From 84084b03c5f414ced10aa9239b47533a46da3103 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Sat, 6 Dec 2025 21:18:15 +0100
Subject: [PATCH] + verify_denom_signature

---
 src/api.ml        |  5 ++++
 src/devices.ml    |  1 +
 src/management.ml | 66 ++++++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/src/api.ml b/src/api.ml
index 1422963f..0e77a541 100644
--- a/src/api.ml
+++ b/src/api.ml
@@ -69,10 +69,15 @@ module HashCode : sig
   type t
 
   val hash : string -> t
+  val to_octets : t -> string
   val jsont : t Jsont.t
 end = struct
   type t = B32.t
 
+  (* TODO rm
+     for convertion to DenominationHash *)
+  let to_octets s = s
+
   let hash s =
     let open Digestif.SHA512 in
     s |> digest_string |> to_raw_string
diff --git a/src/devices.ml b/src/devices.ml
index 34538354..440d7545 100644
--- a/src/devices.ml
+++ b/src/devices.ml
@@ -85,6 +85,7 @@ end
 module Secmod_denom = struct
   type t = {
     sm_key: Signkey.t;
+    (* TODO rename *)
     keys: Denomination.t list;
   }
 
diff --git a/src/management.ml b/src/management.ml
index 123541dc..5206dbff 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -124,11 +124,69 @@ let keys_get req server _env =
 
 (* - ** - *)
 
-let store_master_signatures _ =
-  (* TODO *)
-  Ok ()
+[@@@ocaml.warning "-27"]
 
-let verify_master_signatures ~sm_signkey:_ ~sm_denom:_ _ = Ok ()
+let verify_denom_signature ~sm_denom DenomSignature.{ h_denom_pub; master_sig }
+    =
+  let open Syntax in
+  let open Bin_type in
+  let denom_hash =
+    DenominationHash.of_octets (HashCode.to_octets h_denom_pub)
+  in
+  let* denom =
+    let opt =
+      List.find_opt
+        (fun (denom : Denomination.t) -> denom.h_pub = denom_hash)
+        sm_denom.Secmod_denom.keys
+    in
+    match opt with
+    | None ->
+        Fmt.error
+          "404 not found, One of the keys for which a signature was provided \
+           is unknown to the exchange."
+    | Some denom -> Ok denom
+  in
+  let Denomination.
+        {
+          pub= _;
+          priv= _;
+          section_name= _;
+          value;
+          stamp_start= start;
+          stamp_expire_withdraw= expire_withdraw;
+          stamp_expire_deposit= expire_spend;
+          stamp_expire_legal= expire_legal;
+          fee_withdraw;
+          fee_deposit;
+          fee_refresh;
+          fee_refund= _;
+          age_mask= _;
+          h_pub= _;
+          master_sig= _;
+        } =
+    denom
+  in
+  let master = Config.master_public_key in
+  let open Api_sig.DenominationKeyValidityPS in
+  let r : r =
+    {
+      master;
+      start;
+      expire_withdraw;
+      expire_spend;
+      expire_legal;
+      value;
+      fee_withdraw;
+      fee_deposit;
+      fee_refresh;
+      denom_hash;
+    }
+  in
+  verify ~key:master master_sig r
+
+let verify_signkey_signature SignKeySignature.{ key; master_sig } = Ok ()
+let verify_master_signatures ~sm_signkey ~sm_denom _ = Ok ()
+let store_master_signatures _ = Ok ()
 
 let keys_post req server _env =
   let sm_signkey = Vif.Server.device Devices.secmod_signkey server in