaaaaaaaaaaaaaaa,sig=AA==", "garbage",
+])
+def test_bad_headers(header):
+    with pytest.raises(SignatureError):
+        parse_header(header)
+
+
+def test_bad_inputs_to_canonical():
+    for args in [("k 3", "POST", URL, "/x", NOW, "a" * 16), ("k3", "POST", URL, "/x", NOW, "short"),
+                 ("k3", "POST", "ftp://x", "/x", NOW, "a" * 16), ("k3", "POST", URL, "x", NOW, "a" * 16),
+                 ("k3", "POST", URL, "/x\n/y", NOW, "a" * 16), ("k3", "P0ST", URL, "/x", NOW, "a" * 16)]:
+        with pytest.raises(SignatureError):
+            canonical(*args, b"")
+
+
+@pytest.mark.parametrize("url,expected", [
+    ("https://Acme.Example/path?q=1", "https://acme.example"),
+    ("https://acme.example:443/", "https://acme.example"),
+    ("http://localhost:8001", "http://localhost:8001"),
+    ("https://user:pw@acme.example", ""),
+    ("javascript:alert(1)", ""),
+    ("https://[::1]:8443/x", "https://[::1]:8443"),
+])
+def test_origin(url, expected):
+    assert origin(url) == expected