@did-btcr2/method 0.55.0 → 0.58.0

package/src/did-btcr2.ts

@@ -171,8 +171,16 @@ export class DidBtcr2 implements DidMethod {
     verificationMethodId: string;
     beaconId: string;
   }): Updater {
-    // Validate that the verificationMethodId is authorized for capabilityInvocation
-    if(!sourceDocument.capabilityInvocation?.some(vr => vr === verificationMethodId)) {
+    // Validate that the verificationMethodId is authorized for capabilityInvocation.
+    // Both sides are resolved to absolute DID URLs first, so the caller's spelling of the
+    // reference and the document's spelling of the entry may differ: either is legal per
+    // DID Core. This is the same rule the read path applies to an update's proof, so an
+    // update this factory authorizes is one the resolver will also accept.
+    const authorizedMethodId = Appendix.relationshipMethodId(verificationMethodId, sourceDocument.id);
+    const authorized = authorizedMethodId !== undefined && sourceDocument.capabilityInvocation?.some(
+      entry => Appendix.relationshipMethodId(entry, sourceDocument.id) === authorizedMethodId
+    );
+    if(!authorized) {
       throw new UpdateError(
         'Invalid verificationMethodId: not authorized for capabilityInvocation',
         INVALID_DID_DOCUMENT, sourceDocument
@@ -206,9 +214,14 @@ export class DidBtcr2 implements DidMethod {
       );
     }
 
-    // Find the beacon service matching the given beaconId
+    // Find the beacon service matching the given beaconId. A service `id` may be a relative
+    // DID URL, so both sides are resolved against the document before comparison; an
+    // unusable beaconId matches nothing rather than matching an unusable service id.
+    const targetBeaconId = Appendix.absoluteDidUrl(beaconId, sourceDocument.id);
     const beaconService = sourceDocument.service
-      .filter((service: BeaconService) => service.id === beaconId)
+      .filter((service: BeaconService) =>
+        targetBeaconId !== undefined
+        && Appendix.absoluteDidUrl(service.id, sourceDocument.id) === targetBeaconId)
       .filter((service: BeaconService): service is BeaconService => !!service)
       .shift();
 
@@ -250,10 +263,17 @@ export class DidBtcr2 implements DidMethod {
     }
 
     // Attempt to find a verification method that matches the given method ID, or if not given,
-    // find the first verification method intended for signing claims.
-    const verificationMethod = didDocument.verificationMethod?.find(
-      (vm: DidVerificationMethod) => Appendix.extractDidFragment(vm.id) === (Appendix.extractDidFragment(methodId)
-        ?? Appendix.extractDidFragment(didDocument.assertionMethod?.[0]))
+    // find the first verification method intended for signing claims. Both sides are resolved
+    // to absolute DID URLs first: a document may spell either the verification method `id` or
+    // the reference to it as a relative DID URL (`#initialKey`), and the two must still match.
+    const targetId = Appendix.absoluteDidUrl(methodId, didDocument.id)
+      ?? Appendix.relationshipMethodId(didDocument.assertionMethod?.[0], didDocument.id);
+
+    // An unusable target matches nothing: without this guard it compares equal to every
+    // method whose own id is unusable, and the document's first malformed method is
+    // returned as the signing method.
+    const verificationMethod = targetId === undefined ? undefined : didDocument.verificationMethod?.find(
+      (vm: DidVerificationMethod) => Appendix.absoluteDidUrl(vm.id, didDocument.id) === targetId
     );
 
     // If no verification method is found, throw an error

package/src/utils/appendix.ts

@@ -18,14 +18,46 @@ import type { RootCapability } from '../core/interfaces.js';
  */
 export class Appendix {
   /**
-   * Extracts a DID fragment from a given input
-   * @param {unknown} input The input to extract the DID fragment from
-   * @returns {string | undefined} The extracted DID fragment or undefined if not found
+   * Resolves a DID URL that may be written as a relative reference against the
+   * DID it appears under. DID Core permits the `id` of a verification method or
+   * service, and the entries of a verification relationship, to be a relative
+   * DID URL such as `#initialKey`; it denotes that fragment of `did`. Absolute
+   * DID URLs are returned unchanged, so both spellings of the same reference
+   * compare equal without discarding the DID being compared.
+   *
+   * @param {unknown} input The DID URL to resolve. Non-strings yield `undefined`.
+   * @param {string} did The DID the relative reference is resolved against.
+   * @returns {string | undefined} The absolute DID URL, or `undefined` if `input` is not a usable string.
    */
-  public static extractDidFragment(input: unknown): string | undefined {
+  public static absoluteDidUrl(input: unknown, did: string): string | undefined {
     if (typeof input !== 'string') return undefined;
     if (input.length === 0) return undefined;
-    return input;
+    return input.startsWith('#') ? `${did}${input}` : input;
+  }
+
+  /**
+   * Resolves a verification relationship entry to the absolute DID URL of the method it
+   * names. A relationship entry is either a reference to a method defined elsewhere in the
+   * document, or a method embedded inline, which names itself with its own `id`; either
+   * spelling may be a relative DID URL.
+   *
+   * Every comparison of a relationship entry against a method id goes through this helper,
+   * on both the read path and the write path, so the two admit exactly the same spellings.
+   *
+   * Malformed entries yield `undefined` rather than a placeholder string, so two unusable
+   * values never compare equal to each other. Callers comparing a resolved entry must still
+   * reject an `undefined` target before comparing, or an unusable target matches an
+   * unusable entry.
+   *
+   * @param {unknown} entry The relationship entry: a reference, or an embedded method.
+   * @param {string} did The DID the relative reference is resolved against.
+   * @returns {string | undefined} The absolute DID URL, or `undefined` if unusable.
+   */
+  public static relationshipMethodId(entry: unknown, did: string): string | undefined {
+    const id = (typeof entry === 'object' && entry !== null && !Array.isArray(entry))
+      ? (entry as { id?: unknown }).id
+      : entry;
+    return Appendix.absoluteDidUrl(id, did);
   }
 
   /**