oydid 0.9.3 → 0.9.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b941c83aec6492dfb37d272fd83a77f1b036902b70aab64634fed657d1ccaf6a
-  data.tar.gz: 0ba0f288c5c30e2cd7d7d831bd072ef0c4924082d70fba44634e1412578a8dc7
+  metadata.gz: 0f96270f4b2465c3dadb499841094e20c27c1e6512e18f69c2e2f7dbb2c6559f
+  data.tar.gz: 0aff913041f3105b4569c41c88918439b50754431e24c85e51197f851fd436d9
 SHA512:
-  metadata.gz: ddc6020c44371fee58f2e527513e4d94974ee5d4a3ebabd22a01b5cc039f5c91cfe1a0ab0f4046c50a356ab0784db6a626c971c5ee18e10b076e03625250605e
-  data.tar.gz: eaba43282881c1239cde7af7733707d5beff7670b27388327926b4e7a5c739e9c221c1f9b70565a629adb3e7b4ee43dd3ebb3cb977bf6b2dd885ff6f55a34e93
+  metadata.gz: 2505aeb0d16fc4a7786b24bbd1dcd607e7ac71122738ddc0bff9c6880d813813c5e6f2c134977a4bbf92b765565b8899822ae5d66dfe1977f214b89960ed6733
+  data.tar.gz: 49b7a640acf6793d33a504b45c4f69b30767a86d95fe4f7fd3236c26e4494456ccf4e799effe12c856b85a2ab675fa9887664c934bdcdd93710381466af27145

data/VERSION

@@ -1 +1 @@
-0.9.3
+0.9.4

data/lib/oydid/log.rb

@@ -127,7 +127,7 @@ class Oydid
                 if !position.nil?
                     dag.add_edge from: dag_log[position], to: dag_log[i]
                 end
-            end unless el["previous"] == []
+            end unless el["previous"].nil? || el["previous"] == []
             i += 1
         end unless logs.nil?
 
@@ -207,7 +207,7 @@ class Oydid
                         dag.add_edge from: dag_log[position], to: dag_log[i]
                     end
                 end
-            end unless el["previous"] == []
+            end unless el["previous"].nil? || el["previous"] == []
             i += 1
         end unless logs.nil?
 
@@ -467,10 +467,20 @@ class Oydid
                                 message = log_el["doc"].to_s
                                 signature = log_el["sig"]
                                 # public_key = current_public_doc_key.to_s
-                                extend_currentDID = currentDID.dup
-                                extend_currentDID["log"] = extend_currentDID["full_log"]
-                                # !!!TODO: check for delegates only at certain point in time
-                                pubKeys, msg = Oydid.getDelegatedPubKeysFromFullDidDocument(extend_currentDID, "doc")
+                                # SECURITY (fail-closed on delegation): an UPDATE
+                                # is authorised only by the document key of the
+                                # version it supersedes - the key continuity that
+                                # anchors the chain. Delegated keys (op=5) are NOT
+                                # honoured at resolution: they were collected from
+                                # the raw log with no authentication whatsoever, so
+                                # honouring them let anyone able to write a log
+                                # entry take over a revoked DID by injecting a
+                                # DELEGATE plus a self-signed UPDATE. No production
+                                # DID relies on a delegated key to resolve
+                                # (audit 2026-09-01), so this closes the hole at
+                                # zero cost.
+                                pubKeys = [current_public_doc_key.to_s]
+                                msg = ""
                                 signature_verification = false
                                 used_pubkey = ""
                                 pubKeys.each do |key|
@@ -515,7 +525,7 @@ class Oydid
                                         new_did_hash = new_doc_did.delete_prefix("did:oyd:")
                                         new_did_hash = new_did_hash.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                                         new_did10 = new_did_hash[0,10]
-                                        new_doc = retrieve_document(new_doc_did, new_did10 + ".doc", new_doc_location, {}).first
+                                        new_doc = retrieve_document(new_doc_did, new_did10 + ".doc", new_doc_location, options).first
                                         currentDID["verification"] += "found UPDATE log record:" + "\n"
                                         currentDID["verification"] += JSON.pretty_generate(log_el) + "\n"
                                         currentDID["verification"] += "⛔ none of available public keys (" + pubKeys.join(", ") + ")\n"

data/spec/oydid_spec.rb

@@ -552,6 +552,100 @@ describe "OYDID handling" do
     end
   end
 
+  # regression: a log entry with a missing "previous" field (e.g. junk op=5
+  # entries POSTed to the unauthenticated /log endpoint) made dag_did call
+  # nil.each - the repository then answered 500 with an empty body for every
+  # request to that DID. previous is optional; a missing one means no
+  # back-reference, exactly like an empty array.
+  describe "dag_did with a log entry missing 'previous'" do
+    let(:log) do
+      [ { "ts" => 0, "op" => 5, "doc" => "doc:123", "sig" => "z6M234" }, # no "previous"
+        { "ts" => 1, "op" => 2, "doc" => "zQmSVzALxVDs2Tqf5gh9XDWSL4L57YLi8H1XpvpizQPd79c", "sig" => "z", "previous" => [] },
+        { "ts" => 1, "op" => 0, "doc" => "zQmXRVzdjMnTz1WQVkVdJU1ZF9DPjcK5LM2GynpGzxbNAz6", "sig" => "z", "previous" => [] } ]
+    end
+
+    it "does not raise on a missing previous field" do
+      expect { Oydid.dag_did(log, { silent: true }) }.not_to raise_error
+    end
+
+    it "still resolves the DAG and finds the single CREATE entry" do
+      dag, create_index, _terminate_index, msg = Oydid.dag_did(log, { silent: true })
+      expect(msg).to eq ""
+      expect(dag).not_to be_nil
+      expect(create_index).to eq 1
+    end
+  end
+
+  # SECURITY regression (fail-closed on delegation): a DELEGATE entry (op=5) is
+  # collected from the raw log with no authentication. Honouring it at resolution
+  # let anyone able to write a log entry take over a revoked DID by injecting a
+  # DELEGATE plus a self-signed UPDATE. Resolution must authorise an UPDATE only
+  # by the superseded version's own document key - and must keep resolving a
+  # legitimate owner-signed update.
+  describe "DELEGATE keys are not honoured at resolution" do
+    HOPTS = { digest: "sha2-256", encode: "base58btc" }
+    class MemStore
+      def initialize(h); @h = h; end
+      def get(k); @h[k]; end
+    end
+    def h(e);   Oydid.multi_hash(Oydid.canonical(e.slice("ts","op","doc","sig","previous")), HOPTS).first; end
+    def sub(e); Oydid.multi_hash(Oydid.canonical(e.slice("ts","op","doc","sig")), HOPTS).first; end
+
+    # generate_base builds the CREATE/TERMINATE/REVOKE records and the keys
+    # without the network round-trip that Oydid.create makes via w3c (which
+    # WebMock blocks in the test env). doc_location "local" keeps the log
+    # reference free of an @location suffix.
+    def build_revoked_victim
+      dd, dk, dl, = Oydid.generate_base({ "purpose" => "victim" }, nil, "create",
+                                        { key_type: "ed25519", doc_location: "local" })
+      create = dl[:l1]
+      term1  = dl[:l2]
+      revoke = dl[:r1].merge("previous" => [h(create), h(term1)])
+      { vdid: dd[:did].delete_prefix("did:oyd:"), vdoc: dd[:didDocument], vpriv: dk[:privateKey],
+        create: create, term1: term1, revoke: revoke }
+    end
+
+    def build_v2
+      np    = { "service" => [{ "id" => "#x", "serviceEndpoint" => "https://new.example" }] }
+      apriv = Oydid.generate_private_key("", "ed25519-priv", {}).first
+      apub  = Oydid.public_key(apriv, {}).first
+      arpub = Oydid.public_key(Oydid.generate_private_key("", "ed25519-priv", {}).first, {}).first
+      nkey  = "#{apub}:#{arpub}"
+      r2    = { "ts" => 3, "op" => 1, "sig" => "z",
+                "doc" => Oydid.multi_hash(Oydid.canonical({ "doc" => np, "key" => nkey }.to_json), HOPTS).first }
+      term2 = { "ts" => 3, "op" => 0, "doc" => sub(r2), "sig" => Oydid.sign(sub(r2), apriv, HOPTS).first, "previous" => [] }
+      ndoc  = { "doc" => np, "key" => nkey, "log" => h(term2) }
+      { np: np, apriv: apriv, apub: apub, term2: term2, ndoc: ndoc,
+        ndid: Oydid.multi_hash(Oydid.canonical(ndoc.to_json), HOPTS).first }
+    end
+
+    def resolve(vic, v2, log)
+      store = MemStore.new(vic[:vdid] => { "doc" => vic[:vdoc], "log" => log },
+                           v2[:ndid]  => { "doc" => v2[:ndoc],  "log" => log })
+      r, = Oydid.read("did:oyd:#{vic[:vdid]}",
+                      { local_doc: vic[:vdoc], local_log: log, local_store: store, silent: true })
+      [r["error"].to_i, r.dig("doc", "doc")]
+    end
+
+    it "rejects a takeover via an injected DELEGATE + self-signed UPDATE" do
+      vic = build_revoked_victim; v2 = build_v2
+      deleg = { "ts" => 2, "op" => 5, "doc" => "doc:#{v2[:apub]}", "sig" => "", "previous" => [h(vic[:term1])] }
+      upd   = { "ts" => 3, "op" => 3, "doc" => v2[:ndid],
+                "sig" => Oydid.sign(v2[:ndid], v2[:apriv], HOPTS).first, "previous" => [h(vic[:revoke])] }
+      _err, doc = resolve(vic, v2, [vic[:create], vic[:term1], vic[:revoke], deleg, upd, v2[:term2]])
+      expect(doc).not_to eq v2[:np]
+    end
+
+    it "still resolves a legitimate owner-signed UPDATE" do
+      vic = build_revoked_victim; v2 = build_v2
+      upd = { "ts" => 3, "op" => 3, "doc" => v2[:ndid],
+              "sig" => Oydid.sign(v2[:ndid], vic[:vpriv], HOPTS).first, "previous" => [h(vic[:revoke])] }
+      err, doc = resolve(vic, v2, [vic[:create], vic[:term1], vic[:revoke], upd, v2[:term2]])
+      expect(err).to eq 0
+      expect(doc).to eq v2[:np]
+    end
+  end
+
   # a broken repository (5xx) has to stay distinguishable from a DID that is
   # not stored there - otherwise the caller reports "not found" and thereby
   # claims the identifier never existed

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.9.3
+  version: 0.9.4
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-08-29 00:00:00.000000000 Z
+date: 2026-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag
@@ -433,7 +433,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.19
+rubygems_version: 4.0.15
 specification_version: 4
 summary: Own Your Decentralized Identifier for Ruby.
 test_files: