PHP code example of 51degrees / fiftyone.pipeline.did

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

51degrees / fiftyone.pipeline.did example snippets

use fiftyone\pipeline\did\FodId;
use fiftyone\pipeline\did\IdType;

// A value from outside may be anything at all, so reading answers rather
// than raising. Either base64 alphabet is accepted, standard as the cloud
// issues it or URL-safe as a page puts it in a link, with or without
// padding, and surrounding whitespace such as a trailing newline is
// ignored. A null, an empty string or an array is reported, not raised.
$result = FodId::tryFromBase64($_GET['51did'] ?? null);
if (!$result->ok) {
    // $result->status names the reason and is safe to log.
    return;
}
$fodId = $result->fodId;

$type      = $fodId->getType();        // IdType::Probabilistic / Random / HashedEmail
$usage     = $fodId->getUsage();       // Usage::NonMarketing / Standard / Personalized, the highest granted
$usage->idUsage();                     // 'non-marketing' / 'standard' / 'personalized', the cloud's id.usage value
$consented = $fodId->isUsageFromConsent(); // whether the usage came from a consent string
$licenseId = $fodId->getLicenseId();
$matchKey  = $fodId->getMatchKey();    // SHA-256 or GUID bytes, see type
$terms     = $fodId->getTerms();       // address of the terms document it
                                       // was created under, null where it
                                       // names none this package knows

// Delegated OWID-level fields and operations. Reading never verifies.
$domain   = $fodId->getDomain();
$verified = $fodId->verify($publicKeyPem);
$status   = $fodId->signatureStatus($publicKeyPem); // SignatureStatus
$date     = $fodId->getDate();
$base64   = $fodId->asBase64();
$urlSafe  = $fodId->asBase64Url();    // for a URL, no padding

// Before. The OWID was built or parsed directly and raised on bad input,
// and the exception text was the only account of what was wrong.
try {
    $fodId = FodId::fromOwid(Owid::fromBase64($value));
} catch (OwidException $e) {
    error_log('not a 51Did: ' . $e->getMessage());
}

// After. The read answers with a named reason and nothing is raised for
// data that merely fails to be a 51Did.
$result = FodId::tryFromBase64($value);
if (!$result->ok) {
    error_log('not a 51Did: ' . $result->status->value);
    return;
}
$fodId = $result->fodId;

$a = FodId::fromBase64($idprobglobalA);
$b = FodId::fromBase64($idprobglobalB);

// The envelope (date, signature, base64) differs across reissues.
// The match key inside the payload is stable, so that is what you compare.
$sameMatchKey = $a->getMatchKey() === $b->getMatchKey();

use fiftyone\pipeline\did\ContextOutcome;
use fiftyone\pipeline\did\DidClient;
use fiftyone\pipeline\did\FodId;
use fiftyone\pipeline\did\NotSupportedException;

$client = new DidClient($resourceKey, $licenceKey);

// 1. Read. The identifier arrives from a page in the URL-safe alphabet,
//    and a value that is not a 51Did is an answer rather than an error.
$read = FodId::tryFromBase64($fromThePage);
if (!$read->ok) {
    return;   // $read->status says why
}
$fodId = $read->fodId;

// 2. Verify the signature offline. The client fetches the published
//    signing keys once, caches them for a day, and tries the key in force
//    when the identifier was created plus a neighbouring key where the
//    date sits close to a key boundary. Version 3 envelopes only.
$genuine = $client->verifySignature($fodId);
$key = $client->publicKeyFor($fodId);   // null when no key covers the date

//    verifySignatureDetailed() answers which of the five things happened
//    rather than only whether the identifier is genuine. Only Verified
//    says a key matched, and only Invalid says a key was tried and did
//    not. The other three say the check never ran, so treating them as
//    forged would report your own outage as an attack.
$outcome = $client->verifySignatureDetailed($fodId);
//    SignatureCheck::Verified | Invalid | NoKeyForDate
//                  | UnsupportedVersion | InvalidLength

// 3. Verify the signature through the cloud (one use, no licence key).
$valid = $client->verify($fodId);

// 4. Redeem a sealed creator context result the page relayed (one use).
try {
    $redeemed = $client->redeem($fodId, $sealedResult, $challenge);
    if ($redeemed->context === ContextOutcome::Verified) {
        // Presented from the browser and connection it was created on.
    }
    $redeemed->signature;            // SignatureOutcome
    $redeemed->factors;              // name => FactorOutcome, mismatch only
    $redeemed->verifiedAt;           // DateTimeImmutable or null
    $redeemed->secondsSinceVerified; // int or null
    $redeemed->statusCode;           // 200, or 503 for Unconfirmed
} catch (NotSupportedException $e) {
    // The host does not offer the creator context.
}

$client = new DidClient($resource, $licence);   // once, at start-up

$read = FodId::tryFromBase64($_GET['51did'] ?? null);
if (!$read->ok) {
    http_response_code(400);
    header('Content-Type: application/json');
    echo json_encode(['errors' => [
        'The 51did is not a valid 51Did (' . $read->status->value . ').',
    ]]);
    return;
}
$fodId = $read->fodId;
$serverSignature = $client->verifySignature($fodId) ? 'verified' : 'invalid';
$redeemed = $client->redeem(
    $fodId,
    $_GET['result'] ?? '',
    $_GET['challenge'] ?? ''
);
$answer = $redeemed->toArray();
$answer['serverSignature'] = $serverSignature;
http_response_code($redeemed->statusCode);
header('Content-Type: application/json');
echo json_encode($answer);

bash
git submodule update --init   # fetches owid-php into ./owid-php
composer install

bash
php -S localhost:5100 server.php