add denom revoke

src/api.ml

@@ -69,6 +69,7 @@ module HashCode : sig
   type t
 
   val hash : string -> t
+  val of_b32 : B32.t -> (t, string) result
   val to_denomination_hash : t -> Bin_type.DenominationHash.t
   val jsont : t Jsont.t
 end = struct
@@ -80,6 +81,7 @@ end = struct
     let open Digestif.SHA512 in
     s |> digest_string |> to_raw_string
 
+  let of_b32 = B32.decode
   let jsont = B32.jsont
 end
 

src/handler.ml

@@ -26,7 +26,7 @@ end
 include Respond_util
 open Api
 
-let keys_get req server _env =
+let management_keys_get req server _env =
   let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
   let sm_denom = Vif.Server.device Devices.secmod_denom server in
   let res =
@@ -36,9 +36,9 @@ let keys_get req server _env =
   in
   respond_with_res res req
 
-let keys_post_jsont = MasterSignatures.jsont
+let management_keys_post_jsont = MasterSignatures.jsont
 
-let keys_post req server _env =
+let management_keys_post req server _env =
   let open Syntax in
   let open Management in
   let db_conn = Vif.Server.device Devices.db_connection server in
@@ -55,3 +55,21 @@ let keys_post req server _env =
     Ok ""
   in
   respond_with_res res req
+
+let management_denom_revoke_jsont = DenomRevocationSignature.jsont
+
+let management_denom_revoke req h_denom_pub server _env =
+  let open Syntax in
+  let open Management in
+  let db_conn = Vif.Server.device Devices.db_connection server in
+  let _sm_signkey = Vif.Server.device Devices.secmod_signkey server in
+  let sm_denom = Vif.Server.device Devices.secmod_denom server in
+  let res =
+    let* h_denom_pub = HashCode.of_b32 h_denom_pub in
+    let h_denom_pub = HashCode.to_denomination_hash h_denom_pub in
+    let* v = Vif.Request.of_json req |> unwrap_err_msg in
+    let* () = verify_denom_revocation_sig h_denom_pub v in
+    let* () = update_denom_revocation ~db_conn ~sm_denom h_denom_pub v in
+    Ok ""
+  in
+  respond_with_res res req

src/management.ml

@@ -213,3 +213,18 @@ let update_master_signatures ~db_conn ~sm_signkey ~sm_denom
   in
   let* () = check_master_signatures_update ~db_conn ~sm_denom in
   Ok ()
+
+let verify_denom_revocation_sig h_denom_pub
+    DenomRevocationSignature.{ master_sig } =
+  let open Bin_sig.MasterDenominationKeyRevocation in
+  verify ~key:Config.Exchange.master_public_key master_sig { h_denom_pub }
+
+let update_denom_revocation ~db_conn ~sm_denom h_denom_pub
+    DenomRevocationSignature.{ master_sig } =
+  let open Syntax in
+  let* () = Secmod_denom.revoke_denomination sm_denom h_denom_pub master_sig in
+  let* () =
+    Pg.insert_denomination_revocation db_conn h_denom_pub master_sig
+    |> unwrap_err_caqti
+  in
+  Ok ()

src/mte.ml

@@ -32,8 +32,13 @@ let routes =
     get_ rel --> hello;
     get_ (v "terms") --> Static.terms;
     get_ (v "privacy") --> Static.privacy;
-    get_ (v "management" / "keys") --> keys_get;
+    get_ (v "management" / "keys") --> management_keys_get;
-    post (v "management" / "keys") keys_post_jsont --> keys_post;
+    post (v "management" / "keys") management_keys_post_jsont
+    --> management_keys_post;
+    post
+      (v "management" / "denominations" /% string `Path / "revoke")
+      management_denom_revoke_jsont
+    --> management_denom_revoke;
   ]
 
 let () =

src/pg.ml

@@ -158,3 +158,14 @@ let add_denomination_key =
         fee_deposit,
         fee_refresh,
         (fee_refund, age_mask) )
+
+let insert_denomination_revocation =
+  let denomination_revocation_insert =
+    let master_sig = Bin_sig.MasterDenominationKeyRevocation.caqti in
+    Caqti_type.(t2 denomination_hash master_sig ->. unit)
+      "INSERT INTO denomination_revocations (denominations_serial, master_sig) \
+       SELECT denominations_serial, $2 FROM denominations WHERE \
+       denom_pub_hash=$1"
+  in
+  fun (module Conn : CONN) h_denom_pub master_sig ->
+    Conn.exec denomination_revocation_insert (h_denom_pub, master_sig)

src/secmod_denom.ml

@@ -1,9 +1,15 @@
 open Syntax
 
+type h_denom_pub = Bin_type.DenominationHash.t
+
 type t = {
   lock: Miou.Mutex.t;
   sm_key: Signkey.t;
-  denom_ht: (Bin_type.DenominationHash.t, Denomination.t) Hashtbl.t;
+  denom_ht: (h_denom_pub, Denomination.t) Hashtbl.t;
+  revoked_ht:
+    ( h_denom_pub,
+      Denomination.t * Bin_sig.MasterDenominationKeyRevocation.t )
+    Hashtbl.t;
 }
 
 let get_sm_key t = t.sm_key
@@ -27,8 +33,18 @@ let add_master_signatures conn t l =
           Ok ())
     l
 
+let revoke_denomination t h_denom_pub master_sig =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  match Hashtbl.find_opt t.denom_ht h_denom_pub with
+  | None -> Error "secmod_denom failure: denomination hash not found."
+  | Some denom ->
+      Hashtbl.remove t.denom_ht h_denom_pub;
+      Hashtbl.replace t.revoked_ht h_denom_pub (denom, master_sig);
+      Ok ()
+
 let dir = Fpath.(v "data" / "secmod_signkey")
 
+(* TODO secmod store *)
 let _store_secmod_data t =
   let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key.priv in
   get_denoms t
@@ -67,7 +83,8 @@ let load conn =
         |> List.to_seq
         |> Hashtbl.of_seq
       in
-      Ok (Some { lock; sm_key; denom_ht })
+      let revoked_ht = Hashtbl.create 0xff in
+      Ok (Some { lock; sm_key; denom_ht; revoked_ht })
   | _, _ -> error_invalid_state
 
 let make_new () =
@@ -80,7 +97,8 @@ let make_new () =
     |> List.to_seq
     |> Hashtbl.of_seq
   in
-  { lock; sm_key; denom_ht }
+  let revoked_ht = Hashtbl.create 0xff in
+  { lock; sm_key; denom_ht; revoked_ht }
 
 let init conn =
   match load conn with

src/secmod_denom.mli

@@ -1,3 +1,6 @@
+open Bin_sig
+
+type h_denom_pub = Bin_type.DenominationHash.t
 type t
 
 val get_sm_key : t -> Signkey.t
@@ -6,7 +9,10 @@ val get_denoms : t -> Denomination.t list
 val add_master_signatures :
   (module Pg.CONN) ->
   t ->
-  (Bin_type.DenominationHash.t * Bin_sig.DenominationKeyValidity.t) list ->
+  (h_denom_pub * DenominationKeyValidity.t) list ->
   (unit, string) result
 
+val revoke_denomination :
+  t -> h_denom_pub -> MasterDenominationKeyRevocation.t -> (unit, string) result
+
 val init : (module Pg.CONN) -> t