verify MasterSignatures

src/management.ml

@@ -65,24 +65,24 @@ let mk_future_signkey ~sm_signkey_priv
   FutureSignKey.
     { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
 
-let mk_future_keys_response (secmod_signkey : Secmod_signkey.t)
-    (secmod_denom : Secmod_denom.t) =
+let mk_future_keys_response ~(sm_signkey : Secmod_signkey.t)
+    ~(sm_denom : Secmod_denom.t) =
   let future_denoms =
-    secmod_denom.keys
+    sm_denom.keys
     |> List.filter (fun k -> Option.is_none k.Denomination.master_sig)
     |> List.map (fun denom ->
-        mk_future_denom ~sm_denom_priv:secmod_denom.sm_key.Signkey.priv denom)
+        mk_future_denom ~sm_denom_priv:sm_denom.sm_key.Signkey.priv denom)
   in
   let future_signkeys =
-    secmod_signkey.keys
+    sm_signkey.keys
     |> List.filter (fun k -> Option.is_none k.Signkey.master_sig)
     |> List.map (fun signkey ->
-        mk_future_signkey ~sm_signkey_priv:secmod_signkey.sm_key.Signkey.priv
+        mk_future_signkey ~sm_signkey_priv:sm_signkey.sm_key.Signkey.priv
           signkey)
   in
   let master_pub = Config.Exchange.master_public_key in
-  let denom_secmod_public_key = secmod_denom.sm_key.pub in
-  let signkey_secmod_public_key = secmod_signkey.sm_key.pub in
+  let denom_secmod_public_key = sm_denom.sm_key.pub in
+  let signkey_secmod_public_key = sm_signkey.sm_key.pub in
   FutureKeysResponse.
     {
       future_denoms;
@@ -92,13 +92,125 @@ let mk_future_keys_response (secmod_signkey : Secmod_signkey.t)
       signkey_secmod_public_key;
     }
 
-let keys_get req server _env =
+let respond_with_plain_text_error ?status e req =
+  let open Vif.Response in
+  let open Syntax in
+  let status = Option.value ~default:`Bad_request status in
+  let* () = add ~field:"content-type" "text/plain; charset=utf-8" in
+  let* () = with_string req e in
+  respond status
+
+let respond_with_ok_json content req =
   let open Vif.Response in
   let open Syntax in
-  let secmod_signkey = Vif.Server.device Devices.secmod_signkey server in
-  let secmod_denom = Vif.Server.device Devices.secmod_denom server in
-  let v = mk_future_keys_response secmod_signkey secmod_denom in
-  let s = Api.encode_exn Api.FutureKeysResponse.jsont v in
-  let* () = with_string req s in
   let* () = add ~field:"content-type" "application/json" in
+  let* () = with_string req content in
   respond `OK
+
+let respond_with_res res req =
+  match res with
+  | Error err -> respond_with_plain_text_error err req
+  | Ok content -> respond_with_ok_json content req
+
+let keys_get req server _env =
+  let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
+  let sm_denom = Vif.Server.device Devices.secmod_denom server in
+  let res =
+    let v = mk_future_keys_response ~sm_signkey ~sm_denom in
+    let s = Api.encode_exn Api.FutureKeysResponse.jsont v in
+    Ok s
+  in
+  respond_with_res res req
+
+(* - ** - *)
+
+let verify_denom_signature ~sm_denom DenomSignature.{ h_denom_pub; master_sig }
+    =
+  let open Syntax in
+  let denom_hash =
+    Bin_type.DenominationHash.of_octets (HashCode.to_octets h_denom_pub)
+  in
+  let* denom =
+    let opt =
+      List.find_opt
+        (fun (denom : Denomination.t) -> denom.h_pub = denom_hash)
+        sm_denom.Secmod_denom.keys
+    in
+    match opt with
+    | None ->
+        Fmt.error
+          "404 not found, One of the keys for which a signature was provided \
+           is unknown to the exchange."
+    | Some denom -> Ok denom
+  in
+  let open Api_sig.DenominationKeyValidityPS in
+  let r : r =
+    {
+      master= Config.master_public_key;
+      start= denom.stamp_start;
+      expire_withdraw= denom.stamp_expire_withdraw;
+      expire_spend= denom.stamp_expire_deposit;
+      expire_legal= denom.stamp_expire_legal;
+      value= denom.value;
+      fee_withdraw= denom.fee_withdraw;
+      fee_deposit= denom.fee_deposit;
+      fee_refresh= denom.fee_refresh;
+      denom_hash;
+    }
+  in
+  verify ~key:Config.master_public_key master_sig r
+
+let verify_signkey_signature ~sm_signkey SignKeySignature.{ key; master_sig } =
+  let open Syntax in
+  let* signkey =
+    let opt =
+      List.find_opt
+        (fun (signkey : Signkey.t) -> signkey.pub = key)
+        sm_signkey.Secmod_signkey.keys
+    in
+    match opt with
+    | None ->
+        Fmt.error
+          "404 not found, One of the keys for which a signature was provided \
+           is unknown to the exchange."
+    | Some signkey -> Ok signkey
+  in
+  let open Api_sig.ExchangeSigningKeyValidityPS in
+  let r : r =
+    {
+      start= signkey.stamp_start;
+      expire= signkey.stamp_expire;
+      end_= signkey.stamp_end;
+      signkey_pub= signkey.pub;
+    }
+  in
+  verify ~key:Config.master_public_key master_sig r
+
+let verify_master_signatures ~sm_signkey ~sm_denom
+    MasterSignatures.{ denom_sigs; signkey_sigs } =
+  let open Syntax in
+  let* () = list_iter (verify_denom_signature ~sm_denom) denom_sigs in
+  let* () = list_iter (verify_signkey_signature ~sm_signkey) signkey_sigs in
+  Ok ()
+
+let store_master_signatures _ = Ok ()
+
+let keys_post req server _env =
+  let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
+  let sm_denom = Vif.Server.device Devices.secmod_denom server in
+  let res =
+    let open Syntax in
+    let* master_signatures =
+      match Vif.Request.of_json req with
+      | Ok (v : MasterSignatures.t) -> Ok v
+      | Error (`Msg msg) ->
+          Logs.err (fun m -> m "Invalid JSON: %s" msg);
+          Error msg
+    in
+    let* () =
+      verify_master_signatures ~sm_signkey ~sm_denom master_signatures
+    in
+    let* () = store_master_signatures () in
+    Ok ""
+  in
+  respond_with_res res req