Allow any DID format when token asset matches query DID exactly (#69)

* Allow any DID format when token asset matches query DID exactly

Previously, DecodeERC721DID was called before the direct-match check,
so did:ethr tokens would fail immediately with "unauthorized" even when
token.Asset and the query did were identical. Move the direct-match
check first so it handles any DID format. Change filterToSearchOptions
to accept a plain string subject so the ERC721DID assumption is
removed end-to-end. The device-resolution path (aftermarket/synthetic
device → vehicle DID) is unchanged.

https://claude.ai/code/session_01R5aqTcL3rKEnPazSjxCCP2

* Add a note for later

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: elffjs

internal/graph/convert.go

@@ -9,10 +9,10 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-// filterToSearchOptions converts GraphQL filter and tokenID to grpc.SearchOptions.
-func filterToSearchOptions(filter *model.CloudEventFilter, subject cloudevent.ERC721DID) *grpc.SearchOptions {
+// filterToSearchOptions converts GraphQL filter and subject DID to grpc.SearchOptions.
+func filterToSearchOptions(filter *model.CloudEventFilter, subject string) *grpc.SearchOptions {
 	opts := &grpc.SearchOptions{
-		Subject: &wrapperspb.StringValue{Value: subject.String()},
+		Subject: &wrapperspb.StringValue{Value: subject},
 	}
 	if filter == nil {
 		return opts

internal/graph/resolver.go

@@ -26,6 +26,7 @@ type Resolver struct {
 	IdentityClient identity.Client
 }
 
+// TODO(elffjs): Shouldn't these be Errors?
 const (
 	errNoTokenClaims     = "unauthorized: no token claims"
 	errNoPermission      = "unauthorized: token does not have required permission for this operation"
@@ -68,20 +69,22 @@ func requireRawDataToken(ctx context.Context) (*tokenclaims.Token, error) {
 // ensureRequestedDIDLinkedToPermissionedSubject verifies the client-requested DID is allowed by the token.
 // requestedDID: the DID from the query (e.g. cloudEvents(did: "...")).
 // tokenSubjectDID: the DID the JWT grants access to (tok.Asset).
-func (r *queryResolver) ensureRequestedDIDLinkedToPermissionedSubject(ctx context.Context, requestedDID string, tokenSubjectDID string) (cloudevent.ERC721DID, error) {
+func (r *queryResolver) ensureRequestedDIDLinkedToPermissionedSubject(ctx context.Context, requestedDID string, tokenSubjectDID string) (string, error) {
+	// Direct match works for any DID format (did:ethr, did:erc721, etc.).
+	if requestedDID == tokenSubjectDID {
+		return requestedDID, nil
+	}
+	// Device-resolution path requires an ERC721 DID.
 	requestedDIDParsed, err := cloudevent.DecodeERC721DID(requestedDID)
 	if err != nil {
-		return cloudevent.ERC721DID{}, fmt.Errorf("%s", errNoAccessToSubject)
-	}
-	if requestedDID == tokenSubjectDID {
-		return requestedDIDParsed, nil
+		return "", fmt.Errorf("%s", errNoAccessToSubject)
 	}
 	if r.IdentityClient == nil {
-		return cloudevent.ERC721DID{}, fmt.Errorf("%s", errNoAccessToSubject)
+		return "", fmt.Errorf("%s", errNoAccessToSubject)
 	}
 	linkedDID, err := r.IdentityClient.GetLinkedDIDForDevice(ctx, requestedDIDParsed.String())
 	if err != nil || linkedDID != tokenSubjectDID {
-		return cloudevent.ERC721DID{}, fmt.Errorf("%s", errNoAccessToSubject)
+		return "", fmt.Errorf("%s", errNoAccessToSubject)
 	}
-	return requestedDIDParsed, nil
+	return requestedDIDParsed.String(), nil
 }

internal/graph/resolver_test.go

@@ -144,6 +144,60 @@ func (s *stubIdentityClient) GetLinkedDIDForDevice(_ context.Context, _ string)
 	return s.vehicleDID, s.err
 }
 
+func TestRequireSubjectOptsByDID_EthrDID(t *testing.T) {
+	const ethrDID = "did:ethr:137:0xabcdef1234567890abcdef1234567890abcdef12"
+	const otherEthrDID = "did:ethr:137:0x1111111111111111111111111111111111111111"
+
+	t.Run("ethr token + same ethr query DID allowed", func(t *testing.T) {
+		ctx := contextWithToken(ethrDID, tokenclaims.PermissionGetRawData)
+		r := &Resolver{}
+		q := &queryResolver{r}
+		opts, err := q.requireSubjectOptsByDID(ctx, ethrDID, nil)
+		require.NoError(t, err)
+		require.NotNil(t, opts)
+		require.NotNil(t, opts.Subject)
+		assert.Equal(t, ethrDID, opts.Subject.Value)
+	})
+
+	t.Run("ethr token + different ethr query DID denied", func(t *testing.T) {
+		ctx := contextWithToken(ethrDID, tokenclaims.PermissionGetRawData)
+		r := &Resolver{}
+		q := &queryResolver{r}
+		opts, err := q.requireSubjectOptsByDID(ctx, otherEthrDID, nil)
+		require.Error(t, err)
+		assert.Nil(t, opts)
+		assert.Contains(t, err.Error(), "does not have access to this subject")
+	})
+
+	t.Run("ethr token + erc721 query DID denied (device resolution returns vehicle DID, not ethr DID)", func(t *testing.T) {
+		vehicleDID := cloudevent.ERC721DID{
+			ChainID:         137,
+			ContractAddress: common.HexToAddress("0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"),
+			TokenID:         big.NewInt(1),
+		}.String()
+		ctx := contextWithToken(ethrDID, tokenclaims.PermissionGetRawData)
+		// Identity-api returns a vehicle DID, not the ethr DID — so linkedDID != tokenSubjectDID.
+		r := &Resolver{
+			IdentityClient: &stubIdentityClient{vehicleDID: vehicleDID},
+		}
+		q := &queryResolver{r}
+		opts, err := q.requireSubjectOptsByDID(ctx, vehicleDID, nil)
+		require.Error(t, err)
+		assert.Nil(t, opts)
+		assert.Contains(t, err.Error(), "does not have access to this subject")
+	})
+
+	t.Run("ethr token without required permission denied", func(t *testing.T) {
+		ctx := contextWithToken(ethrDID)
+		r := &Resolver{}
+		q := &queryResolver{r}
+		opts, err := q.requireSubjectOptsByDID(ctx, ethrDID, nil)
+		require.Error(t, err)
+		assert.Nil(t, opts)
+		assert.Contains(t, err.Error(), "required permission for this operation")
+	})
+}
+
 func TestRequireVehicleOptsByDID_DeviceDID(t *testing.T) {
 	vehicleAddr := common.HexToAddress("0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
 	vehicleDID := cloudevent.ERC721DID{