atproto-bridge / pds / lib / verify-key.js

// resolvePlcVerifyKey — resolve a DID's atproto signing pubkey from its DID document (PLC). The doc's
// verificationMethod.publicKeyMultibase is the same multibase multikey as a did:key's suffix, so we decode
// it via `did:key:<multibase>`. `doFetch` is injectable (bare-fetch in prod, global fetch in node/tests).
//
// Kept bridge-side (not in the shared atproto-did-peer module) so that module needs no atproto-identity
// runtime dep. Moved here from the retired lib/peer-router.js (EXTRACTION-PLAN Phase 1b). Passed to
// DidPeerRouter as its `resolveVerifyKey` so a fronted DID with no add({verifyKey}) resolves via PLC.
import { decodeDidKey } from 'atproto-identity/lib/did-key.js'

export async function resolvePlcVerifyKey (did, { plcUrl = 'https://plc.directory', doFetch = fetch } = {}) {
  const res = await doFetch(`${plcUrl}/${did}`)
  if (!res.ok) throw new Error(`resolvePlcVerifyKey: PLC ${res.status} for ${did}`)
  const doc = await res.json()
  const vm = (doc.verificationMethod || []).find((m) => m.id && m.id.endsWith('#atproto')) || (doc.verificationMethod || [])[0]
  if (!vm || !vm.publicKeyMultibase) throw new Error(`resolvePlcVerifyKey: no verificationMethod for ${did}`)
  const { pubkey } = decodeDidKey(`did:key:${vm.publicKeyMultibase}`)
  return pubkey
}