From 008bb6b0fe10a3df349e8c4fb81564e644d1d825 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Thu, 22 Jan 2026 02:51:41 +0100
Subject: [PATCH] + wip exchange_sig

---
 src/bin_sig.ml   |  5 +++++
 src/http_keys.ml | 46 ++++++++++++++++++++++++++++++++++++++++++++--
 src/secmod.mli   |  1 +
 3 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/src/bin_sig.ml b/src/bin_sig.ml
index 70d86584..6caece8b 100644
--- a/src/bin_sig.ml
+++ b/src/bin_sig.ml
@@ -92,6 +92,10 @@ end) : sig
 
   val jsont : t Jsont.t
   val caqti : t Caqti_type.t
+
+  (* TODO rm *)
+  (* escape hatch, only needed for /keys `exchange_sig` (signature over contatentation of all of the master_sigs) *)
+  val to_octets : t -> string
 end = struct
   open Crypto
 
@@ -102,6 +106,7 @@ end = struct
   let verify_f ~f t r = f t ~msg:(Bin.to_string R.bin r)
   let jsont = EddsaSignature.jsont
   let caqti : EddsaSignature.t Caqti_type.t = EddsaSignature.caqti
+  let to_octets t = EddsaSignature.to_octets t
 end
 
 module DenominationKeyAnnouncement = struct
diff --git a/src/http_keys.ml b/src/http_keys.ml
index 020cc7fa..ec40ab0e 100644
--- a/src/http_keys.ml
+++ b/src/http_keys.ml
@@ -93,10 +93,52 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
   let wallet_balance_limit_without_kyc = None in
   let hard_limits = [] in
   let zero_limits = [] in
-  let* denominations =
-    let+ denom_data_l = Pg.get_denominations db_conn |> unwrap_err_caqti in
+  let* denom_data_l = Pg.get_denominations db_conn |> unwrap_err_caqti in
+  (* TODO check order!! *)
+  let denom_data_l =
+    List.sort
+      (fun a b ->
+        let open Denom_data in
+        Stdlib.compare a.stamp_start b.stamp_start)
+      denom_data_l
+  in
+  let list_issue_date =
+    (* TODO is this the last [stamp_start] value? *)
+    (* date when the denomination keys were last updated *)
+    match denom_data_l with
+    | [] -> None
+    | v :: _ -> v.stamp_start
+  in
+  let denominations =
+    (* TODO really need to understand and correctly group denoms *)
     List.map denomgroup_of_denomdata denom_data_l
   in
+
+  let exchange_pub =
+    (* the eddsa pub key used to sign exchange_sig *)
+    Obj.magic ""
+  in
+  let exchange_sig =
+    (* Compact EdDSA signature (binary-only) over the
+       contatentation of all of the master_sigs (in reverse
+       chronological order by group) in the arrays under "denominations". *)
+    let l =
+      List.map
+        (fun v ->
+          match v.Denom_data.master_sig with
+          | None -> Fmt.failwith "denom_data without master_sig"
+          | Some v -> v)
+        denom_data_l
+    in
+    let l = List.map (fun v -> Bin_sig.DenominationKeyValidity.to_octets v) l in
+    let data = String.concat "" l in
+    let hc = Bin_type.Hash_64.hash data in
+    let open Bin_sig.ExchangeKeySet in
+    sign_f
+      ~f:(Secmod.sign_with_signkey sm ~pub:exchange_pub)
+      R.{ list_issue_date; hc }
+  in
+
   (*
       {
         version;
diff --git a/src/secmod.mli b/src/secmod.mli
index 9dda7677..9262bf65 100644
--- a/src/secmod.mli
+++ b/src/secmod.mli
@@ -1,3 +1,4 @@
+(* TODO functorize *)
 open Crypto
 
 type t