Nanopublication / nanopub-js / 35314174586

93%

push

github

feat(sign): check the signing key against the network before signing and publishing (#75)

A nanopublication signed with a key that no introduction declares for its
signer is cryptographically valid, but cannot be attributed: it shows up under
an unapproved agent, and the only remedy is publishing it again and retracting
the first.

sign() now checks the profile's signer and key against the introductions
published on the network, and publish() checks an already-signed
nanopublication by its own signature's npx:signedBy and npx:hasPublicKey. The
result is one of declared, declared_without_authority, key_not_declared,
signer_not_introduced or not_checked, classified as in nanopub-java's check.

The check warns by default; keyCheck: 'strict' refuses and keyCheck: 'off'
skips it, and onKeyCheck receives every result for applications to show. It
fails open, so an unreachable query service never stops anyone signing, and a
signer's introductions are reused for five minutes. checkSigningKey() runs it
on its own.

The introductions are fetched with the SPARQL of get-all-user-intros restricted
to the signer, which answers in under a second where the published query
returns every introduction on the network in about eleven. Keys are compared
without whitespace, since some introductions store them with line breaks, and a
nanopublication declaring its own signing key, as an introduction does, is not
checked.

Closes #73

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

404 of 464 branches covered (87.07%)

Branch coverage included in aggregate %.

65 of 65 new or added lines in 2 files covered. (100.0%)

716 of 734 relevant lines covered (97.55%)

2165.93 hits per line