at-container-registry/pkg/atproto/did/plc.go

package did

import (
	"context"
	"fmt"
	"log/slog"
	"slices"

	"github.com/bluesky-social/indigo/atproto/atcrypto"
	didplc "github.com/did-method-plc/go-didplc/didplc"
)

// CreateIdentity builds a genesis PLC operation with the configured verification key and
// services, signs it with the rotation key, and submits it to the PLC directory.
func CreateIdentity(ctx context.Context, rotationKey atcrypto.PrivateKey, signingKey *atcrypto.PrivateKeyK256, cfg Config) (string, error) {
	rotPub, err := rotationKey.PublicKey()
	if err != nil {
		return "", fmt.Errorf("did: failed to get rotation public key: %w", err)
	}
	sigPub, err := signingKey.PublicKey()
	if err != nil {
		return "", fmt.Errorf("did: failed to get signing public key: %w", err)
	}

	host, err := hostWithPort(cfg.PublicURL)
	if err != nil {
		return "", err
	}

	op := &didplc.RegularOp{
		Type:         "plc_operation",
		RotationKeys: []string{rotPub.DIDKey()},
		VerificationMethods: map[string]string{
			cfg.VerificationKeyName: sigPub.DIDKey(),
		},
		AlsoKnownAs: []string{"at://" + host},
		Services:    toOpServices(cfg.Services),
		Prev:        nil,
	}
	if err := op.Sign(rotationKey); err != nil {
		return "", fmt.Errorf("did: failed to sign genesis operation: %w", err)
	}

	d, err := op.DID()
	if err != nil {
		return "", fmt.Errorf("did: failed to compute DID from genesis: %w", err)
	}

	client := &didplc.Client{DirectoryURL: cfg.PLCDirectoryURL}
	if err := client.Submit(ctx, d, op); err != nil {
		return "", fmt.Errorf("did: failed to submit genesis operation: %w", err)
	}
	return d, nil
}

// EnsureCurrent reconciles the published DID document with the local config; if the local
// signing key, public URL, or service set differs, an update operation is signed and submitted.
// Without a rotation key, mismatches log a warning but are not fatal.
func EnsureCurrent(ctx context.Context, did string, rotationKey atcrypto.PrivateKey, signingKey *atcrypto.PrivateKeyK256, cfg Config) error {
	client := &didplc.Client{DirectoryURL: cfg.PLCDirectoryURL}

	opLog, err := client.OpLog(ctx, did)
	if err != nil {
		return fmt.Errorf("did: failed to fetch op log for %s: %w", did, err)
	}
	if len(opLog) == 0 {
		return fmt.Errorf("did: empty op log for %s", did)
	}
	lastEntry := opLog[len(opLog)-1]
	lastOp := lastEntry.Regular
	if lastOp == nil {
		slog.Warn("Last PLC operation is not a regular op, skipping auto-update", "did", did)
		return nil
	}

	sigPub, err := signingKey.PublicKey()
	if err != nil {
		return fmt.Errorf("did: failed to get signing public key: %w", err)
	}
	localKey := sigPub.DIDKey()
	plcKey := lastOp.VerificationMethods[cfg.VerificationKeyName]
	keyMatch := localKey == plcKey

	servicesMatch := true
	for name, svc := range cfg.Services {
		plcSvc, ok := lastOp.Services[name]
		if !ok || plcSvc.Type != svc.Type || plcSvc.Endpoint != svc.Endpoint {
			servicesMatch = false
			break
		}
	}

	if keyMatch && servicesMatch {
		slog.Info("PLC identity is current", "did", did)
		return nil
	}

	slog.Info("PLC identity needs update",
		"did", did, "signing_key_changed", !keyMatch, "services_changed", !servicesMatch)

	if rotationKey == nil {
		slog.Warn("PLC document doesn't match local state but no rotation key available. Provide rotation key to auto-update.",
			"did", did, "signing_key_changed", !keyMatch, "services_changed", !servicesMatch)
		return nil
	}

	rotPub, err := rotationKey.PublicKey()
	if err != nil {
		return fmt.Errorf("did: failed to get rotation public key: %w", err)
	}
	localRotKey := rotPub.DIDKey()

	// Verify the local rotation key still has authority on the PLC document.
	// If it's been rotated out (possibly maliciously), refuse to submit — PLC would
	// reject anyway, and silent failure here would be confusing.
	localRotKeyPresent := slices.Contains(lastOp.RotationKeys, localRotKey)
	if !localRotKeyPresent {
		slog.Warn("Local rotation key not present in PLC document — refusing to update. Possible compromise or out-of-band rotation. Recover with offline key if available.",
			"did", did, "local_rotation_key", localRotKey, "plc_rotation_keys", lastOp.RotationKeys)
		return nil
	}

	host, err := hostWithPort(cfg.PublicURL)
	if err != nil {
		return err
	}
	prevCID := lastEntry.AsOperation().CID().String()

	op := &didplc.RegularOp{
		Type:         "plc_operation",
		RotationKeys: lastOp.RotationKeys,
		VerificationMethods: map[string]string{
			cfg.VerificationKeyName: localKey,
		},
		AlsoKnownAs: []string{"at://" + host},
		Services:    toOpServices(cfg.Services),
		Prev:        &prevCID,
	}
	if err := op.Sign(rotationKey); err != nil {
		return fmt.Errorf("did: failed to sign update operation: %w", err)
	}
	if err := client.Submit(ctx, did, op); err != nil {
		return fmt.Errorf("did: failed to submit update: %w", err)
	}
	slog.Info("Updated PLC identity",
		"did", did, "signing_key_rotated", !keyMatch, "services_changed", !servicesMatch)
	return nil
}

func toOpServices(in map[string]Service) map[string]didplc.OpService {
	out := make(map[string]didplc.OpService, len(in))
	for name, svc := range in {
		out[name] = didplc.OpService{Type: svc.Type, Endpoint: svc.Endpoint}
	}
	return out
}

func parseOptionalMultibaseKey(encoded string) (atcrypto.PrivateKeyExportable, error) {
	if encoded == "" {
		return nil, nil
	}
	key, err := atcrypto.ParsePrivateMultibase(encoded)
	if err != nil {
		return nil, fmt.Errorf("did: failed to parse multibase key: %w", err)
	}
	return key, nil
}