atproto-identity / test / golden-did-plc.test.js

// Golden-vector test: prove our did:plc computation is byte-exact against a DID
// that millipds actually minted and that lives on the real PLC directory.
//
//   did:plc:bh2hiuoeb34g4lif62zj2vx7   (handle bridgetest.7rnx.net)
//
// If dag-cbor canonicalization, sha256, base32, or truncation are off by a byte,
// this fails. Reference IS the spec (verification-first).

import test from 'brittle'
import { readFileSync } from 'node:fs'
import { fileURLToPath } from 'node:url'
import { dirname, join } from 'node:path'
import { didForCreateOp } from '../lib/did-plc.js'

const here = dirname(fileURLToPath(import.meta.url))
const golden = JSON.parse(readFileSync(join(here, 'vectors', 'bridgetest-genesis.json'), 'utf8'))

const EXPECTED = 'did:plc:bh2hiuoeb34g4lif62zj2vx7'

test('did:plc is byte-exact against millipds golden genesis op', (t) => {
  const did = didForCreateOp(golden)
  t.is(did, EXPECTED, 'did:plc from millipds golden genesis op')

  // The DID is a pure function of the op — recomputation is stable.
  t.is(didForCreateOp(golden), did, 'recomputation is deterministic')

  // Reordering the JSON keys must NOT change the DID (DAG-CBOR canonicalizes).
  const reordered = {
    sig: golden.sig,
    prev: golden.prev,
    services: golden.services,
    alsoKnownAs: golden.alsoKnownAs,
    verificationMethods: golden.verificationMethods,
    rotationKeys: golden.rotationKeys,
    type: golden.type
  }
  t.is(didForCreateOp(reordered), EXPECTED, 'DID invariant under key reordering')
})