Add multi key id binding (supersedes #3472)

[PatStLouis]

Slimer version of #3472 with the same goals:

Updates the KeyInfo object so that the key id can now be an array.
Adds a binding/unbinding method for key id to key pair relationships.

[jamshale]

Looks good to me. I'll let other maintainers have a chance to review.

[jamshale]

Note: There is a few things that sonarcloud found. We don't need to fix all of them, but a few look like easy maintainability fixes.

https://sonarcloud.io/project/issues?id=openwallet-foundation_acapy&pullRequest=3762&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true

[Copilot]

Pull Request Overview

Adds support for multiple key identifiers per key pair and corresponding bind/unbind operations in the wallet API.

• KeyInfo now accepts a list of kids instead of a single string.
• MultikeyManager gained bind_key_id/unbind_key_id and updated its update method.
• Askar backend was extended to store and remove multiple kid tags and index by multikey.
• Tests were updated and a new test_key_id_binding was added.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
acapy_agent/wallet/keys/tests/test_key_operations.py	Updated existing key tests and added test_key_id_binding.
acapy_agent/wallet/keys/manager.py	Expanded MultikeyManager with bind/unbind logic and error handling.
acapy_agent/wallet/did_info.py	Changed KeyInfo.kid to Union[List[str], str].
acapy_agent/wallet/askar.py	Updated Askar wallet adapter to support list-based kid tags and multikey indexing.

Comments suppressed due to low confidence (6)

acapy_agent/wallet/keys/manager.py:218

• Docstring for update does not describe the method's return value (a dict containing kid and multikey). Consider updating the docstring to include the return format for clarity.

async def update(self, multikey: str, kid: str, unbind=False):

acapy_agent/wallet/keys/manager.py:220

• [nitpick] Using a ternary expression for asynchronous calls reduces readability. Consider replacing with a clear if unbind: ... else: ... block.

( await self.unbind_key_id(multikey, kid) if unbind else await self.bind_key_id(multikey, kid) )

acapy_agent/wallet/keys/tests/test_key_operations.py:61

• The new update(..., unbind=True) path in MultikeyManager.update is not covered by tests. Consider adding a test that exercises update with unbind=True to ensure the unbind logic works as expected.

async def test_key_id_binding(self):

acapy_agent/wallet/askar.py:24

• The import of verkey_to_multikey from .keys.manager appears incorrect, as verkey_to_multikey is defined in the util module. Consider importing it from the correct module (e.g., .util).

from .keys.manager import verkey_to_multikey

acapy_agent/wallet/keys/manager.py:183

• Catching broad wallet errors and logging the raw exception at INFO level may expose sensitive information. Consider narrowing the exception types handled or sanitizing the log output.

except (WalletDuplicateError, WalletError, WalletNotFoundError) as err:

acapy_agent/wallet/did_info.py:17

• The default value None for kid is not included in the declared Union[List[str], str]. Consider using Optional[Union[List[str], str]] or defaulting to an empty list for consistency.

kid: Union[List[str], str] = None

[esune]

Functional changes look good, just being a bit pedantic about log levels for error statements.

[PatStLouis]

@esune addressed your comment by updating the log level
@jamshale implemented 7 out of the 8 SonarQube recommendations

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[esune]

LGTM 👍🏻