From b7ebe2cec1640695377370ee37058e62498386cf Mon Sep 17 00:00:00 2001 From: Aaron Hopper Date: Mon, 22 Jun 2026 15:46:13 -0500 Subject: [PATCH 1/4] fix(tdf3): remove TODO from customer-facing error message Replace 'TODO: Fallback to no split ids' error with user-friendly message. Keep developer TODO as code comment for future implementation. Fixes DSPX-3454 Signed-off-by: Aaron Hopper --- lib/tdf3/src/tdf.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/tdf3/src/tdf.ts b/lib/tdf3/src/tdf.ts index 4decf7a9b..308c0fb07 100644 --- a/lib/tdf3/src/tdf.ts +++ b/lib/tdf3/src/tdf.ts @@ -726,8 +726,12 @@ export function splitLookupTableFactory( for (const kao of keyAccess) { const disjunction = splitPotentials[kao.sid ?? '']; if (kao.url in disjunction) { + // TODO(DSPX-3454): Implement fallback to no split ids when repetition is detected. + // Repetition occurs when multiple KAS keys share the same URL within a split. + // A proper fix would handle this by deduplicating or selecting the appropriate key. throw new InvalidFileError( - `TODO: Fallback to no split ids. Repetition found for [${kao.url}] on split [${kao.sid}]` + `Unable to decrypt: Multiple keys detected for Key Access Server [${kao.url}]. ` + + `Please contact your administrator.` ); } if (allowed(kao)) { From d739c3aac2388fad4dbad84f1e926490f2bf7f09 Mon Sep 17 00:00:00 2001 From: davidaronhopper-dev <60709242+davidaronhopper-dev@users.noreply.github.com> Date: Mon, 22 Jun 2026 20:53:36 +0000 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=A4=96=20=F0=9F=8E=A8=20Autoformat?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aaron Hopper --- lib/tdf3/src/tdf.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tdf3/src/tdf.ts b/lib/tdf3/src/tdf.ts index 308c0fb07..596094c55 100644 --- a/lib/tdf3/src/tdf.ts +++ b/lib/tdf3/src/tdf.ts @@ -731,7 +731,7 @@ export function splitLookupTableFactory( // A proper fix would handle this by deduplicating or selecting the appropriate key. throw new InvalidFileError( `Unable to decrypt: Multiple keys detected for Key Access Server [${kao.url}]. ` + - `Please contact your administrator.` + `Please contact your administrator.` ); } if (allowed(kao)) { From 9bff8cc5a195969ae776ecdc62eafe296637c45f Mon Sep 17 00:00:00 2001 From: Aaron Hopper Date: Mon, 22 Jun 2026 16:15:21 -0500 Subject: [PATCH 3/4] test: update error message assertion for duplicate KAS URLs Update test to match new customer-friendly error message. Signed-off-by: Aaron Hopper --- lib/tests/mocha/unit/tdf.spec.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tests/mocha/unit/tdf.spec.ts b/lib/tests/mocha/unit/tdf.spec.ts index 2e476ac3b..e1642f3c5 100644 --- a/lib/tests/mocha/unit/tdf.spec.ts +++ b/lib/tests/mocha/unit/tdf.spec.ts @@ -302,7 +302,7 @@ describe('splitLookupTableFactory', () => { expect(() => TDF.splitLookupTableFactory(keyAccess, allowedKases)).to.throw( InvalidFileError, - 'TODO: Fallback to no split ids. Repetition found for [https://kas1] on split [split1]' + 'Unable to decrypt: Multiple keys detected for Key Access Server [https://kas1]. Please contact your administrator.' ); }); From 179042f4a52e12d0839f75a3f7015c71aa1cc2c3 Mon Sep 17 00:00:00 2001 From: Aaron Hopper Date: Thu, 25 Jun 2026 11:37:01 -0500 Subject: [PATCH 4/4] fix(tdf3): update TODO comment based on review feedback Update TODO to reflect correct solution approach: use KID information already present in each KAO to differentiate keys from same KAS, rather than falling back to no split ids. Addresses ntrevino's review feedback on PR #952. DSPX-3454 --- lib/tdf3/src/tdf.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/tdf3/src/tdf.ts b/lib/tdf3/src/tdf.ts index 596094c55..9d03f20ed 100644 --- a/lib/tdf3/src/tdf.ts +++ b/lib/tdf3/src/tdf.ts @@ -726,9 +726,10 @@ export function splitLookupTableFactory( for (const kao of keyAccess) { const disjunction = splitPotentials[kao.sid ?? '']; if (kao.url in disjunction) { - // TODO(DSPX-3454): Implement fallback to no split ids when repetition is detected. - // Repetition occurs when multiple KAS keys share the same URL within a split. - // A proper fix would handle this by deduplicating or selecting the appropriate key. + // TODO(DSPX-3454): Handle duplicate KAS URLs with different KIDs. + // Each KAO contains a KID - the function should be updated to use this + // information to differentiate between keys from the same KAS. + // Cross-SDK validation needed via xtest. throw new InvalidFileError( `Unable to decrypt: Multiple keys detected for Key Access Server [${kao.url}]. ` + `Please contact your administrator.`