src/denomination.ml

@@ -15,7 +15,7 @@ type t = {
   fee_refund: Amount.t;
   age_mask: int;
   h_pub: Bin_type.DenominationHash.t;
-  master_sig: EddsaSignature.t option;
+  master_sig: Api_sig.DenominationKeyValidityPS.t option;
 }
 
 let make

src/management.ml

@@ -96,19 +96,16 @@ let mk_future_keys_response ~(sm_signkey : Secmod_signkey.t)
 
 (* - ** - *)
 
-let verify_denom_signature ~sm_denoms DenomSignature.{ h_denom_pub; master_sig }
+let verify_denom_signature ~sm_denom DenomSignature.{ h_denom_pub; master_sig }
     =
   let open Syntax in
   let denom_hash =
     Bin_type.DenominationHash.of_octets (HashCode.to_octets h_denom_pub)
   in
   let* denom =
-    let opt =
-      List.find_opt
-        (fun (denom : Denomination.t) -> denom.h_pub = denom_hash)
-        sm_denoms
-    in
-    match opt with
+    Secmod_denom.get_denoms sm_denom
+    |> List.find_opt (fun (denom : Denomination.t) -> denom.h_pub = denom_hash)
+    |> function
     | None ->
         Fmt.error
           "404 not found, One of the keys for which a signature was provided \
@@ -132,13 +129,12 @@ let verify_denom_signature ~sm_denoms DenomSignature.{ h_denom_pub; master_sig }
   in
   verify ~key:Config.master_public_key master_sig r
 
-let verify_signkey_signature ~sm_signkeys SignKeySignature.{ key; master_sig } =
+let verify_signkey_signature ~sm_signkey SignKeySignature.{ key; master_sig } =
   let open Syntax in
   let* signkey =
-    let opt =
-      List.find_opt (fun (signkey : Signkey.t) -> signkey.pub = key) sm_signkeys
-    in
-    match opt with
+    Secmod_signkey.get_signkeys sm_signkey
+    |> List.find_opt (fun (signkey : Signkey.t) -> signkey.pub = key)
+    |> function
     | None ->
         Fmt.error
           "404 not found, One of the keys for which a signature was provided \
@@ -156,18 +152,34 @@ let verify_signkey_signature ~sm_signkeys SignKeySignature.{ key; master_sig } =
   in
   verify ~key:Config.master_public_key master_sig r
 
-let verify_master_signatures ~sm_signkeys ~sm_denoms
+let verify_master_signatures ~sm_signkey ~sm_denom
     MasterSignatures.{ denom_sigs; signkey_sigs } =
   let open Syntax in
-  let* () = list_iter (verify_denom_signature ~sm_denoms) denom_sigs in
-  let* () = list_iter (verify_signkey_signature ~sm_signkeys) signkey_sigs in
+  let* () = list_iter (verify_denom_signature ~sm_denom) denom_sigs in
+  let* () = list_iter (verify_signkey_signature ~sm_signkey) signkey_sigs in
   Ok ()
 
 (* --- *)
 
-let update_master_signatures ~db_conn ~sm_signkey ~sm_denom:_
-    MasterSignatures.{ denom_sigs= _; signkey_sigs } =
-  Secmod_signkey.add_master_signatures db_conn sm_signkey signkey_sigs
+let update_master_signatures ~db_conn ~sm_signkey ~sm_denom
+    MasterSignatures.{ denom_sigs; signkey_sigs } =
+  let open Syntax in
+  let* () =
+    signkey_sigs
+    |> List.map (fun SignKeySignature.{ key; master_sig } -> (key, master_sig))
+    |> Secmod_signkey.add_master_signatures db_conn sm_signkey
+  in
+  let* () =
+    denom_sigs
+    |> List.map (fun DenomSignature.{ h_denom_pub; master_sig } ->
+        (* TODO better denomination-hash type *)
+        let h_denom_pub =
+          Bin_type.DenominationHash.of_octets (HashCode.to_octets h_denom_pub)
+        in
+        (h_denom_pub, master_sig))
+    |> Secmod_denom.add_master_signatures db_conn sm_denom
+  in
+  Ok ()
 
 (* --- *)
 
@@ -217,9 +229,7 @@ let keys_post req server _env =
           Error msg
     in
     let* () =
-      let sm_denoms = Secmod_denom.get_denoms sm_denom in
-      let sm_signkeys = Secmod_signkey.get_signkeys sm_signkey in
-      verify_master_signatures ~sm_signkeys ~sm_denoms master_signatures
+      verify_master_signatures ~sm_signkey ~sm_denom master_signatures
     in
     let* () =
       update_master_signatures ~db_conn ~sm_signkey ~sm_denom master_signatures

src/pg.ml

@@ -119,9 +119,10 @@ let lookup_denomination_key =
 
 let add_denomination_key =
   let denomination_insert =
+    let master_sig = Api_sig.DenominationKeyValidityPS.caqti in
     Caqti_type.(
-      t12 denomination_hash rsa_public eddsa_signature time time time time
-        amount amount amount amount (t2 amount age_mask)
+      t12 denomination_hash rsa_public master_sig time time time time amount
+        amount amount amount (t2 amount age_mask)
       ->. unit)
       "INSERT INTO denominations (denom_pub_hash, denom_pub, master_sig, \
        valid_from, expire_withdraw, expire_deposit, expire_legal, coin, \

src/secmod_denom.ml

@@ -12,12 +12,18 @@ let get_denoms t =
   Miou.Mutex.protect t.lock @@ fun () ->
   Hashtbl.to_seq_values t.denom_ht |> List.of_seq
 
-(* TODO *)
-let update_denoms _conn t denoms =
+let add_master_signatures conn t l =
   Miou.Mutex.protect t.lock @@ fun () ->
-  List.iter
-    (fun denom -> Hashtbl.replace t.denom_ht denom.Denomination.h_pub denom)
-    denoms
+  list_iter
+    (fun (h_denom_pub, master_sig) ->
+      match Hashtbl.find_opt t.denom_ht h_denom_pub with
+      | None -> Error "secmod_denom failure: denomination hash not found."
+      | Some denom ->
+          let denom = { denom with master_sig= Some master_sig } in
+          let* () = Pg.add_denomination_key conn denom |> unwrap_err_caqti in
+          Hashtbl.replace t.denom_ht h_denom_pub denom;
+          Ok ())
+    l
 
 let dir = Fpath.(v "data" / "secmod_signkey")
 

src/secmod_denom.mli

@@ -2,5 +2,11 @@ type t
 
 val get_sm_key : t -> Signkey.t
 val get_denoms : t -> Denomination.t list
-val update_denoms : (module Pg.CONN) -> t -> Denomination.t list -> unit
+
+val add_master_signatures :
+  (module Pg.CONN) ->
+  t ->
+  (Bin_type.DenominationHash.t * Api_sig.DenominationKeyValidityPS.t) list ->
+  (unit, string) result
+
 val init : (module Pg.CONN) -> t

src/secmod_signkey.ml

@@ -16,17 +16,18 @@ let get_signkeys t =
   Miou.Mutex.protect t.lock @@ fun () ->
   Hashtbl.to_seq_values t.signkey_ht |> List.of_seq
 
-(* TODO *)
-let add_master_signatures _conn t l =
+let add_master_signatures conn t l =
   Miou.Mutex.protect t.lock @@ fun () ->
-  l
-  |> Syntax.list_iter (fun Api.SignKeySignature.{ key= pub; master_sig } ->
+  list_iter
+    (fun (pub, master_sig) ->
       match Hashtbl.find_opt t.signkey_ht pub with
       | None -> Error "secmod_signkey failure: public key not found."
       | Some signkey ->
           let signkey = { signkey with master_sig= Some master_sig } in
+          let* () = Pg.activate_signing_key conn signkey |> unwrap_err_caqti in
           Hashtbl.replace t.signkey_ht pub signkey;
           Ok ())
+    l
 
 let dir = Fpath.(v "data" / "secmod_signkey")
 

src/secmod_signkey.mli

@@ -4,6 +4,9 @@ val get_sm_key : t -> Signkey.t
 val get_signkeys : t -> Signkey.t list
 
 val add_master_signatures :
-  (module Pg.CONN) -> t -> Api.SignKeySignature.t list -> (unit, string) result
+  (module Pg.CONN) ->
+  t ->
+  (Crypto.EddsaPublicKey.t * Api_sig.ExchangeSigningKeyValidityPS.t) list ->
+  (unit, string) result
 
 val init : (module Pg.CONN) -> t

src/syntax.ml

@@ -4,6 +4,9 @@ let ( let+ ) o f = match o with Ok v -> Ok (f v) | Error _ as e -> e
 (* TODO use polymorphic variant for errors *)
 let unwrap_err_msg o = match o with Error (`Msg e) -> Error e | Ok v -> Ok v
 
+let unwrap_err_caqti o =
+  match o with Error err -> Fmt.error "%a" Caqti_error.pp err | Ok v -> Ok v
+
 let list_iter f l =
   let err = ref None in
   try