Expand description
did:web minting, DID documents, and a resolver that works locally.
Every agent context gets its own account, and every account needs a DID.
did:plc would mean a registration round trip to a third-party directory
for each one, so these are did:web: the DID is a hostname the deployment
already controls, and minting is a string operation plus a document served
at /.well-known/did.json.
That choice has a consequence worth stating plainly. did:web “is
inherently tied to the domain name used, and does not provide a mechanism
for migration or recovering from loss of control of the domain name”. An
agent identity lives and dies with the zone it was minted under.
atproto constrains did:web more tightly than the W3C draft does, and the
constraints are the interesting part of this crate:
- “only hostname-level
did:webDIDs are supported: path-based DIDs are not supported” — so each agent is a subdomain, not a path. - “The special
localhosthostname is allowed, but only in testing and development environments.” - “Port numbers (with separating colon hex-encoded) are only allowed for
localhost, and only in testing and development.” - A hard limit of 2048 characters on the identifier.
The percent-encoded port is where existing tooling falls down, which is
why resolve exists here rather than being borrowed; see that module.
Handles get the same treatment from the other end. atproto’s rule is that
resolution is bidirectional: a handle resolves to a DID, and that DID’s
document must claim the handle back in alsoKnownAs. Half of it is not a
weaker version of the whole — a handle that resolves to a DID which does
not claim it is somebody asserting a name they do not hold.
handle::atproto_did_url and handle::parse_atproto_did are the
forward half and DidDocument::claims_handle is the reverse, and no
transport for either lives here: this crate owns the rules, and the
services that already hold an HTTP client own the fetch. The DNS TXT
resolution method is not implemented.
Re-exports§
pub use did::canonical_did;pub use did::hostname_is_at_or_below;pub use did::validate_did;pub use did::validate_label;pub use did::AccountDid;pub use did::DidError;pub use did::SyntaxError;pub use did::Zone;pub use did::ZoneRegistry;pub use did::ZoneRegistryError;pub use did::MAX_DID_LENGTH;pub use document::Claim;pub use document::DidDocument;pub use document::OidcIdentity;pub use document::Service;pub use document::VerificationMethod;pub use handle::atproto_did_url;pub use handle::has_disallowed_tld;pub use handle::parse_atproto_did;pub use handle::validate as validate_handle;pub use handle::HandleError;pub use handle::ATPROTO_DID_PATH;pub use resolve::document_url;pub use resolve::resolve;pub use resolve::DidDocumentSource;pub use resolve::InMemoryDocuments;pub use resolve::ResolveError;pub use resolve::DEFAULT_PLC_DIRECTORY;