From 1dc0c402063dcb059a2f69ba357bf7092de04bc6 Mon Sep 17 00:00:00 2001 From: Edmund Edgar Date: Fri, 24 Jul 2026 23:28:15 +0000 Subject: [PATCH] fix: don't require a server-custodied rotation key Remove the requirement that the user's did can be controlled by the server rotation key and signing key. This was preventing users who didn't want to trust the PDS with their rotation keys from activating their accounts. Errors are removed but we issue debug messages. --- crates/tranquil-api/src/server/account_status.rs | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/crates/tranquil-api/src/server/account_status.rs b/crates/tranquil-api/src/server/account_status.rs index b147397..2c2e806 100644 --- a/crates/tranquil-api/src/server/account_status.rs +++ b/crates/tranquil-api/src/server/account_status.rs @@ -10,7 +10,7 @@ use serde_json::Value; use std::str::FromStr; use std::sync::Arc; use std::sync::atomic::{AtomicUsize, Ordering}; -use tracing::{error, info, warn}; +use tracing::{debug, error, info, warn}; use tranquil_pds::api::EmptyResponse; use tranquil_pds::api::error::{ApiError, DbResultExt}; use tranquil_pds::auth::{Auth, NotTakendown, Permissive, require_legacy_session_mfa}; @@ -212,9 +212,10 @@ async fn assert_valid_did_document_for_service( if let Some(ref expected_rotation_key) = server_rotation_key && !doc_rotation_keys.contains(&expected_rotation_key.as_str()) { - return Err(ApiError::InvalidRequest( - "Server rotation key not included in PLC DID data".into(), - )); + debug!( + "DID {} rotation keys {:?} omit the PDS-managed server rotation key {}", + did, doc_rotation_keys, expected_rotation_key + ); } let doc_signing_key = doc_data @@ -251,13 +252,10 @@ async fn assert_valid_did_document_for_service( } if !doc_rotation_keys.contains(&expected_did_key.as_str()) { - warn!( + debug!( "DID {} rotation keys {:?} omit the PDS-managed signing key {}", did, doc_rotation_keys, expected_did_key ); - return Err(ApiError::InvalidRequest( - "PLC rotation keys omit the PDS-managed signing key required to sign operations for this identity".into(), - )); } } } else if let Some(host_and_path) = did.as_str().strip_prefix("did:web:") {