kych

OAuth 2.0 API for Swiyu to enable Taler integration of Swiyu for KYC (experimental)
Log | Files | Refs | README | LICENSE

README (4804B)


      1 taler-config -- vendored from taler-rust
      2 ========================================
      3 
      4 This crate is not developed here.  It is a copy of the configuration parser,
      5 the logging setup and the socket-binding logic of the GNU Taler Rust tree,
      6 taken so that KyCH reads its configuration, writes its logs and binds its
      7 listening socket exactly the way every other Taler component does.
      8 
      9 Upstream:   https://git.taler.net/taler-rust.git
     10 Vendored:   commit 48c40c365ac671cbbe1ac2fb359e1a5cf7e165a3 (2026-08-04),
     11             plus the Section::map double-wrapping fix and the map_config!
     12             $crate fix, both of which are still unlanded upstream -- record
     13             their commit here once they are, and drop this note.
     14 
     15 Fix bugs upstream first, then re-vendor.  Local changes here are a maintenance
     16 cost paid on every sync, so the list below is meant to stay short.
     17 
     18 
     19 What came from where
     20 --------------------
     21 
     22   src/config.rs   common/taler-common/src/config.rs
     23   src/log.rs      common/taler-common/src/log.rs           (verbatim)
     24   src/lib.rs      common/taler-common/src/lib.rs           (CommonArgs, taler_main)
     25   src/serve.rs    common/taler-api/src/lib.rs              (Serve, Listener)
     26                   common/taler-api/src/config.rs           (Serve::parse)
     27                   common/taler-api/src/api.rs              (serve, shutdown_signal,
     28                                                             dyn_event, logger_middleware)
     29 
     30 Everything else in taler-common and taler-api -- amounts, payto URIs, IBAN,
     31 the Taler error codes, the Wire Gateway and Revenue APIs, the database pool
     32 and migration runner -- is deliberately absent.  KyCH speaks OAuth 2.0 and
     33 OpenID4VP, not the Taler wire protocol, and pulling those in would drag
     34 aws-lc-rs, regex and the 150 kB generated error-code table into the Debian
     35 build for nothing.
     36 
     37 
     38 Deliberate differences from upstream
     39 ------------------------------------
     40 
     41 config.rs
     42 
     43   * `validate_base_url` is inlined at the top of the file instead of being
     44     imported from `taler_common::types`.
     45   * The `hex`, `b32` and `b64` accessors are gone; they call
     46     `taler_common::encoding`.
     47   * The `currency`, `amount` and `payto` accessors are gone; they need
     48     `taler_common::types`.  The `amount` test went with them.
     49   * The `regex` accessor is gone, so the regex crate is not a dependency.
     50   * A `unix_mode` test was added, since KyCH is the first component where a
     51     wrong UNIXPATH_MODE is a likely operator mistake.
     52 
     53   Two further changes here are *not* divergences but fixes carried ahead of
     54   upstream, and will diff clean once the patches land there:
     55 
     56   * `Section::map` goes through `inner` rather than `value`, so a `map_config!`
     57     error is no longer wrapped into a second `ValueErr::Invalid` that repeats
     58     its own prefix.
     59   * `map_config!` expands to `$crate::config::MapErr` rather than the
     60     hard-coded `::taler_common::config::MapErr`, which also makes the macro
     61     usable from inside its defining crate -- needed there to write a
     62     regression test for the first fix.
     63 
     64   Each removal is marked with a comment where the code used to be, so a diff
     65   against upstream stays readable.
     66 
     67 lib.rs
     68 
     69   * Only `CommonArgs` and `taler_main` were taken.  `ExpoBackoffDecorr` has no
     70     user here, and the mimalloc `#[global_allocator]` is a whole-program
     71     decision that a library has no business making for its dependents.
     72   * `CommonArgs` fields are public, and `--verbose` is not `hide = true`:
     73     kych.conf(5) and kych-oauth2-gateway(1) document it.
     74 
     75 serve.rs
     76 
     77   * `serve()` is a free function taking an `axum::Router` rather than a method
     78     on the `TalerRouter` trait, and it does not call upstream's `finalize()`:
     79     that adds a CORS layer and Taler-shaped 404/405 bodies, and KyCH's
     80     endpoints answer with OAuth 2.0 error objects instead.
     81   * The request logger keeps the task-id scope, the method/path/status/duration
     82     line and `dyn_event!`, but drops the `LoggedError` branch, which formats a
     83     Taler error code.
     84   * `logger_middleware` uses rand 0.8 (`thread_rng`, `gen_range`) to match the
     85     rest of KyCH; upstream is on rand 0.9 (`rng`, `random_range`).  Change both
     86     together or the tree ends up building two copies of rand.
     87   * Graceful shutdown listens for SIGINT and SIGTERM only.  The `lifetime`
     88     request counter, used by upstream's tests to stop a server after N
     89     requests, is not vendored.
     90 
     91 
     92 Notes
     93 -----
     94 
     95 The `#[cfg(test)] mod test` blocks came along with the code; `cargo test` from
     96 this directory runs them, and they are the fastest way to tell whether a
     97 re-vendored file still behaves.
     98 
     99 jiff is built with the `tz-system` feature, which upstream's workspace does not
    100 enable.  Without it `TalerFmt` cannot resolve the machine's time zone, prints a
    101 complaint on every start and stamps every log line UTC.