oydid 0.9.0 → 0.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3e561caa744ec1b341317d142b27f5b9d7d9dddf92b2d18aaf2117fff05cb9a
-  data.tar.gz: 6aa242687b1765148f79e9b6911d22e81339159f2f0c45445c0be1ce804fe0ad
+  metadata.gz: 072b6ccce2a1b7bf3c607aa01d3a3c97cfd37f8e41d52bb9db529d539ccb6eda
+  data.tar.gz: 75ccf1a0357d60e629dac7ea3a046cfe0933693a04b5179bf0db7b54929abc6b
 SHA512:
-  metadata.gz: 35d735d7f16edf812645b91034b5c8824437144fb86b2dba19e2b165a1912279fc3e6b09916cde37004402bb309f5faad7248105b41de07f293892f7e6963d09
-  data.tar.gz: 0e333ede2a2b46e9c6264264f638cf3b54823cab9663a11af3bf776f796965210abb39b3c37555d0824f67d9b55506d3065803b1a94182097acdf0b11b9c670e
+  metadata.gz: c936a18cf7106ae73e76fb30fc5ee789a50330a342dfa9624f29bd03574cde42b9c8a4b6a710e0f7e3ed9c6865fb8ec49aaac2cf7cd24c5d5330405e4f20cd81
+  data.tar.gz: 3d6c15c81d795cd470f75031722f211aac478dc239a1ece245a64e1b00144d7d37eadfe3c5db8dab4ebfd487e685011f50615f5c40d05ea502d59762cbb51a1f

data/VERSION

@@ -1 +1 @@
-0.9.0
+0.9.2

data/lib/oydid/basic.rb

@@ -338,7 +338,7 @@ class Oydid
                 return [nil, msg]
                 exit
             end
-            pubKey = did_document["doc"]["key"].split(":").first rescue nil
+            pubKey = did_document["doc"]["key"].split(":")[0] rescue nil
             if pubKey.nil?
                 return [nil, "cannot resolve " + did.to_s]
             else
@@ -367,9 +367,9 @@ class Oydid
         # get current public key
         case key_type
         when "doc"
-            keys = [did_document["doc"]["key"].split(":").first] rescue nil
+            keys = [did_document["doc"]["key"].split(":")[0]] rescue nil
         when "rev"
-            keys = [did_document["doc"]["key"].split(":").last] rescue nil
+            keys = [did_document["doc"]["key"].split(":")[1]] rescue nil
         else
             return [nil, "invalid key type: " + key_type]
         end
@@ -1216,6 +1216,24 @@ class Oydid
         end
     end
 
+    # The identifier without its location suffix.
+    #
+    # A did:oyd can carry "@<location>" (raw or percent-encoded) to say where the
+    # document is hosted. That is a resolution hint, not part of the identity:
+    # the same document can be mirrored at any number of locations, so the set of
+    # location-bound variants is open and cannot be enumerated. Everything that
+    # states identity - canonicalId and equivalentId in the didDocumentMetadata -
+    # therefore uses this location-free form. The location-bound variant stays in
+    # alsoKnownAs.
+    #
+    # Note this must NOT be applied to the id of the DID document itself: DID Core
+    # requires that "the value of the id property in the retrieved DID document
+    # must always match the DID being resolved", so a location-bound DID that was
+    # requested is echoed as requested (see Oydid.document_id).
+    def self.strip_location(id)
+        id.to_s.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first rescue id.to_s
+    end
+
     def self.get_location(id)
         if id.include?(LOCATION_PREFIX)
             id_split = id.split(LOCATION_PREFIX)

data/lib/oydid/log.rb

@@ -361,7 +361,7 @@ class Oydid
                     currentDID["verification"] += JSON.pretty_generate(doc) + "\n"
                     currentDID["verification"] += "(Details: https://ownyourdata.github.io/oydid/#calculate_hash)" + "\n\n"
                 end
-                current_public_doc_key = currentDID["doc"]["key"].split(":").first rescue ""
+                current_public_doc_key = currentDID["doc"]["key"].split(":")[0] rescue ""
 
             when 0 # TERMINATE
                 currentDID["termination_log_id"] = i
@@ -506,7 +506,7 @@ class Oydid
                                             return currentDID
                                         end
                                         next_doc = next_doc.first["doc"]
-                                        if pubKeys.include?(next_doc["key"].split(":").first)
+                                        if pubKeys.include?(next_doc["key"].split(":")[0])
                                             currentDID["verification"] += "⚠️  no key rotation in updated DID Document" + "\n"
                                         end
                                         currentDID["verification"] += "\n"

data/lib/oydid.rb

@@ -383,8 +383,8 @@ class Oydid
                 old_privateKey = nil
                 old_revocationKey = nil
                 old_did_key = did_info["doc"]["key"].to_s
-                old_publicDocKey = old_did_key.split(":").first.to_s
-                old_publicRevKey = old_did_key.split(":").last.to_s
+                old_publicDocKey = old_did_key.split(":")[0].to_s
+                old_publicRevKey = old_did_key.split(":")[1].to_s
 
                 verified, vmsg = verify_revocation_log(did_info, options[:log_revoke_old],
                                                        "log_revoke_old", options)
@@ -460,6 +460,16 @@ class Oydid
             publicKey = public_key(privateKey, options).first
             pubRevoKey = public_key(revocationKey, options).first
         end
+        # The "key" field is the control field of a did:oyd: it names who may
+        # update the document (slot 0) and who may revoke it (slot 1) - nothing
+        # else. Keys that are content rather than control (key agreement above
+        # all) belong in the payload as verification methods, where they are
+        # covered by the identifier hash just the same.
+        #
+        # The field is positional and has exactly two slots. Readers must use an
+        # explicit index; .last would silently return the wrong key if a third
+        # slot were ever appended, and the mistake would only surface at
+        # revocation time. A spec enforces this across the repository.
         did_key = publicKey + ":" + pubRevoKey
 
         # the document is assembled once, in the first phase of a CMSM flow -
@@ -512,6 +522,10 @@ class Oydid
         end
 
         if revocationKey.to_s == ""
+            if options[:cmsm]
+                err = cmsm_verify_signature(subDidHash, cmsm_sig_rev, pubRevoKey, "key-rev")
+                return [nil, nil, nil, err] if !err.nil?
+            end
             signedSubDidHash = cmsm_sig_rev
         else
             signedSubDidHash = sign(subDidHash, revocationKey, LOG_HASH_OPTIONS).first
@@ -534,6 +548,8 @@ class Oydid
                                       cmsm_sig_rev, cmsm_sig_doc, cmsm_sig_create,
                                   did_old, cmsm_log_revoke_old), options)
             end
+            err = cmsm_verify_signature(l2_doc, cmsm_sig_doc, publicKey, "key-doc")
+            return [nil, nil, nil, err] if !err.nil?
             l2_sig = cmsm_sig_doc
         else
             l2_sig = sign(l2_doc, privateKey, options).first
@@ -595,6 +611,8 @@ class Oydid
                                           cmsm_sig_rev, cmsm_sig_doc, cmsm_sig_create,
                                           did_old, cmsm_log_revoke_old), options)
                 end
+                err = cmsm_verify_signature(l1_doc, cmsm_sig_create, old_publicDocKey, "key-doc-old")
+                return [nil, nil, nil, err] if !err.nil?
                 l1_sig = cmsm_sig_create
             else
                 l1_sig = sign(l1_doc, old_privateKey, options).first
@@ -628,6 +646,8 @@ class Oydid
                                           cmsm_sig_rev, cmsm_sig_doc, cmsm_sig_create,
                                   did_old, cmsm_log_revoke_old), options)
                 end
+                err = cmsm_verify_signature(l1_doc, cmsm_sig_create, publicKey, "key-doc")
+                return [nil, nil, nil, err] if !err.nil?
                 l1_sig = cmsm_sig_create
             else
                 l1_sig = sign(l1_doc, privateKey, options).first
@@ -736,7 +756,7 @@ class Oydid
         end
 
         did_key = did_info["doc"]["key"].to_s
-        pubRevKey = did_key.split(":").last.to_s
+        pubRevKey = did_key.split(":")[1].to_s
         subDid = {"doc": did_info["doc"]["doc"], "key": did_key}.to_json
         subDidHash = multi_hash(canonical(subDid), LOG_HASH_OPTIONS).first
 
@@ -776,6 +796,23 @@ class Oydid
     # state of a CMSM flow that has to survive between phases. Deliberately only
     # inputs and collected signatures - no derived hashes: every phase recomputes
     # r1 / l2_doc / the DID from these values, so there is nothing to keep in sync.
+    # A signature collected in a CMSM phase is only worth something if it was
+    # really made with the key the challenge named. Without this check the flow
+    # takes anything: the log entries are built from whatever the client sent and
+    # only fail on resolution - by which point the DID exists and has claimed the
+    # public key, which lets anyone permanently burn a key they do not hold.
+    #
+    # The message starts with "CMSM " so that the REST layers report it as a
+    # client error (400), not as a server fault.
+    def self.cmsm_verify_signature(value, signature, public_key, with)
+        if public_key.to_s == ""
+            return "CMSM cannot verify the " + with.to_s + " signature: no public key in session"
+        end
+        success, _msg = (verify(value, signature, public_key) rescue [false, ""])
+        return nil if success == true
+        "CMSM signature for " + with.to_s + " is invalid"
+    end
+
     def self.cmsm_state(publicKey, pubRevoKey, revocationKey, did_doc, ts, doc_location, sig_rev, sig_doc, sig_create, did_old = nil, log_revoke_old = nil)
         {
             publicKey: publicKey,
@@ -1446,19 +1483,42 @@ class Oydid
     # uniresolver plugin) and they had drifted into computing this list with
     # different rules.
     #
+    # Both values are location-free: the "@<location>" suffix says where a
+    # document is hosted, not who it is, and the same document can be mirrored at
+    # any number of locations - so the set of location-bound variants is open and
+    # equivalentId could not state it correctly anyway. The raw values these are
+    # built from do carry a location (dag_update sets did_info["did"] from the log
+    # entry, and log[]["doc"] is written with one), which is why strip_location is
+    # applied here rather than assumed. The location-bound variant stays in
+    # alsoKnownAs; document_id is deliberately left alone (see strip_location).
+    #
     # Returns [canonicalId, equivalentIds]; equivalentIds never contains the
-    # identifier the DID document itself carries as `id` (see document_id).
-    def self.version_ids(did_info)
-        canonical = percent_encode(did_info["did"].to_s)
-        if !canonical.start_with?("did:oyd:")
-            canonical = "did:oyd:" + canonical
-        end
+    # identifier the DID document itself carries as `id` (see document_id) and is
+    # empty - not a set with the DID itself in it - while there is only one
+    # version.
+    # keep_location = true reproduces the pre-0.9.1 values, location suffix and
+    # all. Only w3c uses it, to keep alsoKnownAs listing the location-bound
+    # variant of a DID - dropping that would take the location out of the
+    # document altogether, and alsoKnownAs is where it belongs.
+    #
+    # Deliberately a positional argument: callers pass did_info as a braceless
+    # hash literal (version_ids("did" => ..., "log" => ...)), and a method with
+    # a keyword parameter swallows that hash as keywords instead - every such
+    # call site would raise ArgumentError.
+    def self.version_ids(did_info, keep_location = false)
+        normalize = lambda do |id|
+            id = keep_location ? id.to_s : strip_location(id.to_s)
+            id = percent_encode(id)
+            id = "did:oyd:" + id if !id.start_with?("did:oyd:")
+            id
+        end
+        canonical = normalize.call(did_info["did"])
         own = document_id(did_info)
         equivalentIds = []
         did_info["log"].each do |log|
             if log["op"] == 2 || log["op"] == 3
-                eid = percent_encode("did:oyd:" + log["doc"].to_s)
-                if eid != own
+                eid = normalize.call(log["doc"])
+                if eid != own && !equivalentIds.include?(eid)
                     equivalentIds << eid
                 end
             end
@@ -1466,6 +1526,52 @@ class Oydid
         [canonical, equivalentIds]
     end
 
+    # created / updated / versionId of the resolved document version, as DID Core
+    # 7.1.3 defines them. Returned as a hash with string keys, ready to be merged
+    # into didDocumentMetadata; a property the log cannot answer is absent rather
+    # than null - in particular `updated`, which the spec requires to be "omitted
+    # if an Update operation has never been performed on the DID document".
+    #
+    # The resolved version is did_info["did"] - dag_update walks the log to the
+    # newest document and leaves its identifier there. Deriving both versionId and
+    # the `updated` entry from it avoids guessing which log entry is the newest,
+    # which timestamps alone cannot decide (they are client-supplied and two
+    # entries can share a second).
+    #
+    # versionId is the bare document hash, without the "did:oyd:" prefix and
+    # without a location: it is the method-specific identifier of that version, so
+    # "did:oyd:" + versionId is the versioned DID.
+    def self.version_metadata(did_info)
+        as_datetime = lambda do |ts|
+            # XML Datetime normalised to UTC, no sub-second precision (7.1.3)
+            Time.at(ts.to_i).utc.strftime("%Y-%m-%dT%H:%M:%SZ") rescue nil
+        end
+        version_of = lambda do |id|
+            strip_location(id.to_s).delete_prefix("did:oyd:")
+        end
+
+        meta = {}
+        resolved = version_of.call(did_info["did"])
+        meta["versionId"] = resolved if resolved != ""
+        return meta if did_info["log"].nil?
+
+        created_entry = did_info["log"].find { |el| el["op"].to_i == 2 }
+        if !created_entry.nil? && !created_entry["ts"].nil?
+            created = as_datetime.call(created_entry["ts"])
+            meta["created"] = created if !created.nil?
+        end
+
+        updated_entry = did_info["log"].find do |el|
+            el["op"].to_i == 3 && version_of.call(el["doc"]) == resolved
+        end
+        if !updated_entry.nil? && !updated_entry["ts"].nil?
+            updated = as_datetime.call(updated_entry["ts"])
+            meta["updated"] = updated if !updated.nil?
+        end
+
+        meta
+    end
+
     # The identifier a resolved DID document carries as `id`.
     #
     # A did:oyd is the hash over its own document, so an update mints a new one
@@ -1632,8 +1738,12 @@ class Oydid
         # is reciprocated - which it cannot be here, because all versions resolve
         # to the same document. It stays for backwards compatibility; the
         # authoritative statement is didDocumentMetadata canonicalId/equivalentId,
-        # built from the same list.
-        equivalentIds = version_ids(did_info).last
+        # built from the same list - except that this one keeps the location
+        # suffix. alsoKnownAs therefore carries two kinds of statement: other
+        # versions of the DID, and the location-bound variant of one. It must not
+        # be read as a list of locations; the method specification says so
+        # explicitly.
+        equivalentIds = version_ids(did_info, true).last
         if equivalentIds.length > 0
             wd["alsoKnownAs"] = equivalentIds
         end

data/spec/oydid_spec.rb

@@ -626,12 +626,80 @@ describe "OYDID handling" do
       expect(canonical).to eq "did:oyd:" + second_did
     end
 
-    it "percent-encodes a location suffix" do
+    # The identifier a relying party was handed is the one it asked for, which
+    # after an update is an earlier version than the document being served. Every
+    # other version is then equivalent to it - not just the current one. This is
+    # the case the HTTP request specs could not reach before update_did existed.
+    it "lists every other version when an earlier one was requested" do
+      canonical, equivalent = Oydid.version_ids(
+        "did" => "did:oyd:zC",
+        "did_requested" => "did:oyd:zA",
+        "log" => [{ "op" => 2, "doc" => "zA" },
+                  { "op" => 3, "doc" => "zB" },
+                  { "op" => 3, "doc" => "zC" }])
+      expect(canonical).to eq "did:oyd:zC"
+      expect(equivalent).to eq ["did:oyd:zB", "did:oyd:zC"]
+    end
+
+    it "lists the versions on both sides when a middle one was requested" do
+      canonical, equivalent = Oydid.version_ids(
+        "did" => "did:oyd:zC",
+        "did_requested" => "did:oyd:zB",
+        "log" => [{ "op" => 2, "doc" => "zA" },
+                  { "op" => 3, "doc" => "zB" },
+                  { "op" => 3, "doc" => "zC" }])
+      expect(canonical).to eq "did:oyd:zC"
+      expect(equivalent).to eq ["did:oyd:zA", "did:oyd:zC"]
+    end
+
+    # canonicalId and equivalentId state identity, and "@<location>" states where
+    # a document is hosted. The same document can be mirrored at any number of
+    # locations, so the set of location-bound variants is open and equivalentId
+    # could not state it correctly - both are therefore location-free.
+    it "strips the location suffix from canonicalId and equivalentId" do
       canonical, equivalent = Oydid.version_ids(
         "did" => "did:oyd:" + second_did + "@https://example.org",
+        "did_requested" => "did:oyd:" + second_did,
         "log" => [{ "op" => 2, "doc" => first_did + "@https://example.org" },
                   { "op" => 3, "doc" => second_did + "@https://example.org" }])
-      expect(canonical).to eq "did:oyd:" + second_did + "%40example.org"
+      expect(canonical).to eq "did:oyd:" + second_did
+      expect(equivalent).to eq ["did:oyd:" + first_did]
+    end
+
+    # A location-bound DID that was asked for stays the id of the document - DID
+    # Core: "the value of the id property in the retrieved DID document must
+    # always match the DID being resolved". Its location-free form is then a
+    # genuinely different string for the same subject, so it belongs in
+    # equivalentId alongside the earlier version.
+    it "lists the location-free form of the current version when a location-bound DID was requested" do
+      canonical, equivalent = Oydid.version_ids(
+        "did" => "did:oyd:" + second_did + "@https://example.org",
+        "did_requested" => "did:oyd:" + second_did + "@https://example.org",
+        "log" => [{ "op" => 2, "doc" => first_did + "@https://example.org" },
+                  { "op" => 3, "doc" => second_did + "@https://example.org" }])
+      expect(canonical).to eq "did:oyd:" + second_did
+      expect(equivalent).to eq ["did:oyd:" + first_did, "did:oyd:" + second_did]
+    end
+
+    # this used to list the DID as its own equivalent, in location-bound form,
+    # and hand out that same string as canonicalId
+    it "reports no equivalents for a never updated DID served from a location" do
+      canonical, equivalent = Oydid.version_ids(
+        "did" => "did:oyd:" + first_did + "@https://example.org",
+        "did_requested" => "did:oyd:" + first_did,
+        "log" => [{ "op" => 2, "doc" => first_did + "@https://example.org" },
+                  { "op" => 0, "doc" => "terminate" }])
+      expect(canonical).to eq "did:oyd:" + first_did
+      expect(equivalent).to eq []
+    end
+
+    it "keeps the location suffix for the alsoKnownAs list" do
+      canonical, equivalent = Oydid.version_ids(
+        { "did" => "did:oyd:" + first_did + "@https://example.org",
+          "did_requested" => "did:oyd:" + first_did,
+          "log" => [{ "op" => 2, "doc" => first_did + "@https://example.org" }] },
+        true)
+      expect(canonical).to eq "did:oyd:" + first_did + "%40example.org"
       expect(equivalent).to eq ["did:oyd:" + first_did + "%40example.org"]
     end
 
@@ -661,13 +729,129 @@ describe "OYDID handling" do
       }
       wd = Oydid.w3c(Marshal.load(Marshal.dump(did_info)), {})
       expect(wd["alsoKnownAs"]).to eq ["did:oyd:" + first_did]
-      expect(wd["alsoKnownAs"]).to eq Oydid.version_ids(did_info).last
+      expect(wd["alsoKnownAs"]).to eq Oydid.version_ids(did_info, true).last
+    end
+
+    # The two lists deliberately part ways on the location: identity statements
+    # drop it, alsoKnownAs keeps it - otherwise the location would disappear from
+    # the DID document altogether. Guards the live output for a never updated DID.
+    it "keeps the location-bound variant in alsoKnownAs while canonicalId drops it" do
+      stubbed_did = "zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh"
+      did_info = {
+        "did" => "did:oyd:" + stubbed_did + "@https://example.org",
+        "did_requested" => "did:oyd:" + stubbed_did,
+        "doc" => { "doc" => { "hello" => "world" },
+                   "key" => "z6MktULudTtAsAhRegYPiZ6631RV3viv12qd4GQF8z1xB22S:" \
+                            "z6MkqGC3nWZhYieEVTVDKW5v588CiGfsDSmRVG9ZwwWTvLSK" },
+        "log" => [{ "op" => 2, "doc" => stubbed_did + "@https://example.org" }]
+      }
+      wd = Oydid.w3c(Marshal.load(Marshal.dump(did_info)), {})
+      expect(wd["id"]).to eq "did:oyd:" + stubbed_did
+      expect(wd["alsoKnownAs"]).to eq ["did:oyd:" + stubbed_did + "%40example.org"]
+      canonical, equivalent = Oydid.version_ids(did_info)
+      expect(canonical).to eq "did:oyd:" + stubbed_did
+      expect(equivalent).to eq []
+    end
+  end
+
+  # created / updated / versionId of the resolved version (DID Core 7.1.3).
+  # Without `updated` a consumer cannot tell how old the document in its hands is.
+  describe "version_metadata" do
+    let(:first_did)  { "zQmSE1hzumtZ7AoK1qhHf4t5kiKsujMsJSHqoXtWrdd7K7W" }
+    let(:second_did) { "zQmfEb3KgYZjZUPLTHPmFPdcV6peF5itB5NmJ9N6gaxxE8K" }
+
+    # "The updated property is omitted if an Update operation has never been
+    # performed on the DID document." - 7.1.3
+    it "reports created and versionId, and omits updated, for a new DID" do
+      meta = Oydid.version_metadata(
+        "did" => "did:oyd:" + first_did + "@https://example.org",
+        "log" => [{ "op" => 2, "ts" => 1641224940, "doc" => first_did + "@https://example.org" },
+                  { "op" => 0, "ts" => 1641224940, "doc" => "terminate" }])
+      expect(meta["created"]).to eq "2022-01-03T15:49:00Z"
+      expect(meta["versionId"]).to eq first_did
+      expect(meta).not_to have_key("updated")
+    end
+
+    it "reports the timestamp of the update that produced the resolved version" do
+      meta = Oydid.version_metadata(
+        "did" => "did:oyd:" + second_did,
+        "log" => [{ "op" => 2, "ts" => 1641224940, "doc" => first_did },
+                  { "op" => 3, "ts" => 1641225032, "doc" => second_did },
+                  { "op" => 0, "ts" => 1641225032, "doc" => "terminate" }])
+      expect(meta["created"]).to eq "2022-01-03T15:49:00Z"
+      expect(meta["updated"]).to eq "2022-01-03T15:50:32Z"
+      expect(meta["versionId"]).to eq second_did
+    end
+
+    # the entry is picked by the version it produced, not by its timestamp:
+    # timestamps come from the client and two entries can share a second
+    it "ignores updates that did not produce the resolved version" do
+      meta = Oydid.version_metadata(
+        "did" => "did:oyd:zB",
+        "log" => [{ "op" => 2, "ts" => 1, "doc" => "zA" },
+                  { "op" => 3, "ts" => 2, "doc" => "zB" },
+                  { "op" => 3, "ts" => 3, "doc" => "zC" }])
+      expect(meta["versionId"]).to eq "zB"
+      expect(meta["updated"]).to eq "1970-01-01T00:00:02Z"
+    end
+
+    it "leaves out what the log cannot answer" do
+      expect(Oydid.version_metadata("did" => "did:oyd:" + first_did))
+        .to eq({ "versionId" => first_did })
+      expect(Oydid.version_metadata("did" => "did:oyd:" + first_did,
+                                    "log" => [{ "op" => 2, "doc" => first_did }]))
+        .to eq({ "versionId" => first_did })
     end
   end
 
   # Which identifier a resolved DID document announces as its own. An update
   # mints a new did:oyd, but the identifier a relying party holds is the one it
   # asked for - that is the one the document has to carry.
+  # The "key" field is positional: "<public document key>:<public revocation key>".
+  # Reading it with .first/.last works only as long as it has exactly two slots -
+  # the day a third one is added (e.g. a key agreement key), .last silently
+  # returns the wrong key and the error only surfaces at revocation time.
+  # Every read must therefore use an explicit index.
+  describe "positional access to the key field" do
+    repo_root = File.expand_path("../../..", __FILE__)
+    sources = %w[
+      ruby-gem/lib
+      cli
+      repository/app
+      uni-registrar-driver-did-oyd/app
+    ].map { |d| File.join(repo_root, d) }.select { |d| File.directory?(d) }
+
+    ruby_files = sources.flat_map { |d| Dir.glob(File.join(d, "**", "*.rb")) }
+
+    it "finds sources to scan" do
+      skip "running outside the repository checkout" if ruby_files.empty?
+      expect(ruby_files).not_to be_empty
+    end
+
+    it "never reads a split key field with .last" do
+      skip "running outside the repository checkout" if ruby_files.empty?
+      offenders = ruby_files.flat_map do |file|
+        File.readlines(file).each_with_index.filter_map do |line, i|
+          "#{file.sub(repo_root + "/", "")}:#{i + 1}" if line =~ /split\((["'])\:\1\)\.last/
+        end
+      end
+      expect(offenders).to eq []
+    end
+
+    it "never reads a split key field with .first" do
+      skip "running outside the repository checkout" if ruby_files.empty?
+      offenders = ruby_files.flat_map do |file|
+        File.readlines(file).each_with_index.filter_map do |line, i|
+          next unless line =~ /split\((["'])\:\1\)\.first/
+          # the DID identifier itself is also colon-separated and legitimately
+          # read with .first - only the key field is at issue here
+          "#{file.sub(repo_root + "/", "")}:#{i + 1}" if line.include?('"key"') || line.include?("'key'") || line =~ /_key(s)?\.split/
+        end
+      end
+      expect(offenders).to eq []
+    end
+  end
+
   describe "document_id" do
     let(:first_did)  { "zQmSE1hzumtZ7AoK1qhHf4t5kiKsujMsJSHqoXtWrdd7K7W" }
     let(:second_did) { "zQmfEb3KgYZjZUPLTHPmFPdcV6peF5itB5NmJ9N6gaxxE8K" }
@@ -719,4 +903,103 @@ describe "OYDID handling" do
     end
   end
 
+
+  describe "CMSM signature verification" do
+    # An in-memory stand-in for the session store the repository provides, so
+    # these examples run without a database and without the network.
+    class MemoryCmsmStore
+      def initialize; @data = {}; end
+      def set(session, payload); @data[session] = payload; end
+      def get(session); @data[session]; end
+      def delete(session); @data.delete(session); end
+    end
+
+    let(:store) { MemoryCmsmStore.new }
+    let(:priv)  { Oydid.generate_private_key("", "ed25519-priv", {}).first }
+    let(:pub)   { Oydid.public_key(priv, {}).first }
+
+    def cmsm_options(extra = {})
+      { cmsm: true, key_type: "ed25519", cmsm_store: store,
+        return_secrets: true, skip_publish: true }.merge(extra)
+    end
+
+    # phase 1: hand over the public key, receive session and value to sign
+    def start_flow
+      status, msg = Oydid.create({ "key" => pub }, cmsm_options)
+      expect(msg).to eq("cmsm")
+      status.transform_keys(&:to_s)
+    end
+
+    describe "cmsm_verify_signature" do
+      it "accepts a signature made with the named key" do
+        signature = Oydid.sign("hello", priv, {}).first
+        expect(Oydid.cmsm_verify_signature("hello", signature, pub, "key-doc")).to be_nil
+      end
+
+      it "rejects a signature over a different value" do
+        signature = Oydid.sign("hello", priv, {}).first
+        msg = Oydid.cmsm_verify_signature("goodbye", signature, pub, "key-doc")
+        expect(msg).to eq("CMSM signature for key-doc is invalid")
+      end
+
+      it "rejects a signature made with a different key" do
+        other = Oydid.generate_private_key("", "ed25519-priv", {}).first
+        signature = Oydid.sign("hello", other, {}).first
+        expect(Oydid.cmsm_verify_signature("hello", signature, pub, "key-doc")).not_to be_nil
+      end
+
+      it "rejects nonsense instead of raising" do
+        expect(Oydid.cmsm_verify_signature("hello", "not-a-signature", pub, "key-doc")).not_to be_nil
+      end
+
+      it "refuses to verify without a public key" do
+        signature = Oydid.sign("hello", priv, {}).first
+        msg = Oydid.cmsm_verify_signature("hello", signature, "", "key-doc")
+        expect(msg).to include("no public key in session")
+      end
+
+      # the message is what the REST layers match on to answer 400 instead of 500
+      it "phrases failures as client errors" do
+        msg = Oydid.cmsm_verify_signature("hello", "zBogus", pub, "key-rev")
+        expect(msg).to start_with("CMSM ")
+      end
+    end
+
+    describe "a running flow" do
+      it "advances when the signature is correct" do
+        phase1 = start_flow
+        signature = Oydid.sign(phase1["sign"], priv, {}).first
+
+        status, msg = Oydid.create({}, cmsm_options(cmsm_session: phase1["session"], sig: signature))
+
+        expect(msg).to eq("cmsm")
+        expect(status.transform_keys(&:to_s)["session"]).to eq(phase1["session"])
+      end
+
+      # Before this check the flow took any signature, built the log entries from
+      # it and answered 200. The DID did not resolve, but it had claimed the
+      # public key - so anyone could burn a key they did not hold.
+      it "refuses a signature the client cannot have made" do
+        phase1 = start_flow
+        forged = Oydid.sign(phase1["sign"],
+                            Oydid.generate_private_key("", "ed25519-priv", {}).first, {}).first
+
+        status, msg = Oydid.create({}, cmsm_options(cmsm_session: phase1["session"], sig: forged))
+
+        expect(status).to be_nil
+        expect(msg).to eq("CMSM signature for key-doc is invalid")
+      end
+
+      it "refuses a signature over a value from another flow" do
+        phase1 = start_flow
+        other  = start_flow
+        signature = Oydid.sign(other["sign"], priv, {}).first
+
+        status, msg = Oydid.create({}, cmsm_options(cmsm_session: phase1["session"], sig: signature))
+
+        expect(status).to be_nil
+        expect(msg).to start_with("CMSM ")
+      end
+    end
+  end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.2
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-08-23 00:00:00.000000000 Z
+date: 2026-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag