@learncard/learn-cloud-service 2.5.34 → 2.5.35

package/src/helpers/share-content-auth/canonical.ts

@@ -0,0 +1,91 @@
+import { createHash } from 'node:crypto';
+import { canonicalizeShareContentRequestBody } from '@learncard/helpers';
+
+import { SHARE_CONTENT_OPERATIONS, type ShareContentOperation } from './types';
+
+/**
+ * Canonicalization / identifier primitives for the LC-2187 service auth module.
+ *
+ * Every value that reaches a hash or a comparison is validated here with strict
+ * (not permissive) rules. `Buffer.from(x, 'base64url')` is lenient, so the
+ * canonical base64url check re-encodes and requires an exact round trip, which
+ * rejects alternative spellings that merely decode to the same bytes.
+ */
+
+export {
+    canonicalizeShareContentRequestBody,
+    DEFAULT_MAX_CANONICAL_BYTES as DEFAULT_MAX_CANONICAL_REQUEST_BYTES,
+    DEFAULT_MAX_CANONICAL_DEPTH,
+    ShareContentCanonicalizationError,
+} from '@learncard/helpers';
+
+const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+const OPAQUE_IDENTIFIER_RE = /^[A-Za-z0-9._~-]+$/;
+const JTI_RE = /^[A-Za-z0-9_-]+$/;
+const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+
+export const isPlainObject = (value: unknown): value is Record<string, unknown> => {
+    if (typeof value !== 'object' || value === null) return false;
+
+    const prototype = Object.getPrototypeOf(value);
+
+    return prototype === Object.prototype || prototype === null;
+};
+
+/** Strict canonical base64url: alphabet, no padding, exact round trip, optional byte length. */
+export const isCanonicalBase64Url = (value: unknown, expectedBytes?: number): value is string => {
+    if (typeof value !== 'string' || value.length === 0) return false;
+    if (!BASE64URL_RE.test(value)) return false;
+
+    const decoded = Buffer.from(value, 'base64url');
+
+    if (decoded.toString('base64url') !== value) return false;
+    if (expectedBytes !== undefined && decoded.length !== expectedBytes) return false;
+
+    return true;
+};
+
+export const isSafeContentVersion = (value: unknown): value is number =>
+    typeof value === 'number' && Number.isSafeInteger(value) && value >= 1 && value <= 2 ** 31 - 1;
+
+export const isSafeEpochSecond = (value: unknown): value is number =>
+    typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+
+/**
+ * Opaque profile/object/operation/namespace identifier. Deliberately not a UUID
+ * check: existing profile ids are opaque URL-safe strings.
+ */
+export const isOpaqueIdentifier = (value: unknown, maxLength = 128): value is string =>
+    typeof value === 'string' &&
+    value.length >= 1 &&
+    value.length <= maxLength &&
+    OPAQUE_IDENTIFIER_RE.test(value);
+
+export const isBoundedNonce = (
+    value: unknown,
+    minLength: number,
+    maxLength: number
+): value is string =>
+    typeof value === 'string' &&
+    value.length >= minLength &&
+    value.length <= maxLength &&
+    JTI_RE.test(value);
+
+export const isSha256Hex = (value: unknown): value is string =>
+    typeof value === 'string' && SHA256_HEX_RE.test(value);
+
+export const isShareContentOperation = (value: unknown): value is ShareContentOperation =>
+    typeof value === 'string' && (SHARE_CONTENT_OPERATIONS as readonly string[]).includes(value);
+
+/**
+ * SHA-256 (lowercase hex) over the canonical UTF-8 request body. This is the
+ * value signed into `claims.requestHash`; it must include the opaque ciphertext
+ * envelope and the opaque owner-encrypted recovery for `put`.
+ */
+export const computeShareContentRequestHash = (
+    body: unknown,
+    options: { maxBytes?: number; maxDepth?: number } = {}
+): string =>
+    createHash('sha256')
+        .update(canonicalizeShareContentRequestBody(body, options), 'utf8')
+        .digest('hex');

package/src/helpers/share-content-auth/claims.ts

@@ -0,0 +1,164 @@
+import {
+    isBoundedNonce,
+    isCanonicalBase64Url,
+    isOpaqueIdentifier,
+    isPlainObject,
+    isSafeContentVersion,
+    isSafeEpochSecond,
+    isSha256Hex,
+    isShareContentOperation,
+} from './canonical';
+import {
+    SHARE_CONTENT_AUTH_PURPOSE,
+    SHARE_CONTENT_CLAIM_FIELDS,
+    type ShareContentAuthorizationClaims,
+    type ShareContentTrustConfig,
+} from './types';
+
+/** Share ids are 16 CSPRNG bytes → exactly 22 canonical base64url chars. */
+export const SHARE_ID_BYTES = 16;
+
+const MAX_OPAQUE_IDENTIFIER_LENGTH = 128;
+
+export type SignedClaimsResult =
+    { ok: true; raw: unknown } | { ok: false; reason: 'MALFORMED_CLAIMS' };
+
+/**
+ * Locate the JSON claims the holder signed. DIDKit serializes the presentation
+ * proof `challenge` into the JWT `nonce`; some clients surface it under
+ * `vp.proof.challenge`. Exactly one location/value must be present.
+ */
+export const extractSignedClaims = (payload: Record<string, unknown>): SignedClaimsResult => {
+    const nonce = payload.nonce;
+    const vp = payload.vp;
+
+    const proofChallenge =
+        isPlainObject(vp) && isPlainObject(vp.proof) ? vp.proof.challenge : undefined;
+
+    const candidates = [nonce, proofChallenge].filter(candidate => candidate !== undefined);
+
+    if (candidates.length === 0) return { ok: false, reason: 'MALFORMED_CLAIMS' };
+    if (candidates.length === 2 && candidates[0] !== candidates[1]) {
+        return { ok: false, reason: 'MALFORMED_CLAIMS' };
+    }
+
+    const challenge = candidates[0];
+
+    if (typeof challenge !== 'string' || challenge.length === 0) {
+        return { ok: false, reason: 'MALFORMED_CLAIMS' };
+    }
+
+    try {
+        return { ok: true, raw: JSON.parse(challenge) };
+    } catch {
+        return { ok: false, reason: 'MALFORMED_CLAIMS' };
+    }
+};
+
+export type ParseClaimsResult =
+    | { ok: true; claims: ShareContentAuthorizationClaims }
+    | {
+          ok: false;
+          reason:
+              | 'MALFORMED_CLAIMS'
+              | 'UNKNOWN_CLAIM_FIELD'
+              | 'INVALID_CLAIMS'
+              | 'INVALID_SHARE_ID'
+              | 'INVALID_IDENTIFIER'
+              | 'INVALID_JTI'
+              | 'OPERATION_NOT_ALLOWED'
+              | 'PURPOSE_MISMATCH';
+      };
+
+/**
+ * Strict structural validation of the signed claims. Audience/purpose/time and
+ * request binding are checked separately by the verifier so each has a distinct
+ * rejection reason.
+ */
+export const parseShareContentAuthorizationClaims = (
+    raw: unknown,
+    config: ShareContentTrustConfig
+): ParseClaimsResult => {
+    if (!isPlainObject(raw)) return { ok: false, reason: 'MALFORMED_CLAIMS' };
+
+    for (const key of Object.keys(raw)) {
+        if (!(SHARE_CONTENT_CLAIM_FIELDS as readonly string[]).includes(key)) {
+            return { ok: false, reason: 'UNKNOWN_CLAIM_FIELD' };
+        }
+    }
+
+    const {
+        iss,
+        aud,
+        purpose,
+        namespace,
+        op,
+        shareId,
+        contentVersion,
+        ownerProfileId,
+        objectId,
+        operationId,
+        requestHash,
+        iat,
+        exp,
+        jti,
+    } = raw;
+
+    if (typeof iss !== 'string' || iss.length === 0) return { ok: false, reason: 'INVALID_CLAIMS' };
+    if (typeof aud !== 'string' || aud.length === 0) return { ok: false, reason: 'INVALID_CLAIMS' };
+    if (purpose !== SHARE_CONTENT_AUTH_PURPOSE) return { ok: false, reason: 'PURPOSE_MISMATCH' };
+
+    if (!isOpaqueIdentifier(namespace, MAX_OPAQUE_IDENTIFIER_LENGTH)) {
+        return { ok: false, reason: 'INVALID_IDENTIFIER' };
+    }
+
+    if (!isShareContentOperation(op)) return { ok: false, reason: 'OPERATION_NOT_ALLOWED' };
+
+    if (!isCanonicalBase64Url(shareId, SHARE_ID_BYTES)) {
+        return { ok: false, reason: 'INVALID_SHARE_ID' };
+    }
+
+    if (!isSafeContentVersion(contentVersion)) return { ok: false, reason: 'INVALID_CLAIMS' };
+
+    if (!isOpaqueIdentifier(ownerProfileId, MAX_OPAQUE_IDENTIFIER_LENGTH)) {
+        return { ok: false, reason: 'INVALID_IDENTIFIER' };
+    }
+
+    if (!isOpaqueIdentifier(objectId, MAX_OPAQUE_IDENTIFIER_LENGTH)) {
+        return { ok: false, reason: 'INVALID_IDENTIFIER' };
+    }
+
+    if (!isOpaqueIdentifier(operationId, MAX_OPAQUE_IDENTIFIER_LENGTH)) {
+        return { ok: false, reason: 'INVALID_IDENTIFIER' };
+    }
+
+    if (!isSha256Hex(requestHash)) return { ok: false, reason: 'INVALID_CLAIMS' };
+
+    if (!isSafeEpochSecond(iat) || !isSafeEpochSecond(exp)) {
+        return { ok: false, reason: 'INVALID_CLAIMS' };
+    }
+
+    if (!isBoundedNonce(jti, config.minJtiLength, config.maxJtiLength)) {
+        return { ok: false, reason: 'INVALID_JTI' };
+    }
+
+    return {
+        ok: true,
+        claims: {
+            iss,
+            aud,
+            purpose: SHARE_CONTENT_AUTH_PURPOSE,
+            namespace,
+            op,
+            shareId,
+            contentVersion,
+            ownerProfileId,
+            objectId,
+            operationId,
+            requestHash,
+            iat,
+            exp,
+            jti,
+        },
+    };
+};

package/src/helpers/share-content-auth/config.ts

@@ -0,0 +1,160 @@
+import type { ShareContentTrustConfig } from './types';
+
+/**
+ * Build the trust configuration from an explicit, caller-supplied object.
+ *
+ * Nothing here reads `process.env`, secrets or a bootstrap file: the batch that
+ * owns environment wiring must construct this deliberately and pass it in. Any
+ * missing or invalid value when `enabled` is true collapses to the disabled
+ * configuration so access fails closed rather than partially.
+ */
+
+export const HARD_MAX_TOKEN_TTL_SECONDS = 60;
+export const HARD_MAX_CLOCK_SKEW_SECONDS = 60;
+export const HARD_MIN_TOKEN_BYTES = 256;
+export const HARD_MAX_TOKEN_BYTES = 65_536;
+export const DEFAULT_MAX_TOKEN_BYTES = 8_192;
+export const DEFAULT_MIN_JTI_LENGTH = 16;
+export const DEFAULT_MAX_JTI_LENGTH = 128;
+
+export const DISABLED_SHARE_CONTENT_TRUST_CONFIG: ShareContentTrustConfig = Object.freeze({
+    enabled: false,
+    audience: '',
+    allowedServiceDids: Object.freeze([]) as readonly string[],
+    allowedVerificationMethods: Object.freeze([]) as readonly string[],
+    allowedAlgorithms: Object.freeze(['EdDSA']) as readonly string[],
+    clockSkewSeconds: 5,
+    maxTokenTtlSeconds: HARD_MAX_TOKEN_TTL_SECONDS,
+    maxTokenBytes: DEFAULT_MAX_TOKEN_BYTES,
+    minJtiLength: DEFAULT_MIN_JTI_LENGTH,
+    maxJtiLength: DEFAULT_MAX_JTI_LENGTH,
+});
+
+const toStringList = (value: unknown): string[] | null => {
+    if (typeof value === 'string') {
+        const parts = value
+            .split(',')
+            .map(part => part.trim())
+            .filter(part => part.length > 0);
+
+        return parts;
+    }
+
+    if (Array.isArray(value)) {
+        if (!value.every(item => typeof item === 'string')) return null;
+
+        const parts = (value as string[]).map(part => part.trim()).filter(part => part.length > 0);
+
+        return parts;
+    }
+
+    return null;
+};
+
+const readBoolean = (value: unknown): boolean => value === true;
+
+const readBoundedInteger = (
+    value: unknown,
+    fallback: number,
+    minimum: number,
+    maximum: number
+): number | null => {
+    if (value === undefined) return fallback;
+    if (typeof value !== 'number' || !Number.isSafeInteger(value)) return null;
+    if (value < minimum || value > maximum) return null;
+
+    return value;
+};
+
+/**
+ * Resolve explicit configuration. Returns the frozen, fully-validated config or
+ * the disabled config. An empty allowlist, empty audience or `enabled: false`
+ * disables all access.
+ */
+export const resolveShareContentTrustConfig = (raw: unknown): ShareContentTrustConfig => {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+    }
+
+    const source = raw as Record<string, unknown>;
+
+    if (!readBoolean(source.enabled)) return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+
+    const audience = source.audience;
+    if (typeof audience !== 'string' || audience.trim().length === 0) {
+        return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+    }
+
+    const serviceDids = toStringList(source.serviceDids);
+    const verificationMethods = toStringList(source.verificationMethods);
+
+    if (!serviceDids || serviceDids.length === 0) return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+    if (!verificationMethods || verificationMethods.length === 0) {
+        return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+    }
+
+    const allowedAlgorithms = toStringList(source.allowedAlgorithms) ?? ['EdDSA'];
+    if (allowedAlgorithms.length === 0) return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+
+    const clockSkewSeconds = readBoundedInteger(
+        source.clockSkewSeconds,
+        DISABLED_SHARE_CONTENT_TRUST_CONFIG.clockSkewSeconds,
+        0,
+        HARD_MAX_CLOCK_SKEW_SECONDS
+    );
+    const maxTokenTtlSeconds = readBoundedInteger(
+        source.maxTokenTtlSeconds,
+        HARD_MAX_TOKEN_TTL_SECONDS,
+        1,
+        HARD_MAX_TOKEN_TTL_SECONDS
+    );
+    const maxTokenBytes = readBoundedInteger(
+        source.maxTokenBytes,
+        DEFAULT_MAX_TOKEN_BYTES,
+        HARD_MIN_TOKEN_BYTES,
+        HARD_MAX_TOKEN_BYTES
+    );
+    const minJtiLength = readBoundedInteger(
+        source.minJtiLength,
+        DEFAULT_MIN_JTI_LENGTH,
+        8,
+        DEFAULT_MAX_JTI_LENGTH
+    );
+    const maxJtiLength = readBoundedInteger(
+        source.maxJtiLength,
+        DEFAULT_MAX_JTI_LENGTH,
+        DEFAULT_MIN_JTI_LENGTH,
+        512
+    );
+
+    if (
+        clockSkewSeconds === null ||
+        maxTokenTtlSeconds === null ||
+        maxTokenBytes === null ||
+        minJtiLength === null ||
+        maxJtiLength === null ||
+        minJtiLength > maxJtiLength
+    ) {
+        return DISABLED_SHARE_CONTENT_TRUST_CONFIG;
+    }
+
+    return Object.freeze({
+        enabled: true,
+        audience,
+        allowedServiceDids: Object.freeze([...serviceDids]),
+        allowedVerificationMethods: Object.freeze([...verificationMethods]),
+        allowedAlgorithms: Object.freeze([...allowedAlgorithms]),
+        clockSkewSeconds,
+        maxTokenTtlSeconds,
+        maxTokenBytes,
+        minJtiLength,
+        maxJtiLength,
+    });
+};
+
+/** A config only authorizes traffic when it is enabled and its allowlists are non-empty. */
+export const isShareContentTrustConfigActive = (config: ShareContentTrustConfig): boolean =>
+    config.enabled &&
+    config.audience.length > 0 &&
+    config.allowedServiceDids.length > 0 &&
+    config.allowedVerificationMethods.length > 0;

package/src/helpers/share-content-auth/index.ts

@@ -0,0 +1,59 @@
+/**
+ * LC-2187 robust multi-credential sharing — LearnCloud service authorization.
+ *
+ * A narrow, reusable verifier foundation for the future service-only
+ * `share_content` storage routes (put/get/stat/delete of exact immutable
+ * objects plus the separate owner-recovery read intent). It is **not** wired to
+ * any route or server entrypoint and reads no environment/secrets; callers
+ * inject the trust configuration, DIDKit verification, clock and atomic replay
+ * store.
+ *
+ * No plaintext keys, credentials or source URIs are handled here: the request
+ * hash covers the opaque ciphertext envelope and the opaque owner-encrypted
+ * recovery.
+ */
+
+export * from './types';
+export {
+    SHARE_ID_BYTES,
+    extractSignedClaims,
+    parseShareContentAuthorizationClaims,
+} from './claims';
+export {
+    DEFAULT_MAX_CANONICAL_DEPTH,
+    DEFAULT_MAX_CANONICAL_REQUEST_BYTES,
+    ShareContentCanonicalizationError,
+    canonicalizeShareContentRequestBody,
+    computeShareContentRequestHash,
+    isBoundedNonce,
+    isCanonicalBase64Url,
+    isOpaqueIdentifier,
+    isPlainObject,
+    isSafeContentVersion,
+    isSafeEpochSecond,
+    isSha256Hex,
+    isShareContentOperation,
+} from './canonical';
+export {
+    DEFAULT_MAX_JTI_LENGTH,
+    DEFAULT_MAX_TOKEN_BYTES,
+    DEFAULT_MIN_JTI_LENGTH,
+    DISABLED_SHARE_CONTENT_TRUST_CONFIG,
+    HARD_MAX_CLOCK_SKEW_SECONDS,
+    HARD_MAX_TOKEN_BYTES,
+    HARD_MAX_TOKEN_TTL_SECONDS,
+    HARD_MIN_TOKEN_BYTES,
+    isShareContentTrustConfigActive,
+    resolveShareContentTrustConfig,
+} from './config';
+export { parseCompactJwt, validateShareContentJwtHeader } from './token';
+export {
+    createShareContentAuthorizationVerifier,
+    type CreateShareContentAuthorizationVerifierDependencies,
+} from './verifier';
+export {
+    createDidkitPresentationVerifier,
+    createSetIfAbsentReplayStore,
+    type LearnCardLike,
+    type SetIfAbsent,
+} from './adapters';

package/src/helpers/share-content-auth/token.ts

@@ -0,0 +1,148 @@
+import { isCanonicalBase64Url, isPlainObject } from './canonical';
+import type { ShareContentTrustConfig } from './types';
+
+/**
+ * Strict, bounded parsing of the compact JWS produced by DIDKit for a
+ * holder-signed Verifiable Presentation. Nothing here is trusted: parsing only
+ * establishes syntactic shape and the allowlisted signer before any resolver or
+ * signature verifier is invoked.
+ */
+
+/** Remote-key and extension headers are never valid for this purpose. */
+const FORBIDDEN_HEADER_FIELDS = ['jwk', 'jku', 'x5u', 'x5c', 'crit', 'enc', 'apu', 'apv'] as const;
+
+const MAX_KID_LENGTH = 512;
+
+export type ParsedCompactJwt = {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+    signingInput: string;
+    signature: string;
+};
+
+export type ParseCompactJwtResult =
+    | { ok: true; parsed: ParsedCompactJwt }
+    | { ok: false; reason: 'TOKEN_TOO_LARGE' | 'MALFORMED_TOKEN' };
+
+export const parseCompactJwt = (token: unknown, maxBytes: number): ParseCompactJwtResult => {
+    if (typeof token !== 'string') return { ok: false, reason: 'MALFORMED_TOKEN' };
+    if (Buffer.byteLength(token, 'utf8') > maxBytes)
+        return { ok: false, reason: 'TOKEN_TOO_LARGE' };
+
+    const parts = token.split('.');
+
+    if (parts.length !== 3) return { ok: false, reason: 'MALFORMED_TOKEN' };
+
+    const [headerPart, payloadPart, signaturePart] = parts;
+
+    if (!headerPart || !payloadPart || !signaturePart) {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    if (
+        !isCanonicalBase64Url(headerPart) ||
+        !isCanonicalBase64Url(payloadPart) ||
+        !isCanonicalBase64Url(signaturePart)
+    ) {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    let header: unknown;
+    let payload: unknown;
+
+    try {
+        header = JSON.parse(Buffer.from(headerPart, 'base64url').toString('utf8'));
+        payload = JSON.parse(Buffer.from(payloadPart, 'base64url').toString('utf8'));
+    } catch {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    if (!isPlainObject(header) || !isPlainObject(payload)) {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    return {
+        ok: true,
+        parsed: {
+            header,
+            payload,
+            signingInput: `${headerPart}.${payloadPart}`,
+            signature: signaturePart,
+        },
+    };
+};
+
+export type ValidatedJwtHeader = {
+    signerDid: string;
+    /** Full `kid`, e.g. `did:web:brain.example#key-1`. */
+    verificationMethod: string;
+};
+
+export type ValidateJwtHeaderResult =
+    | { ok: true; value: ValidatedJwtHeader }
+    | {
+          ok: false;
+          reason:
+              | 'UNSUPPORTED_HEADER'
+              | 'UNSUPPORTED_ALGORITHM'
+              | 'MISSING_KID'
+              | 'UNKNOWN_SIGNER'
+              | 'UNKNOWN_VERIFICATION_METHOD';
+      };
+
+/**
+ * Validate the JOSE header and apply the exact DID + verification-method
+ * allowlist. This runs *before* the injected signature verifier, so an unknown
+ * `kid` can never trigger did:web/did:key network resolution.
+ */
+export const validateShareContentJwtHeader = (
+    header: Record<string, unknown>,
+    config: ShareContentTrustConfig
+): ValidateJwtHeaderResult => {
+    if (
+        Object.keys(header).some(field => !['alg', 'kid', 'typ'].includes(field)) ||
+        (header.typ !== undefined && header.typ !== 'JWT')
+    ) {
+        return { ok: false, reason: 'UNSUPPORTED_HEADER' };
+    }
+    for (const field of FORBIDDEN_HEADER_FIELDS) {
+        if (field in header) return { ok: false, reason: 'UNSUPPORTED_HEADER' };
+    }
+
+    const alg = header.alg;
+
+    if (typeof alg !== 'string' || !config.allowedAlgorithms.includes(alg)) {
+        return { ok: false, reason: 'UNSUPPORTED_ALGORITHM' };
+    }
+
+    const kid = header.kid;
+
+    if (typeof kid !== 'string' || kid.length === 0 || kid.length > MAX_KID_LENGTH) {
+        return { ok: false, reason: 'MISSING_KID' };
+    }
+
+    // Reject URLs / relative key references outright. Only a DID URL fragment is valid.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(kid) && !kid.startsWith('did:')) {
+        return { ok: false, reason: 'UNSUPPORTED_HEADER' };
+    }
+
+    const hashIndex = kid.indexOf('#');
+
+    if (hashIndex <= 0 || hashIndex === kid.length - 1) {
+        return { ok: false, reason: 'MISSING_KID' };
+    }
+
+    const signerDid = kid.slice(0, hashIndex);
+
+    if (!signerDid.startsWith('did:')) return { ok: false, reason: 'MISSING_KID' };
+
+    if (!config.allowedServiceDids.includes(signerDid)) {
+        return { ok: false, reason: 'UNKNOWN_SIGNER' };
+    }
+
+    if (!config.allowedVerificationMethods.includes(kid)) {
+        return { ok: false, reason: 'UNKNOWN_VERIFICATION_METHOD' };
+    }
+
+    return { ok: true, value: { signerDid, verificationMethod: kid } };
+};