Skip to content

Accept JSON whitespace in transcript field layouts - #20

Closed
Wondertan wants to merge 1 commit into
mainfrom
fix/json-field-whitespace
Closed

Wondertan wants to merge 1 commit into
mainfrom
fix/json-field-whitespace

Conversation

@Wondertan

@Wondertan Wondertan commented Sep 10, 2026

Copy link
Copy Markdown
Member

GitHub’s real identity response can contain whitespace after JSON colons. The transcript reader previously rejected these valid responses. Accept JSON whitespace around field colons and before integer terminators for token and identity layouts, preserving original reveal offsets and bearer-only commitments.

Validation: all 54 libid-transcript tests pass, including original-byte range checks and chunk-split rejection. This needs the matching TypeScript and verifier changes; the proof circuit is unchanged.

Specification: libid #32. Standalone Bridge fix: libid-server-rs #11, based only on the token-exchange prerequisite (#8).

Preserve original transcript offsets and bearer-only commitments while accepting JSON whitespace around colons and before integer terminators.

Assisted-by: GPT-6
Signed-off-by: Wondertan <hlibwondertan@gmail.com>
xgreenx added a commit that referenced this pull request Sep 11, 2026
The quoted member and the bare integer each walked the body for `"field"`
followed by a colon with a copy of the same loop; `key_and_value` is that loop
once, handing back the key's opening quote and the value's first byte. The doc
on `find_json_snippet_range` still argued for the compact template the reader
no longer requires; it now argues for the allowance the reader's whitespace
removal maps onto the literal.

Tests carried over from #20: every RFC 8259 whitespace byte
alone and as a run on both sides of the colon and before the terminator, the
bytes JSON does not call whitespace (VT, FF), a number of another shape, chunk
framing that lands inside the whitespace, and the token response's delimiter
revealed with its whitespace while the bearer alone is committed.

Co-authored-by: Wondertan <hlibwondertan@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: xgreenx <xgreenx9999@gmail.com>
@xgreenx

xgreenx commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Closing in favor of #21, which now carries everything from here: the one shared scan for both member shapes (key_and_value, your json_field_start) and the tests — every whitespace byte alone and as a run, VT/FF not skipped, 1e3/1.5, chunk framing inside the whitespace, and the token delimiter revealed with the bearer alone committed — with you as co-author on that commit.

The byte ranges the two branches cut are identical, so nothing changes for a consumer. The verifier side that merged is libid-org/libID-contracts#37 (whitespace removed on chain before matching), the same reason #36 closed. libid-server-rs#11 pins this branch's 5bed8f2; it should re-pin to main once #21 lands.

@xgreenx xgreenx closed this Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants