didit-sdk 1.0.0

data/lib/didit/webhooks/verifier.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require "json"
+require "openssl"
+
+module Didit
+  module Webhooks
+    # One verification (docs/DESIGN.md section 9.3). {Didit::Webhooks.verify} and
+    # {Didit::Webhooks.verify_parsed} are the public entry points.
+    #
+    # @api private
+    class Verifier
+      # Signatures over the whole body, in the order they are tried for each secret.
+      FULL_BODY = [
+        HEADER_SIGNATURE, HEADER_SIGNATURE_V2, HEADER_SIGNATURE_PREVIOUS, HEADER_SIGNATURE_V2_PREVIOUS
+      ].freeze
+      # Signatures of the canonical JSON, the only ones a parsed body can be checked against.
+      CANONICAL = [HEADER_SIGNATURE_V2, HEADER_SIGNATURE_V2_PREVIOUS].freeze
+      # The deprecated envelope-only signatures.
+      SIMPLE = [HEADER_SIGNATURE_SIMPLE, HEADER_SIGNATURE_SIMPLE_PREVIOUS].freeze
+      ALL = (FULL_BODY + SIMPLE).freeze
+      # The fields X-Signature-Simple signs, in order.
+      SIMPLE_FIELDS = %w[timestamp session_id status webhook_type].freeze
+
+      # Timestamps at or beyond this many seconds from 1970 (16 digits) are never in tolerance.
+      MAX_TIMESTAMP = 1_000_000_000_000_000
+      # X-Timestamp: an optional sign and digits (leading zeros allowed), at most 32 characters.
+      TIMESTAMP_HEADER = /\A[+-]?[0-9]{1,31}\z/
+      # Strict JSON (no NaN). A repeated key keeps its last value, like Python. json 2.13 added
+      # allow_duplicate_key for that (without it json 2.13+ warns and json 3 raises); older
+      # versions do not know the option and keep the last value anyway.
+      DUPLICATE_KEY_OPTION = (JSON::VERSION.split(".").map(&:to_i) <=> [2, 13]).to_i >= 0
+      PARSE_OPTIONS = (DUPLICATE_KEY_OPTION ? { allow_nan: false, allow_duplicate_key: true } : { allow_nan: false })
+                      .freeze
+
+      # @raise [Didit::ConfigurationError] for a missing or empty secret, a bad tolerance or clock,
+      #   or headers that cannot be read
+      def initialize(secret, headers, tolerance:, now:)
+        @keys = secret_keys(secret)
+        @tolerance = check_tolerance(tolerance)
+        @now = check_now(now)
+        @headers = Headers.new(headers)
+        @raw = nil
+        @payload = nil
+        @digests = {}
+      end
+
+      # @return [Event]
+      def verify(raw_body, allow_simple:)
+        # Only true turns the envelope-only signature on: "false" from an environment variable must not.
+        unless [true, false].include?(allow_simple)
+          raise ConfigurationError, "allow_simple must be true or false, got #{allow_simple.inspect}."
+        end
+
+        raw = body_bytes(raw_body)
+        @raw = raw
+        @payload = normalize(parse_json(raw))
+        verified_by = check_signatures(allow_simple ? FULL_BODY + SIMPLE : FULL_BODY)
+        Event.build(payload, verified_by)
+      end
+
+      # @return [Event]
+      def verify_parsed(payload)
+        unless payload.is_a?(Hash)
+          raise failure(:invalid_payload,
+                        "verify_parsed needs the parsed JSON object (a Hash), not a #{payload.class}; " \
+                        "pass the raw body String to verify instead.")
+        end
+
+        @payload = normalize(payload)
+        Event.build(self.payload, check_signatures(CANONICAL))
+      end
+
+      private
+
+      # The parsed body, a Hash with String keys.
+      def payload
+        @payload || raise(ArgumentError, "no payload")
+      end
+
+      def secret_keys(secret)
+        if secret.nil?
+          raise ConfigurationError, "No webhook secret (nil); copy it from the webhook destination in the " \
+                                    "Didit console, for example into DIDIT_WEBHOOK_SECRET."
+        end
+        list = secret.is_a?(Array) ? secret : [secret]
+        raise ConfigurationError, "No webhook secret (an empty list)." if list.empty?
+
+        list.map { |item| key_bytes(item) }
+      end
+
+      def key_bytes(secret)
+        unless secret.is_a?(String)
+          raise ConfigurationError, "The webhook secret must be a String or an Array of Strings."
+        end
+        raise ConfigurationError, "The webhook secret is empty." if secret.empty?
+
+        (secret.encoding == Encoding::BINARY ? secret : secret.encode(Encoding::UTF_8)).b
+      rescue EncodingError
+        raise ConfigurationError, "The webhook secret cannot be converted to UTF-8."
+      end
+
+      def check_tolerance(tolerance)
+        number = tolerance.is_a?(Integer) || tolerance.is_a?(Float)
+        # `>= 0` is false for NaN, which would otherwise switch the replay check off.
+        return tolerance if number && tolerance >= 0
+
+        raise ConfigurationError, "tolerance must be a number of seconds, 0 or more."
+      end
+
+      def check_now(now)
+        return Time.now.to_f if now.nil?
+        return now if now.is_a?(Integer) || (now.is_a?(Float) && now.finite?)
+
+        raise ConfigurationError, "now must be unix seconds, an Integer or a Float."
+      end
+
+      def body_bytes(raw_body)
+        return raw_body.b if raw_body.is_a?(String)
+
+        raise failure(:invalid_payload, "The webhook body must be the raw request body as a String, " \
+                                        "not a #{raw_body.class}.")
+      end
+
+      # Every parser failure is invalid_payload, whatever the JSON library raises.
+      def parse_json(bytes)
+        text = bytes.dup.force_encoding(Encoding::UTF_8)
+        raise failure(:invalid_payload, "The webhook body is not valid UTF-8.") unless text.valid_encoding?
+
+        value = begin
+          JSON.parse(text, **PARSE_OPTIONS)
+        rescue StandardError # JSON::ParserError, JSON::NestingError, EncodingError, ...
+          raise failure(:invalid_payload, "The webhook body is not valid JSON.")
+        end
+        raise failure(:invalid_payload, "The webhook body is not a JSON object.") unless value.is_a?(Hash)
+
+        value
+      end
+
+      def normalize(value)
+        CanonicalJson.normalize(value)
+      rescue ArgumentError => e
+        raise failure(:invalid_payload, "The webhook payload is not JSON data Didit sends: #{e.message}.")
+      end
+
+      # Steps 3 to 9 of the rules: timestamp, then the signatures in order.
+      def check_signatures(checked)
+        check_timestamp
+        unless ALL.any? { |name| @headers.present?(name) }
+          raise failure(:missing_signature,
+                        "The request has no Didit signature header (X-Signature, X-Signature-V2 or " \
+                        "X-Signature-Simple).")
+        end
+
+        match(checked) || raise(no_match(checked))
+      end
+
+      def check_timestamp
+        timestamp = payload["timestamp"]
+        unless timestamp.is_a?(Integer)
+          raise failure(:missing_timestamp, "The webhook body has no integer \"timestamp\".")
+        end
+
+        stale = timestamp >= MAX_TIMESTAMP || timestamp <= -MAX_TIMESTAMP
+        check_timestamp_header(timestamp) unless stale
+        return unless stale || (@now - timestamp).abs > @tolerance
+
+        raise failure(:timestamp_out_of_tolerance,
+                      "The webhook timestamp is more than #{@tolerance} seconds away from now: a delayed or " \
+                      "replayed delivery, or a clock that is off.")
+      end
+
+      def check_timestamp_header(timestamp)
+        header = @headers.timestamp
+        return if header.nil? || (header.match?(TIMESTAMP_HEADER) && Integer(header, 10) == timestamp)
+
+        raise failure(:timestamp_mismatch, "X-Timestamp does not match the \"timestamp\" in the webhook body.")
+      end
+
+      # The first header, for the first secret, whose signature matches; nil when none does.
+      def match(checked)
+        full = checked & FULL_BODY
+        simple = checked & SIMPLE
+        @keys.each do |key|
+          full.each { |name| return name if signed?(key, name) }
+        end
+        return if simple.empty? || simple_message.nil?
+
+        @keys.each do |key|
+          simple.each { |name| return name if signed?(key, name) }
+        end
+        nil
+      end
+
+      def signed?(key, name)
+        candidates = @headers.signatures(name)
+        return false if candidates.empty?
+
+        expected = digest(key, name)
+        candidates.any? { |candidate| OpenSSL.fixed_length_secure_compare(expected, candidate) }
+      end
+
+      # The HMAC of what +name+ signs; a header and its -Previous variant share it.
+      def digest(key, name)
+        kind = message_kind(name)
+        @digests[[key, kind]] ||= OpenSSL::HMAC.hexdigest("SHA256", key, message(kind))
+      end
+
+      def message_kind(name)
+        return :canonical if CANONICAL.include?(name)
+
+        SIMPLE.include?(name) ? :simple : :raw
+      end
+
+      def message(kind)
+        case kind
+        when :raw then @raw || raise(ArgumentError, "no raw body")
+        when :canonical then canonical
+        else simple_message || raise(ArgumentError, "no simple message")
+        end
+      end
+
+      # Built only when an X-Signature-V2 value is well formed and nothing matched before it.
+      def canonical
+        @canonical ||= CanonicalJson.dump(payload)
+      end
+
+      # "{timestamp}:{session_id}:{status}:{webhook_type}" with Python's str() of each value;
+      # nil when one of them is an object or an array, which never matches.
+      def simple_message
+        return @simple_message if defined?(@simple_message)
+
+        parts = SIMPLE_FIELDS.map { |field| payload.key?(field) ? CanonicalJson.python_str(payload[field]) : "" }
+        @simple_message = parts.all? ? parts.join(":") : nil
+      end
+
+      def no_match(checked)
+        present = ALL.select { |name| @headers.present?(name) }
+        message =
+          if checked == CANONICAL && !present.intersect?(CANONICAL)
+            "verify_parsed can check only X-Signature-V2, and the request has none; pass the raw body to verify."
+          elsif checked == CANONICAL
+            "X-Signature-V2 does not match: check that the secret belongs to this destination and that the " \
+              "payload is the body as parsed, unchanged."
+          elsif !present.intersect?(checked)
+            "The request carries only X-Signature-Simple, which does not cover the body and counts only " \
+              "with allow_simple: true."
+          else
+            "No webhook signature matches the secret: check that the secret belongs to this destination and " \
+              "that the raw body reaches verify unchanged."
+          end
+        failure(:invalid_signature, message)
+      end
+
+      def failure(reason, message)
+        WebhookVerificationError.new(reason, message)
+      end
+    end
+  end
+end

data/lib/didit/webhooks.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module Didit
+  # Verify Didit webhook deliveries and read them as typed events (docs/DESIGN.md section 9).
+  #
+  #   event = Didit::Webhooks.verify(request.raw_post, request.headers, ENV.fetch("DIDIT_WEBHOOK_SECRET"))
+  #   case event
+  #   in Didit::Webhooks::StatusUpdatedEvent(status: "Approved", session_id:) then approve(session_id)
+  #   in Didit::Webhooks::UnknownEvent then nil # a type this SDK version does not know yet
+  #   else nil
+  #   end
+  #
+  # The verifier needs no client, no API key and no framework; +examples/webhooks/+ has Rails,
+  # Sinatra and plain Rack receivers. The same methods are on +client.webhooks+.
+  module Webhooks
+    # Default maximum distance in seconds between the delivery's timestamp and now.
+    DEFAULT_TOLERANCE = 300
+
+    HEADER_SIGNATURE = "X-Signature"
+    HEADER_SIGNATURE_V2 = "X-Signature-V2"
+    HEADER_SIGNATURE_SIMPLE = "X-Signature-Simple"
+    HEADER_SIGNATURE_PREVIOUS = "X-Signature-Previous"
+    HEADER_SIGNATURE_V2_PREVIOUS = "X-Signature-V2-Previous"
+    HEADER_SIGNATURE_SIMPLE_PREVIOUS = "X-Signature-Simple-Previous"
+    HEADER_TIMESTAMP = "X-Timestamp"
+
+    class << self
+      # Verifies a webhook delivery and returns its typed event.
+      #
+      # Pass the exact bytes of the request body (+request.raw_post+, +request.body.read+).
+      # The delivery is accepted when, for one of the secrets, +X-Signature+ matches the body,
+      # +X-Signature-V2+ matches its canonical JSON (it survives middleware that re-encodes the
+      # JSON), or one of their +-Previous+ variants matches (secret rotation). The deprecated
+      # +X-Signature-Simple+ counts only with +allow_simple: true+, and then
+      # {Event#body_authenticated?} is false: re-fetch the record from the API.
+      #
+      # @param raw_body [String] the request body as received, in any encoding (read as UTF-8)
+      # @param headers [Hash, #each] request headers: a Hash (names in any case), a Rack env,
+      #   Rails +request.headers+, or [name, value] pairs
+      # @param secret [String, Array<String>] the destination's secret, or several during a rotation
+      # @param tolerance [Integer, Float] largest accepted distance in seconds between the
+      #   delivery's timestamp and now
+      # @param allow_simple [Boolean] also accept the envelope-only +X-Signature-Simple+
+      # @param now [Integer, Float, nil] the current unix time, for tests
+      # @return [Event]
+      # @raise [Didit::WebhookVerificationError] when the delivery fails verification; +reason+ says why
+      # @raise [Didit::ConfigurationError] for a missing or empty secret, a negative tolerance,
+      #   an +allow_simple+ other than true or false, or headers that cannot be read
+      def verify(raw_body, headers, secret, tolerance: DEFAULT_TOLERANCE, allow_simple: false, now: nil)
+        Verifier.new(secret, headers, tolerance: tolerance, now: now).verify(raw_body, allow_simple: allow_simple)
+      end
+
+      # Verifies a delivery when the framework only gives the parsed JSON body.
+      #
+      # Only +X-Signature-V2+ and +X-Signature-V2-Previous+ can be checked: the other signatures
+      # cover the exact body bytes. Prefer {verify} with the raw body whenever you have it.
+      #
+      # @param payload [Hash] the parsed JSON object, String or Symbol keys
+      # @return [Event]
+      # @raise (see verify)
+      def verify_parsed(payload, headers, secret, tolerance: DEFAULT_TOLERANCE, now: nil)
+        Verifier.new(secret, headers, tolerance: tolerance, now: now).verify_parsed(payload)
+      end
+
+      # The canonical JSON of a parsed body, the text +X-Signature-V2+ signs: exactly Python's
+      # +json.dumps(shorten_floats(value), sort_keys=True, separators=(",", ":"), ensure_ascii=False)+.
+      #
+      # @param value [Hash, Array, String, Integer, Float, true, false, nil] parsed JSON
+      # @return [String] UTF-8
+      # @raise [ArgumentError] when +value+ is not JSON data (NaN, Infinity, a lone surrogate, ...)
+      def canonical_json(value)
+        CanonicalJson.generate(value)
+      end
+
+      # Builds the typed event of a payload WITHOUT verifying anything.
+      #
+      # For unsigned callbacks only, such as +kyb.registry_search.resolved+: anyone can send
+      # such a request, so treat every field as untrusted and fetch the record from the API
+      # before acting on it. {Event#verified_by} is nil and {Event#body_authenticated?} false.
+      #
+      # @param payload [Hash] the parsed JSON object
+      # @return [Event]
+      # @raise [ArgumentError] when +payload+ is not a Hash
+      def parse_event(payload)
+        unless payload.is_a?(Hash)
+          raise ArgumentError, "parse_event needs the parsed JSON object (a Hash), not a #{payload.class}"
+        end
+
+        Event.build(payload)
+      end
+    end
+  end
+end
+
+require_relative "webhooks/canonical_json"
+require_relative "webhooks/headers"
+require_relative "webhooks/verifier"
+require_relative "webhooks/events"
+require_relative "webhooks/client_methods"

data/lib/didit-sdk.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+# Lets Bundler.require load the gem by its name, didit-sdk.
+require_relative "didit"

data/lib/didit.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative "didit/version"
+require_relative "didit/errors"
+
+# The official Didit Ruby library.
+#
+#   didit = Didit::Client.new # reads DIDIT_API_KEY
+#   session = didit.sessions.create(workflow_id: "...", vendor_data: "user-42")
+#
+# See https://docs.didit.me and docs/DESIGN.md.
+module Didit
+  # The value of a keyword argument the caller did not pass. Such arguments are
+  # left out of the request; +nil+ sends JSON +null+.
+  OMIT = Object.new.tap do |omit|
+    def omit.inspect = "Didit::OMIT"
+    def omit.to_s = "Didit::OMIT"
+  end.freeze
+
+  autoload :Authentication, "didit/authentication"
+  autoload :Client, "didit/client"
+  autoload :FilePart, "didit/file_part"
+  autoload :Internal, "didit/internal"
+  autoload :Model, "didit/model"
+  autoload :Page, "didit/page"
+  autoload :RawResponse, "didit/raw_response"
+  autoload :Resource, "didit/resource"
+  autoload :Resources, "didit/resources"
+  autoload :Types, "didit/types"
+  autoload :Webhooks, "didit/webhooks"
+end

data/sig/didit/authentication/base64_url.rbs

@@ -0,0 +1,10 @@
+module Didit
+  class Authentication
+    module Base64Url
+      ALPHABET: Regexp
+
+      def self?.encode: (String bytes) -> String
+      def self?.decode: (String text) -> String?
+    end
+  end
+end

data/sig/didit/authentication/cache.rbs

@@ -0,0 +1,60 @@
+module Didit
+  class Authentication
+    class Discovery
+      attr_reader issuer: String
+      attr_reader token_endpoint: String
+      attr_reader jwks_uri: String
+      attr_reader document: Hash[String, untyped]
+
+      def initialize: (issuer: String, token_endpoint: String, jwks_uri: String, document: Hash[String, untyped]) -> void
+    end
+
+    class IssuerCache
+      DEFAULT_MAX_AGE: Integer
+      MIN_MAX_AGE: Integer
+      MAX_MAX_AGE: Integer
+      REFETCH_INTERVAL: Integer
+      NO_CACHE: Array[String]
+
+      class Entry[T]
+        attr_reader value: T
+        attr_reader expires_at: Float
+
+        def initialize: (T value, Float expires_at) -> void
+      end
+
+      def self.cache_seconds: (Hash[String, String] headers) -> Integer
+      def self.deep_freeze: (untyped value) -> untyped
+
+      private
+
+      def self.max_age: (String cache_control) -> Integer?
+
+      public
+
+      @clock: ^() -> (Integer | Float)
+      @discovery: Entry[Discovery]?
+      @key_set: Entry[KeySet]?
+      @key_set_attempted_at: Float?
+      @key_set_failed: bool
+      @refused: Entry[String]?
+
+      def initialize: (^() -> (Integer | Float) clock) -> void
+      def discovery: () -> Discovery?
+      def store_discovery: (Discovery discovery, Hash[String, String] headers) -> Discovery
+      def discovery_refused: (String message) -> nil
+      def refused_discovery: () -> String?
+      def key_set: () -> KeySet?
+      def store_key_set: (KeySet key_set, Hash[String, String] headers) -> KeySet
+      def key_set_fetch_failed: () -> nil
+      def key_set_unavailable?: () -> bool
+      def key_set_with: (String kid) -> KeySet?
+      def needs_key_set_fetch?: (String? kid) -> bool
+
+      private
+
+      def fresh: [T] (Entry[T]? entry) -> T?
+      def now: () -> Float
+    end
+  end
+end

data/sig/didit/authentication/http.rbs

@@ -0,0 +1,37 @@
+module Didit
+  class Authentication
+    class Http
+      class Call
+        attr_reader http_method: String
+        attr_reader uri: URI::Generic
+        attr_reader bearer: String?
+        attr_reader form: Hash[String, String]?
+        attr_reader json: Hash[String, untyped]?
+        attr_reader secrets: Array[String]
+
+        def initialize: (String http_method, URI::Generic uri, ?bearer: String?, ?form: Hash[String, String]?,
+                         ?json: Hash[String, untyped]?, ?secrets: Array[String]) -> void
+        def display_url: () -> String
+        def describe: () -> String
+      end
+
+      VERBS: Hash[String, Symbol]
+
+      @timeout: Float
+      @transport: Internal::Transport
+
+      def initialize: (timeout: Float, http_client: Internal::http_client?) -> void
+      def perform: (Call call) -> Internal::Transport::Response
+      def close: () -> nil
+      def read: (Call call, Internal::Transport::Response response) -> untyped
+      def read_object: (Call call, Internal::Transport::Response response) -> Hash[String, untyped]
+      def validation_error: (Call call, Internal::Transport::Response response, String message) -> APIResponseValidationError
+
+      private
+
+      def headers_for: (Call call) -> Hash[String, String]
+      def body_for: (Call call) -> String?
+      def text_of: (String body) -> String
+    end
+  end
+end

data/sig/didit/authentication/issuer.rbs

@@ -0,0 +1,17 @@
+module Didit
+  class Authentication
+    module Issuer
+      LOOPBACK_HOSTS: Array[String]
+      PREFIXES: Hash[String, bool]
+      UNSAFE: Regexp
+
+      def self?.normalize: (untyped issuer, ?allow_loopback_http: bool) -> String
+      def self?.from_publishable_key: (untyped publishable_key) -> String
+      def self?.loopback?: (String host) -> bool
+      def self?.decode_issuer: (String prefix, String encoded) -> String
+      def self?.unpad: (String text) -> String
+      def self?.parse: (String text) -> URI::HTTP
+      def self?.invalid: (String text) -> bot
+    end
+  end
+end

data/sig/didit/authentication/jws.rbs

@@ -0,0 +1,41 @@
+module Didit
+  class Authentication
+    module Jws
+      type kind = :access | :id
+
+      ALGORITHM: String
+      MAX_TOKEN_LENGTH: Integer
+      ACCESS_TYPES: Array[String]
+      ID_TYPES: Array[String]
+      ZERO: String
+      JSON_OPTIONS: Hash[Symbol, untyped]
+      DECODE_OPTIONS: Hash[Symbol, untyped]
+
+      class Parsed
+        attr_reader token: String
+        attr_reader header: Hash[String, untyped]
+        attr_reader claims: Hash[String, untyped]
+        attr_reader signature: String
+        attr_reader kid: String
+
+        def initialize: (token: String, header: Hash[String, untyped], claims: Hash[String, untyped], signature: String,
+                         kid: String) -> void
+      end
+
+      def self?.parse: (untyped token, Symbol kind) -> Parsed
+      def self?.verify_signature: (Parsed parsed, OpenSSL::PKey::EC key) -> nil
+      def self?.check_claims: (Hash[String, untyped] claims, kind: Symbol, issuer: String, audience: Array[String]?,
+                               nonce: String?, leeway: Float, now: Float) -> nil
+      def self?.shown: (untyped value) -> String
+      def self?.fail!: (Symbol reason, String message) -> bot
+      def self?.json_object: (String segment, String part) -> Hash[String, untyped]
+      def self?.check_header: (Hash[String, untyped] header, Symbol kind) -> void
+      def self?.check_type: (untyped typ, Symbol kind) -> void
+      def self?.check_issuer: (Hash[String, untyped] claims, String issuer) -> void
+      def self?.check_times: (Hash[String, untyped] claims, Float leeway, Float now) -> void
+      def self?.numeric_date: (Hash[String, untyped] claims, String name) -> Float
+      def self?.check_audience: (Hash[String, untyped] claims, Array[String] audience) -> void
+      def self?.check_nonce: (Hash[String, untyped] claims, String? nonce) -> void
+    end
+  end
+end

data/sig/didit/authentication/jwt.rbs

@@ -0,0 +1,14 @@
+# The parts of the jwt gem (>= 2.7, < 4) that Didit::Authentication uses: the gem
+# ships no signatures. Only Didit::Authentication::Jws calls it.
+module JWT
+  def self.decode: (String jwt, ?untyped key, ?bool verify, ?Hash[Symbol, untyped] options) -> Array[untyped]
+
+  class DecodeError < StandardError
+  end
+
+  class VerificationError < DecodeError
+  end
+
+  class IncorrectAlgorithm < DecodeError
+  end
+end

data/sig/didit/authentication/key_set.rbs

@@ -0,0 +1,25 @@
+module Didit
+  class Authentication
+    class KeySet
+      SPKI_PREFIX: String
+      UNCOMPRESSED: String
+
+      def self.parse: (untyped data) -> KeySet?
+      def self.p256_key: (Hash[String, untyped] jwk) -> OpenSSL::PKey::EC?
+
+      private
+
+      def self.coordinate: (untyped value) -> String?
+
+      public
+
+      @keys: Hash[String, OpenSSL::PKey::EC]
+
+      attr_reader document: Hash[String, untyped]
+
+      def initialize: (Hash[String, OpenSSL::PKey::EC] keys, Hash[String, untyped] document) -> void
+      def []: (String kid) -> OpenSSL::PKey::EC?
+      def key?: (String kid) -> bool
+    end
+  end
+end

data/sig/didit/authentication/pkce.rbs

@@ -0,0 +1,20 @@
+module Didit
+  class Authentication
+    class Pkce
+      METHOD: String
+      VERIFIER: Regexp
+
+      attr_reader code_verifier: String
+      attr_reader code_challenge: String
+      attr_reader code_challenge_method: String
+
+      def self.generate: () -> Pkce
+      def self.s256_challenge: (String verifier) -> String
+
+      def initialize: (untyped code_verifier) -> void
+      def to_h: () -> { code_verifier: String, code_challenge: String, code_challenge_method: String }
+      def inspect: () -> String
+      def to_s: () -> String
+    end
+  end
+end