Multisig OOBI is missing end role authorization messages after member joins

[lenkan]

There is a bug when a group is created with a signing threshold that is less than 100%. For example, consider a group with 3 members and a signing threshold of 2.

Affected versions

• main as of 2024-10-11
• 0.2.0-dev3
• Probably before as well

Steps to reproduce

1. Member 1 and 2 creates group consisting of member 1, 2, and 3
2. Member 1 and 2 authorizes the end role for the agent of member 1
3. Generate OOBI and verify that the oobi contains the /end/role/add message
4. Member 3 creates the group
5. Generate OOBI and verify that the oobi contains the /end/role/add message

Expected result

The /end/role/add message can be found in the oobi response in both step 3 and 5

Actual result

The /end/role/add message is missing from the oobi in step 5.

Notes

A reproduction is available here: https://github.com/nordlei/vlei-sandbox/blob/main/src/issues/multisig-join-late-no-endroles.test.ts

This happens because all three group members are using the same KERIA instance and currently, when KERIA responds to an OOBI request, it reads this information from the last agent that joined the group. In this case, that agent does not yet have the end role information.

[lenkan]

This is where the agent is loaded for the oobi request: https://github.com/WebOfTrust/keria/blob/56534bff7bb7a9efabb64e846f96cb1f084cf837/src/keria/end/ending.py#L87

It will return the agent that was the last one to call "incept" on the agency for the group. I was able to resolve this issue by requiring the eid parameter on the OOBI endpoint and use that to retrieve the agent instead. In other words, KERIA would require you to specify which agent to load the OOBI from.

[2byrds]

@Arsh-Sandhu noted there was a change to keripy that only returns one OOBI. It used to return the set of OOBIs.