-major KYC update, fixes misc. issues

13 files changed, 163 insertions, 123 deletions

diff --git a/src/exchange/taler-exchange-aggregator.c b/src/exchange/taler-exchange-aggregator.c
index 2c2795358..81178e1aa 100644
--- a/src/exchange/taler-exchange-aggregator.c
+++ b/src/exchange/taler-exchange-aggregator.c
@@ -92,6 +92,12 @@ struct AggregationUnit
   const struct TALER_EXCHANGEDB_AccountInfo *wa;
 
   /**
+   * Row in KYC table for legitimization requirements
+   * that are pending for this aggregation, or 0 if none.
+   */
+  uint64_t requirement_row;
+
+  /**
    * Set to #GNUNET_OK during transient checking
    * while everything is OK. Otherwise see return
    * value of #do_aggregate().
@@ -469,14 +475,13 @@ return_relevant_amounts (void *cls,
 /**
  * Test if KYC is required for a transfer to @a h_payto.
  *
- * @param au_active aggregation unit to check for
+ * @param[in,out] au_active aggregation unit to check for
  * @return true if KYC checks are satisfied
  */
 static bool
-kyc_satisfied (const struct AggregationUnit *au_active)
+kyc_satisfied (struct AggregationUnit *au_active)
 {
   const char *requirement;
-  uint64_t legi_row;
   enum GNUNET_DB_QueryStatus qs;
 
   requirement = TALER_KYCLOGIC_kyc_test_required (
@@ -496,7 +501,7 @@ kyc_satisfied (const struct AggregationUnit *au_active)
     db_plugin->cls,
     requirement,
     &au_active->h_payto,
-    &legi_row);
+    &au_active->requirement_row);
   if (qs < 0)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -506,8 +511,8 @@ kyc_satisfied (const struct AggregationUnit *au_active)
   else
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "New legitimization process %llu started\n",
-                (unsigned long long) legi_row);
+                "Legitimization process %llu started\n",
+                (unsigned long long) au_active->requirement_row);
   }
   return false;
 }
@@ -649,6 +654,7 @@ do_aggregate (struct AggregationUnit *au)
       qs = db_plugin->update_aggregation_transient (db_plugin->cls,
                                                     &au->h_payto,
                                                     &au->wtid,
+                                                    au->requirement_row,
                                                     &au->total_amount);
     else
       qs = db_plugin->create_aggregation_transient (db_plugin->cls,
@@ -656,6 +662,7 @@ do_aggregate (struct AggregationUnit *au)
                                                     au->wa->section_name,
                                                     &au->merchant_pub,
                                                     &au->wtid,
+                                                    au->requirement_row,
                                                     &au->total_amount);
     if (GNUNET_DB_STATUS_SOFT_ERROR == qs)
     {
diff --git a/src/exchange/taler-exchange-httpd_batch-withdraw.c b/src/exchange/taler-exchange-httpd_batch-withdraw.c
index 79e6affeb..a0a13d931 100644
--- a/src/exchange/taler-exchange-httpd_batch-withdraw.c
+++ b/src/exchange/taler-exchange-httpd_batch-withdraw.c
@@ -209,7 +209,7 @@ batch_withdraw_transaction (void *cls,
       TEH_plugin->cls,
       kyc_required,
       &wc->h_payto,
-      &wc->kyc.legitimization_uuid);
+      &wc->kyc.requirement_row);
   }
   wc->kyc.ok = true;
   qs = TEH_plugin->do_batch_withdraw (TEH_plugin->cls,
@@ -328,6 +328,7 @@ generate_reply_success (const struct TEH_RequestContext *rc,
   {
     /* KYC required */
     return TEH_RESPONSE_reply_kyc_required (rc->connection,
+                                            &wc->h_payto,
                                             &wc->kyc);
   }
 
diff --git a/src/exchange/taler-exchange-httpd_deposits_get.c b/src/exchange/taler-exchange-httpd_deposits_get.c
index 79c0b16f8..86af9fff1 100644
--- a/src/exchange/taler-exchange-httpd_deposits_get.c
+++ b/src/exchange/taler-exchange-httpd_deposits_get.c
@@ -252,11 +252,11 @@ handle_track_transaction_request (
       connection,
       MHD_HTTP_ACCEPTED,
       GNUNET_JSON_pack_allow_null (
-        (0 == ctx->kyc.legitimization_uuid)
-        ? GNUNET_JSON_pack_string ("legitimization_uuid",
+        (0 == ctx->kyc.requirement_row)
+        ? GNUNET_JSON_pack_string ("requirement_row",
                                    NULL)
-        : GNUNET_JSON_pack_uint64 ("legitimization_uuid",
-                                   ctx->kyc.legitimization_uuid)),
+        : GNUNET_JSON_pack_uint64 ("requirement_row",
+                                   ctx->kyc.requirement_row)),
       GNUNET_JSON_pack_bool ("kyc_ok",
                              ctx->kyc.ok),
       GNUNET_JSON_pack_timestamp ("execution_time",
diff --git a/src/exchange/taler-exchange-httpd_kyc-check.c b/src/exchange/taler-exchange-httpd_kyc-check.c
index c4181e11f..55199593e 100644
--- a/src/exchange/taler-exchange-httpd_kyc-check.c
+++ b/src/exchange/taler-exchange-httpd_kyc-check.c
@@ -72,9 +72,14 @@ struct KycPoller
   struct GNUNET_DB_EventHandler *eh;
 
   /**
-   * UUID being checked.
+   * Row of the requirement being checked.
    */
-  uint64_t legitimization_uuid;
+  uint64_t requirement_row;
+
+  /**
+   * Row of KYC process being initiated.
+   */
+  uint64_t process_row;
 
   /**
    * Hash of the payto:// URI we are confirming to
@@ -88,11 +93,6 @@ struct KycPoller
   struct GNUNET_TIME_Absolute timeout;
 
   /**
-   * Type of KYC check required for this client.
-   */
-  char *required;
-
-  /**
    * Set to starting URL of KYC process if KYC is required.
    */
   char *kyc_url;
@@ -103,6 +103,11 @@ struct KycPoller
   char *hint;
 
   /**
+   * Name of the section of the provider in the configuration.
+   */
+  const char *section_name;
+
+  /**
    * Set to error encountered with KYC logic, if any.
    */
   enum TALER_ErrorCode ec;
@@ -118,9 +123,9 @@ struct KycPoller
   bool suspended;
 
   /**
-   * True if KYC was required but is fully satisfied.
+   * False if KYC is not required.
    */
-  bool found;
+  bool kyc_required;
 
   /**
    * True if we once tried the KYC initiation.
@@ -192,7 +197,6 @@ kyp_cleanup (struct TEH_RequestContext *rc)
   }
   GNUNET_free (kyp->kyc_url);
   GNUNET_free (kyp->hint);
-  GNUNET_free (kyp->required);
   GNUNET_free (kyp);
 }
 
@@ -237,10 +241,10 @@ initiate_cb (
   {
     kyp->hint = GNUNET_strdup (error_msg_hint);
   }
-  qs = TEH_plugin->update_kyc_requirement_by_row (
+  qs = TEH_plugin->update_kyc_process_by_row (
     TEH_plugin->cls,
-    kyp->legitimization_uuid,
-    kyp->required,
+    kyp->process_row,
+    kyp->section_name,
     &kyp->h_payto,
     provider_user_id,
     provider_legitimization_id,
@@ -286,23 +290,18 @@ kyc_check (void *cls,
   struct TALER_KYCLOGIC_ProviderDetails *pd;
   enum GNUNET_GenericReturnValue ret;
   struct TALER_PaytoHashP h_payto;
-  struct GNUNET_TIME_Absolute expiration;
-  char *provider_account_id;
-  char *provider_legitimization_id;
+  char *requirements;
 
   qs = TEH_plugin->lookup_kyc_requirement_by_row (
     TEH_plugin->cls,
-    kyp->legitimization_uuid,
-    &kyp->required,
-    &h_payto,
-    &expiration,
-    &provider_account_id,
-    &provider_legitimization_id);
+    kyp->requirement_row,
+    &requirements,
+    &h_payto);
   if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == qs)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "No KYC requirements open for %llu\n",
-                (unsigned long long) kyp->legitimization_uuid);
+                (unsigned long long) kyp->requirement_row);
     return qs;
   }
   if (qs < 0)
@@ -310,52 +309,65 @@ kyc_check (void *cls,
     GNUNET_break (GNUNET_DB_STATUS_HARD_ERROR != qs);
     return qs;
   }
-  GNUNET_free (provider_account_id);
-  GNUNET_free (provider_legitimization_id);
   if (0 !=
       GNUNET_memcmp (&kyp->h_payto,
                      &h_payto))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Account %llu provided, but h_payto does not match\n",
-                (unsigned long long) kyp->legitimization_uuid);
+                "Requirement %llu provided, but h_payto does not match\n",
+                (unsigned long long) kyp->requirement_row);
     GNUNET_break_op (0);
     *mhd_ret = TALER_MHD_reply_with_error (connection,
                                            MHD_HTTP_FORBIDDEN,
                                            TALER_EC_EXCHANGE_KYC_CHECK_AUTHORIZATION_FAILED,
                                            "h_payto");
+    GNUNET_free (requirements);
     return GNUNET_DB_STATUS_HARD_ERROR;
   }
-  kyp->found = true;
-  if (GNUNET_TIME_absolute_is_future (expiration))
-  {
-    /* kyc not required, we are done */
-    return qs;
-  }
-
-  ret = TALER_KYCLOGIC_kyc_get_logic (kyp->required,
-                                      &kyp->ih_logic,
-                                      &pd);
+  if (TALER_KYCLOGIC_check_satisfied (
+        requirements,
+        &h_payto,
+        TEH_plugin->select_satisfied_kyc_processes,
+        TEH_plugin->cls))
+    return GNUNET_DB_STATUS_SUCCESS_NO_RESULTS;
+
+  kyp->kyc_required = true;
+  ret = TALER_KYCLOGIC_requirements_to_logic (requirements,
+                                              kyp->ut,
+                                              &kyp->ih_logic,
+                                              &pd,
+                                              &kyp->section_name);
   if (GNUNET_OK != ret)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "KYC logic for `%s' not configured but used in database!\n",
-                kyp->required);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "KYC requirements `%s' cannot be checked, but are set as required in database!\n",
+                requirements);
     *mhd_ret = TALER_MHD_reply_with_error (connection,
                                            MHD_HTTP_INTERNAL_SERVER_ERROR,
                                            TALER_EC_EXCHANGE_KYC_GENERIC_LOGIC_GONE,
-                                           kyp->required);
+                                           requirements);
+    GNUNET_free (requirements);
     return GNUNET_DB_STATUS_HARD_ERROR;
   }
+  GNUNET_free (requirements);
+
   if (kyp->ih_done)
     return qs;
+
+  qs = TEH_plugin->insert_kyc_requirement_process (
+    TEH_plugin->cls,
+    &h_payto,
+    kyp->section_name,
+    NULL,
+    NULL,
+    &kyp->process_row);
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "Initiating KYC check with logic %s\n",
-              kyp->required);
+              kyp->ih_logic->name);
   kyp->ih = kyp->ih_logic->initiate (kyp->ih_logic->cls,
                                      pd,
                                      &h_payto,
-                                     kyp->legitimization_uuid,
+                                     kyp->process_row,
                                      &initiate_cb,
                                      kyp);
   GNUNET_break (NULL != kyp->ih);
@@ -421,22 +433,22 @@ TEH_handler_kyc_check (
     rc->rh_cleaner = &kyp_cleanup;
 
     {
-      unsigned long long legitimization_uuid;
+      unsigned long long requirement_row;
       char dummy;
 
       if (1 !=
           sscanf (args[0],
                   "%llu%c",
-                  &legitimization_uuid,
+                  &requirement_row,
                   &dummy))
       {
         GNUNET_break_op (0);
         return TALER_MHD_reply_with_error (rc->connection,
                                            MHD_HTTP_BAD_REQUEST,
                                            TALER_EC_GENERIC_PARAMETER_MALFORMED,
-                                           "legitimization_uuid");
+                                           "requirement_row");
       }
-      kyp->legitimization_uuid = (uint64_t) legitimization_uuid;
+      kyp->requirement_row = (uint64_t) requirement_row;
     }
 
     if (GNUNET_OK !=
@@ -527,12 +539,12 @@ TEH_handler_kyc_check (
   }
 
   if ( (NULL == kyp->ih) &&
-       (! kyp->found) )
+       (! kyp->kyc_required) )
   {
     /* KYC not required */
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "KYC not required %llu\n",
-                (unsigned long long) kyp->legitimization_uuid);
+                (unsigned long long) kyp->requirement_row);
     return TALER_MHD_reply_static (
       rc->connection,
       MHD_HTTP_NO_CONTENT,
@@ -554,7 +566,7 @@ TEH_handler_kyc_check (
   }
 
   /* long polling? */
-  if ( (NULL != kyp->required) &&
+  if ( (NULL != kyp->section_name) &&
        GNUNET_TIME_absolute_is_future (kyp->timeout))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
diff --git a/src/exchange/taler-exchange-httpd_kyc-proof.c b/src/exchange/taler-exchange-httpd_kyc-proof.c
index f6fa12eeb..a3de470db 100644
--- a/src/exchange/taler-exchange-httpd_kyc-proof.c
+++ b/src/exchange/taler-exchange-httpd_kyc-proof.c
@@ -90,14 +90,14 @@ struct KycProofContext
   struct MHD_Response *response;
 
   /**
-   * Configuration section for the logic we are running.
+   * Provider configuration section name of the logic we are running.
    */
-  char *provider_section;
+  const char *provider_section;
 
   /**
    * Row in the database for this legitimization operation.
    */
-  uint64_t legi_row;
+  uint64_t process_row;
 
   /**
    * HTTP response code to return.
@@ -194,13 +194,13 @@ proof_cb (
   {
     enum GNUNET_DB_QueryStatus qs;
 
-    qs = TEH_plugin->update_kyc_requirement_by_row (TEH_plugin->cls,
-                                                    kpc->legi_row,
-                                                    kpc->provider_section,
-                                                    &kpc->h_payto,
-                                                    provider_user_id,
-                                                    provider_legitimization_id,
-                                                    expiration);
+    qs = TEH_plugin->update_kyc_process_by_row (TEH_plugin->cls,
+                                                kpc->process_row,
+                                                kpc->provider_section,
+                                                &kpc->h_payto,
+                                                provider_user_id,
+                                                provider_legitimization_id,
+                                                expiration);
     if (GNUNET_DB_STATUS_HARD_ERROR == qs)
     {
       GNUNET_break (0);
@@ -216,8 +216,8 @@ proof_cb (
   else
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "KYC logic #%llu failed with status %d\n",
-                (unsigned long long) kpc->legi_row,
+                "KYC process #%llu failed with status %d\n",
+                (unsigned long long) kpc->process_row,
                 status);
   }
   kpc->response_code = http_status;
@@ -249,7 +249,6 @@ clean_kpc (struct TEH_RequestContext *rc)
   }
   GNUNET_free (kpc->provider_user_id);
   GNUNET_free (kpc->provider_legitimization_id);
-  GNUNET_free (kpc->provider_section);
   GNUNET_free (kpc);
 }
 
@@ -257,7 +256,7 @@ clean_kpc (struct TEH_RequestContext *rc)
 MHD_RESULT
 TEH_handler_kyc_proof (
   struct TEH_RequestContext *rc,
-  const char *const args[])
+  const char *const args[3])
 {
   struct KycProofContext *kpc = rc->rh_ctx;
 
@@ -290,28 +289,38 @@ TEH_handler_kyc_proof (
                                          TALER_EC_GENERIC_PARAMETER_MALFORMED,
                                          "h_payto");
     }
-    kpc->provider_section = GNUNET_strdup (args[1]);
     if (GNUNET_OK !=
-        TALER_KYCLOGIC_kyc_get_logic (kpc->provider_section,
-                                      &kpc->logic,
-                                      &kpc->pd))
+        TALER_KYCLOGIC_lookup_logic (args[1],
+                                     &kpc->logic,
+                                     &kpc->pd,
+                                     &kpc->provider_section))
     {
       GNUNET_break_op (0);
       return TALER_MHD_reply_with_error (rc->connection,
                                          MHD_HTTP_NOT_FOUND,
                                          TALER_EC_EXCHANGE_KYC_GENERIC_LOGIC_UNKNOWN,
-                                         kpc->provider_section);
+                                         args[1]);
+    }
+    if (0 != strcmp (args[1],
+                     kpc->provider_section))
+    {
+      GNUNET_break_op (0);
+      return TALER_MHD_reply_with_error (rc->connection,
+                                         MHD_HTTP_BAD_REQUEST,
+                                         TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                                         "PROVIDER_SECTION");
     }
 
+    if (NULL != kpc->provider_section)
     {
       enum GNUNET_DB_QueryStatus qs;
       struct GNUNET_TIME_Absolute expiration;
 
-      qs = TEH_plugin->lookup_kyc_requirement_by_account (
+      qs = TEH_plugin->lookup_kyc_process_by_account (
         TEH_plugin->cls,
         kpc->provider_section,
         &kpc->h_payto,
-        &kpc->legi_row,
+        &kpc->process_row,
         &expiration,
         &kpc->provider_user_id,
         &kpc->provider_legitimization_id);
@@ -346,7 +355,7 @@ TEH_handler_kyc_proof (
                                  &args[2],
                                  rc->connection,
                                  &kpc->h_payto,
-                                 kpc->legi_row,
+                                 kpc->process_row,
                                  kpc->provider_user_id,
                                  kpc->provider_legitimization_id,
                                  &proof_cb,
diff --git a/src/exchange/taler-exchange-httpd_kyc-proof.h b/src/exchange/taler-exchange-httpd_kyc-proof.h
index 30e1cafb2..98551557b 100644
--- a/src/exchange/taler-exchange-httpd_kyc-proof.h
+++ b/src/exchange/taler-exchange-httpd_kyc-proof.h
@@ -43,7 +43,7 @@ TEH_kyc_proof_cleanup (void);
 MHD_RESULT
 TEH_handler_kyc_proof (
   struct TEH_RequestContext *rc,
-  const char *const args[]);
+  const char *const args[3]);
 
 
 #endif
diff --git a/src/exchange/taler-exchange-httpd_kyc-wallet.c b/src/exchange/taler-exchange-httpd_kyc-wallet.c
index 9a1133c7f..81acde4c3 100644
--- a/src/exchange/taler-exchange-httpd_kyc-wallet.c
+++ b/src/exchange/taler-exchange-httpd_kyc-wallet.c
@@ -42,9 +42,9 @@ struct KycRequestContext
   struct TALER_PaytoHashP h_payto;
 
   /**
-   * Row with the legitimization requirement.
+   * KYC status, with row with the legitimization requirement.
    */
-  uint64_t legi_row;
+  struct TALER_EXCHANGEDB_KycStatus kyc;
 
   /**
    * Balance threshold crossed by the wallet.
@@ -116,16 +116,20 @@ wallet_kyc_check (void *cls,
     TEH_plugin->cls,
     &balance_iterator,
     krc);
-  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "KYC check required at %s is `%s'\n",
               TALER_amount2s (&krc->balance),
               krc->required);
   if (NULL == krc->required)
+  {
+    krc->kyc.ok = true;
     return GNUNET_DB_STATUS_SUCCESS_NO_RESULTS;
+  }
+  krc->kyc.ok = false;
   qs = TEH_plugin->insert_kyc_requirement_for_account (TEH_plugin->cls,
                                                        krc->required,
                                                        &krc->h_payto,
-                                                       &krc->legi_row);
+                                                       &krc->kyc.requirement_row);
   if (qs < 0)
   {
     if (GNUNET_DB_STATUS_SOFT_ERROR == qs)
@@ -140,7 +144,7 @@ wallet_kyc_check (void *cls,
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "KYC requirement inserted for wallet %s (%llu, %d)\n",
               TALER_B2S (&krc->h_payto),
-              (unsigned long long) krc->legi_row,
+              (unsigned long long) krc->kyc.requirement_row,
               qs);
   return qs;
 }
@@ -200,7 +204,7 @@ TEH_handler_kyc_wallet (
                                           &reserve_pub);
     TALER_payto_hash (payto_uri,
                       &krc.h_payto);
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "h_payto of wallet %s is %s\n",
                 payto_uri,
                 TALER_B2S (&krc.h_payto));
@@ -224,11 +228,9 @@ TEH_handler_kyc_wallet (
       NULL,
       0);
   }
-  return TALER_MHD_REPLY_JSON_PACK (
-    rc->connection,
-    MHD_HTTP_OK,
-    GNUNET_JSON_pack_uint64 ("legitimization_uuid",
-                             krc.legi_row));
+  return TEH_RESPONSE_reply_kyc_required (rc->connection,
+                                          &krc.h_payto,
+                                          &krc.kyc);
 }
 
 
diff --git a/src/exchange/taler-exchange-httpd_kyc-webhook.c b/src/exchange/taler-exchange-httpd_kyc-webhook.c
index 300335f1c..73038c139 100644
--- a/src/exchange/taler-exchange-httpd_kyc-webhook.c
+++ b/src/exchange/taler-exchange-httpd_kyc-webhook.c
@@ -58,6 +58,12 @@ struct KycWebhookContext
   struct TALER_KYCLOGIC_Plugin *plugin;
 
   /**
+   * Section in the configuration of the configured
+   * KYC provider.
+   */
+  const char *provider_section;
+
+  /**
    * Configuration for the specific action.
    */
   struct TALER_KYCLOGIC_ProviderDetails *pd;
@@ -73,12 +79,6 @@ struct KycWebhookContext
   struct MHD_Response *response;
 
   /**
-   * Logic the request is for. Name of the configuration
-   * section defining the KYC logic.
-   */
-  char *logic;
-
-  /**
    * HTTP response code to return.
    */
   unsigned int response_code;
@@ -147,8 +147,9 @@ TEH_kyc_webhook_cleanup (void)
  * will be done by the plugin.
  *
  * @param cls closure
- * @param legi_row legitimization request the webhook was about
+ * @param process_row legitimization process the webhook was about
  * @param account_id account the webhook was about
+ * @param provider_section name of the configuration section of the logic that was run
  * @param provider_user_id set to user ID at the provider, or NULL if not supported or unknown
  * @param provider_legitimization_id set to legitimization process ID at the provider, or NULL if not supported or unknown
  * @param status KYC status
@@ -159,8 +160,9 @@ TEH_kyc_webhook_cleanup (void)
 static void
 webhook_finished_cb (
   void *cls,
-  uint64_t legi_row,
+  uint64_t process_row,
   const struct TALER_PaytoHashP *account_id,
+  const char *provider_section,
   const char *provider_user_id,
   const char *provider_legitimization_id,
   enum TALER_KYCLOGIC_KycStatus status,
@@ -178,13 +180,13 @@ webhook_finished_cb (
     {
       enum GNUNET_DB_QueryStatus qs;
 
-      qs = TEH_plugin->update_kyc_requirement_by_row (TEH_plugin->cls,
-                                                      legi_row,
-                                                      kwh->logic,
-                                                      account_id,
-                                                      provider_user_id,
-                                                      provider_legitimization_id,
-                                                      expiration);
+      qs = TEH_plugin->update_kyc_process_by_row (TEH_plugin->cls,
+                                                  process_row,
+                                                  provider_section,
+                                                  account_id,
+                                                  provider_user_id,
+                                                  provider_legitimization_id,
+                                                  expiration);
       if (qs < 0)
       {
         GNUNET_break (0);
@@ -201,7 +203,7 @@ webhook_finished_cb (
                 "KYC status of %s/%s (Row #%llu) is %d\n",
                 provider_user_id,
                 provider_legitimization_id,
-                (unsigned long long) legi_row,
+                (unsigned long long) process_row,
                 status);
     break;
   }
@@ -231,7 +233,6 @@ clean_kwh (struct TEH_RequestContext *rc)
     MHD_destroy_response (kwh->response);
     kwh->response = NULL;
   }
-  GNUNET_free (kwh->logic);
   GNUNET_free (kwh);
 }
 
@@ -257,23 +258,23 @@ handler_kyc_webhook_generic (
   if (NULL == kwh)
   { /* first time */
     kwh = GNUNET_new (struct KycWebhookContext);
-    kwh->logic = GNUNET_strdup (args[0]);
     kwh->rc = rc;
     rc->rh_ctx = kwh;
     rc->rh_cleaner = &clean_kwh;
 
     if (GNUNET_OK !=
-        TALER_KYCLOGIC_kyc_get_logic (kwh->logic,
-                                      &kwh->plugin,
-                                      &kwh->pd))
+        TALER_KYCLOGIC_lookup_logic (args[0],
+                                     &kwh->plugin,
+                                     &kwh->pd,
+                                     &kwh->provider_section))
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                   "KYC logic `%s' unknown (check KYC provider configuration)\n",
-                  kwh->logic);
+                  args[0]);
       return TALER_MHD_reply_with_error (rc->connection,
                                          MHD_HTTP_NOT_FOUND,
                                          TALER_EC_EXCHANGE_KYC_GENERIC_LOGIC_UNKNOWN,
-                                         "$LOGIC");
+                                         "$NAME");
     }
     kwh->wh = kwh->plugin->webhook (kwh->plugin->cls,
                                     kwh->pd,
diff --git a/src/exchange/taler-exchange-httpd_purses_merge.c b/src/exchange/taler-exchange-httpd_purses_merge.c
index 9ce3033d5..c1582948b 100644
--- a/src/exchange/taler-exchange-httpd_purses_merge.c
+++ b/src/exchange/taler-exchange-httpd_purses_merge.c
@@ -291,7 +291,7 @@ merge_transaction (void *cls,
       TEH_plugin->cls,
       required,
       &pcc->h_payto,
-      &pcc->kyc.legitimization_uuid);
+      &pcc->kyc.requirement_row);
   }
   pcc->kyc.ok = true;
   qs = TEH_plugin->do_purse_merge (
@@ -665,6 +665,7 @@ TEH_handler_purses_merge (
   GNUNET_free (pcc.provider_url);
   if (! pcc.kyc.ok)
     return TEH_RESPONSE_reply_kyc_required (connection,
+                                            &pcc.h_payto,
                                             &pcc.kyc);
 
   {
diff --git a/src/exchange/taler-exchange-httpd_reserves_purse.c b/src/exchange/taler-exchange-httpd_reserves_purse.c
index 450651e4c..f7266bd24 100644
--- a/src/exchange/taler-exchange-httpd_reserves_purse.c
+++ b/src/exchange/taler-exchange-httpd_reserves_purse.c
@@ -206,7 +206,7 @@ purse_transaction (void *cls,
       TEH_plugin->cls,
       required,
       &rpc->h_payto,
-      &rpc->kyc.legitimization_uuid);
+      &rpc->kyc.requirement_row);
   }
   rpc->kyc.ok = true;
 
@@ -709,6 +709,7 @@ TEH_handler_reserves_purse (
 
   if (! rpc.kyc.ok)
     return TEH_RESPONSE_reply_kyc_required (connection,
+                                            &rpc.h_payto,
                                             &rpc.kyc);
   /* generate regular response */
   {
diff --git a/src/exchange/taler-exchange-httpd_responses.c b/src/exchange/taler-exchange-httpd_responses.c
index 4b42b48b5..516b36460 100644
--- a/src/exchange/taler-exchange-httpd_responses.c
+++ b/src/exchange/taler-exchange-httpd_responses.c
@@ -979,13 +979,16 @@ TEH_RESPONSE_reply_purse_created (
 
 MHD_RESULT
 TEH_RESPONSE_reply_kyc_required (struct MHD_Connection *connection,
+                                 const struct TALER_PaytoHashP *h_payto,
                                  const struct TALER_EXCHANGEDB_KycStatus *kyc)
 {
   return TALER_MHD_REPLY_JSON_PACK (
     connection,
     MHD_HTTP_UNAVAILABLE_FOR_LEGAL_REASONS,
-    GNUNET_JSON_pack_uint64 ("legitimization_uuid",
-                             kyc->legitimization_uuid));
+    GNUNET_JSON_pack_data_auto ("h_payto",
+                                h_payto),
+    GNUNET_JSON_pack_uint64 ("requirement_row",
+                             kyc->requirement_row));
 }
 
 
diff --git a/src/exchange/taler-exchange-httpd_responses.h b/src/exchange/taler-exchange-httpd_responses.h
index 9df5646cd..3eebf0274 100644
--- a/src/exchange/taler-exchange-httpd_responses.h
+++ b/src/exchange/taler-exchange-httpd_responses.h
@@ -79,11 +79,13 @@ TEH_RESPONSE_reply_reserve_insufficient_balance (
  * satisfied to proceed to client.
  *
  * @param connection connection to the client
+ * @param h_payto account identifier to include in reply
  * @param kyc details about the KYC requirements
  * @return MHD result code
  */
 MHD_RESULT
 TEH_RESPONSE_reply_kyc_required (struct MHD_Connection *connection,
+                                 const struct TALER_PaytoHashP *h_payto,
                                  const struct TALER_EXCHANGEDB_KycStatus *kyc);
 
 
diff --git a/src/exchange/taler-exchange-httpd_withdraw.c b/src/exchange/taler-exchange-httpd_withdraw.c
index d70999d64..57020ee87 100644
--- a/src/exchange/taler-exchange-httpd_withdraw.c
+++ b/src/exchange/taler-exchange-httpd_withdraw.c
@@ -179,7 +179,7 @@ withdraw_transaction (void *cls,
         TEH_plugin->cls,
         kyc_required,
         &wc->h_payto,
-        &wc->kyc.legitimization_uuid);
+        &wc->kyc.requirement_row);
     }
   }
   wc->kyc.ok = true;
@@ -489,6 +489,7 @@ TEH_handler_withdraw (struct TEH_RequestContext *rc,
 
   if (! wc.kyc.ok)
     return TEH_RESPONSE_reply_kyc_required (rc->connection,
+                                            &wc.h_payto,
                                             &wc.kyc);
   {
     MHD_RESULT ret;