[taler-docs] branch master updated: target_token => access_token

[gnunet]

This is an automated email from the git hooks/post-receive script.

grothoff pushed a commit to branch master
in repository docs.

The following commit(s) were added to refs/heads/master by this push:
     new 8cfc3f75 target_token => access_token
8cfc3f75 is described below

commit 8cfc3f75c0a6de4bfdee3a1237cf90c615778b12
Author: Christian Grothoff <christian@grothoff.org>
AuthorDate: Tue Apr 23 15:21:28 2024 +0200

    target_token => access_token
---
 design-documents/023-taler-kyc.rst | 47 +++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/design-documents/023-taler-kyc.rst 
b/design-documents/023-taler-kyc.rst
index 63e879f0..b0aac4d8 100644
--- a/design-documents/023-taler-kyc.rst
+++ b/design-documents/023-taler-kyc.rst
@@ -561,14 +561,12 @@ New endpoints
       // accounts without this flag being set!
       aml_review: boolean;
 
+      // Access token needed to construct the ``/kyc-spa/``
       // URL that the user should open in a browser to
-      // proceed with the KYC process (optional if
-      // the status type is ``200 Ok``, mandatory if the
-      // HTTP status is ``202 Accepted``).
-      // This URL will encode the *target token* and
-      // should in practice always point to the
-      // KYC SPA (`/kyc-spa/$TARGET_TOKEN`).
-      kyc_url: string;
+      // proceed with the KYC process (optional if the status
+      // type is ``200 Ok``, mandatory if the HTTP status
+      // is ``202 Accepted``).
+      access_token: AccountAccessToken;
 
       // Array with limitations that currently apply to this
       // account and that may be increased or lifted if the
@@ -618,21 +616,22 @@ New endpoints
     }
 
 
-.. http:get:: /kyc-spa/$TARGET_TOKEN
+.. http:get:: /kyc-spa/$ACCESS_TOKEN
 .. http:get:: /kyc-spa/$FILENAME
 
-  A set of ``/kyc-spa/$TARGET_TOKEN`` GET endpoints is created per account
+  A set of ``/kyc-spa/$ACCESS_TOKEN`` GET endpoints is created per account
   hash that serves the KYC SPA.  This is where the ``/kyc-check/`` endpoint
   will in principle redirect clients.  The KYC SPA will use the
-  ``$TARGET_TOKEN`` of its URL to initialize itself via the
-  ``/kyc-info/$TARGET_TOKEN`` endpoint family.  The KYC SPA may download
+  ``$ACCESS_TOKEN`` of its URL to initialize itself via the
+  ``/kyc-info/$ACCESS_TOKEN`` endpoint family.  The KYC SPA may download
   additional resources via ``/kyc-spa/$FILENAME``. The filenames must not
   match base32-encoded 256-bit values.
 
-.. http:get:: /kyc-info/$TARGET_TOKEN
+.. http:get:: /kyc-info/$ACCESS_TOKEN
 
-  A new set of ``/kyc-info/$TARGET_TOKEN`` GET endpoints is created per client
-  account hash to return information about the state of the KYC or AML process
+  The ``/kyc-info/$ACCESS_TOKEN`` endpoints are created per client
+  account hash (but access controlled via a unique target token)
+  to return information about the state of the KYC or AML process
   to the KYC SPA.  The SPA uses this information to show the user an
   appropriate dialog. The SPA should also long-poll this endpoint for changes
   to the AML/KYC state. Note that this is a client-facing endpoint, so it will
@@ -732,7 +731,7 @@ New endpoints
   The ``/kyc-upload/$ID`` POST endpoint allows the SPA to upload
   client-provided evidence.  The ``$ID`` will be provided as part of the
   ``/kyc-info`` body.  This is for checks of type ``FORM``.  In practice,
-  ``$ID`` will encode both the ``$TARGET_TOKEN`` and the index of the selected
+  ``$ID`` will encode both the ``$ACCESS_TOKEN`` and the index of the selected
   measure (but this should be irrelevant for the client).
 
   **Request:**
@@ -759,7 +758,7 @@ New endpoints
   KYC process. It will return the URL that the client must GET to begin the
   KYC process. The SPA should probably open this URL in a new window or tab.
   The ``$ID`` will be provided as part of the ``/kyc-info`` body.  In
-  practice, ``$ID`` will encode both the ``$TARGET_TOKEN`` and the index of
+  practice, ``$ID`` will encode both the ``$ACCESS_TOKEN`` and the index of
   the selected measure (but this should be irrelevant for the client).
 
   **Request:**
@@ -800,7 +799,7 @@ New endpoints
   triggered, the exchange will pass the received arguments to the respective
   logic plugin.  The logic plugin will then (asynchronously) update the KYC
   status of the user.  The logic plugin should redirect the user to the KYC
-  SPA. This endpoint deliberately does not use the ``$TARGET_TOKEN`` as the
+  SPA. This endpoint deliberately does not use the ``$ACCESS_TOKEN`` as the
   external KYC provider should not learn that token.
 
   This endpoint is thus accessed from the user's browser at the *end* of a KYC
@@ -1719,7 +1718,7 @@ on GET ``/deposits/`` with the respective legitimization 
requirement row.
   CREATE TABLE wire_targets
     (wire_target_serial_id BIGSERIAL UNIQUE
     ,wire_target_h_payto BYTEA PRIMARY KEY CHECK 
(LENGTH(wire_target_h_payto)=32),
-    ,target_token BYTEA UNIQUE CHECK (LENGTH(target_token)=32) DEFAULT 
gen_random_bytes(32)
+    ,access_token BYTEA UNIQUE CHECK (LENGTH(access_token)=32) DEFAULT 
gen_random_bytes(32)
     ,target_pub BYTEA CHECK (LENGTH(target_pub)=32) DEFAULT NULL
     ,payto_uri STRING NOT NULL
     )
@@ -1729,7 +1728,7 @@ on GET ``/deposits/`` with the respective legitimization 
requirement row.
     IS 'All recipients of money via the exchange';
   COMMENT ON COLUMN wire_targets.h_payto
     IS 'Unsalted hash of payto_uri';
-  COMMENT ON COLUMN wire_targets.target_token
+  COMMENT ON COLUMN wire_targets.access_token
     IS 'high-entropy random value that is used as a token to authorize access 
to the KYC process (without requiring a signature by target_priv)';
   COMMENT ON COLUMN wire_targets.target_pub
     IS 'Public key (reserve_pub or merchant_pub) associated with the account; 
NULL if KYC is not allowed for the account (if there was no incoming KYC wire 
transfer yet); updated, thus NOT available to the auditor';
@@ -1738,16 +1737,16 @@ on GET ``/deposits/`` with the respective 
legitimization requirement row.
 
   CREATE TABLE IF NOT EXISTS legitimization_measures
     (legitimization_measure_serial_id INT8 GENERATED BY DEFAULT AS IDENTITY
-    ,target_token BYTEA NOT NULL UNIQUE CHECK (LENGTH(target_token)=32)
-     REFERENCES wire_targets (target_token)
+    ,access_token BYTEA NOT NULL UNIQUE CHECK (LENGTH(access_token)=32)
+     REFERENCES wire_targets (access_token)
     ,start_time INT8 NOT NULL
     ,jmeasures TEXT NOT NULL
     ,display_priority INT4 NOT NULL
     ,is_finished BOOL NOT NULL DEFAULT(FALSE)
     )
-    PARTITION BY HASH (target_token);
+    PARTITION BY HASH (access_token);
 
-  COMMENT ON COLUMN legitimization_measures.target_token
+  COMMENT ON COLUMN legitimization_measures.access_token
     IS 'Used to uniquely identify the account and as a symmetric access 
control mechanism for the SPA';
   COMMENT ON COLUMN legitimization_measures.start_time
     IS 'Time when the measure was triggered (by decision or rule)';
@@ -1758,7 +1757,7 @@ on GET ``/deposits/`` with the respective legitimization 
requirement row.
   COMMENT ON COLUMN legitimization_measures.is_finished
     IS 'Set to TRUE if this set of measures was processed; used to avoid 
indexing measures that are done';
 
-  CREATE INDEX ON legitimization_measures (target_token)
+  CREATE INDEX ON legitimization_measures (access_token)
     WHERE NOT is_finished;
 
   CREATE TABLE legitimization_outcomes

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.