~

src/http_keys.ml

@@ -194,7 +194,9 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
   let* global_fees =
     Pg.get_global_fees db_conn ~start_date:Timestamp.epoch |> unwrap_err_caqti
   in
-  let auditors = (* TODO *) [] in
+  let auditors =
+    (* TODO /management/auditors + /auditors/$AUDITOR_PUB/$H_DENOM_PUB *) []
+  in
   let extensions = None in
   let extensions_sig = None in
   Ok

src/pg.ml

@@ -205,7 +205,7 @@ let _get_auditor_denoms =
   in
   fun (module Conn : CONN) () -> Conn.collect_list get_auditor_denoms ()
 
-(* TODO
+(* TODO auditors
    maybe check that url and name are unique/same for each auditor_pub
    do the ht logic out of pg.ml *)
 let get_auditor_keys =

tools/offline.ml

@@ -2,24 +2,46 @@ open Cmdliner
 open Cmdliner.Term.Syntax
 open Offline_impl
 
+module Arg = struct
+  include Arg
+
+  let timestamp =
+    Arg.Conv.make ~docv:"timestamp argument" ~parser:Timestamp.of_string
+      ~pp:Timestamp.pp ()
+
+  let relative_time =
+    Arg.Conv.make ~docv:"relative time argument"
+      ~parser:Timestamp.Span.of_string ~pp:Timestamp.Span.pp ()
+
+  let amount =
+    Arg.Conv.make ~docv:"amount argument" ~parser:Amount.of_string ~pp:Amount.pp
+      ()
+end
+
 let default_master_offline_key_file = "data/master_offline_private_key"
+(*
 let default_response_file = "response.json"
 let default_request_file = "request.json"
+*)
 
-(*let to_term_ret = function Error e -> `Error (false, e) | Ok () -> `Ok ()*)
-let to_term_ret = Fun.id
+let master_key =
+  let doc = "Master offline Eddsa private key file." in
+  Arg.(
+    value
+    & opt file default_master_offline_key_file
+    & info [ "master_key_file" ] ~doc)
 
-let timestamp =
-  Arg.Conv.make ~docv:"timestamp argument" ~parser:Timestamp.of_string
-    ~pp:Timestamp.pp ()
+let input =
+  let doc = "input file" in
+  Arg.(required & opt (some file) None & info [ "i"; "input" ] ~doc)
 
-let relative_time =
-  Arg.Conv.make ~docv:"relative time argument" ~parser:Timestamp.Span.of_string
-    ~pp:Timestamp.Span.pp ()
+let output =
+  let doc = "output file" in
+  Arg.(required & opt (some filepath) None & info [ "o"; "output" ] ~doc)
 
-let amount =
-  Arg.Conv.make ~docv:"amount argument" ~parser:Amount.of_string ~pp:Amount.pp
-    ()
+let url =
+  let doc = "url" in
+  Arg.(required & opt (some string) None & info [ "url" ] ~doc)
 
 let setup_cmd =
   let doc = "Generate offline master keys" in
@@ -33,56 +55,31 @@ let setup_cmd =
   Cmd.make (Cmd.info "setup" ~doc)
   @@
   let+ output = output in
-  setup ~output |> to_term_ret
+  setup ~output
 
 let download_cmd =
   let doc = "GET /management/keys/" in
   let man =
     [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ]
   in
-  let output =
-    let doc = "output file" in
-    Arg.(
-      value & opt filepath default_response_file & info [ "o"; "output" ] ~doc)
-  in
   Cmd.make (Cmd.info "download" ~doc ~man)
   @@
   let+ output = output in
-  download ~output |> to_term_ret
+  download ~output
 
 let upload_cmd =
   let doc = "POST input.json data to url (default /management/keys)" in
-  let input =
-    let doc = "input file" in
-    Arg.(value & opt file default_request_file & info [ "i"; "input" ] ~doc)
-  in
-  let url =
-    let doc = "url" in
-    Arg.(value & opt string "/management/keys" & info [ "url" ] ~doc)
-  in
   Cmd.make (Cmd.info "upload" ~doc)
   @@
   let+ input = input and+ url = url in
-  upload ~input ~url |> to_term_ret
-
-let master_key =
-  let doc = "Master offline Eddsa private key file." in
-  Arg.(value & opt file default_master_offline_key_file & info [ "key" ] ~doc)
-
-let input =
-  let doc = "input file" in
-  Arg.(value & opt file default_response_file & info [ "i"; "input" ] ~doc)
-
-let output =
-  let doc = "output file" in
-  Arg.(value & opt filepath default_request_file & info [ "o"; "output" ] ~doc)
+  upload ~input ~url
 
 let sign_cmd =
   let doc = "Sign FutureKeysResponse." in
   Cmd.make (Cmd.info "sign" ~doc)
   @@
   let+ input = input and+ output = output and+ master_key = master_key in
-  sign ~input ~output ~master_key |> to_term_ret
+  sign ~input ~output ~master_key
 
 let revoke_denom_cmd =
   let doc = "Revoke denomination." in
@@ -93,7 +90,7 @@ let revoke_denom_cmd =
   Cmd.make (Cmd.info "revoke-denom" ~doc)
   @@
   let+ output = output and+ master_key = master_key and+ h_denom = h_denom in
-  revoke_denom ~output ~master_key ~h_denom |> to_term_ret
+  revoke_denom ~output ~master_key ~h_denom
 
 let revoke_signkey_cmd =
   let doc = "Revoke signkey." in
@@ -104,7 +101,7 @@ let revoke_signkey_cmd =
   Cmd.make (Cmd.info "revoke-signkey" ~doc)
   @@
   let+ output = output and+ master_key = master_key and+ signkey = signkey in
-  revoke_signkey ~output ~master_key ~signkey |> to_term_ret
+  revoke_signkey ~output ~master_key ~signkey
 
 let global_fees_cmd =
   let doc = "Provides global fee configuration." in
@@ -148,7 +145,6 @@ let global_fees_cmd =
   global_fees ~output ~master_key ~start_date ~end_date ~history_fee
     ~account_fee ~purse_fee ~history_expiration ~purse_account_limit
     ~purse_timeout
-  |> to_term_ret
 
 let cli =
   let info =
@@ -168,3 +164,13 @@ let cli =
 
 let main () = Cmd.eval_result cli
 let () = if !Sys.interactive then () else exit (main ())
+
+(* TODO all management operations:
+     /management/auditors
+     /management/auditors/$AUDITOR_PUB/disable
+     /management/wire-fee
+     /management/wire
+     /management/wire/disable
+     /management/drain
+     /management/aml-officers
+     /management/partners *)

tools/offline_impl.ml

@@ -5,6 +5,10 @@ let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg
 let write_file fname content =
   Bos.OS.File.write (Fpath.v fname) content |> unwrap_err_msg
 
+let read_master_key_file filename =
+  let* master_key = read_file filename in
+  Crypto.EddsaPrivateKey.of_octets master_key
+
 let base_url = Uri.of_string "http://localhost:3434/"
 let full_url path = Uri.with_path base_url path |> Uri.to_string
 
@@ -40,39 +44,46 @@ let setup ~output =
 
 let sign ~master_key ~input ~output =
   let open Crypto in
+  let* master_key = read_master_key_file master_key in
   let* input = read_file input in
-  let* master_key = read_file master_key in
-  let* master_key = EddsaPrivateKey.of_octets master_key in
   let master_pub = EddsaPrivateKey.pub_of_priv master_key in
   let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in
   let* () =
     Offline_sig.verify_future_keys_response master_pub future_keys_response
   in
   let master_signatures =
-    Offline_sig.make_master_signatures ~master_key future_keys_response
+    Offline_sig.mk_future_keys ~master_key future_keys_response
   in
   let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
   let* () = write_file output s in
   Ok ()
 
 let revoke_denom ~output ~master_key ~h_denom =
-  let open Crypto in
-  let* key = read_file master_key in
-  let* key = EddsaPrivateKey.of_octets key in
+  let* key = read_master_key_file master_key in
   let* h_denom = B32.decode h_denom in
-  let h_denom = Bin_type.DenominationHash.of_octets h_denom in
-  let denom_revoke = Offline_sig.mk_denom_revoke ~key h_denom in
+  let h_denom_pub = Bin_type.DenominationHash.of_octets h_denom in
+  let denom_revoke =
+    let master_sig =
+      let open Bin_sig.MasterDenominationKeyRevocation in
+      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { h_denom_pub }
+    in
+    Api.DenomRevocationSignature.{ master_sig }
+  in
   let* s = Api.encode Api.DenomRevocationSignature.jsont denom_revoke in
   let* () = write_file output s in
   Ok ()
 
 let revoke_signkey ~output ~master_key ~signkey =
-  let open Crypto in
-  let* key = read_file master_key in
-  let* key = EddsaPrivateKey.of_octets key in
-  let* signkey = EddsaPublicKey.of_b32 signkey in
-  let v = Offline_sig.mk_signkey_revoke ~key signkey in
-  let* s = Api.encode Api.SignkeyRevocationSignature.jsont v in
+  let* key = read_master_key_file master_key in
+  let* exchange_pub = Crypto.EddsaPublicKey.of_b32 signkey in
+  let signkey_revoke =
+    let master_sig =
+      let open Bin_sig.MasterSigningKeyRevocation in
+      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { exchange_pub }
+    in
+    Api.SignkeyRevocationSignature.{ master_sig }
+  in
+  let* s = Api.encode Api.SignkeyRevocationSignature.jsont signkey_revoke in
   let* () = write_file output s in
   Ok ()
 
@@ -80,8 +91,7 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
     ~account_fee ~purse_fee ~history_expiration ~purse_account_limit
     ~purse_timeout =
   let open Crypto in
-  let* key = read_file master_key in
-  let* key = EddsaPrivateKey.of_octets key in
+  let* key = read_master_key_file master_key in
   let* purse_account_limit =
     match
       purse_account_limit >= 0
@@ -124,5 +134,4 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
       }
   in
   let* s = Api.encode Api.GlobalFees.jsont global_fees in
-  let* () = write_file output s in
-  Ok ()
+  write_file output s

tools/offline_sig.ml

@@ -2,116 +2,49 @@ open Crypto
 open Bin_type
 open Api
 
-let denom_signature ~master_key
-    FutureDenom.
-      {
-        section_name= _;
-        value;
-        stamp_start;
-        stamp_expire_withdraw;
-        stamp_expire_deposit;
-        stamp_expire_legal;
-        denom_pub;
-        fee_withdraw;
-        fee_deposit;
-        fee_refresh;
-        fee_refund= _;
-        denom_secmod_sig= _;
-      } =
-  let octets = DenominationKey.to_octets denom_pub in
-  let h_denom_pub = DenominationHash.hash octets in
-  let master_sig =
-    let open Bin_sig.DenominationKeyValidity in
-    let master = EddsaPrivateKey.(pub_of_priv master_key) in
-    sign_f
-      ~f:(EddsaSignature.sign ~key:master_key)
-      {
-        master;
-        start= stamp_start;
-        expire_withdraw= stamp_expire_withdraw;
-        expire_spend= stamp_expire_deposit;
-        expire_legal= stamp_expire_legal;
-        value;
-        fee_withdraw;
-        fee_deposit;
-        fee_refresh;
-        denom_hash= h_denom_pub;
-      }
+let verify_future_keys_response =
+  let verify_future_denom ~sm_denom_pub
+      FutureDenom.
+        {
+          section_name;
+          value= _;
+          stamp_start;
+          stamp_expire_withdraw;
+          stamp_expire_deposit= _;
+          stamp_expire_legal= _;
+          denom_pub;
+          fee_withdraw= _;
+          fee_deposit= _;
+          fee_refresh= _;
+          fee_refund= _;
+          denom_secmod_sig;
+        } =
+    let h_denom_pub =
+      DenominationHash.hash (DenominationKey.to_octets denom_pub)
+    in
+    let h_section_name = Hash_64_cstr.hash section_name in
+    let anchor_time = stamp_start in
+    let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
+    let open Bin_sig.DenominationKeyAnnouncement in
+    verify_f
+      ~f:(EddsaSignature.verify ~key:sm_denom_pub)
+      denom_secmod_sig
+      { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
   in
-  DenomSignature.{ h_denom_pub; master_sig }
-
-let signkey_signature ~master_key
-    FutureSignKey.
-      { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
-  let master_sig =
-    let open Bin_sig.ExchangeSigningKeyValidity in
-    sign_f
-      ~f:(EddsaSignature.sign ~key:master_key)
-      {
-        start= stamp_start;
-        expire= stamp_expire;
-        end_= stamp_end;
-        signkey_pub= key;
-      }
+  let verify_future_signkey ~sm_signkey_pub
+      FutureSignKey.
+        { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
+    let exchange_pub = key in
+    let anchor_time = stamp_start in
+    let duration = Timestamp.diff stamp_start stamp_expire in
+    let open Bin_sig.SigningKeyAnnouncement in
+    verify_f
+      ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
+      signkey_secmod_sig
+      { exchange_pub; anchor_time; duration }
   in
-  SignKeySignature.{ key; master_sig }
 
-let make_master_signatures ~master_key
-    FutureKeysResponse.
-      {
-        future_denoms;
-        future_signkeys;
-        master_pub= _;
-        denom_secmod_public_key= _;
-        signkey_secmod_public_key= _;
-      } =
-  let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
-  let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
-  MasterSignatures.{ denom_sigs; signkey_sigs }
-
-(* - ** - *)
-
-let verify_future_signkey ~sm_signkey_pub
-    FutureSignKey.
-      { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
-  let exchange_pub = key in
-  let anchor_time = stamp_start in
-  let duration = Timestamp.diff stamp_start stamp_expire in
-  let open Bin_sig.SigningKeyAnnouncement in
-  verify_f
-    ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
-    signkey_secmod_sig
-    { exchange_pub; anchor_time; duration }
-
-let verify_future_denom ~sm_denom_pub
-    FutureDenom.
-      {
-        section_name;
-        value= _;
-        stamp_start;
-        stamp_expire_withdraw;
-        stamp_expire_deposit= _;
-        stamp_expire_legal= _;
-        denom_pub;
-        fee_withdraw= _;
-        fee_deposit= _;
-        fee_refresh= _;
-        fee_refund= _;
-        denom_secmod_sig;
-      } =
-  let h_denom_pub =
-    DenominationHash.hash (DenominationKey.to_octets denom_pub)
-  in
-  let h_section_name = Hash_64_cstr.hash section_name in
-  let anchor_time = stamp_start in
-  let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
-  let open Bin_sig.DenominationKeyAnnouncement in
-  verify_f
-    ~f:(EddsaSignature.verify ~key:sm_denom_pub)
-    denom_secmod_sig
-    { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
-
-let verify_future_keys_response our_master_public_key
+  fun our_master_public_key
     FutureKeysResponse.
       {
         future_denoms;
@@ -119,37 +52,96 @@ let verify_future_keys_response our_master_public_key
         master_pub;
         denom_secmod_public_key;
         signkey_secmod_public_key;
-      } =
-  let open Syntax in
-  let* () =
-    match master_pub = our_master_public_key with
-    | false ->
-        Fmt.error
-          "master public key of the future key response does not match ours"
-    | true -> Ok ()
-  in
-  let* () =
-    list_iter
-      (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
-      future_denoms
-  in
-  let* () =
-    list_iter
-      (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
-      future_signkeys
-  in
-  Ok ()
+      }
+  ->
+    let open Syntax in
+    let* () =
+      match master_pub = our_master_public_key with
+      | false ->
+          Fmt.error
+            "master public key of the future key response does not match ours"
+      | true -> Ok ()
+    in
+    let* () =
+      list_iter
+        (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
+        future_denoms
+    in
+    let* () =
+      list_iter
+        (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
+        future_signkeys
+    in
+    Ok ()
 
-let mk_denom_revoke ~key h_denom_pub =
-  let master_sig =
-    let open Bin_sig.MasterDenominationKeyRevocation in
-    sign_f ~f:(EddsaSignature.sign ~key) { h_denom_pub }
+let mk_future_keys =
+  let denom_signature ~master_key
+      FutureDenom.
+        {
+          section_name= _;
+          value;
+          stamp_start;
+          stamp_expire_withdraw;
+          stamp_expire_deposit;
+          stamp_expire_legal;
+          denom_pub;
+          fee_withdraw;
+          fee_deposit;
+          fee_refresh;
+          fee_refund= _;
+          denom_secmod_sig= _;
+        } =
+    let octets = DenominationKey.to_octets denom_pub in
+    let h_denom_pub = DenominationHash.hash octets in
+    let master_sig =
+      let open Bin_sig.DenominationKeyValidity in
+      let master = EddsaPrivateKey.(pub_of_priv master_key) in
+      sign_f
+        ~f:(EddsaSignature.sign ~key:master_key)
+        {
+          master;
+          start= stamp_start;
+          expire_withdraw= stamp_expire_withdraw;
+          expire_spend= stamp_expire_deposit;
+          expire_legal= stamp_expire_legal;
+          value;
+          fee_withdraw;
+          fee_deposit;
+          fee_refresh;
+          denom_hash= h_denom_pub;
+        }
+    in
+    DenomSignature.{ h_denom_pub; master_sig }
+  in
+  let signkey_signature ~master_key
+      FutureSignKey.
+        { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
+    let master_sig =
+      let open Bin_sig.ExchangeSigningKeyValidity in
+      sign_f
+        ~f:(EddsaSignature.sign ~key:master_key)
+        {
+          start= stamp_start;
+          expire= stamp_expire;
+          end_= stamp_end;
+          signkey_pub= key;
+        }
+    in
+    SignKeySignature.{ key; master_sig }
   in
-  DenomRevocationSignature.{ master_sig }
 
-let mk_signkey_revoke ~key exchange_pub =
-  let master_sig =
-    let open Bin_sig.MasterSigningKeyRevocation in
-    sign_f ~f:(EddsaSignature.sign ~key) { exchange_pub }
-  in
-  SignkeyRevocationSignature.{ master_sig }
+  fun ~master_key
+    FutureKeysResponse.
+      {
+        future_denoms;
+        future_signkeys;
+        master_pub= _;
+        denom_secmod_public_key= _;
+        signkey_secmod_public_key= _;
+      }
+  ->
+    let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
+    let signkey_sigs =
+      List.map (signkey_signature ~master_key) future_signkeys
+    in
+    MasterSignatures.{ denom_sigs; signkey_sigs }