enforce keys time constraint

src/http_info.ml

@@ -83,14 +83,18 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
   let* denominations = Denomination.make_denom_group_sorted denom_l in
 
   let* signkeys = Keys.signkeys () in
-  let signkeys = List.map Api.SignKey.of_signkey signkeys in
 
   (* the eddsa pub key used to sign exchange_sig *)
   let* exchange_pub =
-    match signkeys with
+    let now = Timestamp.of_ptime (Ptime_clock.now ()) in
-    | [] -> Fmt.error "exchange has no active signkey"
+    let opt =
-    | sk :: _ -> Ok sk.SignKey.key
+      List.find_opt (fun sk -> Signkey.is_valid_at ~timestamp:now sk) signkeys
+    in
+    match opt with
+    | None -> Fmt.error "exchange has no active signkey"
+    | Some sk -> Ok sk.pub
   in
+  let signkeys = List.map Api.SignKey.of_signkey signkeys in
 
   (* ! depends on denominations order *)
   let exchange_sig =

src/signkey.ml

@@ -7,3 +7,6 @@ type t = {
   stamp_end: Timestamp.t;
   master_sig: Signatures.ExchangeSigningKeyValidity.t;
 }
+
+let is_valid_at ~timestamp sk =
+  Timestamp.geq sk.stamp_start timestamp && Timestamp.lt timestamp sk.stamp_end

src/time.ml

@@ -97,6 +97,10 @@ module Timestamp = struct
   let never = uint64_max
   let zero = 0L
   let compare = Int64.unsigned_compare
+  let gt a b = compare a b > 0
+  let geq a b = compare a b >= 0
+  let lt a b = compare a b < 0
+  let leq a b = compare a b <= 0
   let min a b = if compare a b < 0 then a else b
   let max a b = if compare a b > 0 then a else b
 

src/time.mli

@@ -37,6 +37,10 @@ module Timestamp : sig
   val never : t
   val zero : t
   val compare : t -> t -> int
+  val gt : t -> t -> bool
+  val geq : t -> t -> bool
+  val lt : t -> t -> bool
+  val leq : t -> t -> bool
   val min : t -> t -> t
   val max : t -> t -> t
   val diff : t -> t -> TimeRelative.t