oydid 0.9.6 → 0.9.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2852f618ab2af5a4076ece7807b931168d061345496397dfc3f409faf25da10
-  data.tar.gz: 53bc6f370b519b0c72eedbf0bac1fb742fd5288b3696e93c080137531e8eedb7
+  metadata.gz: e80efb72fffc8f0a7e8ec1abb8a28376dad2f3463f581bd97719044d32f1f806
+  data.tar.gz: ac2fad7ca40541d40ec8b616704bc2225e4ebe144641805347fc7716682cdc8b
 SHA512:
-  metadata.gz: 8cc1a99558914d4c968db056cfbd2aa50835ecbc22dc981e54f4eee24c95dbc9fc0e4c7e7c2378c4fe96672255ce54ae9ce91d6d3e3a6e1f2fe96a7d4a26b3fb
-  data.tar.gz: 420f07f1d3a5145dedfdfb1d65fe8cf83c979bcd99283e48437b2291e04007e3532ea3ea5ff53a9cc8a35fb155989989d0bac094fc8051e9d083641a83a54ff1
+  metadata.gz: d0886bb19bc142e297bc454117fec9c904e4ad4ad9b8fec49e359c1824333af1fee5a086dfb05788415eadfc7cb1e16a720ec7bca35bcd58dce2799aded1d4f8
+  data.tar.gz: 1e6d067d6f0c7fcf0a824965b253e4f98108efbb7356775e25a46954c3d37e94bf65c34d9295127fd6c61be9a2bf010e09a997f8c25524b6255f67b49621069e

data/VERSION

@@ -1 +1 @@
-0.9.6
+0.9.7

data/lib/oydid/basic.rb

@@ -1272,6 +1272,29 @@ class Oydid
         end
     end
 
+    # Where a document would be written: the explicit doc_location, the generic
+    # location, or the default repository - the same fallbacks publish uses.
+    def self.write_location(options)
+        loc = options[:doc_location].to_s
+        loc = options[:location].to_s if loc == ""
+        loc = DEFAULT_LOCATION if loc == ""
+        loc
+    end
+
+    # Ask a repository whether a public key already controls an active DID.
+    # Only a clear "yes" counts: a repository that does not know the endpoint
+    # (404), a non-HTTP location or an unreachable host must not block a create -
+    # the write path enforces the rule in any case, this is the early exit.
+    def self.key_in_active_use?(public_key, location, options = {})
+        return false if public_key.to_s == ""
+        return false unless location.to_s.start_with?("http")
+        retVal = HTTParty.get(location.to_s + "/key/" + public_key.to_s)
+        return false if retVal.code != 200
+        retVal.parsed_response["active"] == true
+    rescue StandardError
+        false
+    end
+
     def self.retrieve_document(doc_identifier, doc_file, doc_location, options)
         # in-process callers can supply the DID document directly (e.g. read from
         # a local database) to avoid any HTTP/file lookup

data/lib/oydid/vc.rb

@@ -58,7 +58,7 @@ class Oydid
             if retVal.code == 401
                 msg = "unauthorized (valid Bearer token required)"
             else
-                msg = retVal.parsed_response("error").to_s rescue "invalid response from " + vc_url.to_s
+                msg = http_error_message(retVal, vc_url)
             end
             return [nil, msg]
         end
@@ -338,7 +338,7 @@ class Oydid
             headers: { 'Content-Type' => 'application/json' },
             body: vc_data.to_json )
         if retVal.code != 200
-            err_msg = retVal.parsed_response("error").to_s rescue "invalid response from " + vc_url.to_s
+            err_msg = http_error_message(retVal, vc_url)
             return [nil, err_msg]
         end
         return [retVal["identifier"], ""]
@@ -355,7 +355,7 @@ class Oydid
         vp_url = vp_location.sub(/(\/)+$/,'') + "/presentations/" + identifier
         retVal = HTTParty.get(vp_url)
         if retVal.code != 200
-            msg = retVal.parsed_response("error").to_s rescue "invalid response from " + vp_url.to_s
+            msg = http_error_message(retVal, vp_url)
             return [nil, msg]
         end
         return [retVal.parsed_response, ""]
@@ -451,7 +451,7 @@ class Oydid
             headers: { 'Content-Type' => 'application/json' },
             body: vp_data.to_json )
         if retVal.code != 200
-            err_msg = retVal.parsed_response("error").to_s rescue "invalid response from " + vp_url.to_s
+            err_msg = http_error_message(retVal, vp_url)
             return [nil, err_msg]
         end
         return [vp["identifier"], ""]

data/lib/oydid.rb

@@ -39,6 +39,12 @@ class Oydid
     JWS_SECURITY_SUITE = "https://w3id.org/security/suites/jws-2020/v1"
     DEFAULT_PUBLIC_RESOLVER = "https://dev.uniresolver.io/1.0/identifiers/"
 
+    # A public key controls at most one active DID at a time. The repository
+    # enforces this when a document is written; the constant lives here so every
+    # caller (repository, registrar driver, CLI) can recognise the rejection by
+    # comparison instead of searching the message text.
+    KEY_IN_USE_ERROR = "public key already controls an active DID"
+
     # Single-byte multicodec codes for the intermediate BLAKE2b digest sizes
     # (17-23 bytes), needed to keep a did:oyd identifier short enough for the
     # 50 character URL limit of the EU Digital Product Passport registry.
@@ -278,6 +284,25 @@ class Oydid
                 else
                     return [nil, nil, nil, "CMSM accepts at most two public keys"]
                 end
+
+                # Reject a reused document key before the client signs anything.
+                # The repository enforces the rule when the document is written,
+                # but a CMSM flow only writes after three signatures - with a
+                # secure element that is three round trips to hardware for a
+                # request that cannot succeed. A repository that does not know
+                # the endpoint answers 404 and the flow continues as before.
+                #
+                # Only for create: a non-rotating UPDATE legitimately carries
+                # the document key of the version it replaces, and that is the
+                # most common form of update.
+                #
+                # skip_publish means the caller is the repository itself: its own
+                # database, not the one at doc_location, decides - it checks in
+                # its CMSM controller before the flow starts.
+                if mode.to_s == "create" && !options[:skip_publish] &&
+                   key_in_active_use?(publicKey, write_location(options), options)
+                    return [nil, nil, nil, KEY_IN_USE_ERROR]
+                end
             else
                 # continue a persisted flow: the request carries the session and
                 # exactly one new signature, which fills the next open slot
@@ -731,7 +756,7 @@ class Oydid
                 headers: { 'Content-Type' => 'application/json' },
                 body: did_data.to_json )
             if retVal.code != 200
-                err_msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/doc"
+                err_msg = http_error_message(retVal, doc_location.to_s + "/doc")
                 return [false, err_msg]
             end
         else
@@ -894,7 +919,7 @@ class Oydid
                 headers: { 'Content-Type' => 'application/json' },
                 body: my_body.to_json )
             if retVal.code != 200
-                err_msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/cmsm"
+                err_msg = http_error_message(retVal, doc_location.to_s + "/cmsm")
                 return [nil, err_msg]
             end
         else
@@ -1084,7 +1109,7 @@ class Oydid
             body: {"log": log}.to_json )
         code = retVal.code rescue 500
         if code != 200
-            err_msg = retVal.parsed_response["error"].to_s rescue "invalid response from " + source_location.to_s + "/log"
+            err_msg = http_error_message(retVal, source_location.to_s + "/log")
             return ["", err_msg]
         end
         log_hash = retVal.parsed_response["log"] rescue ""
@@ -1306,7 +1331,7 @@ class Oydid
                 headers: { 'Content-Type' => 'application/json' },
                 body: {"log": revoc_log}.to_json )
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/log/" + did_hash.to_s
+                msg = http_error_message(retVal, doc_location.to_s + "/log/" + did_hash.to_s)
                 return [nil, msg]
             end
         else

data/spec/oydid_spec.rb

@@ -701,6 +701,39 @@ describe "OYDID handling" do
       expect(msg).to start_with("invalid response from")
       expect(Oydid.upstream_error?(msg)).to be false
     end
+
+    # Only the reading paths used the helper. The writing ones built their
+    # message with parsed_response("error") - round brackets, so an
+    # ArgumentError, so the surrounding rescue swallowed whatever the
+    # repository had said. A rejected create then read as "invalid response
+    # from .../doc" and the actual reason never reached the caller.
+    it "passes the repository's error through when writing a DID" do
+      stub_request(:post, "https://oydid.ownyourdata.eu/doc").to_return(
+        status: 400,
+        headers: { "Content-Type" => "application/json" },
+        body: { "error" => "public key already controls an active DID" }.to_json)
+
+      retVal, msg = Oydid.create({ "id" => "spec" },
+                                 { doc_pwd: "spec-doc-pwd", rev_pwd: "spec-rev-pwd",
+                                   location: "https://oydid.ownyourdata.eu",
+                                   digest: "sha2-256", encode: "base58btc" })
+
+      expect(retVal).to be_nil
+      expect(msg).to eq("public key already controls an active DID")
+    end
+
+    it "marks a 5xx while writing as an upstream error" do
+      stub_request(:post, "https://oydid.ownyourdata.eu/doc").to_return(status: 502, body: "")
+
+      retVal, msg = Oydid.create({ "id" => "spec" },
+                                 { doc_pwd: "spec-doc-pwd", rev_pwd: "spec-rev-pwd",
+                                   location: "https://oydid.ownyourdata.eu",
+                                   digest: "sha2-256", encode: "base58btc" })
+
+      expect(retVal).to be_nil
+      expect(Oydid.upstream_error?(msg)).to be true
+      expect(msg).to include("502")
+    end
   end
 
   # main functionds
@@ -1114,6 +1147,79 @@ describe "OYDID handling" do
       status.transform_keys(&:to_s)
     end
 
+    # The write path rejects a reused document key, but a CMSM flow only writes
+    # after three signatures. With a secure element those are three round trips
+    # to hardware for a request that cannot succeed, so phase 1 asks first.
+    describe "document key already in use" do
+      let(:key_url) { "https://oydid.ownyourdata.eu/key/" + pub }
+
+      def remote_options(extra = {})
+        cmsm_options({ skip_publish: false,
+                       location: "https://oydid.ownyourdata.eu" }.merge(extra))
+      end
+
+      it "stops phase 1 when the repository reports the key as active" do
+        stub_request(:get, key_url).to_return(
+          status: 200,
+          headers: { "Content-Type" => "application/json" },
+          body: { "active" => true, "did" => "zQmSpec" }.to_json)
+
+        status, msg = Oydid.create({ "key" => pub }, remote_options)
+
+        expect(status).to be_nil
+        expect(msg).to eq(Oydid::KEY_IN_USE_ERROR)
+      end
+
+      it "continues when the key controls only revoked DIDs" do
+        stub_request(:get, key_url).to_return(
+          status: 200,
+          headers: { "Content-Type" => "application/json" },
+          body: { "active" => false }.to_json)
+
+        status, msg = Oydid.create({ "key" => pub }, remote_options)
+
+        expect(msg).to eq("cmsm")
+        expect(status.transform_keys(&:to_s)["with"]).to eq("key-doc")
+      end
+
+      # A repository that predates the endpoint answers 404. That must not stop
+      # a create - the write path still enforces the rule.
+      it "continues when the repository does not know the endpoint" do
+        stub_request(:get, key_url).to_return(status: 404, body: "")
+
+        status, msg = Oydid.create({ "key" => pub }, remote_options)
+
+        expect(msg).to eq("cmsm")
+      end
+
+      # A non-rotating update legitimately carries the document key of the
+      # version it replaces - the most common form of update. The guardrail is
+      # about create only, so the update path must not even ask.
+      it "asks nobody on update" do
+        stub_request(:get, key_url).to_return(
+          status: 200,
+          headers: { "Content-Type" => "application/json" },
+          body: { "active" => true }.to_json)
+        stub_request(:get, %r{\Ahttps://oydid\.ownyourdata\.eu/doc/}).to_return(status: 404, body: "")
+
+        status, msg = Oydid.update({ "key" => pub }, "did:oyd:zQmSpecUnknownDid", remote_options)
+
+        expect(status).to be_nil
+        expect(msg).not_to eq(Oydid::KEY_IN_USE_ERROR)
+        expect(a_request(:get, key_url)).not_to have_been_made
+      end
+
+      # skip_publish means the repository itself is calling: its own database
+      # decides, and asking the public repository about a local key would be
+      # both wrong and a needless request.
+      it "asks nobody when the caller stores the DID itself" do
+        status, msg = Oydid.create({ "key" => pub }, cmsm_options)
+
+        expect(msg).to eq("cmsm")
+        expect(a_request(:get, %r{/key/})).not_to have_been_made
+      end
+    end
+
     describe "cmsm_verify_signature" do
       it "accepts a signature made with the named key" do
         signature = Oydid.sign("hello", priv, {}).first

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.9.6
+  version: 0.9.7
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-09-04 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag