openentity 0.2.0__tar.gz → 0.3.0__tar.gz

{openentity-0.2.0 → openentity-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openentity
-Version: 0.2.0
+Version: 0.3.0
 Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
 Project-URL: Homepage, https://openentity.org
 Project-URL: Documentation, https://oeis.dev

openentity-0.3.0/openentity/__init__.py

@@ -0,0 +1,4 @@
+from .client import adopt, dispute, find, present, record, rotate, withdraw  # noqa: F401
+from .core import *  # noqa: F401,F403
+
+__version__ = "0.3.0"

{openentity-0.2.0 → openentity-0.3.0}/openentity/client.py

@@ -120,6 +120,18 @@ def record(seed: bytes, entries: list[tuple[str, dict]], registry: str = DEFAULT
     return {"accepted": len(signed), "entries": signed}
 
 
+def rotate(seed: bytes, registry: str = DEFAULT_REGISTRY, new_seed: bytes | None = None, basis: str = "rotation") -> dict:
+    """Rotate to a new key in one call (spec 9.2). Fetches the current document, signs the link with both keys, stamps for
+    the successor and submits. Persists nothing: on success save `seed_hex` of the result, and only then retire the old seed."""
+    registry = registry.rstrip("/")
+    old, new = core.KeyPair(seed), core.KeyPair(new_seed)
+    prev_doc = _request(f"{registry}/v1/entities/{old.did}/document")
+    body = core.build_rotation(old, new, core.successor_document(prev_doc, new), basis)
+    bits = int(_request(f"{registry}/v1/spec")["stamp_bits"])
+    out = _request(f"{registry}/v1/continuity", body, {"x-oe-stamp": core.mint_stamp(bits, new.did)})
+    return {**out, "previous": old.did, "did": new.did, "seed_hex": new.seed.hex(), **body}
+
+
 DISPUTE_REASONS = ("impersonation", "illegal_content", "inaccurate", "other")
 
 

{openentity-0.2.0 → openentity-0.3.0}/openentity/core.py

@@ -135,15 +135,39 @@ def nonce() -> str:
 # ---- eddsa-jcs-2022 (spec 4.1) ----
 def _signing_input(obj: dict, proof: dict) -> bytes:
     config = {k: v for k, v in proof.items() if k != "proofValue"}
-    doc = {k: v for k, v in obj.items() if k != "proof"}
+    doc = {k: v for k, v in obj.items() if k not in ("proof", "proofs")}  # a ContinuityLink carries proofs[]
     return canonical_hash(config) + canonical_hash(doc)
 
 
-def sign_object(obj: dict, kp: KeyPair, created: str | None = None) -> dict:
+def sign_proof(obj: dict, kp: KeyPair, created: str | None = None) -> dict:
     proof = {"type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": created or now(),
              "verificationMethod": verification_method(kp.did), "proofPurpose": "assertionMethod"}
     sig = kp.private.sign(_signing_input(obj, proof))
-    return {**{k: v for k, v in obj.items() if k != "proof"}, "proof": {**proof, "proofValue": "z" + b58encode(sig)}}
+    return {**proof, "proofValue": "z" + b58encode(sig)}
+
+
+def sign_object(obj: dict, kp: KeyPair, created: str | None = None) -> dict:
+    return {**{k: v for k, v in obj.items() if k != "proof"}, "proof": sign_proof(obj, kp, created)}
+
+
+# ---- continuity (spec 9) ----
+def successor_document(prev: dict, nxt: KeyPair, created: str | None = None) -> dict:
+    """The successor's unsigned seq 1 document: `prev` re-keyed, aliases dropped (their proofs name the old EID)."""
+    created = created or now()
+    d = {k: v for k, v in prev.items() if k not in ("proof", "aliases")}
+    return {**d, "eid": nxt.did, "created": created, "updated": created, "seq": 1,
+            "keys": [{"id": verification_method(nxt.did), "type": "Multikey", "publicKeyMultibase": nxt.did.removeprefix("did:key:")}],
+            "continuity": {**d.get("continuity", {}), "previous": prev["eid"]}}
+
+
+def build_rotation(previous: KeyPair, successor: KeyPair, document: dict, basis: str = "rotation",
+                   created: str | None = None, nonce_: str | None = None) -> dict:
+    """The body of POST /v1/continuity: a link signed by both keys, and the successor's document signed by it."""
+    created = created or now()
+    body = {"spec": SPEC, "type": "ContinuityLink", "previous": previous.did, "successor": successor.did,
+            "basis": basis, "created": created, "nonce": nonce_ or nonce()}
+    link = {**body, "proofs": [sign_proof(body, previous, created), sign_proof(body, successor, created)]}
+    return {"link": link, "document": sign_object(document, successor, created)}
 
 
 # ---- EIP-712 for did:pkh (spec 4.2) ----

{openentity-0.2.0 → openentity-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openentity"
-version = "0.2.0"
+version = "0.3.0"
 description = "Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt()."
 readme = "README.md"
 license = "MIT"

{openentity-0.2.0 → openentity-0.3.0}/tests/test_client.py

@@ -18,6 +18,7 @@ class Stub(BaseHTTPRequestHandler):
     chain: list = []  # accepted record entries
     attestations: list = []
     entity: dict | None = None  # overrides GET /v1/entities/<eid>
+    refuse = False  # refuse every continuity link
 
     def log_message(self, *a):
         pass
@@ -44,6 +45,8 @@ class Stub(BaseHTTPRequestHandler):
             return self._send(200, {"head": head, "entries": [e for e in Stub.chain if e["seq"] > after]})
         if u.path.endswith("/attestations"):
             return self._send(200, {"attestations": Stub.attestations})
+        if u.path.endswith("/document"):
+            return self._send(200, client.build_adoption(core.KeyPair(SEED), "Tester", "d", "http://x")[0])
         if u.path.startswith("/v1/entities/"):
             return self._send(200, Stub.entity or {"document": {"name": "Tester"}, "level": "L0"})
         self._send(404, {"error": "not_found", "message": u.path})
@@ -52,7 +55,7 @@ class Stub(BaseHTTPRequestHandler):
         body = json.loads(self.rfile.read(int(self.headers["content-length"])))
         stamp = self.headers.get("x-oe-stamp")
         Stub.log.append(("POST", self.path, body, stamp))
-        eid = body.get("eid") or body.get("issuer")
+        eid = body.get("eid") or body.get("issuer") or body.get("link", {}).get("successor")
         if not stamp or core.check_stamp(stamp, BITS, eid or self.path.split("/")[3]):
             return self._send(400, {"error": "stamp_required", "message": "stamp"})
         if self.path.endswith("/record"):
@@ -63,6 +66,12 @@ class Stub(BaseHTTPRequestHandler):
                     return self._send(409, {"error": "bad_chain", "message": "chain"})
                 Stub.chain.append(e)
             return self._send(200, {"accepted": len(body["entries"])})
+        if self.path == "/v1/continuity":
+            link = body["link"]
+            ok = not Stub.refuse and all(core.verify_object({**link, "proof": p}) == (True, d) for p, d in zip(link["proofs"], (link["previous"], link["successor"])))
+            if not ok or core.verify_object(body["document"])[1] != link["successor"]:
+                return self._send(422, {"error": "continuity_proof_missing", "message": "no"})
+            return self._send(201, {"previous": link["previous"], "successor": link["successor"], "basis": link["basis"]})
         if not core.verify_object(body)[0]:
             return self._send(422, {"error": "bad_signature", "message": "sig"})
         if self.path == "/v1/withdraw":
@@ -74,7 +83,7 @@ class Stub(BaseHTTPRequestHandler):
 
 @pytest.fixture
 def url():
-    Stub.log, Stub.chain, Stub.attestations, Stub.entity = [], [], [], None
+    Stub.log, Stub.chain, Stub.attestations, Stub.entity, Stub.refuse = [], [], [], None, False
     srv = HTTPServer(("127.0.0.1", 0), Stub)
     threading.Thread(target=srv.serve_forever, daemon=True).start()
     yield f"http://127.0.0.1:{srv.server_port}"
@@ -266,3 +275,21 @@ def test_cli_registry_comes_from_the_flag_env_or_the_saved_key(url, home, capsys
     assert json.loads(run(capsys, "whoami", "--json", "--registry", url)[1])["registry"] == url
 
 
+
+
+def test_rotate_signs_with_both_keys_stamps_for_the_successor_and_returns_the_new_seed(url):
+    out = client.rotate(SEED, registry=url)
+    (body,) = posts("/v1/continuity")
+    new = core.KeyPair(bytes.fromhex(out["seed_hex"]))
+    link = body["link"]
+    assert (link["previous"], link["successor"], link["basis"]) == (KP.did, new.did, "rotation") and out["did"] == new.did
+    assert [p["verificationMethod"].split("#")[0] for p in link["proofs"]] == [KP.did, new.did]
+    assert body["document"]["eid"] == new.did and body["document"]["seq"] == 1 and body["document"]["continuity"]["previous"] == KP.did
+    assert core.check_stamp([s for m, p, _, s in Stub.log if p == "/v1/continuity"][0], BITS, new.did) is None
+
+
+def test_rotate_the_registry_refuses_raises_and_returns_nothing(url):
+    Stub.refuse = True
+    with pytest.raises(client.RegistryError) as e:
+        client.rotate(SEED, registry=url)
+    assert e.value.status == 422

{openentity-0.2.0 → openentity-0.3.0}/tests/test_core.py

@@ -183,7 +183,7 @@ def test_adopt_and_cli(tmp_path, monkeypatch, capsys):
 def test_cli_version(capsys):
     with pytest.raises(SystemExit) as e:
         cli.main(["--version"])
-    assert e.value.code == 0 and "0.2.0" in capsys.readouterr().out
+    assert e.value.code == 0 and "0.3.0" in capsys.readouterr().out
 
 
 # ---- shared vectors, checked with the independent verifier's own logic ----
@@ -241,3 +241,20 @@ def test_did_web_needs_a_resolver_and_uses_it():
     obj["proof"]["proofValue"] = "z" + core.b58encode(kp.private.sign(core._signing_input(obj, proof)))
     assert core.verify_object(obj)[0] is False
     assert core.verify_object(obj, resolver=lambda did: {"ed25519": [kp.public]}) == (True, web)
+
+
+# ---- rotation vector: Python reproduces the TS-generated bytes (so each verifies the other's links) ----
+def test_rotation_vector_is_reproduced_byte_for_byte():
+    vec = ROOT / "test-vectors"
+    if not vec.is_dir():
+        pytest.skip("test-vectors/ not present")
+    keys = json.loads((vec / "keys.json").read_text())
+    want = json.loads((vec / "rotation.json").read_text())["request"]
+    prev_doc = json.loads((vec / "entity-document.json").read_text())["object"]
+    a, b = core.KeyPair(bytes.fromhex(keys["entity"]["seed"])), core.KeyPair(bytes.fromhex(keys["second"]["seed"]))
+    created = want["link"]["created"]
+    got = core.build_rotation(a, b, core.successor_document(prev_doc, b, created), created=created, nonce_=want["link"]["nonce"])
+    assert core.canonicalize(got) == core.canonicalize(want)
+    link = want["link"]
+    assert [core.verify_object({**link, "proof": p})[1] for p in link["proofs"]] == [a.did, b.did]
+    assert core.verify_object(want["document"]) == (True, b.did)

{openentity-0.2.0 → openentity-0.3.0}/uv.lock

@@ -189,7 +189,7 @@ wheels = [
 
 [[package]]
 name = "openentity"
-version = "0.2.0"
+version = "0.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },

openentity-0.2.0/openentity/__init__.py

@@ -1,4 +0,0 @@
-from .client import adopt, dispute, find, present, record, withdraw  # noqa: F401
-from .core import *  # noqa: F401,F403
-
-__version__ = "0.2.0"