Build and Push CI (#4887)

* changelog for patched release

* fix typo

.github/workflows/build-deb-meta.yml

@@ -5,5 +5,35 @@ on:
 
 jobs:
   build:
+    runs-on: arc-ubuntu-22.04
+
     steps:
-      run: "echo hello"
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Set up Build Environment
+        run: sudo apt-get update && sudo apt-get install -y make dpkg-dev
+
+      - name: Build Debian Packages
+        working-directory: ppa/packages
+        run: make
+
+      - name: Find .deb files
+        working-directory: ppa/packages
+        run: |
+          echo "file1=$(ls nym-repo-setup*.deb)" >> $GITHUB_ENV
+          echo "file2=$(ls nym-vpn*.deb)" >> $GITHUB_ENV
+
+      - name: Upload nym-repo-setup
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.file1 }}
+          path: ppa/packages/nym-repo-setup*.deb
+          retention-days: 10
+
+      - name: Upload nym-vpn
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.file2 }}
+          path: ppa/packages/nym-vpn*.deb
+          retention-days: 10

.github/workflows/ci-binary-config-checker.yml

@@ -13,6 +13,7 @@ on:
       - 'mixnode/**'
       - 'sdk/rust/nym-sdk/**'
       - 'service-providers/**'
+      - '.github/workflows/ci-binary-config-checker.yml'
   pull_request:
     paths:
       - 'clients/**'
@@ -22,6 +23,7 @@ on:
       - 'mixnode/**'
       - 'sdk/rust/nym-sdk/**'
       - 'service-providers/**'
+      - '.github/workflows/ci-binary-config-checker.yml'
 
 env:
   NETWORK: mainnet
@@ -31,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [custom-linux]
+        platform: [arc-ubuntu-20.04]
 
     runs-on: ${{ matrix.platform }}
     steps:

.github/workflows/ci-build-ts.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - "ts-packages/**"
       - "sdk/typescript/**"
+      - ".github/workflows/ci-build-ts.yml"
 
 jobs:
   build:

.github/workflows/ci-build-upload-binaries.yml

@@ -31,13 +31,14 @@ on:
       - "service-providers/**"
       - "tools/**"
       - "nymvisor/**"
+      - ".github/workflows/ci-build-upload-binaries.yml"
 
 jobs:
   publish-nym:
     strategy:
       fail-fast: false
       matrix:
-        platform: [ ubuntu-20.04 ]
+        platform: [ arc-ubuntu-20.04 ]
 
     runs-on: ${{ matrix.platform }}
     env:
@@ -62,10 +63,6 @@ jobs:
           echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
         if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
 
-      - name: Set CARGO_FEATURES
-        run: |
-          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:

.github/workflows/ci-build.yml

@@ -1,23 +1,6 @@
 name: ci-build
 
 on:
-  push:
-    paths:
-      - 'clients/**'
-      - 'common/**'
-      - 'explorer-api/**'
-      - 'gateway/**'
-      - 'integrations/**'
-      - 'mixnode/**'
-      - 'sdk/lib/socks5-listener/**'
-      - 'sdk/rust/nym-sdk/**'
-      - 'service-providers/**'
-      - 'nym-api/**'
-      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/nym-nr-query/**'
-      - 'tools/ts-rs-cli/**'
-      - 'Cargo.toml'
   pull_request:
     paths:
       - 'clients/**'
@@ -26,15 +9,19 @@ on:
       - 'gateway/**'
       - 'integrations/**'
       - 'mixnode/**'
-      - 'sdk/lib/socks5-listener/**'
-      - 'sdk/rust/nym-sdk/**'
+      - 'sdk/rust/**'
+      - 'sdk/lib/**'
       - 'service-providers/**'
+      - 'nym-network-monitor/**'
       - 'nym-api/**'
+      - 'nym-node/**'
       - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/nym-nr-query/**'
-      - 'tools/ts-rs-cli/**'
+      - 'nym-validator-rewarder/**'
+      - 'tools/**'
+      - 'wasm/**'
       - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/ci-build.yml'
   workflow_dispatch:
 
 jobs:
@@ -42,7 +29,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [custom-linux, custom-runner-mac-m1]
+        os: [arc-ubuntu-20.04, custom-runner-mac-m1]
     runs-on: ${{ matrix.os }}
     env:
       CARGO_TERM_COLOR: always
@@ -50,7 +37,7 @@ jobs:
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
         continue-on-error: true
-        if: matrix.os == 'custom-linux'
+        if: contains(matrix.os, 'ubuntu')
 
       - name: Check out repository code
         uses: actions/checkout@v4
@@ -73,8 +60,6 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
-          # Enable wireguard by default on linux only
-          args: --workspace --features wireguard
 
       # while disabled by default, this build ensures nothing is broken within
       # `axum` feature
@@ -85,36 +70,36 @@ jobs:
           args: --features axum
 
       - name: Build all examples
-        if: matrix.os == 'custom-linux'
+        if: contains(matrix.os, 'ubuntu')
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: --workspace --examples --features wireguard
+          args: --workspace --examples
 
       - name: Run all tests
-        if: matrix.os == 'custom-linux'
+        if: contains(matrix.os, 'ubuntu')
         uses: actions-rs/cargo@v1
         with:
           command: test
-          args: --workspace --features wireguard
+          args: --workspace
 
       - name: Run expensive tests
-        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && matrix.os == 'custom-linux'
+        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && contains(matrix.os, 'ubuntu')
         uses: actions-rs/cargo@v1
         with:
           command: test
-          args: --workspace --features wireguard -- --ignored
+          args: --workspace -- --ignored
 
       - name: Annotate with clippy checks
-        if: matrix.os == 'custom-linux'
+        if: contains(matrix.os, 'ubuntu')
         uses: actions-rs/clippy-check@v1
         continue-on-error: true
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          args: --workspace --features wireguard
+          args: --workspace
 
       - name: Clippy
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --workspace --all-targets --features wireguard,axum -- -D warnings
+          args: --workspace --all-targets --features axum -- -D warnings

.github/workflows/ci-cargo-deny.yml

@@ -2,10 +2,14 @@ name: ci-cargo-deny
 on:
   workflow_dispatch:
   pull_request:
+    paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/ci-cargo-deny.yml'
 
 jobs:
   cargo-deny:
-    runs-on: ubuntu-22.04
+    runs-on: arc-ubuntu-22.04-dind
     strategy:
       matrix:
         checks:

.github/workflows/ci-contracts-schema.yml

@@ -6,11 +6,12 @@ on:
     paths:
       - 'contracts/**'
       - 'common/**'
+      - '.github/workflows/ci-contracts-schema.yml'
 
 jobs:
   check-schema:
     name: Generate and check schema
-    runs-on: custom-linux
+    runs-on: arc-ubuntu-20.04
     env:
       CARGO_TERM_COLOR: always
     steps:

.github/workflows/ci-contracts-upload-binaries.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'common/**'
       - 'contracts/**'
+      - '.github/workflows/ci-contracts-upload-binaries.yml'
 
 env:
   NETWORK: mainnet
@@ -15,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [ ubuntu-20.04 ]
+        platform: arc-ubuntu-20.04
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-contracts.yml

@@ -9,10 +9,11 @@ on:
     paths:
       - 'contracts/**'
       - 'common/**'
+      - '.github/workflows/ci-contracts.yml'
 
 jobs:
   matrix_prep:
-    runs-on: ubuntu-20.04
+    runs-on: arc-ubuntu-20.04
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:

.github/workflows/ci-docs.yml

@@ -6,6 +6,7 @@ on:
     branches-ignore: master
     paths:
       - 'documentation/docs/**'
+      - '.github/workflows/ci-docs.yml'
 
 jobs:
   build:

.github/workflows/ci-lint-typescript.yml

@@ -10,6 +10,7 @@ on:
       - "nym-wallet/src/**"
       - "nym-wallet/package.json"
       - "explorer/**"
+      - ".github/workflows/ci-lint-typescript.yml"
 
 jobs:
   build:

.github/workflows/ci-nym-network-explorer.yml

@@ -5,6 +5,7 @@ on:
   push:
     paths:
       - 'explorer/**'
+      - '.github/workflows/ci-nym-network-explorer.yml'
 
 defaults:
   run:

.github/workflows/ci-nym-wallet-rust.yml

@@ -1,22 +1,17 @@
 name: ci-nym-wallet-rust
 
 on:
-  push:
-    paths:
-      - 'nym-wallet/**'
-      - 'common/**'
-      - 'contracts/vesting/**'
-      - 'nym-api/nym-api-requests/**'
   pull_request:
     paths:
       - 'nym-wallet/**'
       - 'common/**'
       - 'contracts/vesting/**'
       - 'nym-api/nym-api-requests/**'
+      - '.github/workflows/ci-nym-wallet-rust.yml'
 
 jobs:
   build:
-    runs-on: [ self-hosted, custom-linux ]
+    runs-on: arc-ubuntu-20.04
     env:
       CARGO_TERM_COLOR: always
     steps:

.github/workflows/ci-nym-wallet-storybook.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     paths:
       - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-storybook.yml'
 
 jobs:
   build:

.github/workflows/ci-sdk-docs-typescript.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - "sdk/typescript/**"
       - "wasm/**"
+      - '.github/workflows/ci-sdk-docs-typescript.yml'
 
 jobs:
   build:

.github/workflows/ci-sdk-wasm.yml

@@ -6,10 +6,11 @@ on:
       - 'wasm/**'
       - 'clients/client-core/**'
       - 'common/**'
+      - '.github/workflows/ci-sdk-wasm.yml'
 
 jobs:
   wasm:
-    runs-on: [custom-linux]
+    runs-on: arc-ubuntu-20.04
     env:
       CARGO_TERM_COLOR: always
     steps:

.github/workflows/publish-nym-binaries.yml

@@ -51,10 +51,6 @@ jobs:
           echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
         if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
 
-      - name: Set CARGO_FEATURES
-        run: |
-          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:

.github/workflows/publish-nym-wallet-win11.yml

@@ -1,4 +1,4 @@
-name: publish-nym-wallet-win10
+name: publish-nym-wallet-win11
 on:
   workflow_dispatch:
   release:
@@ -14,7 +14,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [windows10]
+        platform: [custom-windows-11]
     runs-on: ${{ matrix.platform }}
 
     outputs:
@@ -62,6 +62,9 @@ jobs:
           fileName: '.env'
           encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}
 
+      - name: Install Yarn
+        run: npm install -g yarn
+
       - name: Install project dependencies
         shell: bash
         run: cd .. && yarn --network-timeout 100000

.github/workflows/push-network-monitor.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Network monitor container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "."
+  CONTAINER_NAME: "network-monitor"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from package.json
+        uses: sergeysova/jq-action@v2
+        id: get_version
+        with:
+          cmd: jq -r '.version' ${{ env.WORKING_DIRECTORY }}/package.json
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            git push --delete origin ${{ steps.get_version.outputs.value }}
+            git tag -d ${{ steps.get_version.outputs.value }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ steps.get_version.outputs.value }} -m "Version ${{ steps.get_version.outputs.value }}"
+          git push origin ${{ steps.get_version.outputs.value }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f nym-network-monitor.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.value }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

CHANGELOG.md

@@ -4,6 +4,60 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.10-caramello] (2024-09-10)
+
+- Backport 4844 and 4845 ([#4857])
+- Bugfix/client registration vol2 ([#4856])
+- Remove wireguard feature flag and pass runtime enabled flag ([#4839])
+- Eliminate cancel unsafe sig awaiting ([#4834])
+- added explicit updateable admin to the mixnet contract ([#4822])
+- using legacy signing payload in CLI and verifying both variants in contract ([#4821])
+- adding ecash contract address ([#4819])
+- Check profit margin of node before defaulting to hardcoded value  ([#4802])
+- Sync last_seen_bandwidth immediately ([#4774])
+- Feature/additional ecash nym cli utils ([#4773])
+- Better storage error logging ([#4772])
+- bugfix: make sure DKG parses data out of events if logs are empty ([#4764])
+- Fix clippy on rustc beta toolchain ([#4746])
+- Fix clippy for beta toolchain ([#4742])
+- Disable testnet-manager on non-unix ([#4741])
+- Don't set NYM_VPN_API to default ([#4740])
+- Update publish-nym-binaries.yml ([#4739])
+- Update ci-build-upload-binaries.yml ([#4738])
+- Add NYM_VPN_API to network config ([#4736])
+- Re-export RecipientFormattingError in nym sdk ([#4735])
+- Persist wireguard peers ([#4732])
+- Fix tokio error in 1.39 ([#4730])
+- Feature/vesting purge plus ranged cost params ([#4716])
+- Fix (some) feature unification build failures ([#4681])
+- Feature Compact Ecash : The One PR ([#4623])
+
+[#4857]: https://github.com/nymtech/nym/pull/4857
+[#4856]: https://github.com/nymtech/nym/pull/4856
+[#4839]: https://github.com/nymtech/nym/pull/4839
+[#4834]: https://github.com/nymtech/nym/pull/4834
+[#4822]: https://github.com/nymtech/nym/pull/4822
+[#4821]: https://github.com/nymtech/nym/pull/4821
+[#4819]: https://github.com/nymtech/nym/pull/4819
+[#4802]: https://github.com/nymtech/nym/pull/4802
+[#4774]: https://github.com/nymtech/nym/pull/4774
+[#4773]: https://github.com/nymtech/nym/pull/4773
+[#4772]: https://github.com/nymtech/nym/pull/4772
+[#4764]: https://github.com/nymtech/nym/pull/4764
+[#4746]: https://github.com/nymtech/nym/pull/4746
+[#4742]: https://github.com/nymtech/nym/pull/4742
+[#4741]: https://github.com/nymtech/nym/pull/4741
+[#4740]: https://github.com/nymtech/nym/pull/4740
+[#4739]: https://github.com/nymtech/nym/pull/4739
+[#4738]: https://github.com/nymtech/nym/pull/4738
+[#4736]: https://github.com/nymtech/nym/pull/4736
+[#4735]: https://github.com/nymtech/nym/pull/4735
+[#4732]: https://github.com/nymtech/nym/pull/4732
+[#4730]: https://github.com/nymtech/nym/pull/4730
+[#4716]: https://github.com/nymtech/nym/pull/4716
+[#4681]: https://github.com/nymtech/nym/pull/4681
+[#4623]: https://github.com/nymtech/nym/pull/4623
+
 ## [2024.9-topdeck] (2024-07-26)
 
 - chore: fix 1.80 lint issues ([#4731])

Cargo.toml

@@ -45,6 +45,7 @@ members = [
     "common/credentials",
     "common/credential-utils",
     "common/credentials-interface",
+    "common/credential-verification",
     "common/crypto",
     "common/dkg",
     "common/ecash-double-spending",
@@ -116,6 +117,8 @@ members = [
     "nym-validator-rewarder",
     "tools/internal/ssl-inject",
     # "tools/internal/sdk-version-bump",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
     "tools/nym-cli",
     "tools/nym-id-cli",
     "tools/nym-nr-query",
@@ -126,21 +129,21 @@ members = [
     "wasm/mix-fetch",
     "wasm/node-tester",
     "wasm/zknym-lib",
-    "tools/internal/testnet-manager",
-    "tools/internal/testnet-manager/dkg-bypass-contract",
 ]
 
 default-members = [
     "clients/native",
     "clients/socks5",
+    "explorer-api",
     "gateway",
-    "service-providers/network-requester",
     "mixnode",
     "nym-api",
-    "tools/nymvisor",
-    "explorer-api",
-    "nym-validator-rewarder",
     "nym-node",
+    "nym-validator-rewarder",
+    "service-providers/authenticator",
+    "service-providers/ip-packet-router",
+    "service-providers/network-requester",
+    "tools/nymvisor",
 ]
 
 exclude = [
@@ -166,9 +169,9 @@ readme = "README.md"
 addr = "0.15.6"
 aes = "0.8.1"
 aes-gcm = "0.10.1"
-anyhow = "1.0.71"
+anyhow = "1.0.87"
 argon2 = "0.5.0"
-async-trait = "0.1.81"
+async-trait = "0.1.82"
 axum = "0.7.5"
 axum-extra = "0.9.3"
 base64 = "0.22.1"
@@ -191,7 +194,7 @@ chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.31"
 cipher = "0.4.3"
-clap = "4.5.16"
+clap = "4.5.17"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.0"
@@ -200,7 +203,7 @@ console = "0.15.8"
 console-subscriber = "0.1.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
-const_format = "0.2.32"
+const_format = "0.2.33"
 criterion = "0.4"
 csv = "1.3.0"
 ctr = "0.9.1"
@@ -209,7 +212,7 @@ curve25519-dalek = "4.1"
 dashmap = "5.5.3"
 defguard_wireguard_rs = "0.4.2"
 digest = "0.10.7"
-dirs = "4.0"
+dirs = "5.0"
 doc-comment = "0.3"
 dotenvy = "0.15.6"
 ecdsa = "0.16"
@@ -252,7 +255,7 @@ okapi = "0.7.0"
 once_cell = "1.7.2"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
-parking_lot = "0.12.1"
+parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
 pin-project = "1.0"
@@ -260,9 +263,7 @@ pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
 quote = "1"
 rand = "0.8.5"
-rand-07 = "0.7.3"
 rand_chacha = "0.3"
-rand_chacha_02 = "0.2"
 rand_core = "0.6.3"
 rand_distr = "0.4"
 rand_pcg = "0.3.1"
@@ -274,12 +275,12 @@ rocket = "0.5.0"
 rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
 safer-ffi = "0.1.12"
-schemars = "0.8.1"
+schemars = "0.8.21"
 semver = "1.0.23"
-serde = "1.0.209"
+serde = "1.0.210"
 serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.127"
+serde_json = "1.0.128"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
@@ -287,20 +288,20 @@ sha2 = "0.10.8"
 si-scale = "0.2.3"
 sphinx-packet = "0.1.1"
 sqlx = "0.6.3"
-strum = "0.25"
+strum = "0.26"
 subtle-encoding = "0.5"
 syn = "1"
 sysinfo = "0.30.12"
 tap = "1.0.1"
-tar = "0.4.40"
+tar = "0.4.41"
 tempfile = "3.5.0"
 thiserror = "1.0.63"
 time = "0.3.30"
 tokio = "1.39"
-tokio-stream = "0.1.15"
+tokio-stream = "0.1.16"
 tokio-test = "0.4.4"
 tokio-tungstenite = { version = "0.20.1" }
-tokio-util = "0.7.11"
+tokio-util = "0.7.12"
 toml = "0.8.14"
 tower = "0.4.13"
 tower-http = "0.5.2"
@@ -318,7 +319,7 @@ utoipauto = "0.1"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
 walkdir = "2"
-wasm-bindgen-test = "0.3.36"
+wasm-bindgen-test = "0.3.43"
 x25519-dalek = "2.0.0"
 zeroize = "1.6.0"
 

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.39"
+version = "1.1.40"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/native/src/commands/ecash/import_coin_index_signatures.rs

@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::{
+    import_coin_index_signatures, CommonClientImportCoinIndexSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCoinIndexSignaturesArgs,
+) -> Result<(), ClientError> {
+    import_coin_index_signatures::<CliNativeClient, _>(args).await?;
+    println!("successfully imported coin index signatures!");
+    Ok(())
+}

clients/native/src/commands/ecash/import_credential.rs

@@ -4,10 +4,10 @@
 use crate::commands::CliNativeClient;
 use crate::error::ClientError;
 use nym_client_core::cli_helpers::client_import_credential::{
-    import_credential, CommonClientImportCredentialArgs,
+    import_credential, CommonClientImportTicketBookArgs,
 };
 
-pub(crate) async fn execute(args: CommonClientImportCredentialArgs) -> Result<(), ClientError> {
+pub(crate) async fn execute(args: CommonClientImportTicketBookArgs) -> Result<(), ClientError> {
     import_credential::<CliNativeClient, _>(args).await?;
     println!("successfully imported credential!");
     Ok(())

clients/native/src/commands/ecash/import_expiration_date_signatures.rs

@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::{
+    import_expiration_date_signatures, CommonClientImportExpirationDateSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportExpirationDateSignaturesArgs,
+) -> Result<(), ClientError> {
+    import_expiration_date_signatures::<CliNativeClient, _>(args).await?;
+    println!("successfully imported expiration date signatures!");
+    Ok(())
+}

clients/native/src/commands/ecash/import_master_verification_key.rs

@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_master_verification_key::{
+    import_master_verification_key, CommonClientImportMasterVerificationKeyArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportMasterVerificationKeyArgs,
+) -> Result<(), ClientError> {
+    import_master_verification_key::<CliNativeClient, _>(args).await?;
+    println!("successfully imported master verification key!");
+    Ok(())
+}

clients/native/src/commands/ecash/mod.rs

@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::CommonClientImportCoinIndexSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportTicketBookArgs;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::CommonClientImportExpirationDateSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_master_verification_key::CommonClientImportMasterVerificationKeyArgs;
+use std::error::Error;
+
+pub(crate) mod import_coin_index_signatures;
+pub(crate) mod import_credential;
+pub(crate) mod import_expiration_date_signatures;
+pub(crate) mod import_master_verification_key;
+pub(crate) mod show_ticketbooks;
+
+#[derive(Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct Ecash {
+    #[clap(subcommand)]
+    pub command: EcashCommands,
+}
+
+impl Ecash {
+    pub async fn execute(self) -> Result<(), Box<dyn Error + Send + Sync>> {
+        match self.command {
+            EcashCommands::ShowTicketBooks(args) => show_ticketbooks::execute(args).await?,
+            EcashCommands::ImportTicketBook(args) => import_credential::execute(args).await?,
+            EcashCommands::ImportCoinIndexSignatures(args) => {
+                import_coin_index_signatures::execute(args).await?
+            }
+            EcashCommands::ImportExpirationDateSignatures(args) => {
+                import_expiration_date_signatures::execute(args).await?
+            }
+            EcashCommands::ImportMasterVerificationKey(args) => {
+                import_master_verification_key::execute(args).await?
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Subcommand)]
+pub enum EcashCommands {
+    /// Display information associated with the imported ticketbooks,
+    ShowTicketBooks(show_ticketbooks::Args),
+
+    /// Import a pre-generated ticketbook
+    ImportTicketBook(CommonClientImportTicketBookArgs),
+
+    /// Import coin index signatures needed for ticketbooks
+    ImportCoinIndexSignatures(CommonClientImportCoinIndexSignaturesArgs),
+
+    /// Import expiration date signatures needed for ticketbooks
+    ImportExpirationDateSignatures(CommonClientImportExpirationDateSignaturesArgs),
+
+    /// Import master verification key needed for ticketbooks
+    ImportMasterVerificationKey(CommonClientImportMasterVerificationKeyArgs),
+}

clients/native/src/commands/mod.rs

@@ -6,13 +6,13 @@ use crate::client::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::client::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
 use crate::client::config::old_config_v1_1_33::ConfigV1_1_33;
 use crate::client::config::{BaseClientConfig, Config};
+use crate::commands::ecash::Ecash;
 use crate::error::ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_config::OptionalSet;
@@ -22,11 +22,10 @@ use std::sync::OnceLock;
 
 mod add_gateway;
 pub(crate) mod build_info;
-pub(crate) mod import_credential;
+pub(crate) mod ecash;
 pub(crate) mod init;
 mod list_gateways;
 pub(crate) mod run;
-mod show_ticketbooks;
 mod switch_gateway;
 
 pub(crate) struct CliNativeClient;
@@ -73,8 +72,8 @@ pub(crate) enum Commands {
     /// Run the Nym client with provided configuration client optionally overriding set parameters
     Run(run::Run),
 
-    /// Import a pre-generated credential
-    ImportCredential(CommonClientImportCredentialArgs),
+    /// Ecash-related functionalities
+    Ecash(Ecash),
 
     /// List all registered with gateways
     ListGateways(list_gateways::Args),
@@ -85,9 +84,6 @@ pub(crate) enum Commands {
     /// Change the currently active gateway. Note that you must have already registered with the new gateway!
     SwitchGateway(switch_gateway::Args),
 
-    /// Display information associated with the imported ticketbooks,
-    ShowTicketbooks(show_ticketbooks::Args),
-
     /// Show build information of this binary
     BuildInfo(build_info::BuildInfo),
 
@@ -116,11 +112,10 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
     match args.command {
         Commands::Init(m) => init::execute(m).await?,
         Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::Ecash(ecash) => ecash.execute().await?,
         Commands::ListGateways(args) => list_gateways::execute(args).await?,
         Commands::AddGateway(args) => add_gateway::execute(args).await?,
         Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
-        Commands::ShowTicketbooks(args) => show_ticketbooks::execute(args).await?,
         Commands::BuildInfo(m) => build_info::execute(m),
         Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
         Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.39"
+version = "1.1.40"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

clients/socks5/src/commands/ecash/import_coin_index_signatures.rs

@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::{
+    import_coin_index_signatures, CommonClientImportCoinIndexSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCoinIndexSignaturesArgs,
+) -> Result<(), Socks5ClientError> {
+    import_coin_index_signatures::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported coin index signatures!");
+    Ok(())
+}

clients/socks5/src/commands/ecash/import_credential.rs

@@ -4,12 +4,10 @@
 use crate::commands::CliSocks5Client;
 use crate::error::Socks5ClientError;
 use nym_client_core::cli_helpers::client_import_credential::{
-    import_credential, CommonClientImportCredentialArgs,
+    import_credential, CommonClientImportTicketBookArgs,
 };
 
-pub(crate) async fn execute(
-    args: CommonClientImportCredentialArgs,
-) -> Result<(), Socks5ClientError> {
+pub async fn execute(args: CommonClientImportTicketBookArgs) -> Result<(), Socks5ClientError> {
     import_credential::<CliSocks5Client, _>(args).await?;
     println!("successfully imported credential!");
     Ok(())

clients/socks5/src/commands/ecash/import_expiration_date_signatures.rs

@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::{
+    import_expiration_date_signatures, CommonClientImportExpirationDateSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportExpirationDateSignaturesArgs,
+) -> Result<(), Socks5ClientError> {
+    import_expiration_date_signatures::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported expiration date signatures!");
+    Ok(())
+}

clients/socks5/src/commands/ecash/import_master_verification_key.rs

@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_master_verification_key::{
+    import_master_verification_key, CommonClientImportMasterVerificationKeyArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportMasterVerificationKeyArgs,
+) -> Result<(), Socks5ClientError> {
+    import_master_verification_key::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported master verification key!");
+    Ok(())
+}

clients/socks5/src/commands/ecash/mod.rs

@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::CommonClientImportCoinIndexSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportTicketBookArgs;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::CommonClientImportExpirationDateSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_master_verification_key::CommonClientImportMasterVerificationKeyArgs;
+use std::error::Error;
+
+pub(crate) mod import_coin_index_signatures;
+pub(crate) mod import_credential;
+pub(crate) mod import_expiration_date_signatures;
+pub(crate) mod import_master_verification_key;
+pub(crate) mod show_ticketbooks;
+
+#[derive(Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct Ecash {
+    #[clap(subcommand)]
+    pub command: EcashCommands,
+}
+
+impl Ecash {
+    pub async fn execute(self) -> Result<(), Box<dyn Error + Send + Sync>> {
+        match self.command {
+            EcashCommands::ShowTicketBooks(args) => show_ticketbooks::execute(args).await?,
+            EcashCommands::ImportTicketBook(args) => import_credential::execute(args).await?,
+            EcashCommands::ImportCoinIndexSignatures(args) => {
+                import_coin_index_signatures::execute(args).await?
+            }
+            EcashCommands::ImportExpirationDateSignatures(args) => {
+                import_expiration_date_signatures::execute(args).await?
+            }
+            EcashCommands::ImportMasterVerificationKey(args) => {
+                import_master_verification_key::execute(args).await?
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Subcommand)]
+pub enum EcashCommands {
+    /// Display information associated with the imported ticketbooks,
+    ShowTicketBooks(show_ticketbooks::Args),
+
+    /// Import a pre-generated ticketbook
+    ImportTicketBook(CommonClientImportTicketBookArgs),
+
+    /// Import coin index signatures needed for ticketbooks
+    ImportCoinIndexSignatures(CommonClientImportCoinIndexSignaturesArgs),
+
+    /// Import expiration date signatures needed for ticketbooks
+    ImportExpirationDateSignatures(CommonClientImportExpirationDateSignaturesArgs),
+
+    /// Import master verification key needed for ticketbooks
+    ImportMasterVerificationKey(CommonClientImportMasterVerificationKeyArgs),
+}

clients/socks5/src/commands/ecash/show_ticketbooks.rs

@@ -9,7 +9,7 @@ use nym_client_core::cli_helpers::client_show_ticketbooks::{
 };
 
 #[derive(clap::Args)]
-pub(crate) struct Args {
+pub struct Args {
     #[command(flatten)]
     common_args: CommonShowTicketbooksArgs,
 
@@ -23,7 +23,7 @@ impl AsRef<CommonShowTicketbooksArgs> for Args {
     }
 }
 
-pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+pub async fn execute(args: Args) -> Result<(), Socks5ClientError> {
     let output = args.output;
     let res = show_ticketbooks::<CliSocks5Client, _>(args).await?;
 

clients/socks5/src/commands/mod.rs

@@ -1,6 +1,7 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::commands::ecash::Ecash;
 use crate::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
@@ -13,7 +14,6 @@ use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
@@ -26,11 +26,10 @@ use std::sync::OnceLock;
 
 mod add_gateway;
 pub(crate) mod build_info;
-mod import_credential;
+pub mod ecash;
 pub mod init;
 mod list_gateways;
 pub(crate) mod run;
-mod show_ticketbooks;
 mod switch_gateway;
 
 pub(crate) struct CliSocks5Client;
@@ -77,8 +76,8 @@ pub(crate) enum Commands {
     /// Run the Nym client with provided configuration client optionally overriding set parameters
     Run(run::Run),
 
-    /// Import a pre-generated credential
-    ImportCredential(CommonClientImportCredentialArgs),
+    /// Ecash-related functionalities
+    Ecash(Ecash),
 
     /// List all registered with gateways
     ListGateways(list_gateways::Args),
@@ -89,9 +88,6 @@ pub(crate) enum Commands {
     /// Change the currently active gateway. Note that you must have already registered with the new gateway!
     SwitchGateway(switch_gateway::Args),
 
-    /// Display information associated with the imported ticketbooks,
-    ShowTicketbooks(show_ticketbooks::Args),
-
     /// Show build information of this binary
     BuildInfo(build_info::BuildInfo),
 
@@ -123,11 +119,10 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
     match args.command {
         Commands::Init(m) => init::execute(m).await?,
         Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::Ecash(ecash) => ecash.execute().await?,
         Commands::ListGateways(args) => list_gateways::execute(args).await?,
         Commands::AddGateway(args) => add_gateway::execute(args).await?,
         Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
-        Commands::ShowTicketbooks(args) => show_ticketbooks::execute(args).await?,
         Commands::BuildInfo(m) => build_info::execute(m),
         Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
         Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),

common/bandwidth-controller/src/acquire/mod.rs

@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::BandwidthControllerError;
-use crate::utils::{get_coin_index_signatures, get_expiration_date_signatures};
+use crate::utils::{
+    get_aggregate_verification_key, get_coin_index_signatures, get_expiration_date_signatures,
+};
 use log::info;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::IssuanceTicketBook;
@@ -55,7 +57,7 @@ where
     ))
 }
 
-pub async fn query_and_persist_required_global_signatures<S>(
+pub async fn query_and_persist_required_global_data<S>(
     storage: &S,
     epoch_id: EpochId,
     expiration_date: Date,
@@ -65,6 +67,10 @@ where
     S: Storage,
     <S as Storage>::StorageError: Send + Sync + 'static,
 {
+    log::info!("Getting master verification key");
+    // this will also persist the key in the storage if was not there already
+    get_aggregate_verification_key(storage, epoch_id, apis.clone()).await?;
+
     log::info!("Getting expiration date signatures");
     // this will also persist the signatures in the storage if they were not there already
     get_expiration_date_signatures(storage, epoch_id, expiration_date, apis.clone()).await?;

common/bandwidth-controller/src/lib.rs

@@ -16,7 +16,7 @@ use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::CredentialSpendingData;
 use nym_credentials_interface::{
-    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, NymPayInfo, VerificationKeyAuth,
+    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, VerificationKeyAuth,
 };
 use nym_ecash_time::Date;
 use nym_validator_client::nym_api::EpochId;
@@ -165,7 +165,9 @@ impl<C, St: Storage> BandwidthController<C, St> {
             .get_coin_index_signatures(epoch_id, &mut api_clients)
             .await?;
 
-        let pay_info = NymPayInfo::generate(provider_pk);
+        let pay_info = retrieved_ticketbook
+            .ticketbook
+            .generate_pay_info(provider_pk);
 
         let spend_request = retrieved_ticketbook.ticketbook.prepare_for_spending(
             &verification_key,

common/bandwidth-controller/src/utils.rs

@@ -4,6 +4,10 @@
 use crate::error::BandwidthControllerError;
 use log::warn;
 use nym_credential_storage::storage::Storage;
+use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
+use nym_credentials::ecash::bandwidth::serialiser::signatures::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+};
 use nym_credentials_interface::{
     AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, VerificationKeyAuth,
 };
@@ -94,13 +98,18 @@ where
     .await?
     .key;
 
+    let full = EpochVerificationKey {
+        epoch_id,
+        key: master_vk,
+    };
+
     // store the retrieved key
     storage
-        .insert_master_verification_key(epoch_id, &master_vk)
+        .insert_master_verification_key(&full)
         .await
         .map_err(BandwidthControllerError::credential_storage_error)?;
 
-    Ok(master_vk)
+    Ok(full.key)
 }
 
 pub(crate) async fn get_coin_index_signatures<St>(
@@ -132,13 +141,18 @@ where
     .await?
     .signatures;
 
+    let aggregated = AggregatedCoinIndicesSignatures {
+        epoch_id,
+        signatures: index_sigs,
+    };
+
     // store the retrieved key
     storage
-        .insert_coin_index_signatures(epoch_id, &index_sigs)
+        .insert_coin_index_signatures(&aggregated)
         .await
         .map_err(BandwidthControllerError::credential_storage_error)?;
 
-    Ok(index_sigs)
+    Ok(aggregated.signatures)
 }
 
 pub(crate) async fn get_expiration_date_signatures<St>(
@@ -171,11 +185,17 @@ where
     .await?
     .signatures;
 
+    let aggregated = AggregatedExpirationDateSignatures {
+        epoch_id,
+        expiration_date,
+        signatures: expiration_sigs,
+    };
+
     // store the retrieved key
     storage
-        .insert_expiration_date_signatures(epoch_id, expiration_date, &expiration_sigs)
+        .insert_expiration_date_signatures(&aggregated)
         .await
         .map_err(BandwidthControllerError::credential_storage_error)?;
 
-    Ok(expiration_sigs)
+    Ok(aggregated.signatures)
 }

common/client-core/Cargo.toml

@@ -71,7 +71,7 @@ features = ["tokio"]
 ###
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
-version = "0.1.11"
+version = "0.1.16"
 features = ["time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio]
@@ -102,7 +102,7 @@ workspace = true
 features = ["tokio"]
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.gloo-timers]
-version = "0.2.4"
+version = "0.3.0"
 features = ["futures"]
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-utils]

common/client-core/src/cli_helpers/client_import_coin_index_signatures.rs

@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_signatures_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("sig_data").required(true)),
+    ))
+]
+pub struct CommonClientImportCoinIndexSignaturesArgs {
+    /// Id of client that is going to import the signatures
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Config file of the client that is supposed to use the signatures.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded signatures data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data", value_parser = parse_encoded_signatures_data))]
+    pub(crate) signatures_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary signatures data
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data"))]
+    pub(crate) signatures_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_coin_index_signatures<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportCoinIndexSignaturesArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let version = common_args.version;
+    let raw_key = match common_args.signatures_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.signatures_path.unwrap())?
+        }
+    };
+
+    nym_id::import_coin_index_signatures(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}

common/client-core/src/cli_helpers/client_import_credential.rs

@@ -11,9 +11,14 @@ fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
 }
 
 #[cfg_attr(feature = "cli", derive(clap::Args))]
-#[cfg_attr(feature = "cli", clap(group(clap::ArgGroup::new("cred_data").required(true))))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("cred_data").required(true)),
+        group(clap::ArgGroup::new("type").required(true)),
+    ))
+]
 #[derive(Debug, Clone)]
-pub struct CommonClientImportCredentialArgs {
+pub struct CommonClientImportTicketBookArgs {
     /// Id of client that is going to import the credential
     #[cfg_attr(feature = "cli", clap(long))]
     pub id: String,
@@ -26,6 +31,15 @@ pub struct CommonClientImportCredentialArgs {
     #[cfg_attr(feature = "cli", clap(long, group = "cred_data"))]
     pub(crate) credential_path: Option<PathBuf>,
 
+    /// Specifies whether we're attempting to import a standalone ticketbook (i.e. serialised `IssuedTicketBook`)
+    #[cfg_attr(feature = "cli", clap(long, group = "type"))]
+    pub(crate) standalone: bool,
+
+    /// Specifies whether we're attempting to import full ticketboot
+    /// (i.e. one that **might** contain required global signatures; that is serialised `ImportableTicketBook`)
+    #[cfg_attr(feature = "cli", clap(long, group = "type"))]
+    pub(crate) full: bool,
+
     // currently hidden as there exists only a single serialization standard
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
     pub(crate) version: Option<u8>,
@@ -33,7 +47,7 @@ pub struct CommonClientImportCredentialArgs {
 
 pub async fn import_credential<C, A>(args: A) -> Result<(), C::Error>
 where
-    A: Into<CommonClientImportCredentialArgs>,
+    A: Into<CommonClientImportTicketBookArgs>,
     C: CliClient,
     C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
 {
@@ -54,6 +68,19 @@ where
         }
     };
 
-    nym_id::import_credential(credentials_store, raw_credential, common_args.version).await?;
+    if common_args.standalone {
+        nym_id::import_standalone_ticketbook(
+            credentials_store,
+            raw_credential,
+            common_args.version,
+        )
+        .await?;
+    } else {
+        // sanity check; clap should have ensured it
+        assert!(common_args.full);
+        nym_id::import_full_ticketbook(credentials_store, raw_credential, common_args.version)
+            .await?;
+    }
+
     Ok(())
 }

common/client-core/src/cli_helpers/client_import_expiration_date_signatures.rs

@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_signatures_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("sig_data").required(true)),
+    ))
+]
+pub struct CommonClientImportExpirationDateSignaturesArgs {
+    /// Id of client that is going to import the signatures
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Config file of the client that is supposed to use the signatures.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded signatures data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data", value_parser = parse_encoded_signatures_data))]
+    pub(crate) signatures_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary signatures data
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data"))]
+    pub(crate) signatures_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_expiration_date_signatures<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportExpirationDateSignaturesArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let version = common_args.version;
+    let raw_key = match common_args.signatures_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.signatures_path.unwrap())?
+        }
+    };
+
+    nym_id::import_expiration_date_signatures(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}

common/client-core/src/cli_helpers/client_import_master_verification_key.rs

@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_key_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("key_data_group").required(true)),
+    ))
+]
+pub struct CommonClientImportMasterVerificationKeyArgs {
+    /// Id of client that is going to import the key
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Config file of the client that is supposed to use the key.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded key data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "key_data_group", value_parser = parse_encoded_key_data))]
+    pub(crate) key_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary key data
+    #[cfg_attr(feature = "cli", clap(long, group = "key_data_group"))]
+    pub(crate) key_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_master_verification_key<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportMasterVerificationKeyArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let version = common_args.version;
+    let raw_key = match common_args.key_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.key_path.unwrap())?
+        }
+    };
+
+    nym_id::import_master_verification_key(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}

common/client-core/src/cli_helpers/mod.rs

@@ -2,7 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub mod client_add_gateway;
+pub mod client_import_coin_index_signatures;
 pub mod client_import_credential;
+pub mod client_import_expiration_date_signatures;
+pub mod client_import_master_verification_key;
 pub mod client_init;
 pub mod client_list_gateways;
 pub mod client_run;

common/client-libs/gateway-client/Cargo.toml

@@ -43,7 +43,7 @@ workspace = true
 features = ["macros", "rt", "net", "sync", "time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
-version = "0.1.11"
+version = "0.1.16"
 features = ["net", "sync", "time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]

common/client-libs/gateway-client/src/client/mod.rs

@@ -293,7 +293,7 @@ impl<C, St> GatewayClient<C, St> {
     // as we need to be able to write the request and read the subsequent response
     async fn send_websocket_message(
         &mut self,
-        msg: Message,
+        msg: impl Into<Message>,
     ) -> Result<ServerResponse, GatewayClientError> {
         let should_restart_mixnet_listener = if self.connection.is_partially_delegated() {
             self.recover_socket_connection().await?;
@@ -307,7 +307,7 @@ impl<C, St> GatewayClient<C, St> {
             SocketState::NotConnected => return Err(GatewayClientError::ConnectionNotEstablished),
             _ => return Err(GatewayClientError::ConnectionInInvalidState),
         };
-        conn.send(msg).await?;
+        conn.send(msg.into()).await?;
         let response = self.read_control_response().await;
 
         if should_restart_mixnet_listener {
@@ -417,6 +417,8 @@ impl<C, St> GatewayClient<C, St> {
                 self.local_identity.as_ref(),
                 self.gateway_identity,
                 self.cfg.bandwidth.require_tickets,
+                #[cfg(not(target_arch = "wasm32"))]
+                self.task_client.clone(),
             )
             .await
             .map_err(GatewayClientError::RegistrationFailure),
@@ -479,8 +481,7 @@ impl<C, St> GatewayClient<C, St> {
             encrypted_address,
             iv,
             self.cfg.bandwidth.require_tickets,
-        )
-        .into();
+        );
 
         match self.send_websocket_message(msg).await? {
             ServerResponse::Authenticate {
@@ -530,6 +531,21 @@ impl<C, St> GatewayClient<C, St> {
         }
     }
 
+    pub async fn get_gateway_protocol(&mut self) -> Result<u8, GatewayClientError> {
+        if !self.connection.is_established() {
+            return Err(GatewayClientError::ConnectionNotEstablished);
+        }
+
+        match self
+            .send_websocket_message(ClientControlRequest::SupportedProtocol {})
+            .await?
+        {
+            ServerResponse::SupportedProtocol { version } => Ok(version),
+            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
+            _ => Err(GatewayClientError::UnexpectedResponse),
+        }
+    }
+
     async fn claim_ecash_bandwidth(
         &mut self,
         credential: CredentialSpendingData,
@@ -541,8 +557,7 @@ impl<C, St> GatewayClient<C, St> {
             credential,
             self.shared_key.as_ref().unwrap(),
             iv,
-        )
-        .into();
+        );
         let bandwidth_remaining = match self.send_websocket_message(msg).await? {
             ServerResponse::Bandwidth { available_total } => Ok(available_total),
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
@@ -560,7 +575,7 @@ impl<C, St> GatewayClient<C, St> {
     }
 
     async fn try_claim_testnet_bandwidth(&mut self) -> Result<(), GatewayClientError> {
-        let msg = ClientControlRequest::ClaimFreeTestnetBandwidth.into();
+        let msg = ClientControlRequest::ClaimFreeTestnetBandwidth;
         let bandwidth_remaining = match self.send_websocket_message(msg).await? {
             ServerResponse::Bandwidth { available_total } => Ok(available_total),
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),

common/client-libs/validator-client/src/nyxd/contract_traits/mixnet_query_client.rs

@@ -42,6 +42,10 @@ pub trait MixnetQueryClient {
 
     // state/sys-params-related
 
+    async fn admin(&self) -> Result<cw_controllers::AdminResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::Admin {}).await
+    }
+
     async fn get_mixnet_contract_version(&self) -> Result<ContractBuildInformation, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetContractVersion {})
             .await
@@ -580,6 +584,7 @@ mod tests {
         msg: MixnetQueryMsg,
     ) -> u32 {
         match msg {
+            MixnetQueryMsg::Admin {} => client.admin().ignore(),
             MixnetQueryMsg::GetAllFamiliesPaged { limit, start_after } => client
                 .get_all_family_members_paged(start_after, limit)
                 .ignore(),

common/client-libs/validator-client/src/nyxd/contract_traits/mixnet_signing_client.rs

@@ -31,6 +31,15 @@ pub trait MixnetSigningClient {
 
     // state/sys-params-related
 
+    async fn update_admin(
+        &self,
+        admin: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::UpdateAdmin { admin }, vec![])
+            .await
+    }
+
     async fn update_rewarding_validator_address(
         &self,
         address: AccountId,
@@ -760,6 +769,7 @@ mod tests {
         msg: MixnetExecuteMsg,
     ) {
         match msg {
+            MixnetExecuteMsg::UpdateAdmin { admin } => client.update_admin(admin, None).ignore(),
             MixnetExecuteMsg::AssignNodeLayer { mix_id, layer } => {
                 client.assign_node_layer(mix_id, layer, None).ignore()
             }

common/client-libs/validator-client/src/nyxd/cosmwasm_client/helpers.rs

@@ -1,6 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::nyxd::cosmwasm_client::types::ExecuteResult;
 use crate::nyxd::error::NyxdError;
 use base64::Engine;
 use cosmrs::abci::TxMsgData;
@@ -10,7 +11,6 @@ use log::error;
 use prost::bytes::Bytes;
 use tendermint_rpc::endpoint::broadcast;
 
-use crate::nyxd::cosmwasm_client::types::ExecuteResult;
 pub use cosmrs::abci::MsgResponse;
 
 pub fn parse_msg_responses(data: Bytes) -> Vec<MsgResponse> {

common/client-libs/validator-client/src/nyxd/cosmwasm_client/logs.rs

@@ -21,7 +21,8 @@ pub struct Log {
 
 /// Searches in logs for the first event of the given event type and in that event
 /// for the first attribute with the given attribute key.
-pub fn find_attribute<'a>(
+#[deprecated]
+pub fn find_attribute_in_logs<'a>(
     logs: &'a [Log],
     event_type: &str,
     attribute_key: &str,
@@ -35,6 +36,7 @@ pub fn find_attribute<'a>(
 }
 
 /// Search for the proposal id in the given log. It'll be in the LAST wasm event, with attribute key "proposal_id"
+#[deprecated]
 pub fn find_proposal_id(logs: &[Log]) -> Result<u64, NyxdError> {
     let maybe_attributes = logs
         .iter()

common/client-libs/validator-client/src/nyxd/helpers.rs

@@ -1,12 +1,24 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::nyxd::cosmwasm_client::logs::Log;
 use crate::nyxd::TxResponse;
+use cosmrs::tendermint::abci;
+
+pub use abci::Event;
 
 // Searches in events for an event of the given event type which contains an
 // attribute for with the given key.
 pub fn find_tx_attribute(tx: &TxResponse, event_type: &str, attribute_key: &str) -> Option<String> {
-    let event = tx.tx_result.events.iter().find(|e| e.kind == event_type)?;
+    find_event_attribute(&tx.tx_result.events, event_type, attribute_key)
+}
+
+pub fn find_event_attribute(
+    events: &[Event],
+    event_type: &str,
+    attribute_key: &str,
+) -> Option<String> {
+    let event = events.iter().find(|e| e.kind == event_type)?;
     let attribute = event.attributes.iter().find(|&attr| {
         if let Ok(key_str) = attr.key_str() {
             key_str == attribute_key
@@ -16,3 +28,23 @@ pub fn find_tx_attribute(tx: &TxResponse, event_type: &str, attribute_key: &str)
     })?;
     Some(attribute.value_str().ok().map(|str| str.to_string())).flatten()
 }
+
+pub fn find_attribute_value_in_logs_or_events(
+    logs: &[Log],
+    events: &[Event],
+    event_type: &str,
+    attribute_key: &str,
+) -> Option<String> {
+    // if logs are empty, i.e. we're using post 0.50 code, parse the events instead
+    if !logs.is_empty() {
+        #[allow(deprecated)]
+        return crate::nyxd::cosmwasm_client::logs::find_attribute_in_logs(
+            logs,
+            event_type,
+            attribute_key,
+        )
+        .map(|attr| attr.value.clone());
+    }
+
+    find_event_attribute(events, event_type, attribute_key)
+}

common/commands/Cargo.toml

@@ -10,6 +10,7 @@ anyhow = { workspace = true }
 base64 = { workspace = true }
 bip39 = { workspace = true }
 bs58 = { workspace = true }
+colored = { workspace = true }
 comfy-table = { workspace = true }
 cfg-if = { workspace = true }
 clap = { workspace = true, features = ["derive"] }
@@ -25,9 +26,10 @@ rand = { workspace = true, features = ["std"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
+tempfile = { workspace = true }
 time = { workspace = true, features = ["parsing", "formatting"] }
-tokio = { workspace = true, features = ["sync"]}
-toml = "0.5.6"
+tokio = { workspace = true, features = ["sync"] }
+toml = { workspace = true }
 url = { workspace = true }
 tap = { workspace = true }
 zeroize = { workspace = true }

common/commands/src/coconut/import_ticket_book.rs

@@ -1,64 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::utils::CommonConfigsWrapper;
-use anyhow::bail;
-use clap::ArgGroup;
-use clap::Parser;
-use nym_credential_storage::initialise_persistent_storage;
-use nym_id::import_credential;
-use std::fs;
-use std::path::PathBuf;
-
-fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
-    bs58::decode(raw).into_vec()
-}
-
-#[derive(Debug, Parser)]
-#[clap(group(ArgGroup::new("cred_data").required(true)))]
-pub struct Args {
-    /// Config file of the client that is supposed to use the credential.
-    #[clap(long)]
-    pub(crate) client_config: PathBuf,
-
-    /// Explicitly provide the encoded credential data (as base58)
-    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
-    pub(crate) credential_data: Option<Vec<u8>>,
-
-    /// Specifies the path to file containing binary credential data
-    #[clap(long, group = "cred_data")]
-    pub(crate) credential_path: Option<PathBuf>,
-
-    // currently hidden as there exists only a single serialization standard
-    #[clap(long, hide = true)]
-    pub(crate) version: Option<u8>,
-}
-
-pub async fn execute(args: Args) -> anyhow::Result<()> {
-    let loaded = CommonConfigsWrapper::try_load(args.client_config)?;
-
-    if let Ok(id) = loaded.try_get_id() {
-        println!("loaded config file for client '{id}'");
-    }
-
-    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
-        bail!("the loaded config does not have a credentials store information")
-    };
-
-    println!(
-        "using credentials store at '{}'",
-        credentials_store.display()
-    );
-    let credentials_store = initialise_persistent_storage(credentials_store).await;
-
-    let raw_credential = match args.credential_data {
-        Some(data) => data,
-        None => {
-            // SAFETY: one of those arguments must have been set
-            fs::read(args.credential_path.unwrap())?
-        }
-    };
-
-    import_credential(credentials_store, raw_credential, args.version).await?;
-    Ok(())
-}

common/commands/src/coconut/issue_ticket_book.rs

@@ -1,56 +0,0 @@
-// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::context::SigningClient;
-use crate::utils::CommonConfigsWrapper;
-use anyhow::bail;
-use clap::Parser;
-use nym_credential_storage::initialise_persistent_storage;
-use nym_credential_utils::utils;
-use nym_credentials_interface::TicketType;
-use nym_crypto::asymmetric::identity;
-use std::path::PathBuf;
-
-#[derive(Debug, Parser)]
-pub struct Args {
-    /// Specify which type of ticketbook should be issued
-    #[clap(long, default_value_t = TicketType::V1MixnetEntry)]
-    pub(crate) ticketbook_type: TicketType,
-
-    /// Config file of the client that is supposed to use the credential.
-    #[clap(long)]
-    pub(crate) client_config: PathBuf,
-}
-
-pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
-    let loaded = CommonConfigsWrapper::try_load(args.client_config)?;
-
-    if let Ok(id) = loaded.try_get_id() {
-        println!("loaded config file for client '{id}'");
-    }
-
-    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
-        bail!("the loaded config does not have a credentials store information")
-    };
-
-    let Ok(private_id_key) = loaded.try_get_private_id_key() else {
-        bail!("the loaded config does not have a public id key information")
-    };
-
-    println!(
-        "using credentials store at '{}'",
-        credentials_store.display()
-    );
-
-    let persistent_storage = initialise_persistent_storage(credentials_store).await;
-    let private_id_key: identity::PrivateKey = nym_pemstore::load_key(private_id_key)?;
-    utils::issue_credential(
-        &client,
-        &persistent_storage,
-        &private_id_key.to_bytes(),
-        args.ticketbook_type,
-    )
-    .await?;
-
-    Ok(())
-}

common/commands/src/ecash/generate_ticket.rs

@@ -0,0 +1,178 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::utils::CommonConfigsWrapper;
+use anyhow::{anyhow, bail};
+use clap::Parser;
+use colored::Colorize;
+use comfy_table::Table;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_credential_storage::storage::Storage;
+use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
+use std::path::PathBuf;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// Specify the index of the ticket to retrieve from the ticketbook.
+    /// By default, the current unspent value is used.
+    #[clap(long, group = "output")]
+    pub(crate) ticket_index: Option<u64>,
+
+    /// Specify whether we should display payments for ALL available tickets
+    #[clap(long, group = "output")]
+    pub(crate) full: bool,
+
+    /// Base58-encoded identity of the provider (must be 32 bytes long)
+    #[clap(long)]
+    pub(crate) provider: String,
+
+    /// Config file of the client that is supposed to use the credential.
+    #[clap(long, group = "source")]
+    pub(crate) client_config: Option<PathBuf>,
+
+    /// Path to the dedicated credential storage database
+    #[clap(long, group = "source")]
+    pub(crate) credential_storage: Option<PathBuf>,
+}
+
+pub async fn execute(args: Args) -> anyhow::Result<()> {
+    let credentials_store = if let Some(explicit) = args.credential_storage {
+        explicit
+    } else {
+        // SAFETY: at least one of them MUST HAVE been specified
+        let cfg = args.client_config.unwrap();
+
+        let loaded = CommonConfigsWrapper::try_load(cfg)?;
+
+        if let Ok(id) = loaded.try_get_id() {
+            println!("loaded config file for client '{id}'");
+        }
+
+        let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+            bail!("the loaded config does not have a credentials store information")
+        };
+        credentials_store
+    };
+
+    let decoded_provider = bs58::decode(&args.provider).into_vec()?;
+    if decoded_provider.len() != 32 {
+        bail!("the provided provider information is malformed")
+    }
+    let provider_arr: [u8; 32] = decoded_provider.try_into().unwrap();
+
+    let persistent_storage = initialise_persistent_storage(&credentials_store).await;
+    let Some(mut next_ticketbook) = persistent_storage
+        .get_next_unspent_usable_ticketbook(0)
+        .await?
+    else {
+        bail!(
+            "there are no valid ticketbooks in the storage at {}",
+            credentials_store.display()
+        )
+    };
+
+    let epoch_id = next_ticketbook.ticketbook.epoch_id();
+    let expiration_date = next_ticketbook.ticketbook.expiration_date();
+
+    let verification_key = persistent_storage
+        .get_master_verification_key(epoch_id)
+        .await?
+        .ok_or_else(|| {
+            anyhow!("ticketbook got incorrectly imported - the master verification key is missing")
+        })?;
+    let expiration_signatures = persistent_storage
+        .get_expiration_date_signatures(expiration_date)
+        .await?
+        .ok_or_else(|| {
+            anyhow!(
+                "ticketbook got incorrectly imported - the expiration date signatures are missing"
+            )
+        })?;
+    let coin_indices_signatures = persistent_storage
+        .get_coin_index_signatures(epoch_id)
+        .await?
+        .ok_or_else(|| {
+            anyhow!("ticketbook got incorrectly imported - the coin index signatures are missing")
+        })?;
+
+    let ticketbook_data = next_ticketbook.ticketbook.pack();
+
+    let next_ticket = args
+        .ticket_index
+        .unwrap_or(next_ticketbook.ticketbook.spent_tickets());
+    let pay_info = next_ticketbook.ticketbook.generate_pay_info(provider_arr);
+
+    println!("{}", "TICKETBOOK DATA:".bold());
+    println!("{}", bs58::encode(&ticketbook_data.data).into_string());
+    println!();
+
+    // display it only for a single ticket
+    if !args.full {
+        println!("attempting to generate payment for ticket {next_ticket}...");
+        println!();
+        next_ticketbook.ticketbook.update_spent_tickets(next_ticket);
+
+        let req = next_ticketbook.ticketbook.prepare_for_spending(
+            &verification_key,
+            pay_info.into(),
+            &coin_indices_signatures,
+            &expiration_signatures,
+            1,
+        )?;
+
+        let payment = req.payment;
+
+        println!("{}", format!("PAYMENT FOR TICKET {next_ticket}: ").bold());
+        println!("{}", bs58::encode(&payment.to_bytes()).into_string());
+        return Ok(());
+    }
+
+    println!(
+        "generating payment information for {} tickets. this might take a while!...",
+        next_ticketbook.ticketbook.params_total_tickets()
+    );
+
+    // otherwise generate all the payments
+    let last_spent = next_ticketbook.ticketbook.spent_tickets();
+
+    let mut table = Table::new();
+    table.set_header(vec!["index", "binary data", "spend status"]);
+
+    for i in 0..next_ticketbook.ticketbook.params_total_tickets() {
+        let status = if i < last_spent {
+            "SPENT".red()
+        } else {
+            "NOT SPENT".green()
+        };
+
+        next_ticketbook.ticketbook.update_spent_tickets(i);
+
+        let req = next_ticketbook.ticketbook.prepare_for_spending(
+            &verification_key,
+            pay_info.into(),
+            &coin_indices_signatures,
+            &expiration_signatures,
+            1,
+        )?;
+
+        let payment = req.payment;
+        let payment_bytes = payment.to_bytes();
+        let len = payment_bytes.len();
+        let display_size = 100;
+        let remaining = len - display_size;
+
+        table.add_row(vec![
+            i.to_string(),
+            format!(
+                "{}…{remaining}bytes remaining",
+                bs58::encode(&payment_bytes[..display_size]).into_string()
+            ),
+            status.to_string(),
+        ]);
+    }
+
+    println!("{}", "AVAILABLE TICKETS".bold());
+    println!("{table}");
+
+    Ok(())
+}

common/commands/src/ecash/import_coin_index_signatures.rs

@@ -0,0 +1,76 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::utils::CommonConfigsWrapper;
+use anyhow::bail;
+use clap::ArgGroup;
+use clap::Parser;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_id::import_credential::import_expiration_date_signatures;
+use std::fs;
+use std::path::PathBuf;
+
+fn parse_encoded_signatures_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[derive(Debug, Parser)]
+#[clap(
+    group(ArgGroup::new("sig_data").required(true)),
+)]
+pub struct Args {
+    /// Config file of the client that is supposed to use the signatures.
+    #[clap(long)]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded signatures data (as base58)
+    #[clap(long, group = "sig_data", value_parser = parse_encoded_signatures_data)]
+    pub(crate) signatures_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary signatures data
+    #[clap(long, group = "sig_data")]
+    pub(crate) signatures_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+impl Args {
+    fn signatures_data(self) -> anyhow::Result<Vec<u8>> {
+        let data = match self.signatures_data {
+            Some(data) => data,
+            None => {
+                // SAFETY: one of those arguments must have been set
+                #[allow(clippy::unwrap_used)]
+                fs::read(self.signatures_path.unwrap())?
+            }
+        };
+        Ok(data)
+    }
+}
+
+pub async fn execute(args: Args) -> anyhow::Result<()> {
+    let loaded = CommonConfigsWrapper::try_load(&args.client_config)?;
+
+    if let Ok(id) = loaded.try_get_id() {
+        println!("loaded config file for client '{id}'");
+    }
+
+    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+        bail!("the loaded config does not have a credentials store information")
+    };
+
+    println!(
+        "using credentials store at '{}'",
+        credentials_store.display()
+    );
+    let credentials_store = initialise_persistent_storage(credentials_store).await;
+
+    let version = args.version;
+    let raw_signatures = args.signatures_data()?;
+
+    import_expiration_date_signatures(credentials_store, raw_signatures, version).await?;
+
+    Ok(())
+}

common/commands/src/ecash/import_expiration_date_signatures.rs

@@ -0,0 +1,76 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::utils::CommonConfigsWrapper;
+use anyhow::bail;
+use clap::ArgGroup;
+use clap::Parser;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_id::import_credential::import_expiration_date_signatures;
+use std::fs;
+use std::path::PathBuf;
+
+fn parse_encoded_signatures_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[derive(Debug, Parser)]
+#[clap(
+    group(ArgGroup::new("sig_data").required(true)),
+)]
+pub struct Args {
+    /// Config file of the client that is supposed to use the signatures.
+    #[clap(long)]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded signatures data (as base58)
+    #[clap(long, group = "sig_data", value_parser = parse_encoded_signatures_data)]
+    pub(crate) signatures_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary signatures data
+    #[clap(long, group = "sig_data")]
+    pub(crate) signatures_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+impl Args {
+    fn signatures_data(self) -> anyhow::Result<Vec<u8>> {
+        let data = match self.signatures_data {
+            Some(data) => data,
+            None => {
+                // SAFETY: one of those arguments must have been set
+                #[allow(clippy::unwrap_used)]
+                fs::read(self.signatures_path.unwrap())?
+            }
+        };
+        Ok(data)
+    }
+}
+
+pub async fn execute(args: Args) -> anyhow::Result<()> {
+    let loaded = CommonConfigsWrapper::try_load(&args.client_config)?;
+
+    if let Ok(id) = loaded.try_get_id() {
+        println!("loaded config file for client '{id}'");
+    }
+
+    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+        bail!("the loaded config does not have a credentials store information")
+    };
+
+    println!(
+        "using credentials store at '{}'",
+        credentials_store.display()
+    );
+    let credentials_store = initialise_persistent_storage(credentials_store).await;
+
+    let version = args.version;
+    let raw_signatures = args.signatures_data()?;
+
+    import_expiration_date_signatures(credentials_store, raw_signatures, version).await?;
+
+    Ok(())
+}

common/commands/src/ecash/import_master_verification_key.rs

@@ -0,0 +1,76 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::utils::CommonConfigsWrapper;
+use anyhow::bail;
+use clap::ArgGroup;
+use clap::Parser;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_id::import_credential::import_master_verification_key;
+use std::fs;
+use std::path::PathBuf;
+
+fn parse_encoded_key_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[derive(Debug, Parser)]
+#[clap(
+    group(ArgGroup::new("key_data_group").required(true)),
+)]
+pub struct Args {
+    /// Config file of the client that is supposed to use the key.
+    #[clap(long)]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded key data (as base58)
+    #[clap(long, group = "key_data_group", value_parser = parse_encoded_key_data)]
+    pub(crate) key_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary key data
+    #[clap(long, group = "key_data_group")]
+    pub(crate) key_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+impl Args {
+    fn key_data(self) -> anyhow::Result<Vec<u8>> {
+        let data = match self.key_data {
+            Some(data) => data,
+            None => {
+                // SAFETY: one of those arguments must have been set
+                #[allow(clippy::unwrap_used)]
+                fs::read(self.key_path.unwrap())?
+            }
+        };
+        Ok(data)
+    }
+}
+
+pub async fn execute(args: Args) -> anyhow::Result<()> {
+    let loaded = CommonConfigsWrapper::try_load(&args.client_config)?;
+
+    if let Ok(id) = loaded.try_get_id() {
+        println!("loaded config file for client '{id}'");
+    }
+
+    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+        bail!("the loaded config does not have a credentials store information")
+    };
+
+    println!(
+        "using credentials store at '{}'",
+        credentials_store.display()
+    );
+    let credentials_store = initialise_persistent_storage(credentials_store).await;
+
+    let version = args.version;
+    let raw_key = args.key_data()?;
+
+    import_master_verification_key(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}

common/commands/src/ecash/import_ticket_book.rs

@@ -0,0 +1,103 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::utils::CommonConfigsWrapper;
+use anyhow::bail;
+use clap::ArgGroup;
+use clap::Parser;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_id::import_credential::import_full_ticketbook;
+use nym_id::import_standalone_ticketbook;
+use std::fs;
+use std::path::PathBuf;
+use std::str::FromStr;
+
+#[derive(Debug, Clone)]
+pub struct CredentialDataWrapper(Vec<u8>);
+
+impl FromStr for CredentialDataWrapper {
+    type Err = bs58::decode::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        bs58::decode(s).into_vec().map(CredentialDataWrapper)
+    }
+}
+
+#[derive(Debug, Parser)]
+#[clap(
+    group(ArgGroup::new("cred_data").required(true)),
+    group(ArgGroup::new("type").required(true)),
+)]
+pub struct Args {
+    /// Config file of the client that is supposed to use the credential.
+    #[clap(long)]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded credential data (as base58)
+    #[clap(long, group = "cred_data")]
+    pub(crate) credential_data: Option<CredentialDataWrapper>,
+
+    /// Specifies the path to file containing binary credential data
+    #[clap(long, group = "cred_data")]
+    pub(crate) credential_path: Option<PathBuf>,
+
+    /// Specifies whether we're attempting to import a standalone ticketbook (i.e. serialised `IssuedTicketBook`)
+    #[clap(long, group = "type")]
+    pub(crate) standalone: bool,
+
+    /// Specifies whether we're attempting to import full ticketboot
+    /// (i.e. one that **might** contain required global signatures; that is serialised `ImportableTicketBook`)
+    #[clap(long, group = "type")]
+    pub(crate) full: bool,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+impl Args {
+    fn credential_data(self) -> anyhow::Result<Vec<u8>> {
+        let data = match self.credential_data {
+            Some(data) => data.0,
+            None => {
+                // SAFETY: one of those arguments must have been set
+                #[allow(clippy::unwrap_used)]
+                fs::read(self.credential_path.unwrap())?
+            }
+        };
+        Ok(data)
+    }
+}
+
+pub async fn execute(args: Args) -> anyhow::Result<()> {
+    let loaded = CommonConfigsWrapper::try_load(&args.client_config)?;
+
+    if let Ok(id) = loaded.try_get_id() {
+        println!("loaded config file for client '{id}'");
+    }
+
+    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+        bail!("the loaded config does not have a credentials store information")
+    };
+
+    println!(
+        "using credentials store at '{}'",
+        credentials_store.display()
+    );
+    let credentials_store = initialise_persistent_storage(credentials_store).await;
+
+    let version = args.version;
+    let standalone = args.standalone;
+    let full = args.full;
+    let raw_credential = args.credential_data()?;
+
+    if standalone {
+        import_standalone_ticketbook(credentials_store, raw_credential, version).await?;
+    } else {
+        // sanity check; clap should have ensured it
+        assert!(full);
+        import_full_ticketbook(credentials_store, raw_credential, version).await?;
+    }
+
+    Ok(())
+}

common/commands/src/ecash/issue_ticket_book.rs

@@ -0,0 +1,170 @@
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use crate::utils::CommonConfigsWrapper;
+use anyhow::{anyhow, bail};
+use clap::ArgGroup;
+use clap::Parser;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_credential_storage::storage::Storage;
+use nym_credential_utils::utils;
+use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
+use nym_credentials::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures, EpochVerificationKey,
+};
+use nym_credentials_interface::TicketType;
+use nym_crypto::asymmetric::identity;
+use std::fs;
+use std::path::PathBuf;
+use tempfile::NamedTempFile;
+
+#[derive(Debug, Parser)]
+#[clap(
+    group(ArgGroup::new("output").required(true)),
+)]
+pub struct Args {
+    /// Specify which type of ticketbook should be issued
+    #[clap(long, default_value_t = TicketType::V1MixnetEntry)]
+    pub(crate) ticketbook_type: TicketType,
+
+    /// Config file of the client that is supposed to use the credential.
+    #[clap(long, group = "output")]
+    pub(crate) client_config: Option<PathBuf>,
+
+    /// Output file for the ticketbook
+    #[clap(long, group = "output", requires = "bs58_encoded_client_secret")]
+    pub(crate) output_file: Option<PathBuf>,
+
+    /// Specifies whether the output file should use binary or bs58 encoded data
+    #[clap(long, requires = "output_file")]
+    pub(crate) bs58_output: bool,
+
+    /// Specifies whether the file output should contain expiration date signatures
+    #[clap(long, requires = "output_file")]
+    pub(crate) include_expiration_date_signatures: bool,
+
+    /// Specifies whether the file output should contain coin index signatures
+    #[clap(long, requires = "output_file")]
+    pub(crate) include_coin_index_signatures: bool,
+
+    /// Specifies whether the file output should contain master verification key
+    #[clap(long, requires = "output_file")]
+    pub(crate) include_master_verification_key: bool,
+
+    /// Secret value that's used for deriving underlying ecash keypair
+    #[clap(long)]
+    pub(crate) bs58_encoded_client_secret: Option<String>,
+}
+
+async fn issue_client_ticketbook(
+    config_path: PathBuf,
+    ticketbook_type: TicketType,
+    client: SigningClient,
+) -> anyhow::Result<()> {
+    let loaded = CommonConfigsWrapper::try_load(config_path)?;
+
+    if let Ok(id) = loaded.try_get_id() {
+        println!("loaded config file for client '{id}'");
+    }
+
+    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+        bail!("the loaded config does not have a credentials store information")
+    };
+
+    let Ok(private_id_key) = loaded.try_get_private_id_key() else {
+        bail!("the loaded config does not have a public id key information")
+    };
+
+    println!(
+        "using credentials store at '{}'",
+        credentials_store.display()
+    );
+
+    let persistent_storage = initialise_persistent_storage(credentials_store).await;
+    let private_id_key: identity::PrivateKey = nym_pemstore::load_key(private_id_key)?;
+    utils::issue_credential(
+        &client,
+        &persistent_storage,
+        &private_id_key.to_bytes(),
+        ticketbook_type,
+    )
+    .await?;
+
+    Ok(())
+}
+
+async fn issue_to_file(args: Args, client: SigningClient) -> anyhow::Result<()> {
+    // those MUST HAVE been specified; clap ensures it
+    let output_file = args.output_file.unwrap();
+    let secret = bs58::decode(&args.bs58_encoded_client_secret.unwrap()).into_vec()?;
+
+    let temp_credential_store_file = NamedTempFile::new()?;
+    let credential_store_path = temp_credential_store_file.into_temp_path();
+
+    let credentials_store = initialise_persistent_storage(credential_store_path).await;
+
+    utils::issue_credential(&client, &credentials_store, &secret, args.ticketbook_type).await?;
+
+    let ticketbook = credentials_store
+        .get_next_unspent_usable_ticketbook(0)
+        .await?
+        .ok_or(anyhow!("we just issued a ticketbook, it must be present!"))?
+        .ticketbook;
+
+    let expiration_date = ticketbook.expiration_date();
+    let epoch_id = ticketbook.epoch_id();
+
+    let mut exported = ticketbook.begin_export();
+
+    if args.include_expiration_date_signatures {
+        let signatures = credentials_store
+            .get_expiration_date_signatures(expiration_date)
+            .await?
+            .ok_or(anyhow!("missing expiration date signatures!"))?;
+
+        exported = exported.with_expiration_date_signatures(&AggregatedExpirationDateSignatures {
+            epoch_id,
+            expiration_date,
+            signatures,
+        });
+    }
+
+    if args.include_coin_index_signatures {
+        let signatures = credentials_store
+            .get_coin_index_signatures(epoch_id)
+            .await?
+            .ok_or(anyhow!("missing coin index signatures!"))?;
+        exported = exported.with_coin_index_signatures(&AggregatedCoinIndicesSignatures {
+            epoch_id,
+            signatures,
+        });
+    }
+
+    if args.include_master_verification_key {
+        let key = credentials_store
+            .get_master_verification_key(epoch_id)
+            .await?
+            .ok_or(anyhow!("missing master verification key!"))?;
+
+        exported = exported.with_master_verification_key(&EpochVerificationKey { epoch_id, key });
+    }
+
+    let data = exported.pack().data;
+
+    if args.bs58_output {
+        fs::write(output_file, bs58::encode(&data).into_string())?;
+    } else {
+        fs::write(output_file, &data)?;
+    }
+
+    Ok(())
+}
+
+pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
+    if let Some(client_config) = args.client_config {
+        return issue_client_ticketbook(client_config, args.ticketbook_type, client).await;
+    }
+
+    issue_to_file(args, client).await
+}

common/commands/src/ecash/mod.rs

@@ -3,6 +3,10 @@
 
 use clap::{Args, Subcommand};
 
+pub mod generate_ticket;
+pub mod import_coin_index_signatures;
+pub mod import_expiration_date_signatures;
+pub mod import_master_verification_key;
 pub mod import_ticket_book;
 pub mod issue_ticket_book;
 pub mod recover_ticket_book;
@@ -19,4 +23,8 @@ pub enum EcashCommands {
     IssueTicketBook(issue_ticket_book::Args),
     RecoverTicketBook(recover_ticket_book::Args),
     ImportTicketBook(import_ticket_book::Args),
+    GenerateTicket(generate_ticket::Args),
+    ImportCoinIndexSignatures(import_coin_index_signatures::Args),
+    ImportExpirationDateSignatures(import_expiration_date_signatures::Args),
+    ImportMasterVerificationKey(import_master_verification_key::Args),
 }

common/commands/src/lib.rs

@@ -1,7 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-pub mod coconut;
 pub mod context;
+pub mod ecash;
 pub mod utils;
 pub mod validator;

common/commands/src/validator/mixnet/operators/gateway/gateway_bonding_sign_payload.rs

@@ -6,7 +6,7 @@ use crate::utils::{account_id_to_cw_addr, DataWrapper};
 use clap::Parser;
 use cosmwasm_std::Coin;
 use nym_bin_common::output_format::OutputFormat;
-use nym_mixnet_contract_common::construct_gateway_bonding_sign_payload;
+use nym_mixnet_contract_common::construct_legacy_gateway_bonding_sign_payload;
 use nym_network_defaults::{DEFAULT_CLIENT_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT};
 use nym_validator_client::nyxd::contract_traits::MixnetQueryClient;
 
@@ -71,7 +71,7 @@ pub async fn create_payload(args: Args, client: SigningClient) {
 
     let address = account_id_to_cw_addr(&client.address());
 
-    let payload = construct_gateway_bonding_sign_payload(nonce, address, coin, gateway);
+    let payload = construct_legacy_gateway_bonding_sign_payload(nonce, address, coin, gateway);
     let wrapper = DataWrapper::new(payload.to_base58_string().unwrap());
     println!("{}", args.output.format(&wrapper))
 }

common/commands/src/validator/mixnet/operators/mixnode/keys/decode_mixnode_key.rs

@@ -1,7 +1,6 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use base64::Engine;
 use clap::Parser;
 
 #[derive(Debug, Parser)]
@@ -11,7 +10,9 @@ pub struct Args {
 }
 
 pub fn decode_mixnode_key(args: Args) {
-    let b64_decoded = base64::prelude::BASE64_STANDARD
+    use base64::{engine::general_purpose::STANDARD, Engine as _};
+
+    let b64_decoded = STANDARD
         .decode(args.key)
         .expect("failed to decode base64 string");
     let b58_encoded = bs58::encode(&b64_decoded).into_string();

common/commands/src/validator/mixnet/operators/mixnode/mixnode_bonding_sign_payload.rs

@@ -7,7 +7,9 @@ use clap::Parser;
 use cosmwasm_std::{Coin, Uint128};
 use nym_bin_common::output_format::OutputFormat;
 use nym_contracts_common::Percent;
-use nym_mixnet_contract_common::{construct_mixnode_bonding_sign_payload, MixNodeCostParams};
+use nym_mixnet_contract_common::{
+    construct_legacy_mixnode_bonding_sign_payload, MixNodeCostParams,
+};
 use nym_network_defaults::{
     DEFAULT_HTTP_API_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT, DEFAULT_VERLOC_LISTENING_PORT,
 };
@@ -98,7 +100,7 @@ pub async fn create_payload(args: Args, client: SigningClient) {
     let address = account_id_to_cw_addr(&client.address());
 
     let payload =
-        construct_mixnode_bonding_sign_payload(nonce, address, coin, mixnode, cost_params);
+        construct_legacy_mixnode_bonding_sign_payload(nonce, address, coin, mixnode, cost_params);
     let wrapper = DataWrapper::new(payload.to_base58_string().unwrap());
     println!("{}", args.output.format(&wrapper))
 }

common/commands/src/validator/mixnet/operators/mixnode/settings/update_cost_params.rs

@@ -6,14 +6,14 @@ use clap::Parser;
 use cosmwasm_std::Uint128;
 use log::info;
 use nym_mixnet_contract_common::{MixNodeCostParams, Percent};
-use nym_validator_client::nyxd::contract_traits::MixnetSigningClient;
+use nym_validator_client::nyxd::contract_traits::{MixnetQueryClient, MixnetSigningClient};
 use nym_validator_client::nyxd::CosmWasmCoin;
 
 #[derive(Debug, Parser)]
 pub struct Args {
     #[clap(
         long,
-        help = "input your profit margin as follows; (so it would be 10, rather than 0.1)"
+        help = "input your profit margin as follows; (so it would be 20, rather than 0.2)"
     )]
     pub profit_margin_percent: Option<u8>,
 
@@ -27,11 +27,48 @@ pub struct Args {
 pub async fn update_cost_params(args: Args, client: SigningClient) {
     let denom = client.current_chain_details().mix_denom.base.as_str();
 
+    fn convert_to_percent(value: u64) -> Percent {
+        Percent::from_percentage_value(value).expect("Invalid value")
+    }
+
+    let default_profit_margin: Percent = convert_to_percent(20);
+
+    let mixownership_response = match client.get_owned_mixnode(&client.address()).await {
+        Ok(response) => response,
+        Err(_) => {
+            eprintln!("Failed to obtain owned mixnode");
+            return;
+        }
+    };
+
+    let mix_id = match mixownership_response.mixnode_details {
+        Some(details) => details.bond_information.mix_id,
+        None => {
+            eprintln!("Failed to obtain mixnode details");
+            return;
+        }
+    };
+
+    let rewarding_response = match client.get_mixnode_rewarding_details(mix_id).await {
+        Ok(details) => details,
+        Err(_) => {
+            eprintln!("Failed to obtain rewarding details");
+            return;
+        }
+    };
+
+    let profit_margin_percent = rewarding_response
+        .rewarding_details
+        .map(|rd| rd.cost_params.profit_margin_percent)
+        .unwrap_or(default_profit_margin);
+
+    let profit_margin_value = args
+        .profit_margin_percent
+        .map(|pm| convert_to_percent(pm as u64))
+        .unwrap_or(profit_margin_percent);
+
     let cost_params = MixNodeCostParams {
-        profit_margin_percent: Percent::from_percentage_value(
-            args.profit_margin_percent.unwrap_or(10) as u64,
-        )
-        .unwrap(),
+        profit_margin_percent: profit_margin_value,
         interval_operating_cost: CosmWasmCoin {
             denom: denom.into(),
             amount: Uint128::new(args.interval_operating_cost.unwrap_or(40_000_000)),

common/cosmwasm-smart-contracts/contracts-common/Cargo.toml

@@ -20,4 +20,4 @@ thiserror = { workspace = true }
 serde_json = { workspace = true }
 
 [build-dependencies]
-vergen = { version = "=8.3.1", features = ["build", "git", "gitcl", "rustc", "cargo"] }
+vergen = { workspace = true, features = ["build", "git", "gitcl", "rustc", "cargo"] }

common/cosmwasm-smart-contracts/contracts-common/src/signing/mod.rs

@@ -248,3 +248,31 @@ impl<T> ContractMessageContent<T> {
         }
     }
 }
+
+impl<T> From<ContractMessageContent<T>> for LegacyContractMessageContent<T> {
+    fn from(value: ContractMessageContent<T>) -> Self {
+        LegacyContractMessageContent {
+            sender: value.sender,
+            proxy: None,
+            funds: value.funds,
+            data: value.data,
+        }
+    }
+}
+
+#[derive(Serialize)]
+pub struct LegacyContractMessageContent<T> {
+    pub sender: Addr,
+    pub proxy: Option<Addr>,
+    pub funds: Vec<Coin>,
+    pub data: T,
+}
+
+impl<T> SigningPurpose for LegacyContractMessageContent<T>
+where
+    T: SigningPurpose,
+{
+    fn message_type() -> MessageType {
+        T::message_type()
+    }
+}

common/cosmwasm-smart-contracts/group-contract/Cargo.toml

@@ -4,11 +4,9 @@ version = "0.1.0"
 edition = "2021"
 license.workspace = true
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 cosmwasm-schema = { workspace = true }
-cw4 = { workspace = true }
 cw-controllers = { workspace = true }
+cw4 = { workspace = true }
 schemars = { workspace = true }
-serde = { version = "1.0.209", default-features = false, features = ["derive"] }
+serde = { workspace = true, features = ["derive"] }

common/cosmwasm-smart-contracts/mixnet-contract/Cargo.toml

@@ -9,9 +9,10 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-bs58 = "0.5.1"
+bs58 = { workspace = true }
 cosmwasm-std = { workspace = true }
 cosmwasm-schema = { workspace = true }
+cw-controllers = { workspace = true }
 cw2 = { workspace = true, optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_repr = { workspace = true }

common/cosmwasm-smart-contracts/mixnet-contract/src/error.rs

@@ -5,6 +5,7 @@ use crate::{EpochEventId, EpochState, IdentityKey, MixId, OperatingCostRange, Pr
 use contracts_common::signing::verifier::ApiVerifierError;
 use contracts_common::Percent;
 use cosmwasm_std::{Addr, Coin, Decimal, Uint128};
+use cw_controllers::AdminError;
 use thiserror::Error;
 
 #[derive(Error, Debug, PartialEq)]
@@ -12,6 +13,9 @@ pub enum MixnetContractError {
     #[error("could not perform contract migration: {comment}")]
     FailedMigration { comment: String },
 
+    #[error(transparent)]
+    Admin(#[from] AdminError),
+
     #[error("{source}")]
     StdErr {
         #[from]

common/cosmwasm-smart-contracts/mixnet-contract/src/msg.rs

@@ -110,6 +110,11 @@ impl InitialRewardingParams {
 
 #[cw_serde]
 pub enum ExecuteMsg {
+    /// Change the admin
+    UpdateAdmin {
+        admin: String,
+    },
+
     AssignNodeLayer {
         mix_id: MixId,
         layer: Layer,
@@ -292,6 +297,7 @@ pub enum ExecuteMsg {
 impl ExecuteMsg {
     pub fn default_memo(&self) -> String {
         match self {
+            ExecuteMsg::UpdateAdmin { admin } => format!("updating contract admin to {admin}"),
             ExecuteMsg::AssignNodeLayer { mix_id, layer } => {
                 format!("assigning mix {mix_id} for layer {layer:?}")
             }
@@ -408,6 +414,9 @@ impl ExecuteMsg {
 #[cw_serde]
 #[cfg_attr(feature = "schema", derive(QueryResponses))]
 pub enum QueryMsg {
+    #[cfg_attr(feature = "schema", returns(cw_controllers::AdminResponse))]
+    Admin {},
+
     // families
     /// Gets the list of families registered in this contract.
     #[cfg_attr(feature = "schema", returns(PagedFamiliesResponse))]

common/cosmwasm-smart-contracts/mixnet-contract/src/signing_types.rs

@@ -4,13 +4,18 @@
 use crate::families::FamilyHead;
 use crate::{Gateway, IdentityKey, MixNode, MixNodeCostParams};
 use contracts_common::signing::{
-    ContractMessageContent, MessageType, Nonce, SignableMessage, SigningPurpose,
+    ContractMessageContent, LegacyContractMessageContent, MessageType, Nonce, SignableMessage,
+    SigningPurpose,
 };
 use cosmwasm_std::{Addr, Coin};
 use serde::Serialize;
 
 pub type SignableMixNodeBondingMsg = SignableMessage<ContractMessageContent<MixnodeBondingPayload>>;
 pub type SignableGatewayBondingMsg = SignableMessage<ContractMessageContent<GatewayBondingPayload>>;
+pub type SignableLegacyMixNodeBondingMsg =
+    SignableMessage<LegacyContractMessageContent<MixnodeBondingPayload>>;
+pub type SignableLegacyGatewayBondingMsg =
+    SignableMessage<LegacyContractMessageContent<GatewayBondingPayload>>;
 pub type SignableFamilyJoinPermitMsg = SignableMessage<FamilyJoinPermit>;
 
 #[derive(Serialize)]
@@ -47,6 +52,20 @@ pub fn construct_mixnode_bonding_sign_payload(
     SignableMessage::new(nonce, content)
 }
 
+pub fn construct_legacy_mixnode_bonding_sign_payload(
+    nonce: Nonce,
+    sender: Addr,
+    pledge: Coin,
+    mix_node: MixNode,
+    cost_params: MixNodeCostParams,
+) -> SignableLegacyMixNodeBondingMsg {
+    let payload = MixnodeBondingPayload::new(mix_node, cost_params);
+    let content: LegacyContractMessageContent<_> =
+        ContractMessageContent::new(sender, vec![pledge], payload).into();
+
+    SignableMessage::new(nonce, content)
+}
+
 #[derive(Serialize)]
 pub struct GatewayBondingPayload {
     gateway: Gateway,
@@ -76,6 +95,19 @@ pub fn construct_gateway_bonding_sign_payload(
     SignableMessage::new(nonce, content)
 }
 
+pub fn construct_legacy_gateway_bonding_sign_payload(
+    nonce: Nonce,
+    sender: Addr,
+    pledge: Coin,
+    gateway: Gateway,
+) -> SignableLegacyGatewayBondingMsg {
+    let payload = GatewayBondingPayload::new(gateway);
+    let content: LegacyContractMessageContent<_> =
+        ContractMessageContent::new(sender, vec![pledge], payload).into();
+
+    SignableMessage::new(nonce, content)
+}
+
 #[derive(Serialize)]
 pub struct FamilyJoinPermit {
     // the granter of this permit

common/cosmwasm-smart-contracts/mixnet-contract/src/types.rs

@@ -187,7 +187,11 @@ impl Index<Layer> for LayerDistribution {
 #[cw_serde]
 pub struct ContractState {
     /// Address of the contract owner.
-    pub owner: Addr,
+    #[deprecated(
+        note = "use explicit ADMIN instead. this field will be removed in future release"
+    )]
+    #[serde(default)]
+    pub owner: Option<Addr>,
 
     /// Address of "rewarding validator" (nym-api) that's allowed to send any rewarding-related transactions.
     pub rewarding_validator_address: Addr,

common/cosmwasm-smart-contracts/multisig-contract/Cargo.toml

@@ -4,15 +4,13 @@ version = "0.1.0"
 edition = "2021"
 license.workspace = true
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
+cosmwasm-schema = { workspace = true }
+cosmwasm-std = { workspace = true }
+cw-storage-plus = { workspace = true }
 cw-utils = { workspace = true }
 cw3 = { workspace = true }
 cw4 = { workspace = true }
-cw-storage-plus = { workspace = true }
-cosmwasm-schema = { workspace = true }
-cosmwasm-std = { workspace = true }
 schemars = { workspace = true }
-serde = { version = "1.0.209", default-features = false, features = ["derive"] }
+serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }

common/credential-storage/migrations/20241104120002_signatures_serialisation_revision.sql

@@ -0,0 +1,13 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+ALTER TABLE master_verification_key
+    ADD COLUMN serialization_revision INTEGER NOT NULL default 1;
+
+ALTER TABLE coin_indices_signatures
+    ADD COLUMN serialization_revision INTEGER NOT NULL default 1;
+
+ALTER TABLE expiration_date_signatures
+    ADD COLUMN serialization_revision INTEGER NOT NULL default 1;

common/credential-storage/src/backends/memory.rs

@@ -5,6 +5,10 @@ use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, Retr
 use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
 use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
 use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
+use nym_credentials::ecash::bandwidth::serialiser::signatures::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+};
 use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
 use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
 use nym_ecash_time::Date;
@@ -192,14 +196,10 @@ impl MemoryEcachTicketbookManager {
         guard.master_vk.get(&epoch_id).cloned()
     }
 
-    pub(crate) async fn insert_master_verification_key(
-        &self,
-        epoch_id: u64,
-        key: &VerificationKeyAuth,
-    ) {
+    pub(crate) async fn insert_master_verification_key(&self, key: &EpochVerificationKey) {
         let mut guard = self.inner.write().await;
 
-        guard.master_vk.insert(epoch_id, key.clone());
+        guard.master_vk.insert(key.epoch_id, key.key.clone());
     }
 
     pub(crate) async fn get_coin_index_signatures(
@@ -213,12 +213,13 @@ impl MemoryEcachTicketbookManager {
 
     pub(crate) async fn insert_coin_index_signatures(
         &self,
-        epoch_id: u64,
-        sigs: &[AnnotatedCoinIndexSignature],
+        sigs: &AggregatedCoinIndicesSignatures,
     ) {
         let mut guard = self.inner.write().await;
 
-        guard.coin_indices_sigs.insert(epoch_id, sigs.to_vec());
+        guard
+            .coin_indices_sigs
+            .insert(sigs.epoch_id, sigs.signatures.clone());
     }
 
     pub(crate) async fn get_expiration_date_signatures(
@@ -232,14 +233,12 @@ impl MemoryEcachTicketbookManager {
 
     pub(crate) async fn insert_expiration_date_signatures(
         &self,
-        _epoch_id: u64,
-        expiration_date: Date,
-        sigs: &[AnnotatedExpirationDateSignature],
+        sigs: &AggregatedExpirationDateSignatures,
     ) {
         let mut guard = self.inner.write().await;
 
         guard
             .expiration_date_sigs
-            .insert(expiration_date, sigs.to_vec());
+            .insert(sigs.expiration_date, sigs.signatures.clone());
     }
 }

common/credential-storage/src/backends/sqlite.rs

@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::models::{
-    BasicTicketbookInformation, RawExpirationDateSignatures, StoredIssuedTicketbook,
-    StoredPendingTicketbook,
+    BasicTicketbookInformation, RawCoinIndexSignatures, RawExpirationDateSignatures,
+    RawVerificationKey, StoredIssuedTicketbook, StoredPendingTicketbook,
 };
 use nym_ecash_time::Date;
 use sqlx::{Executor, Sqlite, Transaction};
@@ -151,25 +151,30 @@ impl SqliteEcashTicketbookManager {
     pub(crate) async fn get_master_verification_key(
         &self,
         epoch_id: i64,
-    ) -> Result<Option<Vec<u8>>, sqlx::Error> {
-        sqlx::query!(
-            "SELECT serialised_key FROM master_verification_key WHERE epoch_id = ?",
+    ) -> Result<Option<RawVerificationKey>, sqlx::Error> {
+        sqlx::query_as!(
+            RawVerificationKey,
+            r#"
+                SELECT epoch_id as "epoch_id: u32", serialised_key, serialization_revision as "serialization_revision: u8"
+                FROM master_verification_key WHERE epoch_id = ?
+            "#,
             epoch_id
         )
         .fetch_optional(&self.connection_pool)
         .await
-        .map(|maybe_record| maybe_record.map(|r| r.serialised_key))
     }
 
     pub(crate) async fn insert_master_verification_key(
         &self,
+        serialisation_revision: u8,
         epoch_id: i64,
         data: &[u8],
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
-            "INSERT INTO master_verification_key(epoch_id, serialised_key) VALUES (?, ?)",
+            "INSERT INTO master_verification_key(epoch_id, serialised_key, serialization_revision) VALUES (?, ?, ?)",
             epoch_id,
-            data
+            data,
+            serialisation_revision
         )
         .execute(&self.connection_pool)
         .await?;
@@ -179,25 +184,30 @@ impl SqliteEcashTicketbookManager {
     pub(crate) async fn get_coin_index_signatures(
         &self,
         epoch_id: i64,
-    ) -> Result<Option<Vec<u8>>, sqlx::Error> {
-        sqlx::query!(
-            "SELECT serialised_signatures FROM coin_indices_signatures WHERE epoch_id = ?",
+    ) -> Result<Option<RawCoinIndexSignatures>, sqlx::Error> {
+        sqlx::query_as!(
+            RawCoinIndexSignatures,
+            r#"
+                SELECT epoch_id as "epoch_id: u32", serialised_signatures, serialization_revision as "serialization_revision: u8"
+                FROM coin_indices_signatures WHERE epoch_id = ?
+            "#,
             epoch_id
         )
         .fetch_optional(&self.connection_pool)
         .await
-        .map(|maybe_record| maybe_record.map(|r| r.serialised_signatures))
     }
 
     pub(crate) async fn insert_coin_index_signatures(
         &self,
+        serialisation_revision: u8,
         epoch_id: i64,
         data: &[u8],
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
-            "INSERT INTO coin_indices_signatures(epoch_id, serialised_signatures) VALUES (?, ?)",
+            "INSERT INTO coin_indices_signatures(epoch_id, serialised_signatures, serialization_revision) VALUES (?, ?, ?)",
             epoch_id,
-            data
+            data,
+            serialisation_revision
         )
         .execute(&self.connection_pool)
         .await?;
@@ -211,7 +221,7 @@ impl SqliteEcashTicketbookManager {
         sqlx::query_as!(
             RawExpirationDateSignatures,
             r#"
-                SELECT epoch_id as "epoch_id: u32", serialised_signatures
+                SELECT epoch_id as "epoch_id: u32", serialised_signatures, serialization_revision as "serialization_revision: u8"
                 FROM expiration_date_signatures
                 WHERE expiration_date = ?
             "#,
@@ -223,15 +233,20 @@ impl SqliteEcashTicketbookManager {
 
     pub(crate) async fn insert_expiration_date_signatures(
         &self,
+        serialisation_revision: u8,
         epoch_id: i64,
         expiration_date: Date,
         data: &[u8],
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
-            "INSERT INTO expiration_date_signatures(expiration_date, epoch_id, serialised_signatures) VALUES (?, ?, ?)",
+            r#"
+                INSERT INTO expiration_date_signatures(expiration_date, epoch_id, serialised_signatures, serialization_revision)
+                VALUES (?, ?, ?, ?)
+            "#,
             expiration_date,
             epoch_id,
-            data
+            data,
+            serialisation_revision
         )
             .execute(&self.connection_pool)
             .await?;

common/credential-storage/src/ephemeral_storage.rs

@@ -9,6 +9,10 @@ use async_trait::async_trait;
 use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
 use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
 use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
+use nym_credentials::ecash::bandwidth::serialiser::signatures::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+};
 use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
 use nym_ecash_time::Date;
 use std::fmt::{self, Debug, Formatter};
@@ -119,11 +123,10 @@ impl Storage for EphemeralStorage {
 
     async fn insert_master_verification_key(
         &self,
-        epoch_id: u64,
-        key: &VerificationKeyAuth,
+        key: &EpochVerificationKey,
     ) -> Result<(), Self::StorageError> {
         self.storage_manager
-            .insert_master_verification_key(epoch_id, key)
+            .insert_master_verification_key(key)
             .await;
         Ok(())
     }
@@ -140,11 +143,10 @@ impl Storage for EphemeralStorage {
 
     async fn insert_coin_index_signatures(
         &self,
-        epoch_id: u64,
-        data: &[AnnotatedCoinIndexSignature],
+        signatures: &AggregatedCoinIndicesSignatures,
     ) -> Result<(), Self::StorageError> {
         self.storage_manager
-            .insert_coin_index_signatures(epoch_id, data)
+            .insert_coin_index_signatures(signatures)
             .await;
         Ok(())
     }
@@ -161,12 +163,10 @@ impl Storage for EphemeralStorage {
 
     async fn insert_expiration_date_signatures(
         &self,
-        epoch_id: u64,
-        expiration_date: Date,
-        data: &[AnnotatedExpirationDateSignature],
+        signatures: &AggregatedExpirationDateSignatures,
     ) -> Result<(), Self::StorageError> {
         self.storage_manager
-            .insert_expiration_date_signatures(epoch_id, expiration_date, data)
+            .insert_expiration_date_signatures(signatures)
             .await;
         Ok(())
     }

common/credential-storage/src/models.rs

@@ -62,4 +62,19 @@ pub struct StoredPendingTicketbook {
 pub struct RawExpirationDateSignatures {
     pub epoch_id: u32,
     pub serialised_signatures: Vec<u8>,
+    pub serialization_revision: u8,
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
+pub struct RawCoinIndexSignatures {
+    pub epoch_id: u32,
+    pub serialised_signatures: Vec<u8>,
+    pub serialization_revision: u8,
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
+pub struct RawVerificationKey {
+    pub epoch_id: u32,
+    pub serialised_key: Vec<u8>,
+    pub serialization_revision: u8,
 }

common/credential-storage/src/persistent_storage/helpers.rs

@@ -1,54 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::error::StorageError;
-use bincode::Options;
-use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
-use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize)]
-struct StorageBorrowedSerdeWrapper<'a, T>(&'a T);
-
-#[derive(Serialize, Deserialize)]
-struct StorageSerdeWrapper<T>(T);
-
-pub(crate) fn serialise_coin_index_signatures(sigs: &[AnnotatedCoinIndexSignature]) -> Vec<u8> {
-    storage_serialiser()
-        .serialize(&StorageBorrowedSerdeWrapper(&sigs))
-        .unwrap()
-}
-
-pub(crate) fn deserialise_coin_index_signatures(
-    raw: &[u8],
-) -> Result<Vec<AnnotatedCoinIndexSignature>, StorageError> {
-    let de: StorageSerdeWrapper<_> = storage_serialiser().deserialize(raw).map_err(|_| {
-        StorageError::database_inconsistency("malformed stored coin index signatures")
-    })?;
-    Ok(de.0)
-}
-
-pub(crate) fn serialise_expiration_date_signatures(
-    sigs: &[AnnotatedExpirationDateSignature],
-) -> Vec<u8> {
-    storage_serialiser()
-        .serialize(&StorageBorrowedSerdeWrapper(&sigs))
-        .unwrap()
-}
-
-pub(crate) fn deserialise_expiration_date_signatures(
-    raw: &[u8],
-) -> Result<Vec<AnnotatedExpirationDateSignature>, StorageError> {
-    let de: StorageSerdeWrapper<_> = storage_serialiser().deserialize(raw).map_err(|_| {
-        StorageError::database_inconsistency("malformed expiration date signatures")
-    })?;
-    Ok(de.0)
-}
-
-// storage serialiser used for non-critical data, such as global expiration signatures or master verification keys,
-// i.e. data that could always be queried for again if malformed
-fn storage_serialiser() -> impl bincode::Options {
-    bincode::DefaultOptions::new()
-        .with_big_endian()
-        .with_varint_encoding()
-}

common/credential-storage/src/persistent_storage/legacy_helpers.rs

@@ -0,0 +1,44 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::StorageError;
+use bincode::Options;
+use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
+use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
+use nym_compact_ecash::VerificationKeyAuth;
+use serde::Deserialize;
+
+#[derive(Deserialize)]
+struct StorageSerdeWrapper<T>(T);
+
+pub(crate) fn deserialise_v1_expiration_date_signatures(
+    raw: &[u8],
+) -> Result<Vec<AnnotatedExpirationDateSignature>, StorageError> {
+    let de: StorageSerdeWrapper<_> = v1_signatures_serialiser().deserialize(raw).map_err(|_| {
+        StorageError::database_inconsistency("malformed expiration date signatures")
+    })?;
+    Ok(de.0)
+}
+
+pub(crate) fn deserialise_v1_coin_index_signatures(
+    raw: &[u8],
+) -> Result<Vec<AnnotatedCoinIndexSignature>, StorageError> {
+    let de: StorageSerdeWrapper<_> = v1_signatures_serialiser().deserialize(raw).map_err(|_| {
+        StorageError::database_inconsistency("malformed stored coin index signatures")
+    })?;
+    Ok(de.0)
+}
+
+pub(crate) fn deserialise_v1_master_verification_key(
+    raw: &[u8],
+) -> Result<VerificationKeyAuth, StorageError> {
+    VerificationKeyAuth::from_bytes(raw).map_err(|_| {
+        StorageError::database_inconsistency("malformed stored master verification key")
+    })
+}
+
+fn v1_signatures_serialiser() -> impl bincode::Options {
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}

common/credential-storage/src/persistent_storage/mod.rs

@@ -1,14 +1,16 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+mod legacy_helpers;
+
 use crate::backends::sqlite::{
     get_next_unspent_ticketbook, increase_used_ticketbook_tickets, SqliteEcashTicketbookManager,
 };
 use crate::error::StorageError;
 use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook};
-use crate::persistent_storage::helpers::{
-    deserialise_coin_index_signatures, deserialise_expiration_date_signatures,
-    serialise_coin_index_signatures, serialise_expiration_date_signatures,
+use crate::persistent_storage::legacy_helpers::{
+    deserialise_v1_coin_index_signatures, deserialise_v1_expiration_date_signatures,
+    deserialise_v1_master_verification_key,
 };
 use crate::storage::Storage;
 use async_trait::async_trait;
@@ -16,6 +18,10 @@ use log::{debug, error};
 use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
 use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
 use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
+use nym_credentials::ecash::bandwidth::serialiser::signatures::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+};
 use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
 use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
 use nym_ecash_time::{ecash_today, Date, EcashTime};
@@ -23,8 +29,6 @@ use sqlx::ConnectOptions;
 use std::path::Path;
 use zeroize::Zeroizing;
 
-mod helpers;
-
 // note that clone here is fine as upon cloning the same underlying pool will be used
 #[derive(Clone)]
 pub struct PersistentStorage {
@@ -229,21 +233,24 @@ impl Storage for PersistentStorage {
             return Ok(None);
         };
 
-        let master_vk = VerificationKeyAuth::from_bytes(&raw).map_err(|_| {
-            StorageError::database_inconsistency("malformed stored master verification key")
-        })?;
-
-        Ok(Some(master_vk))
+        match raw.serialization_revision {
+            1 => deserialise_v1_master_verification_key(&raw.serialised_key).map(Some),
+            other => {
+                let deserialised = EpochVerificationKey::try_unpack(&raw.serialised_key, other)
+                    .map_err(|err| StorageError::database_inconsistency(err.to_string()))?;
+                Ok(Some(deserialised.key))
+            }
+        }
     }
 
     async fn insert_master_verification_key(
         &self,
-        epoch_id: u64,
-        key: &VerificationKeyAuth,
+        key: &EpochVerificationKey,
     ) -> Result<(), Self::StorageError> {
+        let packed = key.pack();
         Ok(self
             .storage_manager
-            .insert_master_verification_key(epoch_id as i64, &key.to_bytes())
+            .insert_master_verification_key(packed.revision, key.epoch_id as i64, &packed.data)
             .await?)
     }
 
@@ -259,16 +266,24 @@ impl Storage for PersistentStorage {
             return Ok(None);
         };
 
-        Ok(Some(deserialise_coin_index_signatures(&raw)?))
+        match raw.serialization_revision {
+            1 => deserialise_v1_coin_index_signatures(&raw.serialised_signatures).map(Some),
+            other => {
+                let deserialised =
+                    AggregatedCoinIndicesSignatures::try_unpack(&raw.serialised_signatures, other)
+                        .map_err(|err| StorageError::database_inconsistency(err.to_string()))?;
+                Ok(Some(deserialised.signatures))
+            }
+        }
     }
 
     async fn insert_coin_index_signatures(
         &self,
-        epoch_id: u64,
-        sigs: &[AnnotatedCoinIndexSignature],
+        signatures: &AggregatedCoinIndicesSignatures,
     ) -> Result<(), Self::StorageError> {
+        let packed = signatures.pack();
         self.storage_manager
-            .insert_coin_index_signatures(epoch_id as i64, &serialise_coin_index_signatures(sigs))
+            .insert_coin_index_signatures(packed.revision, signatures.epoch_id as i64, &packed.data)
             .await?;
         Ok(())
     }
@@ -285,22 +300,30 @@ impl Storage for PersistentStorage {
             return Ok(None);
         };
 
-        Ok(Some(deserialise_expiration_date_signatures(
-            &raw.serialised_signatures,
-        )?))
+        match raw.serialization_revision {
+            1 => deserialise_v1_expiration_date_signatures(&raw.serialised_signatures).map(Some),
+            other => {
+                let deserialised = AggregatedExpirationDateSignatures::try_unpack(
+                    &raw.serialised_signatures,
+                    other,
+                )
+                .map_err(|err| StorageError::database_inconsistency(err.to_string()))?;
+                Ok(Some(deserialised.signatures))
+            }
+        }
     }
 
     async fn insert_expiration_date_signatures(
         &self,
-        epoch_id: u64,
-        expiration_date: Date,
-        sigs: &[AnnotatedExpirationDateSignature],
+        signatures: &AggregatedExpirationDateSignatures,
     ) -> Result<(), Self::StorageError> {
+        let packed = signatures.pack();
         self.storage_manager
             .insert_expiration_date_signatures(
-                epoch_id as i64,
-                expiration_date,
-                &serialise_expiration_date_signatures(sigs),
+                packed.revision,
+                signatures.epoch_id as i64,
+                signatures.expiration_date,
+                &packed.data,
             )
             .await?;
         Ok(())

common/credential-storage/src/storage.rs

@@ -6,6 +6,10 @@ use async_trait::async_trait;
 use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
 use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
 use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
+use nym_credentials::ecash::bandwidth::serialiser::signatures::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+};
 use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
 use nym_ecash_time::Date;
 use std::error::Error;
@@ -64,8 +68,7 @@ pub trait Storage: Send + Sync {
 
     async fn insert_master_verification_key(
         &self,
-        epoch_id: u64,
-        key: &VerificationKeyAuth,
+        key: &EpochVerificationKey,
     ) -> Result<(), Self::StorageError>;
 
     async fn get_coin_index_signatures(
@@ -75,8 +78,7 @@ pub trait Storage: Send + Sync {
 
     async fn insert_coin_index_signatures(
         &self,
-        epoch_id: u64,
-        data: &[AnnotatedCoinIndexSignature],
+        signatures: &AggregatedCoinIndicesSignatures,
     ) -> Result<(), Self::StorageError>;
 
     async fn get_expiration_date_signatures(
@@ -86,8 +88,6 @@ pub trait Storage: Send + Sync {
 
     async fn insert_expiration_date_signatures(
         &self,
-        epoch_id: u64,
-        expiration_date: Date,
-        data: &[AnnotatedExpirationDateSignature],
+        signatures: &AggregatedExpirationDateSignatures,
     ) -> Result<(), Self::StorageError>;
 }

common/credential-utils/src/utils.rs

@@ -3,9 +3,7 @@
 
 use crate::errors::{Error, Result};
 use log::*;
-use nym_bandwidth_controller::acquire::{
-    get_ticket_book, query_and_persist_required_global_signatures,
-};
+use nym_bandwidth_controller::acquire::{get_ticket_book, query_and_persist_required_global_data};
 use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::DEFAULT_DATA_DIR;
 use nym_credential_storage::persistent_storage::PersistentStorage;
@@ -45,14 +43,10 @@ where
     let apis = all_ecash_api_clients(client, epoch_id).await?;
     let ticketbook_expiration = ecash_default_expiration_date();
 
-    // make sure we have all required coin indices and expiration date signatures before attempting the deposit
-    query_and_persist_required_global_signatures(
-        storage,
-        epoch_id,
-        ticketbook_expiration,
-        apis.clone(),
-    )
-    .await?;
+    // make sure we have all required coin indices and expiration date signatures alongside the master verification key
+    // before attempting the deposit
+    query_and_persist_required_global_data(storage, epoch_id, ticketbook_expiration, apis.clone())
+        .await?;
 
     let issuance_data = nym_bandwidth_controller::acquire::make_deposit(
         client,

common/credential-verification/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "nym-credential-verification"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+
+[dependencies]
+bs58 = { workspace = true }
+cosmwasm-std = { workspace = true }
+cw-utils = { workspace = true }
+futures = { workspace = true }
+rand = { workspace = true }
+si-scale = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+time = { workspace = true }
+tracing = { workspace = true }
+
+nym-api-requests = { path = "../../nym-api/nym-api-requests" }
+nym-credentials = { path = "../credentials" }
+nym-credentials-interface = { path = "../credentials-interface" }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
+nym-ecash-double-spending = { path = "../ecash-double-spending" }
+nym-gateway-requests = { path = "../gateway-requests" }
+nym-gateway-storage = { path = "../gateway-storage" }
+nym-task = { path = "../task" }
+nym-validator-client = { path = "../client-libs/validator-client" }

common/credential-verification/src/bandwidth_storage_manager.rs

@@ -0,0 +1,148 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials::ecash::utils::ecash_today;
+use nym_credentials_interface::Bandwidth;
+use nym_gateway_requests::ServerResponse;
+use nym_gateway_storage::Storage;
+use si_scale::helpers::bibytes2;
+use time::OffsetDateTime;
+use tracing::*;
+
+use crate::error::*;
+use crate::BandwidthFlushingBehaviourConfig;
+use crate::ClientBandwidth;
+
+const FREE_TESTNET_BANDWIDTH_VALUE: Bandwidth = Bandwidth::new_unchecked(64 * 1024 * 1024 * 1024); // 64GB
+
+#[derive(Clone)]
+pub struct BandwidthStorageManager<S> {
+    pub(crate) storage: S,
+    pub(crate) client_bandwidth: ClientBandwidth,
+    pub(crate) client_id: i64,
+    pub(crate) bandwidth_cfg: BandwidthFlushingBehaviourConfig,
+    pub(crate) only_coconut_credentials: bool,
+}
+
+impl<S: Storage + Clone + 'static> BandwidthStorageManager<S> {
+    pub fn new(
+        storage: S,
+        client_bandwidth: ClientBandwidth,
+        client_id: i64,
+        bandwidth_cfg: BandwidthFlushingBehaviourConfig,
+        only_coconut_credentials: bool,
+    ) -> Self {
+        BandwidthStorageManager {
+            storage,
+            client_bandwidth,
+            client_id,
+            bandwidth_cfg,
+            only_coconut_credentials,
+        }
+    }
+
+    async fn sync_expiration(&mut self) -> Result<()> {
+        self.storage
+            .set_expiration(self.client_id, self.client_bandwidth.bandwidth.expiration)
+            .await?;
+        Ok(())
+    }
+
+    pub async fn handle_claim_testnet_bandwidth(&mut self) -> Result<ServerResponse> {
+        debug!("handling testnet bandwidth request");
+
+        if self.only_coconut_credentials {
+            return Err(Error::OnlyCoconutCredentials);
+        }
+
+        self.increase_bandwidth(FREE_TESTNET_BANDWIDTH_VALUE, ecash_today())
+            .await?;
+        let available_total = self.client_bandwidth.bandwidth.bytes;
+
+        Ok(ServerResponse::Bandwidth { available_total })
+    }
+
+    #[instrument(skip_all)]
+    pub async fn try_use_bandwidth(&mut self, required_bandwidth: i64) -> Result<i64> {
+        if self.client_bandwidth.bandwidth.expired() {
+            self.expire_bandwidth().await?;
+        }
+        let available_bandwidth = self.client_bandwidth.bandwidth.bytes;
+
+        if available_bandwidth < required_bandwidth {
+            return Err(Error::OutOfBandwidth {
+                required: required_bandwidth,
+                available: available_bandwidth,
+            });
+        }
+
+        let available_bi2 = bibytes2(available_bandwidth as f64);
+        let required_bi2 = bibytes2(required_bandwidth as f64);
+        debug!(available = available_bi2, required = required_bi2);
+
+        self.consume_bandwidth(required_bandwidth).await?;
+        Ok(available_bandwidth)
+    }
+
+    async fn expire_bandwidth(&mut self) -> Result<()> {
+        self.storage.reset_bandwidth(self.client_id).await?;
+        self.client_bandwidth.bandwidth = Default::default();
+        self.client_bandwidth.update_sync_data();
+        Ok(())
+    }
+
+    /// Decreases the amount of available bandwidth of the connected client by the specified value.
+    ///
+    /// # Arguments
+    ///
+    /// * `amount`: amount to decrease the available bandwidth by.
+    async fn consume_bandwidth(&mut self, amount: i64) -> Result<()> {
+        self.client_bandwidth.bandwidth.bytes -= amount;
+        self.client_bandwidth.bytes_delta_since_sync -= amount;
+
+        // since we're going to be operating on a fair use policy anyway, even if we crash and let extra few packets
+        // through, that's completely fine
+        if self.client_bandwidth.should_sync(self.bandwidth_cfg) {
+            self.sync_bandwidth().await?;
+        }
+
+        Ok(())
+    }
+
+    #[instrument(level = "trace", skip_all)]
+    async fn sync_bandwidth(&mut self) -> Result<()> {
+        trace!("syncing client bandwidth with the underlying storage");
+        let updated = self
+            .storage
+            .increase_bandwidth(self.client_id, self.client_bandwidth.bytes_delta_since_sync)
+            .await?;
+
+        trace!(updated);
+
+        self.client_bandwidth.bandwidth.bytes = updated;
+
+        self.client_bandwidth.update_sync_data();
+        Ok(())
+    }
+
+    /// Increases the amount of available bandwidth of the connected client by the specified value.
+    ///
+    /// # Arguments
+    ///
+    /// * `amount`: amount to increase the available bandwidth by.
+    /// * `expiration` : the expiration date of that bandwidth
+    pub async fn increase_bandwidth(
+        &mut self,
+        bandwidth: Bandwidth,
+        expiration: OffsetDateTime,
+    ) -> Result<()> {
+        self.client_bandwidth.bandwidth.bytes += bandwidth.value() as i64;
+        self.client_bandwidth.bytes_delta_since_sync += bandwidth.value() as i64;
+        self.client_bandwidth.bandwidth.expiration = expiration;
+
+        // any increases to bandwidth should get flushed immediately
+        // (we don't want to accidentally miss somebody claiming a gigabyte voucher)
+        self.sync_expiration().await?;
+        self.sync_bandwidth().await
+    }
+}

common/credential-verification/src/client_bandwidth.rs

@@ -0,0 +1,57 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::time::Duration;
+
+use nym_credentials_interface::AvailableBandwidth;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Copy)]
+pub struct BandwidthFlushingBehaviourConfig {
+    /// Defines maximum delay between client bandwidth information being flushed to the persistent storage.
+    pub client_bandwidth_max_flushing_rate: Duration,
+
+    /// Defines a maximum change in client bandwidth before it gets flushed to the persistent storage.
+    pub client_bandwidth_max_delta_flushing_amount: i64,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct ClientBandwidth {
+    pub(crate) bandwidth: AvailableBandwidth,
+    pub(crate) last_flushed: OffsetDateTime,
+
+    /// the number of bytes the client had during the last sync.
+    /// it is used to determine whether the current value should be synced with the storage
+    /// by checking the delta with the known amount
+    pub(crate) bytes_at_last_sync: i64,
+    pub(crate) bytes_delta_since_sync: i64,
+}
+
+impl ClientBandwidth {
+    pub fn new(bandwidth: AvailableBandwidth) -> ClientBandwidth {
+        ClientBandwidth {
+            bandwidth,
+            last_flushed: OffsetDateTime::now_utc(),
+            bytes_at_last_sync: bandwidth.bytes,
+            bytes_delta_since_sync: 0,
+        }
+    }
+
+    pub(crate) fn should_sync(&self, cfg: BandwidthFlushingBehaviourConfig) -> bool {
+        if self.bytes_delta_since_sync.abs() >= cfg.client_bandwidth_max_delta_flushing_amount {
+            return true;
+        }
+
+        if self.last_flushed + cfg.client_bandwidth_max_flushing_rate < OffsetDateTime::now_utc() {
+            return true;
+        }
+
+        false
+    }
+
+    pub(crate) fn update_sync_data(&mut self) {
+        self.last_flushed = OffsetDateTime::now_utc();
+        self.bytes_at_last_sync = self.bandwidth.bytes;
+        self.bytes_delta_since_sync = 0;
+    }
+}

common/credential-verification/src/ecash/credential_sender.rs

@@ -1,17 +1,17 @@
 // Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use crate::node::client_handling::bandwidth::Bandwidth;
-use crate::node::client_handling::websocket::connection_handler::ecash::error::EcashTicketError;
-use crate::node::client_handling::websocket::connection_handler::ecash::helpers::for_each_api_concurrent;
-use crate::node::client_handling::websocket::connection_handler::ecash::state::SharedState;
-use crate::GatewayError;
+use crate::ecash::error::EcashTicketError;
+use crate::ecash::helpers::for_each_api_concurrent;
+use crate::ecash::state::SharedState;
+use crate::Error;
 use cosmwasm_std::Fraction;
 use cw_utils::ThresholdResponse;
 use futures::channel::mpsc::UnboundedReceiver;
 use futures::{Stream, StreamExt};
 use nym_api_requests::constants::MIN_BATCH_REDEMPTION_DELAY;
 use nym_api_requests::ecash::models::{BatchRedeemTicketsBody, VerifyEcashTicketBody};
+use nym_credentials_interface::Bandwidth;
 use nym_credentials_interface::{ClientTicket, TicketType};
 use nym_gateway_storage::Storage;
 use nym_validator_client::nym_api::EpochId;
@@ -105,25 +105,25 @@ impl PendingRedemptionVote {
     }
 }
 
-pub(crate) struct CredentialHandlerConfig {
+pub struct CredentialHandlerConfig {
     /// Specifies the multiplier for revoking a malformed/double-spent ticket
     /// (if it has to go all the way to the nym-api for verification)
     /// e.g. if one ticket grants 100Mb and `revocation_bandwidth_penalty` is set to 1.5,
     /// the client will lose 150Mb
-    pub(crate) revocation_bandwidth_penalty: f32,
+    pub revocation_bandwidth_penalty: f32,
 
     /// Specifies the interval for attempting to resolve any failed, pending operations,
     /// such as ticket verification or redemption.
-    pub(crate) pending_poller: Duration,
+    pub pending_poller: Duration,
 
-    pub(crate) minimum_api_quorum: f32,
+    pub minimum_api_quorum: f32,
 
     /// Specifies the minimum number of tickets this gateway will attempt to redeem.
-    pub(crate) minimum_redemption_tickets: usize,
+    pub minimum_redemption_tickets: usize,
 
     /// Specifies the maximum time between two subsequent tickets redemptions.
-    /// That's required as nym-apis will purge all ticket information for tickets older than 30 days.
-    pub(crate) maximum_time_between_redemption: Duration,
+    /// That's required as nym-apis will purge all ticket information for tickets older than maximum validity.
+    pub maximum_time_between_redemption: Duration,
 }
 
 pub(crate) struct CredentialHandler<St: Storage> {
@@ -260,7 +260,7 @@ where
         config: CredentialHandlerConfig,
         ticket_receiver: UnboundedReceiver<ClientTicket>,
         shared_state: SharedState<St>,
-    ) -> Result<Self, GatewayError> {
+    ) -> Result<Self, Error> {
         let multisig_threshold = shared_state
             .nyxd_client
             .read()
@@ -269,7 +269,7 @@ where
             .await?;
 
         let ThresholdResponse::AbsolutePercentage { percentage, .. } = multisig_threshold else {
-            return Err(GatewayError::InvalidMultisigThreshold);
+            return Err(Error::InvalidMultisigThreshold);
         };
 
         // that's a nasty conversion, but it works : )

common/credential-verification/src/ecash/double_spending.rs

@@ -1,10 +1,10 @@
 // Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use crate::node::client_handling::websocket::connection_handler::ecash::error::EcashTicketError;
-use crate::node::client_handling::websocket::connection_handler::ecash::state::SharedState;
-use crate::node::Storage;
+use crate::ecash::error::EcashTicketError;
+use crate::ecash::state::SharedState;
 use nym_ecash_double_spending::DoubleSpendingFilter;
+use nym_gateway_storage::Storage;
 use nym_task::TaskClient;
 use nym_validator_client::client::NymApiClientExt;
 use nym_validator_client::EcashApiClient;

common/credential-verification/src/ecash/mod.rs

@@ -1,26 +1,25 @@
 // Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use crate::node::client_handling::websocket::connection_handler::ecash::state::SharedState;
-use crate::GatewayError;
+use crate::Error;
 use credential_sender::CredentialHandler;
+use credential_sender::CredentialHandlerConfig;
 use double_spending::DoubleSpendingDetector;
+use error::EcashTicketError;
 use futures::channel::mpsc::{self, UnboundedSender};
 use nym_credentials::CredentialSpendingData;
 use nym_credentials_interface::{ClientTicket, CompactEcashError, NymPayInfo, VerificationKeyAuth};
 use nym_gateway_storage::Storage;
 use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::DirectSigningHttpRpcNyxdClient;
+use state::SharedState;
 use time::OffsetDateTime;
 use tokio::sync::{Mutex, RwLockReadGuard};
 use tracing::error;
 
-use crate::node::client_handling::websocket::connection_handler::ecash::credential_sender::CredentialHandlerConfig;
-use crate::node::client_handling::websocket::connection_handler::ecash::error::EcashTicketError;
-
-pub(crate) mod credential_sender;
+pub mod credential_sender;
 pub(crate) mod double_spending;
-pub(crate) mod error;
+pub mod error;
 mod helpers;
 mod state;
 
@@ -45,7 +44,7 @@ where
         pk_bytes: [u8; 32],
         shutdown: nym_task::TaskClient,
         storage: S,
-    ) -> Result<Self, GatewayError> {
+    ) -> Result<Self, Error> {
         let shared_state = SharedState::new(nyxd_client, storage).await?;
 
         let double_spend_detector = DoubleSpendingDetector::new(shared_state.clone());

common/credential-verification/src/ecash/state.rs

@@ -1,12 +1,12 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::node::client_handling::websocket::connection_handler::ecash::error::EcashTicketError;
-use crate::node::Storage;
-use crate::GatewayError;
+use crate::ecash::error::EcashTicketError;
+use crate::Error;
 use cosmwasm_std::{from_binary, CosmosMsg, WasmMsg};
 use nym_credentials_interface::VerificationKeyAuth;
 use nym_ecash_contract_common::msg::ExecuteMsg;
+use nym_gateway_storage::Storage;
 use nym_validator_client::coconut::all_ecash_api_clients;
 use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::{
@@ -37,7 +37,7 @@ where
     pub(crate) async fn new(
         nyxd_client: DirectSigningHttpRpcNyxdClient,
         storage: S,
-    ) -> Result<Self, GatewayError> {
+    ) -> Result<Self, Error> {
         let address = nyxd_client.address();
 
         if nyxd_client.dkg_contract_address().is_none() {

common/credential-verification/src/error.rs

@@ -0,0 +1,57 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+use time::Date;
+
+use crate::ecash::error::EcashTicketError;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("the provided bandwidth credential has already been spent before at this gateway")]
+    BandwidthCredentialAlreadySpent,
+
+    #[error(transparent)]
+    EcashFailure(EcashTicketError),
+
+    #[error(
+        "the provided credential has an invalid spending date. got {got} but expected {expected}"
+    )]
+    InvalidCredentialSpendingDate { got: Date, expected: Date },
+
+    #[error("the current multisig contract is not using 'AbsolutePercentage' threshold!")]
+    InvalidMultisigThreshold,
+
+    #[error(
+        "the received payment contained more than a single ticket. that's currently not supported"
+    )]
+    MultipleTickets,
+
+    #[error("Nyxd Error - {0}")]
+    NyxdError(#[from] nym_validator_client::nyxd::error::NyxdError),
+
+    #[error("This gateway is only accepting coconut credentials for bandwidth")]
+    OnlyCoconutCredentials,
+
+    #[error("insufficient bandwidth available to process the request. required: {required}B, available: {available}B")]
+    OutOfBandwidth { required: i64, available: i64 },
+
+    #[error("Internal gateway storage error")]
+    StorageError(#[from] nym_gateway_storage::error::StorageError),
+
+    #[error("{0}")]
+    UnknownTicketType(#[from] nym_credentials_interface::UnknownTicketType),
+}
+
+impl From<EcashTicketError> for Error {
+    fn from(err: EcashTicketError) -> Self {
+        // don't expose storage issue details to the user
+        if let EcashTicketError::InternalStorageFailure { source } = err {
+            Error::StorageError(source)
+        } else {
+            Error::EcashFailure(err)
+        }
+    }
+}

common/credential-verification/src/lib.rs

@@ -0,0 +1,156 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use bandwidth_storage_manager::BandwidthStorageManager;
+use std::sync::Arc;
+use time::{Date, OffsetDateTime};
+use tracing::*;
+
+use nym_credentials::ecash::utils::{ecash_today, EcashTime};
+use nym_credentials_interface::{Bandwidth, ClientTicket, TicketType};
+use nym_gateway_requests::models::CredentialSpendingRequest;
+use nym_gateway_storage::Storage;
+
+pub use client_bandwidth::*;
+use ecash::EcashManager;
+pub use error::*;
+
+pub mod bandwidth_storage_manager;
+mod client_bandwidth;
+pub mod ecash;
+pub mod error;
+
+pub struct CredentialVerifier<S> {
+    credential: CredentialSpendingRequest,
+    ecash_verifier: Arc<EcashManager<S>>,
+    bandwidth_storage_manager: BandwidthStorageManager<S>,
+}
+
+impl<S: Storage + Clone + 'static> CredentialVerifier<S> {
+    pub fn new(
+        credential: CredentialSpendingRequest,
+        ecash_verifier: Arc<EcashManager<S>>,
+        bandwidth_storage_manager: BandwidthStorageManager<S>,
+    ) -> Self {
+        CredentialVerifier {
+            credential,
+            ecash_verifier,
+            bandwidth_storage_manager,
+        }
+    }
+
+    fn check_credential_spending_date(&self, today: Date) -> Result<()> {
+        let proposed = self.credential.data.spend_date;
+        trace!("checking ticket spending date...");
+
+        if today != proposed {
+            trace!("invalid credential spending date. received {proposed}");
+            return Err(Error::InvalidCredentialSpendingDate {
+                got: proposed,
+                expected: today,
+            });
+        }
+        Ok(())
+    }
+
+    async fn check_bloomfilter(&self, serial_number: &Vec<u8>) -> Result<()> {
+        trace!("checking the bloomfilter...");
+
+        let spent = self.ecash_verifier.check_double_spend(serial_number).await;
+
+        if spent {
+            trace!("the credential has already been spent before at some gateway before (bloomfilter failure)");
+            return Err(Error::BandwidthCredentialAlreadySpent);
+        }
+        Ok(())
+    }
+
+    async fn check_local_db_for_double_spending(&self, serial_number: &[u8]) -> Result<()> {
+        trace!("checking local db for double spending...");
+
+        let spent = self
+            .bandwidth_storage_manager
+            .storage
+            .contains_ticket(serial_number)
+            .await?;
+        if spent {
+            trace!("the credential has already been spent before at this gateway");
+            return Err(Error::BandwidthCredentialAlreadySpent);
+        }
+        Ok(())
+    }
+
+    async fn cryptographically_verify_ticket(&self) -> Result<()> {
+        trace!("attempting to perform ticket verification...");
+
+        let aggregated_verification_key = self
+            .ecash_verifier
+            .verification_key(self.credential.data.epoch_id)
+            .await?;
+
+        self.ecash_verifier
+            .check_payment(&self.credential.data, &aggregated_verification_key)
+            .await?;
+        Ok(())
+    }
+
+    async fn store_received_ticket(&self, received_at: OffsetDateTime) -> Result<i64> {
+        trace!("storing received ticket");
+        let ticket_id = self
+            .bandwidth_storage_manager
+            .storage
+            .insert_received_ticket(
+                self.bandwidth_storage_manager.client_id,
+                received_at,
+                self.credential.encoded_serial_number(),
+                self.credential.to_bytes(),
+            )
+            .await?;
+        Ok(ticket_id)
+    }
+
+    fn async_verify_ticket(&self, ticket_id: i64) {
+        let client_ticket = ClientTicket::new(self.credential.data.clone(), ticket_id);
+
+        self.ecash_verifier.async_verify(client_ticket);
+    }
+
+    pub async fn verify(&mut self) -> Result<i64> {
+        let received_at = OffsetDateTime::now_utc();
+        let spend_date = ecash_today();
+
+        // check if the credential hasn't been spent before
+        let serial_number = self.credential.data.encoded_serial_number();
+        let credential_type = TicketType::try_from_encoded(self.credential.data.payment.t_type)?;
+
+        if self.credential.data.payment.spend_value != 1 {
+            return Err(Error::MultipleTickets);
+        }
+
+        self.check_credential_spending_date(spend_date.ecash_date())?;
+        self.check_bloomfilter(&serial_number).await?;
+        self.check_local_db_for_double_spending(&serial_number)
+            .await?;
+
+        // TODO: do we HAVE TO do it?
+        self.cryptographically_verify_ticket().await?;
+
+        let ticket_id = self.store_received_ticket(received_at).await?;
+        self.async_verify_ticket(ticket_id);
+
+        // TODO: double storing?
+        // self.store_spent_credential(serial_number_bs58).await?;
+
+        let bandwidth = Bandwidth::ticket_amount(credential_type.into());
+
+        self.bandwidth_storage_manager
+            .increase_bandwidth(bandwidth, spend_date)
+            .await?;
+
+        Ok(self
+            .bandwidth_storage_manager
+            .client_bandwidth
+            .bandwidth
+            .bytes)
+    }
+}