Address copilot pass 1 on #4

Ten findings, all real. Five for behavior, four for wording, one
cleanup.

Behavior:
1. VM controller hard-coded to webId. The builder now accepts an
   explicit `controller` (defaulting to webId for the common
   self-controlled case); the doctor passes `lastController` from
   diagnostics so delegated-control profiles produce VMs that match
   the profile's outer controller predicate. Verified end-to-end
   against the JSS verifier in self-controlled, delegated-controlled,
   and mismatched scenarios.
2. memPrivKey + lastVmKid weren't cleared on sign-out. The UI
   promised sign-out clears state, and a privkey sitting in a tab
   that's no longer authenticated is just exposure with no purpose.
   Now nulled (and the input field cleared) when the session goes
   inactive.
3. Read-modify-write PUT had no concurrency control. Now captures
   ETag from the GET and sends it via If-Match on the PUT, with a
   clear "profile changed since GET" error on 412/409.
4. mergeVerificationMethod only matched object entries, missing
   string-IRI entries. JSON-LD permits VMs to be referenced by IRI
   string, so an existing string entry could leave a duplicate when
   merged. Now matches both forms via entryMatchesId.
5. Idempotent merge could silently clobber a different key sitting
   at the same fragment. Now compares publicKeyJwk material (kty,
   crv, x, y) and refuses to overwrite if the existing key differs,
   pointing the user to a fresh fragment.

Wording (README/UI said "PATCH" but code does GET+PUT):
6. README's B.3 description.
7. lws-auth section's intro.
8. The "future" hint in the B.2 section is now stale — replaced
   with a pointer to B.3.

Cleanup:
9. lastProfile was assigned but never read — dropped.
10. New patch-section hint clarifies why we PUT instead of PATCH
    (JSS conneg-layer edge cases on patch round-trips).

Author: melvincarvalho

README.md

@@ -24,7 +24,7 @@ Read-only — no auth, no mutations, no server roundtrip beyond the GETs.
 
 **2. Nostr verification-method generator** — reads your Nostr pubkey from a [NIP-07](https://github.com/nostr-protocol/nips/blob/master/07.md) signer (e.g. [xlogin](https://xlogin.solid.social/)), encodes it per [did:nostr](https://nostrcg.github.io/did-nostr/)'s Multikey recipe, and emits a copyable JSON snippet to add to your profile. No keys leave your browser.
 
-**3. Strict [LWS10-CID](https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/) auth client** — sign in to your pod via Solid-OIDC (using the [`solid-oidc`](https://www.npmjs.com/package/solid-oidc) package), paste a secp256k1 private key (your Nostr nsec hex works — same key, different signature scheme), and the doctor PATCHes a `JsonWebKey` VM into your profile and signs an LWS10-CID JWT with `alg: ES256K` to authenticate end-to-end. Pairs with the [JSS server-side verifier](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/pull/398). Privkey is held in memory for the tab only.
+**3. Strict [LWS10-CID](https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/) auth client** — sign in to your pod via Solid-OIDC (using the [`solid-oidc`](https://www.npmjs.com/package/solid-oidc) package), paste a secp256k1 private key (your Nostr nsec hex works — same key, different signature scheme), and the doctor adds a `JsonWebKey` VM to your profile (read-modify-write via authenticated GET + PUT) and signs an LWS10-CID JWT with `alg: ES256K` to authenticate end-to-end. Pairs with the [JSS server-side verifier](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/pull/398). Privkey is held in memory for the tab only.
 
 ## Roadmap (rough)
 

doctor.js

@@ -35,7 +35,6 @@ let lastWebId = null;
 let lastDocUrl = null;
 let lastController = null;
 let lastIssuer = null;
-let lastProfile = null;
 let lastVmKid = null;
 let memPrivKey = null; // 32-byte secp256k1 privkey, in-memory only
 
@@ -66,13 +65,12 @@ form.addEventListener('submit', async (e) => {
   hideLwsAuthSection();
 
   try {
-    const { checks, profileFetched, webId, docUrl, controller, profile, issuer } = await runAll(url);
+    const { checks, profileFetched, webId, docUrl, controller, issuer } = await runAll(url);
     renderChecks(checks);
     if (profileFetched && webId) {
       lastWebId = webId;
       lastDocUrl = docUrl;
       lastController = controller;
-      lastProfile = profile;
       lastIssuer = issuer;
       revealAddKeySection();
       revealLwsAuthSection();
@@ -210,7 +208,6 @@ async function runAll(webIdUrl) {
   result.docUrl = docUrl.toString();
   result.webId = canonicalWebId;
   result.controller = controllerIri;
-  result.profile = profile;
   result.issuer = extractIssuer(profile);
 
   // 4. Run LWS-CID structural checks.
@@ -357,6 +354,13 @@ const session = new Session({
     oidcSignOutBtn.hidden = !isActive;
     patchSection.hidden = !isActive;
     if (!isActive) {
+      // Drop any pasted privkey + cached VM kid the moment the session
+      // ends. The UI promises sign-out clears state, and a privkey
+      // sitting in a tab that's no longer authenticated is just
+      // exposure with no purpose.
+      memPrivKey = null;
+      lastVmKid = null;
+      privkeyInput.value = '';
       testSection.hidden = true;
       patchResult.textContent = '';
       patchResult.className = 'patch-result';
@@ -435,6 +439,10 @@ patchButton.addEventListener('click', async () => {
     const { vm, kid } = buildEs256kVerificationMethod({
       privKey: priv,
       webId: lastWebId,
+      // For delegated-control profiles use the diagnosed controller,
+      // not the WebID — otherwise the VM's controller will mismatch
+      // the profile's outer controller predicate and verifiers reject.
+      controller: lastController ?? lastWebId,
     });
     lastVmKid = kid;
 
@@ -445,14 +453,27 @@ patchButton.addEventListener('click', async () => {
       headers: { Accept: 'application/ld+json' },
     });
     if (!getRes.ok) throw new Error(`GET profile: HTTP ${getRes.status}`);
+    const etag = getRes.headers.get('etag');
     const current = await getRes.json();
 
     const merged = mergeVerificationMethod(current, vm);
+
+    const putHeaders = { 'Content-Type': 'application/ld+json' };
+    // Use If-Match to defeat lost-update on concurrent edits. JSS
+    // returns ETags on profile resources; servers without ETag support
+    // fall through with no header.
+    if (etag) putHeaders['If-Match'] = etag;
+
     const putRes = await session.authFetch(lastDocUrl, {
       method: 'PUT',
-      headers: { 'Content-Type': 'application/ld+json' },
+      headers: putHeaders,
       body: JSON.stringify(merged, null, 2),
     });
+    if (putRes.status === 412 || putRes.status === 409) {
+      throw new Error(
+        `profile changed since GET (HTTP ${putRes.status}). Re-run diagnostics and try again.`,
+      );
+    }
     if (!putRes.ok) throw new Error(`PUT profile: HTTP ${putRes.status}`);
 
     patchResult.className = 'patch-result ok';
@@ -518,18 +539,45 @@ testButton.addEventListener('click', async () => {
 });
 
 /**
- * Merge a verificationMethod entry into a profile, idempotently.
- * Replaces an existing entry with the same `id`, otherwise appends.
- * Also adds the entry's id to `authentication` if not already there.
+ * Merge a verificationMethod entry into a profile.
+ *
+ * Idempotent on re-runs of the SAME key: replaces the existing entry
+ * (same id, same publicKeyJwk) so we don't grow duplicates.
+ *
+ * Refuses to clobber a different key sitting at the same fragment —
+ * an existing VM with the same id but DIFFERENT publicKeyJwk throws.
+ * The user can pick another fragment if they want to keep both keys
+ * (key rotation should happen at a fresh fragment, e.g. `lws-key-2`,
+ * with the old one removed from `authentication` once rotation is
+ * complete).
+ *
+ * Handles string-IRI verificationMethod entries (which JSON-LD
+ * permits) — finds them by IRI equality so the entry isn't duplicated.
  */
 function mergeVerificationMethod(profile, vm) {
   const out = { ...profile };
   const vms = Array.isArray(out.verificationMethod) ? [...out.verificationMethod]
             : out.verificationMethod ? [out.verificationMethod]
             : [];
-  const idx = vms.findIndex((v) => (v?.id || v?.['@id']) === vm.id);
-  if (idx >= 0) vms[idx] = vm;
-  else vms.push(vm);
+  const idx = vms.findIndex((v) => entryMatchesId(v, vm.id));
+  if (idx >= 0) {
+    const existing = vms[idx];
+    // String-IRI entries don't carry inline material — replacing
+    // them with our embedded VM is fine. For embedded entries with a
+    // different publicKeyJwk, refuse to overwrite.
+    if (typeof existing === 'object' && existing !== null) {
+      const existingJwk = existing.publicKeyJwk;
+      if (existingJwk && !sameJwk(existingJwk, vm.publicKeyJwk)) {
+        throw new Error(
+          `verificationMethod ${vm.id} already exists with a different public key — ` +
+          `pick a new fragment (e.g. lws-key-2) or remove the existing entry first`,
+        );
+      }
+    }
+    vms[idx] = vm;
+  } else {
+    vms.push(vm);
+  }
   out.verificationMethod = vms;
 
   const auth = Array.isArray(out.authentication) ? [...out.authentication]
@@ -542,6 +590,22 @@ function mergeVerificationMethod(profile, vm) {
   return out;
 }
 
+function entryMatchesId(entry, id) {
+  if (typeof entry === 'string') return entry === id;
+  if (entry && typeof entry === 'object') return (entry.id || entry['@id']) === id;
+  return false;
+}
+
+function sameJwk(a, b) {
+  // Compare the public-key material, not auxiliary fields like `kid`,
+  // `alg`, or `use`. Two VMs are "the same key" iff x and y match.
+  return a && b
+    && a.kty === b.kty
+    && a.crv === b.crv
+    && a.x === b.x
+    && a.y === b.y;
+}
+
 function extractIssuer(profile) {
   // JSS emits oidcIssuer in compact form via the profile @context. Some
   // clients use the full predicate URI or the prefixed form; support all.

index.html

@@ -70,15 +70,16 @@ <h3>Patch to apply</h3>
         <button type="button" id="copy-snippet">Copy snippet</button>
         <span class="copy-status" id="copy-status" aria-live="polite"></span>
 
-        <p class="hint future">B.3 (below) closes the loop with an in-app PATCH so you don't have to copy/paste.</p>
+        <p class="hint">For end-to-end auth without copy/paste, see "Strict LWS10-CID auth setup" below — it signs you in, writes the VM, and tests authentication for you.</p>
       </div>
     </section>
 
     <section class="lws-auth" id="lws-auth" hidden>
       <h2>Strict LWS10-CID auth setup</h2>
       <p>Sign in to your pod, paste a secp256k1 private key (your Nostr nsec hex works
-        &mdash; same key, different signature scheme), and the doctor PATCHes a
-        <code>JsonWebKey</code> verificationMethod into your profile and signs a real
+        &mdash; same key, different signature scheme), and the doctor adds a
+        <code>JsonWebKey</code> verificationMethod to your profile (read-modify-write over
+        authenticated GET + PUT) and signs a real
         <a href="https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/" target="_blank" rel="noopener">LWS10-CID</a>
         JWT to authenticate. <strong>The private key never leaves your browser.</strong></p>
 
@@ -101,6 +102,10 @@ <h3>1. Add an ES256K verificationMethod</h3>
                placeholder="0123…64-hex-chars…cdef">
         <button type="button" id="patch-button">Add VM to profile</button>
         <div class="patch-result" id="patch-result" aria-live="polite"></div>
+        <p class="hint">Implementation: authenticated GET → merge VM → PUT (with
+          <code>If-Match</code> when the server provides an ETag). True
+          <code>PATCH</code> isn't used because JSS's JSON-LD ↔ Turtle conneg
+          layer has known edge cases on patch round-trips.</p>
       </div>
 
       <!-- Test auth -->

lib/lws-cid-client.js

@@ -65,11 +65,16 @@ export function validatePrivKey(hex) {
  *
  * @param {object} args
  * @param {Uint8Array|string} args.privKey - 32-byte privkey (Uint8Array or hex string)
- * @param {string} args.webId - WebID URI used as VM controller
+ * @param {string} args.webId - WebID URI used as the VM `id` base
+ * @param {string} [args.controller=webId] - The CID document that
+ *   controls this verificationMethod. Defaults to the WebID itself
+ *   (the common self-controlled case). For delegated-control profiles
+ *   pass the profile's declared `controller` so the VM agrees with
+ *   the outer controller predicate.
  * @param {string} [args.fragment='lws-key-1'] - VM fragment id
  * @returns {{ vm: object, jwk: object, kid: string }}
  */
-export function buildEs256kVerificationMethod({ privKey, webId, fragment = 'lws-key-1' }) {
+export function buildEs256kVerificationMethod({ privKey, webId, controller, fragment = 'lws-key-1' }) {
   const priv = privKey instanceof Uint8Array ? privKey : validatePrivKey(privKey);
   // Uncompressed 65-byte point: 0x04 || x(32) || y(32)
   const pubFull = secp256k1.getPublicKey(priv, /*compressed*/false);
@@ -93,7 +98,7 @@ export function buildEs256kVerificationMethod({ privKey, webId, fragment = 'lws-
   const vm = {
     id: kid,
     type: 'JsonWebKey',
-    controller: webId,
+    controller: controller ?? webId,
     publicKeyJwk: jwk,
   };
   return { vm, jwk, kid };