exchange

test_withdraw.c (22857B)

---

 /*
   This file is part of TALER
   Copyright (C) 2026 Taler Systems SA
 
   TALER is free software; you can redistribute it and/or modify it under the
   terms of the GNU General Public License as published by the Free Software
   Foundation; either version 3, or (at your option) any later version.
 
   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 
   You should have received a copy of the GNU General Public License along with
   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
 */
 /**
  * @file exchangedb/test_withdraw.c
  * @brief tests for the exchangedb functions whose primary table is
  *        `withdraw`
  * @author Christian Grothoff
  *
  * Covers #TALER_EXCHANGEDB_do_withdraw(),
  * #TALER_EXCHANGEDB_get_withdraw(),
  * #TALER_EXCHANGEDB_iterate_withdrawals_above_serial_id() and
  * #TALER_EXCHANGEDB_iterate_withdraw_amounts_for_kyc_check().
  *
  * `withdraw` references `reserves` and `denominations`.  do_withdraw() has
  * four distinct "did not do the work" answers -- unknown reserve,
  * insufficient balance, age requirement not met and blinding-seed reuse --
  * plus an idempotent replay, and each of them is checked.
  */
 #include "test_common.h"
 #include "exchange-database/do_withdraw.h"
 #include "exchange-database/get_withdraw.h"
 #include "exchange-database/get_reserve.h"
 #include "exchange-database/iterate_withdrawals_above_serial_id.h"
 #include "exchange-database/iterate_withdraw_amounts_for_kyc_check.h"
 
 
 /**
  * Account the checks fund their reserves from.
  */
 static struct TDB_Account account;
 
 
 /**
  * Denomination the checks withdraw.
  */
 static struct TDB_Denom denom;
 
 
 /**
  * Fill in a withdraw request for one coin of #denom.
  *
  * @param seed seed for the planchet hash, signature and blinding seed
  * @param amount amount to withdraw, e.g. "5"
  * @param reserve_pub reserve to withdraw from
  * @param with_seed true to pass a blinding seed
  * @param[out] wd set to the request; release with free_withdraw()
  */
 static void
 make_withdraw (uint32_t seed,
                const char *amount,
                const struct TALER_ReservePublicKeyP *reserve_pub,
                bool with_seed,
                struct TALER_EXCHANGEDB_Withdraw *wd)
 {
   memset (wd,
           0,
           sizeof (*wd));
   wd->amount_with_fee = TDB_amount (amount);
   wd->age_proof_required = false;
   wd->reserve_pub = *reserve_pub;
   TDB_fill (&wd->planchets_h,
             sizeof (wd->planchets_h),
             seed);
   TDB_fill (&wd->reserve_sig,
             sizeof (wd->reserve_sig),
             seed);
   wd->num_coins = 1;
   wd->denom_serials = GNUNET_new (uint64_t);
   wd->denom_serials[0] = denom.serial;
   wd->denom_sigs = GNUNET_new (struct TALER_BlindedDenominationSignature);
   TDB_blinded_denom_sig (seed,
                          &wd->denom_sigs[0]);
   wd->no_blinding_seed = ! with_seed;
   if (with_seed)
     TDB_fill (&wd->blinding_seed,
               sizeof (wd->blinding_seed),
               seed);
 }
 
 
 /**
  * Release what make_withdraw() allocated.
  *
  * @param[in,out] wd request to clean up
  */
 static void
 free_withdraw (struct TALER_EXCHANGEDB_Withdraw *wd)
 {
   for (size_t i = 0; i<wd->num_coins; i++)
     TALER_blinded_denom_sig_free (&wd->denom_sigs[i]);
   GNUNET_free (wd->denom_sigs);
   GNUNET_free (wd->denom_serials);
 }
 
 
 /**
  * Run a withdraw request.
  *
  * @param pg the database context
  * @param wd the request
  * @param[out] st set to the outcome flags
  * @return transaction status
  */
 struct WithdrawStatus
 {
   /**
    * Was the balance sufficient?
    */
   bool balance_ok;
 
   /**
    * Were the age requirements met?
    */
   bool age_ok;
 
   /**
    * Was this a replay?
    */
   bool idempotent;
 
   /**
    * Was the blinding seed used before?
    */
   bool nonce_reuse;
 
   /**
    * Balance the reserve had.
    */
   struct TALER_Amount reserve_balance;
 
   /**
    * Maximum age the reserve allows.
    */
   uint16_t allowed_maximum_age;
 
   /**
    * Birthday recorded for the reserve.
    */
   uint32_t reserve_birthday;
 
   /**
    * Index the exchange chose not to reveal.
    */
   uint16_t noreveal_index;
 };
 
 
 /**
  * Perform a withdraw request.
  *
  * @param pg the database context
  * @param wd the request
  * @param[out] st set to the outcome
  * @return transaction status
  */
 static enum GNUNET_DB_QueryStatus
 run_withdraw (struct TALER_EXCHANGEDB_PostgresContext *pg,
               const struct TALER_EXCHANGEDB_Withdraw *wd,
               struct WithdrawStatus *st)
 {
   struct GNUNET_TIME_Timestamp now = GNUNET_TIME_timestamp_get ();
 
   memset (st,
           0,
           sizeof (*st));
   return TALER_EXCHANGEDB_do_withdraw (pg,
                                        wd,
                                        &now,
                                        &st->balance_ok,
                                        &st->reserve_balance,
                                        &st->age_ok,
                                        &st->allowed_maximum_age,
                                        &st->reserve_birthday,
                                        &st->idempotent,
                                        &st->noreveal_index,
                                        &st->nonce_reuse);
 }
 
 
 /**
  * Closure for #withdraw_cb().
  */
 struct WithdrawContext
 {
   /**
    * How many rows did the callback see?
    */
   unsigned int total;
 
   /**
    * Stop after this many rows; 0 for no limit.
    */
   unsigned int stop_after;
 
   /**
    * Planchet hash we are looking for, NULL to match nothing.
    */
   const struct TALER_HashBlindedPlanchetsP *planchets_h;
 
   /**
    * How many times did we see it?
    */
   unsigned int matched;
 
   /**
    * Amount reported for it.
    */
   struct TALER_Amount amount;
 
   /**
    * Denomination serials reported for it.
    */
   uint64_t denom_serial;
 
   /**
    * Number of denominations reported for it.
    */
   size_t num_denom_serials;
 
   /**
    * Was a blinding seed reported for it?
    */
   bool have_seed;
 };
 
 
 /**
  * Callback for #TALER_EXCHANGEDB_iterate_withdrawals_above_serial_id().
  *
  * @param cls a `struct WithdrawContext *`
  * @param rowid row of the withdraw
  * @param num_denom_serials number of denominations withdrawn
  * @param denom_serials the denominations withdrawn
  * @param selected_h hash over the selected planchets
  * @param h_planchets hash over all planchets
  * @param blinding_seed blinding seed, NULL if none
  * @param age_proof_required was an age proof required?
  * @param max_age maximum age of the coins
  * @param noreveal_index index the exchange did not reveal
  * @param reserve_pub reserve that was drained
  * @param reserve_sig signature over the request
  * @param execution_date when the withdraw happened
  * @param amount_with_fee how much was withdrawn
  * @return #GNUNET_OK to continue, #GNUNET_SYSERR to stop
  */
 static enum GNUNET_GenericReturnValue
 withdraw_cb (void *cls,
              uint64_t rowid,
              size_t num_denom_serials,
              const uint64_t *denom_serials,
              const struct TALER_HashBlindedPlanchetsP *selected_h,
              const struct TALER_HashBlindedPlanchetsP *h_planchets,
              const struct TALER_BlindingMasterSeedP *blinding_seed,
              bool age_proof_required,
              uint8_t max_age,
              uint8_t noreveal_index,
              const struct TALER_ReservePublicKeyP *reserve_pub,
              const struct TALER_ReserveSignatureP *reserve_sig,
              struct GNUNET_TIME_Timestamp execution_date,
              const struct TALER_Amount *amount_with_fee)
 {
   struct WithdrawContext *ctx = cls;
 
   (void) rowid;
   (void) selected_h;
   (void) age_proof_required;
   (void) max_age;
   (void) noreveal_index;
   (void) reserve_pub;
   (void) reserve_sig;
   (void) execution_date;
   ctx->total++;
   if ( (NULL != ctx->planchets_h) &&
        (0 == GNUNET_memcmp (h_planchets,
                             ctx->planchets_h)) )
   {
     ctx->matched++;
     ctx->amount = *amount_with_fee;
     ctx->num_denom_serials = num_denom_serials;
     if (0 < num_denom_serials)
       ctx->denom_serial = denom_serials[0];
     ctx->have_seed = (NULL != blinding_seed);
   }
   if ( (0 != ctx->stop_after) &&
        (ctx->total >= ctx->stop_after) )
     return GNUNET_SYSERR;
   return GNUNET_OK;
 }
 
 
 /**
  * Closure for #amount_cb().
  */
 struct AmountContext
 {
   /**
    * How many amounts did the callback see?
    */
   unsigned int total;
 
   /**
    * Sum of the whole-unit parts of the amounts seen.
    */
   uint64_t value_sum;
 
   /**
    * Return this from the callback.
    */
   enum GNUNET_GenericReturnValue ret;
 };
 
 
 /**
  * Callback for #TALER_EXCHANGEDB_iterate_withdraw_amounts_for_kyc_check().
  *
  * @param cls a `struct AmountContext *`
  * @param amount the withdrawn amount
  * @param date when it was withdrawn
  * @return what @e ret of the closure says
  */
 static enum GNUNET_GenericReturnValue
 amount_cb (void *cls,
            const struct TALER_Amount *amount,
            struct GNUNET_TIME_Absolute date)
 {
   struct AmountContext *ctx = cls;
 
   (void) date;
   ctx->total++;
   ctx->value_sum += amount->value;
   return ctx->ret;
 }
 
 
 /**
  * Withdrawing from a reserve that does not exist does nothing.
  *
  * @param pg the database context
  * @return 0 on success
  */
 static int
 check_unknown_reserve (struct TALER_EXCHANGEDB_PostgresContext *pg)
 {
   struct TALER_ReservePublicKeyP reserve_pub;
   struct TALER_EXCHANGEDB_Withdraw wd;
   struct WithdrawStatus st;
   struct TALER_HashBlindedPlanchetsP h;
 
   TDB_denom (pg,
              10,
              "5",
              "0.1",
              &denom);
   TDB_FILL (reserve_pub,
             1);
   make_withdraw (1,
                  "5",
                  &reserve_pub,
                  false,
                  &wd);
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
             run_withdraw (pg,
                           &wd,
                           &st),
             free_withdraw (&wd));
   free_withdraw (&wd);
   FAILIF (0 != TDB_count (pg,
                           "FROM withdraw"));
   TDB_FILL (h,
             1);
   {
     struct TALER_EXCHANGEDB_Withdraw got;
 
     FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
             TALER_EXCHANGEDB_get_withdraw (pg,
                                            &h,
                                            &got));
   }
   return 0;
 }
 
 
 /**
  * A reserve without enough money keeps it.
  *
  * @param pg the database context
  * @return 0 on success
  */
 static int
 check_insufficient_balance (struct TALER_EXCHANGEDB_PostgresContext *pg)
 {
   struct TALER_ReservePublicKeyP reserve_pub;
   struct TALER_EXCHANGEDB_Withdraw wd;
   struct WithdrawStatus st;
   struct TALER_Amount expect = TDB_amount ("1");
 
   TDB_account (pg,
                10,
                &account);
   TDB_reserve_in (pg,
                   &account,
                   10,
                   "1",
                   &reserve_pub);
   make_withdraw (2,
                  "5",
                  &reserve_pub,
                  false,
                  &wd);
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             run_withdraw (pg,
                           &wd,
                           &st),
             free_withdraw (&wd));
   free_withdraw (&wd);
   FAILIF (st.balance_ok);
   FAILIF (! st.age_ok);
   FAILIF (st.idempotent);
   FAILIF (0 != TALER_amount_cmp (&st.reserve_balance,
                                  &expect));
   FAILIF (0 != TDB_count (pg,
                           "FROM withdraw"));
   return 0;
 }
 
 
 /**
  * A funded reserve is drained and the withdraw is recorded.
  *
  * @param pg the database context
  * @return 0 on success
  */
 static int
 check_withdraw (struct TALER_EXCHANGEDB_PostgresContext *pg)
 {
   struct TALER_ReservePublicKeyP reserve_pub;
   struct TALER_EXCHANGEDB_Withdraw wd;
   struct TALER_EXCHANGEDB_Withdraw got;
   struct TALER_EXCHANGEDB_Reserve reserve;
   struct WithdrawStatus st;
   struct TALER_Amount expect_balance = TDB_amount ("5");
   struct TALER_Amount expect_left = TDB_amount ("5");
 
   TDB_reserve_in (pg,
                   &account,
                   11,
                   "10",
                   &reserve_pub);
   make_withdraw (11,
                  "5",
                  &reserve_pub,
                  true,
                  &wd);
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             run_withdraw (pg,
                           &wd,
                           &st),
             free_withdraw (&wd));
   FAILIF_C (! st.balance_ok,
             free_withdraw (&wd));
   FAILIF_C (! st.age_ok,
             free_withdraw (&wd));
   FAILIF_C (st.idempotent,
             free_withdraw (&wd));
   FAILIF_C (st.nonce_reuse,
             free_withdraw (&wd));
   FAILIF_C (1 != TDB_count (pg,
                             "FROM withdraw"),
             free_withdraw (&wd));
 
   /* the reserve was debited */
   memset (&reserve,
           0,
           sizeof (reserve));
   reserve.pub = reserve_pub;
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             TALER_EXCHANGEDB_get_reserve (pg,
                                           &reserve),
             free_withdraw (&wd));
   FAILIF_C (0 != TALER_amount_cmp (&reserve.balance,
                                    &expect_left),
             free_withdraw (&wd));
 
   /* the request can be looked up by its planchet hash */
   memset (&got,
           0,
           sizeof (got));
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             TALER_EXCHANGEDB_get_withdraw (pg,
                                            &wd.planchets_h,
                                            &got),
             free_withdraw (&wd));
   FAILIF_C (0 != TALER_amount_cmp (&got.amount_with_fee,
                                    &expect_balance),
             free_withdraw (&got); free_withdraw (&wd));
   /* ... and names its reserve and its row */
   FAILIF_C (0 != GNUNET_memcmp (&got.reserve_pub,
                                 &reserve_pub),
             free_withdraw (&got); free_withdraw (&wd));
   FAILIF_C (0 == got.withdraw_id,
             free_withdraw (&got); free_withdraw (&wd));
   FAILIF_C (0 != GNUNET_memcmp (&got.reserve_pub,
                                 &reserve_pub),
             free_withdraw (&got); free_withdraw (&wd));
   FAILIF_C (0 != GNUNET_memcmp (&got.reserve_sig,
                                 &wd.reserve_sig),
             free_withdraw (&got); free_withdraw (&wd));
   FAILIF_C (1 != got.num_coins,
             free_withdraw (&got); free_withdraw (&wd));
   FAILIF_C (denom.serial != got.denom_serials[0],
             free_withdraw (&got); free_withdraw (&wd));
   FAILIF_C (got.no_blinding_seed,
             free_withdraw (&got); free_withdraw (&wd));
   free_withdraw (&got);
 
   /* a replay of the same request is idempotent and does not debit again */
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             run_withdraw (pg,
                           &wd,
                           &st),
             free_withdraw (&wd));
   FAILIF_C (! st.idempotent,
             free_withdraw (&wd));
   FAILIF_C (1 != TDB_count (pg,
                             "FROM withdraw"),
             free_withdraw (&wd));
   memset (&reserve,
           0,
           sizeof (reserve));
   reserve.pub = reserve_pub;
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             TALER_EXCHANGEDB_get_reserve (pg,
                                           &reserve),
             free_withdraw (&wd));
   FAILIF_C (0 != TALER_amount_cmp (&reserve.balance,
                                    &expect_left),
             free_withdraw (&wd));
   free_withdraw (&wd);
   return 0;
 }
 
 
 /**
  * Reusing a blinding seed for a different withdraw is refused, and the
  * reserve is left debited -- the caller has to roll back.
  *
  * @param pg the database context
  * @return 0 on success
  */
 static int
 check_nonce_reuse (struct TALER_EXCHANGEDB_PostgresContext *pg)
 {
   struct TALER_ReservePublicKeyP reserve_pub;
   struct TALER_EXCHANGEDB_Withdraw wd;
   struct WithdrawStatus st;
 
   TDB_reserve_in (pg,
                   &account,
                   12,
                   "10",
                   &reserve_pub);
   /* a fresh planchet hash, but the blinding seed of check_withdraw() */
   make_withdraw (13,
                  "5",
                  &reserve_pub,
                  true,
                  &wd);
   TDB_fill (&wd.blinding_seed,
             sizeof (wd.blinding_seed),
             11);
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             run_withdraw (pg,
                           &wd,
                           &st),
             free_withdraw (&wd));
   FAILIF_C (! st.nonce_reuse,
             free_withdraw (&wd));
   FAILIF_C (st.idempotent,
             free_withdraw (&wd));
   free_withdraw (&wd);
   /* No withdraw row was written... */
   FAILIF (1 != TDB_count (pg,
                           "FROM withdraw"));
   /* ...but the reserve was debited before the seed was checked, so the
      caller has to roll the transaction back.  This is what the check is
      really about: the function is not safe to call outside a transaction. */
   {
     struct TALER_EXCHANGEDB_Reserve reserve;
     struct TALER_Amount debited = TDB_amount ("5");
 
     memset (&reserve,
             0,
             sizeof (reserve));
     reserve.pub = reserve_pub;
     FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             TALER_EXCHANGEDB_get_reserve (pg,
                                           &reserve));
     FAILIF (0 != TALER_amount_cmp (&reserve.balance,
                                    &debited));
   }
   return 0;
 }
 
 
 /**
  * A reserve with a birthday refuses a withdraw that commits to too high
  * an age.
  *
  * @param pg the database context
  * @return 0 on success
  */
 static int
 check_age_restriction (struct TALER_EXCHANGEDB_PostgresContext *pg)
 {
   struct TALER_ReservePublicKeyP reserve_pub;
   struct TALER_EXCHANGEDB_Withdraw wd;
   struct WithdrawStatus st;
   char *hex;
 
   TDB_reserve_in (pg,
                   &account,
                   14,
                   "10",
                   &reserve_pub);
   /* born 20000 days after the epoch, i.e. in 2024 */
   hex = TDB_hex (&reserve_pub,
                  sizeof (reserve_pub));
   FAILIF_C (GNUNET_OK !=
             TDB_exec (pg,
                       "UPDATE reserves"
                       " SET birthday=20000"
                       " WHERE reserve_pub=decode('%s','hex');",
                       hex),
             GNUNET_free (hex));
   GNUNET_free (hex);
 
   make_withdraw (14,
                  "5",
                  &reserve_pub,
                  false,
                  &wd);
   /* no age commitment at all, from a reserve that has a birthday */
   FAILIF_C (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             run_withdraw (pg,
                           &wd,
                           &st),
             free_withdraw (&wd));
   free_withdraw (&wd);
   FAILIF (st.age_ok);
   FAILIF (20000 != st.reserve_birthday);
   FAILIF (1 != TDB_count (pg,
                           "FROM withdraw"));
   return 0;
 }
 
 
 /**
  * The iterators see the withdraw, and the KYC view attributes it to the
  * account that funded the reserve.
  *
  * @param pg the database context
  * @return 0 on success
  */
 static int
 check_iterate (struct TALER_EXCHANGEDB_PostgresContext *pg)
 {
   struct TALER_HashBlindedPlanchetsP h;
   struct WithdrawContext ctx;
   struct AmountContext actx;
 
   TDB_FILL (h,
             11);
   memset (&ctx,
           0,
           sizeof (ctx));
   ctx.planchets_h = &h;
   FAILIF (1 !=
           TALER_EXCHANGEDB_iterate_withdrawals_above_serial_id (pg,
                                                                 0,
                                                                 &withdraw_cb,
                                                                 &ctx));
   FAILIF (1 != ctx.matched);
   FAILIF (1 != ctx.num_denom_serials);
   FAILIF (denom.serial != ctx.denom_serial);
   FAILIF (! ctx.have_seed);
 
   memset (&ctx,
           0,
           sizeof (ctx));
   FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
           TALER_EXCHANGEDB_iterate_withdrawals_above_serial_id (pg,
                                                                 1000,
                                                                 &withdraw_cb,
                                                                 &ctx));
   FAILIF (0 != ctx.total);
 
   memset (&ctx,
           0,
           sizeof (ctx));
   ctx.stop_after = 1;
   FAILIF (1 !=
           TALER_EXCHANGEDB_iterate_withdrawals_above_serial_id (pg,
                                                                 0,
                                                                 &withdraw_cb,
                                                                 &ctx));
   FAILIF (1 != ctx.total);
 
   /* the KYC view groups by the account that funded the reserve */
   memset (&actx,
           0,
           sizeof (actx));
   actx.ret = GNUNET_OK;
   FAILIF (1 !=
           TALER_EXCHANGEDB_iterate_withdraw_amounts_for_kyc_check (
             pg,
             &account.h_normalized,
             GNUNET_TIME_UNIT_ZERO_ABS,
             &amount_cb,
             &actx));
   FAILIF (5 != actx.value_sum);
 
   /* an account nobody withdrew against has nothing */
   {
     struct TALER_NormalizedPaytoHashP other;
 
     TDB_FILL (other,
               77);
     memset (&actx,
             0,
             sizeof (actx));
     actx.ret = GNUNET_OK;
     FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
             TALER_EXCHANGEDB_iterate_withdraw_amounts_for_kyc_check (
               pg,
               &other,
               GNUNET_TIME_UNIT_ZERO_ABS,
               &amount_cb,
               &actx));
     FAILIF (0 != actx.total);
   }
 
   /* a time limit in the future hides everything */
   memset (&actx,
           0,
           sizeof (actx));
   actx.ret = GNUNET_OK;
   FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
           TALER_EXCHANGEDB_iterate_withdraw_amounts_for_kyc_check (
             pg,
             &account.h_normalized,
             GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_HOURS),
             &amount_cb,
             &actx));
   FAILIF (0 != actx.total);
   return 0;
 }
 
 
 /**
  * The checks to run, in order.
  */
 static const struct TDB_Test tests[] = {
   { "withdraw-unknown-reserve",
     &check_unknown_reserve },
   { "withdraw-insufficient-balance",
     &check_insufficient_balance },
   { "withdraw-withdraw",
     &check_withdraw },
   { "withdraw-nonce-reuse",
     &check_nonce_reuse },
   { "withdraw-age-restriction",
     &check_age_restriction },
   { "withdraw-iterate",
     &check_iterate },
   { NULL, NULL }
 };
 
 
 int
 main (int argc,
       char *const *argv)
 {
   int ret;
 
   ret = TDB_main (argc,
                   argv,
                   "test-withdraw",
                   "Tests for the exchangedb `withdraw' table",
                   tests);
   TDB_account_free (&account);
   TDB_denom_free (&denom);
   return ret;
 }
 
 
 /* end of test_withdraw.c */