From a5f726ce9dbdb1687bded2ed46e322181b5f8795 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Sat, 18 Oct 2025 18:19:09 +0200
Subject: [PATCH] more /management

---
 include/dune             |  5 +++++
 include/gen_eddsa_key.ml | 16 ++++++++++++++++
 src/config.ml            |  9 ++++++++-
 src/devices.ml           | 10 +++++++---
 src/management.ml        | 39 ++++++++++++++++++++++++++++++---------
 src/mte.ml               |  3 ++-
 6 files changed, 68 insertions(+), 14 deletions(-)
 create mode 100644 include/gen_eddsa_key.ml

diff --git a/include/dune b/include/dune
index f5c8787a..d9601600 100644
--- a/include/dune
+++ b/include/dune
@@ -9,6 +9,11 @@
  (modules gen_taler_signatures)
  (libraries fmt angstrom))
 
+(executable
+ (name gen_eddsa_key)
+ (modules gen_eddsa_key)
+ (libraries fmt mirage-crypto-rng.unix mirage-crypto-ec b32))
+
 (executable
  (name parse_config)
  (modules parse_config)
diff --git a/include/gen_eddsa_key.ml b/include/gen_eddsa_key.ml
new file mode 100644
index 00000000..f4569744
--- /dev/null
+++ b/include/gen_eddsa_key.ml
@@ -0,0 +1,16 @@
+let () =
+  Mirage_crypto_rng_unix.use_default ();
+  let open Mirage_crypto_ec.Ed25519 in
+  let _priv, pub = generate () in
+  let octets = pub_to_octets pub in
+  let pub_b32 = B32.encode octets in
+  let octets' = B32.decode pub_b32 |> Result.get_ok in
+  assert (octets = octets');
+  (*
+  Fmt.pr "public key    :@.%S@." octets;
+  Fmt.pr "len: %d@." (String.length octets);
+  Fmt.pr "len: %d@." (String.length pub_b32);
+  *)
+  Fmt.pr "%s@." pub_b32;
+
+  ()
diff --git a/src/config.ml b/src/config.ml
index 2e27f457..5e6a6cc0 100644
--- a/src/config.ml
+++ b/src/config.ml
@@ -10,7 +10,14 @@ module Exchange = struct
   let db = "postgres"
   let attribute_encryption_key = "uhuhg" (* high-entropy nonce. *)
   let port = 3696
-  let master_public_key = "uhuhg"
+
+  let master_public_key =
+    "8MQF2XPWCKCW4199JFPE08X7Y9XAX21SF2HD8NZKXM3PY3CMCJ90===="
+    |> B32.decode
+    |> Result.get_ok
+    |> Mirage_crypto_ec.Ed25519.pub_of_octets
+    |> Result.get_ok
+
   let stefan_abs = zero_eur
   let stefan_log = zero_eur
   let stefan_lin = 0.0
diff --git a/src/devices.ml b/src/devices.ml
index 85cb8afb..236f584a 100644
--- a/src/devices.ml
+++ b/src/devices.ml
@@ -1,11 +1,15 @@
+(* TODO
+   better types to not mixup keys maybe
+   .. *)
+
 let signkey = Secmod_keys.make ~name:"signkey"
-let exchange_key = Secmod_keys.make ~name:"exchange_key"
+let online_key = Secmod_keys.make ~name:"online_key"
 let denom_key = Secmod_keys.make ~name:"denom_key"
 
 let denominations =
   let finally _key = () in
-  Vif.Device.v ~name:"denom" ~finally [] @@ fun () ->
+  Vif.Device.v ~name:"denominations" ~finally [] @@ fun () ->
   let rsa_l = List.map Denom.make Config.coins in
   rsa_l
 
-let v = Vif.Devices.[ signkey; exchange_key; denom_key; denominations ]
+let l = Vif.Devices.[ signkey; online_key; denom_key; denominations ]
diff --git a/src/management.ml b/src/management.ml
index 2f34a260..4b7437cf 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -1,13 +1,6 @@
 (*open Types*)
 open Api_types
 
-(* TODO
-   - take secmod devices as param
-   - hash stuff
-     what is the hash algorithm
-     is it hash'ed then base32'ed in xxxP?
-   ... *)
-
 let mk_future_denom denom_key_signf
     ({
        section_name;
@@ -64,7 +57,7 @@ let mk_future_denom denom_key_signf
       denom_secmod_sig;
     }
 
-let mk_future_sign_key signkey_signf
+let mk_future_signkey signkey_signf
     ({ pub; sign= _; stamp_start; stamp_expire; stamp_end } : Secmod_keys.t) =
   let signkey_secmod_sig =
     let open Binary_formats in
@@ -92,9 +85,37 @@ let mk_future_sign_key signkey_signf
       signkey_secmod_sig;
     }
 
-let keys req _server _env =
+let mk_future_keys_response ~signkey ~online_key ~denom_key ~denominations =
+  let future_denoms =
+    (* todo: "only those lacking a master signature" *)
+    List.map (mk_future_denom denom_key.Secmod_keys.sign) denominations
+  in
+  let future_signkeys =
+    (* todo: "only those lacking a master signature" *)
+    List.map (mk_future_signkey signkey.Secmod_keys.sign) [ online_key ]
+  in
+  let master_pub = Config.Exchange.master_public_key in
+  let denom_secmod_public_key = denom_key.pub in
+  let signkey_secmod_public_key = signkey.pub in
+  FutureKeysResponse.
+    {
+      future_denoms;
+      future_signkeys;
+      master_pub;
+      denom_secmod_public_key;
+      signkey_secmod_public_key;
+    }
+
+let keys req server _env =
   let open Vif.Response in
   let open Syntax in
+  let signkey = Vif.Server.device Devices.signkey server in
+  let online_key = Vif.Server.device Devices.online_key server in
+  let denom_key = Vif.Server.device Devices.denom_key server in
+  let denominations = Vif.Server.device Devices.denominations server in
+  let _v =
+    mk_future_keys_response ~signkey ~online_key ~denom_key ~denominations
+  in
   let* () = with_string req "keys .. \n" in
   let* () = add ~field:"content-type" "application/json" in
   respond `OK
diff --git a/src/mte.ml b/src/mte.ml
index 56974867..7db92651 100644
--- a/src/mte.ml
+++ b/src/mte.ml
@@ -123,5 +123,6 @@ let () =
   in
   Miou_unix.run @@ fun () ->
   let env = () in
+  let devices = Devices.l in
   let middlewares = Vif.Middlewares.[] in
-  Vif.run ~cfg ~devices:Devices.v ~middlewares routes env
+  Vif.run ~cfg ~devices ~middlewares routes env