From 085ee7cdc00436270133506a5f4f086efd3e8708 Mon Sep 17 00:00:00 2001 From: swrup Date: Sun, 7 Dec 2025 01:09:59 +0100 Subject: [PATCH] . --- src/denomination.ml | 2 +- src/management.ml | 52 +++++++++++++++++++++++++----------------- src/pg.ml | 5 ++-- src/secmod_denom.ml | 16 +++++++++---- src/secmod_denom.mli | 8 ++++++- src/secmod_signkey.ml | 9 ++++---- src/secmod_signkey.mli | 5 +++- src/syntax.ml | 3 +++ 8 files changed, 65 insertions(+), 35 deletions(-) diff --git a/src/denomination.ml b/src/denomination.ml index 32eb469d..5a7c6202 100644 --- a/src/denomination.ml +++ b/src/denomination.ml @@ -15,7 +15,7 @@ type t = { fee_refund: Amount.t; age_mask: int; h_pub: Bin_type.DenominationHash.t; - master_sig: EddsaSignature.t option; + master_sig: Api_sig.DenominationKeyValidityPS.t option; } let make diff --git a/src/management.ml b/src/management.ml index 45addc53..d1ebb3ad 100644 --- a/src/management.ml +++ b/src/management.ml @@ -96,19 +96,16 @@ let mk_future_keys_response ~(sm_signkey : Secmod_signkey.t) (* - ** - *) -let verify_denom_signature ~sm_denoms DenomSignature.{ h_denom_pub; master_sig } +let verify_denom_signature ~sm_denom DenomSignature.{ h_denom_pub; master_sig } = let open Syntax in let denom_hash = Bin_type.DenominationHash.of_octets (HashCode.to_octets h_denom_pub) in let* denom = - let opt = - List.find_opt - (fun (denom : Denomination.t) -> denom.h_pub = denom_hash) - sm_denoms - in - match opt with + Secmod_denom.get_denoms sm_denom + |> List.find_opt (fun (denom : Denomination.t) -> denom.h_pub = denom_hash) + |> function | None -> Fmt.error "404 not found, One of the keys for which a signature was provided \ @@ -132,13 +129,12 @@ let verify_denom_signature ~sm_denoms DenomSignature.{ h_denom_pub; master_sig } in verify ~key:Config.master_public_key master_sig r -let verify_signkey_signature ~sm_signkeys SignKeySignature.{ key; master_sig } = +let verify_signkey_signature ~sm_signkey SignKeySignature.{ key; master_sig } = let open Syntax in let* signkey = - let opt = - List.find_opt (fun (signkey : Signkey.t) -> signkey.pub = key) sm_signkeys - in - match opt with + Secmod_signkey.get_signkeys sm_signkey + |> List.find_opt (fun (signkey : Signkey.t) -> signkey.pub = key) + |> function | None -> Fmt.error "404 not found, One of the keys for which a signature was provided \ @@ -156,18 +152,34 @@ let verify_signkey_signature ~sm_signkeys SignKeySignature.{ key; master_sig } = in verify ~key:Config.master_public_key master_sig r -let verify_master_signatures ~sm_signkeys ~sm_denoms +let verify_master_signatures ~sm_signkey ~sm_denom MasterSignatures.{ denom_sigs; signkey_sigs } = let open Syntax in - let* () = list_iter (verify_denom_signature ~sm_denoms) denom_sigs in - let* () = list_iter (verify_signkey_signature ~sm_signkeys) signkey_sigs in + let* () = list_iter (verify_denom_signature ~sm_denom) denom_sigs in + let* () = list_iter (verify_signkey_signature ~sm_signkey) signkey_sigs in Ok () (* --- *) -let update_master_signatures ~db_conn ~sm_signkey ~sm_denom:_ - MasterSignatures.{ denom_sigs= _; signkey_sigs } = - Secmod_signkey.add_master_signatures db_conn sm_signkey signkey_sigs +let update_master_signatures ~db_conn ~sm_signkey ~sm_denom + MasterSignatures.{ denom_sigs; signkey_sigs } = + let open Syntax in + let* () = + signkey_sigs + |> List.map (fun SignKeySignature.{ key; master_sig } -> (key, master_sig)) + |> Secmod_signkey.add_master_signatures db_conn sm_signkey + in + let* () = + denom_sigs + |> List.map (fun DenomSignature.{ h_denom_pub; master_sig } -> + (* TODO better denomination-hash type *) + let h_denom_pub = + Bin_type.DenominationHash.of_octets (HashCode.to_octets h_denom_pub) + in + (h_denom_pub, master_sig)) + |> Secmod_denom.add_master_signatures db_conn sm_denom + in + Ok () (* --- *) @@ -217,9 +229,7 @@ let keys_post req server _env = Error msg in let* () = - let sm_denoms = Secmod_denom.get_denoms sm_denom in - let sm_signkeys = Secmod_signkey.get_signkeys sm_signkey in - verify_master_signatures ~sm_signkeys ~sm_denoms master_signatures + verify_master_signatures ~sm_signkey ~sm_denom master_signatures in let* () = update_master_signatures ~db_conn ~sm_signkey ~sm_denom master_signatures diff --git a/src/pg.ml b/src/pg.ml index 57bfec70..9da8a192 100644 --- a/src/pg.ml +++ b/src/pg.ml @@ -119,9 +119,10 @@ let lookup_denomination_key = let add_denomination_key = let denomination_insert = + let master_sig = Api_sig.DenominationKeyValidityPS.caqti in Caqti_type.( - t12 denomination_hash rsa_public eddsa_signature time time time time - amount amount amount amount (t2 amount age_mask) + t12 denomination_hash rsa_public master_sig time time time time amount + amount amount amount (t2 amount age_mask) ->. unit) "INSERT INTO denominations (denom_pub_hash, denom_pub, master_sig, \ valid_from, expire_withdraw, expire_deposit, expire_legal, coin, \ diff --git a/src/secmod_denom.ml b/src/secmod_denom.ml index a2d6d6ea..3de76e66 100644 --- a/src/secmod_denom.ml +++ b/src/secmod_denom.ml @@ -12,12 +12,18 @@ let get_denoms t = Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.to_seq_values t.denom_ht |> List.of_seq -(* TODO *) -let update_denoms _conn t denoms = +let add_master_signatures conn t l = Miou.Mutex.protect t.lock @@ fun () -> - List.iter - (fun denom -> Hashtbl.replace t.denom_ht denom.Denomination.h_pub denom) - denoms + list_iter + (fun (h_denom_pub, master_sig) -> + match Hashtbl.find_opt t.denom_ht h_denom_pub with + | None -> Error "secmod_denom failure: denomination hash not found." + | Some denom -> + let denom = { denom with master_sig= Some master_sig } in + let* () = Pg.add_denomination_key conn denom |> unwrap_err_caqti in + Hashtbl.replace t.denom_ht h_denom_pub denom; + Ok ()) + l let dir = Fpath.(v "data" / "secmod_signkey") diff --git a/src/secmod_denom.mli b/src/secmod_denom.mli index 9c5b2413..0c373086 100644 --- a/src/secmod_denom.mli +++ b/src/secmod_denom.mli @@ -2,5 +2,11 @@ type t val get_sm_key : t -> Signkey.t val get_denoms : t -> Denomination.t list -val update_denoms : (module Pg.CONN) -> t -> Denomination.t list -> unit + +val add_master_signatures : + (module Pg.CONN) -> + t -> + (Bin_type.DenominationHash.t * Api_sig.DenominationKeyValidityPS.t) list -> + (unit, string) result + val init : (module Pg.CONN) -> t diff --git a/src/secmod_signkey.ml b/src/secmod_signkey.ml index 5a08b1b0..ccff6894 100644 --- a/src/secmod_signkey.ml +++ b/src/secmod_signkey.ml @@ -16,17 +16,18 @@ let get_signkeys t = Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.to_seq_values t.signkey_ht |> List.of_seq -(* TODO *) -let add_master_signatures _conn t l = +let add_master_signatures conn t l = Miou.Mutex.protect t.lock @@ fun () -> - l - |> Syntax.list_iter (fun Api.SignKeySignature.{ key= pub; master_sig } -> + list_iter + (fun (pub, master_sig) -> match Hashtbl.find_opt t.signkey_ht pub with | None -> Error "secmod_signkey failure: public key not found." | Some signkey -> let signkey = { signkey with master_sig= Some master_sig } in + let* () = Pg.activate_signing_key conn signkey |> unwrap_err_caqti in Hashtbl.replace t.signkey_ht pub signkey; Ok ()) + l let dir = Fpath.(v "data" / "secmod_signkey") diff --git a/src/secmod_signkey.mli b/src/secmod_signkey.mli index 70afb7f6..40c19702 100644 --- a/src/secmod_signkey.mli +++ b/src/secmod_signkey.mli @@ -4,6 +4,9 @@ val get_sm_key : t -> Signkey.t val get_signkeys : t -> Signkey.t list val add_master_signatures : - (module Pg.CONN) -> t -> Api.SignKeySignature.t list -> (unit, string) result + (module Pg.CONN) -> + t -> + (Crypto.EddsaPublicKey.t * Api_sig.ExchangeSigningKeyValidityPS.t) list -> + (unit, string) result val init : (module Pg.CONN) -> t diff --git a/src/syntax.ml b/src/syntax.ml index f354ca6c..c61aba15 100644 --- a/src/syntax.ml +++ b/src/syntax.ml @@ -4,6 +4,9 @@ let ( let+ ) o f = match o with Ok v -> Ok (f v) | Error _ as e -> e (* TODO use polymorphic variant for errors *) let unwrap_err_msg o = match o with Error (`Msg e) -> Error e | Ok v -> Ok v +let unwrap_err_caqti o = + match o with Error err -> Fmt.error "%a" Caqti_error.pp err | Ok v -> Ok v + let list_iter f l = let err = ref None in try