bug: verify signature referenced invalid field type

Signed-off-by: Nick Gerakines <[e-mail]>

crates/atproto-jetstream/src/consumer.rs

···
 pub(crate) enum SubscriberSourcedMessage {
     #[serde(rename = "options_update")]
     Update {
-        #[serde(rename = "wantedCollections")]
+        #[serde(rename = "wantedCollections", skip_serializing_if = "Vec::is_empty", default)]
         wanted_collections: Vec<String>,
 
         #[serde(rename = "wantedDids", skip_serializing_if = "Vec::is_empty", default)]

crates/atproto-record/src/bytes.rs

···
 //!
 //! ## Base64 Encoding
 //!
-//! The serialization uses standard base64 encoding (RFC 4648) with padding,
-//! compatible with the `$bytes` field format used throughout AT Protocol.
+//! The serialization uses standard base64 encoding (RFC 4648) with padding.
+//! The deserialization accepts both padded and unpadded base64 strings for
+//! compatibility with various AT Protocol implementations.
 
 /// Base64 serialization format for byte arrays.
 ///
···
     use serde::{Deserialize, Serialize};
     use serde::{Deserializer, Serializer};
 
-    use base64::{Engine, engine::general_purpose::STANDARD};
+    use base64::{Engine, engine::general_purpose::{STANDARD, STANDARD_NO_PAD}};
 
     /// Serializes a byte vector to a base64 encoded string.
     pub fn serialize<S: Serializer>(value: &Vec<u8>, serializer: S) -> Result<S::Ok, S::Error> {
···
     }
 
     /// Deserializes a base64 encoded string to a byte vector.
+    /// Handles both padded and unpadded base64 strings for compatibility.
     pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<u8>, D::Error> {
         let encoded_value = String::deserialize(d)?;
+        
+        // Try standard base64 with padding first
         STANDARD
-            .decode(encoded_value)
+            .decode(&encoded_value)
+            .or_else(|_| {
+                // If that fails, try without padding requirement
+                STANDARD_NO_PAD.decode(&encoded_value)
+            })
             .map_err(serde::de::Error::custom)
     }
 }

crates/atproto-record/src/lexicon/community_lexicon_attestation.rs

···
     use serde_json::json;
 
     #[test]
+    fn test_real_signature_or_ref_deserialization() {
+        // Test with the exact signature structure from the user's RSVP
+        let json_str = r#"{
+            "$type": "community.lexicon.attestation.signature",
+            "issuedAt": "2025-08-19T20:17:17.133Z",
+            "issuer": "did:web:acudo-dev.smokesignal.tools",
+            "signature": {
+                "$bytes": "mr9c0MCu3g6SXNQ25JFhzfX1ecYgK9k1Kf6OZI2p2AlQRoQu09dOE7J5uaeilIx/UFCjJErO89C/uBBb9ANmUA"
+            }
+        }"#;
+
+        // First, try to deserialize as TypedSignature
+        let typed_sig_result: Result<TypedSignature, _> = serde_json::from_str(json_str);
+        match &typed_sig_result {
+            Ok(sig) => {
+                println!("TypedSignature OK: issuer={}", sig.inner.issuer);
+                assert_eq!(sig.inner.issuer, "did:web:acudo-dev.smokesignal.tools");
+            }
+            Err(e) => {
+                eprintln!("TypedSignature deserialization error: {}", e);
+            }
+        }
+        
+        // Then try as SignatureOrRef
+        let sig_or_ref_result: Result<SignatureOrRef, _> = serde_json::from_str(json_str);
+        match &sig_or_ref_result {
+            Ok(SignatureOrRef::Inline(sig)) => {
+                println!("SignatureOrRef OK (Inline): issuer={}", sig.inner.issuer);
+                assert_eq!(sig.inner.issuer, "did:web:acudo-dev.smokesignal.tools");
+            }
+            Ok(SignatureOrRef::Reference(_)) => {
+                panic!("Expected Inline signature, got Reference");
+            }
+            Err(e) => {
+                eprintln!("SignatureOrRef deserialization error: {}", e);
+            }
+        }
+        
+        // Try without $type field
+        let json_no_type = r#"{
+            "issuedAt": "2025-08-19T20:17:17.133Z",
+            "issuer": "did:web:acudo-dev.smokesignal.tools",
+            "signature": {
+                "$bytes": "mr9c0MCu3g6SXNQ25JFhzfX1ecYgK9k1Kf6OZI2p2AlQRoQu09dOE7J5uaeilIx/UFCjJErO89C/uBBb9ANmUA"
+            }
+        }"#;
+        
+        let no_type_result: Result<Signature, _> = serde_json::from_str(json_no_type);
+        match &no_type_result {
+            Ok(sig) => {
+                println!("Signature (no type) OK: issuer={}", sig.issuer);
+                assert_eq!(sig.issuer, "did:web:acudo-dev.smokesignal.tools");
+                assert_eq!(sig.signature.bytes.len(), 64);
+                
+                // Now wrap it in TypedLexicon and try as SignatureOrRef
+                let typed = TypedLexicon::new(sig.clone());
+                let _as_sig_or_ref = SignatureOrRef::Inline(typed);
+                println!("Successfully created SignatureOrRef from Signature");
+            }
+            Err(e) => {
+                eprintln!("Signature (no type) deserialization error: {}", e);
+            }
+        }
+        
+        // Check that at least one worked
+        assert!(typed_sig_result.is_ok() || sig_or_ref_result.is_ok() || no_type_result.is_ok(),
+                "Failed to deserialize signature in any form");
+    }
+
+    #[test]
     fn test_signature_deserialization() {
         let json_str = r#"{
             "$type": "community.lexicon.attestation.signature",

crates/atproto-record/src/lexicon/community_lexicon_calendar_rsvp.rs

···
 
         Ok(())
     }
+
+    #[test]
+    fn test_deserialize_real_rsvp_with_signature() -> Result<()> {
+        use crate::lexicon::community_lexicon_attestation::SignatureOrRef;
+        use chrono::Timelike;
+        use serde_json::Value;
+
+        // Real RSVP JSON with actual signature from the user
+        let json_str = r#"{
+            "$type": "community.lexicon.calendar.rsvp",
+            "createdAt": "2025-08-19T20:17:17.133Z",
+            "signatures": [
+                {
+                    "$type": "community.lexicon.attestation.signature",
+                    "issuedAt": "2025-08-19T20:17:17.133Z",
+                    "issuer": "did:web:acudo-dev.smokesignal.tools",
+                    "signature": {
+                        "$bytes": "mr9c0MCu3g6SXNQ25JFhzfX1ecYgK9k1Kf6OZI2p2AlQRoQu09dOE7J5uaeilIx/UFCjJErO89C/uBBb9ANmUA"
+                    }
+                }
+            ],
+            "status": "community.lexicon.calendar.rsvp#going",
+            "subject": {
+                "cid": "bafyreidtr72nriwlscae3gfwhckxiy427b6ni5jmetzkvaafimeuelnlxa",
+                "uri": "at://did:web:acudo-dev.smokesignal.tools/community.lexicon.calendar.event/3lwrfkzy36k2s"
+            }
+        }"#;
+
+        // First parse as generic JSON to verify structure
+        let json_value: Value = serde_json::from_str(json_str)?;
+        assert_eq!(json_value["$type"], "community.lexicon.calendar.rsvp");
+        assert_eq!(json_value["status"], "community.lexicon.calendar.rsvp#going");
+        
+        // Deserialize the JSON
+        let typed_rsvp: TypedRsvp = serde_json::from_str(json_str)?;
+
+        // Verify the basic fields
+        assert_eq!(typed_rsvp.inner.status, RsvpStatus::Going);
+        assert_eq!(
+            typed_rsvp.inner.subject.uri,
+            "at://did:web:acudo-dev.smokesignal.tools/community.lexicon.calendar.event/3lwrfkzy36k2s"
+        );
+        assert_eq!(
+            typed_rsvp.inner.subject.cid,
+            "bafyreidtr72nriwlscae3gfwhckxiy427b6ni5jmetzkvaafimeuelnlxa"
+        );
+
+        // Verify the timestamp
+        let expected_time = Utc.with_ymd_and_hms(2025, 8, 19, 20, 17, 17)
+            .unwrap()
+            .with_nanosecond(133_000_000)
+            .unwrap();
+        assert_eq!(typed_rsvp.inner.created_at, expected_time);
+
+        // Verify the signature
+        assert_eq!(typed_rsvp.inner.signatures.len(), 1);
+        match &typed_rsvp.inner.signatures[0] {
+            SignatureOrRef::Inline(sig) => {
+                assert_eq!(sig.inner.issuer, "did:web:acudo-dev.smokesignal.tools");
+                
+                // Verify the issuedAt field if present
+                if let Some(issued_at_value) = sig.inner.extra.get("issuedAt") {
+                    assert_eq!(issued_at_value, "2025-08-19T20:17:17.133Z");
+                }
+
+                // Verify the signature is base64 encoded data
+                // The signature should be 64 bytes for P-256 ECDSA (32 bytes for r, 32 bytes for s)
+                assert_eq!(sig.inner.signature.bytes.len(), 64);
+            }
+            _ => panic!("Expected inline signature"),
+        }
+
+        // Verify the type field is present
+        assert!(typed_rsvp.has_type_field());
+        assert!(typed_rsvp.validate().is_ok());
+
+        Ok(())
+    }
 }

crates/atproto-record/src/signature.rs

···
 //! });
 //!
 //! let signed = create(&key, &record, "did:plc:repo",
-//!                     "app.bsky.feed.post", sig_obj).await?;
+//!                     "app.bsky.feed.post", sig_obj)?;
 //!
 //! // Verify the signature
 //! verify("did:plc:issuer", &key, signed,
-//!        "did:plc:repo", "app.bsky.feed.post").await?;
+//!        "did:plc:repo", "app.bsky.feed.post")?;
 //! ```
 
 use atproto_identity::key::{KeyData, sign, validate};
-use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use base64::{Engine, engine::general_purpose::STANDARD};
 use serde_json::json;
 
 use crate::errors::VerificationError;
···
 /// - IPLD DAG-CBOR serialization fails
 /// - Cryptographic signing operation fails
 /// - JSON structure manipulation fails
-pub async fn create(
+pub fn create(
     key_data: &KeyData,
     record: &serde_json::Value,
     repository: &str,
···
     let serialized_signing_record = serde_ipld_dagcbor::to_vec(&signing_record)?;
 
     let signature: Vec<u8> = sign(key_data, &serialized_signing_record)?;
-    let encoded_signature = URL_SAFE_NO_PAD.encode(&signature);
+    let encoded_signature = STANDARD.encode(&signature);
 
     // Compose the proof object
     let mut proof = signature_object.clone();
···
 /// - No `signatures` or `sigs` field exists in the record
 /// - No signature from the specified issuer is found
 /// - The issuer's signature is malformed or missing required fields
+/// - The signature is not in the expected `{"$bytes": "..."}` format
 /// - Base64 decoding of the signature fails
 /// - IPLD DAG-CBOR serialization of reconstructed content fails
 /// - Cryptographic verification fails (invalid signature)
···
 ///
 /// This function supports both `signatures` and `sigs` field names for
 /// backward compatibility with different AT Protocol implementations.
-pub async fn verify(
+pub fn verify(
     issuer: &str,
     key_data: &KeyData,
     record: serde_json::Value,
···
 
         let signature_value = sig_obj
             .get("signature")
-            .and_then(|v| v.as_str())
+            .and_then(|v| v.as_object())
+            .and_then(|obj| obj.get("$bytes"))
+            .and_then(|b| b.as_str())
             .ok_or(VerificationError::MissingSignatureField)?;
 
         if issuer != signature_issuer {
···
         let mut signed_record = record.clone();
         if let Some(record_map) = signed_record.as_object_mut() {
             record_map.remove("signatures");
+            record_map.remove("sigs");
             record_map.insert("$sig".to_string(), sig_variable);
         }
 
         let serialized_record = serde_ipld_dagcbor::to_vec(&signed_record)
             .map_err(|error| VerificationError::RecordSerializationFailed { error })?;
 
-        let signature_bytes = URL_SAFE_NO_PAD
+        let signature_bytes = STANDARD
             .decode(signature_value)
             .map_err(|error| VerificationError::SignatureDecodingFailed { error })?;
 
···
         issuer: issuer.to_string(),
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use atproto_identity::key::{KeyType, generate_key, to_public};
+    use serde_json::json;
+
+    #[test]
+    fn test_create_sign_and_verify_record_p256() -> Result<(), Box<dyn std::error::Error>> {
+        // Step 1: Generate a P-256 key pair
+        let private_key = generate_key(KeyType::P256Private)?;
+        let public_key = to_public(&private_key)?;
+
+        // Step 2: Create a sample record
+        let record = json!({
+            "text": "Hello AT Protocol!",
+            "createdAt": "2025-01-19T10:00:00Z",
+            "langs": ["en"]
+        });
+
+        // Step 3: Define signature metadata
+        let issuer_did = "did:plc:test123";
+        let repository = "did:plc:repo456";
+        let collection = "app.bsky.feed.post";
+
+        let signature_object = json!({
+            "issuer": issuer_did,
+            "issuedAt": "2025-01-19T10:00:00Z",
+            "purpose": "attestation"
+        });
+
+        // Step 4: Sign the record
+        let signed_record = create(
+            &private_key,
+            &record,
+            repository,
+            collection,
+            signature_object.clone(),
+        )?;
+
+        // Verify that the signed record contains signatures array
+        assert!(signed_record.get("signatures").is_some());
+        let signatures = signed_record
+            .get("signatures")
+            .and_then(|v| v.as_array())
+            .expect("signatures should be an array");
+        assert_eq!(signatures.len(), 1);
+
+        // Verify signature object structure
+        let sig = &signatures[0];
+        assert_eq!(sig.get("issuer").and_then(|v| v.as_str()), Some(issuer_did));
+        assert!(sig.get("signature").is_some());
+        assert_eq!(
+            sig.get("$type").and_then(|v| v.as_str()),
+            Some("community.lexicon.attestation.signature")
+        );
+
+        // Step 5: Verify the signature
+        verify(
+            issuer_did,
+            &public_key,
+            signed_record.clone(),
+            repository,
+            collection,
+        )?;
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_create_sign_and_verify_record_k256() -> Result<(), Box<dyn std::error::Error>> {
+        // Test with K-256 curve
+        let private_key = generate_key(KeyType::K256Private)?;
+        let public_key = to_public(&private_key)?;
+
+        let record = json!({
+            "subject": "at://did:plc:example/app.bsky.feed.post/123",
+            "likedAt": "2025-01-19T10:00:00Z"
+        });
+
+        let issuer_did = "did:plc:issuer789";
+        let repository = "did:plc:repo789";
+        let collection = "app.bsky.feed.like";
+
+        let signature_object = json!({
+            "issuer": issuer_did,
+            "issuedAt": "2025-01-19T10:00:00Z"
+        });
+
+        let signed_record = create(
+            &private_key,
+            &record,
+            repository,
+            collection,
+            signature_object,
+        )?;
+
+        verify(
+            issuer_did,
+            &public_key,
+            signed_record,
+            repository,
+            collection,
+        )?;
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_create_sign_and_verify_record_p384() -> Result<(), Box<dyn std::error::Error>> {
+        // Test with P-384 curve
+        let private_key = generate_key(KeyType::P384Private)?;
+        let public_key = to_public(&private_key)?;
+
+        let record = json!({
+            "displayName": "Test User",
+            "description": "Testing P-384 signatures"
+        });
+
+        let issuer_did = "did:web:example.com";
+        let repository = "did:plc:profile123";
+        let collection = "app.bsky.actor.profile";
+
+        let signature_object = json!({
+            "issuer": issuer_did,
+            "issuedAt": "2025-01-19T10:00:00Z",
+            "expiresAt": "2025-01-20T10:00:00Z",
+            "customField": "custom value"
+        });
+
+        let signed_record = create(
+            &private_key,
+            &record,
+            repository,
+            collection,
+            signature_object.clone(),
+        )?;
+
+        // Verify custom fields are preserved in signature
+        let signatures = signed_record
+            .get("signatures")
+            .and_then(|v| v.as_array())
+            .expect("signatures should exist");
+        let sig = &signatures[0];
+        assert_eq!(
+            sig.get("customField").and_then(|v| v.as_str()),
+            Some("custom value")
+        );
+
+        verify(
+            issuer_did,
+            &public_key,
+            signed_record,
+            repository,
+            collection,
+        )?;
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_multiple_signatures() -> Result<(), Box<dyn std::error::Error>> {
+        // Create a record with multiple signatures from different issuers
+        let private_key1 = generate_key(KeyType::P256Private)?;
+        let public_key1 = to_public(&private_key1)?;
+
+        let private_key2 = generate_key(KeyType::K256Private)?;
+        let public_key2 = to_public(&private_key2)?;
+
+        let record = json!({
+            "text": "Multi-signed content",
+            "important": true
+        });
+
+        let repository = "did:plc:repo_multi";
+        let collection = "app.example.document";
+
+        // First signature
+        let issuer1 = "did:plc:issuer1";
+        let sig_obj1 = json!({
+            "issuer": issuer1,
+            "issuedAt": "2025-01-19T09:00:00Z",
+            "role": "author"
+        });
+
+        let signed_once = create(&private_key1, &record, repository, collection, sig_obj1)?;
+
+        // Second signature on already signed record
+        let issuer2 = "did:plc:issuer2";
+        let sig_obj2 = json!({
+            "issuer": issuer2,
+            "issuedAt": "2025-01-19T10:00:00Z",
+            "role": "reviewer"
+        });
+
+        let signed_twice = create(
+            &private_key2,
+            &signed_once,
+            repository,
+            collection,
+            sig_obj2,
+        )?;
+
+        // Verify we have two signatures
+        let signatures = signed_twice
+            .get("signatures")
+            .and_then(|v| v.as_array())
+            .expect("signatures should exist");
+        assert_eq!(signatures.len(), 2);
+
+        // Verify both signatures independently
+        verify(
+            issuer1,
+            &public_key1,
+            signed_twice.clone(),
+            repository,
+            collection,
+        )?;
+        verify(
+            issuer2,
+            &public_key2,
+            signed_twice.clone(),
+            repository,
+            collection,
+        )?;
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_verify_wrong_issuer_fails() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::P256Private)?;
+        let public_key = to_public(&private_key)?;
+
+        let record = json!({"test": "data"});
+        let repository = "did:plc:repo";
+        let collection = "app.test";
+
+        let sig_obj = json!({
+            "issuer": "did:plc:correct_issuer"
+        });
+
+        let signed = create(&private_key, &record, repository, collection, sig_obj)?;
+
+        // Try to verify with wrong issuer
+        let result = verify(
+            "did:plc:wrong_issuer",
+            &public_key,
+            signed,
+            repository,
+            collection,
+        );
+
+        assert!(result.is_err());
+        assert!(matches!(
+            result.unwrap_err(),
+            VerificationError::NoValidSignatureForIssuer { .. }
+        ));
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_verify_wrong_key_fails() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::P256Private)?;
+        let wrong_private_key = generate_key(KeyType::P256Private)?;
+        let wrong_public_key = to_public(&wrong_private_key)?;
+
+        let record = json!({"test": "data"});
+        let repository = "did:plc:repo";
+        let collection = "app.test";
+        let issuer = "did:plc:issuer";
+
+        let sig_obj = json!({ "issuer": issuer });
+
+        let signed = create(&private_key, &record, repository, collection, sig_obj)?;
+
+        // Try to verify with wrong key
+        let result = verify(issuer, &wrong_public_key, signed, repository, collection);
+
+        assert!(result.is_err());
+        assert!(matches!(
+            result.unwrap_err(),
+            VerificationError::CryptographicValidationFailed { .. }
+        ));
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_verify_tampered_record_fails() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::P256Private)?;
+        let public_key = to_public(&private_key)?;
+
+        let record = json!({"text": "original"});
+        let repository = "did:plc:repo";
+        let collection = "app.test";
+        let issuer = "did:plc:issuer";
+
+        let sig_obj = json!({ "issuer": issuer });
+
+        let mut signed = create(&private_key, &record, repository, collection, sig_obj)?;
+
+        // Tamper with the record content
+        if let Some(obj) = signed.as_object_mut() {
+            obj.insert("text".to_string(), json!("tampered"));
+        }
+
+        // Verification should fail
+        let result = verify(issuer, &public_key, signed, repository, collection);
+
+        assert!(result.is_err());
+        assert!(matches!(
+            result.unwrap_err(),
+            VerificationError::CryptographicValidationFailed { .. }
+        ));
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_create_missing_issuer_fails() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::P256Private)?;
+
+        let record = json!({"test": "data"});
+        let repository = "did:plc:repo";
+        let collection = "app.test";
+
+        // Signature object without issuer field
+        let sig_obj = json!({
+            "issuedAt": "2025-01-19T10:00:00Z"
+        });
+
+        let result = create(&private_key, &record, repository, collection, sig_obj);
+
+        assert!(result.is_err());
+        assert!(matches!(
+            result.unwrap_err(),
+            VerificationError::SignatureObjectMissingField { field } if field == "issuer"
+        ));
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_verify_supports_sigs_field() -> Result<(), Box<dyn std::error::Error>> {
+        // Test backward compatibility with "sigs" field name
+        let private_key = generate_key(KeyType::P256Private)?;
+        let public_key = to_public(&private_key)?;
+
+        let record = json!({"test": "data"});
+        let repository = "did:plc:repo";
+        let collection = "app.test";
+        let issuer = "did:plc:issuer";
+
+        let sig_obj = json!({ "issuer": issuer });
+
+        let mut signed = create(&private_key, &record, repository, collection, sig_obj)?;
+
+        // Rename "signatures" to "sigs"
+        if let Some(obj) = signed.as_object_mut() {
+            if let Some(signatures) = obj.remove("signatures") {
+                obj.insert("sigs".to_string(), signatures);
+            }
+        }
+
+        // Should still verify successfully
+        verify(issuer, &public_key, signed, repository, collection)?;
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_signature_preserves_original_record() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::P256Private)?;
+
+        let original_record = json!({
+            "text": "Original content",
+            "metadata": {
+                "author": "Test",
+                "version": 1
+            },
+            "tags": ["test", "sample"]
+        });
+
+        let repository = "did:plc:repo";
+        let collection = "app.test";
+
+        let sig_obj = json!({
+            "issuer": "did:plc:issuer"
+        });
+
+        let signed = create(
+            &private_key,
+            &original_record,
+            repository,
+            collection,
+            sig_obj,
+        )?;
+
+        // All original fields should be preserved
+        assert_eq!(signed.get("text"), original_record.get("text"));
+        assert_eq!(signed.get("metadata"), original_record.get("metadata"));
+        assert_eq!(signed.get("tags"), original_record.get("tags"));
+
+        // Plus the new signatures field
+        assert!(signed.get("signatures").is_some());
+
+        Ok(())
+    }
+}