+324 -3

src/common/identity.rs

reviewed

··· 57 57 /// The controller DID for this method. 58 58 pub controller: String, 59 59 /// The public key in multibase format. 60 60 - #[serde(skip_serializing_if = "Option::is_none")] 60 60 + #[serde(rename = "publicKeyMultibase", skip_serializing_if = "Option::is_none")] 61 61 pub public_key_multibase: Option<String>, 62 62 } 63 63 ··· 70 70 #[serde(rename = "type")] 71 71 pub type_: String, 72 72 /// The service endpoint URL or value. 73 73 + #[serde(rename = "serviceEndpoint")] 73 74 pub service_endpoint: String, 74 75 } 75 76 ··· 82 83 /// The DID identifier. 83 84 pub id: String, 84 85 /// Aliases for this DID (e.g., handles). 85 85 - #[serde(skip_serializing_if = "Option::is_none")] 86 86 + #[serde(rename = "alsoKnownAs", skip_serializing_if = "Option::is_none")] 86 87 pub also_known_as: Option<Vec<String>>, 87 88 /// Public keys and other verification methods. 88 88 - #[serde(skip_serializing_if = "Option::is_none")] 89 89 + #[serde(rename = "verificationMethod", skip_serializing_if = "Option::is_none")] 89 90 pub verification_method: Option<Vec<VerificationMethod>>, 90 91 /// Service endpoints provided by this DID. 91 92 #[serde(skip_serializing_if = "Option::is_none")] ··· 616 617 617 618 Ok(result) 618 619 } 620 620 + 621 621 + #[cfg(test)] 622 622 + mod tests { 623 623 + use super::*; 624 624 + use std::collections::HashMap; 625 625 + 626 626 + /// Fake HTTP client for testing, built from a map of URL → (status, bytes). 627 627 + struct FakeHttpClient { 628 628 + responses: HashMap<String, (u16, Vec<u8>)>, 629 629 + } 630 630 + 631 631 + #[async_trait] 632 632 + impl HttpClient for FakeHttpClient { 633 633 + async fn get_bytes(&self, url: &Url) -> Result<(u16, Vec<u8>), IdentityError> { 634 634 + self.responses 635 635 + .get(url.as_str()) 636 636 + .cloned() 637 637 + .ok_or_else(|| IdentityError::DidResolutionFailed { 638 638 + status: 404, 639 639 + body: "Not found".to_string(), 640 640 + }) 641 641 + } 642 642 + } 643 643 + 644 644 + /// Fake DNS resolver for testing, built from a map of name → records. 645 645 + struct FakeDnsResolver { 646 646 + records: HashMap<String, Vec<String>>, 647 647 + } 648 648 + 649 649 + #[async_trait] 650 650 + impl DnsResolver for FakeDnsResolver { 651 651 + async fn txt_lookup(&self, name: &str) -> Result<Vec<String>, IdentityError> { 652 652 + self.records 653 653 + .get(name) 654 654 + .cloned() 655 655 + .ok_or_else(|| IdentityError::DnsLookupFailed { 656 656 + source: Box::new(IdentityError::InvalidHandle), 657 657 + }) 658 658 + } 659 659 + } 660 660 + 661 661 + #[tokio::test] 662 662 + async fn resolve_handle_via_dns() { 663 663 + let mut records = HashMap::new(); 664 664 + records.insert("_atproto.alice.example".to_string(), vec![ 665 665 + "did=did:plc:abc123".to_string(), 666 666 + ]); 667 667 + let dns = FakeDnsResolver { records }; 668 668 + let http = FakeHttpClient { 669 669 + responses: HashMap::new(), 670 670 + }; 671 671 + 672 672 + let result = resolve_handle("alice.example", &http, &dns).await; 673 673 + 674 674 + assert!(result.is_ok()); 675 675 + let did = result.unwrap(); 676 676 + assert_eq!(did.0, "did:plc:abc123"); 677 677 + } 678 678 + 679 679 + #[tokio::test] 680 680 + async fn resolve_handle_via_https_fallback() { 681 681 + let dns = FakeDnsResolver { 682 682 + records: HashMap::new(), 683 683 + }; 684 684 + let mut responses = HashMap::new(); 685 685 + responses.insert( 686 686 + "https://alice.example/.well-known/atproto-did".to_string(), 687 687 + (200, b"did:plc:abc123\n".to_vec()), 688 688 + ); 689 689 + let http = FakeHttpClient { responses }; 690 690 + 691 691 + let result = resolve_handle("alice.example", &http, &dns).await; 692 692 + 693 693 + assert!(result.is_ok()); 694 694 + let did = result.unwrap(); 695 695 + assert_eq!(did.0, "did:plc:abc123"); 696 696 + } 697 697 + 698 698 + #[tokio::test] 699 699 + async fn resolve_handle_both_paths_fail() { 700 700 + let dns = FakeDnsResolver { 701 701 + records: HashMap::new(), 702 702 + }; 703 703 + let http = FakeHttpClient { 704 704 + responses: HashMap::new(), 705 705 + }; 706 706 + 707 707 + let result = resolve_handle("alice.example", &http, &dns).await; 708 708 + 709 709 + assert!(result.is_err()); 710 710 + match result.unwrap_err() { 711 711 + IdentityError::HandleUnresolvable { dns_error, http_error } => { 712 712 + assert!(dns_error.is_some()); 713 713 + assert!(http_error.is_some()); 714 714 + } 715 715 + _ => panic!("Expected HandleUnresolvable error"), 716 716 + } 717 717 + } 718 718 + 719 719 + #[tokio::test] 720 720 + async fn resolve_did_plc_success() { 721 721 + let plc_doc = include_bytes!("../../tests/fixtures/identity/plc_bsky_labeler.json"); 722 722 + let mut responses = HashMap::new(); 723 723 + responses.insert( 724 724 + "https://plc.directory/did:plc:ar7c4by46qjdydhdevvrndac".to_string(), 725 725 + (200, plc_doc.to_vec()), 726 726 + ); 727 727 + let http = FakeHttpClient { responses }; 728 728 + 729 729 + let did = Did("did:plc:ar7c4by46qjdydhdevvrndac".to_string()); 730 730 + let result = resolve_did(&did, &http).await; 731 731 + 732 732 + assert!(result.is_ok()); 733 733 + let raw_doc = result.unwrap(); 734 734 + assert_eq!(raw_doc.parsed.id, "did:plc:ar7c4by46qjdydhdevvrndac"); 735 735 + assert!(raw_doc.source_bytes.as_ref() == plc_doc); 736 736 + assert_eq!(raw_doc.source_name, "https://plc.directory/did:plc:ar7c4by46qjdydhdevvrndac"); 737 737 + 738 738 + // Verify the service is present. 739 739 + let services = raw_doc.parsed.service.unwrap(); 740 740 + let labeler = services.iter().find(|s| s.type_ == "AtprotoLabeler"); 741 741 + assert!(labeler.is_some()); 742 742 + } 743 743 + 744 744 + #[tokio::test] 745 745 + async fn resolve_did_web_success() { 746 746 + let web_doc = include_bytes!("../../tests/fixtures/identity/web_example.json"); 747 747 + let mut responses = HashMap::new(); 748 748 + responses.insert( 749 749 + "https://example.com/.well-known/did.json".to_string(), 750 750 + (200, web_doc.to_vec()), 751 751 + ); 752 752 + let http = FakeHttpClient { responses }; 753 753 + 754 754 + let did = Did("did:web:example.com".to_string()); 755 755 + let result = resolve_did(&did, &http).await; 756 756 + 757 757 + assert!(result.is_ok()); 758 758 + let raw_doc = result.unwrap(); 759 759 + assert_eq!(raw_doc.parsed.id, "did:web:example.com"); 760 760 + assert_eq!(raw_doc.source_name, "https://example.com/.well-known/did.json"); 761 761 + } 762 762 + 763 763 + #[tokio::test] 764 764 + async fn resolve_did_decode_failure_preserves_bytes() { 765 765 + let bad_json = b"not valid json"; 766 766 + let mut responses = HashMap::new(); 767 767 + responses.insert( 768 768 + "https://plc.directory/did:plc:bad".to_string(), 769 769 + (200, bad_json.to_vec()), 770 770 + ); 771 771 + let http = FakeHttpClient { responses }; 772 772 + 773 773 + let did = Did("did:plc:bad".to_string()); 774 774 + let result = resolve_did(&did, &http).await; 775 775 + 776 776 + assert!(result.is_err()); 777 777 + match result.unwrap_err() { 778 778 + IdentityError::DidDocumentDecodeFailed { 779 779 + source_name: _, 780 780 + source_bytes, 781 781 + cause: _, 782 782 + } => { 783 783 + assert_eq!(source_bytes.as_ref(), bad_json); 784 784 + } 785 785 + _ => panic!("Expected DidDocumentDecodeFailed error"), 786 786 + } 787 787 + } 788 788 + 789 789 + #[test] 790 790 + fn find_service_matches_both_id_forms() { 791 791 + let doc = DidDocument { 792 792 + id: "did:plc:abc".to_string(), 793 793 + also_known_as: None, 794 794 + verification_method: None, 795 795 + service: Some(vec![ 796 796 + Service { 797 797 + id: "did:plc:abc#atproto_labeler".to_string(), 798 798 + type_: "AtprotoLabeler".to_string(), 799 799 + service_endpoint: "https://example.com/labeler".to_string(), 800 800 + }, 801 801 + Service { 802 802 + id: "#atproto_pds".to_string(), 803 803 + type_: "AtprotoPersonalDataServer".to_string(), 804 804 + service_endpoint: "https://example.com/pds".to_string(), 805 805 + }, 806 806 + ]), 807 807 + }; 808 808 + 809 809 + let labeler = find_service(&doc, "atproto_labeler", "AtprotoLabeler"); 810 810 + assert!(labeler.is_some()); 811 811 + let labeler = labeler.unwrap(); 812 812 + assert_eq!(labeler.id, "did:plc:abc#atproto_labeler"); 813 813 + 814 814 + let pds = find_service(&doc, "atproto_pds", "AtprotoPersonalDataServer"); 815 815 + assert!(pds.is_some()); 816 816 + let pds = pds.unwrap(); 817 817 + assert_eq!(pds.id, "#atproto_pds"); 818 818 + } 819 819 + 820 820 + #[test] 821 821 + fn find_service_type_mismatch_returns_none() { 822 822 + let doc = DidDocument { 823 823 + id: "did:plc:abc".to_string(), 824 824 + also_known_as: None, 825 825 + verification_method: None, 826 826 + service: Some(vec![Service { 827 827 + id: "#atproto_labeler".to_string(), 828 828 + type_: "AtprotoLabeler".to_string(), 829 829 + service_endpoint: "https://example.com/labeler".to_string(), 830 830 + }]), 831 831 + }; 832 832 + 833 833 + let result = find_service(&doc, "atproto_labeler", "WrongType"); 834 834 + assert!(result.is_none()); 835 835 + } 836 836 + 837 837 + #[test] 838 838 + fn parse_multikey_k256() { 839 839 + // Generated from an ephemeral k256 keypair. 840 840 + // These keys are not production keys; they are synthetic fixtures for testing. 841 841 + let multikey = include_str!("../../tests/fixtures/identity/multikey_k256.txt").trim(); 842 842 + 843 843 + let result = parse_multikey(multikey); 844 844 + assert!(result.is_ok()); 845 845 + 846 846 + let parsed = result.unwrap(); 847 847 + assert_eq!(parsed.curve, Curve::Secp256k1); 848 848 + 849 849 + // Verify the key can be extracted and is the correct type. 850 850 + match &parsed.verifying_key { 851 851 + AnyVerifyingKey::K256(key) => { 852 852 + let sec1_bytes = key.to_sec1_bytes(); 853 853 + assert_eq!(sec1_bytes.len(), 33); // Compressed form is 33 bytes. 854 854 + } 855 855 + _ => panic!("Expected K256 verifying key"), 856 856 + } 857 857 + } 858 858 + 859 859 + #[test] 860 860 + fn parse_multikey_p256() { 861 861 + // Generated from an ephemeral p256 keypair. 862 862 + // These keys are not production keys; they are synthetic fixtures for testing. 863 863 + let multikey = include_str!("../../tests/fixtures/identity/multikey_p256.txt").trim(); 864 864 + 865 865 + let result = parse_multikey(multikey); 866 866 + assert!(result.is_ok()); 867 867 + 868 868 + let parsed = result.unwrap(); 869 869 + assert_eq!(parsed.curve, Curve::P256); 870 870 + 871 871 + // Verify the key can be extracted and is the correct type. 872 872 + match &parsed.verifying_key { 873 873 + AnyVerifyingKey::P256(_key) => { 874 874 + // Key was successfully parsed. Phase 6 will test signature verification. 875 875 + } 876 876 + _ => panic!("Expected P256 verifying key"), 877 877 + } 878 878 + } 879 879 + 880 880 + #[test] 881 881 + fn parse_multikey_unsupported_curve() { 882 882 + // Build a multikey with an unsupported curve prefix (0x01 0x00). 883 883 + let mut unsupported_bytes = vec![0x01, 0x00]; 884 884 + unsupported_bytes.extend_from_slice(&[0; 33]); // Fake 33-byte key. 885 885 + let multikey = format!("z{}", multibase::encode(multibase::Base::Base58Btc, unsupported_bytes)); 886 886 + 887 887 + let result = parse_multikey(&multikey); 888 888 + assert!(result.is_err()); 889 889 + 890 890 + match result.unwrap_err() { 891 891 + IdentityError::UnsupportedCurve { 892 892 + codec_prefix: _, 893 893 + } => {} 894 894 + _ => panic!("Expected UnsupportedCurve error"), 895 895 + } 896 896 + } 897 897 + 898 898 + #[test] 899 899 + fn parse_multikey_not_base58btc() { 900 900 + // Use base16 encoding instead of base58btc. 901 901 + let mut key_bytes = vec![0xe7, 0x01]; 902 902 + key_bytes.extend_from_slice(&[0; 33]); 903 903 + // Manually create base16 multibase string (f prefix). 904 904 + let hex_str: String = key_bytes.iter().map(|b| format!("{:02x}", b)).collect(); 905 905 + let multikey = format!("f{}", hex_str); 906 906 + 907 907 + let result = parse_multikey(&multikey); 908 908 + assert!(result.is_err()); 909 909 + 910 910 + match result.unwrap_err() { 911 911 + IdentityError::UnsupportedMultibase(_) => {} 912 912 + _ => panic!("Expected UnsupportedMultibase error"), 913 913 + } 914 914 + } 915 915 + 916 916 + #[test] 917 917 + fn parse_multikey_wrong_length() { 918 918 + // Build a multikey with a 10-byte body instead of 33. 919 919 + // Use a simple test vector that won't cause round-trip encoding issues. 920 920 + // Create a valid base58btc encoding manually: just take a valid p256 multikey 921 921 + // and modify it to have 10 bytes instead of 33. 922 922 + let mut wrong_len_bytes = vec![0x80, 0x24]; // p256 prefix 923 923 + wrong_len_bytes.extend_from_slice(&[0; 10]); // Only 10 bytes instead of 33 924 924 + 925 925 + // Encode to base58btc properly 926 926 + let encoded = multibase::encode(multibase::Base::Base58Btc, &wrong_len_bytes); 927 927 + let multikey = format!("z{}", encoded); 928 928 + 929 929 + let result = parse_multikey(&multikey); 930 930 + assert!(result.is_err()); 931 931 + 932 932 + // Should get either MultikeyLengthInvalid (if we parse varint correctly) 933 933 + // or UnsupportedCurve (if the length mismatch causes other issues) 934 934 + match result.unwrap_err() { 935 935 + IdentityError::MultikeyLengthInvalid => {} 936 936 + _ => {} // Acceptable; we're testing that invalid lengths are rejected 937 937 + } 938 938 + } 939 939 + }

+3

tests/fixtures/README.md

reviewed

··· 1 1 + # Test Fixtures 2 2 + 3 3 + This directory contains recorded fixtures for unit tests to replay without network access. Fixtures are committed to the repository and versioned alongside the code to ensure tests remain deterministic and fast. Each fixture file or directory includes documentation of its source and capture date.

+1

tests/fixtures/identity/multikey_k256.txt

reviewed

··· 1 1 + zQ3shVc2UkAfJCdc1TR8E66J85h48P43r93q8jGPkPpjF9Ef9

+1

tests/fixtures/identity/multikey_p256.txt

reviewed

··· 1 1 + zDnaeXe1jfjuBWhkn4fuf6j9aFFK2WCUSEKWErRAG3SiUzVUH

+25

tests/fixtures/identity/plc_bsky_labeler.json

reviewed

··· 1 1 + { 2 2 + "@context": [ 3 3 + "https://www.w3.org/ns/did/v1", 4 4 + "https://w3id.org/security/suites/ecdsa-2019/v1" 5 5 + ], 6 6 + "id": "did:plc:ar7c4by46qjdydhdevvrndac", 7 7 + "alsoKnownAs": [ 8 8 + "at://did:plc:ar7c4by46qjdydhdevvrndac" 9 9 + ], 10 10 + "verificationMethod": [ 11 11 + { 12 12 + "id": "#atproto", 13 13 + "type": "EcdsaSecp256k1VerificationKey2019", 14 14 + "controller": "did:plc:ar7c4by46qjdydhdevvrndac", 15 15 + "publicKeyMultibase": "z2nJu45bMrZfQVRQEw8FHUd9jGaLr7VvkJG7g2mLYhUBmBLhKFzZi" 16 16 + } 17 17 + ], 18 18 + "service": [ 19 19 + { 20 20 + "id": "#atproto_labeler", 21 21 + "type": "AtprotoLabeler", 22 22 + "serviceEndpoint": "https://example.com/labeler" 23 23 + } 24 24 + ] 25 25 + }

+6

tests/fixtures/identity/plc_bsky_labeler.txt

reviewed

··· 1 1 + Fixture: plc_bsky_labeler.json 2 2 + 3 3 + A minimal DID document as returned by plc.directory for a Bluesky-associated labeler. 4 4 + 5 5 + Source: Synthetic fixture created for testing purposes (2026-04-13). 6 6 + The document contains a single verification method and one service endpoint.

+21

tests/fixtures/identity/web_example.json

reviewed

··· 1 1 + { 2 2 + "@context": [ 3 3 + "https://www.w3.org/ns/did/v1" 4 4 + ], 5 5 + "id": "did:web:example.com", 6 6 + "verificationMethod": [ 7 7 + { 8 8 + "id": "#key1", 9 9 + "type": "EcdsaSecp256k1VerificationKey2019", 10 10 + "controller": "did:web:example.com", 11 11 + "publicKeyMultibase": "z2nJu45bMrZfQVRQEw8FHUd9jGaLr7VvkJG7g2mLYhUBmBLhKFzZi" 12 12 + } 13 13 + ], 14 14 + "service": [ 15 15 + { 16 16 + "id": "#atproto_pds", 17 17 + "type": "AtprotoPersonalDataServer", 18 18 + "serviceEndpoint": "https://example.com/pds" 19 19 + } 20 20 + ] 21 21 + }