libeufin

setup.rs (6178B)

---

 /*
 * This file is part of LibEuFin.
 * Copyright (C) 2026 Taler Systems S.A.
 
 * LibEuFin is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation; either version 3, or
 * (at your option) any later version.
 
 * LibEuFin is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General
 * Public License for more details.
 
 * You should have received a copy of the GNU Affero General Public
 * License along with LibEuFin; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>
 */
 
 use std::path::Path;
 
 use anyhow::{anyhow, bail};
 use compact_str::{CompactString, CompactStringExt};
 use tracing::{debug, info};
 
 use crate::{
     config::EbicsSetupCfg,
     crypto::ebics_pub_key_hash,
     ebics::{EbicsClient, administrative::VersionNumber, order::Order},
     keys::{
         BankKeys, ClientKeys, load_bank_keys, load_client_keys, persist_bank_keys,
         persist_client_keys,
     },
     pdf::generate_keys_pdf,
     utils::hex_chunk_by_two,
 };
 
 /** Load client private keys at or create new ones if missing */
 pub fn load_or_generate_client_keys(path: &Path) -> anyhow::Result<ClientKeys> {
     // If exists load from disk
     let current = load_client_keys(path)?;
     if let Some(current) = current {
         return Ok(current);
     }
     // Else create new keys
     let new = ClientKeys::generate()?;
     persist_client_keys(&new, path)?;
     info!(target: "setup",
         "New client private keys created at '{}'",
         path.to_string_lossy()
     );
     Ok(new)
 }
 
 pub async fn ebics_setup(
     ebics: &EbicsClient<'_>,
     cfg: &EbicsSetupCfg<'_>,
     force_keys_resubmission: bool,
     generate_registration_pdf: bool,
     auto_accept_keys: bool,
 ) -> anyhow::Result<(ClientKeys, BankKeys)> {
     let mut client = load_or_generate_client_keys(cfg.keys.client.as_ref())?;
     let bank = load_bank_keys(cfg.keys.bank.as_ref())?;
 
     // Check EBICS 3 support
     let versions = ebics.hev().await?;
     debug!(target: "setup",
         "HEV: {}",
         versions
             .iter()
             .map(|v| v.to_string())
             .join_compact(", ")
     );
     if !versions.contains(&VersionNumber {
         number: "03.00".into(),
         schema: "H005".into(),
     }) && !versions.contains(&VersionNumber {
         number: "03.02".into(),
         schema: "H005".into(),
     }) {
         bail!("EBICS 3 is not supported by your bank");
     }
 
     // Privs exist.  Upload their pubs
     let keys_not_sub = !client.submitted_ini;
     if !client.submitted_ini || force_keys_resubmission {
         ebics
             .submit_client_keys(&cfg.keys, &mut client, Order::INI)
             .await?;
     }
     // Eject PDF if the keys were submitted for the first time, or the user asked.
     if keys_not_sub || generate_registration_pdf {
         let pdf = generate_keys_pdf(&client, &cfg.host)?;
         let path = "/tmp/libeufin-ebics-keys.pdf";
         std::fs::write("/tmp/libeufin-ebics-keys.pdf", &pdf)
             .map_err(|e| anyhow!("Could not write PDF to '{path}': {}", e.kind()))?;
         println!("PDF file with keys created at '{path}'");
     }
     if !client.submitted_hia || force_keys_resubmission {
         ebics
             .submit_client_keys(&cfg.keys, &mut client, Order::HIA)
             .await?;
     }
 
     let new = ebics.hpb(&client).await?;
     let mut bank = if let Some(current) = bank {
         // Check current bank keys
         if current.enc.as_ref() != new.enc.as_ref() {
             bail!(
                 "On disk bank encryption key stored at {} doesn't match server key\nDisk:   {}\nServer: {}",
                 cfg.keys.bank,
                 hex_chunk_by_two(ebics_pub_key_hash(&current.enc)),
                 hex_chunk_by_two(ebics_pub_key_hash(&new.enc))
             )
         } else if current.auth.as_ref() != new.auth.as_ref() {
             bail!(
                 "On disk bank authentication key stored at {} doesn't match server key\nDisk:   {}\nServer: {}",
                 cfg.keys.bank,
                 hex_chunk_by_two(ebics_pub_key_hash(&current.auth)),
                 hex_chunk_by_two(ebics_pub_key_hash(&new.auth))
             )
         }
         current
     } else {
         // Accept bank keys
         info!("Bank keys stored at {}", cfg.keys.bank);
         persist_bank_keys(&new, cfg.keys.bank.as_ref())?;
         new
     };
     if !bank.accepted {
         // Finishing the setup by accepting the bank keys.
         let enc_hash = ebics_pub_key_hash(&bank.enc);
         let auth_hash = ebics_pub_key_hash(&bank.auth);
         if auto_accept_keys {
             bank.accepted = true
         } else if let Some(enc) = cfg.enc
             && let Some(auth) = cfg.auth
         {
             if enc == enc_hash.as_ref() && auth == auth_hash.as_ref() {
                 info!(target: "setup", "Accepting bank keys matching config hashes");
                 bank.accepted = true
             } else {
                 bail!(
                     "Bank keys does not match config hashes\nBank encryption key: {}\nConfig encryption key: {}\nBank authentication key: {}\nConfig authentication key: {}",
                     hex_chunk_by_two(enc_hash),
                     hex_chunk_by_two(enc),
                     hex_chunk_by_two(auth_hash),
                     hex_chunk_by_two(auth),
                 )
             }
         } else {
             println!(
                 "The bank has the following keys:\nEncryption key: {}\nAuthentication key: {}",
                 hex_chunk_by_two(enc_hash),
                 hex_chunk_by_two(auth_hash)
             );
             bank.accepted = dialoguer::Input::<CompactString>::new()
                 .with_prompt("type 'yes, accept' to accept them")
                 .interact()?
                 == "yes, accept";
         }
         if !bank.accepted {
             bail!("Cannot successfully finish the setup without accepting the bank keys");
         }
         persist_bank_keys(&bank, cfg.keys.bank.as_ref())?;
     }
 
     Ok((client, bank))
 }