From 195c6fa36d35806f02c4134e563affd3436e95c1 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Fri, 20 Feb 2026 13:45:05 +0100
Subject: [PATCH]

---
 src/keys.ml  | 97 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/time.mli |  1 +
 2 files changed, 98 insertions(+)

diff --git a/src/keys.ml b/src/keys.ml
index cbfc4234..cd5d3517 100644
--- a/src/keys.ml
+++ b/src/keys.ml
@@ -175,6 +175,103 @@ module Make (Conn : Pg.CONN) = struct
     | None -> Fmt.error "Keys: denomination data not found in database"
     | Some dn_data -> Ok dn_data
 
+  let find_signkey pub = Pg.find_signkey conn pub |> unwrap_err_caqti
+  let find_denom h_pub = Pg.find_denom conn h_pub |> unwrap_err_caqti
+
+  (* TODO check stamps definitions *)
+  let mk_future_sk pub start expire =
+    let stamp_start = Timestamp.of_absolute start in
+    let stamp_expire = Timestamp.of_absolute expire in
+    let stamp_end = stamp_expire in
+    let signkey_secmod_sig =
+      let open Signatures.SigningKeyAnnouncement in
+      let exchange_pub = pub in
+      let anchor_time = stamp_start in
+      let duration = Timestamp.diff stamp_start stamp_expire in
+      sign_f ~f:Secmod_eddsa.sign_with_sm_key
+        { exchange_pub; anchor_time; duration }
+    in
+    Api.FutureSignKey.
+      { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
+
+  let _get_future_sk () =
+    Secmod_eddsa.keys ()
+    |> List.map (fun (pub, t1, t2) ->
+        let* opt = find_signkey pub in
+        match opt with
+        | None ->
+            let future_sk = mk_future_sk pub t1 t2 in
+            Ok (Some future_sk)
+        | Some sk -> (
+            match Timestamp.of_absolute t1 = sk.stamp_start with
+            | false ->
+                Fmt.error
+                  "secmod/database stamp_start mismatch for signkey `%s`"
+                  (EddsaPublicKey.to_b32 pub)
+            | true -> Ok None))
+
+  let make_future_dn t ~section_name ~pub start _end_ =
+    let stamp_start = Timestamp.of_absolute start in
+    let stamp_expire_withdraw =
+      Timestamp.of_absolute @@ Time.Absolute.add start duration_withdraw
+    in
+    let stamp_expire_deposit =
+      Timestamp.of_absolute @@ Time.Absolute.add start duration_spend
+    in
+    let stamp_expire_legal =
+      Timestamp.of_absolute @@ Time.Absolute.add start duration_legal
+    in
+    let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in
+    let open Api in
+    let rsa_denomination_key =
+      RsaDenominationKey.{ age_mask= 0; rsa_pub= pub }
+    in
+    let denom_pub = DenominationKey.Rsa rsa_denomination_key in
+    let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
+    let denom_secmod_sig =
+      let open Signatures.DenominationKeyAnnouncement in
+      let h_denom_pub = h_pub in
+      let h_section_name = Hash.Cstring.H64.hash section_name in
+      let anchor_time = stamp_start in
+      let duration_withdraw =
+        Timestamp.diff stamp_start stamp_expire_withdraw
+      in
+      sign_f ~f:Secmod_rsa.sign_with_sm_key
+        { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
+    in
+    FutureDenom.
+      {
+        section_name;
+        value;
+        stamp_start;
+        stamp_expire_withdraw;
+        stamp_expire_deposit;
+        stamp_expire_legal;
+        denom_pub;
+        fee_withdraw;
+        fee_deposit;
+        fee_refresh;
+        fee_refund;
+        denom_secmod_sig;
+      }
+
+  let _get_future_dn () =
+    Secmod_rsa.keys ()
+    |> List.map (fun (section_name, pub, t1, t2) ->
+        let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
+        let* opt = find_denom h_pub in
+        match opt with
+        | None ->
+            let future_dn = mk_future_dn ~section_name ~h_pub ~pub t1 t2 in
+            Ok (Some future_dn)
+        | Some sk -> (
+            match Timestamp.of_absolute t1 = sk.stamp_start with
+            | false ->
+                Fmt.error
+                  "secmod/database stamp_start mismatch for denomination `%s`"
+                  section_name
+            | true -> Ok None))
+
   let list_to_ht l = Hashtbl.of_seq (List.to_seq l)
 
   let load () =
diff --git a/src/time.mli b/src/time.mli
index 180df904..544e92f9 100644
--- a/src/time.mli
+++ b/src/time.mli
@@ -46,6 +46,7 @@ module Timestamp : sig
   val of_absolute : Absolute.t -> t
   val of_ptime : Ptime.t -> t
 
+  (* TODO add pp *)
   (* - *)
   val bin : t Bin.t
   val bin_nbo : t Bin.t