oydid 0.9.2 → 0.9.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 072b6ccce2a1b7bf3c607aa01d3a3c97cfd37f8e41d52bb9db529d539ccb6eda
-  data.tar.gz: 75ccf1a0357d60e629dac7ea3a046cfe0933693a04b5179bf0db7b54929abc6b
+  metadata.gz: 0f96270f4b2465c3dadb499841094e20c27c1e6512e18f69c2e2f7dbb2c6559f
+  data.tar.gz: 0aff913041f3105b4569c41c88918439b50754431e24c85e51197f851fd436d9
 SHA512:
-  metadata.gz: c936a18cf7106ae73e76fb30fc5ee789a50330a342dfa9624f29bd03574cde42b9c8a4b6a710e0f7e3ed9c6865fb8ec49aaac2cf7cd24c5d5330405e4f20cd81
-  data.tar.gz: 3d6c15c81d795cd470f75031722f211aac478dc239a1ece245a64e1b00144d7d37eadfe3c5db8dab4ebfd487e685011f50615f5c40d05ea502d59762cbb51a1f
+  metadata.gz: 2505aeb0d16fc4a7786b24bbd1dcd607e7ac71122738ddc0bff9c6880d813813c5e6f2c134977a4bbf92b765565b8899822ae5d66dfe1977f214b89960ed6733
+  data.tar.gz: 49b7a640acf6793d33a504b45c4f69b30767a86d95fe4f7fd3236c26e4494456ccf4e799effe12c856b85a2ab675fa9887664c934bdcdd93710381466af27145

data/VERSION

@@ -1 +1 @@
-0.9.2
+0.9.4

data/lib/oydid/basic.rb

@@ -1248,6 +1248,30 @@ class Oydid
         end
     end
 
+    # Marks a failure of the queried repository itself (HTTP 5xx) as opposed to
+    # a DID that is simply not stored there. Without the distinction a caller
+    # turns a broken upstream into "not found", which claims the identifier
+    # never existed - see upstream_error?.
+    UPSTREAM_ERROR_PREFIX = "upstream error"
+
+    def self.upstream_error?(message)
+        message.to_s.start_with?(UPSTREAM_ERROR_PREFIX)
+    end
+
+    # Failure message for a non-200 response: the repository's own error field
+    # when it sent one, otherwise a message naming status and URL. A 5xx gets
+    # the prefix above so callers can tell it apart from a missing DID.
+    def self.http_error_message(response, url)
+        msg = (response.parsed_response["error"].to_s rescue "")
+        return msg unless msg.to_s == ""
+        code = response.code.to_i rescue 0
+        if code >= 500
+            UPSTREAM_ERROR_PREFIX + " " + code.to_s + " from " + url.to_s
+        else
+            "invalid response from " + url.to_s
+        end
+    end
+
     def self.retrieve_document(doc_identifier, doc_file, doc_location, options)
         # in-process callers can supply the DID document directly (e.g. read from
         # a local database) to avoid any HTTP/file lookup
@@ -1271,11 +1295,7 @@ class Oydid
             end
             retVal = HTTParty.get(doc_location + "/doc/" + doc_identifier + option_str)
             if retVal.code != 200
-                msg = retVal.parsed_response["error"].to_s rescue ""
-                if msg.to_s == ""
-                    msg = "invalid response from " + doc_location.to_s + "/doc/" + doc_identifier.to_s
-                end
-                return [nil, msg]
+                return [nil, http_error_message(retVal, doc_location.to_s + "/doc/" + doc_identifier.to_s)]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]
@@ -1324,8 +1344,7 @@ class Oydid
             doc_location = doc_location.sub("%3A%2F%2F","://").sub("%3A", ":")
             retVal = HTTParty.get(doc_location + "/doc_raw/" + doc_hash)
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/doc/" + doc_hash.to_s
-                return [nil, msg]
+                return [nil, http_error_message(retVal, doc_location.to_s + "/doc_raw/" + doc_hash.to_s)]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]

data/lib/oydid/log.rb

@@ -44,10 +44,7 @@ class Oydid
             log_location = log_location.gsub("%2F%2F","//")
             retVal = HTTParty.get(log_location + "/log/" + did_hash)
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue 
-                        "invalid response from " + log_location.to_s + "/log/" + did_hash.to_s
-
-                return [nil, msg]
+                return [nil, http_error_message(retVal, log_location.to_s + "/log/" + did_hash.to_s)]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]
@@ -79,9 +76,7 @@ class Oydid
             log_location = log_location.gsub("%2F%2F","//")
             retVal = HTTParty.get(log_location + "/log/" + log_hash + "/item")
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue 
-                        "invalid response from " + log_location.to_s + "/log/" + log_hash.to_s + "/item"
-                return [nil, msg]
+                return [nil, http_error_message(retVal, log_location.to_s + "/log/" + log_hash.to_s + "/item")]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]
@@ -132,7 +127,7 @@ class Oydid
                 if !position.nil?
                     dag.add_edge from: dag_log[position], to: dag_log[i]
                 end
-            end unless el["previous"] == []
+            end unless el["previous"].nil? || el["previous"] == []
             i += 1
         end unless logs.nil?
 
@@ -212,7 +207,7 @@ class Oydid
                         dag.add_edge from: dag_log[position], to: dag_log[i]
                     end
                 end
-            end unless el["previous"] == []
+            end unless el["previous"].nil? || el["previous"] == []
             i += 1
         end unless logs.nil?
 
@@ -472,10 +467,20 @@ class Oydid
                                 message = log_el["doc"].to_s
                                 signature = log_el["sig"]
                                 # public_key = current_public_doc_key.to_s
-                                extend_currentDID = currentDID.dup
-                                extend_currentDID["log"] = extend_currentDID["full_log"]
-                                # !!!TODO: check for delegates only at certain point in time
-                                pubKeys, msg = Oydid.getDelegatedPubKeysFromFullDidDocument(extend_currentDID, "doc")
+                                # SECURITY (fail-closed on delegation): an UPDATE
+                                # is authorised only by the document key of the
+                                # version it supersedes - the key continuity that
+                                # anchors the chain. Delegated keys (op=5) are NOT
+                                # honoured at resolution: they were collected from
+                                # the raw log with no authentication whatsoever, so
+                                # honouring them let anyone able to write a log
+                                # entry take over a revoked DID by injecting a
+                                # DELEGATE plus a self-signed UPDATE. No production
+                                # DID relies on a delegated key to resolve
+                                # (audit 2026-09-01), so this closes the hole at
+                                # zero cost.
+                                pubKeys = [current_public_doc_key.to_s]
+                                msg = ""
                                 signature_verification = false
                                 used_pubkey = ""
                                 pubKeys.each do |key|
@@ -520,7 +525,7 @@ class Oydid
                                         new_did_hash = new_doc_did.delete_prefix("did:oyd:")
                                         new_did_hash = new_did_hash.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                                         new_did10 = new_did_hash[0,10]
-                                        new_doc = retrieve_document(new_doc_did, new_did10 + ".doc", new_doc_location, {}).first
+                                        new_doc = retrieve_document(new_doc_did, new_did10 + ".doc", new_doc_location, options).first
                                         currentDID["verification"] += "found UPDATE log record:" + "\n"
                                         currentDID["verification"] += JSON.pretty_generate(log_el) + "\n"
                                         currentDID["verification"] += "⛔ none of available public keys (" + pubKeys.join(", ") + ")\n"
@@ -558,9 +563,22 @@ class Oydid
                 # handle DID Rotation
                 if (i == (currentDID["log"].length-1))
                     if options[:followAlsoKnownAs]
+                        # the payload of a DID Document is arbitrary JSON: an
+                        # Array or a scalar is valid and simply carries no
+                        # alsoKnownAs, so only a Hash can be inspected for it.
+                        # Without this guard a revoked DID whose document holds
+                        # e.g. [5] raised NoMethodError here, the repository
+                        # answered 500 with an empty body, and the resolver
+                        # degraded that to "not found" instead of "deactivated".
                         current_doc = currentDID["doc"]
-                        if current_doc["doc"].transform_keys(&:to_s).has_key?("alsoKnownAs")
-                            rotate_DID = current_doc["doc"].transform_keys(&:to_s)["alsoKnownAs"]
+                        doc_payload = current_doc.is_a?(Hash) ? current_doc["doc"] : nil
+                        doc_payload = doc_payload.transform_keys(&:to_s) if doc_payload.is_a?(Hash)
+                        if doc_payload.is_a?(Hash) && doc_payload.has_key?("alsoKnownAs")
+                            # DID Core defines alsoKnownAs as a set; older
+                            # documents wrote a bare String
+                            rotate_DID = doc_payload["alsoKnownAs"]
+                            rotate_DID = rotate_DID.first if rotate_DID.is_a?(Array)
+                            rotate_DID = rotate_DID.to_s
                             if rotate_DID.start_with?("did:")
                                 rotate_DID_method = rotate_DID.split(":").take(2).join(":")
                                 did_orig = currentDID["did"]
@@ -586,8 +604,14 @@ class Oydid
                                         currentDID["verification"] += "(Details: https://ownyourdata.github.io/oydid/#did_rotation)" + "\n\n"
                                     end
                                 when "did:oyd"
-                                    puts "try to resolve did:oyd with our own resolver"
-                                    puts "add verification text"
+                                    # DID Rotation to another did:oyd identifier
+                                    # is not implemented yet: resolving it needs
+                                    # a second pass through this resolver.
+                                    if verification_output
+                                        currentDID["verification"] += "DID rotation to: " + rotate_DID.to_s + "\n"
+                                        currentDID["verification"] += "⚠️ rotation to another did:oyd identifier is not supported yet\n"
+                                        currentDID["verification"] += "(Details: https://ownyourdata.github.io/oydid/#did_rotation)" + "\n\n"
+                                    end
                                 else
                                     # do nothing: DID Rotation is not supported for this DID method yet
                                 end

data/spec/oydid_spec.rb

@@ -519,6 +519,159 @@ describe "OYDID handling" do
   #   end
   # end
 
+  # regression: the payload of a DID Document is arbitrary JSON, not
+  # necessarily an object. A revoked DID whose payload is an Array used to
+  # raise NoMethodError in the alsoKnownAs lookup - the repository then
+  # answered 500 with an empty body and the resolver reported "not found"
+  # instead of "deactivated".
+  describe "dag_update with a non-object DID Document payload" do
+    def revoked_state(payload)
+      { "did" => "did:oyd:zQmPyjnkL52gQxBBhPuCFkf167MzpCKquqbu5Qt5ia2JGTr",
+        "doc" => { "doc" => payload, "key" => "", "log" => "" },
+        "log" => [{ "ts" => 1647732475, "op" => 1, "doc" => "zQmcVLwEtzU8By7TTeRFGvVUKm7HhZS6GgRTDFt51QNnans",
+                    "sig" => "", "previous" => [] }] }
+    end
+
+    it "does not raise for an Array payload" do
+      expect {
+        Oydid.dag_update(revoked_state([5]), { followAlsoKnownAs: true })
+      }.not_to raise_error
+    end
+
+    it "does not raise for a scalar payload" do
+      expect {
+        Oydid.dag_update(revoked_state("plain"), { followAlsoKnownAs: true })
+      }.not_to raise_error
+    end
+
+    it "accepts alsoKnownAs written as a set" do
+      state = revoked_state({ "alsoKnownAs" => ["did:oyd:zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh"] })
+      expect {
+        Oydid.dag_update(state, { followAlsoKnownAs: true })
+      }.not_to raise_error
+    end
+  end
+
+  # regression: a log entry with a missing "previous" field (e.g. junk op=5
+  # entries POSTed to the unauthenticated /log endpoint) made dag_did call
+  # nil.each - the repository then answered 500 with an empty body for every
+  # request to that DID. previous is optional; a missing one means no
+  # back-reference, exactly like an empty array.
+  describe "dag_did with a log entry missing 'previous'" do
+    let(:log) do
+      [ { "ts" => 0, "op" => 5, "doc" => "doc:123", "sig" => "z6M234" }, # no "previous"
+        { "ts" => 1, "op" => 2, "doc" => "zQmSVzALxVDs2Tqf5gh9XDWSL4L57YLi8H1XpvpizQPd79c", "sig" => "z", "previous" => [] },
+        { "ts" => 1, "op" => 0, "doc" => "zQmXRVzdjMnTz1WQVkVdJU1ZF9DPjcK5LM2GynpGzxbNAz6", "sig" => "z", "previous" => [] } ]
+    end
+
+    it "does not raise on a missing previous field" do
+      expect { Oydid.dag_did(log, { silent: true }) }.not_to raise_error
+    end
+
+    it "still resolves the DAG and finds the single CREATE entry" do
+      dag, create_index, _terminate_index, msg = Oydid.dag_did(log, { silent: true })
+      expect(msg).to eq ""
+      expect(dag).not_to be_nil
+      expect(create_index).to eq 1
+    end
+  end
+
+  # SECURITY regression (fail-closed on delegation): a DELEGATE entry (op=5) is
+  # collected from the raw log with no authentication. Honouring it at resolution
+  # let anyone able to write a log entry take over a revoked DID by injecting a
+  # DELEGATE plus a self-signed UPDATE. Resolution must authorise an UPDATE only
+  # by the superseded version's own document key - and must keep resolving a
+  # legitimate owner-signed update.
+  describe "DELEGATE keys are not honoured at resolution" do
+    HOPTS = { digest: "sha2-256", encode: "base58btc" }
+    class MemStore
+      def initialize(h); @h = h; end
+      def get(k); @h[k]; end
+    end
+    def h(e);   Oydid.multi_hash(Oydid.canonical(e.slice("ts","op","doc","sig","previous")), HOPTS).first; end
+    def sub(e); Oydid.multi_hash(Oydid.canonical(e.slice("ts","op","doc","sig")), HOPTS).first; end
+
+    # generate_base builds the CREATE/TERMINATE/REVOKE records and the keys
+    # without the network round-trip that Oydid.create makes via w3c (which
+    # WebMock blocks in the test env). doc_location "local" keeps the log
+    # reference free of an @location suffix.
+    def build_revoked_victim
+      dd, dk, dl, = Oydid.generate_base({ "purpose" => "victim" }, nil, "create",
+                                        { key_type: "ed25519", doc_location: "local" })
+      create = dl[:l1]
+      term1  = dl[:l2]
+      revoke = dl[:r1].merge("previous" => [h(create), h(term1)])
+      { vdid: dd[:did].delete_prefix("did:oyd:"), vdoc: dd[:didDocument], vpriv: dk[:privateKey],
+        create: create, term1: term1, revoke: revoke }
+    end
+
+    def build_v2
+      np    = { "service" => [{ "id" => "#x", "serviceEndpoint" => "https://new.example" }] }
+      apriv = Oydid.generate_private_key("", "ed25519-priv", {}).first
+      apub  = Oydid.public_key(apriv, {}).first
+      arpub = Oydid.public_key(Oydid.generate_private_key("", "ed25519-priv", {}).first, {}).first
+      nkey  = "#{apub}:#{arpub}"
+      r2    = { "ts" => 3, "op" => 1, "sig" => "z",
+                "doc" => Oydid.multi_hash(Oydid.canonical({ "doc" => np, "key" => nkey }.to_json), HOPTS).first }
+      term2 = { "ts" => 3, "op" => 0, "doc" => sub(r2), "sig" => Oydid.sign(sub(r2), apriv, HOPTS).first, "previous" => [] }
+      ndoc  = { "doc" => np, "key" => nkey, "log" => h(term2) }
+      { np: np, apriv: apriv, apub: apub, term2: term2, ndoc: ndoc,
+        ndid: Oydid.multi_hash(Oydid.canonical(ndoc.to_json), HOPTS).first }
+    end
+
+    def resolve(vic, v2, log)
+      store = MemStore.new(vic[:vdid] => { "doc" => vic[:vdoc], "log" => log },
+                           v2[:ndid]  => { "doc" => v2[:ndoc],  "log" => log })
+      r, = Oydid.read("did:oyd:#{vic[:vdid]}",
+                      { local_doc: vic[:vdoc], local_log: log, local_store: store, silent: true })
+      [r["error"].to_i, r.dig("doc", "doc")]
+    end
+
+    it "rejects a takeover via an injected DELEGATE + self-signed UPDATE" do
+      vic = build_revoked_victim; v2 = build_v2
+      deleg = { "ts" => 2, "op" => 5, "doc" => "doc:#{v2[:apub]}", "sig" => "", "previous" => [h(vic[:term1])] }
+      upd   = { "ts" => 3, "op" => 3, "doc" => v2[:ndid],
+                "sig" => Oydid.sign(v2[:ndid], v2[:apriv], HOPTS).first, "previous" => [h(vic[:revoke])] }
+      _err, doc = resolve(vic, v2, [vic[:create], vic[:term1], vic[:revoke], deleg, upd, v2[:term2]])
+      expect(doc).not_to eq v2[:np]
+    end
+
+    it "still resolves a legitimate owner-signed UPDATE" do
+      vic = build_revoked_victim; v2 = build_v2
+      upd = { "ts" => 3, "op" => 3, "doc" => v2[:ndid],
+              "sig" => Oydid.sign(v2[:ndid], vic[:vpriv], HOPTS).first, "previous" => [h(vic[:revoke])] }
+      err, doc = resolve(vic, v2, [vic[:create], vic[:term1], vic[:revoke], upd, v2[:term2]])
+      expect(err).to eq 0
+      expect(doc).to eq v2[:np]
+    end
+  end
+
+  # a broken repository (5xx) has to stay distinguishable from a DID that is
+  # not stored there - otherwise the caller reports "not found" and thereby
+  # claims the identifier never existed
+  describe "failure messages for non-200 responses" do
+    it "marks a 5xx as an upstream error" do
+      reply = double(code: 500, parsed_response: "")
+      msg = Oydid.http_error_message(reply, "https://oydid.ownyourdata.eu/doc/zQmXY")
+      expect(Oydid.upstream_error?(msg)).to be true
+      expect(msg).to include("500")
+    end
+
+    it "passes the repository's own error through" do
+      reply = double(code: 410, parsed_response: { "error" => "revoked" })
+      msg = Oydid.http_error_message(reply, "https://oydid.ownyourdata.eu/doc/zQmXY")
+      expect(msg).to eq "revoked"
+      expect(Oydid.upstream_error?(msg)).to be false
+    end
+
+    it "does not mark a 4xx without an error field as upstream error" do
+      reply = double(code: 404, parsed_response: nil)
+      msg = Oydid.http_error_message(reply, "https://oydid.ownyourdata.eu/doc/zQmXY")
+      expect(msg).to start_with("invalid response from")
+      expect(Oydid.upstream_error?(msg)).to be false
+    end
+  end
+
   # main functionds
   Dir.glob(File.expand_path("../input/main/*_read.doc", __FILE__)).each do |input|
     it "execute read for #{input.split('/').last}" do

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.4
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-08-28 00:00:00.000000000 Z
+date: 2026-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag
@@ -433,7 +433,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.19
+rubygems_version: 4.0.15
 specification_version: 4
 summary: Own Your Decentralized Identifier for Ruby.
 test_files: