From f06be16c559597cc9ff7599c0ea40ccf1ed4c4c5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 23 Jul 2026 17:41:05 +0000
Subject: [PATCH] fix: correct DID verification method fragment and set
 controller

doc.Fragment() expects a bare fragment name and prepends the "#" itself,
so passing "#key-0" produced a double-hash fragment that the DID-URL
serializer percent-encoded as "#%23key-0" (e.g.
did:web:hilt.staging.fil.one#%23key-0). Pass "key-0" instead.

Also set the verification method's Controller to the document's DID,
which was previously left unset and serialized as "controller": null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YAjDX5F44mcX8ojb1ENjYt
---
 identity/identity.go      |  5 ++++-
 identity/identity_test.go | 40 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 identity/identity_test.go

diff --git a/identity/identity.go b/identity/identity.go
index 717dbe4..ef2a2b7 100644
--- a/identity/identity.go
+++ b/identity/identity.go
@@ -63,7 +63,10 @@ func (i Identity) DIDDocument() (did.Document, error) {
 	if !ok {
 		return did.Document{}, fmt.Errorf("identity does not have a multikey verifier")
 	}
-	vm := multikey.DeriveVerificationMethod(doc.Fragment("#key-0"), mkVerifier)
+	// Fragment expects a bare name and prepends the "#" itself; passing "#key-0"
+	// would serialize as "#%23key-0".
+	vm := multikey.DeriveVerificationMethod(doc.Fragment("key-0"), mkVerifier)
+	vm.Controller = doc.ID
 
 	if err := doc.VerificationMethods.Add(vm); err != nil {
 		return did.Document{}, err
diff --git a/identity/identity_test.go b/identity/identity_test.go
new file mode 100644
index 0000000..3f0a343
--- /dev/null
+++ b/identity/identity_test.go
@@ -0,0 +1,40 @@
+package identity_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/fil-forge/libforge/identity"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDIDDocument(t *testing.T) {
+	const serviceDID = "did:web:example.com"
+
+	id, err := identity.New("", serviceDID)
+	require.NoError(t, err)
+
+	doc, err := id.DIDDocument()
+	require.NoError(t, err)
+
+	docJSON, err := json.Marshal(doc)
+	require.NoError(t, err)
+
+	var parsed struct {
+		ID                 string `json:"id"`
+		VerificationMethod []struct {
+			ID         string `json:"id"`
+			Controller string `json:"controller"`
+		} `json:"verificationMethod"`
+	}
+	require.NoError(t, json.Unmarshal(docJSON, &parsed))
+
+	require.Equal(t, serviceDID, parsed.ID)
+	require.Len(t, parsed.VerificationMethod, 1)
+
+	vm := parsed.VerificationMethod[0]
+	require.Equal(t, serviceDID+"#key-0", vm.ID)
+	require.False(t, strings.Contains(vm.ID, "%23"), "verification method ID must not contain a percent-encoded '#'")
+	require.Equal(t, serviceDID, vm.Controller)
+}