resolveDidDocument method

Future<Map<String, dynamic>> resolveDidDocument(
  1. String did
)

Fetches the DID document for did and returns it verbatim, as decoded JSON.

did must be a did:plc: or did:web: DID (optionally at://-prefixed and surrounded by whitespace); a handle is not accepted, because verifying that a handle and a document claim each other is what resolve is for, and there is no ResolvedIdentity here to carry the result.

Unlike resolve this applies no atproto-specific interpretation: no #atproto_pds service is required and no signing key is extracted, so it serves documents that cannot become a ResolvedIdentity at all. A feed generator's did:web document, for instance, declares a #bsky_fg service and no PDS, and resolve rejects it outright.

The transport controls resolve uses still apply: timeout, maxResponseBytes, and the redirect cap for every fetch, plus — for did:web only — allowedHosts, allowPrivateNetwork, https-only redirects, and the binding of the document's id to did. A did:plc document is fetched from the operator-configured plcDirectory, which is trusted by construction and therefore exempt from the host policy, and is not id-bound because it is content-addressed. As in resolve, the redirect validation only takes effect on platforms whose HTTP client honors followRedirects = false; on the web the browser follows redirects transparently.

The returned map is a fresh decode owned by the caller: it is mutable, and it is not cached.

The values inside it are not validated. Every serviceEndpoint in it is attacker-controlled text that has passed no scheme or host policy — the #atproto_pds entry included, since the PDS endpoint is checked only on the resolve path, where it becomes ResolvedIdentity.pds. Read one with serviceEndpointOf, or vet a host you derive yourself with ensureNonReservedHost, before connecting to it.

Throws an IdentityException on a malformed DID, an unsupported DID method, a transport or host-policy failure, a non-200 response, a body that is not a JSON object, or a did:web document whose id does not match did; and an ArgumentError when did is blank.

Implementation

Future<Map<String, dynamic>> resolveDidDocument(final String did) async {
  return _resolveDidDocument(_normalizeIdentity(did, name: 'did'));
}