Add 400 missing controller error to create space op.

Signed-off-by: Dmitri Zagidulin <dzagidulin@gmail.com>

Author: dmitrizagidulin

spec.md

@@ -355,13 +355,17 @@ To create a Space:
 * Perform an authenticated Create Space operation that includes a Proof of
   (cryptographic material) Possession via a mechanism such as HTTP Signatures.
 
-* The signing DID (from the proof of possession signature) is set as the 
-  Space's `controller`. See the [Space `controller` and the Root of 
-  Trust](#space-controller-and-the-root-of-trust) section for more details)
-
 * If an `id` is provided in the Create Space request, it must start with `urn:uuid`.
   If no `id` is provided, it will be generated by the storage server.
 
+* A `controller` MUST be provided in the request body.
+    * If no `controller` is provided, the server MUST return an HTTP 400 error
+      response
+    * The signing DID (from the proof of possession signature) MUST match the
+      Space's `controller`. This is how the root of trust is initially set up
+      (see the [Space `controller` and the Root of
+      Trust](#space-controller-and-the-root-of-trust) section for more details)
+
 * (Optional, out of scope) A given storage provider MAY impose additional
   requirements in order to create a Space for a given controller, such as:
   - a Verifiable Credential representing a pre-arranged onboarding coupon
@@ -380,7 +384,8 @@ Content-type: application/json
 Authorization: ...
 
 {
-  "name": "Example space #1"
+  "name": "Example space #1",
+  "controller": "did:key:z6MkpBMbMaRSv5nsgifRAwEKvHHoiKDMhiAHShTFNmkJNdVW"
 }
 ```
 
@@ -403,14 +408,64 @@ Note that in the example above:
 
 * the `id` was not specified in the body of the request, and so was generated by
   the server and returned in the response
-* the `controller` was not specified in the body of the request, it was determined
-  by the server (based on the Key ID in the `Authorization` header's HTTP 
-  Signature)
 
-Example error response (missing Proof of Possession signature, unable to 
-determine controller):
+#### Create Space Errors
+
+Example error response (missing `controller` property):
+
+```http
+HTTP/1.1 400 Bad Request
+Content-type: application/problem+json
+Content-Language: en
+
+{
+  "type": "https://wallet.storage/spec#create-space-errors",
+  "title": "Invalid Create Space request.",
+  "errors": [
+    {
+      "detail": "'controller' property is required.",
+      "pointer": "#/controller"
+    }
+  ]
+}
+```
+
+Example error response (missing Proof of Possession signature):
+
+```http
+HTTP/1.1 401 Unauthorized
+Content-type: application/problem+json
+Content-Language: en
 
-Example error response (invalid authorization):
+{
+  "type": "https://wallet.storage/spec#create-space-errors",
+  "title": "Invalid Create Space request.",
+  "errors": [
+    {
+      "detail": "Valid proof of possession of the 'controller' DID must be provided."
+    }
+  ]
+}
+```
+
+Example error response (invalid authorization - the signing DID in the `Authorization`
+header does not match the DID specified in the `controller`):
+
+```http
+HTTP/1.1 403 Forbidden
+Content-type: application/problem+json
+Content-Language: en
+
+{
+  "type": "https://wallet.storage/spec#create-space-errors",
+  "title": "Invalid Create Space request.",
+  "errors": [
+    {
+      "detail": "The signing DID from the Authorization header must match the 'controller' DID in request body."
+    }
+  ]
+}
+```
 
 Example error response (missing or insufficient onboarding material provided):