oydid 0.5.4 → 0.5.6

data/lib/oydid.rb

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 # frozen_string_literal: true
 
-require 'dag'
+require 'simple_dag'
 require 'jwt'
 require 'rbnacl'
 require 'ed25519'
@@ -24,9 +24,18 @@ class Oydid
     DEFAULT_ENCODING = "base58btc"
     SUPPORTED_ENCODINGS = ["base16", "base32", "base58btc", "base64"]
     LOG_HASH_OPTIONS = {:digest => "sha2-256", :encode => "base58btc"}
+    DEFAULT_PUBLIC_RESOLVER = "https://dev.uniresolver.io/1.0/identifiers/"
+
+    # full Multicodecs table: https://github.com/multiformats/multicodec/blob/master/table.csv
+    # Multicodecs.register(code: 0x1305, name: 'rsa-priv', tag: 'key')
+    # Multicodecs.register(code: 0x1205, name: 'rsa-pub', tag: 'key')
 
     # expected DID format: did:oyd:123
     def self.read(did, options)
+        if did.to_s == ""
+            return [nil, "missing DID"]
+        end
+
         # setup
         currentDID = {
             "did": did,
@@ -115,15 +124,12 @@ class Oydid
             if options[:trace]
                 puts " .. DAG with " + dag.vertices.length.to_s + " vertices and " + dag.edges.length.to_s + " edges, CREATE index: " + create_index.to_s
             end
-            ordered_log_array = dag2array(dag, log_array, create_index, [], options)
-            ordered_log_array << log_array[terminate_index]
-            currentDID["log"] = ordered_log_array
-            if options[:trace]
-                if options[:silent].nil? || !options[:silent]
-                    puts "    vertex " + terminate_index.to_s + " at " + log_array[terminate_index]["ts"].to_s + " op: " + log_array[terminate_index]["op"].to_s + " doc: " + log_array[terminate_index]["doc"].to_s
-                end
-            end
+
+            result = dag2array(dag, log_array, create_index, [], options)
+            ordered_log_array = dag2array_terminate(dag, log_array, terminate_index, result, options)
             currentDID["log"] = ordered_log_array
+            # !!! ugly hack to get access to all delegation keys required in dag_update
+            currentDID["full_log"] = log_array
             if options[:trace]
                 if options[:silent].nil? || !options[:silent]
                     dag.edges.each do |e|
@@ -131,14 +137,24 @@ class Oydid
                     end
                 end
             end
-            currentDID = dag_update(currentDID, options)
+
+            # identify if DID Rotation was performed
+            rotated_DID = (currentDID.transform_keys(&:to_s)["doc"]["doc"].has_key?("@context") &&
+                currentDID.transform_keys(&:to_s)["doc"]["doc"].has_key?("id") &&
+                currentDID.transform_keys(&:to_s)["doc"]["doc"]["id"].split(":").first == "did") rescue false
+
+            if rotated_DID
+                doc = currentDID["doc"].dup
+                currentDID = dag_update(currentDID, options)
+                currentDID["doc"] = doc
+            else
+                currentDID = dag_update(currentDID, options)
+            end
             if options[:log_complete]
                 currentDID["log"] = log_array
             end
-
             return [currentDID, ""]
         end
-
     end
 
     def self.create(content, options)
@@ -150,7 +166,7 @@ class Oydid
     end
 
     def self.simulate_did(content, did, mode, options)
-        did_doc, did_key, did_log, msg = Oydid.generate_base(content, did, mode, options)
+        did_doc, did_key, did_log, msg = generate_base(content, did, mode, options)
         user_did = did_doc[:did]
         return [user_did, msg]
     end
@@ -169,50 +185,38 @@ class Oydid
         revoc_log = nil
         doc_location = options[:location]
         if options[:ts].nil?
-            ts = Time.now.to_i
+            ts = Time.now.utc.to_i
         else
             ts = options[:ts]
         end
 
-        if mode == "create" || mode == "clone"
-            operation_mode = 2 # CREATE
-            if options[:doc_key].nil?
-                if options[:doc_enc].nil?
-                    privateKey, msg = generate_private_key(options[:doc_pwd].to_s, 'ed25519-priv', options)
-                else
-                    privateKey, msg = decode_private_key(options[:doc_enc].to_s, options)
-                end
-            else
-                privateKey, msg = read_private_key(options[:doc_key].to_s, options)
-                if privateKey.nil?
-                    return [nil, nil, nil, "private document key not found"]
-                end
+        # key management
+        tmp_did_hash = did.delete_prefix("did:oyd:") rescue ""
+        tmp_did10 = tmp_did_hash[0,10] + "_private_key.enc" rescue ""
+        privateKey, msg = getPrivateKey(options[:doc_enc], options[:doc_pwd], options[:doc_key], tmp_did10, options)
+        if privateKey.nil?
+            privateKey, msg = generate_private_key("", 'ed25519-priv', options)
+            if privateKey.nil?
+                return [nil, nil, nil, "private document key not found"]
             end
-            if options[:rev_key].nil?
-                if options[:rev_enc].nil?
-                    revocationKey, msg = generate_private_key(options[:rev_pwd].to_s, 'ed25519-priv', options)
-                else
-                    revocationKey, msg = decode_private_key(options[:rev_enc].to_s, options)
-                end
-            else
-                revocationKey, msg = read_private_key(options[:rev_key].to_s, options)
-                if revocationKey.nil?
-                    return [nil, nil, nil, "private revocation key not found"]
-                end
+        end
+        tmp_did10 = tmp_did_hash[0,10] + "_revocation_key.enc" rescue ""
+        revocationKey, msg = getPrivateKey(options[:rev_enc], options[:rev_pwd], options[:rev_key], tmp_did10, options)
+        if revocationKey.nil?
+            revocationKey, msg = generate_private_key("", 'ed25519-priv', options)
+            if revocationKey.nil?
+                return [nil, nil, nil, "private revocation key not found"]
             end
-        else # mode == "update"  => read information
-            # if a location is provided this is only relevant for writing the DID
-            update_location = options[:location]
-            update_doc_location = options[:doc_location]
-            update_log_location = options[:log_location]
-            options[:location] = nil
-            options[:doc_location] = nil
-            options[:log_location] = nil
-            did_info, msg = read(did, options)
-            options[:location] = options[:location]
-            options[:doc_location] = options[:doc_location]
-            options[:log_location] = options[:log_location]
+        end
 
+        # mode-specific handling
+        if mode == "create" || mode == "clone"
+            operation_mode = 2 # CREATE
+
+        else # mode == "update"  => read information first
+            operation_mode = 3 # UPDATE
+
+            did_info, msg = read(did, options)
             if did_info.nil?
                 return [nil, nil, nil, "cannot resolve DID (on updating DID)"]
             end
@@ -230,90 +234,64 @@ class Oydid
                     doc_location = hash_split[1]
                 end
             end
-            operation_mode = 3 # UPDATE
-
-            # collect relevant information from previous did
             did_old = did.dup
             did10_old = did10.dup
             log_old = did_info["log"]
-            if options[:old_doc_key].nil?
-                if options[:old_doc_enc].nil?
-                    if options[:old_doc_pwd].nil?
-                        privateKey_old = read_private_storage(did10_old + "_private_key.enc")
-                    else
-                        privateKey_old, msg = generate_private_key(options[:old_doc_pwd].to_s, 'ed25519-priv', options)
-                    end
-                else
-                    privateKey_old, msg = decode_private_key(options[:old_doc_enc].to_s, options)
-                end
+
+            # check if provided old keys are native DID keys or delegates ==================
+            tmp_old_did10 = did10_old + "_private_key.enc" rescue ""
+            old_privateKey, msg = getPrivateKey(options[:old_doc_enc], options[:old_doc_pwd], options[:old_doc_key], tmp_old_did10, options)
+            tmp_old_did10 = did10_old + "_revocation_key.enc" rescue ""
+            old_revocationKey, msg = getPrivateKey(options[:old_rev_enc], options[:old_rev_pwd], options[:old_rev_key], tmp_did10, options)
+            old_publicDocKey = public_key(old_privateKey, {}).first
+            old_publicRevKey = public_key(old_revocationKey, {}).first
+            old_did_key = old_publicDocKey + ":" + old_publicRevKey
+
+            # compare old keys with existing DID Document & generate revocation record
+            if old_did_key.to_s == did_info["doc"]["key"].to_s
+                # provided keys are native DID keys ------------------
+
+                # re-build revocation document
+                old_did_doc = did_info["doc"]["doc"]
+                old_ts = did_info["log"].last["ts"]
+                old_subDid = {"doc": old_did_doc, "key": old_did_key}.to_json
+                old_subDidHash = multi_hash(canonical(old_subDid), LOG_HASH_OPTIONS).first
+                old_signedSubDidHash = sign(old_subDidHash, old_revocationKey, LOG_HASH_OPTIONS).first
+                revocationLog = { 
+                    "ts": old_ts,
+                    "op": 1, # REVOKE
+                    "doc": old_subDidHash,
+                    "sig": old_signedSubDidHash }.transform_keys(&:to_s).to_json
             else
-                privateKey_old, msg = read_private_key(options[:old_doc_key].to_s, options)
-            end
+                # proviced keys are either delegates or invalid ------
+                # * check validity of key-doc delegate
+                pubKeys, msg = getDelegatedPubKeysFromDID(did, "doc")
+                if !pubKeys.include?(old_publicDocKey)
+                    return [nil, nil, nil, "invalid or missing old private document key"]
+                end
 
-            if privateKey_old.nil?
-                return [nil, nil, nil, "invalid or missing old private document key"]
-            end
-            if options[:old_rev_key].nil?
-                if options[:old_rev_enc].nil?
-                    if options[:old_rev_pwd].nil?
-                        revocationKey_old = read_private_storage(did10_old + "_revocation_key.enc")
-                    else
-                        revocationKey_old, msg = generate_private_key(options[:old_rev_pwd].to_s, 'ed25519-priv', options)
+                # * check validity of key-rev delegate
+                pubKeys, msg = getDelegatedPubKeysFromDID(did, "rev")
+                if !pubKeys.include?(old_publicRevKey)
+                    return [nil, nil, nil, "invalid or missing old private revocation key"]
+                end
+
+                # retrieve revocationLog from previous in key-rev delegate
+                revoc_log = nil
+                log_old.each do |item|
+                    if !item["encrypted-revocation-log"].nil?
+                        revoc_log = item["encrypted-revocation-log"]
                     end
-                else
-                    revocationKey_old, msg = decode_private_key(options[:old_rev_enc].to_s, options)
                 end
-            else
-                revocationKey_old, msg = read_private_key(options[:old_rev_key].to_s, options)
-            end
-            if revocationKey_old.nil?
-                return [nil, nil, nil, "invalid or missing old private revocation key"]
-            end
-            # key management
-            if options[:doc_key].nil?
-                if options[:doc_enc].nil?
-                    privateKey, msg = generate_private_key(options[:doc_pwd].to_s, 'ed25519-priv', options)
-                else
-                    privateKey, msg = decode_private_key(options[:doc_enc].to_s, options)
+                if revoc_log.nil?
+                    return [nil, nil, nil, "cannot retrieve revocation log"]
                 end
-            else
-                privateKey, msg = read_private_key(options[:doc_key].to_s, options)
-            end
-            # if options[:rev_key].nil? && options[:rev_pwd].nil? && options[:rev_enc].nil?
-            #     revocationLog = read_private_storage(did10 + "_revocation.json")
-            #     if revocationLog.nil?
-            #         return [nil, nil, nil, "invalid or missing old revocation log"]
-            #     end
-            # else
-                if options[:rev_key].nil?
-                    if options[:rev_enc].nil?
-                        if options[:rev_pwd].nil?
-                            revocationKey, msg = generate_private_key("", 'ed25519-priv', options)
-                        else
-                            revocationKey, msg = generate_private_key(options[:rev_pwd].to_s, 'ed25519-priv', options)
-                        end
-                    else
-                        revocationKey, msg = decode_private_key(options[:rev_enc].to_s, options)
-                    end
-                else
-                    revocationKey, msg = read_private_key(options[:rev_key].to_s, options)
+                revocationLog, msg = decrypt(revoc_log.to_json, old_revocationKey.to_s)
+                if revocationLog.nil?
+                    return [nil, nil, nil, "cannot decrypt revocation log entry: " + msg]
                 end
+            end # compare old keys with existing DID Document
 
-                # re-build revocation document
-                did_old_doc = did_info["doc"]["doc"]
-                ts_old = did_info["log"].last["ts"]
-                publicKey_old = public_key(privateKey_old, options).first
-                pubRevoKey_old = public_key(revocationKey_old, options).first
-                did_key_old = publicKey_old + ":" + pubRevoKey_old
-                subDid = {"doc": did_old_doc, "key": did_key_old}.to_json
-                subDidHash = multi_hash(canonical(subDid), LOG_HASH_OPTIONS).first
-                signedSubDidHash = sign(subDidHash, revocationKey_old, options).first
-                revocationLog = { 
-                    "ts": ts_old,
-                    "op": 1, # REVOKE
-                    "doc": subDidHash,
-                    "sig": signedSubDidHash }.transform_keys(&:to_s).to_json
-            # end
             revoc_log = JSON.parse(revocationLog)
             revoc_log["previous"] = [
                 multi_hash(canonical(log_old[did_info["doc_log_id"].to_i]), LOG_HASH_OPTIONS).first, 
@@ -325,11 +303,25 @@ class Oydid
         pubRevoKey = public_key(revocationKey, options).first
         did_key = publicKey + ":" + pubRevoKey
 
-        # check if pubKeys matches with existing DID Document
-        if mode == "update"
-            if did_key_old.to_s != did_info["doc"]["key"].to_s
-                return [nil, nil, nil, "keys from original DID don't match"]
+        if options[:x25519_keyAgreement]
+            if did_doc.nil?
+                did_doc = {}
+            end
+            did_doc[:keyAgreement] = [{
+                "id": "#key-doc-x25519",
+                "type": "X25519KeyAgreementKey2019",
+                "publicKeyMultibase": public_key(privateKey, options, 'x25519-pub').first
+            }]
+            did_doc = did_doc.transform_keys(&:to_s)
+        end
+        if options[:authentication]
+            if did_doc.nil?
+                did_doc = {}
             end
+            did_doc[:authentication] = [{
+                "id": "#key-doc"
+            }]
+            did_doc = did_doc.transform_keys(&:to_s)
         end
 
         # build new revocation document
@@ -350,11 +342,16 @@ class Oydid
         if !doc_location.nil?
             l2_doc += LOCATION_PREFIX + doc_location.to_s
         end
+        if options[:confirm_logs].nil?
+            previous_array = []
+        else
+            previous_array = options[:confirm_logs]
+        end
         l2 = { "ts": ts,
                "op": 0, # TERMINATE
                "doc": l2_doc,
                "sig": sign(l2_doc, privateKey, options).first,
-               "previous": [] }.transform_keys(&:to_s)
+               "previous": previous_array }.transform_keys(&:to_s)
 
         # build actual DID document
         log_str = multi_hash(canonical(l2), LOG_HASH_OPTIONS).first
@@ -389,13 +386,27 @@ class Oydid
         end
 
         # build creation log entry
+        log_revoke_encrypted_array = nil
         if operation_mode == 3 # UPDATE
             l1 = { "ts": ts,
                    "op": operation_mode, # UPDATE
                    "doc": l1_doc,
-                   "sig": sign(l1_doc, privateKey_old, options).first,
+                   "sig": sign(l1_doc, old_privateKey, options).first,
                    "previous": prev_hash }.transform_keys(&:to_s)
-        else        
+            options[:confirm_logs].each do |el|
+                # read each log entry to check if it is a revocation delegation
+                log_item, msg = retrieve_log_item(el, doc_location, options)
+                if log_item["doc"][0..3] == "rev:"
+                    cipher, msg = encrypt(r1.to_json, log_item["encryption-key"], {})
+                    cipher[:log] = el.to_s
+                    if log_revoke_encrypted_array.nil?
+                        log_revoke_encrypted_array = [cipher]
+                    else
+                        log_revoke_encrypted_array << cipher
+                    end
+                end
+            end unless options[:confirm_logs].nil?
+        else
             l1 = { "ts": ts,
                    "op": operation_mode, # CREATE
                    "doc": l1_doc,
@@ -407,7 +418,6 @@ class Oydid
         # did_doc = [did, didDocument, did_old]
         # did_log = [revoc_log, l1, l2, r1, log_old]
         # did_key = [privateKey, revocationKey]
-
         did_doc = {
             :did => did,
             :didDocument => didDocument,
@@ -420,6 +430,10 @@ class Oydid
             :r1 => r1,
             :log_old => log_old
         }
+        if !log_revoke_encrypted_array.nil?
+            did_log[:r1_encrypted] = log_revoke_encrypted_array
+        end
+
         did_key = {
             :privateKey => privateKey,
             :revocationKey => revocationKey
@@ -482,6 +496,7 @@ class Oydid
         l1 = did_log[:l1]
         l2 = did_log[:l2]
         r1 = did_log[:r1]
+        r1_encrypted = did_log[:r1_encrypted]
         log_old = did_log[:log_old]
         privateKey = did_key[:privateKey]
         revocationKey = did_key[:revocationKey]
@@ -504,7 +519,7 @@ class Oydid
         end
         case doc_location.to_s
         when /^http/
-            logs = [revoc_log, l1, l2].flatten.compact
+            logs = [revoc_log, l1, l2, r1_encrypted].flatten.compact
         else
             logs = [log_old, revoc_log, l1, l2].flatten.compact
             if !did_old.nil?
@@ -514,14 +529,17 @@ class Oydid
         success, msg = publish(did, didDocument, logs, options)
 
         if success
+            didDocumentBackup = Marshal.load(Marshal.dump(didDocument))
             w3c_input = {
-                "did" => did,
-                "doc" => didDocument
+                "did" => did.clone,
+                "doc" => didDocument.clone
             }
+            doc_w3c = Oydid.w3c(w3c_input, options)
+            didDocument = didDocumentBackup
             retVal = {
                 "did" => did,
                 "doc" => didDocument,
-                "doc_w3c" => w3c(w3c_input, options),
+                "doc_w3c" => doc_w3c,
                 "log" => logs
             }
             if options[:return_secrets]
@@ -540,11 +558,88 @@ class Oydid
         end
     end
 
+    def self.write_log(did, log, options = {})
+        # validate log
+        if !log.is_a?(Hash)
+            return [nil, "invalid log input"]
+        end
+        log = log.transform_keys(&:to_s)
+        if log["ts"].nil?
+            return [nil, "missing timestamp in log"]
+        end
+        if log["op"].nil?
+           return [nil, "missing operation in log"]
+        end 
+        if log["doc"].nil?
+           return [nil, "missing doc entry in log"]
+        end 
+        if log["sig"].nil?
+           return [nil, "missing signature in log"]
+        end
+
+        # validate did
+        if did.include?(LOCATION_PREFIX)
+            tmp = did.split(LOCATION_PREFIX)
+            did = tmp[0]
+            source_location = tmp[1]
+            log_location = tmp[1]
+        end
+        if did.include?(CGI.escape LOCATION_PREFIX)
+            tmp = did.split(CGI.escape LOCATION_PREFIX)
+            did = tmp[0] 
+            source_location = tmp[1]
+            log_location = tmp[1]
+        end
+
+        if source_location.to_s == ""
+            if options[:doc_location].nil?
+                source_location = DEFAULT_LOCATION
+            else
+                source_location = options[:doc_location]
+            end
+            if options[:log_location].nil?
+                log_location = DEFAULT_LOCATION
+            else
+                log_location = options[:log_location]
+            end
+        end
+        options[:doc_location] = source_location
+        options[:log_location] = log_location
+        source_did, msg = read(did, options)
+        if source_did.nil?
+            return [nil, "cannot resolve DID (on writing logs)"]
+        end
+        if source_did["error"] != 0
+            return [nil, source_did["message"].to_s]
+        end
+        if source_did["doc_log_id"].nil?
+            return [nil, "cannot parse DID log"]
+        end
+
+        # write log
+        source_location = source_location.gsub("%3A",":")
+        source_location = source_location.gsub("%2F%2F","//")
+        retVal = HTTParty.post(source_location + "/log/" + did,
+            headers: { 'Content-Type' => 'application/json' },
+            body: {"log": log}.to_json )
+        code = retVal.code rescue 500
+        if code != 200
+            err_msg = retVal.parsed_response["error"].to_s rescue "invalid response from " + source_location.to_s + "/log"
+            return ["", err_msg]
+        end
+        log_hash = retVal.parsed_response["log"] rescue ""
+        if log_hash == ""
+            err_msg = "missing log hash from " + source_location.to_s + "/log"
+            return ["", err_msg]
+        end
+        return [log_hash, nil]
+    end
+
     def self.revoke_base(did, options)
         did_orig = did.dup
         doc_location = options[:doc_location]
         if options[:ts].nil?
-            ts = Time.now.to_i
+            ts = Time.now.utc.to_i
         else
             ts = options[:ts]
         end
@@ -606,38 +701,111 @@ class Oydid
         end
 
         if options[:rev_key].nil? && options[:rev_pwd].nil? && options[:rev_enc].nil?
-            revocationKey, msg = read_private_key(did10 + "_revocation_key.enc", options)
+            # revocationKey, msg = read_private_key(did10 + "_revocation_key.enc", options)
             revocationLog = read_private_storage(did10 + "_revocation.json")
         else
-            if options[:rev_pwd].nil?
+
+            # check if provided old keys are native DID keys or delegates ==================
+            if options[:doc_key].nil?
+                if options[:doc_enc].nil?
+                    old_privateKey, msg = generate_private_key(options[:old_doc_pwd].to_s, 'ed25519-priv', options)
+                else
+                    old_privateKey, msg = decode_private_key(options[:old_doc_enc].to_s, options)
+                end
+            else
+                old_privateKey, msg = read_private_key(options[:old_doc_key].to_s, options)
+            end
+            if options[:rev_key].nil?
                 if options[:rev_enc].nil?
-                    revocationKey, msg = read_private_key(options[:rev_key].to_s, options)
+                    old_revocationKey, msg = generate_private_key(options[:old_rev_pwd].to_s, 'ed25519-priv', options)
                 else
-                    revocationKey, msg = decode_private_key(options[:rev_enc].to_s, options)
+                    old_revocationKey, msg = decode_private_key(options[:old_rev_enc].to_s, options)
                 end
             else
-                revocationKey, msg = generate_private_key(options[:rev_pwd].to_s, 'ed25519-priv', options)
-            end
-            # re-build revocation document
-            did_old_doc = did_info["doc"]["doc"]
-            ts_old = did_info["log"].last["ts"]
-            publicKey_old = public_key(privateKey_old, options).first
-            pubRevoKey_old = public_key(revocationKey_old, options).first
-            did_key_old = publicKey_old + ":" + pubRevoKey_old
-            subDid = {"doc": did_old_doc, "key": did_key_old}.to_json
-            subDidHash = multi_hash(canonical(subDid), LOG_HASH_OPTIONS).first
-            signedSubDidHash = sign(subDidHash, revocationKey_old, options).first
-            revocationLog = { 
-                "ts": ts_old,
-                "op": 1, # REVOKE
-                "doc": subDidHash,
-                "sig": signedSubDidHash }.transform_keys(&:to_s).to_json
+                old_revocationKey, msg = read_private_key(options[:old_rev_key].to_s, options)
+            end
+            old_publicDocKey = public_key(old_privateKey, {}).first
+            old_publicRevKey = public_key(old_revocationKey, {}).first
+            old_did_key = old_publicDocKey + ":" + old_publicRevKey
+
+            # compare old keys with existing DID Document & generate revocation record
+            if old_did_key.to_s == did_info["doc"]["key"].to_s
+                # provided keys are native DID keys ------------------
+
+                # re-build revocation document
+                old_did_doc = did_info["doc"]["doc"]
+                old_ts = did_info["log"].last["ts"]
+                old_subDid = {"doc": old_did_doc, "key": old_did_key}.to_json
+                old_subDidHash = multi_hash(canonical(old_subDid), LOG_HASH_OPTIONS).first
+                old_signedSubDidHash = sign(old_subDidHash, old_revocationKey, LOG_HASH_OPTIONS).first
+                revocationLog = { 
+                    "ts": old_ts,
+                    "op": 1, # REVOKE
+                    "doc": old_subDidHash,
+                    "sig": old_signedSubDidHash }.transform_keys(&:to_s).to_json
+            else
+                # proviced keys are either delegates or invalid ------
+                # * check validity of key-doc delegate
+                pubKeys, msg = getDelegatedPubKeysFromDID(did, "doc")
+                if !pubKeys.include?(old_publicDocKey)
+                    return [nil, "invalid or missing private document key"]
+                end
+
+                # * check validity of key-rev delegate
+                pubKeys, msg = getDelegatedPubKeysFromDID(did, "rev")
+                if !pubKeys.include?(old_publicRevKey)
+                    return [nil, "invalid or missing private revocation key"]
+                end
+
+                # retrieve revocationLog from previous in key-rev delegate
+                revoc_log = nil
+                log_old.each do |item|
+                    if !item["encrypted-revocation-log"].nil?
+                        revoc_log = item["encrypted-revocation-log"]
+                    end
+                end
+                if revoc_log.nil?
+                    return [nil, "cannot retrieve revocation log"]
+                end
+                revocationLog, msg = decrypt(revoc_log.to_json, old_revocationKey.to_s)
+                if revocationLog.nil?
+                    return [nil, "cannot decrypt revocation log entry: " + msg]
+                end
+            end # compare old keys with existing DID Document
+
+            # if options[:rev_pwd].nil?
+            #     if options[:rev_enc].nil?
+            #         revocationKey, msg = read_private_key(options[:rev_key].to_s, options)
+            #     else
+            #         revocationKey, msg = decode_private_key(options[:rev_enc].to_s, options)
+            #     end
+            # else
+            #     revocationKey, msg = generate_private_key(options[:rev_pwd].to_s, 'ed25519-priv', options)
+            # end
+            # # re-build revocation document
+            # did_old_doc = did_info["doc"]["doc"]
+            # ts_old = did_info["log"].last["ts"]
+            # publicKey_old = public_key(privateKey_old, options).first
+            # pubRevoKey_old = public_key(revocationKey_old, options).first
+            # did_key_old = publicKey_old + ":" + pubRevoKey_old
+            # subDid = {"doc": did_old_doc, "key": did_key_old}.to_json
+            # subDidHash = multi_hash(canonical(subDid), LOG_HASH_OPTIONS).first
+            # signedSubDidHash = sign(subDidHash, revocationKey_old, options).first
+            # revocationLog = { 
+            #     "ts": ts_old,
+            #     "op": 1, # REVOKE
+            #     "doc": subDidHash,
+            #     "sig": signedSubDidHash }.transform_keys(&:to_s).to_json
         end
 
         if revocationLog.nil?
             return [nil, "private revocation key not found"]
         end
 
+        # check if REVOCATION hash matches hash in TERMINATION
+        if did_info["log"][did_info["termination_log_id"]]["doc"] != multi_hash(canonical(revocationLog), LOG_HASH_OPTIONS).first
+            return [nil, "invalid revocation information"]
+        end
         revoc_log = JSON.parse(revocationLog)
         revoc_log["previous"] = [
             multi_hash(canonical(log_old[did_info["doc_log_id"].to_i]), LOG_HASH_OPTIONS).first, 
@@ -736,15 +904,98 @@ class Oydid
         return [retVal, msg]
     end
 
-   def self.w3c(did_info, options)
+    def self.delegate(did, options)
+        # check location
+        location = options[:doc_location]
+        if location.to_s == ""
+            location = DEFAULT_LOCATION
+        end
+        if did.include?(LOCATION_PREFIX)
+            tmp = did.split(LOCATION_PREFIX)
+            did = tmp[0]
+            location = tmp[1]
+        end
+        if did.include?(CGI.escape LOCATION_PREFIX)
+            tmp = did.split(CGI.escape LOCATION_PREFIX)
+            did = tmp[0] 
+            location = tmp[1]
+        end
+        options[:doc_location] = location
+        options[:log_location] = location
+
+        if options[:ts].nil?
+            ts = Time.now.utc.to_i
+        else
+            ts = options[:ts]
+        end
+
+        # build log record
+        log = {}
+        log["ts"] = ts
+        log["op"] = 5 # DELEGATE
+        pwd = false
+        doc_privateKey, msg = getPrivateKey(options[:doc_enc], options[:doc_pwd], options[:doc_key], "", options)
+        rev_privateKey, msg = getPrivateKey(options[:rev_enc], options[:rev_pwd], options[:rev_key], "", options)
+        if !doc_privateKey.nil?
+            pwd="doc"
+            privateKey = doc_privateKey
+        end
+        if !rev_privateKey.nil?
+            pwd="rev"
+            privateKey = rev_privateKey
+        end
+        if !pwd || privateKey.to_s == ""
+            return [nil, "missing or invalid delegate key"]
+        end
+        log["doc"] = pwd + ":" + public_key(privateKey, options).first.to_s
+        log["sig"] = sign(privateKey, privateKey, options).first
+        log["previous"] = [did] # DID in previous cannot be resolved in the DAG but guarantees unique log hash
+
+        # revocation delegate keys need to specify a public key for encrypting the revocation record
+        if pwd == "rev"
+            publicEncryptionKey, msg = public_key(privateKey, {}, 'x25519-pub')
+            log["encryption-key"] = publicEncryptionKey
+        end
+        log_hash, msg = write_log(did, log, options)
+        if log_hash.nil?
+            return [nil, msg]
+        else
+            return [{"log": log_hash}, ""]
+        end
+    end
+
+    def self.w3c(did_info, options)
+        # check if doc is already W3C DID
+        is_already_w3c_did = (did_info.transform_keys(&:to_s)["doc"]["doc"].has_key?("@context") &&
+            did_info.transform_keys(&:to_s)["doc"]["doc"].has_key?("id") &&
+            did_info.transform_keys(&:to_s)["doc"]["doc"]["id"].split(":").first == "did") rescue false
+        if is_already_w3c_did
+            return did_info.transform_keys(&:to_s)["doc"]["doc"]
+        end
         did = percent_encode(did_info["did"])
         if !did.start_with?("did:oyd:")
             did = "did:oyd:" + did
         end
 
-        didDoc = did_info.transform_keys(&:to_s)["doc"]
+        didDoc = did_info.dup.transform_keys(&:to_s)["doc"]
         pubDocKey = didDoc["key"].split(":")[0] rescue ""
         pubRevKey = didDoc["key"].split(":")[1] rescue ""
+        delegateDocKeys = getDelegatedPubKeysFromDID(did, "doc").first - [pubDocKey] rescue []
+        if delegateDocKeys.is_a?(String)
+            if delegateDocKeys == pubDocKey
+                delegateDocKeys = nil
+            else
+                delegateDocKeys = [delegateDocKeys]
+            end
+        end
+        delegateRevKeys = getDelegatedPubKeysFromDID(did, "rev").first - [pubRevKey] rescue []
+        if delegateRevKeys.is_a?(String)
+            if delegateRevKeys == pubRevKey
+                delegateRevKeys = nil
+            else
+                delegateRevKeys = [delegateRevKeys]
+            end
+        end
 
         wd = {}
         if didDoc["doc"].is_a?(Hash) 
@@ -752,9 +1003,9 @@ class Oydid
                 wd["@context"] = ["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1"]
             else
                 if didDoc["doc"]["@context"].is_a?(Array)
-                    wd["@context"] = ["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1"] + didDoc["doc"]["@context"]
+                    wd["@context"] = (["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1"] + didDoc["doc"]["@context"]).uniq
                 else
-                    wd["@context"] = ["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1", didDoc["doc"]["@context"]]
+                    wd["@context"] = (["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1", didDoc["doc"]["@context"]]).uniq
                 end
                 didDoc["doc"].delete("@context")
             end
@@ -773,6 +1024,36 @@ class Oydid
             "controller": did,
             "publicKeyMultibase": pubRevKey
         }]
+        if !delegateDocKeys.nil? && delegateDocKeys.count > 0
+            i = 0
+            wd["capabilityDelegation"] = []
+            delegateDocKeys.each do |key|
+                i += 1
+                delegaton_object = {
+                    "id": did + "#key-delegate-doc-" + i.to_s,
+                    "type": "Ed25519VerificationKey2020",
+                    "controller": did,
+                    "publicKeyMultibase": key
+                }
+                wd["capabilityDelegation"] << delegaton_object
+            end
+        end
+        if !delegateRevKeys.nil? && delegateRevKeys.count > 0
+            i = 0
+            if wd["capabilityDelegation"].nil?
+                wd["capabilityDelegation"] = []
+            end
+            delegateRevKeys.each do |key|
+                i += 1
+                delegaton_object = {
+                    "id": did + "#key-delegate-rev-" + i.to_s,
+                    "type": "Ed25519VerificationKey2020",
+                    "controller": did,
+                    "publicKeyMultibase": key
+                }
+                wd["capabilityDelegation"] << delegaton_object
+            end
+        end
 
         equivalentIds = []
         did_info["log"].each do |log|
@@ -784,7 +1065,7 @@ class Oydid
             end
         end unless did_info["log"].nil?
         if equivalentIds.length > 0
-            wd[:alsoKnownAs] = equivalentIds
+            wd["alsoKnownAs"] = equivalentIds
         end
 
         if didDoc["doc"].is_a?(Hash) && !didDoc["doc"]["service"].nil?
@@ -807,28 +1088,62 @@ class Oydid
         else
             payload = nil
             if didDoc["doc"].is_a?(Hash)
-                didDoc = didDoc["doc"]
-                if didDoc["authentication"].to_s != ""
-                    wd["authentication"] = didDoc["authentication"]
-                    didDoc.delete("authentication")
-                end
-                if didDoc["assertionMethod"].to_s != ""
-                    wd["assertionMethod"] = didDoc["assertionMethod"]
-                    didDoc.delete("assertionMethod")
-                end
-                if didDoc["keyAgreement"].to_s != ""
-                    wd["keyAgreement"] = didDoc["keyAgreement"]
-                    didDoc.delete("keyAgreement")
-                end
-                if didDoc["capabilityInvocation"].to_s != ""
-                    wd["capabilityInvocation"] = didDoc["capabilityInvocation"]
-                    didDoc.delete("capabilityInvocation")
-                end
-                if didDoc["capabilityDelegation"].to_s != ""
-                    wd["capabilityDelegation"] = didDoc["capabilityDelegation"]
-                    didDoc.delete("capabilityDelegation")
+                if didDoc["doc"] != {}
+                    didDoc = didDoc["doc"]
+                    if didDoc["authentication"].to_s != ""
+                        new_authentication = []
+                        didDoc["authentication"].each do |el|
+                            new_el = el.transform_keys(&:to_s)
+                            new_el["id"] = percent_encode(did) + new_el["id"]
+                            new_authentication << new_el
+                        end unless didDoc["authentication"].nil?
+                        if new_authentication.length > 0
+                            wd["authentication"] = new_authentication
+                            didDoc.delete("authentication")
+                        end
+                    end
+                    if didDoc["assertionMethod"].to_s != ""
+                        wd["assertionMethod"] = didDoc["assertionMethod"]
+                        didDoc.delete("assertionMethod")
+                    end
+                    if didDoc["keyAgreement"].to_s != ""
+                        new_keyAgreement = []
+                        didDoc["keyAgreement"].each do |el|
+                            new_el = el.transform_keys(&:to_s)
+                            new_el["id"] = percent_encode(did) + new_el["id"]
+                            new_keyAgreement << new_el
+                        end unless didDoc["keyAgreement"].nil?
+                        if new_keyAgreement.length > 0
+                            wd["keyAgreement"] = new_keyAgreement
+                            didDoc.delete("keyAgreement")
+                        end
+                    end
+                    if didDoc["capabilityInvocation"].to_s != ""
+                        wd["capabilityInvocation"] = didDoc["capabilityInvocation"]
+                        didDoc.delete("capabilityInvocation")
+                    end
+                    if didDoc["capabilityDelegation"].to_s != ""
+                        wd["capabilityDelegation"] = didDoc["capabilityDelegation"]
+                        didDoc.delete("capabilityDelegation")
+                    end
+                    if didDoc["alsoKnownAs"].to_s != ""
+                        if didDoc["alsoKnownAs"].is_a?(Array)
+                            dda = didDoc["alsoKnownAs"]
+                        else
+                            dda = [didDoc["alsoKnownAs"]]
+                        end
+                        if wd["alsoKnownAs"].nil?
+                            wd["alsoKnownAs"] = dda
+                        else
+                            wd["alsoKnownAs"] += dda
+                        end
+                        didDoc.delete("alsoKnownAs")
+                    end
+                    payload = didDoc
+                    if payload == {}
+                        payload = nil
+                    end
                 end
-                payload = didDoc
             else
                 payload = didDoc["doc"]
             end
@@ -858,7 +1173,7 @@ class Oydid
     end
 
 
-   def self.w3c_legacy(did_info, options)
+    def self.w3c_legacy(did_info, options)
         did = did_info["did"]
         if !did.start_with?("did:oyd:")
             did = "did:oyd:" + did