identity_kit/did/
document.rs

1//! The DID document data model (DID Core §5) and operations on it.
2
3use core::fmt;
4use core::mem;
5use core::str::FromStr;
6use std::borrow::Cow;
7use std::collections::{HashMap, HashSet};
8
9use indexmap::{IndexMap, IndexSet};
10use serde::de::{self, MapAccess, SeqAccess, Visitor};
11use serde::ser::SerializeMap as _;
12use serde::{Deserialize, Deserializer, Serialize, Serializer};
13use serde_json::Value;
14
15use super::{Did, DidUrl, DidUrlReference, Uri};
16use crate::jose::{Jwk, OneOrMany};
17
18/// Why a [`DidDocument`] operation was refused.
19#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
20#[non_exhaustive]
21pub enum DocumentError {
22    /// `@context` is not a string, a map or a non-empty array.
23    #[error("`@context` must be a string, a map or a non-empty array")]
24    InvalidContext,
25    /// A verification method with this id is already in the document, or the document defines
26    /// the id twice with different material.
27    #[error("verification method `{0}` already exists")]
28    DuplicateVerificationMethod(DidUrl),
29    /// A service with this id is already in the document.
30    #[error("service `{0}` already exists")]
31    DuplicateService(DidUrl),
32    /// No verification method with this id is in the document.
33    #[error("verification method `{0}` not found")]
34    VerificationMethodNotFound(DidUrl),
35    /// The DID URL belongs to another DID than the document.
36    #[error("`{url}` does not belong to document `{document}`")]
37    ForeignDid {
38        /// The DID URL that was looked up.
39        url: DidUrl,
40        /// The `id` of the document.
41        document: Did,
42    },
43    /// The verification method exists but is not listed under the relationship.
44    #[error("verification method `{id}` is not listed under `{relationship}`")]
45    NotInRelationship {
46        /// The id of the verification method.
47        id: DidUrl,
48        /// The relationship that was required.
49        relationship: VerificationRelationship,
50    },
51    /// Not the name of a verification relationship.
52    #[error("unknown verification relationship `{0}`")]
53    UnknownRelationship(String),
54    /// An extension property with the name of a core property.
55    #[error("`{0}` is a core property, not an extension property")]
56    ReservedProperty(String),
57}
58
59// ---------------------------------------------------------------------------------------------
60// Building blocks
61// ---------------------------------------------------------------------------------------------
62
63/// `skip_serializing_if` for optional lists: `None` and empty lists are omitted alike.
64#[expect(clippy::ref_option, reason = "serde passes the field by reference")]
65fn is_none_or_empty<T>(value: &Option<OneOrMany<T>>) -> bool {
66    value.as_ref().is_none_or(OneOrMany::is_empty)
67}
68
69/// The `@context` of a DID document, carried verbatim: a string, a map or a non-empty array of
70/// them.
71///
72/// This crate does no JSON-LD processing; the context is data that round-trips.
73///
74/// # Examples
75///
76/// ```
77/// use identity_kit::did::Context;
78///
79/// let context = Context::uris([Context::DID_V1, "https://w3id.org/security/suites/jws-2020/v1"]);
80/// assert!(context.contains(Context::DID_V1));
81/// assert_eq!(
82///     serde_json::to_string(&context)?,
83///     r#"["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"]"#
84/// );
85/// # Ok::<(), serde_json::Error>(())
86/// ```
87#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
88#[serde(transparent)]
89pub struct Context(Value);
90
91impl Context {
92    /// The DID Core 1.0 context URI.
93    pub const DID_V1: &'static str = "https://www.w3.org/ns/did/v1";
94
95    /// The context `"https://www.w3.org/ns/did/v1"`.
96    pub fn did_v1() -> Self {
97        Self::uri(Self::DID_V1)
98    }
99
100    /// A single context URI.
101    pub fn uri(uri: impl Into<String>) -> Self {
102        Self(Value::String(uri.into()))
103    }
104
105    /// An array of context URIs.
106    pub fn uris<I, S>(uris: I) -> Self
107    where
108        I: IntoIterator<Item = S>,
109        S: Into<String>,
110    {
111        Self(Value::Array(
112            uris.into_iter().map(|s| Value::String(s.into())).collect(),
113        ))
114    }
115
116    /// Any JSON value allowed as a context.
117    ///
118    /// # Errors
119    ///
120    /// [`DocumentError::InvalidContext`] unless `value` is a string, a map or a non-empty array.
121    pub fn new(value: Value) -> Result<Self, DocumentError> {
122        match &value {
123            Value::String(_) | Value::Object(_) => Ok(Self(value)),
124            Value::Array(items) if !items.is_empty() => Ok(Self(value)),
125            _ => Err(DocumentError::InvalidContext),
126        }
127    }
128
129    /// The context as JSON.
130    pub fn as_value(&self) -> &Value {
131        &self.0
132    }
133
134    /// The context as JSON.
135    pub fn into_value(self) -> Value {
136        self.0
137    }
138
139    /// Whether `uri` is the context or one of the strings in the context array.
140    pub fn contains(&self, uri: &str) -> bool {
141        match &self.0 {
142            Value::String(s) => s == uri,
143            Value::Array(items) => items.iter().any(|item| item.as_str() == Some(uri)),
144            _ => false,
145        }
146    }
147}
148
149impl<'de> Deserialize<'de> for Context {
150    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
151        Self::new(Value::deserialize(deserializer)?).map_err(de::Error::custom)
152    }
153}
154
155/// A verification relationship (DID Core §5.3): the purpose a verification method may be used
156/// for. The `Display` and `FromStr` forms are the DID document property names.
157#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
158#[serde(rename_all = "camelCase")]
159pub enum VerificationRelationship {
160    /// `authentication`
161    Authentication,
162    /// `assertionMethod`
163    AssertionMethod,
164    /// `keyAgreement`
165    KeyAgreement,
166    /// `capabilityInvocation`
167    CapabilityInvocation,
168    /// `capabilityDelegation`
169    CapabilityDelegation,
170}
171
172impl VerificationRelationship {
173    /// Every relationship, in the order DID Core lists them.
174    pub const ALL: &'static [VerificationRelationship] = &[
175        Self::Authentication,
176        Self::AssertionMethod,
177        Self::KeyAgreement,
178        Self::CapabilityInvocation,
179        Self::CapabilityDelegation,
180    ];
181
182    /// The DID document property name, for example `assertionMethod`.
183    pub const fn as_str(self) -> &'static str {
184        match self {
185            Self::Authentication => "authentication",
186            Self::AssertionMethod => "assertionMethod",
187            Self::KeyAgreement => "keyAgreement",
188            Self::CapabilityInvocation => "capabilityInvocation",
189            Self::CapabilityDelegation => "capabilityDelegation",
190        }
191    }
192}
193
194impl fmt::Display for VerificationRelationship {
195    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
196        f.write_str(self.as_str())
197    }
198}
199
200impl FromStr for VerificationRelationship {
201    type Err = DocumentError;
202
203    fn from_str(s: &str) -> Result<Self, Self::Err> {
204        Self::ALL
205            .iter()
206            .copied()
207            .find(|rel| rel.as_str() == s)
208            .ok_or_else(|| DocumentError::UnknownRelationship(s.to_owned()))
209    }
210}
211
212/// The `type` of a verification method: an open string with constants for the types this crate
213/// produces.
214///
215/// # Examples
216///
217/// ```
218/// use identity_kit::did::MethodType;
219///
220/// assert_eq!(MethodType::JSON_WEB_KEY_2020.as_str(), "JsonWebKey2020");
221/// assert_eq!(MethodType::new("JsonWebKey2020"), MethodType::JSON_WEB_KEY_2020);
222/// assert_eq!(serde_json::to_string(&MethodType::MULTIKEY)?, "\"Multikey\"");
223/// # Ok::<(), serde_json::Error>(())
224/// ```
225#[derive(Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
226pub struct MethodType(Cow<'static, str>);
227
228impl MethodType {
229    /// `JsonWebKey2020`: `publicKeyJwk` material (JSON Web Signature 2020 suite).
230    pub const JSON_WEB_KEY_2020: MethodType = MethodType(Cow::Borrowed("JsonWebKey2020"));
231    /// `JsonWebKey`: `publicKeyJwk` material (Controlled Identifiers 1.0).
232    pub const JSON_WEB_KEY: MethodType = MethodType(Cow::Borrowed("JsonWebKey"));
233    /// `Multikey`: `publicKeyMultibase` material (Controlled Identifiers 1.0).
234    pub const MULTIKEY: MethodType = MethodType(Cow::Borrowed("Multikey"));
235    /// `Ed25519VerificationKey2020`: `publicKeyMultibase` material (Ed25519 Signature 2020 suite).
236    pub const ED25519_VERIFICATION_KEY_2020: MethodType =
237        MethodType(Cow::Borrowed("Ed25519VerificationKey2020"));
238
239    /// Any type name.
240    pub fn new(name: impl Into<String>) -> Self {
241        Self(Cow::Owned(name.into()))
242    }
243
244    /// The type name.
245    pub fn as_str(&self) -> &str {
246        &self.0
247    }
248}
249
250impl fmt::Debug for MethodType {
251    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
252        fmt::Debug::fmt(self.as_str(), f)
253    }
254}
255
256impl fmt::Display for MethodType {
257    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
258        f.write_str(self.as_str())
259    }
260}
261
262impl From<&str> for MethodType {
263    fn from(name: &str) -> Self {
264        Self::new(name)
265    }
266}
267
268impl From<String> for MethodType {
269    fn from(name: String) -> Self {
270        Self::new(name)
271    }
272}
273
274impl PartialEq<str> for MethodType {
275    fn eq(&self, other: &str) -> bool {
276        self.as_str() == other
277    }
278}
279
280impl PartialEq<&str> for MethodType {
281    fn eq(&self, other: &&str) -> bool {
282        self.as_str() == *other
283    }
284}
285
286impl Serialize for MethodType {
287    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
288        serializer.serialize_str(self.as_str())
289    }
290}
291
292impl<'de> Deserialize<'de> for MethodType {
293    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
294        String::deserialize(deserializer).map(Self::new)
295    }
296}
297
298// ---------------------------------------------------------------------------------------------
299// Verification methods
300// ---------------------------------------------------------------------------------------------
301
302/// The verification material of a verification method (DID Core §5.2.1): exactly one of
303/// `publicKeyJwk` and `publicKeyMultibase`.
304///
305/// A `publicKeyJwk` must not carry private parameters; such a key is rejected when read and
306/// refused when written.
307#[derive(Debug, Clone, PartialEq, Eq)]
308#[non_exhaustive]
309pub enum VerificationMaterial {
310    /// `publicKeyJwk`: a public JSON Web Key.
311    PublicKeyJwk(Box<Jwk>),
312    /// `publicKeyMultibase`: a multibase-encoded public key.
313    PublicKeyMultibase(String),
314}
315
316impl VerificationMaterial {
317    /// `publicKeyJwk` with the public part of `jwk`.
318    pub fn jwk(jwk: &Jwk) -> Self {
319        Self::PublicKeyJwk(Box::new(jwk.public()))
320    }
321
322    /// `publicKeyMultibase`.
323    pub fn multibase(value: impl Into<String>) -> Self {
324        Self::PublicKeyMultibase(value.into())
325    }
326
327    /// The JWK, when the material is `publicKeyJwk`.
328    pub fn as_jwk(&self) -> Option<&Jwk> {
329        match self {
330            Self::PublicKeyJwk(jwk) => Some(jwk),
331            Self::PublicKeyMultibase(_) => None,
332        }
333    }
334
335    /// The multibase string, when the material is `publicKeyMultibase`.
336    pub fn as_multibase(&self) -> Option<&str> {
337        match self {
338            Self::PublicKeyMultibase(value) => Some(value),
339            Self::PublicKeyJwk(_) => None,
340        }
341    }
342}
343
344impl Serialize for VerificationMaterial {
345    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
346        let mut map = serializer.serialize_map(Some(1))?;
347        match self {
348            Self::PublicKeyJwk(jwk) => {
349                if jwk.is_private() {
350                    return Err(serde::ser::Error::custom(
351                        "`publicKeyJwk` must not contain private parameters",
352                    ));
353                }
354                map.serialize_entry("publicKeyJwk", jwk)?;
355            }
356            Self::PublicKeyMultibase(value) => map.serialize_entry("publicKeyMultibase", value)?,
357        }
358        map.end()
359    }
360}
361
362/// The two material members as optional fields, so they can be flattened out of a method.
363#[derive(Deserialize)]
364struct MaterialMembers {
365    #[serde(rename = "publicKeyJwk", default)]
366    public_key_jwk: Option<Jwk>,
367    #[serde(rename = "publicKeyMultibase", default)]
368    public_key_multibase: Option<String>,
369}
370
371impl<'de> Deserialize<'de> for VerificationMaterial {
372    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
373        let members = MaterialMembers::deserialize(deserializer)?;
374        match (members.public_key_jwk, members.public_key_multibase) {
375            (Some(jwk), None) if jwk.is_private() => Err(de::Error::custom(
376                "`publicKeyJwk` must not contain private parameters",
377            )),
378            (Some(jwk), None) => Ok(Self::PublicKeyJwk(Box::new(jwk))),
379            (None, Some(value)) => Ok(Self::PublicKeyMultibase(value)),
380            (None, None) => Err(de::Error::custom(
381                "verification method has neither `publicKeyJwk` nor `publicKeyMultibase`",
382            )),
383            (Some(_), Some(_)) => Err(de::Error::custom(
384                "verification method has both `publicKeyJwk` and `publicKeyMultibase`",
385            )),
386        }
387    }
388}
389
390/// A verification method (DID Core §5.2): a public key with an id, a type and a controller.
391///
392/// Members other than the four core ones live in `properties`, in insertion order.
393///
394/// # Examples
395///
396/// ```
397/// use identity_kit::did::{MethodType, VerificationMaterial, VerificationMethod};
398///
399/// let json = r#"{
400///   "id": "did:example:123#key-1",
401///   "type": "Multikey",
402///   "controller": "did:example:123",
403///   "publicKeyMultibase": "z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu"
404/// }"#;
405/// let method: VerificationMethod = serde_json::from_str(json)?;
406/// assert_eq!(method.method_type, MethodType::MULTIKEY);
407/// assert_eq!(method.controller.as_str(), "did:example:123");
408/// assert_eq!(
409///     method.material.as_multibase(),
410///     Some("z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu")
411/// );
412/// # Ok::<(), serde_json::Error>(())
413/// ```
414#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
415#[non_exhaustive]
416pub struct VerificationMethod {
417    /// The DID URL identifying the method, usually the document DID with a fragment.
418    pub id: DidUrl,
419    /// The `type`, which tells which cryptographic suite reads the material.
420    #[serde(rename = "type")]
421    pub method_type: MethodType,
422    /// The DID of the controller of the key.
423    pub controller: Did,
424    /// `publicKeyJwk` or `publicKeyMultibase`.
425    #[serde(flatten)]
426    pub material: VerificationMaterial,
427    /// Every other member, in insertion order.
428    #[serde(flatten)]
429    pub properties: IndexMap<String, Value>,
430}
431
432impl VerificationMethod {
433    /// A verification method with the four core members.
434    pub fn new(
435        id: DidUrl,
436        method_type: MethodType,
437        controller: Did,
438        material: VerificationMaterial,
439    ) -> Self {
440        Self {
441            id,
442            method_type,
443            controller,
444            material,
445            properties: IndexMap::new(),
446        }
447    }
448
449    /// The `publicKeyJwk`, if that is the material.
450    pub fn public_key_jwk(&self) -> Option<&Jwk> {
451        self.material.as_jwk()
452    }
453
454    /// The `publicKeyMultibase`, if that is the material.
455    pub fn public_key_multibase(&self) -> Option<&str> {
456        self.material.as_multibase()
457    }
458}
459
460/// An entry of a verification relationship: a reference to a method in `verificationMethod`,
461/// or a method embedded in the relationship and usable for that purpose only (DID Core §5.3).
462#[derive(Debug, Clone, PartialEq, Eq)]
463pub enum MethodRef {
464    /// A DID URL (possibly relative) of a method listed under `verificationMethod`.
465    Reference(DidUrlReference),
466    /// A method defined in place.
467    Embedded(Box<VerificationMethod>),
468}
469
470impl MethodRef {
471    /// A reference to `id`.
472    pub fn reference(id: impl Into<DidUrlReference>) -> Self {
473        Self::Reference(id.into())
474    }
475
476    /// An embedded method.
477    pub fn embedded(method: VerificationMethod) -> Self {
478        Self::Embedded(Box::new(method))
479    }
480
481    /// The embedded method, if this entry embeds one.
482    pub fn as_embedded(&self) -> Option<&VerificationMethod> {
483        match self {
484            Self::Embedded(method) => Some(method),
485            Self::Reference(_) => None,
486        }
487    }
488
489    /// The reference, if this entry is one.
490    pub fn as_reference(&self) -> Option<&DidUrlReference> {
491        match self {
492            Self::Reference(reference) => Some(reference),
493            Self::Embedded(_) => None,
494        }
495    }
496
497    /// Whether this entry denotes the method `id` in a document whose `id` is `base`.
498    pub fn refers_to(&self, id: &DidUrl, base: &Did) -> bool {
499        match self {
500            Self::Reference(reference) => reference.refers_to(id, base),
501            Self::Embedded(method) => method.id == *id,
502        }
503    }
504}
505
506impl From<DidUrl> for MethodRef {
507    fn from(id: DidUrl) -> Self {
508        Self::Reference(id.into())
509    }
510}
511
512impl From<DidUrlReference> for MethodRef {
513    fn from(reference: DidUrlReference) -> Self {
514        Self::Reference(reference)
515    }
516}
517
518impl From<VerificationMethod> for MethodRef {
519    fn from(method: VerificationMethod) -> Self {
520        Self::embedded(method)
521    }
522}
523
524impl Serialize for MethodRef {
525    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
526        match self {
527            Self::Reference(reference) => reference.serialize(serializer),
528            Self::Embedded(method) => method.serialize(serializer),
529        }
530    }
531}
532
533impl<'de> Deserialize<'de> for MethodRef {
534    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
535        struct MethodRefVisitor;
536
537        impl<'de> Visitor<'de> for MethodRefVisitor {
538            type Value = MethodRef;
539
540            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
541                f.write_str("a DID URL string or a verification method object")
542            }
543
544            fn visit_str<E: de::Error>(self, value: &str) -> Result<Self::Value, E> {
545                DidUrlReference::parse(value)
546                    .map(MethodRef::Reference)
547                    .map_err(E::custom)
548            }
549
550            fn visit_map<A: MapAccess<'de>>(self, map: A) -> Result<Self::Value, A::Error> {
551                VerificationMethod::deserialize(de::value::MapAccessDeserializer::new(map))
552                    .map(MethodRef::embedded)
553            }
554        }
555
556        deserializer.deserialize_any(MethodRefVisitor)
557    }
558}
559
560// ---------------------------------------------------------------------------------------------
561// Services
562// ---------------------------------------------------------------------------------------------
563
564/// The `serviceEndpoint` of a service (DID Core §5.4): a URI, a set of URIs, or a map.
565#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
566#[serde(untagged)]
567pub enum ServiceEndpoint {
568    /// A single URI.
569    Uri(Uri),
570    /// A non-empty set of URIs, in document order.
571    Set(IndexSet<Uri>),
572    /// A map, carried verbatim.
573    Map(IndexMap<String, Value>),
574}
575
576impl ServiceEndpoint {
577    /// A single URI.
578    pub fn uri(uri: Uri) -> Self {
579        Self::Uri(uri)
580    }
581
582    /// The URIs, when the endpoint is a URI or a set of them.
583    pub fn uris(&self) -> impl Iterator<Item = &Uri> {
584        let slice: Box<dyn Iterator<Item = &Uri>> = match self {
585            Self::Uri(uri) => Box::new(core::iter::once(uri)),
586            Self::Set(set) => Box::new(set.iter()),
587            Self::Map(_) => Box::new(core::iter::empty()),
588        };
589        slice
590    }
591}
592
593impl From<Uri> for ServiceEndpoint {
594    fn from(uri: Uri) -> Self {
595        Self::Uri(uri)
596    }
597}
598
599impl<'de> Deserialize<'de> for ServiceEndpoint {
600    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
601        struct EndpointVisitor;
602
603        impl<'de> Visitor<'de> for EndpointVisitor {
604            type Value = ServiceEndpoint;
605
606            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
607                f.write_str("a URI string, a non-empty array of URI strings, or an object")
608            }
609
610            fn visit_str<E: de::Error>(self, value: &str) -> Result<Self::Value, E> {
611                Uri::parse(value)
612                    .map(ServiceEndpoint::Uri)
613                    .map_err(E::custom)
614            }
615
616            fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> Result<Self::Value, A::Error> {
617                let mut set = IndexSet::new();
618                while let Some(uri) = seq.next_element::<Uri>()? {
619                    set.insert(uri);
620                }
621                if set.is_empty() {
622                    return Err(de::Error::custom(
623                        "`serviceEndpoint` set must contain at least one URI",
624                    ));
625                }
626                Ok(ServiceEndpoint::Set(set))
627            }
628
629            fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
630                let mut entries = IndexMap::new();
631                while let Some((key, value)) = map.next_entry::<String, Value>()? {
632                    entries.insert(key, value);
633                }
634                Ok(ServiceEndpoint::Map(entries))
635            }
636        }
637
638        deserializer.deserialize_any(EndpointVisitor)
639    }
640}
641
642/// A service (DID Core §5.4): a way of interacting with the DID subject.
643///
644/// `type` serializes as a string when single. Members other than the three core ones live in
645/// `properties`, in insertion order.
646#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
647#[non_exhaustive]
648pub struct Service {
649    /// The DID URL identifying the service, usually the document DID with a fragment.
650    pub id: DidUrl,
651    /// The service type or types.
652    #[serde(rename = "type")]
653    pub service_type: OneOrMany<String>,
654    /// Where the service is.
655    #[serde(rename = "serviceEndpoint")]
656    pub service_endpoint: ServiceEndpoint,
657    /// Every other member, in insertion order.
658    #[serde(flatten)]
659    pub properties: IndexMap<String, Value>,
660}
661
662impl Service {
663    /// A service with the three core members.
664    pub fn new(
665        id: DidUrl,
666        service_type: impl Into<OneOrMany<String>>,
667        service_endpoint: impl Into<ServiceEndpoint>,
668    ) -> Self {
669        Self {
670            id,
671            service_type: service_type.into(),
672            service_endpoint: service_endpoint.into(),
673            properties: IndexMap::new(),
674        }
675    }
676
677    /// Whether `service_type` is among the service's types.
678    pub fn has_type(&self, service_type: &str) -> bool {
679        self.service_type.iter().any(|t| t == service_type)
680    }
681}
682
683// ---------------------------------------------------------------------------------------------
684// The document
685// ---------------------------------------------------------------------------------------------
686
687/// A DID document (DID Core §5): the core properties as fields, everything else in `properties`.
688///
689/// The JSON representation is deterministic: `@context` comes first, then `id`, the core
690/// properties in the order DID Core lists them, and extension properties in insertion order.
691/// `None` and empty lists are omitted. A document parsed from JSON and written again holds the
692/// same members with the same values; the bytes are identical when the input already used that
693/// order. Extension properties must not use a core property name (see
694/// [`CORE_PROPERTIES`](Self::CORE_PROPERTIES)); the builder refuses one, and a document whose
695/// `properties` field holds one serializes a duplicate member.
696///
697/// The fields are public for reading and plain mutation; the methods keep the invariants that
698/// DID Core requires (unique method and service ids, references that point at listed methods).
699/// Deserialization enforces them too: a document that defines one verification method id twice
700/// with different content (listed or embedded) is rejected, so no lookup can pick different
701/// material for one id, and so is one with two services sharing an id, as DID Core §5.4 requires
702/// of a consumer. Embedding the same method under several relationships, as DID Core's own
703/// examples do, is one definition and allowed.
704///
705/// # Examples
706///
707/// ```
708/// use identity_kit::did::{DidDocument, VerificationRelationship};
709///
710/// // DID Core §4.1, Example 1 (with its editorial typo fixed).
711/// let json = r#"{
712///   "@context": ["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1"],
713///   "id": "did:example:123456789abcdefghi",
714///   "authentication": [{
715///     "id": "did:example:123456789abcdefghi#keys-1",
716///     "type": "Ed25519VerificationKey2020",
717///     "controller": "did:example:123456789abcdefghi",
718///     "publicKeyMultibase": "zH3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"
719///   }]
720/// }"#;
721/// let document: DidDocument = serde_json::from_str(json)?;
722/// assert_eq!(document.id.as_str(), "did:example:123456789abcdefghi");
723///
724/// let key = document.id.join("#keys-1")?;
725/// let method = document.resolve_verification_method(&key, Some(VerificationRelationship::Authentication))?;
726/// assert_eq!(method.public_key_multibase(), Some("zH3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"));
727///
728/// // The method is embedded under `authentication` and usable for nothing else.
729/// assert!(document.resolve_verification_method(&key, Some(VerificationRelationship::AssertionMethod)).is_err());
730/// # Ok::<(), Box<dyn std::error::Error>>(())
731/// ```
732#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
733#[non_exhaustive]
734#[serde(remote = "Self")]
735pub struct DidDocument {
736    /// `@context`, carried verbatim.
737    #[serde(rename = "@context", default, skip_serializing_if = "Option::is_none")]
738    pub context: Option<Context>,
739    /// The DID of the subject.
740    pub id: Did,
741    /// Other identifiers of the subject.
742    #[serde(rename = "alsoKnownAs", default, skip_serializing_if = "Vec::is_empty")]
743    pub also_known_as: Vec<Uri>,
744    /// The DIDs whose controllers may change this document; omitted when `None` or empty, and
745    /// `None` when read as an empty set.
746    #[serde(default, skip_serializing_if = "is_none_or_empty")]
747    pub controller: Option<OneOrMany<Did>>,
748    /// Verification methods that relationships may reference.
749    #[serde(
750        rename = "verificationMethod",
751        default,
752        skip_serializing_if = "Vec::is_empty"
753    )]
754    pub verification_method: Vec<VerificationMethod>,
755    /// `authentication`
756    #[serde(default, skip_serializing_if = "Vec::is_empty")]
757    pub authentication: Vec<MethodRef>,
758    /// `assertionMethod`
759    #[serde(
760        rename = "assertionMethod",
761        default,
762        skip_serializing_if = "Vec::is_empty"
763    )]
764    pub assertion_method: Vec<MethodRef>,
765    /// `keyAgreement`
766    #[serde(
767        rename = "keyAgreement",
768        default,
769        skip_serializing_if = "Vec::is_empty"
770    )]
771    pub key_agreement: Vec<MethodRef>,
772    /// `capabilityInvocation`
773    #[serde(
774        rename = "capabilityInvocation",
775        default,
776        skip_serializing_if = "Vec::is_empty"
777    )]
778    pub capability_invocation: Vec<MethodRef>,
779    /// `capabilityDelegation`
780    #[serde(
781        rename = "capabilityDelegation",
782        default,
783        skip_serializing_if = "Vec::is_empty"
784    )]
785    pub capability_delegation: Vec<MethodRef>,
786    /// Services.
787    #[serde(default, skip_serializing_if = "Vec::is_empty")]
788    pub service: Vec<Service>,
789    /// Every other property, in insertion order.
790    #[serde(flatten)]
791    pub properties: IndexMap<String, Value>,
792}
793
794impl Serialize for DidDocument {
795    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
796        Self::serialize(self, serializer)
797    }
798}
799
800impl<'de> Deserialize<'de> for DidDocument {
801    /// Reads the document and rejects duplicate verification method or service ids. An empty
802    /// `controller` set reads as no controller, which is how it is written.
803    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
804        let mut document = Self::deserialize(deserializer)?;
805        document.check_unique_ids().map_err(de::Error::custom)?;
806        if is_none_or_empty(&document.controller) {
807            document.controller = None;
808        }
809        Ok(document)
810    }
811}
812
813impl DidDocument {
814    /// The property names DID Core §5 defines, which `properties` must not contain.
815    pub const CORE_PROPERTIES: &'static [&'static str] = &[
816        "@context",
817        "id",
818        "alsoKnownAs",
819        "controller",
820        "verificationMethod",
821        "authentication",
822        "assertionMethod",
823        "keyAgreement",
824        "capabilityInvocation",
825        "capabilityDelegation",
826        "service",
827    ];
828
829    /// An empty document for `id`.
830    pub fn new(id: Did) -> Self {
831        Self {
832            context: None,
833            id,
834            also_known_as: Vec::new(),
835            controller: None,
836            verification_method: Vec::new(),
837            authentication: Vec::new(),
838            assertion_method: Vec::new(),
839            key_agreement: Vec::new(),
840            capability_invocation: Vec::new(),
841            capability_delegation: Vec::new(),
842            service: Vec::new(),
843            properties: IndexMap::new(),
844        }
845    }
846
847    /// A builder for a document for `id`.
848    pub fn builder(id: Did) -> DidDocumentBuilder {
849        DidDocumentBuilder {
850            document: Self::new(id),
851            error: None,
852        }
853    }
854
855    /// The entries of `relationship`.
856    pub fn relationship(&self, relationship: VerificationRelationship) -> &[MethodRef] {
857        match relationship {
858            VerificationRelationship::Authentication => &self.authentication,
859            VerificationRelationship::AssertionMethod => &self.assertion_method,
860            VerificationRelationship::KeyAgreement => &self.key_agreement,
861            VerificationRelationship::CapabilityInvocation => &self.capability_invocation,
862            VerificationRelationship::CapabilityDelegation => &self.capability_delegation,
863        }
864    }
865
866    /// The entries of `relationship`, mutably.
867    pub fn relationship_mut(
868        &mut self,
869        relationship: VerificationRelationship,
870    ) -> &mut Vec<MethodRef> {
871        match relationship {
872            VerificationRelationship::Authentication => &mut self.authentication,
873            VerificationRelationship::AssertionMethod => &mut self.assertion_method,
874            VerificationRelationship::KeyAgreement => &mut self.key_agreement,
875            VerificationRelationship::CapabilityInvocation => &mut self.capability_invocation,
876            VerificationRelationship::CapabilityDelegation => &mut self.capability_delegation,
877        }
878    }
879
880    /// The methods embedded in any relationship.
881    fn embedded_methods(&self) -> impl Iterator<Item = &VerificationMethod> {
882        VerificationRelationship::ALL
883            .iter()
884            .flat_map(|rel| self.relationship(*rel))
885            .filter_map(MethodRef::as_embedded)
886    }
887
888    /// The verification method with `id`, listed under `verificationMethod` or embedded in a
889    /// relationship.
890    pub fn verification_method(&self, id: &DidUrl) -> Option<&VerificationMethod> {
891        self.verification_method
892            .iter()
893            .chain(self.embedded_methods())
894            .find(|method| method.id == *id)
895    }
896
897    /// The verification methods usable for `relationship`, or every method in the document
898    /// when `relationship` is `None`.
899    ///
900    /// References are followed; a reference to a method that is not listed under
901    /// `verificationMethod` yields nothing.
902    pub fn methods(
903        &self,
904        relationship: Option<VerificationRelationship>,
905    ) -> impl Iterator<Item = &VerificationMethod> {
906        let entries: Box<dyn Iterator<Item = &VerificationMethod>> =
907            match relationship {
908                None => Box::new(
909                    self.verification_method
910                        .iter()
911                        .chain(self.embedded_methods()),
912                ),
913                Some(rel) => Box::new(self.relationship(rel).iter().filter_map(
914                    |entry| match entry {
915                        MethodRef::Embedded(method) => Some(&**method),
916                        MethodRef::Reference(reference) => {
917                            let id = reference.resolve(&self.id).ok()?;
918                            self.verification_method.iter().find(|m| m.id == id)
919                        }
920                    },
921                )),
922            };
923        entries
924    }
925
926    /// The verification method `id`, optionally restricted to those usable for `relationship`.
927    ///
928    /// `id` must belong to this document's DID. The method may be listed under
929    /// `verificationMethod` or embedded in a relationship; with a `relationship`, it must be
930    /// referenced (absolutely or relatively) or embedded under that relationship.
931    ///
932    /// # Errors
933    ///
934    /// - [`DocumentError::ForeignDid`] when `id` is a DID URL of another DID.
935    /// - [`DocumentError::VerificationMethodNotFound`] when no method has that id.
936    /// - [`DocumentError::NotInRelationship`] when it exists but not under `relationship`.
937    pub fn resolve_verification_method(
938        &self,
939        id: &DidUrl,
940        relationship: Option<VerificationRelationship>,
941    ) -> Result<&VerificationMethod, DocumentError> {
942        if id.did() != &self.id {
943            return Err(DocumentError::ForeignDid {
944                url: id.clone(),
945                document: self.id.clone(),
946            });
947        }
948        let Some(relationship) = relationship else {
949            return self
950                .verification_method(id)
951                .ok_or_else(|| DocumentError::VerificationMethodNotFound(id.clone()));
952        };
953        for entry in self.relationship(relationship) {
954            match entry {
955                MethodRef::Embedded(method) if method.id == *id => return Ok(method),
956                MethodRef::Reference(reference) if reference.refers_to(id, &self.id) => {
957                    return self
958                        .verification_method
959                        .iter()
960                        .find(|method| method.id == *id)
961                        .ok_or_else(|| DocumentError::VerificationMethodNotFound(id.clone()));
962                }
963                _ => {}
964            }
965        }
966        if self.verification_method(id).is_some() {
967            Err(DocumentError::NotInRelationship {
968                id: id.clone(),
969                relationship,
970            })
971        } else {
972            Err(DocumentError::VerificationMethodNotFound(id.clone()))
973        }
974    }
975
976    /// [`resolve_verification_method`](Self::resolve_verification_method) for a reference that
977    /// may be relative (`#key-1`), resolved against this document's `id`.
978    ///
979    /// # Errors
980    ///
981    /// As [`resolve_verification_method`](Self::resolve_verification_method).
982    pub fn resolve_method_reference(
983        &self,
984        reference: &DidUrlReference,
985        relationship: Option<VerificationRelationship>,
986    ) -> Result<&VerificationMethod, DocumentError> {
987        // A relative reference this type accepted always joins to a DID.
988        let id = reference.resolve(&self.id).map_err(|_| match reference {
989            DidUrlReference::Absolute(url) => DocumentError::ForeignDid {
990                url: url.clone(),
991                document: self.id.clone(),
992            },
993            DidUrlReference::Relative(_) => {
994                DocumentError::VerificationMethodNotFound(self.id.to_url())
995            }
996        })?;
997        self.resolve_verification_method(&id, relationship)
998    }
999
1000    /// Adds `method` under `verificationMethod` and references it from each of `relationships`.
1001    ///
1002    /// # Errors
1003    ///
1004    /// [`DocumentError::DuplicateVerificationMethod`] when a method with that id exists, listed
1005    /// or embedded; the document is unchanged.
1006    pub fn insert_verification_method(
1007        &mut self,
1008        method: VerificationMethod,
1009        relationships: impl IntoIterator<Item = VerificationRelationship>,
1010    ) -> Result<(), DocumentError> {
1011        if self.verification_method(&method.id).is_some() {
1012            return Err(DocumentError::DuplicateVerificationMethod(method.id));
1013        }
1014        let id = method.id.clone();
1015        self.verification_method.push(method);
1016        for relationship in relationships {
1017            self.attach_relationship(&id, relationship)?;
1018        }
1019        Ok(())
1020    }
1021
1022    /// Checks that every verification method id (listed or embedded) has one definition and that
1023    /// no two services share an id: the invariant the mutating methods keep and deserialization
1024    /// enforces. The same method embedded under several relationships is one definition.
1025    ///
1026    /// # Errors
1027    ///
1028    /// [`DocumentError::DuplicateVerificationMethod`] naming the first id defined twice with
1029    /// different content, or [`DocumentError::DuplicateService`] naming the first repeated
1030    /// service id.
1031    pub fn check_unique_ids(&self) -> Result<(), DocumentError> {
1032        let mut seen = HashMap::new();
1033        for method in self
1034            .verification_method
1035            .iter()
1036            .chain(self.embedded_methods())
1037        {
1038            if *seen.entry(&method.id).or_insert(method) != method {
1039                return Err(DocumentError::DuplicateVerificationMethod(
1040                    method.id.clone(),
1041                ));
1042            }
1043        }
1044        let mut seen = HashSet::new();
1045        for service in &self.service {
1046            if !seen.insert(&service.id) {
1047                return Err(DocumentError::DuplicateService(service.id.clone()));
1048            }
1049        }
1050        Ok(())
1051    }
1052
1053    /// Removes the method `id`, listed or embedded, and every relationship entry for it.
1054    pub fn remove_verification_method(&mut self, id: &DidUrl) -> Option<VerificationMethod> {
1055        // Every listed entry with the id goes, should plain mutation have duplicated it.
1056        let (matching, rest): (Vec<_>, Vec<_>) = mem::take(&mut self.verification_method)
1057            .into_iter()
1058            .partition(|method| method.id == *id);
1059        self.verification_method = rest;
1060        let listed = matching.into_iter().next();
1061        let mut embedded = None;
1062        let base = self.id.clone();
1063        for relationship in VerificationRelationship::ALL {
1064            let entries = self.relationship_mut(*relationship);
1065            let mut index = 0;
1066            while index < entries.len() {
1067                if entries[index].refers_to(id, &base) {
1068                    if let MethodRef::Embedded(method) = entries.remove(index) {
1069                        embedded.get_or_insert(*method);
1070                    }
1071                } else {
1072                    index += 1;
1073                }
1074            }
1075        }
1076        listed.or(embedded)
1077    }
1078
1079    /// References the listed method `id` from `relationship`.
1080    ///
1081    /// Returns whether an entry was added: `Ok(false)` when the relationship already references
1082    /// or embeds the method.
1083    ///
1084    /// # Errors
1085    ///
1086    /// [`DocumentError::VerificationMethodNotFound`] when `id` is not listed under
1087    /// `verificationMethod` (a reference to an embedded method would dangle).
1088    pub fn attach_relationship(
1089        &mut self,
1090        id: &DidUrl,
1091        relationship: VerificationRelationship,
1092    ) -> Result<bool, DocumentError> {
1093        if !self.verification_method.iter().any(|m| m.id == *id) {
1094            return Err(DocumentError::VerificationMethodNotFound(id.clone()));
1095        }
1096        let base = self.id.clone();
1097        let entries = self.relationship_mut(relationship);
1098        if entries.iter().any(|entry| entry.refers_to(id, &base)) {
1099            return Ok(false);
1100        }
1101        entries.push(MethodRef::Reference(id.clone().into()));
1102        Ok(true)
1103    }
1104
1105    /// Removes every entry for the method `id` from `relationship`, returning whether there
1106    /// was one.
1107    pub fn detach_relationship(
1108        &mut self,
1109        id: &DidUrl,
1110        relationship: VerificationRelationship,
1111    ) -> bool {
1112        let base = self.id.clone();
1113        let entries = self.relationship_mut(relationship);
1114        let before = entries.len();
1115        entries.retain(|entry| !entry.refers_to(id, &base));
1116        entries.len() != before
1117    }
1118
1119    /// The service `id`.
1120    pub fn service(&self, id: &DidUrl) -> Option<&Service> {
1121        self.service.iter().find(|service| service.id == *id)
1122    }
1123
1124    /// Adds `service`.
1125    ///
1126    /// # Errors
1127    ///
1128    /// [`DocumentError::DuplicateService`] when a service with that id exists.
1129    pub fn insert_service(&mut self, service: Service) -> Result<(), DocumentError> {
1130        if self.service(&service.id).is_some() {
1131            return Err(DocumentError::DuplicateService(service.id));
1132        }
1133        self.service.push(service);
1134        Ok(())
1135    }
1136
1137    /// Removes the service `id`.
1138    pub fn remove_service(&mut self, id: &DidUrl) -> Option<Service> {
1139        self.service
1140            .iter()
1141            .position(|service| service.id == *id)
1142            .map(|index| self.service.remove(index))
1143    }
1144
1145    /// Rewrites every DID in the document through `f`: the `id`, the controllers, the ids and
1146    /// controllers of verification methods (listed and embedded), absolute relationship
1147    /// references and service ids. Relative references, `alsoKnownAs` and extension properties
1148    /// are left as they are.
1149    ///
1150    /// This is how a method whose DID depends on the document (a `did:web` moving domains, a
1151    /// placeholder DID replaced by the registered one) produces its final document.
1152    ///
1153    /// `f` is expected to map distinct DIDs to distinct DIDs. Merging two DIDs into one can give
1154    /// two methods or services the same id; that is not checked here, and
1155    /// [`check_unique_ids`](Self::check_unique_ids) reports it.
1156    ///
1157    /// # Examples
1158    ///
1159    /// ```
1160    /// use identity_kit::did::{Did, DidDocument, MethodType, VerificationMaterial, VerificationMethod, VerificationRelationship};
1161    ///
1162    /// let placeholder = Did::parse("did:example:placeholder")?;
1163    /// let mut document = DidDocument::new(placeholder.clone());
1164    /// document.insert_verification_method(
1165    ///     VerificationMethod::new(
1166    ///         placeholder.join("#key-1")?,
1167    ///         MethodType::MULTIKEY,
1168    ///         placeholder.clone(),
1169    ///         VerificationMaterial::multibase("z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu"),
1170    ///     ),
1171    ///     [VerificationRelationship::Authentication],
1172    /// )?;
1173    ///
1174    /// let registered = Did::parse("did:web:example.com")?;
1175    /// document.map_dids(|did| if did == placeholder { registered.clone() } else { did });
1176    ///
1177    /// assert_eq!(document.id, registered);
1178    /// assert_eq!(document.verification_method[0].id.as_str(), "did:web:example.com#key-1");
1179    /// assert_eq!(document.verification_method[0].controller, registered);
1180    /// let key = registered.join("#key-1")?;
1181    /// assert!(document.resolve_verification_method(&key, Some(VerificationRelationship::Authentication)).is_ok());
1182    /// # Ok::<(), Box<dyn std::error::Error>>(())
1183    /// ```
1184    pub fn map_dids(&mut self, mut f: impl FnMut(Did) -> Did) {
1185        fn map_url(url: &mut DidUrl, f: &mut impl FnMut(Did) -> Did) {
1186            let did = f(url.did().clone());
1187            if &did != url.did() {
1188                *url = url.with_did(did);
1189            }
1190        }
1191        fn map_method(method: &mut VerificationMethod, f: &mut impl FnMut(Did) -> Did) {
1192            map_url(&mut method.id, f);
1193            method.controller = f(method.controller.clone());
1194        }
1195
1196        self.id = f(self.id.clone());
1197        if let Some(controller) = &mut self.controller {
1198            for did in controller.iter_mut() {
1199                *did = f(did.clone());
1200            }
1201        }
1202        for method in &mut self.verification_method {
1203            map_method(method, &mut f);
1204        }
1205        for relationship in VerificationRelationship::ALL {
1206            for entry in self.relationship_mut(*relationship) {
1207                match entry {
1208                    MethodRef::Reference(DidUrlReference::Absolute(url)) => map_url(url, &mut f),
1209                    MethodRef::Reference(DidUrlReference::Relative(_)) => {}
1210                    MethodRef::Embedded(method) => map_method(method, &mut f),
1211                }
1212            }
1213        }
1214        for service in &mut self.service {
1215            map_url(&mut service.id, &mut f);
1216        }
1217    }
1218}
1219
1220/// Builds a [`DidDocument`], reporting the first invariant violation at [`build`](Self::build).
1221#[derive(Debug, Clone)]
1222pub struct DidDocumentBuilder {
1223    document: DidDocument,
1224    error: Option<DocumentError>,
1225}
1226
1227impl DidDocumentBuilder {
1228    /// Sets `@context`.
1229    #[must_use]
1230    pub fn context(mut self, context: Context) -> Self {
1231        self.document.context = Some(context);
1232        self
1233    }
1234
1235    /// Adds an `alsoKnownAs` URI.
1236    #[must_use]
1237    pub fn also_known_as(mut self, uri: Uri) -> Self {
1238        self.document.also_known_as.push(uri);
1239        self
1240    }
1241
1242    /// Adds a controller; one controller serializes as a string, more as an array.
1243    #[must_use]
1244    pub fn controller(mut self, did: Did) -> Self {
1245        self.document.controller = Some(match self.document.controller.take() {
1246            None => OneOrMany::One(did),
1247            Some(existing) => {
1248                let mut dids = existing.into_vec();
1249                dids.push(did);
1250                OneOrMany::Many(dids)
1251            }
1252        });
1253        self
1254    }
1255
1256    /// Adds a verification method under `verificationMethod`, referenced from `relationships`.
1257    #[must_use]
1258    pub fn verification_method(
1259        mut self,
1260        method: VerificationMethod,
1261        relationships: impl IntoIterator<Item = VerificationRelationship>,
1262    ) -> Self {
1263        if self.error.is_none() {
1264            self.error = self
1265                .document
1266                .insert_verification_method(method, relationships)
1267                .err();
1268        }
1269        self
1270    }
1271
1272    /// Embeds a verification method in `relationship`, usable for that purpose only.
1273    #[must_use]
1274    pub fn embedded_method(
1275        mut self,
1276        relationship: VerificationRelationship,
1277        method: VerificationMethod,
1278    ) -> Self {
1279        if self.error.is_none() {
1280            if self.document.verification_method(&method.id).is_some() {
1281                self.error = Some(DocumentError::DuplicateVerificationMethod(method.id));
1282            } else {
1283                self.document
1284                    .relationship_mut(relationship)
1285                    .push(MethodRef::embedded(method));
1286            }
1287        }
1288        self
1289    }
1290
1291    /// Adds a service.
1292    #[must_use]
1293    pub fn service(mut self, service: Service) -> Self {
1294        if self.error.is_none() {
1295            self.error = self.document.insert_service(service).err();
1296        }
1297        self
1298    }
1299
1300    /// Adds an extension property; a core property name is refused at
1301    /// [`build`](Self::build) with [`DocumentError::ReservedProperty`].
1302    #[must_use]
1303    pub fn property(mut self, name: impl Into<String>, value: impl Into<Value>) -> Self {
1304        let name = name.into();
1305        if DidDocument::CORE_PROPERTIES.contains(&name.as_str()) {
1306            if self.error.is_none() {
1307                self.error = Some(DocumentError::ReservedProperty(name));
1308            }
1309        } else {
1310            self.document.properties.insert(name, value.into());
1311        }
1312        self
1313    }
1314
1315    /// The document.
1316    ///
1317    /// # Errors
1318    ///
1319    /// The first [`DocumentError`] an addition raised: a duplicate method or service id.
1320    pub fn build(self) -> Result<DidDocument, DocumentError> {
1321        match self.error {
1322            Some(error) => Err(error),
1323            None => Ok(self.document),
1324        }
1325    }
1326}
identity_kit/did/document.rs

identity_kit/did/
document.rs
