digitalbazaar / ezcap

An opinionated Authorization Capabilities client
BSD 3-Clause "New" or "Revised" License
7 stars 1 forks source link

Validate `signer` instances passed into the `ZcapClient` constructor. #26

Open mattcollier opened 5 days ago

mattcollier commented 5 days ago

https://github.com/digitalbazaar/ezcap/blob/main/lib/ZcapClient.js#L49-L60

It is currently possible the initialize a ZcapClient supplying signer APIs that are associated with a key that has no private key material associated with it. When this happens, one later discovers when calling a client API such as delegate that the signer is not capable of performing a signing operation.

https://github.com/digitalbazaar/ed25519-verification-key-2020/blob/main/lib/Ed25519VerificationKey2020.js#L405

If possible, it would be good to validate that the signers passed to the ZcapClient constructor are actually valid.

mattcollier commented 5 days ago

Related: https://github.com/digitalbazaar/ed25519-verification-key-2020/issues/23