Restrictions on defining a data resolver URL

[ryanchristo]

Summary

When defining a resolver in the data module, there are currently no restrictions on the provided URL. Anyone can define a resolver with any URL and essentially domain squat a URL that they do not administer.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[ryanchristo]

cc @clevinson @aaronc

I think the simplest solution would be remove unique constraints on URL. We currently look up a resolver based on resolver id and we could allow multiple resolvers with the same URL.

It would be nice to verify a TXT record but not sure how we could do that deterministically. Other options would include a fee (does not solve the problem completely) or governance (adds a lot of overhead and additional work).

[aaronc]

This came up in a call with Cambium as well. I think removing the unique constraint is the right solution

[clevinson]

Makes sense to me. Also in favor of removing uniqueness constraint.

[ryanchristo]

We currently look up a resolver based on resolver id and we could allow multiple resolvers with the same URL.

We actually look up a resolver by url in the current implementation but we can switch to id. I was thinking of registering data to a resolver, which currently takes the resolver id and not the url and which doesn't need to change.

The id is returned when defining a resolver, so the manager will need to store it for use when registering data and for any future operations we add related to the resolver (e.g. updating a resolver manager).

When querying for resolvers by IRI or content hash, we return the resolver urls rather than the resolver ids. This still makes sense although we may want to consider adding a query for resolvers by url (multiple resolvers returned if multiple resolvers with the same url exist), which would allow a user to look up a resolver without the id. Might be nice to have.

Opened #1128 to remove the unique constraint and to update the query by resolver url.

[clevinson]

I agree that allowing for users to query for resolvers by URL (and therefore find the data that is registered in that resolver) would be valuable. In support of adding this as a nice to have.