go/ucan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

invocation: rephrase slightly the proof rules to be less confusing down the line

Browse Source
This commit is contained in:
Michael Muré
2024-12-09 18:35:49 +01:00
parent c518c6657a
commit 80c2d60ab3
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
token/invocation/proof.go
View File

@@ -40,7 +40,7 @@ import (
// c. The first proof must be issued to the Invoker (audience DID). // c. The first proof must be issued to the Invoker (audience DID).
// d. The Issuer of each delegation must be the Audience in the next one. // d. The Issuer of each delegation must be the Audience in the next one.
// e. The last token must be a root delegation. // e. The last token must be a root delegation.
// f. The Subject of each delegation must equal the invocation's Audience field. // f. The Subject of each delegation must equal the invocation's Subject (or Audience if defined)
// g. The command of each delegation must "allow" the one before it. // g. The command of each delegation must "allow" the one before it.
// //
// 5. If steps 1-4 pass: // 5. If steps 1-4 pass:
@@ -58,18 +58,18 @@ func (t *Token) verifyProofs(delegations []*delegation.Token) error {
cmd := t.command cmd := t.command
iss := t.issuer iss := t.issuer
aud := t.audience sub := t.subject
if !aud.Defined() { if t.audience.Defined() {
aud = t.subject sub = t.audience
} }
// control from the invocation to the root // control from the invocation to the root
for i, dlgCid := range t.proof { for i, dlgCid := range t.proof {
dlg := delegations[i] dlg := delegations[i]
// The Subject of each delegation must equal the invocation's Audience field. - 4f // The Subject of each delegation must equal the invocation's Subject (or Audience if defined). - 4f
if dlg.Subject() != aud { if dlg.Subject() != sub {
return fmt.Errorf("%w: delegation %s, expected %s, got %s", ErrWrongSub, dlgCid, aud, dlg.Subject()) return fmt.Errorf("%w: delegation %s, expected %s, got %s", ErrWrongSub, dlgCid, sub, dlg.Subject())
} }
// The first proof must be issued to the Invoker (audience DID). - 4c // The first proof must be issued to the Invoker (audience DID). - 4c