Address copilot pass 5 on #2

JSON-LD lets `controller` be a string, object with @id/id, OR an
array of either form. The previous code assumed string|@id-object,
so an array silently produced an undefined expected controller and
disabled the mismatch check entirely.

Added normalizeControllers() helper that handles all four shapes
(string, object-with-@id, object-with-id-shorthand, array) and
returns a list of absolutized IRIs. Both the profile's outer
controller and each VM's controller are normalized through it; a
VM passes if any of its controllers is in the profile's expected
controller set.

Verified against five edge cases: array containing the WebID
(passes), object-with-id shorthand (passes), VM matching second
array entry (passes), VM matching neither (correctly fails), and
VM with array-valued controller (passes when intersection is
non-empty).

Author: melvincarvalho

lib/lws-cid.js

@@ -132,15 +132,17 @@ export function runLwsCidChecks(profile, { webIdUrl }) {
     // to `@id`. Most profiles are self-controlled (controller === @id)
     // so the two are equal; for delegated-control profiles, VMs are
     // expected to be controlled by whoever the profile says controls
-    // it, not by the WebID itself.
-    const expectedCtrlSource = controller !== undefined
-      ? (typeof controller === 'string' ? controller : controller['@id'])
-      : id;
-    const expectedCtrl = absolutize(expectedCtrlSource, requestedNoHash);
+    // it. JSON-LD allows `controller` to be a string, an object with
+    // `@id`/`id`, or an array of either form — each VM's controller
+    // need only match one of them.
+    const expectedCtrls = normalizeControllers(
+      controller !== undefined ? controller : id,
+      requestedNoHash,
+    );
     const seenIds = new Set();
     let allOk = true;
     for (const [i, vm] of vms.entries()) {
-      const probs = validateVerificationMethod(vm, requestedNoHash, expectedCtrl);
+      const probs = validateVerificationMethod(vm, requestedNoHash, expectedCtrls);
       if (probs.length === 0) continue;
       allOk = false;
       out.push({
@@ -316,7 +318,7 @@ function expandsToCid(termValue, ctx) {
   return false;
 }
 
-function validateVerificationMethod(vm, baseUrl, controllerUrl) {
+function validateVerificationMethod(vm, baseUrl, expectedCtrls) {
   const probs = [];
   if (typeof vm !== 'object' || vm === null) {
     return ['entry is not an object'];
@@ -326,10 +328,11 @@ function validateVerificationMethod(vm, baseUrl, controllerUrl) {
   if (!vm.type) probs.push('missing type');
   if (!vm.controller) {
     probs.push('missing controller');
-  } else if (controllerUrl) {
-    const ctrlAbs = absolutize(typeof vm.controller === 'string' ? vm.controller : vm.controller['@id'], baseUrl);
-    if (ctrlAbs !== controllerUrl) {
-      probs.push(`controller mismatch: ${ctrlAbs} ≠ ${controllerUrl}`);
+  } else if (expectedCtrls && expectedCtrls.length > 0) {
+    const vmCtrls = normalizeControllers(vm.controller, baseUrl);
+    const matched = vmCtrls.some((c) => expectedCtrls.includes(c));
+    if (!matched) {
+      probs.push(`controller mismatch: ${vmCtrls.join(', ') || '(empty)'} ∉ {${expectedCtrls.join(', ')}}`);
     }
   }
   if (!vm.publicKeyJwk && !vm.publicKeyMultibase) {
@@ -338,6 +341,24 @@ function validateVerificationMethod(vm, baseUrl, controllerUrl) {
   return probs;
 }
 
+/**
+ * Normalize a JSON-LD controller value (string | { '@id' | 'id': string }
+ * | array of either) to a list of absolutized IRI strings.
+ */
+function normalizeControllers(value, baseUrl) {
+  if (value === undefined || value === null) return [];
+  const list = Array.isArray(value) ? value : [value];
+  const out = [];
+  for (const v of list) {
+    let iri;
+    if (typeof v === 'string') iri = v;
+    else if (v && typeof v === 'object') iri = v['@id'] ?? v.id;
+    if (typeof iri !== 'string' || iri.length === 0) continue;
+    out.push(absolutize(iri, baseUrl));
+  }
+  return out;
+}
+
 function asArray(v) {
   if (v === undefined || v === null) return [];
   return Array.isArray(v) ? v : [v];