SDK not allowing DID registration with single external controller, works with cheqd-noded CLI

[ipurujit]

Expected behavior: We should be able to create a DID document which has a single external controller responsible for managing the DID document (updating, etc.) but not responsible for authentication operation.

Actual behavior: Getting error DID authentication is not valid: authentication does not match signatures: signature from key did:cheqd:testnet:...#key-x is missing.

Source of error:

sdk/cjs/src/modules/did.ts

Line 1294 in d583cd7

externalControllersDocuments.concat(didDocument).flatMap((d) => (d ? normalizeAuthentication(d) : []))

(and the corresponding code in esm)

In the line above, the external controller DID document is appended with the current DID document for counting the authentication key ids while validating signatures. This is wrong for a very specific case where:

Only the external controller will "sign" the did registration. But the new entity will "authenticate" itself in the future.

Below I am attaching the payload for cheqd which works with the CLI cheqd-noded but not with the SDK. As shown in the file, only the signature of the controller should be sufficient without needing another signature.

payload-for-creation.json

This issue seems to be very closely related to #473

[ipurujit]

TL;DR: In the case where there is an external controller and only one authentication method in the DID document (DID's own verification method), the SDK does not allow create DID operation transaction to be signed by any controller other than the current DID itself.

There are other issues as well, all related to having an external controller. Probably the update DID transaction is also affected by this bug.

Longer explanation:

1. During signature input evaluation by the SDK, it is expecting all verification method IDs to be in the current DID document itself! But that is not the case when we have an external controller already registered on the cheqd ledger, it must query to resolve that controller's DID document from the ledger and ensure that that DID document contains the verification method ID.

2. During validation of signature inputs, as mentioned in my previous comment, it is merging the authentication method of the external controller and the current new DID document. But that should not happen when the new DID document has only external controller (not itself).