From c42636b998593255aaed41fe5ea76763b44c613c Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Fri, 20 Feb 2026 21:27:21 +0100
Subject: [PATCH] + wip ; ok verify future sk

---
 src/http_management.ml | 82 ++++++++++++++++++++++++++----------------
 src/signatures.ml      |  3 ++
 2 files changed, 55 insertions(+), 30 deletions(-)

diff --git a/src/http_management.ml b/src/http_management.ml
index 148029a8..3c72997b 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -33,51 +33,73 @@ module Keys_get = struct
 end
 
 module Keys_post = struct
-  let error_key_unknown =
-    "404 not found, One of the keys for which a signature was provided is \
-     unknown to the exchange."
-
-  let verify_denom_signature (module Keys : Keys.S)
-      DenomSignature.{ h_denom_pub; master_sig } =
-    let* opt = Keys.find_future_denomination h_denom_pub in
-    let* denom = Option.to_result ~none:error_key_unknown opt in
+  let verify_dn (module Keys : Keys.S) fdn denom_hash master_sig =
+    let open FutureDenom in
     let open Signatures.DenominationKeyValidity in
     let r : r =
       {
         master= Config.master_public_key;
-        start= denom.stamp_start;
-        expire_withdraw= denom.stamp_expire_withdraw;
-        expire_spend= denom.stamp_expire_deposit;
-        expire_legal= denom.stamp_expire_legal;
-        value= denom.value;
-        fee_withdraw= denom.fee_withdraw;
-        fee_deposit= denom.fee_deposit;
-        fee_refresh= denom.fee_refresh;
-        fee_refund= denom.fee_refund;
-        denom_hash= h_denom_pub;
+        start= fdn.stamp_start;
+        expire_withdraw= fdn.stamp_expire_withdraw;
+        expire_spend= fdn.stamp_expire_deposit;
+        expire_legal= fdn.stamp_expire_legal;
+        value= fdn.value;
+        fee_withdraw= fdn.fee_withdraw;
+        fee_deposit= fdn.fee_deposit;
+        fee_refresh= fdn.fee_refresh;
+        fee_refund= fdn.fee_refund;
+        denom_hash;
       }
     in
-    verify_f ~f:Keys.verify_with_master_key master_sig r
+    verify_f ~f:(Crypto.EddsaSignature.verify ~key:Keys.master_pub) master_sig r
 
-  let verify_signkey_signature (module Keys : Keys.S)
-      SignKeySignature.{ key; master_sig } =
-    let* signkey =
-      Keys.find_future_signkey key |> Option.to_result ~none:error_key_unknown
+  let verify_denom_sigs (module Keys : Keys.S) denom_sigs =
+    let* fdn_l = Keys.future_denominations () in
+    let fdn_l =
+      List.map
+        (fun fdn ->
+          let h_pub =
+            (* TODO DenominationHash.of_denom_pub *)
+            DenominationHash.hash
+              (DenominationKey.to_octets fdn.FutureDenom.denom_pub)
+          in
+          (h_pub, fdn))
+        fdn_l
     in
+    list_iter
+      (fun DenomSignature.{ h_denom_pub; master_sig } ->
+        match List.assoc_opt h_denom_pub fdn_l with
+        | None -> Error "future denomination not found"
+        | Some fdn -> verify_dn (module Keys) fdn h_denom_pub master_sig)
+      denom_sigs
+
+  let verify_sk (module Keys : Keys.S)
+      FutureSignKey.
+        { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ }
+      master_sig =
     let open Signatures.ExchangeSigningKeyValidity in
     let r : r =
       {
-        start= signkey.stamp_start;
-        expire= signkey.stamp_expire;
-        end_= signkey.stamp_end;
-        signkey_pub= signkey.key;
+        start= stamp_start;
+        expire= stamp_expire;
+        end_= stamp_end;
+        signkey_pub= key;
       }
     in
-    verify_f ~f:Keys.verify_with_master_key master_sig r
+    verify_f ~f:(Crypto.EddsaSignature.verify ~key:Keys.master_pub) master_sig r
+
+  let verify_signkey_sigs (module Keys : Keys.S) signkey_sigs =
+    let* fsk_l = Keys.future_signkeys () in
+    list_iter
+      (fun SignKeySignature.{ key; master_sig } ->
+        match List.find_opt (fun sk -> sk.FutureSignKey.key = key) fsk_l with
+        | None -> Error "future signkey not found"
+        | Some fsk -> verify_sk (module Keys) fsk master_sig)
+      signkey_sigs
 
   let verify keys MasterSignatures.{ denom_sigs; signkey_sigs } =
-    let* () = list_iter (verify_denom_signature keys) denom_sigs in
-    let* () = list_iter (verify_signkey_signature keys) signkey_sigs in
+    let* () = verify_signkey_sigs keys signkey_sigs in
+    let* () = verify_denom_sigs keys denom_sigs in
     Ok ()
 
   let do_ ~db_conn:_ (module Keys : Keys.S)
diff --git a/src/signatures.ml b/src/signatures.ml
index 1d57405e..f5364000 100644
--- a/src/signatures.ml
+++ b/src/signatures.ml
@@ -157,6 +157,9 @@ end) : sig
 
   val sign_f : f:(string -> eddsa_sig) -> r -> t
 
+  (* TODO
+     - just directly verify here?
+     - type for `theirs` and `ours` signatures? *)
   val verify_f :
     f:(eddsa_sig -> msg:string -> (unit, string) result) ->
     t ->