[taler-wallet-core] branch master updated: wallet-core: make basic deposit KYC work

[gnunet]

This is an automated email from the git hooks/post-receive script.

dold pushed a commit to branch master
in repository wallet-core.

The following commit(s) were added to refs/heads/master by this push:
     new 0f9ff6e37 wallet-core: make basic deposit KYC work
0f9ff6e37 is described below

commit 0f9ff6e37fe45e2f2e4db95a517a35a3df5cea6e
Author: Florian Dold <florian@dold.me>
AuthorDate: Thu Sep 5 19:08:23 2024 +0200

    wallet-core: make basic deposit KYC work
---
 .../test-kyc-balance-withdrawal.ts                 |   4 +-
 .../integrationtests/test-kyc-deposit-aggregate.ts |  45 ++++++++-
 .../integrationtests/test-kyc-exchange-wallet.ts   |   4 +-
 .../integrationtests/test-kyc-form-withdrawal.ts   |   4 +-
 .../src/integrationtests/test-kyc-new-measure.ts   |   4 +-
 .../src/integrationtests/test-kyc-peer-pull.ts     |   4 +-
 .../src/integrationtests/test-kyc-peer-push.ts     |   4 +-
 .../test-kyc-threshold-withdrawal.ts               |   4 +-
 packages/taler-util/src/http-common.ts             |  18 ++--
 .../src/crypto/cryptoImplementation.ts             |  16 +--
 packages/taler-wallet-core/src/db.ts               |   2 +-
 packages/taler-wallet-core/src/deposits.ts         | 109 +++++++++++++++++++--
 packages/taler-wallet-core/src/pay-merchant.ts     |   4 +-
 .../taler-wallet-core/src/pay-peer-push-credit.ts  |   3 +-
 packages/taler-wallet-core/src/withdraw.ts         |   8 +-
 15 files changed, 182 insertions(+), 51 deletions(-)

diff --git 
a/packages/taler-harness/src/integrationtests/test-kyc-balance-withdrawal.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-balance-withdrawal.ts
index d7c02718b..12e62607b 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-balance-withdrawal.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-balance-withdrawal.ts
@@ -29,7 +29,7 @@ import {
 } from "@gnu-taler/taler-util";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -57,7 +57,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git 
a/packages/taler-harness/src/integrationtests/test-kyc-deposit-aggregate.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-deposit-aggregate.ts
index 5432d552e..4dc072882 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-deposit-aggregate.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-deposit-aggregate.ts
@@ -24,7 +24,7 @@ import {
 } from "@gnu-taler/taler-util";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -39,7 +39,11 @@ import {
   WalletClient,
   WalletService,
 } from "../harness/harness.js";
-import { EnvOptions, withdrawViaBankV3 } from "../harness/helpers.js";
+import {
+  EnvOptions,
+  postAmlDecisionNoRules,
+  withdrawViaBankV3,
+} from "../harness/helpers.js";
 
 interface KycTestEnv {
   commonDb: DbInfo;
@@ -48,7 +52,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
@@ -206,7 +210,7 @@ async function createKycTestkudosEnvironment(
 export async function runKycDepositAggregateTest(t: GlobalTestState) {
   // Set up test environment
 
-  const { walletClient, bankClient, exchange } =
+  const { walletClient, bankClient, exchange, amlKeypair } =
     await createKycTestkudosEnvironment(t);
 
   // Withdraw digital cash into the wallet.
@@ -253,6 +257,39 @@ export async function runKycDepositAggregateTest(t: 
GlobalTestState) {
       minor: TransactionMinorState.KycRequired,
     },
   });
+
+  const txDetails = await walletClient.call(
+    WalletApiOperation.GetTransactionById,
+    {
+      transactionId: depositResp.transactionId,
+    },
+  );
+
+  const kycPaytoHash = txDetails.kycPaytoHash;
+
+  t.assertTrue(!!kycPaytoHash);
+
+  await postAmlDecisionNoRules(t, {
+    amlPriv: amlKeypair.priv,
+    amlPub: amlKeypair.pub,
+    exchangeBaseUrl: exchange.baseUrl,
+    paytoHash: kycPaytoHash,
+  });
+
+  await exchange.runAggregatorOnceWithTimetravel({
+    timetravelMicroseconds: 1000 * 1000 * 60 * 60 * 3,
+  });
+
+  await exchange.runTransferOnceWithTimetravel({
+    timetravelMicroseconds: 1000 * 1000 * 60 * 60 * 3,
+  });
+
+  await walletClient.call(WalletApiOperation.TestingWaitTransactionState, {
+    transactionId: depositResp.transactionId,
+    txState: {
+      major: TransactionMajorState.Done,
+    },
+  });
 }
 
 runKycDepositAggregateTest.suites = ["wallet"];
diff --git 
a/packages/taler-harness/src/integrationtests/test-kyc-exchange-wallet.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-exchange-wallet.ts
index 39aa2c26d..5ff260a1d 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-exchange-wallet.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-exchange-wallet.ts
@@ -26,7 +26,7 @@ import {
 } from "@gnu-taler/taler-util";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -50,7 +50,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git 
a/packages/taler-harness/src/integrationtests/test-kyc-form-withdrawal.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-form-withdrawal.ts
index 1ad4b5bb4..5d4211c9f 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-form-withdrawal.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-form-withdrawal.ts
@@ -32,7 +32,7 @@ import {
 import { readResponseJsonOrThrow } from "@gnu-taler/taler-util/http";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -57,7 +57,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git 
a/packages/taler-harness/src/integrationtests/test-kyc-new-measure.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-new-measure.ts
index 82eb5ad48..7af36502a 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-new-measure.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-new-measure.ts
@@ -33,7 +33,7 @@ import {
 import { readResponseJsonOrThrow } from "@gnu-taler/taler-util/http";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -62,7 +62,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git a/packages/taler-harness/src/integrationtests/test-kyc-peer-pull.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-peer-pull.ts
index cc5787f26..2205ee687 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-peer-pull.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-peer-pull.ts
@@ -30,7 +30,7 @@ import {
 } from "@gnu-taler/taler-util";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -59,7 +59,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git a/packages/taler-harness/src/integrationtests/test-kyc-peer-push.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-peer-push.ts
index fcd5d7aa8..ed880251d 100644
--- a/packages/taler-harness/src/integrationtests/test-kyc-peer-push.ts
+++ b/packages/taler-harness/src/integrationtests/test-kyc-peer-push.ts
@@ -29,7 +29,7 @@ import {
 } from "@gnu-taler/taler-util";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -58,7 +58,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git 
a/packages/taler-harness/src/integrationtests/test-kyc-threshold-withdrawal.ts 
b/packages/taler-harness/src/integrationtests/test-kyc-threshold-withdrawal.ts
index b70da10d4..27073ab2a 100644
--- 
a/packages/taler-harness/src/integrationtests/test-kyc-threshold-withdrawal.ts
+++ 
b/packages/taler-harness/src/integrationtests/test-kyc-threshold-withdrawal.ts
@@ -28,7 +28,7 @@ import {
 } from "@gnu-taler/taler-util";
 import {
   createSyncCryptoApi,
-  EddsaKeypair,
+  EddsaKeypairStrings,
   WalletApiOperation,
 } from "@gnu-taler/taler-wallet-core";
 import { CoinConfig, defaultCoinConfig } from "../harness/denomStructures.js";
@@ -52,7 +52,7 @@ interface KycTestEnv {
   exchangeBankAccount: HarnessExchangeBankAccount;
   walletClient: WalletClient;
   walletService: WalletService;
-  amlKeypair: EddsaKeypair;
+  amlKeypair: EddsaKeypairStrings;
 }
 
 async function createKycTestkudosEnvironment(
diff --git a/packages/taler-util/src/http-common.ts 
b/packages/taler-util/src/http-common.ts
index e42892f9d..3f310e2b6 100644
--- a/packages/taler-util/src/http-common.ts
+++ b/packages/taler-util/src/http-common.ts
@@ -333,14 +333,16 @@ export function throwUnexpectedRequestError(
   httpResponse: HttpResponse,
   talerErrorResponse: TalerErrorResponse,
 ): never {
+  const errorDetails = {
+    requestUrl: httpResponse.requestUrl,
+    requestMethod: httpResponse.requestMethod,
+    httpStatusCode: httpResponse.status,
+    errorResponse: talerErrorResponse,
+  };
+  logger.trace(`unexpected request error: ${j2s(errorDetails)}`);
   throw TalerError.fromDetail(
     TalerErrorCode.WALLET_UNEXPECTED_REQUEST_ERROR,
-    {
-      requestUrl: httpResponse.requestUrl,
-      requestMethod: httpResponse.requestMethod,
-      httpStatusCode: httpResponse.status,
-      errorResponse: talerErrorResponse,
-    },
+    errorDetails,
     `Unexpected HTTP status ${httpResponse.status} in response`,
   );
 }
@@ -502,8 +504,8 @@ export function encodeBody(body: unknown): ArrayBuffer {
     return body.buffer;
   } else if (body instanceof ArrayBuffer) {
     return body;
-  } else if (body instanceof URLSearchParams) {    
-    return textEncoder.encode(body.toString()).buffer
+  } else if (body instanceof URLSearchParams) {
+    return textEncoder.encode(body.toString()).buffer;
   } else if (typeof body === "object" && body.constructor.name === "FormData") 
{
     return body as ArrayBuffer;
   } else if (typeof body === "object") {
diff --git a/packages/taler-wallet-core/src/crypto/cryptoImplementation.ts 
b/packages/taler-wallet-core/src/crypto/cryptoImplementation.ts
index 69081d234..ce6193b83 100644
--- a/packages/taler-wallet-core/src/crypto/cryptoImplementation.ts
+++ b/packages/taler-wallet-core/src/crypto/cryptoImplementation.ts
@@ -170,7 +170,7 @@ export interface TalerCryptoInterface {
     req: ContractTermsValidationRequest,
   ): Promise<ValidationResult>;
 
-  createEddsaKeypair(req: {}): Promise<EddsaKeypair>;
+  createEddsaKeypair(req: {}): Promise<EddsaKeypairStrings>;
 
   eddsaGetPublic(req: EddsaGetPublicRequest): Promise<EddsaGetPublicResponse>;
 
@@ -333,10 +333,12 @@ export const nullCrypto: TalerCryptoInterface = {
   ): Promise<ValidationResult> {
     throw new Error("Function not implemented.");
   },
-  createEddsaKeypair: function (req: unknown): Promise<EddsaKeypair> {
+  createEddsaKeypair: function (req: unknown): Promise<EddsaKeypairStrings> {
     throw new Error("Function not implemented.");
   },
-  eddsaGetPublic: function (req: EddsaGetPublicRequest): Promise<EddsaKeypair> 
{
+  eddsaGetPublic: function (
+    req: EddsaGetPublicRequest,
+  ): Promise<EddsaKeypairStrings> {
     throw new Error("Function not implemented.");
   },
   unblindDenominationSignature: function (
@@ -600,7 +602,7 @@ export interface WireAccountValidationRequest {
   creditRestrictions?: any[];
 }
 
-export interface EddsaKeypair {
+export interface EddsaKeypairStrings {
   priv: string;
   pub: string;
 }
@@ -1081,7 +1083,9 @@ export const nativeCryptoR: TalerCryptoInterfaceR = {
   /**
    * Create a new EdDSA key pair.
    */
-  async createEddsaKeypair(tci: TalerCryptoInterfaceR): Promise<EddsaKeypair> {
+  async createEddsaKeypair(
+    tci: TalerCryptoInterfaceR,
+  ): Promise<EddsaKeypairStrings> {
     const eddsaPriv = encodeCrock(getRandomBytes(32));
     const eddsaPubRes = await tci.eddsaGetPublic(tci, {
       priv: eddsaPriv,
@@ -1095,7 +1099,7 @@ export const nativeCryptoR: TalerCryptoInterfaceR = {
   async eddsaGetPublic(
     tci: TalerCryptoInterfaceR,
     req: EddsaGetPublicRequest,
-  ): Promise<EddsaKeypair> {
+  ): Promise<EddsaKeypairStrings> {
     return {
       priv: req.priv,
       pub: encodeCrock(eddsaGetPublic(decodeCrock(req.priv))),
diff --git a/packages/taler-wallet-core/src/db.ts 
b/packages/taler-wallet-core/src/db.ts
index 21ec3f033..99b69135a 100644
--- a/packages/taler-wallet-core/src/db.ts
+++ b/packages/taler-wallet-core/src/db.ts
@@ -1831,7 +1831,7 @@ export interface DepositGroupRecord {
 }
 
 export interface DepositKycInfo {
-  accessToken: string;
+  accessToken?: string;
   paytoHash: string;
   exchangeBaseUrl: string;
 }
diff --git a/packages/taler-wallet-core/src/deposits.ts 
b/packages/taler-wallet-core/src/deposits.ts
index 34b19df80..da69530f7 100644
--- a/packages/taler-wallet-core/src/deposits.ts
+++ b/packages/taler-wallet-core/src/deposits.ts
@@ -61,6 +61,7 @@ import {
   canonicalJson,
   checkDbInvariant,
   checkLogicInvariant,
+  codecForAccountKycStatus,
   codecForBatchDepositSuccess,
   codecForTackTransactionAccepted,
   codecForTackTransactionWired,
@@ -72,7 +73,12 @@ import {
   parsePaytoUri,
   stringToBytes,
 } from "@gnu-taler/taler-util";
-import { readSuccessResponseJsonOrThrow } from "@gnu-taler/taler-util/http";
+import {
+  readResponseJsonOrThrow,
+  readSuccessResponseJsonOrThrow,
+  readTalerErrorResponse,
+  throwUnexpectedRequestError,
+} from "@gnu-taler/taler-util/http";
 import { selectPayCoins, selectPayCoinsInTx } from "./coinSelection.js";
 import {
   PendingTaskType,
@@ -94,6 +100,7 @@ import {
   RefreshOperationStatus,
   WalletDbAllStoresReadOnlyTransaction,
   WalletDbReadWriteTransaction,
+  timestampAbsoluteFromDb,
   timestampPreciseFromDb,
   timestampPreciseToDb,
   timestampProtocolFromDb,
@@ -104,6 +111,7 @@ import {
   getExchangeWireFee,
   getScopeForAllExchanges,
 } from "./exchanges.js";
+import { EddsaKeypairStrings } from "./index.js";
 import {
   extractContractData,
   generateDepositPermissions,
@@ -217,6 +225,14 @@ export class DepositTransactionContext implements 
TransactionContext {
       depositGroupId: dg.depositGroupId,
       trackingState,
       deposited,
+      kycPaytoHash: dg.kycInfo?.paytoHash,
+      kycAccessToken: dg.kycInfo?.accessToken,
+      kycUrl: dg.kycInfo
+        ? new URL(
+            `kyc-spa/${dg.kycInfo.accessToken}`,
+            dg.kycInfo.exchangeBaseUrl,
+          ).href
+        : undefined,
       ...(ort?.lastError ? { error: ort.lastError } : {}),
     };
   }
@@ -778,6 +794,19 @@ async function processDepositGroupPendingKyc(
     throw Error("invalid DB state, in pending(kyc), but no kycInfo present");
   }
 
+  const lastReserveKeypair = await getLastWithdrawalKeyPair(
+    wex,
+    kycInfo.exchangeBaseUrl,
+  );
+  if (!lastReserveKeypair) {
+    // Need to do a KYC transfer
+    throw Error("not supported yet");
+  }
+  const sigResp = await wex.cryptoApi.signWalletKycAuth({
+    accountPriv: lastReserveKeypair.priv,
+    accountPub: lastReserveKeypair.pub,
+  });
+
   const url = new URL(
     `kyc-check/${kycInfo.paytoHash}`,
     kycInfo.exchangeBaseUrl,
@@ -792,6 +821,9 @@ async function processDepositGroupPendingKyc(
       return await wex.http.fetch(url.href, {
         method: "GET",
         cancellationToken: wex.cancellationToken,
+        headers: {
+          ["Account-Owner-Signature"]: sigResp.sig,
+        },
       });
     },
   );
@@ -831,6 +863,42 @@ async function processDepositGroupPendingKyc(
   return TaskRunResult.backoff();
 }
 
+/**
+ * Finds the reserve key pair of the most recent withdrawal
+ * with the given exchange.
+ * Returns undefined if no such withdrawal exists.
+ */
+async function getLastWithdrawalKeyPair(
+  wex: WalletExecutionContext,
+  exchangeBaseUrl: string,
+): Promise<EddsaKeypairStrings | undefined> {
+  let candidateTimestamp: AbsoluteTime | undefined = undefined;
+  let candidateRes: EddsaKeypairStrings | undefined = undefined;
+  await wex.db.runAllStoresReadOnlyTx({}, async (tx) => {
+    const withdrawalRecs =
+      await tx.withdrawalGroups.indexes.byExchangeBaseUrl.getAll(
+        exchangeBaseUrl,
+      );
+    for (const rec of withdrawalRecs) {
+      if (!rec.timestampFinish) {
+        continue;
+      }
+      const currTimestamp = timestampAbsoluteFromDb(rec.timestampFinish);
+      if (
+        candidateTimestamp == null ||
+        AbsoluteTime.cmp(currTimestamp, candidateTimestamp) > 0
+      ) {
+        candidateTimestamp = currTimestamp;
+        candidateRes = {
+          priv: rec.reservePriv,
+          pub: rec.reservePub,
+        };
+      }
+    }
+  });
+  return candidateRes;
+}
+
 /**
  * Tracking information from the exchange indicated that
  * KYC is required.  We need to check the KYC info
@@ -846,17 +914,33 @@ async function transitionToKycRequired(
 
   const ctx = new DepositTransactionContext(wex, depositGroupId);
 
+  const lastReserveKeypair = await getLastWithdrawalKeyPair(wex, exchangeUrl);
+  if (!lastReserveKeypair) {
+    // Need to do a KYC transfer
+    throw Error("not supported yet");
+  }
+  const sigResp = await wex.cryptoApi.signWalletKycAuth({
+    accountPriv: lastReserveKeypair.priv,
+    accountPub: lastReserveKeypair.pub,
+  });
+
   const url = new URL(`kyc-check/${kycInfo.paytoHash}`, exchangeUrl);
   logger.info(`kyc url ${url.href}`);
-  const kycStatusReq = await wex.http.fetch(url.href, {
+  const kycStatusResp = await wex.http.fetch(url.href, {
     method: "GET",
+    headers: {
+      ["Account-Owner-Signature"]: sigResp.sig,
+    },
   });
-  if (kycStatusReq.status === HttpStatusCode.Ok) {
+  logger.trace(`response status of initial kyc-check: 
${kycStatusResp.status}`);
+  if (kycStatusResp.status === HttpStatusCode.Ok) {
     logger.warn("kyc requested, but already fulfilled");
     return TaskRunResult.backoff();
-  } else if (kycStatusReq.status === HttpStatusCode.Accepted) {
-    const kycStatus = await kycStatusReq.json();
-    logger.info(`kyc status: ${j2s(kycStatus)}`);
+  } else if (kycStatusResp.status === HttpStatusCode.Accepted) {
+    const statusResp = await readResponseJsonOrThrow(
+      kycStatusResp,
+      codecForAccountKycStatus(),
+    );
     const transitionInfo = await wex.db.runReadWriteTx(
       { storeNames: ["depositGroups", "transactionsMeta"] },
       async (tx) => {
@@ -868,10 +952,11 @@ async function transitionToKycRequired(
           return undefined;
         }
         const oldTxState = computeDepositTransactionStatus(dg);
+        dg.operationStatus = DepositOperationStatus.PendingKyc;
         dg.kycInfo = {
           exchangeBaseUrl: exchangeUrl,
           paytoHash: kycInfo.paytoHash,
-          accessToken: null as any, // FIXME!
+          accessToken: statusResp.access_token,
         };
         await tx.depositGroups.put(dg);
         await ctx.updateTransactionMeta(tx);
@@ -880,9 +965,12 @@ async function transitionToKycRequired(
       },
     );
     notifyTransition(wex, ctx.transactionId, transitionInfo);
-    return TaskRunResult.finished();
+    return TaskRunResult.progress();
   } else {
-    throw Error(`unexpected response from kyc-check (${kycStatusReq.status})`);
+    throwUnexpectedRequestError(
+      kycStatusResp,
+      await readTalerErrorResponse(kycStatusResp),
+    );
   }
 }
 
@@ -932,6 +1020,7 @@ async function processDepositGroupPendingTrack(
         exchangeBaseUrl,
       );
 
+      logger.trace(`track response: ${j2s(track)}`);
       if (track.type === "accepted") {
         if (!track.kyc_ok && track.requirement_row !== undefined) {
           const paytoHash = encodeCrock(
@@ -940,7 +1029,7 @@ async function processDepositGroupPendingTrack(
           const kycInfo: DepositKycInfo = {
             paytoHash,
             exchangeBaseUrl: exchangeBaseUrl,
-            accessToken: null as any, // FIXME!
+            accessToken: undefined,
           };
           return transitionToKycRequired(
             wex,
diff --git a/packages/taler-wallet-core/src/pay-merchant.ts 
b/packages/taler-wallet-core/src/pay-merchant.ts
index 5be153367..12cfedc9e 100644
--- a/packages/taler-wallet-core/src/pay-merchant.ts
+++ b/packages/taler-wallet-core/src/pay-merchant.ts
@@ -123,7 +123,7 @@ import {
   TransactionContext,
   TransitionResultType,
 } from "./common.js";
-import { EddsaKeypair } from "./crypto/cryptoImplementation.js";
+import { EddsaKeypairStrings } from "./crypto/cryptoImplementation.js";
 import {
   CoinRecord,
   DbCoinSelection,
@@ -1196,7 +1196,7 @@ async function createOrReusePurchase(
     return oldProposal.proposalId;
   }
 
-  let noncePair: EddsaKeypair;
+  let noncePair: EddsaKeypairStrings;
   let shared = false;
   if (noncePriv) {
     shared = true;
diff --git a/packages/taler-wallet-core/src/pay-peer-push-credit.ts 
b/packages/taler-wallet-core/src/pay-peer-push-credit.ts
index d18f8712d..fd6d40bcf 100644
--- a/packages/taler-wallet-core/src/pay-peer-push-credit.ts
+++ b/packages/taler-wallet-core/src/pay-peer-push-credit.ts
@@ -869,12 +869,11 @@ async function processPeerPushCreditKycRequired(
     logger.warn("kyc requested, but already fulfilled");
     return TaskRunResult.finished();
   } else if (kycStatusRes.status === HttpStatusCode.Accepted) {
-    const kycStatus = await kycStatusRes.json();
-    logger.info(`kyc status: ${j2s(kycStatus)}`);
     const statusResp = await readResponseJsonOrThrow(
       kycStatusRes,
       codecForAccountKycStatus(),
     );
+    logger.info(`kyc status: ${j2s(statusResp)}`);
     const { transitionInfo, result } = await wex.db.runReadWriteTx(
       { storeNames: ["peerPushCredit", "transactionsMeta"] },
       async (tx) => {
diff --git a/packages/taler-wallet-core/src/withdraw.ts 
b/packages/taler-wallet-core/src/withdraw.ts
index 0d47e08c7..1ed600265 100644
--- a/packages/taler-wallet-core/src/withdraw.ts
+++ b/packages/taler-wallet-core/src/withdraw.ts
@@ -129,7 +129,7 @@ import {
   requireExchangeTosAcceptedOrThrow,
   runWithClientCancellation,
 } from "./common.js";
-import { EddsaKeypair } from "./crypto/cryptoImplementation.js";
+import { EddsaKeypairStrings } from "./crypto/cryptoImplementation.js";
 import {
   CoinRecord,
   CoinSourceType,
@@ -3060,7 +3060,7 @@ export async function 
internalPrepareCreateWithdrawalGroup(
     exchangeBaseUrl: string | undefined;
     forcedWithdrawalGroupId?: string;
     forcedDenomSel?: ForcedDenomSel;
-    reserveKeyPair?: EddsaKeypair;
+    reserveKeyPair?: EddsaKeypairStrings;
     restrictAge?: number;
     wgInfo: WgInfo;
   },
@@ -3256,7 +3256,7 @@ export async function internalCreateWithdrawalGroup(
     amount?: AmountJson;
     forcedWithdrawalGroupId?: string;
     forcedDenomSel?: ForcedDenomSel;
-    reserveKeyPair?: EddsaKeypair;
+    reserveKeyPair?: EddsaKeypairStrings;
     restrictAge?: number;
     wgInfo: WgInfo;
   },
@@ -3846,7 +3846,7 @@ export async function createManualWithdrawal(
     );
   }
 
-  let reserveKeyPair: EddsaKeypair;
+  let reserveKeyPair: EddsaKeypairStrings;
   if (req.forceReservePriv) {
     const pubResp = await wex.cryptoApi.eddsaGetPublic({
       priv: req.forceReservePriv,

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.