Struct DidDocument

Source

pub struct DidDocument {
    pub context: Vec<String>,
    pub id: String,
    pub also_known_as: Vec<String>,
    pub verification_method: Vec<VerificationMethod>,
    pub authentication: Vec<String>,
    pub service: Vec<Service>,
    pub operator: Option<String>,
}

Expand description

A DID document, reduced to the fields this crate consumes.

Fields§

§context: Vec<String>

JSON-LD contexts. Serialized first, under the literal name @context.

§id: String

The DID this document describes. A resolver must check it against the DID it asked for; see crate::resolve.

§also_known_as: Vec<String>

Claimed handles, as at:// URIs. Ordered: the first syntactically valid entry is the claimed handle.

§verification_method: Vec<VerificationMethod>

Public keys. The atproto signing key is the entry whose id ends in #atproto.

§authentication: Vec<String>

DID Core’s authentication, read from other documents and never written into this deployment’s own.

§service: Vec<Service>

Service endpoints. The PDS is the entry whose id ends in #atproto_pds.

§operator: Option<String>

The DID of the human who answers for this account, from the document’s OPERATOR_PROPERTY. The same fact as the account’s bot.did.registration names, published here so one HTTP GET answers it.

Implementations§

Source §

impl DidDocument

Source

pub fn for_account( did: &AccountDid, public_key_multibase: &str, handle: &str, pds_endpoint: &str, ) -> Self

Builds the document for an agent account.

public_key_multibase is a &str on purpose: this crate has no opinion on how the key was generated, and taking a key type here would make every consumer of DID documents depend on the key crate.

Fragment ids are emitted fully qualified. The spec asks readers to accept both forms, and the qualified one survives being copied out of the document into some other context without losing its subject.

Source

pub fn for_service(did: &str, pds_endpoint: &str) -> Self

Builds the document for the server itself.

A service document, not an account one: no signing key and no handle, because the server holds neither on its own behalf. It exists so that the DID a vouch record names resolves to something that says where the server is, which is the whole of what a reader needs from it.

Source

pub fn handle(&self) -> Option<&str>

The first claimed handle, with the at:// prefix stripped.

“First valid entry” is the spec’s rule and now the implementation’s: alsoKnownAs is an ordered list a DID controller writes, it may hold entries in other URI schemes, and it is not this crate’s to trust. An entry that is not a syntactically valid handle is skipped rather than returned, so a document whose first entry is at://not a handle and whose second is real resolves to the real one instead of to garbage a caller would then try to look up.

Source

pub fn claims_handle(&self, handle: &str) -> bool

Whether this document claims handle as its own.

The other half of atproto’s bidirectional rule. A handle resolves to a DID, and that is only half an answer: the DID’s document has to claim the handle back, or what has been resolved is somebody asserting a name they do not hold. A resolver that stops after the first half will file records under whichever account was quickest to claim the name.

Only the first valid alsoKnownAs entry counts, which is handle and the specification’s own rule. Deliberately not “any entry mentions it”: alsoKnownAs is an ordered list its controller writes, so a document could list a real handle second and have this answer yes to a name no resolver would ever return for it.

Compared case-insensitively, because a handle is a hostname.

Source

fn owns_fragment(&self, id: &str, fragment: &str) -> bool

Whether id is this document’s own fragment entry.

A DID URL is a DID plus a fragment, and the DID half is what says whose entry it is. ends_with alone does not read it, so a document for did:web:victim.example could list did:web:attacker.example#atproto and have it answered as the victim’s signing key — a well-formed entry that does not belong to the subject, accepted because the only field that says so was never looked at. The relative form (#atproto, no DID at all) is the other spelling the spec asks readers to accept, and it can only mean the document’s own subject.

Source

pub fn with_operator(self, operator: impl Into<String>) -> Self

Names the human who answers for this account.

Source

pub fn operator(&self) -> Option<&str>

The human who answers for this account, if the document says.

Source

pub fn signing_key_multibase(&self) -> Option<&str>

The multibase signing key, taking the first #atproto entry of the correct type and ignoring any others, as the spec directs.

The entry must also be this document’s own: an id whose DID half is this document’s id, or absent entirely.

Source

pub fn pds_endpoint(&self) -> Option<&str>

The PDS endpoint, taking the first #atproto_pds entry of the correct type and ignoring any others.

The entry must also be this document’s own: an id whose DID half is this document’s id, or absent entirely.

Source

pub fn service_endpoint(&self, service: &str) -> Option<&str>

The endpoint of the service whose id is #service, of whatever type: the entry an atproto-proxy header names, as did:web:api.bsky.app#bsky_appview names bsky_appview.

The entry must be this document’s own, as for Self::pds_endpoint.