Address copilot pass 6 on #2

- doctor.js: harden canonical-WebID derivation. Wrap URL parsing in
  try/catch so a malformed profile @id can't crash diagnostics; only
  adopt the profile @id when its fragmentless form matches the
  fetched docUrl, otherwise fall back to the user-supplied URL. This
  prevents a snippet whose VM id is rooted at one document while the
  UI tells the user to PATCH a different one.
- lib/lws-cid.js: route the self-control check through
  normalizeControllers too, so all four JSON-LD shapes (string,
  object-with-@id, object-with-id, array) yield consistent results.
  Previously, controller={id: ...} or array forms produced an
  undefined comparison and a misleading warn. Empty/unresolvable
  controller now reports "does not resolve to a usable IRI" rather
  than silently degrading.

Author: melvincarvalho

doctor.js

@@ -151,14 +151,25 @@ async function runAll(webIdUrl) {
 
   // Profile was fetched and parsed — safe to root a snippet against this URL.
   // Take the canonical WebID from the profile's own @id (absolutized
-  // against the document URL); fall back to the user-supplied URL if
-  // the profile didn't declare one. This preserves any fragment (e.g.
-  // "#me") so verificationMethod controllers will agree with the
-  // profile's outer controller predicate.
+  // against the document URL), but only when its fragmentless form
+  // matches the URL we actually fetched — otherwise the snippet's VM
+  // id would be rooted at one document while the UI tells the user to
+  // patch a different one. Untrusted input, so the URL parse is
+  // wrapped: malformed @id falls back to the user-supplied URL.
   const profileId = profile['@id'] || profile.id;
-  const canonicalWebId = profileId
-    ? new URL(profileId, docUrl).toString()
-    : webIdUrl;
+  let canonicalWebId = webIdUrl;
+  if (profileId) {
+    try {
+      const resolved = new URL(profileId, docUrl);
+      const resolvedNoHash = new URL(resolved);
+      resolvedNoHash.hash = '';
+      if (resolvedNoHash.toString() === docUrl.toString()) {
+        canonicalWebId = resolved.toString();
+      }
+    } catch {
+      // malformed @id; fall through to user-supplied URL
+    }
+  }
   result.profileFetched = true;
   result.docUrl = docUrl.toString();
   result.webId = canonicalWebId;

lib/lws-cid.js

@@ -92,16 +92,24 @@ export function runLwsCidChecks(profile, { webIdUrl }) {
       detail: 'CID v1 requires a controller for verification methods to be usable.',
     });
   } else {
-    const ctrl = typeof controller === 'string' ? controller : controller['@id'];
-    const ctrlAbs = absolutize(ctrl, requestedNoHash);
+    // Normalize through the same helper as the VM check so all four
+    // JSON-LD shapes (string, object-with-@id, object-with-id, array)
+    // are handled consistently.
+    const ctrlList = normalizeControllers(controller, requestedNoHash);
     const idAbsolute = absolutize(id, requestedNoHash);
-    if (ctrlAbs === idAbsolute) {
+    if (ctrlList.length === 0) {
+      out.push({
+        status: 'fail',
+        label: 'Profile declares a controller',
+        detail: 'controller is present but does not resolve to a usable IRI.',
+      });
+    } else if (ctrlList.includes(idAbsolute)) {
       out.push({ status: 'pass', label: 'controller === @id (self-controlled)' });
     } else {
       out.push({
         status: 'warn',
         label: 'controller differs from @id',
-        detail: `controller=${ctrlAbs}, @id=${idAbsolute}. Delegated control is allowed by CID v1 but most pods are self-controlled.`,
+        detail: `controller=${ctrlList.join(', ')}, @id=${idAbsolute}. Delegated control is allowed by CID v1 but most pods are self-controlled.`,
       });
     }
   }