refactor: Updating authorization xrpc middleware to reflect recent IdentityResolver changes.

README.md

···
 ### XRPC Service
 
 ```rust
-use atproto_xrpcs::authorization::ResolvingAuthorization;
+use atproto_xrpcs::authorization::Authorization;
 use axum::{Json, Router, extract::Query, routing::get};
 use serde::Deserialize;
 use serde_json::json;
···
 
 async fn handle_hello(
     params: Query<HelloParams>,
-    authorization: Option<ResolvingAuthorization>,
+    authorization: Option<Authorization>,
 ) -> Json<serde_json::Value> {
     let subject = params.subject.as_deref().unwrap_or("World");
-    
+
     let message = if let Some(auth) = authorization {
         format!("Hello, authenticated {}! (caller: {})", subject, auth.subject())
     } else {
         format!("Hello, {}!", subject)
     };
-    
+
     Json(json!({ "message": message }))
 }
 

crates/atproto-identity/src/model.rs

···
     /// The DID identifier (e.g., "did:plc:abc123").
     pub id: String,
     /// Alternative identifiers like handles and domains.
+    #[serde(default)]
     pub also_known_as: Vec<String>,
     /// Available services for this identity.
+    #[serde(default)]
     pub service: Vec<Service>,
 
     /// Cryptographic verification methods.
-    #[serde(alias = "verificationMethod")]
+    #[serde(alias = "verificationMethod", default)]
     pub verification_method: Vec<VerificationMethod>,
 
     /// Additional document properties not explicitly defined.
···
             let document = document.unwrap();
             assert_eq!(document.id, "did:plc:cbkjy5n7bk3ax2wplmtjofq2");
         }
+    }
+
+    #[test]
+    fn test_deserialize_service_did_document() {
+        // DID document from api.bsky.app - a service DID without alsoKnownAs
+        let document = serde_json::from_str::<Document>(
+            r##"{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/multikey/v1"],"id":"did:web:api.bsky.app","verificationMethod":[{"id":"did:web:api.bsky.app#atproto","type":"Multikey","controller":"did:web:api.bsky.app","publicKeyMultibase":"zQ3shpRzb2NDriwCSSsce6EqGxG23kVktHZc57C3NEcuNy1jg"}],"service":[{"id":"#bsky_notif","type":"BskyNotificationService","serviceEndpoint":"https://api.bsky.app"},{"id":"#bsky_appview","type":"BskyAppView","serviceEndpoint":"https://api.bsky.app"}]}"##,
+        );
+        assert!(document.is_ok(), "Failed to parse: {:?}", document.err());
+
+        let document = document.unwrap();
+        assert_eq!(document.id, "did:web:api.bsky.app");
+        assert!(document.also_known_as.is_empty());
+        assert_eq!(document.service.len(), 2);
+        assert_eq!(document.service[0].id, "#bsky_notif");
+        assert_eq!(document.service[1].id, "#bsky_appview");
     }
 }

crates/atproto-oauth/src/scopes.rs

···
     Atproto,
     /// Transition scope for migration operations
     Transition(TransitionScope),
+    /// Include scope for referencing permission sets by NSID
+    Include(IncludeScope),
     /// OpenID Connect scope - required for OpenID Connect authentication
     OpenId,
     /// Profile scope - access to user profile information
···
     Generic,
     /// Email transition operations
     Email,
+}
+
+/// Include scope for referencing permission sets by NSID
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct IncludeScope {
+    /// The permission set NSID (e.g., "app.example.authFull")
+    pub nsid: String,
+    /// Optional audience DID for inherited RPC permissions
+    pub aud: Option<String>,
 }
 
 /// Blob scope with mime type constraints
···
             "rpc",
             "atproto",
             "transition",
+            "include",
             "openid",
             "profile",
             "email",
···
             "rpc" => Self::parse_rpc(suffix),
             "atproto" => Self::parse_atproto(suffix),
             "transition" => Self::parse_transition(suffix),
+            "include" => Self::parse_include(suffix),
             "openid" => Self::parse_openid(suffix),
             "profile" => Self::parse_profile(suffix),
             "email" => Self::parse_email(suffix),
···
         Ok(Scope::Transition(scope))
     }
 
+    fn parse_include(suffix: Option<&str>) -> Result<Self, ParseError> {
+        let (nsid, params) = match suffix {
+            Some(s) => {
+                if let Some(pos) = s.find('?') {
+                    (&s[..pos], Some(&s[pos + 1..]))
+                } else {
+                    (s, None)
+                }
+            }
+            None => return Err(ParseError::MissingResource),
+        };
+
+        if nsid.is_empty() {
+            return Err(ParseError::MissingResource);
+        }
+
+        let aud = if let Some(params) = params {
+            let parsed_params = parse_query_string(params);
+            parsed_params
+                .get("aud")
+                .and_then(|v| v.first())
+                .map(|s| url_decode(s))
+        } else {
+            None
+        };
+
+        Ok(Scope::Include(IncludeScope {
+            nsid: nsid.to_string(),
+            aud,
+        }))
+    }
+
     fn parse_openid(suffix: Option<&str>) -> Result<Self, ParseError> {
         if suffix.is_some() {
             return Err(ParseError::InvalidResource(
···
                 TransitionScope::Generic => "transition:generic".to_string(),
                 TransitionScope::Email => "transition:email".to_string(),
             },
+            Scope::Include(scope) => {
+                if let Some(ref aud) = scope.aud {
+                    format!("include:{}?aud={}", scope.nsid, url_encode(aud))
+                } else {
+                    format!("include:{}", scope.nsid)
+                }
+            }
             Scope::OpenId => "openid".to_string(),
             Scope::Profile => "profile".to_string(),
             Scope::Email => "email".to_string(),
···
             // Other scopes don't grant transition scopes
             (_, Scope::Transition(_)) => false,
             (Scope::Transition(_), _) => false,
+            // Include scopes only grant themselves (exact match including aud)
+            (Scope::Include(a), Scope::Include(b)) => a == b,
+            // Other scopes don't grant include scopes
+            (_, Scope::Include(_)) => false,
+            (Scope::Include(_), _) => false,
             // OpenID Connect scopes only grant themselves
             (Scope::OpenId, Scope::OpenId) => true,
             (Scope::OpenId, _) => false,
···
     }
 
     params
+}
+
+/// Decode a percent-encoded string
+fn url_decode(s: &str) -> String {
+    let mut result = String::with_capacity(s.len());
+    let mut chars = s.chars().peekable();
+
+    while let Some(c) = chars.next() {
+        if c == '%' {
+            let hex: String = chars.by_ref().take(2).collect();
+            if hex.len() == 2 {
+                if let Ok(byte) = u8::from_str_radix(&hex, 16) {
+                    result.push(byte as char);
+                    continue;
+                }
+            }
+            result.push('%');
+            result.push_str(&hex);
+        } else {
+            result.push(c);
+        }
+    }
+
+    result
+}
+
+/// Encode a string for use in a URL query parameter
+fn url_encode(s: &str) -> String {
+    let mut result = String::with_capacity(s.len() * 3);
+
+    for c in s.chars() {
+        match c {
+            'A'..='Z' | 'a'..='z' | '0'..='9' | '-' | '_' | '.' | '~' | ':' => {
+                result.push(c);
+            }
+            _ => {
+                for byte in c.to_string().as_bytes() {
+                    result.push_str(&format!("%{:02X}", byte));
+                }
+            }
+        }
+    }
+
+    result
 }
 
 /// Error type for scope parsing
···
         let reduced = Scope::parse_multiple_reduced("repo:app.bsky.feed.* repo:app.bsky.graph.* repo:*").unwrap();
         assert_eq!(reduced.len(), 1);
         assert_eq!(reduced[0], repo_all);
+    }
+
+    #[test]
+    fn test_include_scope_parsing() {
+        // Test basic include scope
+        let scope = Scope::parse("include:app.example.authFull").unwrap();
+        assert_eq!(
+            scope,
+            Scope::Include(IncludeScope {
+                nsid: "app.example.authFull".to_string(),
+                aud: None,
+            })
+        );
+
+        // Test include scope with audience
+        let scope = Scope::parse("include:app.example.authFull?aud=did:web:api.example.com").unwrap();
+        assert_eq!(
+            scope,
+            Scope::Include(IncludeScope {
+                nsid: "app.example.authFull".to_string(),
+                aud: Some("did:web:api.example.com".to_string()),
+            })
+        );
+
+        // Test include scope with URL-encoded audience (with fragment)
+        let scope = Scope::parse("include:app.example.authFull?aud=did:web:api.example.com%23svc_chat").unwrap();
+        assert_eq!(
+            scope,
+            Scope::Include(IncludeScope {
+                nsid: "app.example.authFull".to_string(),
+                aud: Some("did:web:api.example.com#svc_chat".to_string()),
+            })
+        );
+
+        // Test missing NSID
+        assert!(matches!(
+            Scope::parse("include"),
+            Err(ParseError::MissingResource)
+        ));
+
+        // Test empty NSID with query params
+        assert!(matches!(
+            Scope::parse("include:?aud=did:example:123"),
+            Err(ParseError::MissingResource)
+        ));
+    }
+
+    #[test]
+    fn test_include_scope_normalization() {
+        // Test normalization without audience
+        let scope = Scope::parse("include:com.example.authBasic").unwrap();
+        assert_eq!(scope.to_string_normalized(), "include:com.example.authBasic");
+
+        // Test normalization with audience (no special chars)
+        let scope = Scope::parse("include:com.example.authBasic?aud=did:plc:xyz123").unwrap();
+        assert_eq!(
+            scope.to_string_normalized(),
+            "include:com.example.authBasic?aud=did:plc:xyz123"
+        );
+
+        // Test normalization with URL encoding (fragment needs encoding)
+        let scope = Scope::parse("include:app.example.authFull?aud=did:web:api.example.com%23svc_chat").unwrap();
+        let normalized = scope.to_string_normalized();
+        assert_eq!(
+            normalized,
+            "include:app.example.authFull?aud=did:web:api.example.com%23svc_chat"
+        );
+    }
+
+    #[test]
+    fn test_include_scope_grants() {
+        let include1 = Scope::parse("include:app.example.authFull").unwrap();
+        let include2 = Scope::parse("include:app.example.authBasic").unwrap();
+        let include1_with_aud = Scope::parse("include:app.example.authFull?aud=did:plc:xyz").unwrap();
+        let account = Scope::parse("account:email").unwrap();
+
+        // Include scopes only grant themselves (exact match)
+        assert!(include1.grants(&include1));
+        assert!(!include1.grants(&include2));
+        assert!(!include1.grants(&include1_with_aud)); // Different because aud differs
+        assert!(include1_with_aud.grants(&include1_with_aud));
+
+        // Include scopes don't grant other scope types
+        assert!(!include1.grants(&account));
+        assert!(!account.grants(&include1));
+
+        // Include scopes don't grant atproto or transition
+        let atproto = Scope::parse("atproto").unwrap();
+        let transition = Scope::parse("transition:generic").unwrap();
+        assert!(!include1.grants(&atproto));
+        assert!(!include1.grants(&transition));
+        assert!(!atproto.grants(&include1));
+        assert!(!transition.grants(&include1));
+    }
+
+    #[test]
+    fn test_parse_multiple_with_include() {
+        let scopes = Scope::parse_multiple("atproto include:app.example.auth repo:*").unwrap();
+        assert_eq!(scopes.len(), 3);
+        assert_eq!(scopes[0], Scope::Atproto);
+        assert!(matches!(scopes[1], Scope::Include(_)));
+        assert!(matches!(scopes[2], Scope::Repo(_)));
+
+        // Test with URL-encoded audience
+        let scopes = Scope::parse_multiple(
+            "include:app.example.auth?aud=did:web:api.example.com%23svc account:email"
+        ).unwrap();
+        assert_eq!(scopes.len(), 2);
+        if let Scope::Include(inc) = &scopes[0] {
+            assert_eq!(inc.nsid, "app.example.auth");
+            assert_eq!(inc.aud, Some("did:web:api.example.com#svc".to_string()));
+        } else {
+            panic!("Expected Include scope");
+        }
+    }
+
+    #[test]
+    fn test_parse_multiple_reduced_with_include() {
+        // Include scopes don't reduce each other (each is distinct)
+        let scopes = Scope::parse_multiple_reduced(
+            "include:app.example.auth include:app.example.other include:app.example.auth"
+        ).unwrap();
+        assert_eq!(scopes.len(), 2); // Duplicates are removed
+        assert!(scopes.contains(&Scope::Include(IncludeScope {
+            nsid: "app.example.auth".to_string(),
+            aud: None,
+        })));
+        assert!(scopes.contains(&Scope::Include(IncludeScope {
+            nsid: "app.example.other".to_string(),
+            aud: None,
+        })));
+
+        // Include scopes with different audiences are not duplicates
+        let scopes = Scope::parse_multiple_reduced(
+            "include:app.example.auth include:app.example.auth?aud=did:plc:xyz"
+        ).unwrap();
+        assert_eq!(scopes.len(), 2);
+    }
+
+    #[test]
+    fn test_serialize_multiple_with_include() {
+        let scopes = vec![
+            Scope::parse("repo:*").unwrap(),
+            Scope::parse("include:app.example.authFull").unwrap(),
+            Scope::Atproto,
+        ];
+        let result = Scope::serialize_multiple(&scopes);
+        assert_eq!(result, "atproto include:app.example.authFull repo:*");
+
+        // Test with URL-encoded audience
+        let scopes = vec![
+            Scope::Include(IncludeScope {
+                nsid: "app.example.auth".to_string(),
+                aud: Some("did:web:api.example.com#svc".to_string()),
+            }),
+        ];
+        let result = Scope::serialize_multiple(&scopes);
+        assert_eq!(result, "include:app.example.auth?aud=did:web:api.example.com%23svc");
+    }
+
+    #[test]
+    fn test_remove_scope_with_include() {
+        let scopes = vec![
+            Scope::Atproto,
+            Scope::parse("include:app.example.auth").unwrap(),
+            Scope::parse("account:email").unwrap(),
+        ];
+        let to_remove = Scope::parse("include:app.example.auth").unwrap();
+        let result = Scope::remove_scope(&scopes, &to_remove);
+        assert_eq!(result.len(), 2);
+        assert!(!result.contains(&to_remove));
+        assert!(result.contains(&Scope::Atproto));
+    }
+
+    #[test]
+    fn test_include_scope_roundtrip() {
+        // Test that parse and serialize are inverses
+        let original = "include:com.example.authBasicFeatures?aud=did:web:api.example.com%23svc_appview";
+        let scope = Scope::parse(original).unwrap();
+        let serialized = scope.to_string_normalized();
+        let reparsed = Scope::parse(&serialized).unwrap();
+        assert_eq!(scope, reparsed);
     }
 }

crates/atproto-xrpcs-helloworld/src/main.rs

···
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, require_env, version},
     key::{KeyData, KeyResolver, identify_key, to_public},
     resolve::{HickoryDnsResolver, IdentityResolver, InnerIdentityResolver},
-    storage_lru::LruDidDocumentStorage,
-    traits::DidDocumentStorage,
 };
-use atproto_xrpcs::authorization::ResolvingAuthorization;
+use atproto_xrpcs::authorization::Authorization;
 use axum::{
     Json, Router,
     extract::{FromRef, Query, State},
···
 use http::{HeaderMap, StatusCode};
 use serde::Deserialize;
 use serde_json::json;
-use std::{collections::HashMap, num::NonZeroUsize, ops::Deref, sync::Arc};
+use std::{collections::HashMap, ops::Deref, sync::Arc};
 
 #[derive(Clone)]
 pub struct SimpleKeyResolver {
···
 
 pub struct InnerWebContext {
     pub http_client: reqwest::Client,
-    pub document_storage: Arc<dyn DidDocumentStorage>,
     pub key_resolver: Arc<dyn KeyResolver>,
     pub service_document: ServiceDocument,
     pub service_did: ServiceDID,
···
     }
 }
 
-impl FromRef<WebContext> for Arc<dyn DidDocumentStorage> {
-    fn from_ref(context: &WebContext) -> Self {
-        context.0.document_storage.clone()
-    }
-}
-
 impl FromRef<WebContext> for Arc<dyn KeyResolver> {
     fn from_ref(context: &WebContext) -> Self {
         context.0.key_resolver.clone()
···
 
     let web_context = WebContext(Arc::new(InnerWebContext {
         http_client: http_client.clone(),
-        document_storage: Arc::new(LruDidDocumentStorage::new(NonZeroUsize::new(255).unwrap())),
         key_resolver: Arc::new(SimpleKeyResolver {
             keys: signing_key_storage,
         }),
···
 async fn handle_xrpc_hello_world(
     parameters: Query<HelloParameters>,
     headers: HeaderMap,
-    authorization: Option<ResolvingAuthorization>,
+    authorization: Option<Authorization>,
 ) -> Json<serde_json::Value> {
     println!("headers {headers:?}");
     let subject = parameters.subject.as_deref().unwrap_or("World");

crates/atproto-xrpcs/README.md

···
 ### Basic XRPC Service
 
 ```rust
-use atproto_xrpcs::authorization::ResolvingAuthorization;
+use atproto_xrpcs::authorization::Authorization;
 use axum::{Json, Router, extract::Query, routing::get};
 use serde::Deserialize;
 use serde_json::json;
···
 
 async fn handle_hello(
     params: Query<HelloParams>,
-    authorization: Option<ResolvingAuthorization>,
+    authorization: Option<Authorization>,
 ) -> Json<serde_json::Value> {
     let name = params.name.as_deref().unwrap_or("World");
-    
+
     let message = if authorization.is_some() {
         format!("Hello, authenticated {}!", name)
     } else {
         format!("Hello, {}!", name)
     };
-    
+
     Json(json!({ "message": message }))
 }
 
···
 ### JWT Authorization
 
 ```rust
-use atproto_xrpcs::authorization::ResolvingAuthorization;
+use atproto_xrpcs::authorization::Authorization;
 
 async fn handle_secure_endpoint(
-    authorization: ResolvingAuthorization, // Required authorization
+    authorization: Authorization, // Required authorization
 ) -> Json<serde_json::Value> {
-    // The ResolvingAuthorization extractor automatically:
+    // The Authorization extractor automatically:
     // 1. Validates the JWT token
-    // 2. Resolves the caller's DID document  
+    // 2. Resolves the caller's DID document
     // 3. Verifies the signature against the DID document
     // 4. Provides access to caller identity information
-    
+
     let caller_did = authorization.subject();
     Json(json!({"caller": caller_did, "status": "authenticated"}))
 }
···
 use axum::{response::IntoResponse, http::StatusCode};
 
 async fn protected_handler(
-    authorization: Result<ResolvingAuthorization, AuthorizationError>,
+    authorization: Result<Authorization, AuthorizationError>,
 ) -> impl IntoResponse {
     match authorization {
         Ok(auth) => (StatusCode::OK, "Access granted").into_response(),
-        Err(AuthorizationError::InvalidJWTToken { .. }) => {
+        Err(AuthorizationError::InvalidJWTFormat) => {
             (StatusCode::UNAUTHORIZED, "Invalid token").into_response()
         }
-        Err(AuthorizationError::DIDDocumentResolutionFailed { .. }) => {
+        Err(AuthorizationError::SubjectResolutionFailed { .. }) => {
             (StatusCode::FORBIDDEN, "Identity verification failed").into_response()
         }
         Err(_) => {
···
 
 ## Authorization Flow
 
-The `ResolvingAuthorization` extractor implements:
+The `Authorization` extractor implements:
 
 1. JWT extraction from HTTP Authorization headers
 2. Token validation (signature and claims structure)

crates/atproto-xrpcs/src/authorization.rs

···
 //! JWT authorization extractors for XRPC services.
 //!
-//! Axum extractors for JWT validation against DID documents with
-//! cached and resolving authorization modes.
+//! Axum extractors for JWT validation against DID documents resolved
+//! via an identity resolver.
 
 use anyhow::Result;
 use atproto_identity::key::identify_key;
-use atproto_identity::resolve::IdentityResolver;
-use atproto_identity::traits::DidDocumentStorage;
+use atproto_identity::traits::IdentityResolver;
 use atproto_oauth::jwt::{Claims, Header};
 use axum::extract::{FromRef, OptionalFromRequestParts};
 use axum::http::request::Parts;
···
 
 use crate::errors::AuthorizationError;
 
-/// JWT authorization extractor that validates tokens against cached DID documents.
+/// JWT authorization extractor that validates tokens against DID documents.
 ///
 /// Contains JWT header, validated claims, original token, and validation status.
-/// Only validates against DID documents already present in storage.
+/// Resolves DID documents via the configured identity resolver.
 pub struct Authorization(pub Header, pub Claims, pub String, pub bool);
 
-/// JWT authorization extractor with automatic DID document resolution.
-///
-/// Contains JWT header, validated claims, original token, and validation status.
-/// Attempts to resolve missing DID documents from authoritative sources when needed.
-pub struct ResolvingAuthorization(pub Header, pub Claims, pub String, pub bool);
-
 impl<S> OptionalFromRequestParts<S> for Authorization
 where
     S: Send + Sync,
-    Arc<dyn DidDocumentStorage>: FromRef<S>,
+    Arc<dyn IdentityResolver>: FromRef<S>,
 {
     type Rejection = Infallible;
 
···
             }
         };
 
-        let did_document_storage = Arc::<dyn DidDocumentStorage>::from_ref(state);
+        let identity_resolver = Arc::<dyn IdentityResolver>::from_ref(state);
 
-        match validate_jwt(&token, did_document_storage, None).await {
+        match validate_jwt(&token, identity_resolver).await {
             Ok((header, claims)) => Ok(Some(Authorization(header, claims, token, true))),
             Err(_) => {
                 // Return unvalidated authorization so the handler can decide what to do
···
     }
 }
 
-impl<S> OptionalFromRequestParts<S> for ResolvingAuthorization
-where
-    S: Send + Sync,
-    Arc<dyn DidDocumentStorage>: FromRef<S>,
-    Arc<dyn IdentityResolver>: FromRef<S>,
-{
-    type Rejection = Infallible;
-
-    async fn from_request_parts(
-        parts: &mut Parts,
-        state: &S,
-    ) -> Result<Option<Self>, Self::Rejection> {
-        let auth_header = parts
-            .headers
-            .get("authorization")
-            .and_then(|value| value.to_str().ok())
-            .and_then(|s| s.strip_prefix("Bearer "));
-
-        let token = match auth_header {
-            Some(token) => token.to_string(),
-            None => {
-                return Ok(None);
-            }
-        };
-
-        let did_document_storage = Arc::<dyn DidDocumentStorage>::from_ref(state);
-        let identity_resolver = Arc::<dyn IdentityResolver>::from_ref(state);
-
-        match validate_jwt(&token, did_document_storage, Some(identity_resolver)).await {
-            Ok((header, claims)) => Ok(Some(ResolvingAuthorization(header, claims, token, true))),
-            Err(_) => {
-                // Return unvalidated authorization so the handler can decide what to do
-                let header = Header::default();
-                let claims = Claims::default();
-                Ok(Some(ResolvingAuthorization(header, claims, token, false)))
-            }
-        }
-    }
-}
-
 async fn validate_jwt(
     token: &str,
-    storage: Arc<dyn DidDocumentStorage + Send + Sync>,
-    identity_resolver: Option<Arc<dyn IdentityResolver>>,
+    identity_resolver: Arc<dyn IdentityResolver>,
 ) -> Result<(Header, Claims)> {
     // Split and decode JWT
     let parts: Vec<&str> = token.split('.').collect();
···
         .as_ref()
         .ok_or_else(|| AuthorizationError::NoIssuerInClaims)?;
 
-    // Try to look up DID document directly first
-    let mut did_document = storage.get_document_by_did(issuer).await?;
-
-    // If not found, try to resolve the subject
-    if did_document.is_none()
-        && let Some(identity_resolver) = identity_resolver
-    {
-        did_document = match identity_resolver.resolve(issuer).await {
-            Ok(value) => {
-                storage
-                    .store_document(value.clone())
-                    .await
-                    .map_err(|err| AuthorizationError::DocumentStorageFailed { error: err })?;
-
-                Some(value)
-            }
-            Err(err) => {
-                return Err(AuthorizationError::SubjectResolutionFailed {
-                    issuer: issuer.to_string(),
-                    error: err,
-                }
-                .into());
-            }
-        };
-    }
-
-    let did_document = did_document.ok_or_else(|| AuthorizationError::DIDDocumentNotFound {
-        issuer: issuer.to_string(),
+    // Resolve the DID document via identity resolver
+    let did_document = identity_resolver.resolve(issuer).await.map_err(|err| {
+        AuthorizationError::SubjectResolutionFailed {
+            issuer: issuer.to_string(),
+            error: err,
+        }
     })?;
 
     // Extract keys from DID document
···
 mod tests {
     use super::*;
     use atproto_identity::model::{Document, VerificationMethod};
-    use atproto_identity::traits::DidDocumentStorage;
     use axum::extract::FromRef;
     use axum::http::{Method, Request};
     use std::collections::HashMap;
 
     #[derive(Clone)]
-    struct MockStorage {
+    struct MockResolver {
         document: Document,
     }
 
     #[async_trait::async_trait]
-    impl DidDocumentStorage for MockStorage {
-        async fn get_document_by_did(&self, did: &str) -> Result<Option<Document>> {
-            if did == self.document.id {
-                Ok(Some(self.document.clone()))
+    impl IdentityResolver for MockResolver {
+        async fn resolve(&self, subject: &str) -> Result<Document> {
+            if subject == self.document.id {
+                Ok(self.document.clone())
             } else {
-                Ok(None)
+                Err(anyhow::anyhow!(
+                    "error-atproto-xrpcs-authorization-1 DID not found: {}",
+                    subject
+                ))
             }
         }
-
-        async fn store_document(&self, _document: Document) -> Result<()> {
-            Ok(())
-        }
-
-        async fn delete_document_by_did(&self, _did: &str) -> Result<()> {
-            Ok(())
-        }
     }
 
     #[derive(Clone)]
     struct TestState {
-        storage: Arc<dyn DidDocumentStorage + Send + Sync>,
+        resolver: Arc<dyn IdentityResolver>,
     }
 
-    impl FromRef<TestState> for Arc<dyn DidDocumentStorage> {
+    impl FromRef<TestState> for Arc<dyn IdentityResolver> {
         fn from_ref(state: &TestState) -> Self {
-            state.storage.clone()
+            state.resolver.clone()
         }
     }
 
···
             extra: HashMap::new(),
         };
 
-        // Create mock storage
-        let storage =
-            Arc::new(MockStorage { document }) as Arc<dyn DidDocumentStorage + Send + Sync>;
-        let state = TestState { storage };
+        // Create mock resolver
+        let resolver = Arc::new(MockResolver { document }) as Arc<dyn IdentityResolver>;
+        let state = TestState { resolver };
 
         // Create request with Authorization header
         let request = Request::builder()
···
 
     #[tokio::test]
     async fn test_authorization_no_header() {
-        // Create mock storage
-        let storage = Arc::new(MockStorage {
+        // Create mock resolver
+        let resolver = Arc::new(MockResolver {
             document: Document {
                 context: vec![],
                 id: "did:plc:test".to_string(),
···
                 verification_method: vec![],
                 extra: HashMap::new(),
             },
-        }) as Arc<dyn DidDocumentStorage + Send + Sync>;
-        let state = TestState { storage };
+        }) as Arc<dyn IdentityResolver>;
+        let state = TestState { resolver };
 
         // Create request without Authorization header
         let request = Request::builder()

crates/atproto-xrpcs/src/errors.rs

···
     #[error("error-atproto-xrpcs-authorization-4 No issuer found in JWT claims")]
     NoIssuerInClaims,
 
-    /// Occurs when DID document is not found for the issuer
-    #[error("error-atproto-xrpcs-authorization-5 DID document not found for issuer: {issuer}")]
-    DIDDocumentNotFound {
-        /// The issuer DID that was not found
-        issuer: String,
-    },
-
     /// Occurs when no verification keys are found in DID document
-    #[error("error-atproto-xrpcs-authorization-6 No verification keys found in DID document")]
+    #[error("error-atproto-xrpcs-authorization-5 No verification keys found in DID document")]
     NoVerificationKeys,
 
     /// Occurs when JWT header cannot be base64 decoded
-    #[error("error-atproto-xrpcs-authorization-7 Failed to decode JWT header: {error}")]
+    #[error("error-atproto-xrpcs-authorization-6 Failed to decode JWT header: {error}")]
     HeaderDecodeError {
         /// The underlying base64 decode error
         error: base64::DecodeError,
     },
 
     /// Occurs when JWT header cannot be parsed as JSON
-    #[error("error-atproto-xrpcs-authorization-8 Failed to parse JWT header: {error}")]
+    #[error("error-atproto-xrpcs-authorization-7 Failed to parse JWT header: {error}")]
     HeaderParseError {
         /// The underlying JSON parse error
         error: serde_json::Error,
     },
 
     /// Occurs when JWT validation fails with all available keys
-    #[error("error-atproto-xrpcs-authorization-9 JWT validation failed with all available keys")]
+    #[error("error-atproto-xrpcs-authorization-8 JWT validation failed with all available keys")]
     ValidationFailedAllKeys,
 
     /// Occurs when subject resolution fails during DID document lookup
-    #[error("error-atproto-xrpcs-authorization-10 Subject resolution failed: {issuer} {error}")]
+    #[error("error-atproto-xrpcs-authorization-9 Subject resolution failed: {issuer} {error}")]
     SubjectResolutionFailed {
         /// The issuer that failed to resolve
         issuer: String,
         /// The underlying resolution error
-        error: anyhow::Error,
-    },
-
-    /// Occurs when DID document lookup fails after successful resolution
-    #[error(
-        "error-atproto-xrpcs-authorization-11 DID document not found for resolved issuer: {resolved_did}"
-    )]
-    ResolvedDIDDocumentNotFound {
-        /// The resolved DID that was not found in storage
-        resolved_did: String,
-    },
-
-    /// Occurs when PLC directory query fails
-    #[error("error-atproto-xrpcs-authorization-12 PLC directory query failed: {error}")]
-    PLCQueryFailed {
-        /// The underlying PLC query error
-        error: anyhow::Error,
-    },
-
-    /// Occurs when web DID query fails
-    #[error("error-atproto-xrpcs-authorization-13 Web DID query failed: {error}")]
-    WebDIDQueryFailed {
-        /// The underlying web DID query error
-        error: anyhow::Error,
-    },
-
-    /// Occurs when DID document storage operation fails
-    #[error("error-atproto-xrpcs-authorization-14 DID document storage failed: {error}")]
-    DocumentStorageFailed {
-        /// The underlying storage error
-        error: anyhow::Error,
-    },
-
-    /// Occurs when input parsing fails for resolved DID
-    #[error("error-atproto-xrpcs-authorization-15 Input parsing failed for resolved DID: {error}")]
-    InputParsingFailed {
-        /// The underlying parsing error
         error: anyhow::Error,
     },
 }