From aa50b1305a005c30caf398e1ef04ae7e03004157 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Tue, 17 Feb 2026 11:07:52 +0100
Subject: [PATCH]

---
 src/secmod.ml | 88 ++++++++++++++++++++++++++++-----------------------
 1 file changed, 48 insertions(+), 40 deletions(-)

diff --git a/src/secmod.ml b/src/secmod.ml
index 8bb52b32..bcbe3174 100644
--- a/src/secmod.ml
+++ b/src/secmod.ml
@@ -87,23 +87,7 @@ module Make (Conn : Pg.CONN) = struct
           section_name
     | Some dn_data -> Ok dn_data
 
-  (*
-        let pub = EddsaPrivateKey.pub_of_priv priv in
-        let* sk = db_lookup_signkey_data conn fname pub in
-        let signkey = { priv; sk_data } in
-        Ok (Some signkey)
-        *)
-  (*
-            match opt with
-            | None -> Ok None
-            | Some priv ->
-                (* todo: could check that coin config match db values *)
-                let* dn_data = db_lookup_denomination conn ~section_name priv in
-                Hashtbl.replace dn_section_name_ht dn_data.h_pub section_name;
-                let denom = { priv; dn_data } in
-                Ok (Some denom))
-                *)
-
+  (* TODO clean up *)
   let load conn =
     let error_invalid_state =
       Fmt.error "secmod load error: invalid store state."
@@ -187,27 +171,37 @@ module Make (Conn : Pg.CONN) = struct
         Ok (Some t)
     | _, _, _ -> error_invalid_state
 
-  let make_new_signkey () =
+  (* TODO *)
+  let sign_with_sm_key _ = assert false
+
+  let make_future_sk t =
     let start = Time.Absolute.of_ptime (Ptime_clock.now ()) in
     let expire =
       Time.Absolute.add start Config.Exchange.signkey_legal_duration
     in
-    let stamp_start = Time.Timestamp.of_absolute start in
-    let stamp_expire = Time.Timestamp.of_absolute expire in
+    let stamp_start = Timestamp.of_absolute start in
+    let stamp_expire = Timestamp.of_absolute expire in
     let stamp_end = stamp_expire in
     let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
-    let master_sig = None in
-    let revoked_sig = None in
-    let sk_data =
-      Signkey.
-        { pub; stamp_start; stamp_expire; stamp_end; master_sig; revoked_sig }
+    let signkey_secmod_sig =
+      let open Signatures.SigningKeyAnnouncement in
+      let exchange_pub = pub in
+      let anchor_time = stamp_start in
+      let duration = Timestamp.diff stamp_start stamp_expire in
+      sign_f ~f:sign_with_sm_key { exchange_pub; anchor_time; duration }
     in
-    { priv; sk_data }
+    let future_sk =
+      Api.FutureSignKey.
+        { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
+    in
+    Hashtbl.replace t.future_sk_ht pub future_sk;
+    Hashtbl.replace t.future_sk_key_ht pub priv;
+    ()
 
-  let make_new_denom
+  let make_future_dn t
       Config.Coin.
         {
-          section_name= _;
+          section_name;
           value;
           duration_withdraw;
           duration_spend;
@@ -233,31 +227,45 @@ module Make (Conn : Pg.CONN) = struct
     let stamp_expire_legal =
       Timestamp.of_absolute @@ Absolute.add start duration_legal
     in
-
     let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in
-    let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in
-    let master_sig = None in
-    let revoked_sig = None in
-    let dn_data =
-      Denomination.
+    let open Api in
+    let rsa_denomination_key =
+      RsaDenominationKey.{ age_mask= 0; rsa_pub= pub }
+    in
+    let denom_pub = DenominationKey.Rsa rsa_denomination_key in
+    let denom_secmod_sig =
+      let open Signatures.DenominationKeyAnnouncement in
+      let h_denom_pub =
+        Hash.DenominationHash.hash (RsaPublicKey.to_octets pub)
+      in
+      let h_section_name = Hash.Cstring.H64.hash section_name in
+      let anchor_time = stamp_start in
+      let duration_withdraw =
+        Timestamp.diff stamp_start stamp_expire_withdraw
+      in
+      sign_f ~f:sign_with_sm_key
+        { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
+    in
+    let future_dn =
+      FutureDenom.
         {
-          pub;
+          section_name;
           value;
           stamp_start;
           stamp_expire_withdraw;
           stamp_expire_deposit;
           stamp_expire_legal;
+          denom_pub;
           fee_withdraw;
           fee_deposit;
           fee_refresh;
           fee_refund;
-          age_mask= 0;
-          h_pub;
-          master_sig;
-          revoked_sig;
+          denom_secmod_sig;
         }
     in
-    { priv; dn_data }
+    Hashtbl.replace t.future_dn_ht pub future_dn;
+    Hashtbl.replace t.future_dn_key_ht pub priv;
+    ()
 
   let make_new () =
     let lock = Miou.Mutex.create () in