Update go-did library to support DIDURL for DID URLs (#2583)

api/ssi_types_test.go

@@ -172,7 +172,7 @@ func createDidDocument() did.Document {
 		KeyAgreement:         did.VerificationRelationships{verificationRelationship},
 		VerificationMethod:   did.VerificationMethods{verificationMethod},
 		Controller:           []did.DID{did.MustParseDID("did:example:controller")},
-		ID:                   verificationMethod.ID,
+		ID:                   verificationMethod.ID.DID,
 		Service: []did.Service{
 			{
 				ID:              ssi.MustParseURI("example"),

auth/services/irma/signer_test.go

@@ -21,6 +21,7 @@ package irma
 import (
 	"context"
 	"errors"
+	"github.com/nuts-foundation/go-did/did"
 	"github.com/stretchr/testify/require"
 	"testing"
 
@@ -109,7 +110,7 @@ func TestService_StartSigningSession(t *testing.T) {
 func TestService_SigningSessionStatus(t *testing.T) {
 	correctContractText := "EN:PractitionerLogin:v3 I hereby declare to act on behalf of verpleeghuis De nootjes located in Caretown. This declaration is valid from maandag 1 oktober 12:00:00 until maandag 1 oktober 13:00:00."
 	holder := vdr.TestDIDA
-	keyID := holder
+	keyID := did.DIDURL{DID: holder}
 	keyID.Fragment = keyID.ID
 	ctx := context.Background()
 

auth/services/oauth/authz_server_test.go

@@ -80,7 +80,7 @@ func getAuthorizerDIDDocument() *did.Document {
 	doc := did.Document{
 		ID: id,
 	}
-	signingKeyID := id
+	signingKeyID := did.DIDURL{DID: id}
 	signingKeyID.Fragment = "signing-key"
 	key, err := did.NewVerificationMethod(signingKeyID, ssi.JsonWebKey2020, id, authorizerSigningKey.Public())
 	if err != nil {

crypto/api/v1/api.go

@@ -191,8 +191,8 @@ func (w *Wrapper) EncryptJwe(ctx context.Context, request EncryptJweRequestObjec
 	return EncryptJwe200TextResponse(jwe), err
 }
 
-func (w *Wrapper) resolvePublicKey(id *did.DID) (key crypt.PublicKey, keyID ssi.URI, err error) {
-	if id.IsURL() {
+func (w *Wrapper) resolvePublicKey(id *did.DIDURL) (key crypt.PublicKey, keyID ssi.URI, err error) {
+	if id.Fragment != "" {
 		// Assume it is a keyId
 		now := time.Now()
 		key, err = w.K.ResolveKeyByID(id.String(), &now, resolver.KeyAgreement)
@@ -202,7 +202,7 @@ func (w *Wrapper) resolvePublicKey(id *did.DID) (key crypt.PublicKey, keyID ssi.
 		keyID = id.URI()
 	} else {
 		// Assume it is a DID
-		keyID, key, err = w.K.ResolveKey(*id, nil, resolver.KeyAgreement)
+		keyID, key, err = w.K.ResolveKey(id.DID, nil, resolver.KeyAgreement)
 		if err != nil {
 			return nil, ssi.URI{}, err
 		}

didman/didman_test.go

@@ -539,7 +539,7 @@ func TestDidman_GetContactInformation(t *testing.T) {
 
 func TestDidman_DeleteEndpointsByType(t *testing.T) {
 	id, _ := did.ParseDID("did:nuts:123")
-	serviceID := *id
+	serviceID := did.DIDURL{DID: *id}
 	serviceID.Fragment = "abc"
 	endpointType := "eOverdracht"
 	endpoints := []did.Service{{

go.mod

@@ -23,7 +23,7 @@ require (
 	github.com/nats-io/nats-server/v2 v2.10.4
 	github.com/nats-io/nats.go v1.31.0
 	github.com/nuts-foundation/crypto-ecies v0.0.0-20211207143025-5b84f9efce2b
-	github.com/nuts-foundation/go-did v0.8.0
+	github.com/nuts-foundation/go-did v0.9.0
 	github.com/nuts-foundation/go-leia/v4 v4.0.0
 	github.com/nuts-foundation/go-stoabs v1.9.0
 	// check the oapi-codegen tool version in the makefile when upgrading the runtime

go.sum

@@ -445,8 +445,8 @@ github.com/nightlyone/lockfile v1.0.0/go.mod h1:rywoIealpdNse2r832aiD9jRk8ErCatR
 github.com/npillmayer/nestext v0.1.3/go.mod h1:h2lrijH8jpicr25dFY+oAJLyzlya6jhnuG+zWp9L0Uk=
 github.com/nuts-foundation/crypto-ecies v0.0.0-20211207143025-5b84f9efce2b h1:80icUxWHwE1MrIOOEK5rxrtyKOgZeq5Iu1IjAEkggTY=
 github.com/nuts-foundation/crypto-ecies v0.0.0-20211207143025-5b84f9efce2b/go.mod h1:6YUioYirD6/8IahZkoS4Ypc8xbeJW76Xdk1QKcziNTM=
-github.com/nuts-foundation/go-did v0.8.0 h1:L+XEaX87/P2SY762rhxIUDxj3LNrvk1LDJTtNgQ810o=
-github.com/nuts-foundation/go-did v0.8.0/go.mod h1:L39mh6SBsuenqeZw2JxARx4a/bwdARwchG2x3zPMTjc=
+github.com/nuts-foundation/go-did v0.9.0 h1:JBz1cYaMxplKZ31QyWierrR3Yt2RIpaxZTt8KFm4Ph4=
+github.com/nuts-foundation/go-did v0.9.0/go.mod h1:L39mh6SBsuenqeZw2JxARx4a/bwdARwchG2x3zPMTjc=
 github.com/nuts-foundation/go-leia/v4 v4.0.0 h1:/unYCk18qGG2HWcJK4ld4CaM6k7Tdr0bR1vQd1Jwfcg=
 github.com/nuts-foundation/go-leia/v4 v4.0.0/go.mod h1:A246dA4nhY99OPCQpG/XbQ/iPyyfSaJchanivuPWpao=
 github.com/nuts-foundation/go-stoabs v1.9.0 h1:zK+ugfolaJYyBvGwsRuavLVdycXk4Yw/1gI+tz17lWQ=

network/dag/keys_test.go

@@ -39,7 +39,7 @@ func TestNutsKeyResolver_ResolvePublicKey(t *testing.T) {
 	doc := &did.Document{
 		ID: did.MustParseDID("did:nuts:123"),
 	}
-	mockKID := doc.ID
+	mockKID := did.DIDURL{DID: doc.ID}
 	mockKID.Fragment = "key-1"
 	vm, err := did.NewVerificationMethod(mockKID, ssi.JsonWebKey2020, doc.ID, pk.Public())
 	require.NoError(t, err)

network/network_integration_test.go

@@ -1006,7 +1006,7 @@ func resetIntegrationTest(t *testing.T) {
 	writeDIDDocument := func(subject string) {
 		nodeDID := did.MustParseDID(subject)
 		document := did.Document{ID: nodeDID}
-		kid := nodeDID
+		kid := did.DIDURL{DID: nodeDID}
 		kid.Fragment = "key-1"
 		key, _ := keyStore.New(audit.TestContext(), func(_ crypto.PublicKey) (string, error) {
 			return kid.String(), nil

network/network_test.go

@@ -615,7 +615,7 @@ func TestNetwork_selfTestNutsCommAddress(t *testing.T) {
 
 func TestNetwork_validateNodeDID(t *testing.T) {
 	ctx := context.Background()
-	keyID := *nodeDID
+	keyID := did.DIDURL{DID: *nodeDID}
 	keyID.Fragment = "some-key"
 	key := crypto.NewTestKey(keyID.String()).(*crypto.TestKey).PrivateKey
 	documentWithoutNutsCommService := &did.Document{
@@ -1252,7 +1252,7 @@ func TestNetwork_checkHealth(t *testing.T) {
 	})
 
 	t.Run("authentication", func(t *testing.T) {
-		keyID := *nodeDID
+		keyID := did.DIDURL{DID: *nodeDID}
 		keyID.Fragment = "some-key"
 		completeDocument := &did.Document{
 			KeyAgreement: []did.VerificationRelationship{

vcr/ambassador_test.go

@@ -375,7 +375,7 @@ func (s stubRoundTripper) RoundTrip(request *http.Request) (*http.Response, erro
 
 func documentWithPublicKey(t *testing.T, publicKey crypt.PublicKey) *did.Document {
 	id := did.MustParseDID("did:nuts:CuE3qeFGGLhEAS3gKzhMCeqd1dGa9at5JCbmCfyMU2Ey")
-	keyID := id
+	keyID := did.DIDURL{DID: id}
 	keyID.Fragment = "sNGDQ3NlOe6Icv0E7_ufviOLG6Y25bSEyS5EbXBgp8Y"
 	vm, err := did.NewVerificationMethod(keyID, ssi.JsonWebKey2020, id, publicKey)
 	require.NoError(t, err)

vcr/holder/wallet_test.go

@@ -460,7 +460,7 @@ func createCredential(keyID string) vc.VerifiableCredential {
             "city": "Hengelo",
             "name": "De beste zorg"
         },
-        "id": "` + did.MustParseDIDURL(keyID).WithoutURL().String() + `"
+        "id": "` + did.MustParseDIDURL(keyID).DID.String() + `"
     },
     "issuanceDate": "2021-12-24T13:21:29.087205+01:00",
     "issuer": "did:nuts:4tzMaWfpizVKeA8fscC3JTdWBc3asUWWMj5hUFHdWX3H",

vcr/issuer/issuer_test.go

@@ -690,7 +690,7 @@ func Test_issuer_Revoke(t *testing.T) {
 				store: store,
 			}
 			revocation, err := sut.Revoke(ctx, ssi.MustParseURI("a#38E90E8C-F7E5-4333-B63A-F9DD155A0272"))
-			assert.EqualError(t, err, "failed to extract issuer: invalid DID")
+			assert.EqualError(t, err, "failed to extract issuer: invalid DID: DID must start with 'did:'")
 			assert.Nil(t, revocation)
 		})
 

vcr/issuer/keyresolver_test.go

@@ -34,7 +34,7 @@ import (
 func Test_vdrKeyResolver_ResolveAssertionKey(t *testing.T) {
 	ctx := context.Background()
 	issuerDID, _ := did.ParseDID("did:nuts:123")
-	methodID := *issuerDID
+	methodID := did.DIDURL{DID: *issuerDID}
 	methodID.Fragment = "abc"
 	publicKey := crypto.NewTestKey(issuerDID.String() + "abc").Public()
 	newMethod, err := did.NewVerificationMethod(methodID, ssi.JsonWebKey2020, *issuerDID, publicKey)

vcr/issuer/network_publisher.go

@@ -73,13 +73,13 @@ func (p networkPublisher) PublishCredential(ctx context.Context, verifiableCrede
 		}
 	}
 
-	key, err := p.keyResolver.ResolveAssertionKey(ctx, *issuerDID)
+	key, err := p.keyResolver.ResolveAssertionKey(ctx, issuerDID.DID)
 	if err != nil {
 		return fmt.Errorf("could not resolve an assertion key for issuer: %w", err)
 	}
 
 	// find did document/metadata for originating TXs
-	_, meta, err := p.didResolver.Resolve(*issuerDID, nil)
+	_, meta, err := p.didResolver.Resolve(issuerDID.DID, nil)
 	if err != nil {
 		return err
 	}
@@ -103,7 +103,7 @@ func (p networkPublisher) PublishCredential(ctx context.Context, verifiableCrede
 }
 
 func (p networkPublisher) generateParticipants(verifiableCredential vc.VerifiableCredential) ([]did.DID, error) {
-	issuer, _ := did.ParseDID(verifiableCredential.Issuer.String())
+	issuer, _ := did.ParseDIDURL(verifiableCredential.Issuer.String())
 	participants := make([]did.DID, 0)
 	var (
 		base                []credential.BaseCredentialSubject
@@ -118,7 +118,7 @@ func (p networkPublisher) generateParticipants(verifiableCredential vc.Verifiabl
 	}
 
 	// participants are not the issuer and the credentialSubject.id but the DID that holds the concrete endpoint for the NutsComm service
-	for _, vcp := range []did.DID{*issuer, *credentialSubjectID} {
+	for _, vcp := range []did.DID{issuer.DID, *credentialSubjectID} {
 		serviceOwner, err := p.resolveNutsCommServiceOwner(vcp)
 		if err != nil {
 			return nil, fmt.Errorf("failed to resolve participating node (did=%s): %w", vcp.String(), err)
@@ -149,7 +149,7 @@ func (p networkPublisher) resolveNutsCommServiceOwner(DID did.DID) (*did.DID, er
 }
 
 func (p networkPublisher) PublishRevocation(ctx context.Context, revocation credential.Revocation) error {
-	issuerDID, err := did.ParseDIDURL(revocation.Issuer.String())
+	issuerDID, err := did.ParseDID(revocation.Issuer.String())
 	if err != nil {
 		return fmt.Errorf("invalid revocation issuer: %w", err)
 	}

vcr/issuer/network_publisher_test.go

@@ -335,7 +335,7 @@ func Test_networkPublisher_PublishRevocation(t *testing.T) {
 			publisher := NewNetworkPublisher(nil, nil, nil)
 			revocationToPublish := credential.Revocation{}
 			err := publisher.PublishRevocation(ctx, revocationToPublish)
-			assert.EqualError(t, err, "invalid revocation issuer: invalid DID")
+			assert.EqualError(t, err, "invalid revocation issuer: invalid DID: DID must start with 'did:'")
 		})
 	})
 

vcr/vcr.go

@@ -544,7 +544,7 @@ func (c *vcr) Untrusted(credentialType ssi.URI) ([]ssi.URI, error) {
 			if err != nil {
 				return err
 			}
-			_, _, err = didResolver.Resolve(*issuerDid, nil)
+			_, _, err = didResolver.Resolve(issuerDid.DID, nil)
 			if err != nil {
 				if !(errors.Is(err, did.DeactivatedErr) || errors.Is(err, resolver.ErrNoActiveController)) {
 					return err

vcr/vcr_test.go

@@ -382,19 +382,19 @@ func TestVcr_Untrusted(t *testing.T) {
 	t.Run("Untrusted", func(t *testing.T) {
 		confirmTrustedStatus(t, instance, testCredential.Issuer, instance.Untrusted, 0)
 		confirmUntrustedStatus(t, func(issuer ssi.URI) ([]ssi.URI, error) {
-			mockDidResolver.EXPECT().Resolve(did.MustParseDIDURL(testCredential.Issuer.String()), nil).Return(nil, nil, nil)
+			mockDidResolver.EXPECT().Resolve(did.MustParseDID(testCredential.Issuer.String()), nil).Return(nil, nil, nil)
 			return instance.Untrusted(issuer)
 		}, 1)
 	})
 	t.Run("Untrusted - did deactivated", func(t *testing.T) {
 		confirmUntrustedStatus(t, func(issuer ssi.URI) ([]ssi.URI, error) {
-			mockDidResolver.EXPECT().Resolve(did.MustParseDIDURL(testCredential.Issuer.String()), nil).Return(nil, nil, did.DeactivatedErr)
+			mockDidResolver.EXPECT().Resolve(did.MustParseDID(testCredential.Issuer.String()), nil).Return(nil, nil, did.DeactivatedErr)
 			return instance.Untrusted(issuer)
 		}, 0)
 	})
 	t.Run("Untrusted - no active controller", func(t *testing.T) {
 		confirmUntrustedStatus(t, func(issuer ssi.URI) ([]ssi.URI, error) {
-			mockDidResolver.EXPECT().Resolve(did.MustParseDIDURL(testCredential.Issuer.String()), nil).Return(nil, nil, resolver.ErrNoActiveController)
+			mockDidResolver.EXPECT().Resolve(did.MustParseDID(testCredential.Issuer.String()), nil).Return(nil, nil, resolver.ErrNoActiveController)
 			return instance.Untrusted(issuer)
 		}, 0)
 	})

vcr/verifier/verifier_test.go

@@ -99,7 +99,7 @@ func Test_verifier_Validate(t *testing.T) {
 		require.NoError(t, err)
 
 		template := testCredential(t)
-		template.Issuer = did.MustParseDIDURL(key.KID()).WithoutURL().URI()
+		template.Issuer = did.MustParseDIDURL(key.KID()).DID.URI()
 
 		cred, err := vc.CreateJWTVerifiableCredential(audit.TestContext(), template, func(ctx context.Context, claims map[string]interface{}, headers map[string]interface{}) (string, error) {
 			return keyStore.SignJWT(ctx, claims, headers, key)

vdr/didjwk/resolver.go

@@ -82,9 +82,9 @@ func (w Resolver) Resolve(id did.DID, _ *resolver.ResolveMetadata) (*did.Documen
 
 	// Create a new DID verification method.
 	// See https://www.w3.org/TR/did-core/#verification-methods
-	keyID := id.WithoutURL()
+	keyID := did.DIDURL{DID: id}
 	keyID.Fragment = "0"
-	verificationMethod, err := did.NewVerificationMethod(keyID, godid.JsonWebKey2020, id.WithoutURL(), publicRawKey)
+	verificationMethod, err := did.NewVerificationMethod(keyID, godid.JsonWebKey2020, id, publicRawKey)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to create verification method: %w", err)
 	}
@@ -93,7 +93,7 @@ func (w Resolver) Resolve(id did.DID, _ *resolver.ResolveMetadata) (*did.Documen
 	var document did.Document
 
 	// Set the document ID
-	document.ID = id.WithoutURL()
+	document.ID = id
 
 	// Add the verification method
 	document.AddAssertionMethod(verificationMethod)

vdr/didjwk/resolver_test.go

@@ -69,7 +69,7 @@ func TestResolver_Resolve(t *testing.T) {
 			// Generate a test function using the specified JWK JSON string
 			return func(t *testing.T) {
 				// Parse the DID
-				id := did.MustParseDIDURL("did:jwk:" + id)
+				id := did.MustParseDID("did:jwk:" + id)
 
 				// Resolve the DID, which returns a document/error
 				doc, md, err := resolver.Resolve(id, nil)

vdr/didkey/resolver.go

@@ -121,7 +121,7 @@ func (r Resolver) Resolve(id did.DID, _ *resolver.ResolveMetadata) (*did.Documen
 		},
 		ID: id,
 	}
-	keyID := id
+	keyID := did.DIDURL{DID: id}
 	keyID.Fragment = id.ID
 	vm, err := did.NewVerificationMethod(keyID, ssi.JsonWebKey2020, id, key)
 	if err != nil {

vdr/didnuts/ambassador_test.go

@@ -801,13 +801,11 @@ func newDidDocWithOptions(opts management.DIDCreationOptions) (did.Document, jwk
 	didDocument, key, err := docCreator.Create(audit.TestContext(), opts)
 	signingKey, _ := jwk.FromRaw(key.Public())
 	thumbStr, _ := crypto.Thumbprint(signingKey)
-	didStr := fmt.Sprintf("did:nuts:%s", thumbStr)
-	id, _ := did.ParseDID(didStr)
-	didDocument.ID = *id
+	didDocument.ID = did.MustParseDID(fmt.Sprintf("did:nuts:%s", thumbStr))
 	if err != nil {
 		return did.Document{}, nil, err
 	}
-	serviceID := didDocument.ID
+	serviceID := did.DIDURL{DID: didDocument.ID}
 	serviceID.Fragment = "1234"
 	didDocument.Service = []did.Service{
 		{

vdr/didnuts/creator.go

@@ -113,7 +113,7 @@ func getKIDName(pKey crypto.PublicKey, idFunc func(key jwk.Key) (string, error))
 	}
 
 	// assemble
-	kid := &did.DID{}
+	kid := &did.DIDURL{}
 	kid.Method = MethodName
 	kid.ID = idString
 	kid.Fragment = jwKey.KeyID()

vdr/didnuts/creator_test.go

@@ -62,7 +62,7 @@ func TestCreator_Create(t *testing.T) {
 			assert.NoError(t, err, "create should not return an error")
 			assert.NotNil(t, doc, "create should return a document")
 			assert.NotNil(t, key, "create should return a Key")
-			assert.Equal(t, did.MustParseDIDURL(kc.key.KID()).WithoutURL(), doc.ID, "the DID Doc should have the expected id")
+			assert.Equal(t, did.MustParseDIDURL(kc.key.KID()).DID, doc.ID, "the DID Doc should have the expected id")
 			assert.Len(t, doc.VerificationMethod, 1, "it should have one verificationMethod")
 			assert.Equal(t, kc.key.KID(), doc.VerificationMethod[0].ID.String(),
 				"verificationMethod should have the correct id")