Commit 669bd187 authored by Sietse Ringers's avatar Sietse Ringers
Browse files

feat: refactor revocation update messages into hashed chain structure

parent 33598603
package irma
import (
"database/sql/driver"
"database/sql/driver" // only imported to refer to the driver.Value type
"fmt"
"strings"
......
......@@ -14,6 +14,7 @@ import (
"github.com/go-errors/errors"
"github.com/jasonlvhit/gocron"
"github.com/privacybydesign/gabi/revocation"
"github.com/privacybydesign/irmago"
"github.com/privacybydesign/irmago/server"
"github.com/sirupsen/logrus"
......@@ -154,7 +155,7 @@ func (s *Server) Revoke(credid irma.CredentialTypeIdentifier, key string) error
}
func ParsePath(path string) (token, noun string, arg []string, err error) {
rev := regexp.MustCompile("revocation/(records|latestrecords|issuancerecord)/?(.*)$")
rev := regexp.MustCompile("revocation/(updatefrom|updatelatest|update|issuancerecord)/?(.*)$")
matches := rev.FindStringSubmatch(path)
if len(matches) == 3 {
args := strings.Split(matches[2], "/")
......@@ -381,7 +382,7 @@ func (s *Server) handleClientMessage(
func (s *Server) handleRevocationMessage(
noun, method string, args []string, headers map[string][]string, message []byte,
) (int, []byte) {
if (noun == "records" || noun == "latestrecords") && method == http.MethodGet {
if (noun == "updatefrom" || noun == "updatelatest") && method == http.MethodGet {
if len(args) != 2 {
return server.JsonResponse(nil, server.RemoteError(server.ErrorInvalidRequest, "GET "+noun+" expects 2 url arguments"))
}
......@@ -390,21 +391,22 @@ func (s *Server) handleRevocationMessage(
return server.JsonResponse(nil, server.RemoteError(server.ErrorMalformedInput, err.Error()))
}
cred := irma.NewCredentialTypeIdentifier(args[0])
if noun == "records" {
return server.JsonResponse(s.handleGetRevocationRecords(cred, i))
if noun == "updatefrom" {
return server.JsonResponse(s.handleGetUpdateFrom(cred, i))
} else {
return server.JsonResponse(s.handleGetLatestRevocationRecords(cred, i))
return server.JsonResponse(s.handleGetUpdateLatest(cred, i))
}
}
if noun == "records" && method == http.MethodPost {
if len(args) != 0 {
return server.JsonResponse(nil, server.RemoteError(server.ErrorInvalidRequest, "POST records expects no url arguments"))
if noun == "update" && method == http.MethodPost {
if len(args) != 1 {
return server.JsonResponse(nil, server.RemoteError(server.ErrorInvalidRequest, "POST update expects 1 url argument"))
}
var records []*irma.RevocationRecord
if err := json.Unmarshal(message, &records); err != nil {
cred := irma.NewCredentialTypeIdentifier(args[0])
var update *revocation.Update
if err := json.Unmarshal(message, &update); err != nil {
return server.JsonResponse(nil, server.RemoteError(server.ErrorMalformedInput, err.Error()))
}
return server.JsonResponse(s.handlePostRevocationRecords(records))
return server.JsonResponse(s.handlePostUpdate(cred, update))
}
if noun == "issuancerecord" && method == http.MethodPost {
if len(args) != 2 {
......
......@@ -4,6 +4,7 @@ import (
"time"
"github.com/privacybydesign/gabi"
"github.com/privacybydesign/gabi/revocation"
"github.com/privacybydesign/gabi/signed"
"github.com/privacybydesign/irmago"
"github.com/privacybydesign/irmago/server"
......@@ -33,10 +34,10 @@ func (session *session) handleGetRequest(min, max *irma.ProtocolVersion) (irma.S
session.markAlive()
logger := session.conf.Logger.WithFields(logrus.Fields{"session": session.token})
// we include the latest revocation records for the client here, as opposed to when the session
// we include the latest revocation updates for the client here, as opposed to when the session
// was started, so that the client always gets the very latest revocation records
var err error
if err = session.conf.IrmaConfiguration.Revocation.SetRevocationRecords(session.request.Base()); err != nil {
if err = session.conf.IrmaConfiguration.Revocation.SetRevocationUpdates(session.request.Base()); err != nil {
return nil, session.fail(server.ErrorUnknown, err.Error()) // TODO error type
}
......@@ -214,40 +215,42 @@ func (session *session) handlePostCommitments(commitments *irma.IssueCommitmentM
return sigs, nil
}
// POST revocation/records
func (s *Server) handlePostRevocationRecords(records []*irma.RevocationRecord) (interface{}, *irma.RemoteError) {
if err := s.conf.IrmaConfiguration.Revocation.AddRevocationRecords(records); err != nil {
// POST revocation/update/{credtype}
func (s *Server) handlePostUpdate(typ irma.CredentialTypeIdentifier, update *revocation.Update) (interface{}, *irma.RemoteError) {
if err := s.conf.IrmaConfiguration.Revocation.AddUpdate(typ, update); err != nil {
return nil, server.RemoteError(server.ErrorUnknown, err.Error()) // TODO error type
}
return nil, nil
}
// GET revocation/records/{credtype}/{index}
func (s *Server) handleGetRevocationRecords(
// GET revocation/updatefrom/{credtype}/{index}
func (s *Server) handleGetUpdateFrom(
cred irma.CredentialTypeIdentifier, index uint64,
) ([]*irma.RevocationRecord, *irma.RemoteError) {
if _, ok := s.conf.RevocationSettings[cred]; !ok {
) (*revocation.Update, *irma.RemoteError) {
if settings := s.conf.RevocationSettings[cred]; settings == nil ||
!(settings.Mode == irma.RevocationModeProxy || settings.Mode == irma.RevocationModeServer) {
return nil, server.RemoteError(server.ErrorInvalidRequest, "not supported by this server")
}
records, err := s.conf.IrmaConfiguration.Revocation.RevocationRecords(cred, index)
update, err := s.conf.IrmaConfiguration.Revocation.UpdateFrom(cred, index)
if err != nil {
return nil, server.RemoteError(server.ErrorUnknown, err.Error()) // TODO error type
}
return records, nil
return update, nil
}
// GET revocation/latestrecords/{credtype}/{count}
func (s *Server) handleGetLatestRevocationRecords(
// GET revocation/updatelatest/{credtype}/{count}
func (s *Server) handleGetUpdateLatest(
cred irma.CredentialTypeIdentifier, count uint64,
) ([]*irma.RevocationRecord, *irma.RemoteError) {
if _, ok := s.conf.RevocationSettings[cred]; !ok {
) (*revocation.Update, *irma.RemoteError) {
if settings := s.conf.RevocationSettings[cred]; settings == nil ||
!(settings.Mode == irma.RevocationModeProxy || settings.Mode == irma.RevocationModeServer) {
return nil, server.RemoteError(server.ErrorInvalidRequest, "not supported by this server")
}
records, err := s.conf.IrmaConfiguration.Revocation.LatestRevocationRecords(cred, count)
update, err := s.conf.IrmaConfiguration.Revocation.UpdateLatest(cred, count)
if err != nil {
return nil, server.RemoteError(server.ErrorUnknown, err.Error()) // TODO error type
}
return records, nil
return update, nil
}
// POST revocation/issuancerecord/{credtype}/{keycounter}
......
......@@ -95,25 +95,25 @@ func (session *session) issuanceHandleRevocation(
// Fetch latest revocation record, and then extract the current value of the accumulator
// from it to generate the witness from
records, err := rs.LatestRevocationRecords(id, 1)
u, err := rs.UpdateLatest(id, 0)
if err != nil {
return
}
r := records[len(records)-1]
pk, err := rs.Keys.PublicKey(id.IssuerIdentifier(), r.PublicKeyIndex)
sig := u.SignedAccumulator
pk, err := rs.Keys.PublicKey(id.IssuerIdentifier(), sig.PKIndex)
if err != nil {
return nil, nil, err
}
msg, err := r.UnmarshalVerify(pk)
acc, err := sig.UnmarshalVerify(pk)
if err != nil {
return nil, nil, err
}
if witness, err = sk.RevocationGenerateWitness(&msg.Accumulator); err != nil {
if witness, err = sk.RevocationGenerateWitness(acc); err != nil {
return
}
witness.Record = &r.Record // attach previously selected reocation record to the witness for the client
witness.SignedAccumulator = sig // attach previously selected reocation record to the witness for the client
nonrevAttr = witness.E
issrecord := &irma.IssuanceRecord{
CredType: id,
......@@ -122,7 +122,7 @@ func (session *session) issuanceHandleRevocation(
Issued: time.Now().UnixNano(), // or (floored) cred issuance time?
ValidUntil: attributes.Expiry().UnixNano(),
}
err = session.conf.IrmaConfiguration.Revocation.SaveIssuanceRecord(id, issrecord)
err = session.conf.IrmaConfiguration.Revocation.SaveIssuanceRecord(id, issrecord, sk)
return
}
......
......@@ -5,7 +5,6 @@ import (
"encoding/json"
"io/ioutil"
"net/http"
"reflect"
"testing"
......
......@@ -83,9 +83,11 @@ func StartRevocationServer(t *testing.T) {
// Connect to database and clear records from previous test runs
g, err := gorm.Open("postgres", conf.RevocationDB)
require.NoError(t, err)
require.NoError(t, g.DropTableIfExists((*irma.RevocationRecord)(nil)).Error)
require.NoError(t, g.DropTableIfExists((*irma.EventRecord)(nil)).Error)
require.NoError(t, g.DropTableIfExists((*irma.AccumulatorRecord)(nil)).Error)
require.NoError(t, g.DropTableIfExists((*irma.IssuanceRecord)(nil)).Error)
require.NoError(t, g.AutoMigrate((*irma.RevocationRecord)(nil)).Error)
require.NoError(t, g.AutoMigrate((*irma.EventRecord)(nil)).Error)
require.NoError(t, g.AutoMigrate((*irma.AccumulatorRecord)(nil)).Error)
require.NoError(t, g.AutoMigrate((*irma.IssuanceRecord)(nil)).Error)
require.NoError(t, g.Close())
......
package irmaclient
import (
"errors"
"github.com/privacybydesign/gabi"
"github.com/privacybydesign/gabi/revocation"
"github.com/privacybydesign/irmago"
......@@ -61,17 +59,18 @@ func (cred *credential) NonrevPrepare(conf *irma.Configuration, request irma.Ses
// first try to update witness by applying the revocation update messages attached to the session request
keys := irma.RevocationKeys{Conf: conf}
revupdates := base.RevocationUpdates[credtype]
count := len(revupdates.Events)
updated, err := cred.NonrevApplyUpdates(revupdates, keys)
if err != nil {
return updated, err
}
if cred.NonRevocationWitness.Accumulator.Index >= revupdates[len(revupdates)-1].EndIndex {
if cred.NonRevocationWitness.Accumulator.Index >= revupdates.Events[count-1].Index {
return updated, nil
}
// nonrevocation witness is still out of date after applying the updates from the request:
// we were too far behind. Update from revocation server.
revupdates, err = irma.RevocationClient{Conf: conf}.FetchRevocationRecords(credtype, cred.NonRevocationWitness.Accumulator.Index+1)
revupdates, err = irma.RevocationClient{Conf: conf}.FetchUpdateFrom(credtype, cred.NonRevocationWitness.Accumulator.Index+1)
if err != nil {
return updated, err
}
......@@ -80,22 +79,16 @@ func (cred *credential) NonrevPrepare(conf *irma.Configuration, request irma.Ses
// NonrevApplyUpdates updates the credential's nonrevocation witness using the specified messages,
// if they all verify and if their indices are ahead and adjacent to that of our witness.
func (cred *credential) NonrevApplyUpdates(messages []*irma.RevocationRecord, keys irma.RevocationKeys) (bool, error) {
func (cred *credential) NonrevApplyUpdates(update *revocation.Update, keys irma.RevocationKeys) (bool, error) {
oldindex := cred.NonRevocationWitness.Accumulator.Index
var err error
var pk *revocation.PublicKey
for _, record := range messages {
if cred.CredentialType().IssuerIdentifier() != record.CredType.IssuerIdentifier() {
return false, errors.New("cannot apply revocation record of other credential type")
}
if pk, err = keys.PublicKey(cred.CredentialType().IssuerIdentifier(), record.PublicKeyIndex); err != nil {
pk, err := keys.PublicKey(cred.CredentialType().IssuerIdentifier(), update.SignedAccumulator.PKIndex)
if err != nil {
return false, err
}
if err = cred.NonRevocationWitness.Update(pk, &record.Record); err != nil {
if err = cred.NonRevocationWitness.Update(pk, update); err != nil {
return false, err
}
}
return cred.NonRevocationWitness.Accumulator.Index != oldindex, nil
}
......@@ -359,6 +359,7 @@ func (session *session) doSession(proceed bool) {
err := <-session.prepRevocation
if err != nil {
session.fail(&irma.SessionError{ErrorType: irma.ErrorCrypto, Err: err}) // TODO error type
return
}
if !session.Distributed() {
......@@ -668,6 +669,7 @@ func (session *session) finish() bool {
func (session *session) fail(err *irma.SessionError) {
if session.finish() && err.ErrorType != irma.ErrorKeyshareUnenrolled {
irma.Logger.Warn("client session error: ", err.Error())
err.Err = errors.Wrap(err.Err, 0)
session.Handler.Failure(err)
}
......
......@@ -254,7 +254,7 @@ func (s *storage) LoadSignature(attrs *irma.AttributeList) (*gabi.CLSignature, *
if sig.Witness != nil {
pk, err := s.Configuration.Revocation.Keys.PublicKey(
attrs.CredentialType().IssuerIdentifier(),
sig.Witness.Record.PublicKeyIndex,
sig.Witness.SignedAccumulator.PKIndex,
)
if err != nil {
return nil, nil, err
......
......@@ -13,6 +13,7 @@ import (
"github.com/go-errors/errors"
"github.com/privacybydesign/gabi"
"github.com/privacybydesign/gabi/big"
"github.com/privacybydesign/gabi/revocation"
"github.com/privacybydesign/irmago/internal/fs"
)
......@@ -38,7 +39,7 @@ type BaseRequest struct {
Revocation []CredentialTypeIdentifier `json:"revocation,omitempty"`
// RevocationUpdates contains revocation update messages for the client to update its
// revocation state.
RevocationUpdates map[CredentialTypeIdentifier][]*RevocationRecord `json:"revocationUpdates,omitempty"`
RevocationUpdates map[CredentialTypeIdentifier]*revocation.Update `json:"revocationUpdates,omitempty"`
ids *IrmaIdentifierSet // cache for Identifiers() method
......@@ -199,7 +200,7 @@ type AttributeRequest struct {
type RevocationRequest struct {
LDContext string `json:"@context,omitempty"`
CredentialType CredentialTypeIdentifier `json:"type"`
Key string `json:"key,omitempty"`
Key string `json:"revocationKey,omitempty"`
Enable bool `json:"enable,omitempty"`
}
......@@ -236,7 +237,7 @@ func (b *BaseRequest) GetNonce(*atum.Timestamp) *big.Int {
// RequestsRevocation indicates whether or not the requestor requires a nonrevocation proof for
// the given credential type; that is, whether or not it included revocation update messages.
func (b *BaseRequest) RequestsRevocation(id CredentialTypeIdentifier) bool {
return len(b.RevocationUpdates) > 0 && len(b.RevocationUpdates[id]) > 0
return len(b.RevocationUpdates) > 0 && len(b.RevocationUpdates[id].Events) > 0
}
func (b *BaseRequest) RevocationConsistent() error {
......
......@@ -8,6 +8,7 @@ import (
"github.com/hashicorp/go-multierror"
"github.com/jinzhu/gorm"
_ "github.com/jinzhu/gorm/dialects/postgres"
"github.com/privacybydesign/gabi"
"github.com/privacybydesign/gabi/big"
"github.com/privacybydesign/gabi/revocation"
"github.com/privacybydesign/gabi/signed"
......@@ -41,13 +42,13 @@ type (
// RevocationSetting contains revocation settings for a given credential type.
RevocationSetting struct {
Mode RevocationMode `json:"mode"`
Mode RevocationMode `json:"mode" mapstructure:"mode"`
PostURLs []string `json:"post_urls" mapstructure:"post_urls"`
MaxNonrevocationDuration uint `json:"max_nonrev_duration" mapstructure:"max_nonrev_duration"` // in seconds, min 30
ServerURL string `json:"server_url" mapstructure:"server_url"`
MaxNonrevocationDuration uint `json:"max_nonrev_duration" mapstructure:"max_nonrev_duration"` // in seconds, min 30
// set to now whenever a new revocation record is received, or when the RA indicates
// there are no new records. Thus it specifies up to what time our nonrevocation
// set to now whenever a new update is received, or when the RA indicates
// there are no new updates. Thus it specifies up to what time our nonrevocation
// guarantees lasts.
updated time.Time
}
......@@ -55,18 +56,18 @@ type (
// RevocationMode specifies for a given credential type what revocation operations are
// supported, and how the associated data is stored (SQL or memory).
RevocationMode string
)
// RevocationRecord contains a signed AccumulatorUpdate and associated information and is used
// by clients, issuers and verifiers to update their revocation state, so that they can create
// and verify nonrevocation proofs and witnesses.
RevocationRecord struct {
revocation.Record `gorm:"embedded"`
// Structs corresponding to SQL table rows. All of them end in Record.
type (
AccumulatorRecord struct {
*revocation.SignedAccumulator `gorm:"embedded"`
CredType CredentialTypeIdentifier `gorm:"primary_key"`
}
TimeRecord struct {
Index uint64
Start, End int64
EventRecord struct {
*revocation.Event `gorm:"embedded"`
CredType CredentialTypeIdentifier `gorm:"primary_key"`
}
// IssuanceRecord contains information generated during issuance, needed for later revocation.
......@@ -78,6 +79,12 @@ type (
ValidUntil int64
RevokedAt int64 // 0 if not currently revoked
}
// TODO
TimeRecord struct {
Index uint64
Start, End int64
}
)
const (
......@@ -86,21 +93,21 @@ const (
RevocationModeRequestor RevocationMode = ""
// RevocationModeProxy indicates that this server
// (1) allows fetching of RevocationRecord instances from its database,
// (2) relays all RevocationRecord instances it receives to the URLs configured in the containing
// (1) allows fetching of revocation update messages from its database,
// (2) relays all revocation updates it receives to the URLs configured in the containing
// RevocationSetting struct.
// Requires a SQL server to store and retrieve RevocationRecord instances from.
// Requires a SQL server to store and retrieve update messages from.
RevocationModeProxy RevocationMode = "proxy"
// RevocationModeServer indicates that this is a revocation server for a credential type.
// IssuanceRecord instances are sent to this server, as well as revocation commands, through
// revocation sessions or through the RevocationStorage.Revoke() method.
// Requires a SQL server to store and retrieve all records from and requires the issuer's
// private key to be accessible, in order to revoke and to sign new revocation records.
// private key to be accessible, in order to revoke and to sign new revocation update messages.
// In addition this mode exposes the same endpoints as RevocationModeProxy.
RevocationModeServer RevocationMode = "server"
// revocationUpdateCount specifies how many revocation records are attached to session requests
// revocationUpdateCount specifies how many revocation events are attached to session requests
// for the client to update its revocation state.
revocationUpdateCount = 5
......@@ -111,35 +118,24 @@ const (
revocationMaxAccumulatorAge uint = 5 * 60
)
// Revocation record methods
// EnableRevocation creates an initial accumulator for a given credential type. This function is the
// only way to create such an initial accumulator and it must be called before anyone can use
// revocation for this credential type. Requires the issuer private key.
func (rs *RevocationStorage) EnableRevocation(typ CredentialTypeIdentifier, sk *revocation.PrivateKey) error {
hasRecords, err := rs.db.HasRecords(typ, (*RevocationRecord)(nil))
hasRecords, err := rs.db.HasRecords(typ, (*EventRecord)(nil))
if err != nil {
return err
}
if hasRecords {
return errors.New("revocation record table not empty")
return errors.New("revocation event record table not empty")
}
msg, acc, err := revocation.NewAccumulator(sk)
update, err := revocation.NewAccumulator(sk)
if err != nil {
return err
}
r := &RevocationRecord{
Record: revocation.Record{
PublicKeyIndex: sk.Counter,
Message: msg,
StartIndex: acc.Index,
EndIndex: acc.Index,
},
CredType: typ,
}
if err = rs.AddRevocationRecord(r); err != nil {
if err = rs.AddUpdate(typ, update); err != nil {
return err
}
return nil
......@@ -149,81 +145,104 @@ func (rs *RevocationStorage) EnableRevocation(typ CredentialTypeIdentifier, sk *
// by checking if any revocation record exists in the database.
func (rs *RevocationStorage) RevocationEnabled(typ CredentialTypeIdentifier) (bool, error) {
if rs.sqlMode {
return rs.db.HasRecords(typ, (*RevocationRecord)(nil))
return rs.db.HasRecords(typ, (*EventRecord)(nil))
} else {
return rs.memdb.HasRecords(typ), nil
}
}
// RevocationRecords returns all records that a client requires to update its revocation state if it is currently
// Revocation update message methods
// UpdateFrom returns all records that a client requires to update its revocation state if it is currently
// at the specified index, that is, all records whose end index is greater than or equal to
// the specified index.
func (rs *RevocationStorage) RevocationRecords(typ CredentialTypeIdentifier, index uint64) ([]*RevocationRecord, error) {
var records []*RevocationRecord
return records, rs.db.From(typ, "end_index", index, &records)
func (rs *RevocationStorage) UpdateFrom(typ CredentialTypeIdentifier, index uint64) (*revocation.Update, error) {
// Only requires SQL implementation
var update *revocation.Update
if err := rs.db.Transaction(func(tx revStorage) error {
acc, _, err := rs.currentAccumulator(tx, typ)
if err != nil {
return err
}
var events []*EventRecord
if err := tx.From(typ, "index", index, &events); err != nil {
return err
}
update = rs.newUpdate(acc, events)
return nil
}); err != nil {
return nil, err
}
return update, nil
}
func (rs *RevocationStorage) LatestRevocationRecords(typ CredentialTypeIdentifier, count uint64) ([]*RevocationRecord, error) {
var records []*RevocationRecord
func (rs *RevocationStorage) UpdateLatest(typ CredentialTypeIdentifier, count uint64) (*revocation.Update, error) {
// TODO what should this function and UpdateFrom return when no records are found?
if rs.sqlMode {
if err := rs.db.Latest(typ, "end_index", count, &records); err != nil {
var update *revocation.Update
if err := rs.db.Transaction(func(tx revStorage) error {
acc, _, err := rs.currentAccumulator(tx, typ)
if err != nil {
return err
}
var events []*EventRecord
if err := tx.Latest(typ, "index", count, &events); err != nil {
return err
}
update = rs.newUpdate(acc, events)
return nil
}); err != nil {
return nil, err
}
return update, nil
} else {
rs.memdb.Latest(typ, count, &records)
return rs.memdb.Latest(typ, count), nil
}
if len(records) == 0 {
return nil, gorm.ErrRecordNotFound
}
return records, nil
}
func (rs *RevocationStorage) AddRevocationRecords(records []*RevocationRecord) error {
var err error
for _, r := range records {
if err = rs.addRevocationRecord(rs.db, r, false); err != nil {
return err
func (*RevocationStorage) newUpdate(acc *revocation.SignedAccumulator, events []*EventRecord) *revocation.Update {
updates := make([]*revocation.Event, len(events))
for i := range events {
updates[i] = events[i].Event
}
return &revocation.Update{
SignedAccumulator: acc,
Events: updates,
}
if len(records) > 0 {
// POST record to listeners, if any, asynchroniously
go rs.client.PostRevocationRecords(rs.getSettings(records[0].CredType).PostURLs, records)
}
return nil
}
func (rs *RevocationStorage) AddRevocationRecord(record *RevocationRecord) error {
return rs.addRevocationRecord(rs.db, record, true)
func (rs *RevocationStorage) AddUpdate(typ CredentialTypeIdentifier, record *revocation.Update) error {
return rs.addUpdate(rs.db, typ, record)
}
func (rs *RevocationStorage) addRevocationRecord(tx revStorage, record *RevocationRecord, post bool) error {
func (rs *RevocationStorage) addUpdate(tx revStorage, typ CredentialTypeIdentifier, update *revocation.Update) error {
// Unmarshal and verify the record against the appropriate public key
pk, err := rs.Keys.PublicKey(record.CredType.IssuerIdentifier(), record.PublicKeyIndex)
pk, err := rs.Keys.PublicKey(typ.IssuerIdentifier(), update.SignedAccumulator.PKIndex)
if err != nil {
return err
}
_, err = record.UnmarshalVerify(pk)
if err != nil {
if _, _, err = update.Verify(pk, 0); err != nil {
return err
}
// Save record
if rs.sqlMode {
if err = tx.Insert(record); err != nil {
if err = tx.Upsert(&AccumulatorRecord{SignedAccumulator: update.SignedAccumulator, CredType: typ}); err != nil {
return err
}
for _, event := range update.Events {
if err = tx.Insert(&EventRecord{Event: event, CredType: typ}); err != nil {
return err
}
}
} else {
rs.memdb.Insert(record)
rs.memdb.Insert(typ, update)
}
s := rs.getSettings(record.CredType)
s := rs.getSettings(typ)
s.updated = time.Now()
if post {
// POST record to listeners, if any, asynchroniously
go rs.client.PostRevocationRecords(s.PostURLs, []*RevocationRecord{record})
}
go rs.client.PostUpdate(typ, s.PostURLs, update)
return nil
}
......@@ -259,51 +278,36 @@ func (rs *RevocationStorage) Revoke(typ CredentialTypeIdentifier, key string, sk
return rs.db.Transaction(func(tx revStorage) error {
var err error
cr := IssuanceRecord{}
if err = tx.