wallet-core: check base URL reported by exchange

packages/taler-util/src/errors.ts

@@ -129,6 +129,10 @@ export interface DetailsMap {
      */
     errors: TalerErrorDetail[];
   };
+  [TalerErrorCode.WALLET_EXCHANGE_BASE_URL_MISMATCH]: {
+    urlWallet: string;
+    urlExchange: string;
+  }
 }
 
 type ErrBody<Y> = Y extends keyof DetailsMap ? DetailsMap[Y] : empty;

packages/taler-util/src/taler-types.ts

@@ -719,6 +719,12 @@ export class ExchangeSignKeyJson {
  * Structure that the exchange gives us in /keys.
  */
 export class ExchangeKeysJson {
+
+  /**
+   * Canonical, public base URL of the exchange.
+   */
+  base_url: string;
+
   /**
    * List of offered denominations.
    */
@@ -1401,6 +1407,7 @@ export const codecForGlobalFees = (): Codec<GlobalFees> =>
 export const codecForExchangeKeysJson = (): Codec<ExchangeKeysJson> =>
   buildCodecForObject<ExchangeKeysJson>()
     .property("denoms", codecForList(codecForDenomination()))
+    .property("base_url", codecForString())
     .property("master_public_key", codecForString())
     .property("auditors", codecForList(codecForAuditor()))
     .property("list_issue_date", codecForTimestamp)

packages/taler-wallet-core/src/operations/exchanges.ts

@@ -38,11 +38,13 @@ import {
   j2s,
   LibtoolVersion,
   Logger,
+  makeErrorDetail,
   NotificationType,
   parsePaytoUri,
   Recoup,
   TalerError,
   TalerErrorCode,
+  TalerErrorDetail,
   TalerPreciseTimestamp,
   TalerProtocolDuration,
   TalerProtocolTimestamp,
@@ -421,6 +423,7 @@ export async function provideExchangeRecordInTx(
 }
 
 interface ExchangeKeysDownloadResult {
+  baseUrl: string;
   masterPublicKey: string;
   currency: string;
   auditors: ExchangeAuditor[];
@@ -486,6 +489,7 @@ async function downloadExchangeKeysInfo(
   return {
     masterPublicKey: exchangeKeysJsonUnchecked.master_public_key,
     currency,
+    baseUrl: exchangeKeysJsonUnchecked.base_url,
     auditors: exchangeKeysJsonUnchecked.auditors,
     currentDenominations: exchangeKeysJsonUnchecked.denoms.map((d) =>
       denominationRecordFromKeys(
@@ -650,6 +654,20 @@ export async function updateExchangeFromUrlHandler(
     keysInfo.globalFees,
     keysInfo.masterPublicKey,
   );
+  if (keysInfo.baseUrl != exchangeBaseUrl) {
+    logger.warn("exchange base URL mismatch");
+    const errorDetail: TalerErrorDetail = makeErrorDetail(
+      TalerErrorCode.WALLET_EXCHANGE_BASE_URL_MISMATCH,
+      {
+        urlWallet: exchangeBaseUrl,
+        urlExchange: keysInfo.baseUrl,
+      },
+    );
+    return {
+      type: OperationAttemptResultType.Error,
+      errorDetail,
+    };
+  }
 
   logger.info("finished validating exchange /wire info");