Surface DID resolution errors in VP verification failures #3979

Copilot · 2026-01-29T10:07:14Z

Plan: Improve Client Error Message for DID Resolution Failures

Understand the issue and codebase structure
Identify specific errors related to DID resolution that can be safely exposed
Modify error handling to allow DID resolution errors to pass through
Add tests to verify the new error messages
Run existing tests to ensure no regression
Run security checks (CodeQL - 0 alerts found)
Address review feedback - simplify implementation

Summary of Changes

Problem: Currently, when the server can't resolve a DID document during VP verification, it returns a generic error: "presentation(s) or contained credential(s) are invalid". This makes troubleshooting difficult for clients.

Solution Implemented:

Created verificationErrorDescription() helper (auth/api/iam/openid4vp.go):
- Detects DID resolution errors using errors.Is() and string pattern matching
- Returns detailed error messages by appending the actual error message
- Maintains generic message for other errors to preserve security
Updated error handling in two locations:
- auth/api/iam/openid4vp.go - OpenID4VP HandleAuthorizeResponse flow
- auth/api/iam/s2s_vptoken.go - Service-to-service VP token verification flow
Added comprehensive tests (auth/api/iam/openid4vp_test.go):
- Tests for DID resolution error types
- Tests for wrapped errors
- Tests for generic fallback behavior

New Error Messages:

✅ Appends actual error message for DID resolution errors (ErrNotFound, ErrKeyNotFound, "unable to resolve")
✅ Generic message maintained for other errors (security preserved)

Review Feedback Addressed:

✅ Removed legacy did:nuts error checks (deactivated, no active controllers)
✅ Simplified to use err.Error() directly instead of custom messages

Testing Results:

✅ All unit tests pass (4/4)
✅ All existing IAM package tests pass
✅ Build successful

Security Considerations:

Only DID resolution-related errors are exposed with specific messages
All other verification errors continue to use the generic message
Internal error details are still logged via InternalError field for debugging
No sensitive information is exposed to clients

Original prompt

This section details on the original issue you should resolve

<issue_title>QoL: improve client error message if DID can't be resolved.</issue_title>
<issue_description>Currently, the server returns:
invalid_request - presentation(s) or contained credential(s) are invalid
This typically happens because the server can't resolve the DID document. We sanitize error messages for security reasons, but maybe we can allow some errors that aren't so sensitive.</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes QoL: improve client error message if DID can't be resolved. #3978

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>

qltysh · 2026-01-29T10:26:45Z

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (2)

Rating	File	% Diff	Uncovered Line #s
	auth/api/iam/openid4vp.go	100.0%
	auth/api/iam/s2s_vptoken.go	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

reinkrul · 2026-01-30T07:59:43Z

auth/api/iam/openid4vp.go

+	// Check error messages directly since ErrDeactivated and ErrNoActiveController both implement deactivatedError
+	if strings.Contains(errMsg, "no active controllers") {
+		return "presentation(s) or contained credential(s) are invalid: DID document has no active controllers"
+	}


this is a legacy did:nuts error message, you can remove this case

Removed in a9b37f2

reinkrul · 2026-01-30T08:00:41Z

auth/api/iam/openid4vp.go

+	if strings.Contains(errMsg, "deactivated") {
+		return "presentation(s) or contained credential(s) are invalid: DID document has been deactivated"
+	}


this is a legacy did:nuts error message, you can remove this case

Removed in a9b37f2

reinkrul · 2026-01-30T08:01:29Z

auth/api/iam/openid4vp.go

+// verificationErrorDescription returns a more specific error description when DID resolution fails,
+// otherwise returns the generic error message. This improves user experience by providing actionable
+// error information for common DID resolution issues while maintaining security for other errors.
+func verificationErrorDescription(err error) string {


instead of making a new error message, just use

"presentation(s) or contained credential(s) are invalid: " + err.Error()

Updated in a9b37f2 to use err.Error() directly

- Remove legacy did:nuts error checks (deactivated, no active controllers) - Simplify to just append err.Error() for DID resolution errors - Update tests to match simplified implementation Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>

Initial plan

e55c706

Copilot AI assigned Copilot and reinkrul Jan 29, 2026

Copilot started work on behalf of reinkrul January 29, 2026 10:07 View session

Copilot AI and others added 2 commits January 29, 2026 10:18

Improve error messages for DID resolution failures in VP verification

530e2ea

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>

Complete implementation - all tests pass, security check passed

8ea7b94

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update client error message for unresolved DID~~ Surface DID resolution errors in VP verification failures Jan 29, 2026

Copilot AI requested a review from reinkrul January 29, 2026 10:27

Copilot finished work on behalf of reinkrul January 29, 2026 10:27

reinkrul requested changes Jan 30, 2026

View reviewed changes

Copilot started work on behalf of reinkrul January 30, 2026 08:02 View session

Copilot AI requested a review from reinkrul January 30, 2026 08:06

Copilot finished work on behalf of reinkrul January 30, 2026 08:06

wip

e3c85f5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Surface DID resolution errors in VP verification failures #3979

Surface DID resolution errors in VP verification failures #3979

Uh oh!

Copilot AI commented Jan 29, 2026 •

edited

Loading

Uh oh!

qltysh bot commented Jan 29, 2026 •

edited

Loading

Uh oh!

reinkrul Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

reinkrul Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

reinkrul Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Surface DID resolution errors in VP verification failures #3979

Are you sure you want to change the base?

Surface DID resolution errors in VP verification failures #3979

Uh oh!

Conversation

Copilot AI commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan: Improve Client Error Message for DID Resolution Failures

Summary of Changes

Comments on the Issue (you are @copilot in this section)

Uh oh!

qltysh bot commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

reinkrul Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

reinkrul Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

reinkrul Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 29, 2026 •

edited

Loading

qltysh bot commented Jan 29, 2026 •

edited

Loading