From 313af6504755f01f7cb9731bf3bf6692fd0a08cd Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Tue, 10 Feb 2026 14:48:02 +0100
Subject: [PATCH] clean up offline tool

---
 test/offline_management.sh |  37 +++++---
 tools/dune                 |   2 +-
 tools/offline.ml           |   6 +-
 tools/offline_impl.ml      | 171 ++++++++++++++++++++++++++++++++++---
 tools/offline_sig.ml       | 147 -------------------------------
 5 files changed, 184 insertions(+), 179 deletions(-)
 delete mode 100644 tools/offline_sig.ml

diff --git a/test/offline_management.sh b/test/offline_management.sh
index 01be21e0..119c46e0 100755
--- a/test/offline_management.sh
+++ b/test/offline_management.sh
@@ -2,27 +2,37 @@
 
 set -e
 
-a="tmp_a.json"
-b="tmp_b.json"
+a="/tmp/a.json"
+b="/tmp/b.json"
 
+url="http://localhost:3434"
 auditor_pub=$(<"./test/auditor_public_key")
 master_key="./default/master_offline_private_key"
 zero_euro="EUR:0.0"
 
-dune exec offline -- download --output $a
-dune exec offline -- sign --master_key $master_key --input $a --output $b
-dune exec offline -- upload --input $b --url "/management/keys"
+offline_tool() {
+   dune exec offline -- "$@" > /dev/null
+}
 
-dune exec offline -- enable-auditor \
+offline_tool download --output $a --url $url"/management/keys"
+offline_tool sign \
+--master_key $master_key \
+--input $a \
+--output $b
+offline_tool upload --input $b --url $url"/management/keys"
+echo "[OK] /management/keys"
+
+offline_tool enable-auditor \
 --master_key $master_key \
 --output $b \
 --auditor_url "auditor.example.com" \
 --auditor_name "auditor example" \
 --auditor_pub $auditor_pub \
 --validity_start 0
-dune exec offline -- upload --input $b --url "/management/auditors"
+offline_tool upload --input $b --url $url"/management/auditors"
+echo "[OK] /management/auditors"
 
-dune exec offline -- wire-fee \
+offline_tool wire-fee \
 --master_key $master_key \
 --output $b \
 --wire_method "xxx" \
@@ -30,9 +40,10 @@ dune exec offline -- wire-fee \
 --fee_end 99999999 \
 --closing_fee $zero_euro \
 --wire_fee $zero_euro
-dune exec offline -- upload --input $b --url "/management/wire-fee"
+offline_tool upload --input $b --url $url"/management/wire-fee"
+echo "[OK] /management/wire-fee"
 
-dune exec offline -- global-fees \
+offline_tool global-fees \
 --master_key $master_key \
 --output $b \
 --start_date 0 \
@@ -43,7 +54,5 @@ dune exec offline -- global-fees \
 --history_expiration 9999999 \
 --purse_account_limit 1 \
 --purse_timeout 9999999
-dune exec offline -- upload --input $b --url "/management/global-fees"
-
-rm $a
-rm $b
+offline_tool upload --input $b --url $url"/management/global-fees"
+echo "[OK] /management/global-fees"
diff --git a/tools/dune b/tools/dune
index 906889a7..4f5057ca 100644
--- a/tools/dune
+++ b/tools/dune
@@ -1,7 +1,7 @@
 (executable
  (public_name offline)
  (name offline)
- (modules offline offline_impl offline_sig)
+ (modules offline offline_impl)
  (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
 
 (executable
diff --git a/tools/offline.ml b/tools/offline.ml
index 9c94a61e..5864bd0c 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -1,5 +1,5 @@
 (* TODO
-   change download_cmd/upload_cmd
+   better cmd doc
    change arguments: '_' -> '-'
 
    all management operations:
@@ -99,8 +99,8 @@ let download_cmd =
   let doc = "GET" in
   Cmd.make (Cmd.info "download" ~doc)
   @@
-  let+ output = output in
-  download ~output
+  let+ output = output and+ url = url in
+  download ~output ~url
 
 let upload_cmd =
   let doc = "POST" in
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
index f436fe9c..d8a1fa18 100644
--- a/tools/offline_impl.ml
+++ b/tools/offline_impl.ml
@@ -1,6 +1,157 @@
 open Syntax
 open Hash
 
+module Future_keys = struct
+  open Crypto
+  open Api
+
+  let verify =
+    let verify_future_denom ~sm_denom_pub
+        FutureDenom.
+          {
+            section_name;
+            value= _;
+            stamp_start;
+            stamp_expire_withdraw;
+            stamp_expire_deposit= _;
+            stamp_expire_legal= _;
+            denom_pub;
+            fee_withdraw= _;
+            fee_deposit= _;
+            fee_refresh= _;
+            fee_refund= _;
+            denom_secmod_sig;
+          } =
+      let h_denom_pub =
+        DenominationHash.hash (DenominationKey.to_octets denom_pub)
+      in
+      let h_section_name = Hash.Cstring.H64.hash section_name in
+      let anchor_time = stamp_start in
+      let duration_withdraw =
+        Timestamp.diff stamp_start stamp_expire_withdraw
+      in
+      let open Signatures.DenominationKeyAnnouncement in
+      verify_f
+        ~f:(EddsaSignature.verify ~key:sm_denom_pub)
+        denom_secmod_sig
+        { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
+    in
+    let verify_future_signkey ~sm_signkey_pub
+        FutureSignKey.
+          { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
+      let exchange_pub = key in
+      let anchor_time = stamp_start in
+      let duration = Timestamp.diff stamp_start stamp_expire in
+      let open Signatures.SigningKeyAnnouncement in
+      verify_f
+        ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
+        signkey_secmod_sig
+        { exchange_pub; anchor_time; duration }
+    in
+    fun our_master_public_key
+      FutureKeysResponse.
+        {
+          future_denoms;
+          future_signkeys;
+          master_pub;
+          denom_secmod_public_key;
+          signkey_secmod_public_key;
+        }
+    ->
+      let* () =
+        match master_pub = our_master_public_key with
+        | false ->
+            Fmt.error
+              "master public key of the future key response does not match ours"
+        | true -> Ok ()
+      in
+      let* () =
+        list_iter
+          (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
+          future_denoms
+      in
+      let* () =
+        list_iter
+          (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
+          future_signkeys
+      in
+      Ok ()
+
+  let make =
+    let denom_signature ~master_key
+        FutureDenom.
+          {
+            section_name= _;
+            value;
+            stamp_start;
+            stamp_expire_withdraw;
+            stamp_expire_deposit;
+            stamp_expire_legal;
+            denom_pub;
+            fee_withdraw;
+            fee_deposit;
+            fee_refresh;
+            fee_refund;
+            denom_secmod_sig= _;
+          } =
+      let octets = DenominationKey.to_octets denom_pub in
+      let h_denom_pub = DenominationHash.hash octets in
+      let master_sig =
+        let open Signatures.DenominationKeyValidity in
+        let master = EddsaPrivateKey.(pub_of_priv master_key) in
+        sign_f
+          ~f:(EddsaSignature.sign ~key:master_key)
+          {
+            master;
+            start= stamp_start;
+            expire_withdraw= stamp_expire_withdraw;
+            expire_spend= stamp_expire_deposit;
+            expire_legal= stamp_expire_legal;
+            value;
+            fee_withdraw;
+            fee_deposit;
+            fee_refresh;
+            fee_refund;
+            denom_hash= h_denom_pub;
+          }
+      in
+      DenomSignature.{ h_denom_pub; master_sig }
+    in
+    let signkey_signature ~master_key
+        FutureSignKey.
+          { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
+      let master_sig =
+        let open Signatures.ExchangeSigningKeyValidity in
+        sign_f
+          ~f:(EddsaSignature.sign ~key:master_key)
+          {
+            start= stamp_start;
+            expire= stamp_expire;
+            end_= stamp_end;
+            signkey_pub= key;
+          }
+      in
+      SignKeySignature.{ key; master_sig }
+    in
+    fun ~master_key
+      FutureKeysResponse.
+        {
+          future_denoms;
+          future_signkeys;
+          master_pub= _;
+          denom_secmod_public_key= _;
+          signkey_secmod_public_key= _;
+        }
+    ->
+      let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
+      let signkey_sigs =
+        List.map (signkey_signature ~master_key) future_signkeys
+      in
+      MasterSignatures.{ denom_sigs; signkey_sigs }
+end
+
+(* -- *)
+
 let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg
 
 let write_file fname content =
@@ -10,21 +161,17 @@ let read_master_key_file filename =
   let* master_key = read_file filename in
   Crypto.EddsaPrivateKey.of_octets master_key
 
-let base_url = Uri.of_string "http://localhost:3434/"
-let full_url path = Uri.with_path base_url path |> Uri.to_string
-
-let download ~output =
+let download ~output ~url =
   let open Bos in
-  let uri = full_url "/management/keys/" in
-  OS.Cmd.run Cmd.(v "curl" % "-s" % "-o" % output % "-X" % "GET" % uri)
+  OS.Cmd.run Cmd.(v "curl" % "--silent" % "-o" % output % "-X" % "GET" % url)
   |> unwrap_err_msg
 
 let upload ~input ~url =
   let open Bos in
-  let uri = full_url url in
   OS.Cmd.run
     Cmd.(
       v "curl"
+      % "--silent"
       % "-i"
       % "-X"
       % "POST"
@@ -32,7 +179,7 @@ let upload ~input ~url =
       % "Content-Type: application/json"
       % "--data"
       % ("@" ^ input)
-      % uri)
+      % url)
   |> unwrap_err_msg
 
 let setup ~output =
@@ -49,12 +196,8 @@ let sign ~master_key ~input ~output =
   let* input = read_file input in
   let master_pub = EddsaPrivateKey.pub_of_priv master_key in
   let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in
-  let* () =
-    Offline_sig.verify_future_keys_response master_pub future_keys_response
-  in
-  let master_signatures =
-    Offline_sig.mk_future_keys ~master_key future_keys_response
-  in
+  let* () = Future_keys.verify master_pub future_keys_response in
+  let master_signatures = Future_keys.make ~master_key future_keys_response in
   let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
   let* () = write_file output s in
   Ok ()
diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml
deleted file mode 100644
index f89cca19..00000000
--- a/tools/offline_sig.ml
+++ /dev/null
@@ -1,147 +0,0 @@
-open Crypto
-open Api
-
-let verify_future_keys_response =
-  let verify_future_denom ~sm_denom_pub
-      FutureDenom.
-        {
-          section_name;
-          value= _;
-          stamp_start;
-          stamp_expire_withdraw;
-          stamp_expire_deposit= _;
-          stamp_expire_legal= _;
-          denom_pub;
-          fee_withdraw= _;
-          fee_deposit= _;
-          fee_refresh= _;
-          fee_refund= _;
-          denom_secmod_sig;
-        } =
-    let h_denom_pub =
-      DenominationHash.hash (DenominationKey.to_octets denom_pub)
-    in
-    let h_section_name = Hash.Cstring.H64.hash section_name in
-    let anchor_time = stamp_start in
-    let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
-    let open Signatures.DenominationKeyAnnouncement in
-    verify_f
-      ~f:(EddsaSignature.verify ~key:sm_denom_pub)
-      denom_secmod_sig
-      { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
-  in
-  let verify_future_signkey ~sm_signkey_pub
-      FutureSignKey.
-        { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
-    let exchange_pub = key in
-    let anchor_time = stamp_start in
-    let duration = Timestamp.diff stamp_start stamp_expire in
-    let open Signatures.SigningKeyAnnouncement in
-    verify_f
-      ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
-      signkey_secmod_sig
-      { exchange_pub; anchor_time; duration }
-  in
-
-  fun our_master_public_key
-    FutureKeysResponse.
-      {
-        future_denoms;
-        future_signkeys;
-        master_pub;
-        denom_secmod_public_key;
-        signkey_secmod_public_key;
-      }
-  ->
-    let open Syntax in
-    let* () =
-      match master_pub = our_master_public_key with
-      | false ->
-          Fmt.error
-            "master public key of the future key response does not match ours"
-      | true -> Ok ()
-    in
-    let* () =
-      list_iter
-        (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
-        future_denoms
-    in
-    let* () =
-      list_iter
-        (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
-        future_signkeys
-    in
-    Ok ()
-
-let mk_future_keys =
-  let denom_signature ~master_key
-      FutureDenom.
-        {
-          section_name= _;
-          value;
-          stamp_start;
-          stamp_expire_withdraw;
-          stamp_expire_deposit;
-          stamp_expire_legal;
-          denom_pub;
-          fee_withdraw;
-          fee_deposit;
-          fee_refresh;
-          fee_refund;
-          denom_secmod_sig= _;
-        } =
-    let octets = DenominationKey.to_octets denom_pub in
-    let h_denom_pub = DenominationHash.hash octets in
-    let master_sig =
-      let open Signatures.DenominationKeyValidity in
-      let master = EddsaPrivateKey.(pub_of_priv master_key) in
-      sign_f
-        ~f:(EddsaSignature.sign ~key:master_key)
-        {
-          master;
-          start= stamp_start;
-          expire_withdraw= stamp_expire_withdraw;
-          expire_spend= stamp_expire_deposit;
-          expire_legal= stamp_expire_legal;
-          value;
-          fee_withdraw;
-          fee_deposit;
-          fee_refresh;
-          fee_refund;
-          denom_hash= h_denom_pub;
-        }
-    in
-    DenomSignature.{ h_denom_pub; master_sig }
-  in
-  let signkey_signature ~master_key
-      FutureSignKey.
-        { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
-    let master_sig =
-      let open Signatures.ExchangeSigningKeyValidity in
-      sign_f
-        ~f:(EddsaSignature.sign ~key:master_key)
-        {
-          start= stamp_start;
-          expire= stamp_expire;
-          end_= stamp_end;
-          signkey_pub= key;
-        }
-    in
-    SignKeySignature.{ key; master_sig }
-  in
-
-  fun ~master_key
-    FutureKeysResponse.
-      {
-        future_denoms;
-        future_signkeys;
-        master_pub= _;
-        denom_secmod_public_key= _;
-        signkey_secmod_public_key= _;
-      }
-  ->
-    let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
-    let signkey_sigs =
-      List.map (signkey_signature ~master_key) future_signkeys
-    in
-    MasterSignatures.{ denom_sigs; signkey_sigs }