taler-rust

setup.rs (6188B)

---

 /*
   This file is part of TALER
   Copyright (C) 2025 Taler Systems SA
 
   TALER is free software; you can redistribute it and/or modify it under the
   terms of the GNU Affero General Public License as published by the Free Software
   Foundation; either version 3, or (at your option) any later version.
 
   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
   A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
 
   You should have received a copy of the GNU Affero General Public License along with
   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
 */
 
 use std::io::ErrorKind;
 
 use p256::ecdsa::SigningKey;
 use taler_common::{json_file, types::base32::Base32};
 use tracing::{info, warn};
 
 use crate::magnet_api::{api::ErrKind, client::AuthClient, oauth::Token};
 use crate::{
     config::WorkerCfg,
     magnet_api::{api::MagnetError, oauth::TokenAuth},
 };
 
 #[derive(Default, Debug, serde::Deserialize, serde::Serialize)]
 struct KeysFile {
     access_token: Option<Token>,
     signing_key: Option<Base32<32>>,
 }
 
 #[derive(Debug)]
 pub struct Keys {
     pub access_token: Token,
     pub signing_key: SigningKey,
 }
 
 pub fn load(cfg: &WorkerCfg) -> anyhow::Result<Keys> {
     // Load JSON file
     let file: KeysFile = match json_file::load(&cfg.keys_path) {
         Ok(file) => file,
         Err(e) => {
             return Err(anyhow::anyhow!(
                 "Could not read magnet keys at '{}': {}",
                 cfg.keys_path,
                 e.kind()
             ));
         }
     };
 
     fn incomplete_err() -> anyhow::Error {
         anyhow::anyhow!("Missing magnet keys, run 'taler-magnet-bank setup' first")
     }
 
     // Check full
     let access_token = file.access_token.ok_or_else(incomplete_err)?;
     let signing_key = file.signing_key.ok_or_else(incomplete_err)?;
 
     // Load signing key
 
     let signing_key = SigningKey::from_slice(&*signing_key)?;
 
     Ok(Keys {
         access_token,
         signing_key,
     })
 }
 
 pub async fn setup(cfg: WorkerCfg, reset: bool) -> anyhow::Result<()> {
     if reset
         && let Err(e) = std::fs::remove_file(&cfg.keys_path)
         && e.kind() != ErrorKind::NotFound
     {
         Err(e)?;
     }
     let mut keys = match json_file::load(&cfg.keys_path) {
         Ok(existing) => existing,
         Err(e) if e.kind() == ErrorKind::NotFound => KeysFile::default(),
         Err(e) => Err(e)?,
     };
     let client = reqwest::Client::new();
     let client = AuthClient::new(&client, &cfg.api_url, &cfg.consumer);
 
     info!("Setup OAuth access token");
     if keys.access_token.is_none() {
         let token_request = client.token_request().await?;
 
         // TODO how to do it in a generic way ?
         // TODO Ask MagnetBank if they could support out-of-band configuration
         println!(
             "Login at {}?oauth_token={}",
             client
                 .api_url
                 .join("/NetBankOAuth/authtoken.xhtml")
                 .unwrap(),
             token_request.key
         );
         let auth_url = rpassword::prompt_password("Enter the result URL>")?;
         let auth_url = reqwest::Url::parse(&auth_url)?;
         let token_auth: TokenAuth =
             serde_urlencoded::from_str(auth_url.query().unwrap_or_default())?;
         assert_eq!(token_request.key, token_auth.oauth_token);
 
         let access_token = client.token_access(&token_request, &token_auth).await?;
         keys.access_token = Some(access_token);
         json_file::persist(&cfg.keys_path, &keys)?;
     }
 
     let client = client.upgrade(keys.access_token.as_ref().unwrap());
 
     info!("Setup Strong Customer Authentication");
     // TODO find a proper way to check if SCA is required without triggering SCA.GLOBAL_FEATURE_NOT_ENABLED
     let request = client.request_sms_code().await?;
     println!(
         "A SCA code have been sent through {} to {}",
         request.channel,
         request.sent_to.join(", ")
     );
     let sca_code = rpassword::prompt_password("Enter the code>")?;
     if let Err(e) = client.perform_sca(&sca_code).await {
         // Ignore error if SCA already performed
         if !matches!(e.kind, ErrKind::Magnet(MagnetError { ref short_message, .. }) if short_message == "TOKEN_SCA_HITELESITETT")
         {
             return Err(e.into());
         }
     }
 
     info!("Setup public key");
     // TODO find a proper way to check if a public key have been setup
     // TODO use the better from/to_array API in the next version of the crypto lib
     let signing_key = match keys.signing_key {
         Some(bytes) => SigningKey::from_slice(bytes.as_ref())?,
         None => {
             let rand = SigningKey::random(&mut rand_core::OsRng);
             let array: [u8; 32] = rand.to_bytes().into();
             keys.signing_key = Some(Base32::from(array));
             json_file::persist(&cfg.keys_path, &keys)?;
             rand
         }
     };
     if let Err(e) = client.upload_public_key(&signing_key).await {
         // Ignore error if public key already uploaded
         if !matches!(e.kind, ErrKind::Magnet(MagnetError { ref short_message, .. }) if short_message== "KULCS_MAR_HASZNALATBAN")
         {
             return Err(e.into());
         }
     }
 
     info!("Check account");
     let res = client.list_accounts().await?;
     let mut ibans = Vec::new();
     for partner in res.partners {
         for account in partner.bank_accounts {
             if *cfg.payto == account.iban {
                 if partner.partner.name != cfg.payto.name {
                     warn!(
                         "Expected name '{}' from config got '{}' from bank",
                         cfg.payto.name, partner.partner.name
                     );
                 }
                 return Ok(());
             } else {
                 ibans.push(account.iban);
             }
         }
     }
     Err(anyhow::anyhow!(
         "Unknown account {} from config, expected one of the following account {}",
         cfg.payto.0,
         ibans
             .into_iter()
             .map(|it| it.to_string())
             .collect::<Vec<_>>()
             .join(", ")
     ))
 }