oydid 0.8.0 → 0.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e119ee021cb7e09dd4c7ee6273a4ee778bae850e31b6360a31044c11e674df4c
-  data.tar.gz: 9be71c4690f1e6476c6a339a49172575eac79c11406c6a1ac8a49e66c804ee6e
+  metadata.gz: 66decf23cb4e474d0703a8948e20474be619c05083bd8abd5ab8d45857ac4ac0
+  data.tar.gz: db83f3c7ba0a20c5e4f8fd8ba8b9977b42b9b78fc56ad11df8a8bf12e9657704
 SHA512:
-  metadata.gz: fa57e8c74580e2afa7e6adae48528fd8d43fd306176eb9039a1531c9db46c0090702eef2d036ddaee3aef09e568ef8ad2714c990e6745b2dff4ed080d5e18874
-  data.tar.gz: 4608b92f08da163850832144c89a9495c182a065155727a8d10bacb83ee00fd47951b442420e9ee24582a5804938349e55649b57fe0e699082aa3311fbc57729
+  metadata.gz: 8856635688f0dd47b246443d7fcc7a994ceef87e7d2594530da0f3489445a544f3c7cc9d20327fec7da3988e83872d1ddf3c854bd4db25b367b72fa917ba09c3
+  data.tar.gz: '08956cf2da8ed63a35261a7ffa01cb58b11a177c77fe8b5f873f8ed4d59592695c0e80bd72d118c28f4266728b10e420b4eaab7189c406dd6c7731e52f40e38d'

data/VERSION

@@ -1 +1 @@
-0.8.0
+0.8.2

data/lib/oydid.rb

@@ -1058,6 +1058,18 @@ class Oydid
             return [nil, did_info["message"].to_s]
         end
 
+        # A client that holds no private revocation key - a secure element does
+        # not export one - submits the record it kept from creating or updating
+        # the DID. Rebuilding it here is impossible, and re-signing it would not
+        # help: the hash committed in the TERMINATE entry would no longer match.
+        if !options[:log_revoke].nil?
+            verified, vmsg = verify_revocation_log(did_info, options[:log_revoke], "log_revoke", options)
+            if verified.nil?
+                return [nil, vmsg]
+            end
+            return [link_revocation_log(verified, did_info), ""]
+        end
+
         did = did_info["did"]
         did_hash = did.delete_prefix("did:oyd:")
         did10 = did_hash[0,10]
@@ -1224,6 +1236,15 @@ class Oydid
         # the location extracted from the DID may be percent-encoded
         # (e.g. "http%3A%2F%2Flocalhost%3A3000"); decode before using as URL
         doc_location = doc_location.to_s.gsub("%3A", ":").gsub("%2F", "/")
+        # percent_encode strips the default scheme, so a DID published to an
+        # https location carries a bare host ("oydid.ownyourdata.eu"). Without
+        # putting the scheme back this is not recognised as a remote location
+        # and the revocation is written to a local file instead - which is how
+        # the branch below used to be reached at all.
+        if !(doc_location == "" || doc_location == "local") &&
+           !doc_location.start_with?("http")
+            doc_location = "https://" + doc_location
+        end
 
         # publish revocation log based on location
         case doc_location.to_s
@@ -1236,10 +1257,10 @@ class Oydid
                 return [nil, msg]
             end
         else
-            File.write(did10 + ".log", revoc_log.to_json)
-            if !did_old.nil?
-                File.write(did10_old + ".log", revoc_log.to_json)
-            end
+            # did_old / did10_old were never defined here - they are locals of
+            # generate_base. Writing the revocation next to the previous DID is
+            # the job of the caller that knows about it.
+            write_private_storage(revoc_log.to_json, did10 + ".log")
         end
 
         return [did, ""]
@@ -1367,6 +1388,44 @@ class Oydid
         end
     end
 
+    # Verification relationships in the payload either name a key by fragment
+    # ("#key-doc") or embed a whole verification method. Both need the DID
+    # prefixed onto the identifier; an embedded method additionally needs a
+    # controller, which the client cannot supply - the DID is the hash of the
+    # document that would have to contain it, so it is not known while the
+    # document is being written.
+    def self.expand_verification_methods(payload, wd, did)
+        return wd if !payload.is_a?(Hash)
+
+        [ "authentication",
+          "assertionMethod",
+          "keyAgreement",
+          "capabilityInvocation",
+          "capabilityDelegation" ].each do |vm|
+            next if payload[vm].to_s == ""
+            entries = payload[vm]
+            entries = [entries] if entries.is_a?(Hash) || entries.is_a?(String)
+
+            new_entries = []
+            entries.each do |el|
+                if el.is_a?(String)
+                    new_entries << percent_encode(did) + el
+                else
+                    new_el = el.transform_keys(&:to_s)
+                    new_el["id"] = percent_encode(did) + new_el["id"].to_s
+                    if new_el["controller"].to_s == ""
+                        new_el["controller"] = percent_encode(did)
+                    end
+                    new_entries << new_el
+                end
+            end
+
+            wd[vm] = new_entries.length > 0 ? new_entries : payload[vm]
+            payload.delete(vm)
+        end
+        wd
+    end
+
     def self.w3c(did_info, options)
         # check if doc is already W3C DID
         is_already_w3c_did = (did_info.transform_keys(&:to_s)["doc"]["doc"].has_key?("@context") &&
@@ -1527,6 +1586,10 @@ class Oydid
             if location.nil?
                 location = get_location(did_info["did"].to_s)
             end
+            # a payload carrying a service used to skip the handling below
+            # entirely and get merged verbatim, which left fragment identifiers
+            # unresolved and embedded methods without a controller
+            wd = expand_verification_methods(didDoc["doc"], wd, did)
             wd = wd.merge(didDoc["doc"])
             if wd["service"] != []
                 if wd["service"].is_a?(Array)
@@ -1547,33 +1610,7 @@ class Oydid
             if didDoc["doc"].is_a?(Hash)
                 if didDoc["doc"] != {}
                     didDoc = didDoc["doc"]
-                    # special handling for Verification Methods
-                    vms = [ "authentication", 
-                            "assertionMethod", 
-                            "keyAgreement", 
-                            "capabilityInvocation",
-                            "capabilityDelegation" ]
-
-                    vms.each do |vm|
-                        if didDoc[vm].to_s != ""
-                            new_entries = []
-                            didDoc[vm].each do |el|
-                                if el.is_a?(String)
-                                    new_entries << percent_encode(did) + el
-                                else
-                                    new_el = el.transform_keys(&:to_s)
-                                    new_el["id"] = percent_encode(did) + new_el["id"]
-                                    new_entries << new_el
-                                end
-                            end unless didDoc[vm].nil?
-                            if new_entries.length > 0
-                                wd[vm] = new_entries
-                            else
-                                wd[vm] = didDoc[vm]
-                            end
-                            didDoc.delete(vm)
-                        end
-                    end
+                    wd = expand_verification_methods(didDoc, wd, did)
                     if didDoc["alsoKnownAs"].to_s != ""
                         if didDoc["alsoKnownAs"].is_a?(Array)
                             dda = didDoc["alsoKnownAs"]

data/spec/oydid_spec.rb

@@ -528,4 +528,60 @@ describe "OYDID handling" do
     end
   end
 
+  # W3C conversion of verification relationships carried in the payload
+  describe "verification relationships in the payload" do
+    let(:did) { "did:oyd:zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh" }
+    let(:keys) do
+      "z6MktULudTtAsAhRegYPiZ6631RV3viv12qd4GQF8z1xB22S:" \
+      "z6MkqGC3nWZhYieEVTVDKW5v588CiGfsDSmRVG9ZwwWTvLSK"
+    end
+    let(:attestation) do
+      { "id" => "#key-attest",
+        "type" => "Ed25519VerificationKey2020",
+        "publicKeyMultibase" => "z6Mkg49NtQR2LyYRDCQFK4w1VVHqhypZSSRo7HsyuN7SV7v5" }
+    end
+
+    def convert(payload)
+      Oydid.w3c({ "did" => did, "doc" => { "doc" => payload, "key" => keys } }, {})
+    end
+
+    it "prefixes the DID onto a key named by fragment" do
+      wd = convert({ "authentication" => ["#key-doc"] })
+      expect(wd["authentication"]).to eq ["#{did}#key-doc"]
+    end
+
+    it "prefixes the DID onto an embedded verification method" do
+      wd = convert({ "assertionMethod" => [attestation] })
+      expect(wd["assertionMethod"].first["id"]).to eq "#{did}#key-attest"
+    end
+
+    # a client cannot supply the controller: the DID is the hash of the
+    # document that would contain it
+    it "fills in the controller of an embedded verification method" do
+      wd = convert({ "assertionMethod" => [attestation] })
+      expect(wd["assertionMethod"].first["controller"]).to eq did
+    end
+
+    it "keeps a controller the payload already carries" do
+      own = attestation.merge("controller" => "did:oyd:zSomeoneElse")
+      wd = convert({ "assertionMethod" => [own] })
+      expect(wd["assertionMethod"].first["controller"]).to eq "did:oyd:zSomeoneElse"
+    end
+
+    # regression: a payload carrying a service took a different branch and was
+    # merged verbatim, leaving fragments unresolved
+    it "handles relationships next to a service entry" do
+      wd = convert({ "assertionMethod" => [attestation],
+                     "service" => [{ "id" => "#payload", "type" => "Custom" }] })
+      expect(wd["assertionMethod"].first["id"]).to eq "#{did}#key-attest"
+      expect(wd["assertionMethod"].first["controller"]).to eq did
+      expect(wd["service"]).to be_an(Array)
+    end
+
+    it "accepts a single embedded method that is not wrapped in an array" do
+      wd = convert({ "assertionMethod" => attestation })
+      expect(wd["assertionMethod"].first["id"]).to eq "#{did}#key-attest"
+    end
+  end
+
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.2
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-08-22 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag