Remove deprecated CoreBank Withdrawal API

8 files changed, 9 insertions, 62 deletions

diff --git a/API_CHANGES.md b/API_CHANGES.md
index c7009eca..6296d7a2 100644
--- a/API_CHANGES.md
+++ b/API_CHANGES.md
@@ -15,6 +15,10 @@ This files contains all the API changes for the current release:
 - GET /accounts/USERNAME: add is_public and is_taler_exchange
 - GET /public-accounts: add is_taler_exchange and rename account_name to username
 - PATCH /accounts: fix PATCH semantic
+- Remove deprecate unsecure CoreBank Withdrawal API
+    - Drop POST /withdrawals/WITHDRAWAL_ID/abort
+    - Drop POST /withdrawals/WITHDRAWAL_ID/confirm
+    - Drop aborted, confirmation_done and selection_done fields from GET /withdrawals/WITHDRAWAL_ID
 
 ## bank cli
 
diff --git a/bank/src/main/kotlin/tech/libeufin/bank/CoreBankApi.kt b/bank/src/main/kotlin/tech/libeufin/bank/CoreBankApi.kt
index e5a87768..c294416b 100644
--- a/bank/src/main/kotlin/tech/libeufin/bank/CoreBankApi.kt
+++ b/bank/src/main/kotlin/tech/libeufin/bank/CoreBankApi.kt
@@ -473,46 +473,6 @@ private fun Routing.coreBankWithdrawalApi(db: Database, ctx: BankConfig) {
         )
         call.respond(op)
     }
-    post("/withdrawals/{withdrawal_id}/abort") {
-        val opId = call.uuidUriComponent("withdrawal_id")
-        when (db.withdrawal.abort(opId)) {
-            AbortResult.UnknownOperation -> throw notFound(
-                "Withdrawal operation $opId not found",
-                TalerErrorCode.BANK_TRANSACTION_NOT_FOUND
-            )
-            AbortResult.AlreadyConfirmed -> throw conflict(
-                "Cannot abort confirmed withdrawal", 
-                TalerErrorCode.BANK_ABORT_CONFIRM_CONFLICT
-            )
-            AbortResult.Success -> call.respond(HttpStatusCode.NoContent)
-        }
-    }
-    post("/withdrawals/{withdrawal_id}/confirm") {
-        val opId = call.uuidUriComponent("withdrawal_id")
-        when (db.withdrawal.confirm(opId, Instant.now())) {
-            WithdrawalConfirmationResult.UnknownOperation -> throw notFound(
-                "Withdrawal operation $opId not found",
-                TalerErrorCode.BANK_TRANSACTION_NOT_FOUND
-            )
-            WithdrawalConfirmationResult.AlreadyAborted -> throw conflict(
-                "Cannot confirm an aborted withdrawal",
-                TalerErrorCode.BANK_CONFIRM_ABORT_CONFLICT
-            )
-            WithdrawalConfirmationResult.NotSelected -> throw conflict(
-                "Cannot confirm an unselected withdrawal",
-                TalerErrorCode.BANK_CONFIRM_INCOMPLETE
-            )
-            WithdrawalConfirmationResult.BalanceInsufficient -> throw conflict(
-                "Insufficient funds",
-                TalerErrorCode.BANK_UNALLOWED_DEBIT
-            )
-            WithdrawalConfirmationResult.UnknownExchange -> throw conflict(
-                "Exchange to withdraw from not found",
-                TalerErrorCode.BANK_UNKNOWN_CREDITOR
-            )
-            WithdrawalConfirmationResult.Success -> call.respond(HttpStatusCode.NoContent)
-        }
-    }
 }
 
 private fun Routing.coreBankCashoutApi(db: Database, ctx: BankConfig) = conditional(ctx.allowConversion) {
diff --git a/bank/src/main/kotlin/tech/libeufin/bank/TalerMessage.kt b/bank/src/main/kotlin/tech/libeufin/bank/TalerMessage.kt
index 72633c73..61c71c1a 100644
--- a/bank/src/main/kotlin/tech/libeufin/bank/TalerMessage.kt
+++ b/bank/src/main/kotlin/tech/libeufin/bank/TalerMessage.kt
@@ -400,11 +400,7 @@ data class WithdrawalPublicInfo (
     val amount: TalerAmount,
     val username: String,
     val selected_reserve_pub: EddsaPublicKey? = null,
-    val selected_exchange_account: String? = null,
-    // TODO remove
-    val aborted: Boolean,
-    val confirmation_done: Boolean,
-    val selection_done: Boolean,
+    val selected_exchange_account: String? = null
 )
 
 @Serializable
diff --git a/bank/src/main/kotlin/tech/libeufin/bank/db/WithdrawalDAO.kt b/bank/src/main/kotlin/tech/libeufin/bank/db/WithdrawalDAO.kt
index bc0b49ce..5bf1c4ec 100644
--- a/bank/src/main/kotlin/tech/libeufin/bank/db/WithdrawalDAO.kt
+++ b/bank/src/main/kotlin/tech/libeufin/bank/db/WithdrawalDAO.kt
@@ -233,9 +233,6 @@ class WithdrawalDAO(private val db: Database) {
                     END as status
                     ,(amount).val as amount_val
                     ,(amount).frac as amount_frac
-                    ,selection_done     
-                    ,aborted     
-                    ,confirmation_done     
                     ,reserve_pub
                     ,selected_exchange_payto
                     ,login
@@ -252,9 +249,6 @@ class WithdrawalDAO(private val db: Database) {
                         username = it.getString("login"),
                         selected_exchange_account = it.getString("selected_exchange_payto"),
                         selected_reserve_pub = it.getBytes("reserve_pub")?.run(::EddsaPublicKey),
-                        selection_done = it.getBoolean("selection_done"),
-                        confirmation_done = it.getBoolean("confirmation_done"),
-                        aborted = it.getBoolean("aborted"),
                     )
                 }
             }
diff --git a/bank/src/test/kotlin/BankIntegrationApiTest.kt b/bank/src/test/kotlin/BankIntegrationApiTest.kt
index bbe1bafb..b8379ea2 100644
--- a/bank/src/test/kotlin/BankIntegrationApiTest.kt
+++ b/bank/src/test/kotlin/BankIntegrationApiTest.kt
@@ -53,7 +53,6 @@ class BankIntegrationApiTest {
                 assert(!it.aborted)
                 assert(!it.transfer_done)
                 assertEquals(amount, it.amount)
-                // TODO check all status
             }
         }
 
diff --git a/bank/src/test/kotlin/CoreBankApiTest.kt b/bank/src/test/kotlin/CoreBankApiTest.kt
index 85a780dc..eb18eab9 100644
--- a/bank/src/test/kotlin/CoreBankApiTest.kt
+++ b/bank/src/test/kotlin/CoreBankApiTest.kt
@@ -820,14 +820,8 @@ class CoreBankWithdrawalApiTest {
         client.postA("/accounts/merchant/withdrawals") {
             json { "amount" to amount}
         }.assertOkJson<BankAccountCreateWithdrawalResponse> {
-            client.get("/withdrawals/${it.withdrawal_id}") {
-                pwAuth("merchant")
-            }.assertOkJson<WithdrawalPublicInfo> {
-                assert(!it.selection_done)
-                assert(!it.aborted)
-                assert(!it.confirmation_done)
+            client.get("/withdrawals/${it.withdrawal_id}").assertOkJson<WithdrawalPublicInfo> {
                 assertEquals(amount, it.amount)
-                // TODO check all status
             }
         }
 
diff --git a/bank/src/test/kotlin/helpers.kt b/bank/src/test/kotlin/helpers.kt
index 3cef3f2c..7c4a2e46 100644
--- a/bank/src/test/kotlin/helpers.kt
+++ b/bank/src/test/kotlin/helpers.kt
@@ -227,7 +227,7 @@ suspend fun ApplicationTestBuilder.withdrawal(amount: String) {
     }.assertOkJson<BankAccountCreateWithdrawalResponse> {
         val uuid = it.taler_withdraw_uri.split("/").last()
         withdrawalSelect(uuid)
-        client.postA("/withdrawals/${uuid}/confirm")
+        client.postA("/accounts/merchant/withdrawals/${uuid}/confirm")
             .assertNoContent()
     }
 }
diff --git a/bank/src/test/kotlin/routines.kt b/bank/src/test/kotlin/routines.kt
index 6a915d58..4eb37850 100644
--- a/bank/src/test/kotlin/routines.kt
+++ b/bank/src/test/kotlin/routines.kt
@@ -256,7 +256,7 @@ inline suspend fun <reified B> ApplicationTestBuilder.statusRoutine(
                 }
             }
             delay(100)
-            client.post("/withdrawals/$confirmed_uuid/confirm").assertNoContent()
+            client.postA("/accounts/customer/withdrawals/$confirmed_uuid/confirm").assertNoContent()
         }
 
         // Polling abort
@@ -274,7 +274,7 @@ inline suspend fun <reified B> ApplicationTestBuilder.statusRoutine(
                 }
             }
             delay(100)
-            client.post("/withdrawals/$aborted_uuid/abort").assertNoContent()
+            client.postA("/accounts/customer/withdrawals/$aborted_uuid/abort").assertNoContent()
         }
     }
 }
\ No newline at end of file