[DOCs/operators]: Release notes for v2025.19 kase (#6157)

* add release and operators notes

* bump up version

* fix location in csv to USA

* bump up stats

* typo fix

.github/workflows/ci-build.yml

@@ -8,13 +8,10 @@ on:
       - 'gateway/**'
       - 'integrations/**'
       - 'nym-api/**'
-      - 'nym-authenticator-client/**'
       - 'nym-credential-proxy/**'
-      - 'nym-ip-packet-client/**'
       - 'nym-network-monitor/**'
       - 'nym-node/**'
       - 'nym-node-status-api/**'
-      - 'nym-registration-client/**'
       - 'nym-statistics-api/**'
       - 'nym-outfox/**'
       - 'nym-validator-rewarder/**'

.github/workflows/ci-check-ns-api-version.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/ci-check-nym-stats-api-version.yml

@@ -10,13 +10,13 @@ env:
 
 jobs:
   check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/ci-lint-typescript.yml

@@ -6,14 +6,16 @@ on:
     paths:
       - "ts-packages/**"
       - "sdk/typescript/**"
+      - "nym-connect/desktop/src/**"
+      - "nym-connect/desktop/package.json"
       - "nym-wallet/src/**"
       - "nym-wallet/package.json"
-      - "explorer-v2/**"
+      - "explorer/**"
       - ".github/workflows/ci-lint-typescript.yml"
 
 jobs:
   build:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
     env:
       RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
@@ -23,7 +25,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-
       - name: Setup yarn
         run: npm install -g yarn
 
@@ -36,12 +37,14 @@ jobs:
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
 
       - name: Install wasm-opt
-        run: cargo install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"
 
       - name: Install
         run: yarn
@@ -49,11 +52,7 @@ jobs:
       - name: Build packages
         run: yarn build:ci
 
-      - name: Install again
-        run: yarn
-
       - name: Lint
         run: yarn lint
-
       - name: Typecheck with tsc
         run: yarn tsc

.github/workflows/ci-nym-wallet-storybook.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    runs-on: arc-linux-latest
+    runs-on: custom-linux
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/ci-sdk-wasm.yml

@@ -31,7 +31,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: "1.24.6"
 

.github/workflows/ci-sonar.yml

@@ -14,6 +14,6 @@ jobs:
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v6
+        uses: SonarSource/sonarqube-scan-action@v5
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/deploy-github-pages.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Setup Pages
         uses: actions/configure-pages@v5
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v3
         with:
           # Upload entire repository
           path: './ppa'

.github/workflows/greetings.yml

@@ -8,6 +8,6 @@ jobs:
     steps:
     - uses: actions/first-interaction@v3
       with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        issue_message: 'Thank you for raising this issue'
-        pr_message: 'Thank you for making this first PR'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue-message: 'Thank you for raising this issue'
+        pr-message: 'Thank you for making this first PR'

.github/workflows/publish-sdk-npm.yml

@@ -4,7 +4,7 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -17,13 +17,10 @@ jobs:
       - name: Setup yarn
         run: npm install -g yarn
 
-      - name: Install rust toolchain
+      - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          profile: minimal
           toolchain: stable
-          override: true
-          components: rustfmt, clippy
 
       - name: Install wasm-pack
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -32,9 +29,9 @@ jobs:
         run: cargo install wasm-opt
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"
 
       - name: Install dependencies
         run: yarn

.github/workflows/push-credential-proxy.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml

.github/workflows/push-data-observatory.yaml

@@ -8,7 +8,7 @@ env:
 
 jobs:
   build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
         uses: docker/login-action@v3
@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-network-monitor.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml

.github/workflows/push-node-status-agent.yaml

@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
   workflow_dispatch:
     inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
       release_image:
         description: 'Tag image as a release'
         required: true
@@ -38,6 +43,16 @@ jobs:
           VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
           echo "result=$VERSION" >> $GITHUB_OUTPUT
 
+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
       - name: Initialize RELEASE_TAG
         run: echo "RELEASE_TAG=" >> $GITHUB_ENV
       
@@ -46,12 +61,24 @@ jobs:
         run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
       
       - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
         
       - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-nym-api.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml

.github/workflows/push-nym-node.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-nym-statistics-api.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-nyx-chain-watcher.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-validator-rewarder.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.gitignore

@@ -63,5 +63,3 @@ nym-api/redocly/formatted-openapi.json
 
 **/settings.sql
 **/enter_db.sh
-
-*.profraw

CHANGELOG.md

@@ -4,100 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
-## [2025.21-mozzarella] (2025-11-25)
-
-- [bugfix] Tunnel not waiting on MixnetClient to shut down cleanly ([#6225])
-- bugfix: fix credential proxy upgrade mode attestation url arg ([#6202])
-- HTTP API resilience enable & domain rotation conditions ([#6200])
-- Remove debug feature from http-macro spec in gateway probe ([#6195])
-- DNS relibility and troubleshooting  ([#6179])
-- [bugfix] Distinguish authenticator errors by credential spent ([#6176])
-- Typescript SDK 1.4.1 ([#6146])
-- Enable URL rotation and retries for mixnet gateway init ([#6126])
-- Feature/credential proxy jwt ([#5957])
-
-[#6225]: https://github.com/nymtech/nym/pull/6225
-[#6202]: https://github.com/nymtech/nym/pull/6202
-[#6200]: https://github.com/nymtech/nym/pull/6200
-[#6195]: https://github.com/nymtech/nym/pull/6195
-[#6179]: https://github.com/nymtech/nym/pull/6179
-[#6176]: https://github.com/nymtech/nym/pull/6176
-[#6146]: https://github.com/nymtech/nym/pull/6146
-[#6126]: https://github.com/nymtech/nym/pull/6126
-[#5957]: https://github.com/nymtech/nym/pull/5957
-
-## [2025.20-leerdammer] (2025-11-12)
-
-- Max/tweak ts sdk actions ([#6185])
-- chore: resolve clippy 1.91 warnings ([#6168])
-- [chore] Remove unused dependencies ([#6151])
-- Use typed-builder for registration client builder config ([#6150])
-- tommy is too quick ([#6149])
-- configurable mixnet client startup timeout ([#6148])
-- [Feature/operators]: QUIC bridge deployment script v2 ([#6145])
-- Bugfix: Add circuit breaker ([#6143])
-- bugfix: update internal owner address in transferred share ([#6139])
-- Update quic_bridge_deployment.sh for IPv4 and .deb package ([#6138])
-- feat: expose more explicit new_with_fronted_urls builder for http API client ([#6136])
-- bugfix: update stored epoch share when changing ownership ([#6135])
-- Domain fronting ([#6134])
-- bugfix: update stored epoch share when changing announce address ([#6131])
-
-[#6185]: https://github.com/nymtech/nym/pull/6185
-[#6168]: https://github.com/nymtech/nym/pull/6168
-[#6151]: https://github.com/nymtech/nym/pull/6151
-[#6150]: https://github.com/nymtech/nym/pull/6150
-[#6149]: https://github.com/nymtech/nym/pull/6149
-[#6148]: https://github.com/nymtech/nym/pull/6148
-[#6145]: https://github.com/nymtech/nym/pull/6145
-[#6143]: https://github.com/nymtech/nym/pull/6143
-[#6139]: https://github.com/nymtech/nym/pull/6139
-[#6138]: https://github.com/nymtech/nym/pull/6138
-[#6136]: https://github.com/nymtech/nym/pull/6136
-[#6135]: https://github.com/nymtech/nym/pull/6135
-[#6134]: https://github.com/nymtech/nym/pull/6134
-[#6131]: https://github.com/nymtech/nym/pull/6131
-
-## [2025.19-kase] (2025-10-30)
-
-- update ns agent workflow ([#6154])
-- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
-- bugfix: nym-credential-proxy query params parsing regression ([#6121])
-- bugfix: revert some dep updates introduced in #6043 ([#6120])
-- Skip ipv6 metadata endpoint request ([#6118])
-- update to no longer use 1mb files ([#6117])
-- chore: restore pending dkg contract state migration ([#6116])
-- Revert "Propagate cancel token to mixnet client" ([#6115])
-- Update dirs to 6.0 ([#6109])
-- Propagate cancel token to mixnet client ([#6105])
-- bugfix: retrieve and update ticketbook in the same query ([#6101])
-- bugfix: include network name in the default gateway probe config path ([#6100])
-- Bugfix/incompatibility fixes ([#6099])
-- [DOCs/operators] QUIC deployment script & docs ([#6098])
-- bugfix: testnet manager 02sql migration ([#6096])
-- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
-- bugfix: use custom topology provider for list of init gateways ([#6092])
-- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
 ## [2025.18-jarlsberg] (2025-10-14)
 
 - ns-api: add descriptions to dVPN gateway responses ([#6102])

Cargo.toml

@@ -87,9 +87,7 @@ members = [
     "common/nymsphinx/params",
     "common/nymsphinx/routing",
     "common/nymsphinx/types",
-    "common/nyxd-scraper-sqlite",
-    "common/nyxd-scraper-psql",
-    "common/nyxd-scraper-shared",
+    "common/nyxd-scraper",
     "common/pemstore",
     "common/registration",
     "common/serde-helpers",
@@ -126,7 +124,6 @@ members = [
     "nym-credential-proxy/nym-credential-proxy",
     "nym-credential-proxy/nym-credential-proxy-requests",
     "nym-credential-proxy/vpn-api-lib-wasm",
-    "nym-data-observatory",
     "nym-ip-packet-client",
     "nym-network-monitor",
     "nym-node",
@@ -153,7 +150,7 @@ members = [
     "tools/internal/contract-state-importer/importer-cli",
     "tools/internal/contract-state-importer/importer-contract",
     "tools/internal/mixnet-connectivity-check",
-#    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
     "tools/internal/ssl-inject",
     "tools/internal/testnet-manager",
     "tools/internal/testnet-manager/dkg-bypass-contract",
@@ -174,7 +171,6 @@ members = [
 default-members = [
     "clients/native",
     "clients/socks5",
-    "nym-authenticator-client",
     "nym-api",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-node",
@@ -266,7 +262,6 @@ futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
 hickory-resolver = "0.25"
@@ -351,11 +346,11 @@ tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
 tower = "0.5.2"
-tower-http = "0.6.6"
+tower-http = "0.5.2"
 tracing = "0.1.41"
 tracing-log = "0.2"
 tracing-opentelemetry = "0.19.0"
-tracing-subscriber = "0.3.20"
+tracing-subscriber = "0.3.19"
 tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
 tracing-test = "0.2.5"
@@ -402,9 +397,7 @@ cw-multi-test = "=2.3.2"
 bip32 = { version = "0.5.3", default-features = false }
 
 
-cosmrs = { version = "0.22.0" }
-cosmos-sdk-proto = { version = "0.27.0" }
-ibc-proto = { version = "0.52.0" }
+cosmrs = { version = "0.21.1" }
 tendermint = "0.40.4"
 tendermint-rpc = "0.40.4"
 prost = { version = "0.13", default-features = false }
@@ -460,11 +453,6 @@ opt-level = 'z'
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }
 
 [workspace.lints.clippy]
-suspicious = "deny"
-complexity = "deny"
-perf = "deny"
-style = "deny"
-
 unwrap_used = "deny"
 expect_used = "deny"
 todo = "deny"

Makefile

@@ -107,16 +107,16 @@ sdk-wasm-build:
 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
-	$(MAKE) -C wasm/mix-fetch
+	# $(MAKE) -C wasm/mix-fetch
 	$(MAKE) -C wasm/zknym-lib
 	# $(MAKE) -C wasm/full-nym-wasm
 
 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	npx lerna run --scope @nymproject/mix-fetch build --stream
-	npx lerna run --scope @nymproject/node-tester build --stream
-	yarn --cwd sdk/typescript/codegen/contract-clients build
+	# npx lerna run --scope @nymproject/mix-fetch build --stream
+	# npx lerna run --scope @nymproject/node-tester build --stream
+	# yarn --cwd sdk/typescript/codegen/contract-clients build
 
 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
 WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.67"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.67"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/authenticator-requests/Cargo.toml

@@ -16,7 +16,6 @@ serde = { workspace = true, features = ["derive"] }
 semver = { workspace = true }
 strum_macros = { workspace = true }
 thiserror = { workspace = true }
-tracing = { workspace = true }
 
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
@@ -30,13 +29,7 @@ hmac = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
 x25519-dalek = { workspace = true, features = ["static_secrets"] }
 
-[dev-dependencies]
-nym-test-utils = { path = "../test-utils" }
-
 [features]
 default = ["verify"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
 verify = ["hmac", "sha2"]
-
-[lints]
-workspace = true

common/authenticator-requests/src/client_message.rs

@@ -6,11 +6,9 @@ use nym_wireguard_types::PeerPublicKey;
 
 use crate::{
     AuthenticatorVersion, Error,
-    traits::{
-        FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, UpgradeModeMessage,
-        Versionable,
-    },
-    v2, v3, v4, v5, v6,
+    latest::registration::IpPair,
+    traits::{FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, Versionable},
+    v2, v3, v4, v5,
 };
 
 // This is very redundant with AuthenticatorRequest and I reckon they could be smooshed.
@@ -21,293 +19,6 @@ pub enum ClientMessage {
     Final(Box<dyn FinalMessage + Send + Sync + 'static>),
     Query(Box<dyn QueryBandwidthMessage + Send + Sync + 'static>),
     TopUp(Box<dyn TopUpMessage + Send + Sync + 'static>),
-    UpgradeModeCheck(Box<dyn UpgradeModeMessage + Send + Sync + 'static>),
-}
-
-pub struct SerialisedRequest {
-    pub bytes: Vec<u8>,
-    pub request_id: u64,
-}
-
-impl SerialisedRequest {
-    pub fn new(bytes: Vec<u8>, request_id: u64) -> Self {
-        Self { bytes, request_id }
-    }
-}
-
-impl ClientMessage {
-    fn serialise_v1(&self) -> Result<SerialisedRequest, Error> {
-        Err(Error::UnsupportedVersion)
-    }
-
-    fn serialise_v2(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v2::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-            request::AuthenticatorRequest,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ip: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?
-                                .into(),
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v3(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v3::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ip: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?
-                                .into(),
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(
-                    TopUpMessage {
-                        pub_key: top_up_message.pub_key(),
-                        credential: top_up_message.credential(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v4(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v4::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ips: IpPair {
-                                ipv4: final_message
-                                    .gateway_client_ipv4()
-                                    .ok_or(Error::UnsupportedMessage)?,
-                                ipv6: final_message
-                                    .gateway_client_ipv6()
-                                    .ok_or(Error::UnsupportedMessage)?,
-                            },
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(
-                    TopUpMessage {
-                        pub_key: top_up_message.pub_key(),
-                        credential: top_up_message.credential(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v5(&self) -> Result<SerialisedRequest, Error> {
-        use v5::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                    pub_key: init_message.pub_key(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                    gateway_client: GatewayClient {
-                        pub_key: final_message.gateway_client_pub_key(),
-                        private_ips: IpPair {
-                            ipv4: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?,
-                            ipv6: final_message
-                                .gateway_client_ipv6()
-                                .ok_or(Error::UnsupportedMessage)?,
-                        },
-                        mac: ClientMac::new(final_message.gateway_client_mac()),
-                    },
-                    credential: final_message
-                        .credential()
-                        .and_then(|c| c.credential.into_zk_nym())
-                        .map(|c| *c),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) = AuthenticatorRequest::new_query_request(query_message.pub_key());
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                    pub_key: top_up_message.pub_key(),
-                    credential: top_up_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v6(&self) -> Result<SerialisedRequest, Error> {
-        use v6::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-            upgrade_mode_check::UpgradeModeCheckRequest,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                    pub_key: init_message.pub_key(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                    gateway_client: GatewayClient {
-                        pub_key: final_message.gateway_client_pub_key(),
-                        private_ips: IpPair {
-                            ipv4: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?,
-                            ipv6: final_message
-                                .gateway_client_ipv6()
-                                .ok_or(Error::UnsupportedMessage)?,
-                        },
-                        mac: ClientMac::new(final_message.gateway_client_mac()),
-                    },
-                    credential: final_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) = AuthenticatorRequest::new_query_request(query_message.pub_key());
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                    pub_key: top_up_message.pub_key(),
-                    credential: top_up_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::UpgradeModeCheck(upgrade_mode_check) => {
-                // currently JWT is the only emergency credential option
-                let Some(upgrade_mode_jwt) =
-                    upgrade_mode_check.upgrade_mode_global_attestation_jwt()
-                else {
-                    return Err(Error::conversion(
-                        "no valid known upgrade mode check variants",
-                    ));
-                };
-                let msg = UpgradeModeCheckRequest::UpgradeModeJwt {
-                    token: upgrade_mode_jwt,
-                };
-
-                let (req, id) = AuthenticatorRequest::new_upgrade_mode_check_request(msg);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-        }
-    }
 }
 
 impl ClientMessage {
@@ -316,7 +27,7 @@ impl ClientMessage {
         match self {
             Self::Final(msg) => msg.credential().is_some(),
             Self::TopUp(_) => true,
-            Self::Initial(_) | Self::Query(_) | Self::UpgradeModeCheck(_) => false,
+            Self::Initial(_) | Self::Query(_) => false,
         }
     }
 
@@ -326,18 +37,208 @@ impl ClientMessage {
             ClientMessage::Final(msg) => msg.version(),
             ClientMessage::Query(msg) => msg.version(),
             ClientMessage::TopUp(msg) => msg.version(),
-            ClientMessage::UpgradeModeCheck(msg) => msg.version(),
         }
     }
 
-    pub fn bytes(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
+    pub fn bytes(&self, reply_to: Recipient) -> Result<(Vec<u8>, u64), Error> {
         match self.version() {
-            AuthenticatorVersion::V1 => self.serialise_v1(),
-            AuthenticatorVersion::V2 => self.serialise_v2(reply_to),
-            AuthenticatorVersion::V3 => self.serialise_v3(reply_to),
-            AuthenticatorVersion::V4 => self.serialise_v4(reply_to),
-            AuthenticatorVersion::V5 => self.serialise_v5(),
-            AuthenticatorVersion::V6 => self.serialise_v6(),
+            AuthenticatorVersion::V1 => Err(Error::UnsupportedVersion),
+            AuthenticatorVersion::V2 => {
+                use v2::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(
+                            InitMessage {
+                                pub_key: init_message.pub_key(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(
+                            FinalMessage {
+                                gateway_client: GatewayClient {
+                                    pub_key: final_message.gateway_client_pub_key(),
+                                    private_ip: final_message
+                                        .gateway_client_ipv4()
+                                        .ok_or(Error::UnsupportedMessage)?
+                                        .into(),
+                                    mac: ClientMac::new(final_message.gateway_client_mac()),
+                                },
+                                credential: final_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) = AuthenticatorRequest::new_query_request(
+                            query_message.pub_key(),
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    _ => Err(Error::UnsupportedMessage),
+                }
+            }
+            AuthenticatorVersion::V3 => {
+                use v3::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                    topup::TopUpMessage,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(
+                            InitMessage {
+                                pub_key: init_message.pub_key(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(
+                            FinalMessage {
+                                gateway_client: GatewayClient {
+                                    pub_key: final_message.gateway_client_pub_key(),
+                                    private_ip: final_message
+                                        .gateway_client_ipv4()
+                                        .ok_or(Error::UnsupportedMessage)?
+                                        .into(),
+                                    mac: ClientMac::new(final_message.gateway_client_mac()),
+                                },
+                                credential: final_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) = AuthenticatorRequest::new_query_request(
+                            query_message.pub_key(),
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::TopUp(top_up_message) => {
+                        let (req, id) = AuthenticatorRequest::new_topup_request(
+                            TopUpMessage {
+                                pub_key: top_up_message.pub_key(),
+                                credential: top_up_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                }
+            }
+            AuthenticatorVersion::V4 => {
+                use v4::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                    topup::TopUpMessage,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(
+                            InitMessage {
+                                pub_key: init_message.pub_key(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(
+                            FinalMessage {
+                                gateway_client: GatewayClient {
+                                    pub_key: final_message.gateway_client_pub_key(),
+                                    private_ips: IpPair {
+                                        ipv4: final_message
+                                            .gateway_client_ipv4()
+                                            .ok_or(Error::UnsupportedMessage)?,
+                                        ipv6: final_message
+                                            .gateway_client_ipv6()
+                                            .ok_or(Error::UnsupportedMessage)?,
+                                    }
+                                    .into(),
+                                    mac: ClientMac::new(final_message.gateway_client_mac()),
+                                },
+                                credential: final_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) = AuthenticatorRequest::new_query_request(
+                            query_message.pub_key(),
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::TopUp(top_up_message) => {
+                        let (req, id) = AuthenticatorRequest::new_topup_request(
+                            TopUpMessage {
+                                pub_key: top_up_message.pub_key(),
+                                credential: top_up_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                }
+            }
+            AuthenticatorVersion::V5 => {
+                use v5::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                    topup::TopUpMessage,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
+                            pub_key: init_message.pub_key(),
+                        });
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
+                            gateway_client: GatewayClient {
+                                pub_key: final_message.gateway_client_pub_key(),
+                                private_ips: IpPair {
+                                    ipv4: final_message
+                                        .gateway_client_ipv4()
+                                        .ok_or(Error::UnsupportedMessage)?,
+                                    ipv6: final_message
+                                        .gateway_client_ipv6()
+                                        .ok_or(Error::UnsupportedMessage)?,
+                                },
+                                mac: ClientMac::new(final_message.gateway_client_mac()),
+                            },
+                            credential: final_message.credential(),
+                        });
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) =
+                            AuthenticatorRequest::new_query_request(query_message.pub_key());
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::TopUp(top_up_message) => {
+                        let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
+                            pub_key: top_up_message.pub_key(),
+                            credential: top_up_message.credential(),
+                        });
+                        Ok((req.to_bytes()?, id))
+                    }
+                }
+            }
             AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
         }
     }
@@ -346,7 +247,7 @@ impl ClientMessage {
         use AuthenticatorVersion::*;
         match self.version() {
             V1 | V2 | V3 | V4 => false,
-            V5 | V6 => true,
+            V5 => true,
             UNKNOWN => true,
         }
     }

common/authenticator-requests/src/error.rs

@@ -1,7 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use std::fmt::Display;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -38,13 +37,3 @@ pub enum Error {
     #[error(transparent)]
     Bincode(#[from] bincode::Error),
 }
-
-impl Error {
-    pub fn conversion(msg: impl Into<String>) -> Self {
-        Error::Conversion(msg.into())
-    }
-
-    pub fn conversion_display(msg: impl Display) -> Self {
-        Error::Conversion(msg.to_string())
-    }
-}

common/authenticator-requests/src/lib.rs

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub mod client_message;
-pub mod models;
 pub mod request;
 pub mod response;
 pub mod traits;
@@ -11,14 +10,13 @@ pub mod v2;
 pub mod v3;
 pub mod v4;
 pub mod v5;
-pub mod v6;
 
 mod error;
 mod util;
 mod version;
 
 pub use error::Error;
-pub use v6 as latest;
+pub use v5 as latest;
 pub use version::AuthenticatorVersion;
 
 pub const CURRENT_VERSION: u8 = latest::VERSION;

common/authenticator-requests/src/models.rs

@@ -1,58 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials_interface::{
-    BandwidthCredential, CredentialSpendingData, TicketType, UnknownTicketType,
-};
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq)]
-pub enum CurrentUpgradeModeStatus {
-    Enabled,
-    Disabled,
-    // everything pre-v6
-    Unknown,
-}
-
-impl CurrentUpgradeModeStatus {
-    pub fn is_enabled(&self) -> bool {
-        matches!(self, CurrentUpgradeModeStatus::Enabled)
-    }
-}
-
-impl From<bool> for CurrentUpgradeModeStatus {
-    fn from(value: bool) -> Self {
-        if value {
-            CurrentUpgradeModeStatus::Enabled
-        } else {
-            CurrentUpgradeModeStatus::Disabled
-        }
-    }
-}
-
-impl From<CurrentUpgradeModeStatus> for Option<bool> {
-    fn from(value: CurrentUpgradeModeStatus) -> Self {
-        match value {
-            CurrentUpgradeModeStatus::Enabled => Some(true),
-            CurrentUpgradeModeStatus::Disabled => Some(false),
-            CurrentUpgradeModeStatus::Unknown => None,
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct BandwidthClaim {
-    pub credential: BandwidthCredential,
-    pub kind: TicketType,
-}
-
-impl TryFrom<CredentialSpendingData> for BandwidthClaim {
-    type Error = UnknownTicketType;
-
-    fn try_from(credential: CredentialSpendingData) -> Result<Self, Self::Error> {
-        Ok(BandwidthClaim {
-            kind: TicketType::try_from_encoded(credential.payment.t_type)?,
-            credential: BandwidthCredential::from(credential),
-        })
-    }
-}

common/authenticator-requests/src/request.rs

@@ -4,10 +4,8 @@
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 
-use crate::traits::{
-    FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, UpgradeModeMessage,
-};
-use crate::{v1, v2, v3, v4, v5, v6};
+use crate::traits::{FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage};
+use crate::{v1, v2, v3, v4, v5};
 
 #[derive(Debug)]
 pub enum AuthenticatorRequest {
@@ -35,11 +33,6 @@ pub enum AuthenticatorRequest {
         reply_to: Option<Recipient>,
         request_id: u64,
     },
-    CheckUpgradeMode {
-        msg: Box<dyn UpgradeModeMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        request_id: u64,
-    },
 }
 
 impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
@@ -209,45 +202,3 @@ impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
         }
     }
 }
-
-impl From<v6::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v6::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v6::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v6::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v6::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v6::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v6::request::AuthenticatorRequestData::CheckUpgradeMode(upgrade_mode_check_msg) => {
-                Self::CheckUpgradeMode {
-                    msg: Box::new(upgrade_mode_check_msg),
-                    protocol: value.protocol,
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}

common/authenticator-requests/src/response.rs

@@ -1,12 +1,11 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::models::CurrentUpgradeModeStatus;
 use crate::traits::{
     Id, PendingRegistrationResponse, RegisteredResponse, RemainingBandwidthResponse,
-    TopUpBandwidthResponse, UpgradeModeStatus,
+    TopUpBandwidthResponse,
 };
-use crate::{v2, v3, v4, v5, v6};
+use crate::{v2, v3, v4, v5};
 
 #[derive(Debug)]
 pub enum AuthenticatorResponse {
@@ -14,29 +13,6 @@ pub enum AuthenticatorResponse {
     Registered(Box<dyn RegisteredResponse + Send + Sync + 'static>),
     RemainingBandwidth(Box<dyn RemainingBandwidthResponse + Send + Sync + 'static>),
     TopUpBandwidth(Box<dyn TopUpBandwidthResponse + Send + Sync + 'static>),
-    UpgradeMode(Box<dyn UpgradeModeStatus + Send + Sync + 'static>),
-}
-
-impl UpgradeModeStatus for AuthenticatorResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        match self {
-            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
-                pending_registration_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::Registered(registered_response) => {
-                registered_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::RemainingBandwidth(remaining_bandwidth_response) => {
-                remaining_bandwidth_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
-                top_up_bandwidth_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::UpgradeMode(upgrade_mode_response) => {
-                upgrade_mode_response.upgrade_mode_status()
-            }
-        }
-    }
 }
 
 impl Id for AuthenticatorResponse {
@@ -52,7 +28,6 @@ impl Id for AuthenticatorResponse {
             AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
                 top_up_bandwidth_response.id()
             }
-            AuthenticatorResponse::UpgradeMode(upgrade_mode_response) => upgrade_mode_response.id(),
         }
     }
 }
@@ -129,25 +104,3 @@ impl From<v5::response::AuthenticatorResponse> for AuthenticatorResponse {
         }
     }
 }
-
-impl From<v6::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v6::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v6::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v6::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v6::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-            v6::response::AuthenticatorResponseData::UpgradeMode(upgrade_mode_check_response) => {
-                Self::UpgradeMode(Box::new(upgrade_mode_check_response))
-            }
-        }
-    }
-}

common/authenticator-requests/src/traits.rs

@@ -1,15 +1,15 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::latest::registration::IpPair;
-use crate::models::{BandwidthClaim, CurrentUpgradeModeStatus};
-use crate::{AuthenticatorVersion, Error, v1, v2, v3, v4, v5, v6};
-use nym_credentials_interface::CredentialSpendingData;
-use nym_crypto::asymmetric::x25519;
-use nym_wireguard_types::PeerPublicKey;
 use std::fmt;
 use std::net::{Ipv4Addr, Ipv6Addr};
-use tracing::error;
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_crypto::asymmetric::x25519::PrivateKey;
+use nym_wireguard_types::PeerPublicKey;
+
+use crate::latest::registration::IpPair;
+use crate::{AuthenticatorVersion, Error, v1, v2, v3, v4, v5};
 
 pub trait Versionable {
     fn version(&self) -> AuthenticatorVersion;
@@ -51,12 +51,6 @@ impl Versionable for v5::registration::InitMessage {
     }
 }
 
-impl Versionable for v6::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
 impl Versionable for v2::registration::FinalMessage {
     fn version(&self) -> AuthenticatorVersion {
         AuthenticatorVersion::V2
@@ -81,12 +75,6 @@ impl Versionable for v5::registration::FinalMessage {
     }
 }
 
-impl Versionable for v6::registration::FinalMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
 impl Versionable for PeerPublicKey {
     fn version(&self) -> AuthenticatorVersion {
         AuthenticatorVersion::V3
@@ -110,158 +98,6 @@ impl Versionable for v5::topup::TopUpMessage {
         AuthenticatorVersion::V5
     }
 }
-impl Versionable for v6::topup::TopUpMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
-impl Versionable for v6::upgrade_mode_check::UpgradeModeCheckRequest {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
-pub trait UpgradeModeStatus: Id + fmt::Debug {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus;
-}
-
-impl UpgradeModeStatus for v1::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v1::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v1::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v2::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v2::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v2::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-impl UpgradeModeStatus for v3::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v3::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v3::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v3::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v6::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::UpgradeModeResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
 
 pub trait InitMessage: Versionable + fmt::Debug {
     fn pub_key(&self) -> PeerPublicKey;
@@ -297,20 +133,14 @@ impl InitMessage for v5::registration::InitMessage {
     }
 }
 
-impl InitMessage for v6::registration::InitMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
-
 pub trait FinalMessage: Versionable + fmt::Debug {
     fn gateway_client_pub_key(&self) -> PeerPublicKey;
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error>;
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
     fn private_ips(&self) -> IpPair;
     fn gateway_client_ipv4(&self) -> Option<Ipv4Addr>;
     fn gateway_client_ipv6(&self) -> Option<Ipv6Addr>;
     fn gateway_client_mac(&self) -> Vec<u8>;
-    fn credential(&self) -> Option<BandwidthClaim>;
+    fn credential(&self) -> Option<CredentialSpendingData>;
 }
 
 impl FinalMessage for v1::GatewayClient {
@@ -318,7 +148,7 @@ impl FinalMessage for v1::GatewayClient {
         self.pub_key
     }
 
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         self.verify(private_key, nonce)
     }
 
@@ -341,7 +171,7 @@ impl FinalMessage for v1::GatewayClient {
         self.mac.to_vec()
     }
 
-    fn credential(&self) -> Option<BandwidthClaim> {
+    fn credential(&self) -> Option<CredentialSpendingData> {
         None
     }
 }
@@ -351,7 +181,7 @@ impl FinalMessage for v2::registration::FinalMessage {
         self.gateway_client.pub_key
     }
 
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         self.gateway_client.verify(private_key, nonce)
     }
 
@@ -374,12 +204,8 @@ impl FinalMessage for v2::registration::FinalMessage {
         self.gateway_client.mac.to_vec()
     }
 
-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
     }
 }
 
@@ -388,7 +214,7 @@ impl FinalMessage for v3::registration::FinalMessage {
         self.gateway_client.pub_key
     }
 
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         self.gateway_client.verify(private_key, nonce)
     }
 
@@ -411,12 +237,8 @@ impl FinalMessage for v3::registration::FinalMessage {
         self.gateway_client.mac.to_vec()
     }
 
-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
     }
 }
 
@@ -425,42 +247,7 @@ impl FinalMessage for v4::registration::FinalMessage {
         self.gateway_client.pub_key
     }
 
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
-        self.gateway_client.verify(private_key, nonce)
-    }
-
-    fn private_ips(&self) -> IpPair {
-        // v4 -> v5 -> v6
-        v5::registration::IpPair::from(self.gateway_client.private_ips).into()
-    }
-
-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        Some(self.gateway_client.private_ips.ipv4)
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        Some(self.gateway_client.private_ips.ipv6)
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.gateway_client.mac.to_vec()
-    }
-
-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
-    }
-}
-
-impl FinalMessage for v5::registration::FinalMessage {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
-        self.gateway_client.pub_key
-    }
-
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         self.gateway_client.verify(private_key, nonce)
     }
 
@@ -480,21 +267,17 @@ impl FinalMessage for v5::registration::FinalMessage {
         self.gateway_client.mac.to_vec()
     }
 
-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
     }
 }
 
-impl FinalMessage for v6::registration::FinalMessage {
+impl FinalMessage for v5::registration::FinalMessage {
     fn gateway_client_pub_key(&self) -> PeerPublicKey {
         self.gateway_client.pub_key
     }
 
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         self.gateway_client.verify(private_key, nonce)
     }
 
@@ -514,7 +297,7 @@ impl FinalMessage for v6::registration::FinalMessage {
         self.gateway_client.mac.to_vec()
     }
 
-    fn credential(&self) -> Option<BandwidthClaim> {
+    fn credential(&self) -> Option<CredentialSpendingData> {
         self.credential.clone()
     }
 }
@@ -564,42 +347,10 @@ impl TopUpMessage for v5::topup::TopUpMessage {
     }
 }
 
-impl TopUpMessage for v6::topup::TopUpMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-
-    fn credential(&self) -> CredentialSpendingData {
-        self.credential.clone()
-    }
-}
-
-pub trait UpgradeModeMessage: Versionable + fmt::Debug {
-    // the idea is to expose different types of emergency credentials here,
-    // like upgrade mode JWT, emergency threshold credential issued by signers, etc.
-    fn upgrade_mode_global_attestation_jwt(&self) -> Option<String>;
-}
-
-impl UpgradeModeMessage for v6::upgrade_mode_check::UpgradeModeCheckRequest {
-    fn upgrade_mode_global_attestation_jwt(&self) -> Option<String> {
-        use v6::upgrade_mode_check::UpgradeModeCheckRequest;
-
-        match self {
-            UpgradeModeCheckRequest::UpgradeModeJwt { token } => Some(token.clone()),
-        }
-    }
-}
-
 pub trait Id {
     fn id(&self) -> u64;
 }
 
-impl Id for v1::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v2::response::PendingRegistrationResponse {
     fn id(&self) -> u64 {
         self.request_id
@@ -624,18 +375,6 @@ impl Id for v5::response::PendingRegistrationResponse {
     }
 }
 
-impl Id for v6::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v1::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v2::response::RegisteredResponse {
     fn id(&self) -> u64 {
         self.request_id
@@ -660,18 +399,6 @@ impl Id for v5::response::RegisteredResponse {
     }
 }
 
-impl Id for v6::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v1::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v2::response::RemainingBandwidthResponse {
     fn id(&self) -> u64 {
         self.request_id
@@ -696,12 +423,6 @@ impl Id for v5::response::RemainingBandwidthResponse {
     }
 }
 
-impl Id for v6::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v3::response::TopUpBandwidthResponse {
     fn id(&self) -> u64 {
         self.request_id
@@ -720,28 +441,11 @@ impl Id for v5::response::TopUpBandwidthResponse {
     }
 }
 
-impl Id for v6::response::TopUpBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v6::response::UpgradeModeResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-pub trait PendingRegistrationResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait PendingRegistrationResponse: Id + fmt::Debug {
     fn nonce(&self) -> u64;
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error>;
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error>;
     fn pub_key(&self) -> PeerPublicKey;
     fn private_ips(&self) -> IpPair;
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync>;
 }
 
 impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
@@ -749,7 +453,7 @@ impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
         self.reply.nonce
     }
 
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
         self.reply.gateway_data.verify(gateway_key, self.nonce())
     }
 
@@ -760,22 +464,6 @@ impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
     fn private_ips(&self) -> IpPair {
         self.reply.gateway_data.private_ip.into()
     }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v2::registration::FinalMessage {
-            gateway_client: v2::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.private_ips().ipv4.into(),
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
 }
 
 impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
@@ -783,7 +471,7 @@ impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
         self.reply.nonce
     }
 
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
         self.reply.gateway_data.verify(gateway_key, self.nonce())
     }
 
@@ -794,22 +482,6 @@ impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
     fn private_ips(&self) -> IpPair {
         self.reply.gateway_data.private_ip.into()
     }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v3::registration::FinalMessage {
-            gateway_client: v3::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.private_ips().ipv4.into(),
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
 }
 
 impl PendingRegistrationResponse for v4::response::PendingRegistrationResponse {
@@ -817,42 +489,7 @@ impl PendingRegistrationResponse for v4::response::PendingRegistrationResponse {
         self.reply.nonce
     }
 
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
-        self.reply.gateway_data.verify(gateway_key, self.nonce())
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.gateway_data.pub_key
-    }
-
-    fn private_ips(&self) -> IpPair {
-        // v4 -> v5 -> v6
-        v5::registration::IpPair::from(self.reply.gateway_data.private_ips).into()
-    }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v4::registration::FinalMessage {
-            gateway_client: v4::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.reply.gateway_data.private_ips,
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
-}
-
-impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
-    fn nonce(&self) -> u64 {
-        self.reply.nonce
-    }
-
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
         self.reply.gateway_data.verify(gateway_key, self.nonce())
     }
 
@@ -863,30 +500,14 @@ impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
     fn private_ips(&self) -> IpPair {
         self.reply.gateway_data.private_ips.into()
     }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v5::registration::FinalMessage {
-            gateway_client: v5::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.reply.gateway_data.private_ips,
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
 }
 
-impl PendingRegistrationResponse for v6::response::PendingRegistrationResponse {
+impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
     fn nonce(&self) -> u64 {
         self.reply.nonce
     }
 
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
         self.reply.gateway_data.verify(gateway_key, self.nonce())
     }
 
@@ -897,25 +518,9 @@ impl PendingRegistrationResponse for v6::response::PendingRegistrationResponse {
     fn private_ips(&self) -> IpPair {
         self.reply.gateway_data.private_ips
     }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v6::registration::FinalMessage {
-            gateway_client: v6::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.reply.gateway_data.private_ips,
-                self.nonce(),
-            ),
-            credential,
-        })
-    }
 }
 
-pub trait RegisteredResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait RegisteredResponse: Id + fmt::Debug {
     fn private_ips(&self) -> IpPair;
     fn pub_key(&self) -> PeerPublicKey;
     fn wg_port(&self) -> u16;
@@ -950,8 +555,7 @@ impl RegisteredResponse for v3::response::RegisteredResponse {
 }
 impl RegisteredResponse for v4::response::RegisteredResponse {
     fn private_ips(&self) -> IpPair {
-        // v4 -> v5 -> v6
-        v5::registration::IpPair::from(self.reply.private_ips).into()
+        self.reply.private_ips.into()
     }
 
     fn pub_key(&self) -> PeerPublicKey {
@@ -964,20 +568,6 @@ impl RegisteredResponse for v4::response::RegisteredResponse {
 }
 
 impl RegisteredResponse for v5::response::RegisteredResponse {
-    fn private_ips(&self) -> IpPair {
-        self.reply.private_ips.into()
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.pub_key
-    }
-
-    fn wg_port(&self) -> u16 {
-        self.reply.wg_port
-    }
-}
-
-impl RegisteredResponse for v6::response::RegisteredResponse {
     fn private_ips(&self) -> IpPair {
         self.reply.private_ips
     }
@@ -991,7 +581,7 @@ impl RegisteredResponse for v6::response::RegisteredResponse {
     }
 }
 
-pub trait RemainingBandwidthResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait RemainingBandwidthResponse: Id + fmt::Debug {
     fn available_bandwidth(&self) -> Option<i64>;
 }
 
@@ -1019,13 +609,7 @@ impl RemainingBandwidthResponse for v5::response::RemainingBandwidthResponse {
     }
 }
 
-impl RemainingBandwidthResponse for v6::response::RemainingBandwidthResponse {
-    fn available_bandwidth(&self) -> Option<i64> {
-        self.reply.as_ref().map(|r| r.available_bandwidth)
-    }
-}
-
-pub trait TopUpBandwidthResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait TopUpBandwidthResponse: Id + fmt::Debug {
     fn available_bandwidth(&self) -> i64;
 }
 
@@ -1046,9 +630,3 @@ impl TopUpBandwidthResponse for v5::response::TopUpBandwidthResponse {
         self.reply.available_bandwidth
     }
 }
-
-impl TopUpBandwidthResponse for v6::response::TopUpBandwidthResponse {
-    fn available_bandwidth(&self) -> i64 {
-        self.reply.available_bandwidth
-    }
-}

common/authenticator-requests/src/v1/registration.rs

@@ -48,7 +48,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ip: IpAddr,
     pub wg_port: u16,

common/authenticator-requests/src/v1/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
 
@@ -34,7 +34,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -108,7 +108,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

common/authenticator-requests/src/v2/conversion.rs

@@ -154,8 +154,8 @@ impl From<v2::registration::RegistrationData> for v1::registration::Registration
     }
 }
 
-impl From<v2::registration::RegisteredData> for v1::registration::RegisteredData {
-    fn from(value: v2::registration::RegisteredData) -> Self {
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ip,

common/authenticator-requests/src/v2/registration.rs

@@ -58,7 +58,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ip: IpAddr,
     pub wg_port: u16,

common/authenticator-requests/src/v2/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -118,7 +118,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v3/conversion.rs

@@ -299,8 +299,8 @@ impl From<v2::registration::RegistrationData> for v3::registration::Registration
     }
 }
 
-impl From<v3::registration::RegisteredData> for v2::registration::RegisteredData {
-    fn from(value: v3::registration::RegisteredData) -> Self {
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ip,
@@ -309,8 +309,8 @@ impl From<v3::registration::RegisteredData> for v2::registration::RegisteredData
     }
 }
 
-impl From<v2::registration::RegisteredData> for v3::registration::RegisteredData {
-    fn from(value: v2::registration::RegisteredData) -> Self {
+impl From<v2::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ip,
@@ -674,7 +674,7 @@ mod tests {
         let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
         let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
         let wg_port = 51822;
-        let registred_data = v2::registration::RegisteredData {
+        let registred_data = v2::registration::RegistredData {
             pub_key,
             private_ip,
             wg_port,
@@ -701,7 +701,7 @@ mod tests {
             v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v3::registration::RegisteredData {
+                reply: v3::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ip
@@ -715,7 +715,7 @@ mod tests {
         let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
         let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
         let wg_port = 51822;
-        let registred_data = v3::registration::RegisteredData {
+        let registred_data = v3::registration::RegistredData {
             pub_key,
             private_ip,
             wg_port,
@@ -742,7 +742,7 @@ mod tests {
             v2::response::AuthenticatorResponseData::Registered(v2::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v2::registration::RegisteredData {
+                reply: v2::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ip

common/authenticator-requests/src/v3/registration.rs

@@ -58,7 +58,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ip: IpAddr,
     pub wg_port: u16,

common/authenticator-requests/src/v3/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -139,7 +139,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v4/conversion.rs

@@ -262,8 +262,8 @@ impl From<v4::response::TopUpBandwidthResponse> for v3::response::TopUpBandwidth
     }
 }
 
-impl From<v3::registration::RegisteredData> for v4::registration::RegisteredData {
-    fn from(value: v3::registration::RegisteredData) -> Self {
+impl From<v3::registration::RegistredData> for v4::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ips: value.private_ip.into(),
@@ -272,8 +272,8 @@ impl From<v3::registration::RegisteredData> for v4::registration::RegisteredData
     }
 }
 
-impl From<v4::registration::RegisteredData> for v3::registration::RegisteredData {
-    fn from(value: v4::registration::RegisteredData) -> Self {
+impl From<v4::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ips.ipv4.into(),
@@ -565,7 +565,7 @@ mod tests {
         let private_ips =
             v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::a0a").unwrap());
         let wg_port = 51822;
-        let registred_data = v3::registration::RegisteredData {
+        let registred_data = v3::registration::RegistredData {
             pub_key,
             private_ip: ipv4.into(),
             wg_port,
@@ -592,7 +592,7 @@ mod tests {
             v4::response::AuthenticatorResponseData::Registered(v4::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v4::registration::RegisteredData {
+                reply: v4::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ips
@@ -608,7 +608,7 @@ mod tests {
         let private_ips =
             v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::10").unwrap());
         let wg_port = 51822;
-        let registred_data = v4::registration::RegisteredData {
+        let registred_data = v4::registration::RegistredData {
             pub_key,
             private_ips,
             wg_port,
@@ -635,7 +635,7 @@ mod tests {
             v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v3::registration::RegisteredData {
+                reply: v3::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ip: ipv4.into()

common/authenticator-requests/src/v4/registration.rs

@@ -110,7 +110,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ips: IpPair,
     pub wg_port: u16,

common/authenticator-requests/src/v4/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -139,7 +139,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v5/conversion.rs

@@ -186,8 +186,8 @@ impl From<v4::response::TopUpBandwidthResponse> for v5::response::TopUpBandwidth
     }
 }
 
-impl From<v4::registration::RegisteredData> for v5::registration::RegisteredData {
-    fn from(value: v4::registration::RegisteredData) -> Self {
+impl From<v4::registration::RegistredData> for v5::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ips: value.private_ips.into(),
@@ -405,7 +405,7 @@ mod tests {
         let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
         let private_ips = v4::registration::IpPair::new(ipv4, ipv6);
         let wg_port = 51822;
-        let registred_data = v4::registration::RegisteredData {
+        let registred_data = v4::registration::RegistredData {
             pub_key,
             private_ips,
             wg_port,
@@ -431,7 +431,7 @@ mod tests {
             upgraded_msg.data,
             v5::response::AuthenticatorResponseData::Registered(v5::response::RegisteredResponse {
                 request_id,
-                reply: v5::registration::RegisteredData {
+                reply: v5::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ips: v5::registration::IpPair::new(ipv4, ipv6)

common/authenticator-requests/src/v5/registration.rs

@@ -108,7 +108,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ips: IpPair,
     pub wg_port: u16,

common/authenticator-requests/src/v5/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use serde::{Deserialize, Serialize};
 
@@ -32,7 +32,7 @@ impl AuthenticatorResponse {
         }
     }
 
-    pub fn new_registered(registred_data: RegisteredData, request_id: u64) -> Self {
+    pub fn new_registered(registred_data: RegistredData, request_id: u64) -> Self {
         Self {
             protocol: Protocol {
                 service_provider_type: ServiceProviderType::Authenticator,
@@ -116,7 +116,7 @@ pub struct PendingRegistrationResponse {
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RegisteredResponse {
     pub request_id: u64,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v6/conversion.rs

@@ -1,441 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::{v5, v6};
-
-impl TryFrom<v5::request::AuthenticatorRequest> for v6::request::AuthenticatorRequest {
-    type Error = crate::Error;
-
-    fn try_from(
-        authenticator_request: v5::request::AuthenticatorRequest,
-    ) -> Result<Self, Self::Error> {
-        Ok(Self {
-            protocol: v6::PROTOCOL,
-            data: authenticator_request.data.try_into()?,
-            request_id: authenticator_request.request_id,
-        })
-    }
-}
-
-impl TryFrom<v5::request::AuthenticatorRequestData> for v6::request::AuthenticatorRequestData {
-    type Error = crate::Error;
-
-    fn try_from(
-        authenticator_request_data: v5::request::AuthenticatorRequestData,
-    ) -> Result<Self, Self::Error> {
-        match authenticator_request_data {
-            v5::request::AuthenticatorRequestData::Initial(init_msg) => Ok(
-                v6::request::AuthenticatorRequestData::Initial(init_msg.into()),
-            ),
-            v5::request::AuthenticatorRequestData::Final(final_msg) => Ok(
-                v6::request::AuthenticatorRequestData::Final(Box::new((*final_msg).try_into()?)),
-            ),
-            v5::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => Ok(
-                v6::request::AuthenticatorRequestData::QueryBandwidth(pub_key),
-            ),
-            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => Ok(
-                v6::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into()),
-            ),
-        }
-    }
-}
-
-impl From<v5::registration::InitMessage> for v6::registration::InitMessage {
-    fn from(init_msg: v5::registration::InitMessage) -> Self {
-        Self {
-            pub_key: init_msg.pub_key,
-        }
-    }
-}
-
-impl TryFrom<v5::registration::FinalMessage> for v6::registration::FinalMessage {
-    type Error = crate::Error;
-
-    fn try_from(final_msg: v5::registration::FinalMessage) -> Result<Self, Self::Error> {
-        Ok(Self {
-            gateway_client: final_msg.gateway_client.into(),
-            credential: final_msg
-                .credential
-                .map(TryInto::try_into)
-                .transpose()
-                .map_err(Self::Error::conversion_display)?,
-        })
-    }
-}
-
-impl From<v5::registration::GatewayClient> for v6::registration::GatewayClient {
-    fn from(gateway_client: v5::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gateway_client.pub_key,
-            private_ips: gateway_client.private_ips.into(),
-            mac: gateway_client.mac.into(),
-        }
-    }
-}
-
-impl From<v6::registration::GatewayClient> for v5::registration::GatewayClient {
-    fn from(gateway_client: v6::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gateway_client.pub_key,
-            private_ips: gateway_client.private_ips.into(),
-            mac: gateway_client.mac.into(),
-        }
-    }
-}
-
-impl From<v5::registration::ClientMac> for v6::registration::ClientMac {
-    fn from(client_mac: v5::registration::ClientMac) -> Self {
-        Self::new((*client_mac).clone())
-    }
-}
-
-impl From<v6::registration::ClientMac> for v5::registration::ClientMac {
-    fn from(client_mac: v6::registration::ClientMac) -> Self {
-        Self::new((*client_mac).clone())
-    }
-}
-
-impl From<Box<v5::topup::TopUpMessage>> for Box<v6::topup::TopUpMessage> {
-    fn from(top_up_message: Box<v5::topup::TopUpMessage>) -> Self {
-        Box::new(v6::topup::TopUpMessage {
-            pub_key: top_up_message.pub_key,
-            credential: top_up_message.credential,
-        })
-    }
-}
-
-impl From<v5::response::AuthenticatorResponse> for v6::response::AuthenticatorResponse {
-    fn from(value: v5::response::AuthenticatorResponse) -> Self {
-        Self {
-            protocol: v6::PROTOCOL,
-            data: value.data.into(),
-        }
-    }
-}
-
-impl From<v5::response::AuthenticatorResponseData> for v6::response::AuthenticatorResponseData {
-    fn from(authenticator_response_data: v5::response::AuthenticatorResponseData) -> Self {
-        match authenticator_response_data {
-            v5::response::AuthenticatorResponseData::PendingRegistration(pending_response) => {
-                v6::response::AuthenticatorResponseData::PendingRegistration(
-                    pending_response.into(),
-                )
-            }
-            v5::response::AuthenticatorResponseData::Registered(registered_response) => {
-                v6::response::AuthenticatorResponseData::Registered(registered_response.into())
-            }
-            v5::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response.into(),
-            ),
-            v5::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response) => {
-                v6::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response.into())
-            }
-        }
-    }
-}
-
-impl From<v5::response::RegisteredResponse> for v6::response::RegisteredResponse {
-    fn from(value: v5::response::RegisteredResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::response::PendingRegistrationResponse> for v6::response::PendingRegistrationResponse {
-    fn from(value: v5::response::PendingRegistrationResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::registration::RegistrationData> for v6::registration::RegistrationData {
-    fn from(value: v5::registration::RegistrationData) -> Self {
-        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v6::registration::RegistrationData> for v5::registration::RegistrationData {
-    fn from(value: v6::registration::RegistrationData) -> Self {
-        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v5::response::RemainingBandwidthResponse> for v6::response::RemainingBandwidthResponse {
-    fn from(value: v5::response::RemainingBandwidthResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.map(Into::into),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::response::TopUpBandwidthResponse> for v6::response::TopUpBandwidthResponse {
-    fn from(value: v5::response::TopUpBandwidthResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::registration::RegisteredData> for v6::registration::RegisteredData {
-    fn from(value: v5::registration::RegisteredData) -> Self {
-        Self {
-            pub_key: value.pub_key,
-            private_ips: value.private_ips.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v5::registration::RemainingBandwidthData> for v6::registration::RemainingBandwidthData {
-    fn from(value: v5::registration::RemainingBandwidthData) -> Self {
-        Self {
-            available_bandwidth: value.available_bandwidth,
-        }
-    }
-}
-
-impl From<v5::registration::IpPair> for v6::registration::IpPair {
-    fn from(value: v5::registration::IpPair) -> Self {
-        Self {
-            ipv4: value.ipv4,
-            ipv6: value.ipv6,
-        }
-    }
-}
-
-impl From<v6::registration::IpPair> for v5::registration::IpPair {
-    fn from(value: v6::registration::IpPair) -> Self {
-        Self {
-            ipv4: value.ipv4,
-            ipv6: value.ipv6,
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        net::{Ipv4Addr, Ipv6Addr},
-        str::FromStr,
-    };
-
-    use nym_credentials_interface::{BandwidthCredential, CredentialSpendingData, TicketType};
-    use nym_crypto::asymmetric::x25519::PrivateKey;
-    use nym_wireguard_types::PeerPublicKey;
-    use x25519_dalek::PublicKey;
-
-    use super::*;
-    use crate::models::BandwidthClaim;
-    use crate::{util::tests::CREDENTIAL_BYTES, v5};
-
-    #[test]
-    fn upgrade_initial_req() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-
-        let (msg, _) = v5::request::AuthenticatorRequest::new_initial_request(
-            v5::registration::InitMessage::new(pub_key),
-        );
-        let upgraded_msg = v6::request::AuthenticatorRequest::try_from(msg).unwrap();
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::request::AuthenticatorRequestData::Initial(v6::registration::InitMessage {
-                pub_key
-            })
-        );
-    }
-
-    #[test]
-    fn upgrade_final_req() {
-        let mut rng = rand::thread_rng();
-
-        let local_secret = PrivateKey::new(&mut rng);
-        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
-        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let ips = v5::registration::IpPair::new(ipv4, ipv6);
-        let nonce = 42;
-        let gateway_client = v5::registration::GatewayClient::new(
-            &local_secret,
-            (&remote_secret).into(),
-            ips,
-            nonce,
-        );
-        let credential = CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap();
-        let final_message = v5::registration::FinalMessage {
-            gateway_client: gateway_client.clone(),
-            credential: Some(credential.clone()),
-        };
-
-        let (msg, _) = v5::request::AuthenticatorRequest::new_final_request(final_message);
-        let upgraded_msg = v6::request::AuthenticatorRequest::try_from(msg).unwrap();
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::request::AuthenticatorRequestData::Final(Box::new(
-                v6::registration::FinalMessage {
-                    gateway_client: v6::registration::GatewayClient::new(
-                        &local_secret,
-                        (&remote_secret).into(),
-                        v6::registration::IpPair::new(ipv4, ipv6),
-                        nonce
-                    ),
-                    credential: Some(BandwidthClaim {
-                        credential: BandwidthCredential::ZkNym(Box::new(credential)),
-                        kind: TicketType::V1MixnetEntry,
-                    })
-                }
-            ))
-        );
-    }
-
-    #[test]
-    fn upgrade_query_req() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-
-        let (msg, _) = v5::request::AuthenticatorRequest::new_query_request(pub_key);
-        let upgraded_msg = v6::request::AuthenticatorRequest::try_from(msg).unwrap();
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
-        );
-    }
-
-    #[test]
-    fn upgrade_pending_reg_resp() {
-        let mut rng = rand::thread_rng();
-
-        let local_secret = PrivateKey::new(&mut rng);
-        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
-        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let ips = v5::registration::IpPair::new(ipv4, ipv6);
-        let nonce = 42;
-        let wg_port = 51822;
-        let gateway_data = v5::registration::GatewayClient::new(
-            &local_secret,
-            (&remote_secret).into(),
-            ips,
-            nonce,
-        );
-        let registration_data = v5::registration::RegistrationData {
-            nonce,
-            gateway_data,
-            wg_port,
-        };
-        let request_id = 123;
-
-        let msg = v5::response::AuthenticatorResponse::new_pending_registration_success(
-            registration_data,
-            request_id,
-        );
-        let upgraded_msg = v6::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-
-        assert_eq!(
-            upgraded_msg.data,
-            v6::response::AuthenticatorResponseData::PendingRegistration(
-                v6::response::PendingRegistrationResponse {
-                    request_id,
-                    reply: v6::registration::RegistrationData {
-                        nonce,
-                        gateway_data: v6::registration::GatewayClient::new(
-                            &local_secret,
-                            (&remote_secret).into(),
-                            v6::registration::IpPair::new(ipv4, ipv6),
-                            nonce
-                        ),
-                        wg_port
-                    },
-                    upgrade_mode_enabled: false,
-                }
-            )
-        );
-    }
-
-    #[test]
-    fn upgrade_registered_resp() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-        let ipv4 = Ipv4Addr::from_str("10.1.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let private_ips = v5::registration::IpPair::new(ipv4, ipv6);
-        let wg_port = 51822;
-        let registered_data = v5::registration::RegisteredData {
-            pub_key,
-            private_ips,
-            wg_port,
-        };
-        let request_id = 123;
-
-        let msg = v5::response::AuthenticatorResponse::new_registered(registered_data, request_id);
-        let upgraded_msg = v6::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::response::AuthenticatorResponseData::Registered(v6::response::RegisteredResponse {
-                request_id,
-                reply: v6::registration::RegisteredData {
-                    wg_port,
-                    pub_key,
-                    private_ips: v6::registration::IpPair::new(ipv4, ipv6)
-                },
-                upgrade_mode_enabled: false,
-            })
-        );
-    }
-
-    #[test]
-    fn upgrade_remaining_bandwidth_resp() {
-        let available_bandwidth = 42;
-        let remaining_bandwidth_data = Some(v5::registration::RemainingBandwidthData {
-            available_bandwidth,
-        });
-        let request_id = 123;
-
-        let msg = v5::response::AuthenticatorResponse::new_remaining_bandwidth(
-            remaining_bandwidth_data,
-            request_id,
-        );
-        let upgraded_msg = v6::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                v6::response::RemainingBandwidthResponse {
-                    request_id,
-                    reply: Some(v6::registration::RemainingBandwidthData {
-                        available_bandwidth,
-                    }),
-                    upgrade_mode_enabled: false,
-                }
-            )
-        );
-    }
-}

common/authenticator-requests/src/v6/mod.rs

@@ -1,15 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-
-pub mod conversion;
-pub mod registration;
-pub mod request;
-pub mod response;
-pub mod topup;
-pub mod upgrade_mode_check;
-
-pub const VERSION: u8 = 6;
-
-pub const PROTOCOL: Protocol = Protocol::new(VERSION, ServiceProviderType::Authenticator);

common/authenticator-requests/src/v6/registration.rs

@@ -1,287 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::error::Error;
-use crate::models::BandwidthClaim;
-use base64::{Engine, engine::general_purpose};
-use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-use std::time::SystemTime;
-use std::{fmt, ops::Deref, str::FromStr};
-
-#[cfg(feature = "verify")]
-use hmac::{Hmac, Mac};
-#[cfg(feature = "verify")]
-use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
-#[cfg(feature = "verify")]
-use sha2::Sha256;
-
-pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
-pub type PrivateIPs = HashMap<IpPair, Taken>;
-
-#[cfg(feature = "verify")]
-pub type HmacSha256 = Hmac<Sha256>;
-
-pub type Nonce = u64;
-pub type Taken = Option<SystemTime>;
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct IpPair {
-    pub ipv4: Ipv4Addr,
-    pub ipv6: Ipv6Addr,
-}
-
-impl IpPair {
-    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
-        IpPair { ipv4, ipv6 }
-    }
-}
-
-impl From<(Ipv4Addr, Ipv6Addr)> for IpPair {
-    fn from((ipv4, ipv6): (Ipv4Addr, Ipv6Addr)) -> Self {
-        IpPair { ipv4, ipv6 }
-    }
-}
-
-impl fmt::Display for IpPair {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "({}, {})", self.ipv4, self.ipv6)
-    }
-}
-
-impl From<IpAddr> for IpPair {
-    fn from(value: IpAddr) -> Self {
-        let (before_last_byte, last_byte) = match value {
-            IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
-            IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
-        };
-        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
-        let ipv4 = Ipv4Addr::new(
-            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
-            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
-            before_last_byte,
-            last_byte,
-        );
-        let ipv6 = Ipv6Addr::new(
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
-            last_bytes,
-        );
-        IpPair::new(ipv4, ipv6)
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct InitMessage {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-}
-
-impl InitMessage {
-    pub fn new(pub_key: PeerPublicKey) -> Self {
-        InitMessage { pub_key }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct FinalMessage {
-    /// Gateway client data
-    pub gateway_client: GatewayClient,
-
-    /// Ecash credential
-    pub credential: Option<BandwidthClaim>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegistrationData {
-    pub nonce: u64,
-    pub gateway_data: GatewayClient,
-    pub wg_port: u16,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
-    pub pub_key: PeerPublicKey,
-    pub private_ips: IpPair,
-    pub wg_port: u16,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RemainingBandwidthData {
-    pub available_bandwidth: i64,
-}
-
-/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
-/// Gateway/Nym node can then verify pub_key payload using the same process
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct GatewayClient {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-
-    /// Assigned private IPs (v4 and v6)
-    pub private_ips: IpPair,
-
-    /// Sha256 hmac on the data (alongside the prior nonce)
-    pub mac: ClientMac,
-}
-
-impl GatewayClient {
-    #[cfg(feature = "verify")]
-    pub fn new(
-        local_secret: &PrivateKey,
-        remote_public: x25519_dalek::PublicKey,
-        private_ips: IpPair,
-        nonce: u64,
-    ) -> Self {
-        let local_public = PublicKey::from(local_secret);
-        let remote_public = PublicKey::from(remote_public);
-
-        let dh = local_secret.diffie_hellman(&remote_public);
-
-        // TODO: change that to use our nym_crypto::hmac module instead
-        #[allow(clippy::expect_used)]
-        let mut mac = HmacSha256::new_from_slice(&dh[..])
-            .expect("x25519 shared secret is always 32 bytes long");
-
-        mac.update(local_public.as_bytes());
-        mac.update(private_ips.to_string().as_bytes());
-        mac.update(&nonce.to_le_bytes());
-
-        GatewayClient {
-            pub_key: PeerPublicKey::new(local_public.into()),
-            private_ips,
-            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
-        }
-    }
-
-    // Reusable secret should be gateways Wireguard PK
-    // Client should perform this step when generating its payload, using its own WG PK
-    #[cfg(feature = "verify")]
-    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
-        // use gateways key as a ref to an x25519_dalek key
-        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
-
-        // TODO: change that to use our nym_crypto::hmac module instead
-        #[allow(clippy::expect_used)]
-        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
-            .expect("x25519 shared secret is always 32 bytes long");
-
-        mac.update(self.pub_key.as_bytes());
-        mac.update(self.private_ips.to_string().as_bytes());
-        mac.update(&nonce.to_le_bytes());
-
-        mac.verify_slice(&self.mac)
-            .map_err(|source| Error::FailedClientMacVerification {
-                client: self.pub_key.to_string(),
-                source,
-            })
-    }
-
-    pub fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
-
-// TODO: change the inner type into generic array of size HmacSha256::OutputSize
-// TODO2: rely on our internal crypto/hmac
-#[derive(Debug, Clone, PartialEq)]
-pub struct ClientMac(Vec<u8>);
-
-impl fmt::Display for ClientMac {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
-    }
-}
-
-impl From<Vec<u8>> for ClientMac {
-    fn from(v: Vec<u8>) -> Self {
-        ClientMac(v)
-    }
-}
-
-impl ClientMac {
-    #[allow(dead_code)]
-    pub fn new(mac: Vec<u8>) -> Self {
-        ClientMac(mac)
-    }
-}
-
-impl Deref for ClientMac {
-    type Target = Vec<u8>;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl FromStr for ClientMac {
-    type Err = Error;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        let mac_bytes: Vec<u8> =
-            general_purpose::STANDARD
-                .decode(s)
-                .map_err(|source| Error::MalformedClientMac {
-                    mac: s.to_string(),
-                    source,
-                })?;
-
-        Ok(ClientMac(mac_bytes))
-    }
-}
-
-impl Serialize for ClientMac {
-    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
-        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
-        serializer.serialize_str(&encoded_key)
-    }
-}
-
-impl<'de> Deserialize<'de> for ClientMac {
-    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
-        let encoded_key = String::deserialize(deserializer)?;
-        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use nym_crypto::asymmetric::x25519;
-    use nym_test_utils::helpers::deterministic_rng;
-
-    #[test]
-    fn create_ip_pair() {
-        let ipv4: IpAddr = Ipv4Addr::from_str("10.1.10.50").unwrap().into();
-        let ipv6: IpAddr = Ipv6Addr::from_str("fc01::0a32").unwrap().into();
-
-        assert_eq!(IpPair::from(ipv4), IpPair::from(ipv6));
-    }
-
-    #[test]
-    #[cfg(feature = "verify")]
-    fn client_request_roundtrip() {
-        let mut rng = deterministic_rng();
-
-        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
-        let client_key_pair = x25519::KeyPair::new(&mut rng);
-
-        let nonce = 1234567890;
-
-        let client = GatewayClient::new(
-            client_key_pair.private_key(),
-            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
-            IpPair::new("10.0.0.42".parse().unwrap(), "fc00::42".parse().unwrap()),
-            nonce,
-        );
-        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
-    }
-}

common/authenticator-requests/src/v6/request.rs

@@ -1,135 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::{
-    PROTOCOL,
-    registration::{FinalMessage, InitMessage},
-    topup::TopUpMessage,
-    upgrade_mode_check::UpgradeModeCheckRequest,
-};
-use nym_service_provider_requests_common::Protocol;
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-
-use crate::make_bincode_serializer;
-
-fn generate_random() -> u64 {
-    use rand::RngCore;
-    let mut rng = rand::rngs::OsRng;
-    rng.next_u64()
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct AuthenticatorRequest {
-    pub protocol: Protocol,
-    pub data: AuthenticatorRequestData,
-    pub request_id: u64,
-}
-
-impl AuthenticatorRequest {
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-
-    pub fn new_initial_request(init_message: InitMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::Initial(init_message),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_final_request(final_message: FinalMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::Final(Box::new(final_message)),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_query_request(peer_public_key: PeerPublicKey) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_topup_request(top_up_message: TopUpMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_upgrade_mode_check_request(message: UpgradeModeCheckRequest) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::CheckUpgradeMode(message),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum AuthenticatorRequestData {
-    Initial(InitMessage),
-    Final(Box<FinalMessage>),
-    QueryBandwidth(PeerPublicKey),
-    TopUpBandwidth(Box<TopUpMessage>),
-    CheckUpgradeMode(UpgradeModeCheckRequest),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::VERSION;
-    use super::*;
-    use nym_service_provider_requests_common::ServiceProviderType;
-    use std::str::FromStr;
-
-    #[test]
-    fn check_first_bytes_protocol() {
-        let version = VERSION;
-        let data = AuthenticatorRequest {
-            protocol: Protocol {
-                version,
-                service_provider_type: ServiceProviderType::Authenticator,
-            },
-            data: AuthenticatorRequestData::Initial(InitMessage::new(
-                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
-            )),
-            request_id: 1,
-        };
-        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
-        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
-    }
-}

common/authenticator-requests/src/v6/response.rs

@@ -1,153 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
-use nym_service_provider_requests_common::Protocol;
-use serde::{Deserialize, Serialize};
-
-use crate::make_bincode_serializer;
-
-use super::PROTOCOL;
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct AuthenticatorResponse {
-    pub protocol: Protocol,
-    pub data: AuthenticatorResponseData,
-}
-
-impl AuthenticatorResponse {
-    pub fn new_pending_registration_success(
-        registration_data: RegistrationData,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
-                reply: registration_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_registered(
-        registered_data: RegisteredData,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::Registered(RegisteredResponse {
-                reply: registered_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_remaining_bandwidth(
-        remaining_bandwidth_data: Option<RemainingBandwidthData>,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
-                reply: remaining_bandwidth_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_topup_bandwidth(
-        remaining_bandwidth_data: RemainingBandwidthData,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
-                reply: remaining_bandwidth_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_upgrade_mode_check(request_id: u64, upgrade_mode_enabled: bool) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::UpgradeMode(UpgradeModeResponse {
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
-            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
-            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
-            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
-            AuthenticatorResponseData::UpgradeMode(response) => Some(response.request_id),
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum AuthenticatorResponseData {
-    PendingRegistration(PendingRegistrationResponse),
-    Registered(RegisteredResponse),
-    RemainingBandwidth(RemainingBandwidthResponse),
-    TopUpBandwidth(TopUpBandwidthResponse),
-    UpgradeMode(UpgradeModeResponse),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct PendingRegistrationResponse {
-    pub request_id: u64,
-    pub reply: RegistrationData,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct RegisteredResponse {
-    pub request_id: u64,
-    pub reply: RegisteredData,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct RemainingBandwidthResponse {
-    pub request_id: u64,
-    pub reply: Option<RemainingBandwidthData>,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct TopUpBandwidthResponse {
-    pub request_id: u64,
-    pub reply: RemainingBandwidthData,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct UpgradeModeResponse {
-    pub request_id: u64,
-    pub upgrade_mode_enabled: bool,
-}

common/authenticator-requests/src/v6/topup.rs

@@ -1,15 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials_interface::CredentialSpendingData;
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct TopUpMessage {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-
-    /// Ecash credential
-    pub credential: CredentialSpendingData,
-}

common/authenticator-requests/src/v6/upgrade_mode_check.rs

@@ -1,12 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub enum UpgradeModeCheckRequest {
-    /// Attempt to request upgrade mode recheck via the JWT issued as the result of
-    /// global attestation.json being published
-    UpgradeModeJwt { token: String },
-}

common/authenticator-requests/src/version.rs

@@ -1,7 +1,7 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::{v1, v2, v3, v4, v5, v6};
+use super::{v1, v2, v3, v4, v5};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 
 #[derive(Copy, Clone, Debug, PartialEq, strum_macros::Display)]
@@ -22,15 +22,11 @@ pub enum AuthenticatorVersion {
     /// introduced in dorina-patched release (1.6.1)
     V5,
 
-    /// introduced in niolo release (1.23.0)
-    V6,
-
-    /// an unknown, future, variant that can be present if running outdated software
     UNKNOWN,
 }
 
 impl AuthenticatorVersion {
-    pub const LATEST: Self = Self::V6;
+    pub const LATEST: Self = Self::V5;
 
     pub const fn release_version(&self) -> semver::Version {
         match self {
@@ -39,7 +35,6 @@ impl AuthenticatorVersion {
             AuthenticatorVersion::V3 => semver::Version::new(1, 1, 10),
             AuthenticatorVersion::V4 => semver::Version::new(1, 2, 0),
             AuthenticatorVersion::V5 => semver::Version::new(1, 6, 1),
-            AuthenticatorVersion::V6 => semver::Version::new(1, 23, 0),
             AuthenticatorVersion::UNKNOWN => semver::Version::new(0, 0, 0),
         }
     }
@@ -59,8 +54,6 @@ impl From<Protocol> for AuthenticatorVersion {
             AuthenticatorVersion::V4
         } else if value.version == v5::VERSION {
             AuthenticatorVersion::V5
-        } else if value.version == v6::VERSION {
-            AuthenticatorVersion::V6
         } else {
             AuthenticatorVersion::UNKNOWN
         }
@@ -79,8 +72,6 @@ impl From<u8> for AuthenticatorVersion {
             AuthenticatorVersion::V4
         } else if value == v5::VERSION {
             AuthenticatorVersion::V5
-        } else if value == v6::VERSION {
-            AuthenticatorVersion::V6
         } else {
             AuthenticatorVersion::UNKNOWN
         }
@@ -135,14 +126,11 @@ impl From<semver::Version> for AuthenticatorVersion {
         if semver < AuthenticatorVersion::V5.release_version() {
             return Self::V4;
         }
-        if semver < AuthenticatorVersion::V6.release_version() {
-            return Self::V5;
-        }
-        // if provided version is higher (or equal) to release version of V6,
-        // we return the latest (i.e. v6)
+        // if provided version is higher (or equal) to release version of V5,
+        // we return the latest (i.e. v5)
 
         debug_assert_eq!(
-            Self::V6,
+            Self::V5,
             Self::LATEST,
             "a new AuthenticatorVersion variant has been introduced without adjusting the `From<semver::Version>` trait"
         );
@@ -203,9 +191,5 @@ mod tests {
         assert_eq!(AuthenticatorVersion::V5, "1.7.0".into());
         assert_eq!(AuthenticatorVersion::V5, "1.16.11".into());
         assert_eq!(AuthenticatorVersion::V5, "1.17.0".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.22.0".into());
-        assert_eq!(AuthenticatorVersion::V6, "1.23.0".into());
-        assert_eq!(AuthenticatorVersion::V6, "1.23.1".into());
-        assert_eq!(AuthenticatorVersion::V6, "1.24.0".into());
     }
 }

common/bandwidth-controller/Cargo.toml

@@ -7,16 +7,21 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-async-trait = { workspace = true }
+async-trait = { workspace =  true }
+bip39 = { workspace = true }
 log = { workspace = true }
 rand = { workspace = true }
 thiserror = { workspace = true }
+url = { workspace = true }
+zeroize = { workspace = true }
 
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
 nym-ecash-time = { path = "../ecash-time" }
+nym-network-defaults = { path = "../network-defaults" }
 nym-task = { path = "../task" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 

common/bandwidth-controller/src/error.rs

@@ -21,9 +21,6 @@ pub enum BandwidthControllerError {
     #[error("There was a credential storage error - {0}")]
     CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
 
-    #[error("retrieved upgrade mode token is not a valid String")]
-    MalformedUpgradeModeToken,
-
     #[error("the credential storage does not contain any usable credentials")]
     NoCredentialsAvailable,
 

common/bandwidth-controller/src/lib.rs

@@ -12,7 +12,7 @@ use crate::utils::{
     ApiClientsWrapper,
 };
 use log::error;
-use nym_credential_storage::models::{EmergencyCredential, RetrievedTicketbook};
+use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::CredentialSpendingData;
 use nym_credentials_interface::{
@@ -220,19 +220,6 @@ impl<C, St: Storage> BandwidthController<C, St> {
             }
         }
     }
-
-    pub async fn get_emergency_credential(
-        &self,
-        typ: &str,
-    ) -> Result<Option<EmergencyCredential>, BandwidthControllerError>
-    where
-        <St as Storage>::StorageError: Send + Sync + 'static,
-    {
-        self.storage
-            .get_emergency_credential(typ)
-            .await
-            .map_err(BandwidthControllerError::credential_storage_error)
-    }
 }
 
 impl<C, St> Clone for BandwidthController<C, St>

common/bandwidth-controller/src/traits.rs

@@ -11,9 +11,6 @@ use crate::{error::BandwidthControllerError, BandwidthController, PreparedCreden
 
 pub const DEFAULT_TICKETS_TO_SPEND: u32 = 1;
 
-// TODO: this does not really belong here
-pub const UPGRADE_MODE_JWT_TYPE: &str = "UPGRADE_MODE_JWT";
-
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait BandwidthTicketProvider: Send + Sync {
@@ -23,8 +20,6 @@ pub trait BandwidthTicketProvider: Send + Sync {
         gateway_id: ed25519::PublicKey,
         tickets_to_spend: u32,
     ) -> Result<PreparedCredential, BandwidthControllerError>;
-
-    async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError>;
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -44,16 +39,4 @@ where
         self.prepare_ecash_ticket(ticket_type, gateway_id.to_bytes(), tickets_to_spend)
             .await
     }
-
-    async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError> {
-        let Some(emergency_credential) =
-            self.get_emergency_credential(UPGRADE_MODE_JWT_TYPE).await?
-        else {
-            return Ok(None);
-        };
-        // upgrade mode credential is just a simple stringified JWT
-        let token = String::from_utf8(emergency_credential.data.content)
-            .map_err(|_| BandwidthControllerError::MalformedUpgradeModeToken)?;
-        Ok(Some(token))
-    }
 }

common/client-core/gateways-storage/.sqlx/query-06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32.json

@@ -6,14 +6,14 @@
       {
         "name": "exists",
         "ordinal": 0,
-        "type_info": "Integer"
+        "type_info": "Int"
       }
     ],
     "parameters": {
       "Right": 1
     },
     "nullable": [
-      false
+      null
     ]
   },
   "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"

common/client-core/gateways-storage/.sqlx/query-0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985.json

@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}

common/client-core/gateways-storage/.sqlx/query-0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}

common/client-core/gateways-storage/.sqlx/query-4b739e12ea8d917cb17580337caeabb05f0e3ddbec04fdfa111d0fc86ba75505.json

@@ -1,38 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT\n                rgd.gateway_id_bs58,\n                derived_aes256_gcm_siv_key,\n                gateway_listener,\n                fallback_listener\n            FROM\n                remote_gateway_details AS rgd\n            INNER JOIN\n                remote_gateway_shared_keys AS rgsk\n            ON\n                rgd.gateway_id_bs58 = rgsk.gateway_id_bs58\n            WHERE\n                rgd.gateway_id_bs58 = ?",
-  "describe": {
-    "columns": [
-      {
-        "name": "gateway_id_bs58",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "derived_aes256_gcm_siv_key",
-        "ordinal": 1,
-        "type_info": "Blob"
-      },
-      {
-        "name": "gateway_listener",
-        "ordinal": 2,
-        "type_info": "Text"
-      },
-      {
-        "name": "fallback_listener",
-        "ordinal": 3,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "4b739e12ea8d917cb17580337caeabb05f0e3ddbec04fdfa111d0fc86ba75505"
-}

common/client-core/gateways-storage/.sqlx/query-700a75acbcd90c74baa7823c40739a8ff8a26400c1d2bd45a689970bf1ba0e66.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                INSERT INTO remote_gateway_shared_keys(gateway_id_bs58, derived_aes256_gcm_siv_key)\n                VALUES (?, ?)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "700a75acbcd90c74baa7823c40739a8ff8a26400c1d2bd45a689970bf1ba0e66"
-}

common/client-core/gateways-storage/.sqlx/query-8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e.json

@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type)\n                VALUES (?, ?, ?)\n            ",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "727598e516090da6d26e36d09062b60ccb76d6468f359891428c0bfb96ddd7ef"
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
 }

common/client-core/gateways-storage/.sqlx/query-a64a557ba87d4b2c7457857afa7ebc7d4f895fc4991da18ec02c9e250bea0fe0.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, gateway_listener, fallback_listener)\n                VALUES (?, ?, ?)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "a64a557ba87d4b2c7457857afa7ebc7d4f895fc4991da18ec02c9e250bea0fe0"
-}

common/client-core/gateways-storage/.sqlx/query-a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}

common/client-core/gateways-storage/.sqlx/query-b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4.json

@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data)\n                VALUES (?, ?)\n            ",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "2c113b37864f9fec7e64c0f8fdd38edcdf149acfd38c56a4db3bbf97bdb13210"
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
 }

common/client-core/gateways-storage/Cargo.toml

@@ -9,6 +9,7 @@ rust-version.workspace = true
 
 [dependencies]
 async-trait.workspace = true
+cosmrs.workspace = true
 serde = { workspace = true, features = ["derive"] }
 thiserror.workspace = true
 time.workspace = true
@@ -19,7 +20,6 @@ zeroize = { workspace = true, features = ["zeroize_derive"] }
 
 nym-crypto = { path = "../../crypto", features = ["asymmetric"] }
 nym-gateway-requests = { path = "../../gateway-requests" }
-nym-gateway-client = { path = "../../client-libs/gateway-client" }
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true

common/client-core/gateways-storage/fs_gateways_migrations/20251126120000_remove_legacy_add_fallback.sql

@@ -1,22 +0,0 @@
-/*
- * Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
- * SPDX-License-Identifier: Apache-2.0
- */
-
-CREATE TABLE remote_gateway_details_temp
-(
-    gateway_id_bs58                          TEXT NOT NULL UNIQUE PRIMARY KEY REFERENCES registered_gateway (gateway_id_bs58),
-    derived_aes256_gcm_siv_key               BLOB NOT NULL,
-    gateway_listener                         TEXT NOT NULL,
-    fallback_listener                        TEXT,
-    expiration_timestamp                     DATETIME NOT NULL
-);
-
--- keep only registrations with a non null aes256 key
-INSERT INTO remote_gateway_details_temp SELECT gateway_id_bs58, derived_aes256_gcm_siv_key, gateway_listener, NULL, datetime(0, 'unixepoch') FROM remote_gateway_details WHERE derived_aes256_gcm_siv_key IS NOT NULL;
-
-DROP TABLE remote_gateway_details;
-ALTER TABLE remote_gateway_details_temp RENAME TO remote_gateway_details;
-
--- delete registrations with no key
-DELETE FROM registered_gateway WHERE gateway_id_bs58 NOT IN ( SELECT gateway_id_bs58 FROM remote_gateway_details);

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -6,7 +6,6 @@ use crate::{
     types::{
         RawActiveGateway, RawCustomGatewayDetails, RawRegisteredGateway, RawRemoteGatewayDetails,
     },
-    RawGatewayPublishedData,
 };
 use sqlx::{
     sqlite::{SqliteAutoVacuum, SqliteSynchronous},
@@ -145,11 +144,13 @@ impl StorageManager {
         &self,
         gateway_id: &str,
     ) -> Result<RawRemoteGatewayDetails, sqlx::Error> {
-        // query_as! macro doesn't use fromRow
-        sqlx::query_as("SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?")
-            .bind(gateway_id)
-            .fetch_one(&self.connection_pool)
-            .await
+        sqlx::query_as!(
+            RawRemoteGatewayDetails,
+            "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .fetch_one(&self.connection_pool)
+        .await
     }
 
     pub(crate) async fn set_remote_gateway_details(
@@ -158,36 +159,41 @@ impl StorageManager {
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
-                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes256_gcm_siv_key, gateway_listener, fallback_listener, expiration_timestamp)
+                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)
                 VALUES (?, ?, ?, ?, ?)
             "#,
             remote.gateway_id_bs58,
+            remote.derived_aes128_ctr_blake3_hmac_keys_bs58,
             remote.derived_aes256_gcm_siv_key,
-            remote.published_data.gateway_listener,
-            remote.published_data.fallback_listener,
-            remote.published_data.expiration_timestamp
+            remote.gateway_owner_address,
+            remote.gateway_listener,
         )
             .execute(&self.connection_pool)
             .await?;
         Ok(())
     }
 
-    pub(crate) async fn update_remote_gateway_published_data(
+    pub(crate) async fn update_remote_gateway_key(
         &self,
         gateway_id_bs58: &str,
-        published_data: &RawGatewayPublishedData,
+        derived_aes128_ctr_blake3_hmac_keys_bs58: Option<&str>,
+        derived_aes256_gcm_siv_key: Option<&[u8]>,
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
-                UPDATE remote_gateway_details SET gateway_listener = ?, fallback_listener = ?, expiration_timestamp = ? WHERE gateway_id_bs58 = ?
+                UPDATE remote_gateway_details
+                SET
+                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,
+                    derived_aes256_gcm_siv_key = ?
+                WHERE gateway_id_bs58 = ?
             "#,
-            published_data.gateway_listener,
-            published_data.fallback_listener,
-            published_data.expiration_timestamp,
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
             gateway_id_bs58
         )
-            .execute(&self.connection_pool)
-            .await?;
+        .execute(&self.connection_pool)
+        .await?;
+
         Ok(())
     }
 

common/client-core/gateways-storage/src/backend/fs_backend/mod.rs

@@ -2,16 +2,18 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::{
-    ActiveGateway, BadGateway, GatewayDetails, GatewayPublishedData, GatewayRegistration,
-    GatewayType, GatewaysDetailsStore, StorageError,
+    ActiveGateway, BadGateway, GatewayDetails, GatewayRegistration, GatewayType,
+    GatewaysDetailsStore, StorageError,
 };
 use async_trait::async_trait;
 use manager::StorageManager;
 use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::path::Path;
 
 pub mod error;
 mod manager;
+mod models;
 
 #[derive(Clone)]
 pub struct OnDiskGatewaysDetails {
@@ -132,15 +134,16 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
         Ok(())
     }
 
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
         &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
     ) -> Result<(), Self::StorageError> {
         self.manager
-            .update_remote_gateway_published_data(
+            .update_remote_gateway_key(
                 &gateway_id.to_base58_string(),
-                &published_data.into(),
+                None,
+                Some(updated_key.as_bytes()),
             )
             .await?;
         Ok(())

common/client-core/gateways-storage/src/backend/fs_backend/models.rs

@@ -0,0 +1,2 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0

common/client-core/gateways-storage/src/backend/mem_backend.rs

@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::types::{ActiveGateway, GatewayRegistration};
-use crate::{BadGateway, GatewayDetails, GatewayPublishedData, GatewaysDetailsStore};
+use crate::{BadGateway, GatewayDetails, GatewaysDetailsStore};
 use async_trait::async_trait;
-use nym_crypto::asymmetric::ed25519;
+use nym_crypto::asymmetric::ed25519::PublicKey;
+use nym_gateway_requests::{SharedGatewayKey, SharedSymmetricKey};
 use std::collections::HashMap;
 use std::sync::Arc;
 use thiserror::Error;
@@ -95,17 +96,26 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
         Ok(())
     }
 
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
         &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: PublicKey,
+        updated_key: &SharedSymmetricKey,
     ) -> Result<(), Self::StorageError> {
         let mut guard = self.inner.write().await;
-        if let Some(gateway) = guard.gateways.get_mut(&gateway_id.to_base58_string()) {
-            if let GatewayDetails::Remote(ref mut remote_details) = gateway.details {
-                remote_details.published_data = published_data.clone();
-            }
+
+        #[allow(clippy::unwrap_used)]
+        if let Some(target) = guard.gateways.get_mut(&gateway_id.to_string()) {
+            let GatewayDetails::Remote(details) = &mut target.details else {
+                return Ok(());
+            };
+            assert_eq!(Arc::strong_count(&details.shared_key), 1);
+
+            // eh. that's nasty, but it's only ever used for ephemeral clients so should be fine for now...
+            details.shared_key = Arc::new(SharedGatewayKey::Current(
+                SharedSymmetricKey::try_from_bytes(updated_key.as_bytes()).unwrap(),
+            ))
         }
+
         Ok(())
     }
 

common/client-core/gateways-storage/src/error.rs

@@ -18,6 +18,16 @@ pub enum BadGateway {
         source: Ed25519RecoveryError,
     },
 
+    #[error("the account owner of gateway {gateway_id} ({raw_owner}) is malformed: {source}")]
+    MalformedGatewayOwnerAccountAddress {
+        gateway_id: String,
+
+        raw_owner: String,
+
+        #[source]
+        source: cosmrs::ErrorReport,
+    },
+
     #[error("the shared keys provided for gateway {gateway_id} are malformed: {source}")]
     MalformedSharedKeys {
         gateway_id: String,
@@ -40,12 +50,4 @@ pub enum BadGateway {
         #[source]
         source: url::ParseError,
     },
-
-    #[error("the listening address ({raw_listener}) is malformed: {source}")]
-    MalformedListenerNoId {
-        raw_listener: String,
-
-        #[source]
-        source: url::ParseError,
-    },
 }

common/client-core/gateways-storage/src/lib.rs

@@ -6,6 +6,7 @@
 
 use async_trait::async_trait;
 use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::error::Error;
 
 pub mod backend;
@@ -59,11 +60,10 @@ pub trait GatewaysDetailsStore {
         details: &GatewayRegistration,
     ) -> Result<(), Self::StorageError>;
 
-    /// Update the gateway details
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
         &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
     ) -> Result<(), Self::StorageError>;
 
     /// Remove given gateway details from the underlying store.

common/client-core/gateways-storage/src/types.rs

@@ -2,21 +2,20 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::BadGateway;
+use cosmrs::AccountId;
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::GatewayListeners;
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
+use std::ops::Deref;
 use std::str::FromStr;
 use std::sync::Arc;
-use time::Duration;
 use time::OffsetDateTime;
 use url::Url;
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
 pub const REMOTE_GATEWAY_TYPE: &str = "remote";
 pub const CUSTOM_GATEWAY_TYPE: &str = "custom";
-const GATEWAY_DETAILS_TTL: Duration = Duration::days(7);
 
 #[derive(Debug, Clone, Default)]
 pub struct ActiveGateway {
@@ -66,13 +65,15 @@ impl From<GatewayDetails> for GatewayRegistration {
 impl GatewayDetails {
     pub fn new_remote(
         gateway_id: ed25519::PublicKey,
-        shared_key: Arc<SharedSymmetricKey>,
-        published_data: GatewayPublishedData,
+        shared_key: Arc<SharedGatewayKey>,
+        gateway_owner_address: Option<AccountId>,
+        gateway_listener: Url,
     ) -> Self {
         GatewayDetails::Remote(RemoteGatewayDetails {
             gateway_id,
             shared_key,
-            published_data,
+            gateway_owner_address,
+            gateway_listener,
         })
     }
 
@@ -87,20 +88,13 @@ impl GatewayDetails {
         }
     }
 
-    pub fn shared_key(&self) -> Option<&SharedSymmetricKey> {
+    pub fn shared_key(&self) -> Option<&SharedGatewayKey> {
         match self {
             GatewayDetails::Remote(details) => Some(&details.shared_key),
             GatewayDetails::Custom(_) => None,
         }
     }
 
-    pub fn details_exipration(&self) -> Option<OffsetDateTime> {
-        match self {
-            GatewayDetails::Remote(details) => Some(details.published_data.expiration_timestamp),
-            GatewayDetails::Custom(_) => None,
-        }
-    }
-
     pub fn is_custom(&self) -> bool {
         matches!(self, GatewayDetails::Custom(..))
     }
@@ -170,78 +164,14 @@ pub struct RegisteredGateway {
     pub gateway_type: GatewayType,
 }
 
-#[derive(Debug, Clone)]
-pub struct GatewayPublishedData {
-    pub listeners: GatewayListeners,
-    pub expiration_timestamp: OffsetDateTime,
-}
-
-impl GatewayPublishedData {
-    pub fn new(listeners: GatewayListeners) -> GatewayPublishedData {
-        GatewayPublishedData {
-            listeners,
-            expiration_timestamp: OffsetDateTime::now_utc() + GATEWAY_DETAILS_TTL,
-        }
-    }
-}
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
-pub struct RawGatewayPublishedData {
-    pub gateway_listener: String,
-    pub fallback_listener: Option<String>,
-    pub expiration_timestamp: OffsetDateTime,
-}
-
-impl<'a> From<&'a GatewayPublishedData> for RawGatewayPublishedData {
-    fn from(value: &'a GatewayPublishedData) -> Self {
-        Self {
-            gateway_listener: value.listeners.primary.to_string(),
-            fallback_listener: value.listeners.fallback.as_ref().map(|uri| uri.to_string()),
-            expiration_timestamp: value.expiration_timestamp,
-        }
-    }
-}
-
-impl TryFrom<RawGatewayPublishedData> for GatewayPublishedData {
-    type Error = BadGateway;
-
-    fn try_from(value: RawGatewayPublishedData) -> Result<Self, Self::Error> {
-        let gateway_listener: Url = Url::parse(&value.gateway_listener).map_err(|source| {
-            BadGateway::MalformedListenerNoId {
-                raw_listener: value.gateway_listener.clone(),
-                source,
-            }
-        })?;
-        let fallback_listener = value
-            .fallback_listener
-            .as_ref()
-            .map(|uri| {
-                Url::parse(uri).map_err(|source| BadGateway::MalformedListenerNoId {
-                    raw_listener: uri.to_owned(),
-                    source,
-                })
-            })
-            .transpose()?;
-
-        Ok(GatewayPublishedData {
-            listeners: GatewayListeners {
-                primary: gateway_listener,
-                fallback: fallback_listener,
-            },
-            expiration_timestamp: value.expiration_timestamp,
-        })
-    }
-}
-
 #[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 #[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
 pub struct RawRemoteGatewayDetails {
     pub gateway_id_bs58: String,
-    pub derived_aes256_gcm_siv_key: Vec<u8>,
-    #[zeroize(skip)]
-    #[cfg_attr(feature = "sqlx", sqlx(flatten))]
-    pub published_data: RawGatewayPublishedData,
+    pub derived_aes128_ctr_blake3_hmac_keys_bs58: Option<String>,
+    pub derived_aes256_gcm_siv_key: Option<Vec<u8>>,
+    pub gateway_owner_address: Option<String>,
+    pub gateway_listener: String,
 }
 
 impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
@@ -256,26 +186,81 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
                 }
             })?;
 
-        let shared_key = SharedSymmetricKey::try_from_bytes(&value.derived_aes256_gcm_siv_key)
-            .map_err(|source| BadGateway::MalformedSharedKeys {
+        let shared_key =
+            match (
+                &value.derived_aes256_gcm_siv_key,
+                &value.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            ) {
+                (None, None) => {
+                    return Err(BadGateway::MissingSharedKey {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                    })
+                }
+                (Some(aes256gcm_siv), _) => {
+                    let current_key =
+                        SharedSymmetricKey::try_from_bytes(aes256gcm_siv).map_err(|source| {
+                            BadGateway::MalformedSharedKeys {
+                                gateway_id: value.gateway_id_bs58.clone(),
+                                source,
+                            }
+                        })?;
+                    SharedGatewayKey::Current(current_key)
+                }
+                (None, Some(aes128ctr_hmac)) => {
+                    let legacy_key = LegacySharedKeys::try_from_base58_string(aes128ctr_hmac)
+                        .map_err(|source| BadGateway::MalformedSharedKeys {
+                            gateway_id: value.gateway_id_bs58.clone(),
+                            source,
+                        })?;
+                    SharedGatewayKey::Legacy(legacy_key)
+                }
+            };
+
+        let gateway_owner_address = value
+            .gateway_owner_address
+            .as_ref()
+            .map(|raw_owner| {
+                AccountId::from_str(raw_owner).map_err(|source| {
+                    BadGateway::MalformedGatewayOwnerAccountAddress {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                        raw_owner: raw_owner.clone(),
+                        source,
+                    }
+                })
+            })
+            .transpose()?;
+
+        let gateway_listener = Url::parse(&value.gateway_listener).map_err(|source| {
+            BadGateway::MalformedListener {
                 gateway_id: value.gateway_id_bs58.clone(),
+                raw_listener: value.gateway_listener.clone(),
                 source,
-            })?;
+            }
+        })?;
 
         Ok(RemoteGatewayDetails {
             gateway_id,
             shared_key: Arc::new(shared_key),
-            published_data: value.published_data.clone().try_into()?,
+            gateway_owner_address,
+            gateway_listener,
         })
     }
 }
 
 impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
     fn from(value: &'a RemoteGatewayDetails) -> Self {
+        let (derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key) =
+            match value.shared_key.deref() {
+                SharedGatewayKey::Current(key) => (None, Some(key.to_bytes())),
+                SharedGatewayKey::Legacy(key) => (Some(key.to_base58_string()), None),
+            };
+
         RawRemoteGatewayDetails {
             gateway_id_bs58: value.gateway_id.to_base58_string(),
-            derived_aes256_gcm_siv_key: value.shared_key.to_bytes(),
-            published_data: (&value.published_data).into(),
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
+            gateway_owner_address: value.gateway_owner_address.as_ref().map(|o| o.to_string()),
+            gateway_listener: value.gateway_listener.to_string(),
         }
     }
 }
@@ -284,9 +269,11 @@ impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
 pub struct RemoteGatewayDetails {
     pub gateway_id: ed25519::PublicKey,
 
-    pub shared_key: Arc<SharedSymmetricKey>,
+    pub shared_key: Arc<SharedGatewayKey>,
 
-    pub published_data: GatewayPublishedData,
+    pub gateway_owner_address: Option<AccountId>,
+
+    pub gateway_listener: Url,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]

common/client-core/src/cli_helpers/client_add_gateway.rs

@@ -87,7 +87,6 @@ where
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         common_args.force_tls_gateway,
-        false,
     );
     tracing::debug!("Gateway selection specification: {selection_spec:?}");
 
@@ -168,7 +167,6 @@ where
         identity: gateway_details.gateway_id,
         active: common_args.set_active,
         typ: gateway_registration.details.typ().to_string(),
-        endpoint: Some(gateway_details.published_data.listeners.primary.clone()),
-        fallback_endpoint: gateway_details.published_data.listeners.fallback.clone(),
+        endpoint: Some(gateway_details.gateway_listener.clone()),
     })
 }

common/client-core/src/cli_helpers/client_init.rs

@@ -81,10 +81,6 @@ pub struct CommonClientInitArgs {
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
     pub enabled_credentials_mode: Option<bool>,
 
-    /// Change the default minimum node performance used during initial node selection filtering.
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub minimum_gateway_performance: Option<u8>,
-
     /// Mostly debug-related option to increase default traffic rate so that you would not need to
     /// modify config post init
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
@@ -140,7 +136,6 @@ where
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         common_args.force_tls_gateway,
-        false,
     );
     tracing::debug!("Gateway selection specification: {selection_spec:?}");
 
@@ -178,14 +173,10 @@ where
         })?;
         hardcoded_topology.entry_capable_nodes().cloned().collect()
     } else {
-        let minimum_performance = common_args
-            .minimum_gateway_performance
-            .unwrap_or(core.debug.topology.minimum_gateway_performance);
-
         crate::init::helpers::gateways_for_init(
             &core.client.nym_api_urls,
             user_agent,
-            minimum_performance,
+            core.debug.topology.minimum_gateway_performance,
             core.debug.topology.ignore_ingress_epoch_role,
             None,
         )

common/client-core/src/cli_helpers/client_list_gateways.rs

@@ -56,8 +56,7 @@ where
                 identity: remote_details.gateway_id,
                 active: active_gateway == Some(remote_details.gateway_id),
                 typ: GatewayType::Remote.to_string(),
-                endpoint: Some(remote_details.published_data.listeners.primary.clone()),
-                fallback_endpoint: remote_details.published_data.listeners.fallback.clone(),
+                endpoint: Some(remote_details.gateway_listener),
             }),
             GatewayDetails::Custom(_) => info.push(GatewayInfo {
                 registration: gateway.registration_timestamp,
@@ -65,7 +64,6 @@ where
                 active: active_gateway == Some(gateway.details.gateway_id()),
                 typ: gateway.details.typ().to_string(),
                 endpoint: None,
-                fallback_endpoint: None,
             }),
         };
     }

common/client-core/src/cli_helpers/types.rs

@@ -15,7 +15,6 @@ pub struct GatewayInfo {
 
     pub typ: String,
     pub endpoint: Option<Url>,
-    pub fallback_endpoint: Option<Url>,
 }
 
 impl Display for GatewayInfo {
@@ -31,9 +30,6 @@ impl Display for GatewayInfo {
         if let Some(endpoint) = &self.endpoint {
             write!(f, " endpoint: {endpoint}")?;
         }
-        if let Some(fallback_endpoint) = &self.fallback_endpoint {
-            write!(f, " fallback: {fallback_endpoint}")?;
-        }
         Ok(())
     }
 }

common/client-core/src/client/base_client/mod.rs

@@ -529,6 +529,7 @@ where
         config: &Config,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
         stats_reporter: ClientStatsSender,
         #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
@@ -554,7 +555,14 @@ where
                     shutdown_tracker.clone_shutdown_token(),
                 )
             } else {
-                let cfg = GatewayConfig::new(details.gateway_id, details.published_data.listeners);
+                let cfg = GatewayConfig::new(
+                    details.gateway_id,
+                    details
+                        .gateway_owner_address
+                        .as_ref()
+                        .map(|o| o.to_string()),
+                    details.gateway_listener.to_string(),
+                );
                 GatewayClient::new(
                     GatewayClientConfig::new_default()
                         .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
@@ -584,13 +592,32 @@ where
         // the gateway client startup procedure is slightly more complicated now
         // we need to:
         // - perform handshake (reg or auth)
+        // - check for key upgrade
+        // - maybe perform another upgrade handshake
         // - check for bandwidth
         // - start background tasks
-        let _ = gateway_client
+        let auth_res = gateway_client
             .perform_initial_authentication()
             .await
             .map_err(gateway_failure)?;
 
+        if auth_res.requires_key_upgrade {
+            // drop the shared_key arc because we don't need it and we can't hold it for the purposes of upgrade
+            drop(auth_res);
+
+            let updated_key = gateway_client
+                .upgrade_key_authenticated()
+                .await
+                .map_err(gateway_failure)?;
+
+            details_store
+                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
+                .await.map_err(|err| {
+                tracing::error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
+            })?
+        }
+
         gateway_client
             .claim_initial_bandwidth()
             .await
@@ -609,6 +636,7 @@ where
         config: &Config,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
         stats_reporter: ClientStatsSender,
         #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
@@ -639,6 +667,7 @@ where
             config,
             initialisation_result,
             bandwidth_controller,
+            details_store,
             packet_router,
             stats_reporter,
             #[cfg(unix)]
@@ -946,7 +975,8 @@ where
         )
         .await?;
 
-        let (reply_storage_backend, credential_store, _) = self.client_store.into_runtime_stores();
+        let (reply_storage_backend, credential_store, details_store) =
+            self.client_store.into_runtime_stores();
 
         // channels for inter-component communication
         // TODO: make the channels be internally created by the relevant components
@@ -1039,6 +1069,7 @@ where
             &self.config,
             init_res,
             bandwidth_controller,
+            &details_store,
             gateway_packet_router,
             stats_reporter.clone(),
             #[cfg(unix)]

common/client-core/src/client/base_client/storage/helpers.rs

@@ -4,9 +4,7 @@
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::error::ClientCoreError;
-use nym_client_core_gateways_storage::{
-    ActiveGateway, GatewayPublishedData, GatewayRegistration, GatewaysDetailsStore,
-};
+use nym_client_core_gateways_storage::{ActiveGateway, GatewayRegistration, GatewaysDetailsStore};
 use nym_crypto::asymmetric::ed25519;
 
 // helpers for error wrapping
@@ -87,23 +85,6 @@ where
         })
 }
 
-pub async fn update_stored_published_data_gateway<D>(
-    details_store: &D,
-    gateway_id: &ed25519::PublicKey,
-    published_data: &GatewayPublishedData,
-) -> Result<(), ClientCoreError>
-where
-    D: GatewaysDetailsStore,
-    D::StorageError: Send + Sync + 'static,
-{
-    details_store
-        .update_gateway_published_data(gateway_id, published_data)
-        .await
-        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
-            source: Box::new(source),
-        })
-}
-
 pub async fn load_active_gateway_details<D>(
     details_store: &D,
 ) -> Result<ActiveGateway, ClientCoreError>

common/client-core/src/client/base_client/storage/migration_helpers.rs

@@ -2,18 +2,210 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub mod v1_1_33 {
+    use crate::client::base_client::{
+        non_wasm_helpers::setup_fs_gateways_storage,
+        storage::helpers::{set_active_gateway, store_gateway_details},
+    };
     use crate::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
     use crate::config::disk_persistence::CommonClientPaths;
     use crate::config::old_config_v1_1_33::OldGatewayEndpointConfigV1_1_33;
     use crate::error::ClientCoreError;
+    use nym_client_core_gateways_storage::{
+        CustomGatewayDetails, GatewayDetails, GatewayRegistration, RemoteGatewayDetails,
+    };
+    use nym_gateway_requests::shared_key::LegacySharedKeys;
+    use serde::{Deserialize, Serialize};
+    use sha2::{digest::Digest, Sha256};
+    use std::ops::Deref;
+    use std::path::Path;
+    use std::sync::Arc;
+    use zeroize::Zeroizing;
+
+    mod base64 {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+        use serde::{Deserialize, Deserializer, Serializer};
+
+        pub fn serialize<S: Serializer>(bytes: &[u8], serializer: S) -> Result<S::Ok, S::Error> {
+            serializer.serialize_str(&STANDARD.encode(bytes))
+        }
+
+        pub fn deserialize<'de, D: Deserializer<'de>>(
+            deserializer: D,
+        ) -> Result<Vec<u8>, D::Error> {
+            let s = <String>::deserialize(deserializer)?;
+            STANDARD.decode(s).map_err(serde::de::Error::custom)
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    #[serde(untagged)]
+    enum PersistedGatewayDetails {
+        /// Standard details of a remote gateway
+        Default(PersistedGatewayConfig),
+
+        /// Custom gateway setup, such as for a client embedded inside gateway itself
+        Custom(PersistedCustomGatewayDetails),
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+    struct PersistedGatewayConfig {
+        /// The hash of the shared keys to ensure the correct ones are used with those gateway details.
+        #[serde(with = "base64")]
+        key_hash: Vec<u8>,
+
+        /// Actual gateway details being persisted.
+        details: OldGatewayEndpointConfigV1_1_33,
+    }
+
+    impl PersistedGatewayConfig {
+        fn verify(&self, shared_key: &LegacySharedKeys) -> bool {
+            let key_bytes = Zeroizing::new(shared_key.to_bytes());
+
+            let mut key_hasher = Sha256::new();
+            key_hasher.update(&key_bytes);
+            let key_hash = key_hasher.finalize();
+
+            self.key_hash == key_hash.deref()
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    struct PersistedCustomGatewayDetails {
+        gateway_id: String,
+    }
+
+    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<LegacySharedKeys, ClientCoreError> {
+        // the shared key was a simple pem file
+        Ok(nym_pemstore::load_key(path)?)
+    }
+
+    fn gateway_details_from_raw(
+        gateway_id: String,
+        gateway_owner: String,
+        gateway_listener: String,
+        gateway_shared_key: LegacySharedKeys,
+    ) -> Result<GatewayDetails, ClientCoreError> {
+        Ok(GatewayDetails::Remote(RemoteGatewayDetails {
+            gateway_id: gateway_id
+                .parse()
+                .map_err(|err| ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway id was malformed: {err}"),
+                })?,
+            shared_key: Arc::new(gateway_shared_key.into()),
+            gateway_owner_address: Some(gateway_owner.parse().map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway owner address was malformed: {err}"),
+                }
+            })?),
+            gateway_listener: gateway_listener.parse().map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway listener address was malformed: {err}"),
+                }
+            })?,
+        }))
+    }
+
+    // helper to extract shared key and gateway details into the new GatewayRegistration
+    fn extract_gateway_registration(
+        storage_paths: &CommonClientPathsV1_1_33,
+    ) -> Result<GatewayRegistration, ClientCoreError> {
+        let details_file = std::fs::File::open(&storage_paths.gateway_details).map_err(|err| {
+            ClientCoreError::UpgradeFailure {
+                message: format!(
+                    "failed to open gateway details file at {}: {err}",
+                    storage_paths.gateway_details.display()
+                ),
+            }
+        })?;
+
+        // in v1.1.33 of the clients, the gateway details struct was saved as json
+        let details: PersistedGatewayDetails =
+            serde_json::from_reader(details_file).map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!(
+                        "failed to deserialize gateway details from {}: {err}",
+                        storage_paths.gateway_details.display()
+                    ),
+                }
+            })?;
+
+        let details = match details {
+            PersistedGatewayDetails::Default(config) => {
+                let gateway_shared_key =
+                    load_shared_key(&storage_paths.keys.gateway_shared_key_file)?;
+                if !config.verify(&gateway_shared_key) {
+                    return Err(ClientCoreError::UpgradeFailure {
+                        message: "failed to verify consistency of the existing gateway details"
+                            .to_string(),
+                    });
+                }
+                gateway_details_from_raw(
+                    config.details.gateway_id,
+                    config.details.gateway_owner,
+                    config.details.gateway_listener,
+                    gateway_shared_key,
+                )?
+            }
+            PersistedGatewayDetails::Custom(custom) => {
+                GatewayDetails::Custom(CustomGatewayDetails {
+                    gateway_id: custom.gateway_id.parse().map_err(|err| {
+                        ClientCoreError::UpgradeFailure {
+                            message: format!("the stored gateway id was malformed: {err}"),
+                        }
+                    })?,
+                    data: None,
+                })
+            }
+        };
+
+        Ok(details.into())
+    }
+
+    // it's responsibility of the caller to ensure this is called **after** new registration has already been saved
+    fn remove_old_gateway_details(storage_paths: &CommonClientPathsV1_1_33) -> std::io::Result<()> {
+        std::fs::remove_file(&storage_paths.gateway_details)?;
+
+        if storage_paths.keys.gateway_shared_key_file.exists() {
+            std::fs::remove_file(&storage_paths.keys.gateway_shared_key_file)?;
+        }
+        Ok(())
+    }
 
     pub async fn migrate_gateway_details(
-        _old_storage_paths: &CommonClientPathsV1_1_33,
-        _new_storage_paths: &CommonClientPaths,
-        _preloaded_config: Option<OldGatewayEndpointConfigV1_1_33>,
+        old_storage_paths: &CommonClientPathsV1_1_33,
+        new_storage_paths: &CommonClientPaths,
+        preloaded_config: Option<OldGatewayEndpointConfigV1_1_33>,
     ) -> Result<(), ClientCoreError> {
-        Err(ClientCoreError::UnsupportedMigration(
-            "migration of legacy keys has been removed and is no longer supported".into(),
-        ))
+        let gateway_registration = match preloaded_config {
+            Some(config) => {
+                let gateway_shared_key =
+                    load_shared_key(&old_storage_paths.keys.gateway_shared_key_file)?;
+                gateway_details_from_raw(
+                    config.gateway_id,
+                    config.gateway_owner,
+                    config.gateway_listener,
+                    gateway_shared_key,
+                )?
+                .into()
+            }
+            None => extract_gateway_registration(old_storage_paths)?,
+        };
+
+        // since we're migrating to a brand new store, the store should be empty
+        // and thus set the 'new' gateway as the active one
+        let details_store =
+            setup_fs_gateways_storage(&new_storage_paths.gateway_registrations).await?;
+        store_gateway_details(&details_store, &gateway_registration).await?;
+        set_active_gateway(
+            &details_store,
+            &gateway_registration.details.gateway_id().to_base58_string(),
+        )
+        .await?;
+
+        remove_old_gateway_details(old_storage_paths).map_err(|err| {
+            ClientCoreError::UpgradeFailure {
+                message: format!("failed to remove old data: {err}"),
+            }
+        })
     }
 }

common/client-core/src/client/key_manager/mod.rs

@@ -6,7 +6,7 @@ use nym_crypto::{
     asymmetric::{ed25519, x25519},
     hkdf::{DerivationMaterial, InvalidLength},
 };
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use nym_sphinx::acknowledgements::AckKey;
 use rand::{CryptoRng, RngCore};
 use std::sync::Arc;
@@ -106,5 +106,7 @@ fn _assert_keys_zeroize_on_drop() {
     _assert_zeroize_on_drop::<ed25519::KeyPair>();
     _assert_zeroize_on_drop::<x25519::KeyPair>();
     _assert_zeroize_on_drop::<AckKey>();
+    _assert_zeroize_on_drop::<LegacySharedKeys>();
     _assert_zeroize_on_drop::<SharedSymmetricKey>();
+    _assert_zeroize_on_drop::<SharedGatewayKey>();
 }

common/client-core/src/error.rs

@@ -16,9 +16,6 @@ use std::path::PathBuf;
 
 #[derive(thiserror::Error, Debug)]
 pub enum ClientCoreError {
-    #[error("could not perform the state migration: {0}")]
-    UnsupportedMigration(String),
-
     #[error("I/O error: {0}")]
     IoError(#[from] std::io::Error),
 
@@ -46,12 +43,9 @@ pub enum ClientCoreError {
     #[error("Invalid URL: {0}")]
     InvalidUrl(String),
 
-    #[error("node doesn't advertise ip addresses : {0}")]
-    MissingIpAddress(String),
-
     #[cfg(not(target_arch = "wasm32"))]
     #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
+    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),
 
     #[error("no gateways on network")]
     NoGatewaysOnNetwork,
@@ -169,9 +163,6 @@ pub enum ClientCoreError {
     #[error("custom selection of gateway was expected")]
     CustomGatewaySelectionExpected,
 
-    #[error("custom selection of gateway was unexpected")]
-    UnexpectedCustomGatewaySelection,
-
     #[error("the persisted gateway details were set for a custom setup")]
     UnexpectedPersistedCustomGatewayDetails,
 

common/client-core/src/init/helpers.rs

@@ -5,7 +5,6 @@ use crate::error::ClientCoreError;
 use crate::init::types::RegistrationResult;
 use futures::{SinkExt, StreamExt};
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::GatewayListeners;
 use nym_gateway_client::GatewayClient;
 use nym_topology::node::RoutingNode;
 use nym_validator_client::client::{IdentityKeyRef, NymApiClientExt};
@@ -380,12 +379,12 @@ pub(super) fn get_specified_gateway(
 
 pub(super) async fn register_with_gateway(
     gateway_id: ed25519::PublicKey,
-    gateway_listeners: GatewayListeners,
+    gateway_listener: Url,
     our_identity: Arc<ed25519::KeyPair>,
     #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
 ) -> Result<RegistrationResult, ClientCoreError> {
     let mut gateway_client = GatewayClient::new_init(
-        gateway_listeners,
+        gateway_listener,
         gateway_id,
         our_identity.clone(),
         #[cfg(unix)]
@@ -410,6 +409,14 @@ pub(super) async fn register_with_gateway(
             }
         })?;
 
+    // this should NEVER happen, if it did, it means the function was misused,
+    // because for any fresh **registration**, the derived key is always up to date
+    if auth_response.requires_key_upgrade {
+        return Err(ClientCoreError::UnexpectedKeyUpgrade {
+            gateway_id: gateway_id.to_base58_string(),
+        });
+    }
+
     Ok(RegistrationResult {
         shared_keys: auth_response.initial_shared_key,
         authenticated_ephemeral_client: gateway_client,
@@ -434,7 +441,7 @@ mod tests {
 
     #[test]
     fn test_multiple_urls_prepared_for_retries() {
-        let urls = [
+        let urls = vec![
             Url::parse("https://api1.nym.com").unwrap(),
             Url::parse("https://api2.nym.com").unwrap(),
             Url::parse("https://api3.nym.com").unwrap(),

common/client-core/src/init/mod.rs

@@ -5,7 +5,7 @@
 
 use crate::client::base_client::storage::helpers::{
     has_gateway_details, load_active_gateway_details, load_client_keys, load_gateway_details,
-    store_gateway_details, update_stored_published_data_gateway,
+    store_gateway_details,
 };
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
@@ -16,8 +16,8 @@ use crate::init::helpers::{
 use crate::init::types::{
     GatewaySelectionSpecification, GatewaySetup, InitialisationResult, SelectedGateway,
 };
+use nym_client_core_gateways_storage::GatewaysDetailsStore;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewayRegistration};
-use nym_client_core_gateways_storage::{GatewayPublishedData, GatewaysDetailsStore};
 use nym_gateway_client::client::InitGatewayClient;
 use nym_topology::node::RoutingNode;
 use rand::rngs::OsRng;
@@ -71,28 +71,21 @@ where
     let mut rng = OsRng;
 
     let selected_gateway = match selection_specification {
-        GatewaySelectionSpecification::UniformRemote {
-            must_use_tls,
-            no_hostname,
-        } => {
+        GatewaySelectionSpecification::UniformRemote { must_use_tls } => {
             let gateway = uniformly_random_gateway(&mut rng, &available_gateways, must_use_tls)?;
-            SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?
+            SelectedGateway::from_topology_node(gateway, must_use_tls)?
         }
-        GatewaySelectionSpecification::RemoteByLatency {
-            must_use_tls,
-            no_hostname,
-        } => {
+        GatewaySelectionSpecification::RemoteByLatency { must_use_tls } => {
             let gateway =
                 choose_gateway_by_latency(&mut rng, &available_gateways, must_use_tls).await?;
-            SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?
+            SelectedGateway::from_topology_node(gateway, must_use_tls)?
         }
         GatewaySelectionSpecification::Specified {
             must_use_tls,
-            no_hostname,
             identity,
         } => {
             let gateway = get_specified_gateway(&identity, &available_gateways, must_use_tls)?;
-            SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?
+            SelectedGateway::from_topology_node(gateway, must_use_tls)?
         }
         GatewaySelectionSpecification::Custom {
             gateway_identity,
@@ -112,15 +105,15 @@ where
     let (gateway_details, authenticated_ephemeral_client) = match selected_gateway {
         SelectedGateway::Remote {
             gateway_id,
-
-            gateway_listeners,
+            gateway_owner_address,
+            gateway_listener,
         } => {
             // if we're using a 'normal' gateway setup, do register
             let our_identity = client_keys.identity_keypair();
 
             let registration = helpers::register_with_gateway(
                 gateway_id,
-                gateway_listeners.clone(),
+                gateway_listener.clone(),
                 our_identity,
                 #[cfg(unix)]
                 connection_fd_callback,
@@ -130,7 +123,8 @@ where
                 GatewayDetails::new_remote(
                     gateway_id,
                     registration.shared_keys,
-                    GatewayPublishedData::new(gateway_listeners),
+                    gateway_owner_address,
+                    gateway_listener,
                 ),
                 Some(registration.authenticated_ephemeral_client),
             )
@@ -156,46 +150,6 @@ where
     })
 }
 
-pub async fn refresh_gateway_published_data<D>(
-    details_store: &D,
-    registration: GatewayRegistration,
-    available_gateways: Vec<RoutingNode>,
-    must_use_tls: bool,
-    no_hostname: bool,
-) -> Result<(), ClientCoreError>
-where
-    D: GatewaysDetailsStore,
-    D::StorageError: Send + Sync + 'static,
-{
-    let gateway_id = registration.gateway_id().to_base58_string();
-    tracing::trace!("Updating gateway details : {gateway_id}");
-
-    let gateway = get_specified_gateway(&gateway_id, &available_gateways, must_use_tls)?;
-    let selected_gateway = SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?;
-
-    let new_gateway_listeners = match selected_gateway {
-        SelectedGateway::Remote {
-            gateway_listeners, ..
-        } => gateway_listeners,
-        SelectedGateway::Custom { .. } => {
-            // this should not happen, as `from_topology_node` returns a Remote
-            Err(ClientCoreError::UnexpectedCustomGatewaySelection)?
-        }
-    };
-
-    let new_published_data = GatewayPublishedData::new(new_gateway_listeners);
-
-    // update gateway details
-    update_stored_published_data_gateway(
-        details_store,
-        &registration.gateway_id(),
-        &new_published_data,
-    )
-    .await?;
-
-    Ok(())
-}
-
 async fn use_loaded_gateway_details<K, D>(
     key_store: &K,
     details_store: &D,

common/client-core/src/init/types.rs

@@ -10,11 +10,12 @@ use nym_client_core_gateways_storage::{
     GatewayRegistration, GatewaysDetailsStore, RemoteGatewayDetails,
 };
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::{GatewayListeners, InitGatewayClient};
-use nym_gateway_client::SharedSymmetricKey;
+use nym_gateway_client::client::InitGatewayClient;
+use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_topology::node::RoutingNode;
 use nym_validator_client::client::IdentityKey;
+use nym_validator_client::nyxd::AccountId;
 use serde::Serialize;
 use std::fmt::{Debug, Display};
 #[cfg(unix)]
@@ -27,7 +28,9 @@ pub enum SelectedGateway {
     Remote {
         gateway_id: ed25519::PublicKey,
 
-        gateway_listeners: GatewayListeners,
+        gateway_owner_address: Option<AccountId>,
+
+        gateway_listener: Url,
     },
     Custom {
         gateway_id: ed25519::PublicKey,
@@ -39,40 +42,24 @@ impl SelectedGateway {
     pub fn from_topology_node(
         node: RoutingNode,
         must_use_tls: bool,
-        no_hostname: bool,
     ) -> Result<Self, ClientCoreError> {
         // for now, let's use 'old' behaviour, if you want to change it, you can pass it up the enum stack yourself : )
         let prefer_ipv6 = false;
 
-        let (gateway_listener, fallback_listener) = if must_use_tls {
-            // WSS main, no fallback
-            let primary =
-                node.ws_entry_address_tls()
-                    .ok_or(ClientCoreError::UnsupportedWssProtocol {
-                        gateway: node.identity_key.to_base58_string(),
-                    })?;
-            (primary, None)
+        let gateway_listener = if must_use_tls {
+            node.ws_entry_address_tls()
+                .ok_or(ClientCoreError::UnsupportedWssProtocol {
+                    gateway: node.identity_key.to_base58_string(),
+                })?
         } else {
-            let (maybe_primary, fallback) =
-                node.ws_entry_address_with_fallback(prefer_ipv6, no_hostname);
-            (
-                maybe_primary.ok_or(ClientCoreError::UnsupportedEntry {
+            node.ws_entry_address(prefer_ipv6)
+                .ok_or(ClientCoreError::UnsupportedEntry {
                     id: node.node_id,
                     identity: node.identity_key.to_base58_string(),
-                })?,
-                fallback,
-            )
+                })?
         };
 
-        let fallback_listener_url = fallback_listener.and_then(|address| {
-            Url::parse(&address)
-                .inspect_err(|err| {
-                    tracing::warn!("Malformed fallback listener, none will be used : {err}")
-                })
-                .ok()
-        });
-
-        let gateway_listener_url =
+        let gateway_listener =
             Url::parse(&gateway_listener).map_err(|source| ClientCoreError::MalformedListener {
                 gateway_id: node.identity_key.to_base58_string(),
                 raw_listener: gateway_listener,
@@ -81,10 +68,8 @@ impl SelectedGateway {
 
         Ok(SelectedGateway::Remote {
             gateway_id: node.identity_key,
-            gateway_listeners: GatewayListeners {
-                primary: gateway_listener_url,
-                fallback: fallback_listener_url,
-            },
+            gateway_owner_address: None,
+            gateway_listener,
         })
     }
 
@@ -113,7 +98,7 @@ impl SelectedGateway {
 /// - shared keys derived between ourselves and the node
 /// - an authenticated handle of an ephemeral handle created for the purposes of registration
 pub struct RegistrationResult {
-    pub shared_keys: Arc<SharedSymmetricKey>,
+    pub shared_keys: Arc<SharedGatewayKey>,
     pub authenticated_ephemeral_client: InitGatewayClient,
 }
 
@@ -160,36 +145,20 @@ impl InitialisationResult {
     pub fn gateway_id(&self) -> ed25519::PublicKey {
         self.gateway_registration.details.gateway_id()
     }
-
-    // indicates if the remote gateway details TTL has expired
-    pub fn exipred_details(&self) -> bool {
-        if let Some(expiration_timestamp) = self.gateway_registration.details.details_exipration() {
-            OffsetDateTime::now_utc() > expiration_timestamp
-        } else {
-            false
-        }
-    }
 }
 
 #[derive(Clone, Debug)]
 pub enum GatewaySelectionSpecification {
     /// Uniformly choose a random remote gateway.
-    UniformRemote {
-        must_use_tls: bool,
-        no_hostname: bool,
-    },
+    UniformRemote { must_use_tls: bool },
 
     /// Should the new, remote, gateway be selected based on latency.
-    RemoteByLatency {
-        must_use_tls: bool,
-        no_hostname: bool,
-    },
+    RemoteByLatency { must_use_tls: bool },
 
     /// Gateway with this specific identity should be chosen.
     // JS: I don't really like the name of this enum variant but couldn't think of anything better at the time
     Specified {
         must_use_tls: bool,
-        no_hostname: bool,
         identity: IdentityKey,
     },
 
@@ -205,7 +174,6 @@ impl Default for GatewaySelectionSpecification {
     fn default() -> Self {
         GatewaySelectionSpecification::UniformRemote {
             must_use_tls: false,
-            no_hostname: false,
         }
     }
 }
@@ -215,24 +183,16 @@ impl GatewaySelectionSpecification {
         gateway_identity: Option<String>,
         latency_based_selection: Option<bool>,
         must_use_tls: bool,
-        no_hostname: bool,
     ) -> Self {
         if let Some(identity) = gateway_identity {
             GatewaySelectionSpecification::Specified {
                 identity,
                 must_use_tls,
-                no_hostname,
             }
         } else if let Some(true) = latency_based_selection {
-            GatewaySelectionSpecification::RemoteByLatency {
-                must_use_tls,
-                no_hostname,
-            }
+            GatewaySelectionSpecification::RemoteByLatency { must_use_tls }
         } else {
-            GatewaySelectionSpecification::UniformRemote {
-                must_use_tls,
-                no_hostname,
-            }
+            GatewaySelectionSpecification::UniformRemote { must_use_tls }
         }
     }
 }
@@ -355,7 +315,6 @@ pub struct InitResults {
     pub encryption_key: String,
     pub gateway_id: String,
     pub gateway_listener: String,
-    pub fallback_listener: Option<String>,
     pub gateway_registration: OffsetDateTime,
     pub address: Recipient,
 }
@@ -373,13 +332,7 @@ impl InitResults {
             identity_key: address.identity().to_base58_string(),
             encryption_key: address.encryption_key().to_base58_string(),
             gateway_id: gateway.gateway_id.to_base58_string(),
-            gateway_listener: gateway.published_data.listeners.primary.to_string(),
-            fallback_listener: gateway
-                .published_data
-                .listeners
-                .fallback
-                .as_ref()
-                .map(|uri| uri.to_string()),
+            gateway_listener: gateway.gateway_listener.to_string(),
             gateway_registration: registration,
             address,
         }

common/client-core/src/init/websockets.rs

@@ -30,6 +30,7 @@ pub(crate) async fn connect_async(
             resolver
                 .resolve_str(domain)
                 .await?
+                .into_iter()
                 .map(|a| SocketAddr::new(a, port))
                 .collect()
         }

common/client-libs/gateway-client/Cargo.toml

@@ -88,6 +88,3 @@ features = ["js"]
 
 [features]
 wasm = []
-
-[lints]
-workspace = true

common/client-libs/gateway-client/src/bandwidth.rs

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use si_scale::helpers::bibytes2;
-use std::fmt::{Display, Formatter};
 use std::sync::atomic::{AtomicBool, AtomicI64, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
@@ -27,39 +26,6 @@ pub struct ClientBandwidth {
     inner: Arc<ClientBandwidthInner>,
 }
 
-// simple helper for logging purposes to accommodate 'unknown' case
-pub(crate) enum UpgradeModeEnabledWrapper {
-    True,
-    False,
-    Unknown,
-}
-
-impl From<Option<bool>> for UpgradeModeEnabledWrapper {
-    fn from(value: Option<bool>) -> Self {
-        match value {
-            Some(true) => UpgradeModeEnabledWrapper::True,
-            Some(false) => UpgradeModeEnabledWrapper::False,
-            None => UpgradeModeEnabledWrapper::Unknown,
-        }
-    }
-}
-
-impl From<bool> for UpgradeModeEnabledWrapper {
-    fn from(value: bool) -> Self {
-        Some(value).into()
-    }
-}
-
-impl Display for UpgradeModeEnabledWrapper {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            UpgradeModeEnabledWrapper::True => write!(f, "true"),
-            UpgradeModeEnabledWrapper::False => write!(f, "false"),
-            UpgradeModeEnabledWrapper::Unknown => write!(f, "unknown"),
-        }
-    }
-}
-
 struct ClientBandwidthInner {
     /// the actual bandwidth amount (in bytes) available
     available: AtomicI64,
@@ -105,41 +71,26 @@ impl ClientBandwidth {
         self.inner.available.load(Ordering::Acquire)
     }
 
-    pub(crate) fn maybe_log_bandwidth(
-        &self,
-        now: Option<OffsetDateTime>,
-        upgrade_mode: impl Into<UpgradeModeEnabledWrapper>,
-    ) {
+    pub(crate) fn maybe_log_bandwidth(&self, now: Option<OffsetDateTime>) {
         let last = self.last_logged();
         let now = now.unwrap_or_else(OffsetDateTime::now_utc);
         if last + Duration::from_secs(10) < now {
-            self.log_bandwidth(Some(now), upgrade_mode)
+            self.log_bandwidth(Some(now))
         }
     }
 
-    pub(crate) fn log_bandwidth(
-        &self,
-        now: Option<OffsetDateTime>,
-        upgrade_mode: impl Into<UpgradeModeEnabledWrapper>,
-    ) {
+    pub(crate) fn log_bandwidth(&self, now: Option<OffsetDateTime>) {
         let now = now.unwrap_or_else(OffsetDateTime::now_utc);
-        let upgrade_mode = upgrade_mode.into();
 
         let remaining = self.remaining();
         let remaining_bi2 = bibytes2(remaining as f64);
 
         if remaining < 0 {
-            tracing::warn!(
-                "OUT OF BANDWIDTH. remaining: {remaining_bi2}. in 'upgrade mode': {upgrade_mode}"
-            );
+            tracing::warn!("OUT OF BANDWIDTH. remaining: {remaining_bi2}");
         } else if remaining < 1_000_000 {
-            tracing::info!(
-                "remaining bandwidth: {remaining_bi2}. in 'upgrade mode': {upgrade_mode}"
-            );
+            tracing::info!("remaining bandwidth: {remaining_bi2}");
         } else {
-            tracing::trace!(
-                "remaining bandwidth: {remaining_bi2}. in 'upgrade mode': {upgrade_mode}"
-            );
+            tracing::debug!("remaining bandwidth: {remaining_bi2}");
         }
 
         self.inner
@@ -147,35 +98,26 @@ impl ClientBandwidth {
             .store(now.unix_timestamp(), Ordering::Relaxed)
     }
 
-    pub(crate) fn update_and_maybe_log(
-        &self,
-        remaining: i64,
-        upgrade_mode: impl Into<UpgradeModeEnabledWrapper>,
-    ) {
+    pub(crate) fn update_and_maybe_log(&self, remaining: i64) {
         let now = OffsetDateTime::now_utc();
         self.inner.available.store(remaining, Ordering::Release);
         self.inner
             .last_updated_ts
             .store(now.unix_timestamp(), Ordering::Relaxed);
-        self.maybe_log_bandwidth(Some(now), upgrade_mode)
+        self.maybe_log_bandwidth(Some(now))
     }
 
-    pub(crate) fn update_and_log(
-        &self,
-        remaining: i64,
-        upgrade_mode: impl Into<UpgradeModeEnabledWrapper>,
-    ) {
+    pub(crate) fn update_and_log(&self, remaining: i64) {
         let now = OffsetDateTime::now_utc();
         self.inner.available.store(remaining, Ordering::Release);
         self.inner
             .last_updated_ts
             .store(now.unix_timestamp(), Ordering::Relaxed);
-        self.log_bandwidth(Some(now), upgrade_mode)
+        self.log_bandwidth(Some(now))
     }
 
     fn last_logged(&self) -> OffsetDateTime {
         // SAFETY: this value is always populated with valid timestamps
-        #[allow(clippy::unwrap_used)]
         OffsetDateTime::from_unix_timestamp(self.inner.last_logged_ts.load(Ordering::Relaxed))
             .unwrap()
     }

common/client-libs/gateway-client/src/client/config.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::GatewayClientError;
-use nym_credentials_interface::DEFAULT_MIXNET_REQUEST_BANDWIDTH_THRESHOLD;
+use nym_network_defaults::TicketTypeRepr::V1MixnetEntry;
 use si_scale::helpers::bibytes2;
 use std::time::Duration;
 
@@ -103,7 +103,7 @@ impl BandwidthTickets {
 
     // 20% of entry ticket value
     pub const DEFAULT_REMAINING_BANDWIDTH_THRESHOLD: i64 =
-        DEFAULT_MIXNET_REQUEST_BANDWIDTH_THRESHOLD;
+        (V1MixnetEntry.bandwidth_value() / 5) as i64;
 
     pub const DEFAULT_CUTOFF_REMAINING_BANDWIDTH_THRESHOLD: Option<i64> = None;
 

common/client-libs/gateway-client/src/client/mod.rs

@@ -20,9 +20,9 @@ use nym_credentials_interface::TicketType;
 use nym_crypto::asymmetric::ed25519;
 use nym_gateway_requests::registration::handshake::client_handshake;
 use nym_gateway_requests::{
-    BandwidthResponse, BinaryRequest, ClientControlRequest, ClientRequest, GatewayProtocolVersion,
-    GatewayProtocolVersionExt, GatewayRequestsError, ServerResponse, SharedSymmetricKey,
-    CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
+    BinaryRequest, ClientControlRequest, ClientRequest, GatewayProtocolVersionExt,
+    GatewayRequestsError, SensitiveServerResponse, ServerResponse, SharedGatewayKey,
+    SharedSymmetricKey, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
 };
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_statistics_common::clients::connection::ConnectionStatsEvent;
@@ -47,39 +47,43 @@ use std::os::raw::c_int as RawFd;
 use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
 use wasmtimer::tokio::sleep;
+use zeroize::Zeroizing;
 
 pub mod config;
 
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) mod websockets;
 #[cfg(not(target_arch = "wasm32"))]
-use crate::client::websockets::connect_async_with_fallback;
+use websockets::connect_async;
 
 pub struct GatewayConfig {
     pub gateway_identity: ed25519::PublicKey,
 
-    pub gateway_listeners: GatewayListeners,
+    // currently a dead field
+    pub gateway_owner: Option<String>,
+
+    pub gateway_listener: String,
 }
 
 impl GatewayConfig {
-    pub fn new(gateway_identity: ed25519::PublicKey, gateway_listeners: GatewayListeners) -> Self {
+    pub fn new(
+        gateway_identity: ed25519::PublicKey,
+        gateway_owner: Option<String>,
+        gateway_listener: String,
+    ) -> Self {
         GatewayConfig {
             gateway_identity,
-            gateway_listeners,
+            gateway_owner,
+            gateway_listener,
         }
     }
 }
 
-#[derive(Debug, Clone)]
-pub struct GatewayListeners {
-    pub primary: Url,
-    pub fallback: Option<Url>,
-}
-
 #[must_use]
 #[derive(Debug)]
 pub struct AuthenticationResponse {
-    pub initial_shared_key: Arc<SharedSymmetricKey>,
+    pub initial_shared_key: Arc<SharedGatewayKey>,
+    pub requires_key_upgrade: bool,
 }
 
 // TODO: this should be refactored into a state machine that keeps track of its authentication state
@@ -88,16 +92,17 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
 
     authenticated: bool,
     bandwidth: ClientBandwidth,
-    gateway_addresses: GatewayListeners,
+    gateway_address: String,
     gateway_identity: ed25519::PublicKey,
     local_identity: Arc<ed25519::KeyPair>,
-    shared_key: Option<Arc<SharedSymmetricKey>>,
+    shared_key: Option<Arc<SharedGatewayKey>>,
     connection: SocketState,
     packet_router: PacketRouter,
     bandwidth_controller: Option<BandwidthController<C, St>>,
     stats_reporter: ClientStatsSender,
 
-    negotiated_protocol: Option<GatewayProtocolVersion>,
+    // currently unused (but populated)
+    negotiated_protocol: Option<u8>,
 
     // Callback on the fd as soon as the connection has been established
     #[cfg(unix)]
@@ -114,7 +119,7 @@ impl<C, St> GatewayClient<C, St> {
         gateway_config: GatewayConfig,
         local_identity: Arc<ed25519::KeyPair>,
         // TODO: make it mandatory. if you don't want to pass it, use `new_init`
-        shared_key: Option<Arc<SharedSymmetricKey>>,
+        shared_key: Option<Arc<SharedGatewayKey>>,
         packet_router: PacketRouter,
         bandwidth_controller: Option<BandwidthController<C, St>>,
         stats_reporter: ClientStatsSender,
@@ -125,7 +130,7 @@ impl<C, St> GatewayClient<C, St> {
             cfg,
             authenticated: false,
             bandwidth: ClientBandwidth::new_empty(),
-            gateway_addresses: gateway_config.gateway_listeners,
+            gateway_address: gateway_config.gateway_listener,
             gateway_identity: gateway_config.gateway_identity,
             local_identity,
             shared_key,
@@ -144,7 +149,7 @@ impl<C, St> GatewayClient<C, St> {
         self.gateway_identity
     }
 
-    pub fn shared_key(&self) -> Option<Arc<SharedSymmetricKey>> {
+    pub fn shared_key(&self) -> Option<Arc<SharedGatewayKey>> {
         self.shared_key.clone()
     }
 
@@ -161,12 +166,10 @@ impl<C, St> GatewayClient<C, St> {
     }
 
     #[cfg(not(target_arch = "wasm32"))]
-    #[allow(clippy::unreachable)]
     async fn _close_connection(&mut self) -> Result<(), GatewayClientError> {
         match std::mem::replace(&mut self.connection, SocketState::NotConnected) {
             SocketState::Available(mut socket) => Ok((*socket).close(None).await?),
             SocketState::PartiallyDelegated(_) => {
-                // SAFETY: this is only called after the caller has already recovered the connection
                 unreachable!("this branch should have never been reached!")
             }
             _ => Ok(()), // no need to do anything in those cases
@@ -174,7 +177,6 @@ impl<C, St> GatewayClient<C, St> {
     }
 
     #[cfg(target_arch = "wasm32")]
-    #[allow(clippy::unreachable)]
     async fn _close_connection(&mut self) -> Result<(), GatewayClientError> {
         match std::mem::replace(&mut self.connection, SocketState::NotConnected) {
             SocketState::Available(socket) => {
@@ -182,7 +184,6 @@ impl<C, St> GatewayClient<C, St> {
                 Ok(())
             }
             SocketState::PartiallyDelegated(_) => {
-                // SAFETY: this is only called after the caller has already recovered the connection
                 unreachable!("this branch should have never been reached!")
             }
             _ => Ok(()), // no need to do anything in those cases
@@ -199,19 +200,12 @@ impl<C, St> GatewayClient<C, St> {
 
     #[cfg(not(target_arch = "wasm32"))]
     pub async fn establish_connection(&mut self) -> Result<(), GatewayClientError> {
-        if let Some(fallback_url) = &self.gateway_addresses.fallback {
-            debug!(
-                "Attempting to establish connection to gateway at: {}, with fallback at: {fallback_url}",
-                self.gateway_addresses.primary
-            );
-        } else {
-            debug!(
-                "Attempting to establish connection to gateway at: {}",
-                self.gateway_addresses.primary
-            );
-        }
-        let (ws_stream, _) = connect_async_with_fallback(
-            &self.gateway_addresses,
+        debug!(
+            "Attempting to establish connection to gateway at: {}",
+            self.gateway_address
+        );
+        let (ws_stream, _) = connect_async(
+            &self.gateway_address,
             #[cfg(unix)]
             self.connection_fd_callback.clone(),
         )
@@ -224,7 +218,7 @@ impl<C, St> GatewayClient<C, St> {
 
     #[cfg(target_arch = "wasm32")]
     pub async fn establish_connection(&mut self) -> Result<(), GatewayClientError> {
-        let ws_stream = match JSWebsocket::new(self.gateway_addresses.primary.as_ref()) {
+        let ws_stream = match JSWebsocket::new(&self.gateway_address) {
             Ok(ws_stream) => ws_stream,
             Err(e) => {
                 return Err(GatewayClientError::NetworkErrorWasm(e));
@@ -277,7 +271,7 @@ impl<C, St> GatewayClient<C, St> {
         message: ClientRequest,
     ) -> Result<(), GatewayClientError> {
         if let Some(shared_key) = self.shared_key() {
-            let encrypted = message.encrypt(&shared_key)?;
+            let encrypted = message.encrypt(&*shared_key)?;
             Box::pin(self.send_websocket_message_without_response(encrypted)).await?;
             Ok(())
         } else {
@@ -464,28 +458,61 @@ impl<C, St> GatewayClient<C, St> {
         }
     }
 
+    fn check_gateway_protocol(
+        &self,
+        gateway_protocol: Option<u8>,
+    ) -> Result<(), GatewayClientError> {
+        debug!("gateway protocol: {gateway_protocol:?}, ours: {CURRENT_PROTOCOL_VERSION}");
+
+        // right now there are no failure cases here, but this might change in the future
+        match gateway_protocol {
+            None => {
+                warn!("the gateway we're connected to has not specified its protocol version. It's probably running version < 1.1.X, but that's still fine for now. It will become a hard error in 1.2.0");
+                // note: in +1.2.0 we will have to return a hard error here
+                Ok(())
+            }
+            Some(v) if v > CURRENT_PROTOCOL_VERSION => {
+                let err = GatewayClientError::IncompatibleProtocol {
+                    gateway: Some(v),
+                    current: CURRENT_PROTOCOL_VERSION,
+                };
+                error!("{err}");
+                Err(err)
+            }
+
+            Some(_) => {
+                debug!("the gateway is using exactly the same (or older) protocol version as we are. We're good to continue!");
+                Ok(())
+            }
+        }
+    }
+
     async fn register(
         &mut self,
-        supported_gateway_protocol: GatewayProtocolVersion,
+        derive_aes256_gcm_siv_key: bool,
     ) -> Result<(), GatewayClientError> {
         if !self.connection.is_established() {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
 
         debug_assert!(self.connection.is_available());
-        log::debug!("registering with gateway");
+        log::debug!(
+            "registering with gateway. using legacy key derivation: {}",
+            !derive_aes256_gcm_siv_key
+        );
 
         // it's fine to instantiate it here as it's only used once (during authentication or registration)
         // and putting it into the GatewayClient struct would be a hassle
         let mut rng = OsRng;
 
-        let handshake_result = match &mut self.connection {
+        let shared_key = match &mut self.connection {
             SocketState::Available(ws_stream) => client_handshake(
                 &mut rng,
                 ws_stream,
                 self.local_identity.as_ref(),
                 self.gateway_identity,
-                supported_gateway_protocol,
+                self.cfg.bandwidth.require_tickets,
+                derive_aes256_gcm_siv_key,
                 #[cfg(not(target_arch = "wasm32"))]
                 self.shutdown_token.clone(),
             )
@@ -494,35 +521,99 @@ impl<C, St> GatewayClient<C, St> {
             _ => return Err(GatewayClientError::ConnectionInInvalidState),
         }?;
 
-        let authentication_status = match self.read_control_response().await? {
+        let (authentication_status, gateway_protocol) = match self.read_control_response().await? {
             ServerResponse::Register {
+                protocol_version,
                 status,
-                upgrade_mode,
-                ..
-            } => {
-                if upgrade_mode {
-                    warn!("the system is currently undergoing an upgrade. some of its functionalities might be unstable")
-                }
-                status
-            }
+            } => (status, protocol_version),
             ServerResponse::Error { message } => {
                 return Err(GatewayClientError::GatewayError(message))
             }
             other => return Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         };
 
+        self.check_gateway_protocol(gateway_protocol)?;
         self.authenticated = authentication_status;
 
         if self.authenticated {
-            self.shared_key = Some(Arc::new(handshake_result.derived_key));
+            self.shared_key = Some(Arc::new(shared_key));
         }
 
         // populate the negotiated protocol for future uses
-        self.negotiated_protocol = Some(handshake_result.negotiated_protocol);
+        self.negotiated_protocol = gateway_protocol;
 
         Ok(())
     }
 
+    pub async fn upgrade_key_authenticated(
+        &mut self,
+    ) -> Result<Zeroizing<SharedSymmetricKey>, GatewayClientError> {
+        info!("*** STARTING AES128CTR-HMAC KEY UPGRADE INTO AES256GCM-SIV***");
+
+        if !self.connection.is_established() {
+            return Err(GatewayClientError::ConnectionNotEstablished);
+        }
+
+        if !self.authenticated {
+            return Err(GatewayClientError::NotAuthenticated);
+        }
+
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        if !shared_key.is_legacy() {
+            return Err(GatewayClientError::KeyAlreadyUpgraded);
+        }
+
+        // make sure we have the only reference, so we could safely swap it
+        if Arc::strong_count(shared_key) != 1 {
+            return Err(GatewayClientError::KeyAlreadyInUse);
+        }
+
+        assert!(shared_key.is_legacy());
+        let legacy_key = shared_key.unwrap_legacy();
+        let (updated_key, hkdf_salt) = legacy_key.upgrade();
+        let derived_key_digest = updated_key.digest();
+
+        let upgrade_request = ClientRequest::UpgradeKey {
+            hkdf_salt,
+            derived_key_digest,
+        }
+        .encrypt(legacy_key)?;
+
+        info!("sending upgrade request and awaiting the acknowledgement back");
+        let (ciphertext, nonce) = match self
+            .send_websocket_message_with_response(upgrade_request)
+            .await?
+        {
+            ServerResponse::EncryptedResponse { ciphertext, nonce } => (ciphertext, nonce),
+            ServerResponse::Error { message } => {
+                return Err(GatewayClientError::GatewayError(message))
+            }
+            other => return Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
+        };
+
+        // attempt to decrypt it using NEW key
+        let Ok(response) = SensitiveServerResponse::decrypt(&ciphertext, &nonce, &updated_key)
+        else {
+            return Err(GatewayClientError::FatalKeyUpgradeFailure);
+        };
+
+        match response {
+            SensitiveServerResponse::KeyUpgradeAck { .. } => {
+                info!("received key upgrade acknowledgement")
+            }
+            _ => return Err(GatewayClientError::FatalKeyUpgradeFailure),
+        }
+
+        // perform in memory swap and make a copy for updating storage
+        let zeroizing_updated_key = updated_key.zeroizing_clone();
+        self.shared_key = Some(Arc::new(updated_key.into()));
+
+        Ok(zeroizing_updated_key)
+    }
+
     async fn send_authenticate_request_and_handle_response(
         &mut self,
         msg: ClientControlRequest,
@@ -532,21 +623,13 @@ impl<C, St> GatewayClient<C, St> {
                 protocol_version,
                 status,
                 bandwidth_remaining,
-                upgrade_mode,
             } => {
-                if protocol_version.is_future_version() {
-                    error!("the gateway insists on using v{protocol_version} protocol which is not supported by this client");
-                    return Err(GatewayClientError::AuthenticationFailure);
-                }
+                self.check_gateway_protocol(protocol_version)?;
                 self.authenticated = status;
-                self.bandwidth
-                    .update_and_maybe_log(bandwidth_remaining, upgrade_mode);
+                self.bandwidth.update_and_maybe_log(bandwidth_remaining);
 
-                self.negotiated_protocol = Some(protocol_version);
+                self.negotiated_protocol = protocol_version;
                 log::debug!("authenticated: {status}, bandwidth remaining: {bandwidth_remaining}");
-                if upgrade_mode {
-                    warn!("the system is currently undergoing an upgrade. some of its functionalities might be unstable")
-                }
 
                 Ok(())
             }
@@ -555,42 +638,56 @@ impl<C, St> GatewayClient<C, St> {
         }
     }
 
-    async fn authenticate_v2(
-        &mut self,
-        requested_protocol_version: GatewayProtocolVersion,
-    ) -> Result<(), GatewayClientError> {
-        debug!("using v2 authentication");
+    async fn authenticate_v1(&mut self) -> Result<(), GatewayClientError> {
+        debug!("using v1 authentication");
+
         let Some(shared_key) = self.shared_key.as_ref() else {
             return Err(GatewayClientError::NoSharedKeyAvailable);
         };
 
-        let msg = ClientControlRequest::new_authenticate_v2(
+        let self_address = self
+            .local_identity
+            .public_key()
+            .derive_destination_address();
+
+        let msg = ClientControlRequest::new_authenticate(
+            self_address,
             shared_key,
-            &self.local_identity,
-            requested_protocol_version,
+            self.cfg.bandwidth.require_tickets,
         )?;
         self.send_authenticate_request_and_handle_response(msg)
             .await
     }
 
-    async fn authenticate(
-        &mut self,
-        requested_protocol_version: GatewayProtocolVersion,
-    ) -> Result<(), GatewayClientError> {
+    async fn authenticate_v2(&mut self) -> Result<(), GatewayClientError> {
+        debug!("using v2 authentication");
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        let msg = ClientControlRequest::new_authenticate_v2(shared_key, &self.local_identity)?;
+        self.send_authenticate_request_and_handle_response(msg)
+            .await
+    }
+
+    async fn authenticate(&mut self, use_v2: bool) -> Result<(), GatewayClientError> {
         if !self.connection.is_established() {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
         debug!("authenticating with gateway");
 
-        // use the highest possible protocol version the gateway has announced support for
-        self.authenticate_v2(requested_protocol_version).await
+        if use_v2 {
+            self.authenticate_v2().await
+        } else {
+            self.authenticate_v1().await
+        }
     }
 
     /// Helper method to either call register or authenticate based on self.shared_key value
     #[instrument(skip_all,
         fields(
             gateway = %self.gateway_identity,
-            gateway_address = %self.gateway_addresses.primary
+            gateway_address = %self.gateway_address
         )
     )]
     pub async fn perform_initial_authentication(
@@ -601,16 +698,19 @@ impl<C, St> GatewayClient<C, St> {
         }
 
         // 1. check gateway's protocol version
-        // if we failed to get this request resolved, it means the gateway is on an old version
-        // that definitely does not support auth v2 or aes256gcm, so we bail
-        let gw_protocol = self.get_gateway_protocol().await?;
-
-        debug!("supported gateway protocol: {gw_protocol:?}");
+        let gw_protocol = match self.get_gateway_protocol().await {
+            Ok(protocol) => Some(protocol),
+            Err(_) => {
+                // if we failed to send the request, it means the gateway is running the old binary,
+                // so it has reset our connection - we have to reconnect
+                self.establish_connection().await?;
+                None
+            }
+        };
 
         let supports_aes_gcm_siv = gw_protocol.supports_aes256_gcm_siv();
         let supports_auth_v2 = gw_protocol.supports_authenticate_v2();
         let supports_key_rotation_info = gw_protocol.supports_key_rotation_packet();
-        let supports_upgrade_mode = gw_protocol.supports_upgrade_mode();
 
         if !supports_aes_gcm_siv {
             warn!("this gateway is on an old version that doesn't support AES256-GCM-SIV");
@@ -618,35 +718,16 @@ impl<C, St> GatewayClient<C, St> {
         if !supports_auth_v2 {
             warn!("this gateway is on an old version that doesn't support authentication v2")
         }
-
-        // Dropping v1 support
-        if !supports_auth_v2 || !supports_aes_gcm_siv {
-            // we can't continue
-            return Err(GatewayClientError::IncompatibleProtocol {
-                gateway: gw_protocol,
-                current: CURRENT_PROTOCOL_VERSION,
-            });
-        }
-
         if !supports_key_rotation_info {
             warn!("this gateway is on an old version that doesn't support key rotation packets")
         }
-        if !supports_upgrade_mode {
-            warn!("this gateway is on an old version that doesn't support upgrade mode")
-        }
-
-        let gw_protocol = if gw_protocol.is_future_version() {
-            warn!("we're running outdated software as gateway is announcing protocol {gw_protocol:?} whilst we're using {}. we're going to attempt to downgrade", GatewayProtocolVersion::CURRENT);
-            GatewayProtocolVersion::CURRENT
-        } else {
-            gw_protocol
-        };
 
         if self.authenticated {
             debug!("Already authenticated");
             return if let Some(shared_key) = &self.shared_key {
                 Ok(AuthenticationResponse {
                     initial_shared_key: Arc::clone(shared_key),
+                    requires_key_upgrade: shared_key.is_legacy() && supports_aes_gcm_siv,
                 })
             } else {
                 Err(GatewayClientError::AuthenticationFailureWithPreexistingSharedKey)
@@ -654,30 +735,32 @@ impl<C, St> GatewayClient<C, St> {
         }
 
         if self.shared_key.is_some() {
-            self.authenticate(gw_protocol).await?;
+            self.authenticate(supports_auth_v2).await?;
 
             if self.authenticated {
                 // if we are authenticated it means we MUST have an associated shared_key
-                #[allow(clippy::unwrap_used)]
                 let shared_key = self.shared_key.as_ref().unwrap();
 
+                let requires_key_upgrade = shared_key.is_legacy() && supports_aes_gcm_siv;
+
                 Ok(AuthenticationResponse {
                     initial_shared_key: Arc::clone(shared_key),
+                    requires_key_upgrade,
                 })
             } else {
                 Err(GatewayClientError::AuthenticationFailure)
             }
         } else {
-            self.register(gw_protocol).await?;
+            self.register(supports_aes_gcm_siv).await?;
 
             // if registration didn't return an error, we MUST have an associated shared key
-            #[allow(clippy::unwrap_used)]
             let shared_key = self.shared_key.as_ref().unwrap();
 
             // we're always registering with the highest supported protocol,
             // so no upgrades are required
             Ok(AuthenticationResponse {
                 initial_shared_key: Arc::clone(shared_key),
+                requires_key_upgrade: false,
             })
         }
     }
@@ -700,81 +783,51 @@ impl<C, St> GatewayClient<C, St> {
         }
     }
 
-    async fn wait_for_bandwidth_response(
+    async fn claim_ecash_bandwidth(
         &mut self,
-        msg: ClientControlRequest,
-    ) -> Result<BandwidthResponse, GatewayClientError> {
-        let response = match self
+        credential: CredentialSpendingData,
+    ) -> Result<(), GatewayClientError> {
+        let msg = ClientControlRequest::new_enc_ecash_credential(
+            credential,
+            self.shared_key.as_ref().unwrap(),
+        )?;
+        let bandwidth_remaining = match self
             .send_websocket_message_with_non_send_response(msg)
             .await?
         {
-            ServerResponse::Bandwidth(response) => {
-                if response.upgrade_mode {
-                    info!("the system is currently undergoing an upgrade. our bandwidth shouldn't have been metered")
-                }
-                Ok(response)
-            }
+            ServerResponse::Bandwidth { available_total } => Ok(available_total),
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
             ServerResponse::TypedError { error } => {
                 Err(GatewayClientError::TypedGatewayError(error))
             }
             other => Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         }?;
-        Ok(response)
-    }
-
-    async fn claim_ecash_bandwidth(
-        &mut self,
-        credential: CredentialSpendingData,
-    ) -> Result<(), GatewayClientError> {
-        // SAFETY: claiming ecash bandwidth is called as part of `claim_bandwidth` which
-        // ensures the shared key is defined
-        #[allow(clippy::unwrap_used)]
-        let msg = ClientControlRequest::new_enc_ecash_credential(
-            credential,
-            self.shared_key.as_ref().unwrap(),
-        )?;
-        let response = self.wait_for_bandwidth_response(msg).await?;
 
         // TODO: create tracing span
         info!("managed to claim ecash bandwidth");
-        self.bandwidth
-            .update_and_log(response.available_total, response.upgrade_mode);
-
-        Ok(())
-    }
-
-    pub async fn send_upgrade_mode_jwt(&mut self, token: String) -> Result<(), GatewayClientError> {
-        let msg = ClientControlRequest::new_upgrade_mode_jwt(token);
-        let response = self.wait_for_bandwidth_response(msg).await?;
-
-        // if gateway rejected our jwt, we would have returned an error
-        info!("gateway has accepted our jwt");
-        if !response.upgrade_mode {
-            error!("but we're not in upgrade mode - something is wrong!");
-            return Err(GatewayClientError::UnexpectedUpgradeModeState);
-        }
-
-        self.bandwidth
-            .update_and_log(response.available_total, response.upgrade_mode);
+        self.bandwidth.update_and_log(bandwidth_remaining);
 
         Ok(())
     }
 
     async fn try_claim_testnet_bandwidth(&mut self) -> Result<(), GatewayClientError> {
         let msg = ClientControlRequest::ClaimFreeTestnetBandwidth;
-        let response = self.wait_for_bandwidth_response(msg).await?;
+        let bandwidth_remaining = match self
+            .send_websocket_message_with_non_send_response(msg)
+            .await?
+        {
+            ServerResponse::Bandwidth { available_total } => Ok(available_total),
+            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
+            other => Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
+        }?;
 
         info!("managed to claim testnet bandwidth");
-        self.bandwidth
-            .update_and_log(response.available_total, response.upgrade_mode);
+        self.bandwidth.update_and_log(bandwidth_remaining);
 
         Ok(())
     }
 
     fn unchecked_bandwidth_controller(&self) -> &BandwidthController<C, St> {
-        // this is an unchecked method
-        #[allow(clippy::unwrap_used)]
         self.bandwidth_controller.as_ref().unwrap()
     }
 
@@ -866,7 +919,6 @@ impl<C, St> GatewayClient<C, St> {
             BinaryRequest::ForwardSphinx { packet }
         };
 
-        #[allow(clippy::expect_used)]
         req.into_ws_message(
             self.shared_key
                 .as_ref()
@@ -973,8 +1025,6 @@ impl<C, St> GatewayClient<C, St> {
         self.send_with_reconnection_on_failure(msg).await
     }
 
-    // SAFETY: this method is only called when the connection is in `PartiallyDelegated` state
-    #[allow(clippy::unreachable)]
     async fn recover_socket_connection(&mut self) -> Result<(), GatewayClientError> {
         if self.connection.is_available() {
             return Ok(());
@@ -1004,7 +1054,6 @@ impl<C, St> GatewayClient<C, St> {
             return Err(GatewayClientError::ConnectionInInvalidState);
         }
 
-        #[allow(clippy::expect_used)]
         let partially_delegated =
             match std::mem::replace(&mut self.connection, SocketState::Invalid) {
                 SocketState::Available(conn) => {
@@ -1020,13 +1069,7 @@ impl<C, St> GatewayClient<C, St> {
                         self.shutdown_token.clone(),
                     )
                 }
-                other => {
-                    error!(
-                        "attempted to start mixnet listener whilst the connection is in {} state!",
-                        other.name()
-                    );
-                    return Err(GatewayClientError::ConnectionInInvalidState);
-                }
+                _ => unreachable!(),
             };
 
         self.connection = SocketState::PartiallyDelegated(partially_delegated);
@@ -1039,12 +1082,8 @@ impl<C, St> GatewayClient<C, St> {
         }
 
         // if we're reconnecting, because we lost connection, we need to re-authenticate the connection
-        if let Some(negotiated_protocol) = self.negotiated_protocol {
-            self.authenticate(negotiated_protocol).await?;
-        } else {
-            // This should never happen, because it would mean we're not registered
-            return Err(GatewayClientError::NotRegistered);
-        }
+        self.authenticate(self.negotiated_protocol.supports_authenticate_v2())
+            .await?;
 
         // this call is NON-blocking
         self.start_listening_for_mixnet_messages()?;
@@ -1089,7 +1128,7 @@ pub struct InitOnly;
 impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
     // for initialisation we do not need credential storage. Though it's still a bit weird we have to set the generic...
     pub fn new_init(
-        gateway_listeners: GatewayListeners,
+        gateway_listener: Url,
         gateway_identity: ed25519::PublicKey,
         local_identity: Arc<ed25519::KeyPair>,
         #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
@@ -1108,7 +1147,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
             cfg: GatewayClientConfig::default().with_disabled_credentials_mode(true),
             authenticated: false,
             bandwidth: ClientBandwidth::new_empty(),
-            gateway_addresses: gateway_listeners,
+            gateway_address: gateway_listener.to_string(),
             gateway_identity,
             local_identity,
             shared_key: None,
@@ -1140,7 +1179,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
             cfg: self.cfg,
             authenticated: self.authenticated,
             bandwidth: self.bandwidth,
-            gateway_addresses: self.gateway_addresses,
+            gateway_address: self.gateway_address,
             gateway_identity: self.gateway_identity,
             local_identity: self.local_identity,
             shared_key: self.shared_key,

common/client-libs/gateway-client/src/client/websockets.rs

@@ -1,5 +1,3 @@
-#[cfg(not(target_arch = "wasm32"))]
-use crate::client::GatewayListeners;
 use crate::error::GatewayClientError;
 
 use nym_http_api_client::HickoryDnsResolver;
@@ -41,6 +39,7 @@ pub(crate) async fn connect_async(
             resolver
                 .resolve_str(domain)
                 .await?
+                .into_iter()
                 .map(|a| SocketAddr::new(a, port))
                 .collect()
         }
@@ -87,35 +86,3 @@ pub(crate) async fn connect_async(
             source: Box::new(error),
         })
 }
-
-#[cfg(not(target_arch = "wasm32"))]
-pub(crate) async fn connect_async_with_fallback(
-    endpoints: &GatewayListeners,
-    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
-) -> Result<(WebSocketStream<MaybeTlsStream<TcpStream>>, Response), GatewayClientError> {
-    match connect_async(
-        endpoints.primary.as_ref(),
-        #[cfg(unix)]
-        connection_fd_callback.clone(),
-    )
-    .await
-    {
-        Ok(inner) => Ok(inner),
-        Err(e) => {
-            if let Some(fallback) = &endpoints.fallback {
-                tracing::warn!(
-                    "Main endpoint failed {} : {e}, trying fallback : {fallback}",
-                    endpoints.primary
-                );
-                connect_async(
-                    fallback.as_ref(),
-                    #[cfg(unix)]
-                    connection_fd_callback,
-                )
-                .await
-            } else {
-                Err(e)
-            }
-        }
-    }
-}

common/client-libs/gateway-client/src/error.rs

@@ -54,7 +54,7 @@ pub enum GatewayClientError {
 
     #[cfg(not(target_arch = "wasm32"))]
     #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
+    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),
 
     #[error("No shared key was provided or obtained")]
     NoSharedKeyAvailable,
@@ -83,9 +83,6 @@ pub enum GatewayClientError {
     #[error("Client is not authenticated")]
     NotAuthenticated,
 
-    #[error("Client is not registered")]
-    NotRegistered,
-
     #[error("Client does not have enough bandwidth: estimated {0}, remaining: {1}")]
     NotEnoughBandwidth(i64, i64),
 
@@ -119,8 +116,8 @@ pub enum GatewayClientError {
     #[error("Failed to send mixnet message")]
     MixnetMsgSenderFailedToSend,
 
-    #[error("Attempted to negotiate connection with gateway using incompatible protocol version. Ours is {current} and the gateway reports {gateway}")]
-    IncompatibleProtocol { gateway: u8, current: u8 },
+    #[error("Attempted to negotiate connection with gateway using incompatible protocol version. Ours is {current} and the gateway reports {gateway:?}")]
+    IncompatibleProtocol { gateway: Option<u8>, current: u8 },
 
     #[error(
         "The packet router hasn't been set - are you sure you started up the client correctly?"
@@ -131,9 +128,6 @@ pub enum GatewayClientError {
         "this operation couldn't be completed as the program is in the process of shutting down"
     )]
     ShutdownInProgress,
-
-    #[error("the system is an unexpected upgrade mode state")]
-    UnexpectedUpgradeModeState,
 }
 
 impl From<WsError> for GatewayClientError {

common/client-libs/gateway-client/src/lib.rs

@@ -7,7 +7,9 @@ use tracing::{error, warn};
 use tungstenite::{protocol::Message, Error as WsError};
 
 pub use client::{config::GatewayClientConfig, GatewayClient, GatewayConfig};
-pub use nym_gateway_requests::shared_key::SharedSymmetricKey;
+pub use nym_gateway_requests::shared_key::{
+    LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey,
+};
 pub use packet_router::{
     AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
     PacketRouter,
@@ -45,7 +47,7 @@ pub(crate) fn cleanup_socket_messages(
 
 pub(crate) fn try_decrypt_binary_message(
     bin_msg: Vec<u8>,
-    shared_keys: &SharedSymmetricKey,
+    shared_keys: &SharedGatewayKey,
 ) -> Option<Vec<u8>> {
     match BinaryResponse::try_from_encrypted_tagged_bytes(bin_msg, shared_keys) {
         Ok(bin_response) => match bin_response {

common/client-libs/gateway-client/src/packet_router.rs

@@ -35,7 +35,6 @@ impl PacketRouter {
         }
     }
 
-    #[allow(clippy::panic)]
     pub fn route_mixnet_messages(
         &self,
         received_messages: Vec<Vec<u8>>,
@@ -55,7 +54,6 @@ impl PacketRouter {
         Ok(())
     }
 
-    #[allow(clippy::panic)]
     pub fn route_acks(&self, received_acks: Vec<Vec<u8>>) -> Result<(), GatewayClientError> {
         if let Err(err) = self.ack_sender.unbounded_send(received_acks) {
             // check if the failure is due to the shutdown being in progress and thus the receiver channel

common/client-libs/gateway-client/src/socket_state.rs

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::bandwidth::ClientBandwidth;
-use crate::client::config::BandwidthTickets;
 use crate::error::GatewayClientError;
 use crate::packet_router::PacketRouter;
 use crate::traits::GatewayPacketRouter;
@@ -10,10 +9,8 @@ use crate::{cleanup_socket_messages, try_decrypt_binary_message};
 use futures::channel::oneshot;
 use futures::stream::{SplitSink, SplitStream};
 use futures::{SinkExt, StreamExt};
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
-use nym_gateway_requests::{
-    SendResponse, SensitiveServerResponse, ServerResponse, SimpleGatewayRequestsError,
-};
+use nym_gateway_requests::shared_key::SharedGatewayKey;
+use nym_gateway_requests::{SensitiveServerResponse, ServerResponse, SimpleGatewayRequestsError};
 use nym_task::ShutdownToken;
 use si_scale::helpers::bibytes2;
 use std::os::raw::c_int as RawFd;
@@ -66,7 +63,7 @@ pub(crate) struct PartiallyDelegatedHandle {
 
 struct PartiallyDelegatedRouter {
     packet_router: PacketRouter,
-    shared_key: Arc<SharedSymmetricKey>,
+    shared_key: Arc<SharedGatewayKey>,
     client_bandwidth: ClientBandwidth,
 
     stream_return: SplitStreamSender,
@@ -76,7 +73,7 @@ struct PartiallyDelegatedRouter {
 impl PartiallyDelegatedRouter {
     fn new(
         packet_router: PacketRouter,
-        shared_key: Arc<SharedSymmetricKey>,
+        shared_key: Arc<SharedGatewayKey>,
         client_bandwidth: ClientBandwidth,
         stream_return: SplitStreamSender,
         stream_return_requester: oneshot::Receiver<()>,
@@ -157,12 +154,11 @@ impl PartiallyDelegatedRouter {
     fn handle_text_message(&self, text: String) -> Result<(), GatewayClientError> {
         // if we fail to deserialise the response, return a hard error. we can't handle garbage
         match ServerResponse::try_from(text).map_err(|_| GatewayClientError::MalformedResponse)? {
-            ServerResponse::Send(SendResponse {
+            ServerResponse::Send {
                 remaining_bandwidth,
-                upgrade_mode,
-            }) => {
+            } => {
                 self.client_bandwidth
-                    .update_and_maybe_log(remaining_bandwidth, upgrade_mode);
+                    .update_and_maybe_log(remaining_bandwidth);
                 Ok(())
             }
             ServerResponse::Error { message } => {
@@ -178,20 +174,7 @@ impl PartiallyDelegatedRouter {
                         let available_bi2 = bibytes2(available as f64);
                         let required_bi2 = bibytes2(required as f64);
                         warn!("run out of bandwidth when attempting to send the message! we got {available_bi2} available, but needed at least {required_bi2} to send the previous message");
-                        // if we run out of bandwidth (and tried to send reasonable amount of data),
-                        // the upgrade mode is implicitly disabled, as otherwise we would have been
-                        // to proceed
-                        let upgrade_mode = if available
-                            < BandwidthTickets::DEFAULT_REMAINING_BANDWIDTH_THRESHOLD
-                        {
-                            Some(false)
-                        } else {
-                            // we were attempting to send a lot of data at once
-                            // - we have no certainty about upgrade mode at this point
-                            None
-                        };
-                        self.client_bandwidth
-                            .update_and_log(available, upgrade_mode);
+                        self.client_bandwidth.update_and_log(available);
                         // UNIMPLEMENTED: we should stop sending messages until we recover bandwidth
                         Ok(())
                     }
@@ -214,6 +197,11 @@ impl PartiallyDelegatedRouter {
                         SensitiveServerResponse::RememberMeAck {} => {
                             info!("received remember me acknowledgement");
                         }
+                        SensitiveServerResponse::KeyUpgradeAck {} => {
+                            warn!(
+                                    "received illegal key upgrade acknowledgement in an authenticated client"
+                                );
+                        }
                         _ => {
                             warn!("received unknown SensitiveServerResponse");
                         }
@@ -289,7 +277,7 @@ impl PartiallyDelegatedHandle {
     pub(crate) fn split_and_listen_for_mixnet_messages(
         conn: WsConn,
         packet_router: PacketRouter,
-        shared_key: Arc<SharedSymmetricKey>,
+        shared_key: Arc<SharedGatewayKey>,
         client_bandwidth: ClientBandwidth,
         shutdown: ShutdownToken,
     ) -> Self {
@@ -339,7 +327,6 @@ impl PartiallyDelegatedHandle {
         Ok(self.sink_half.send_all(&mut send_stream).await?)
     }
 
-    #[allow(clippy::panic)]
     pub(crate) async fn merge(self) -> Result<WsConn, GatewayClientError> {
         let (mut stream_receiver, notify) = self.delegated_stream;
 
@@ -368,10 +355,8 @@ impl PartiallyDelegatedHandle {
             // in receive_res
             .map_err(|_| GatewayClientError::ConnectionAbruptlyClosed)?;
         let stream = stream_results?;
-
         // the error is thrown when trying to reunite sink and stream that did not originate
         // from the same split which is impossible to happen here
-        #[allow(clippy::unwrap_used)]
         Ok(self.sink_half.reunite(stream).unwrap())
     }
 }
@@ -402,13 +387,4 @@ impl SocketState {
             SocketState::Available(_) | SocketState::PartiallyDelegated(_)
         )
     }
-
-    pub(crate) fn name(&self) -> &'static str {
-        match self {
-            SocketState::Available(_) => "available",
-            SocketState::PartiallyDelegated(_) => "partially delegated",
-            SocketState::NotConnected => "not connected",
-            SocketState::Invalid => "invalid",
-        }
-    }
 }