View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0009725Talerchallengerpublic2025-04-10 20:002025-05-10 02:11
Reportersebasjm Assigned ToChristian Grothoff Resolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicator 
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Versiongit (master) 
Target Version1.0Fixed in Version1.0 
Summary0009725: is not possible to use challeger with read_only mode
DescriptionWhen a challenge has been setup with a payload it should work as read only (the user can only trigger the challenge and confirm the pin but not change the address)
For this:
 * last_address must be filled with the request payload
 * fix_address must be true
 * changes_left must be 0


Current behavior:

$ curl 'http://challenger.taler.test:1180/setup/1' -X 'POST' -H 'Accept: application/json' -H 'Authorization: Bearer secret-token:xxx' -d '{"CONTACT_NAME":"xxx","ADDRESS_LINES":"xxx","ADDRESS_COUNTRY":"xxx"}
{
  "nonce": "SZYJ57RKM08AW8GZXEJ5C6ZC5BQE1J38RZBK8YGTWGXF1R2HTQ4G"
}

$ curl 'http://challenger.taler.test:1180/authorize/SZYJ57RKM08AW8GZXEJ5C6ZC5BQE1J38RZBK8YGTWGXF1R2HTQ4G?response_type=code&client_id=1&redirect_uri=http%3A%2F%2Fexchange.taler.test%2Fkyc-proof%2Fxxx&state=DE6RQX6MN58T7MRNCD2QGD39KTS0A0WF28HJHFTTE87W1YE1FS00' -X 'POST'
{
  "fix_address": false,
  "solved": false,
  "pin_transmissions_left": 0,
  "auth_attempts_left": 0,
  "retransmission_time": {
    "t_s": 5
  },
  "changes_left": 3
}


Expected behavior:


$ curl 'http://challenger.taler.test:1180/setup/1' -X 'POST' -H 'Accept: application/json' -H 'Authorization: Bearer secret-token:xxx' -d '{"CONTACT_NAME":"xxx","ADDRESS_LINES":"xxx","ADDRESS_COUNTRY":"xxx"}'
{
  "nonce": "SZYJ57RKM08AW8GZXEJ5C6ZC5BQE1J38RZBK8YGTWGXF1R2HTQ4G"
}

$ curl 'http://challenger.taler.test:1180/authorize/SZYJ57RKM08AW8GZXEJ5C6ZC5BQE1J38RZBK8YGTWGXF1R2HTQ4G?response_type=code&client_id=1&redirect_uri=http%3A%2F%2Fexchange.taler.test%2Fkyc-proof%2Fxxx&state=DE6RQX6MN58T7MRNCD2QGD39KTS0A0WF28HJHFTTE87W1YE1FS00' -X 'POST'
{
  "fix_address": true,
  "last_address": {"CONTACT_NAME":"xxx","ADDRESS_LINES":"xxx","ADDRESS_COUNTRY":"xxx"},
  "solved": false,
  "pin_transmissions_left": 0,
  "auth_attempts_left": 0,
  "retransmission_time": {
    "t_s": 5
  },
  "changes_left": 0
}
TagsNo tags attached.

Required notifications

Address or linkRemarkAdded byNotifiedActions

Relationships

related to 0009349 closedChristian Grothoff enforce read-only address data in challenger SPA 

Activities

Christian Grothoff

2025-04-11 12:59

manager   ~0024512

Well, the idea (now clarified in the challenger API) was actually that you would do:

$ curl 'http://challenger.taler.test:1180/setup/1' -X 'POST' -H 'Accept: application/json' -H 'Authorization: Bearer secret-token:xxx' -d '{"CONTACT_NAME":"xxx","ADDRESS_LINES":"xxx","ADDRESS_COUNTRY":"xxx","read_only":true}
{
  "nonce": "SZYJ57RKM08AW8GZXEJ5C6ZC5BQE1J38RZBK8YGTWGXF1R2HTQ4G"
}

to make an address read-only, because not all addresses given as part of /setup are inherently read-only.

Then, you would get:

 curl 'http://challenger.taler.test:1180/authorize/SZYJ57RKM08AW8GZXEJ5C6ZC5BQE1J38RZBK8YGTWGXF1R2HTQ4G?response_type=code&client_id=1&redirect_uri=http%3A%2F%2Fexchange.taler.test%2Fkyc-proof%2Fxxx&state=DE6RQX6MN58T7MRNCD2QGD39KTS0A0WF28HJHFTTE87W1YE1FS00' -X 'POST'
{
  "fix_address": SEEBELOW,
  "last_address": {"CONTACT_NAME":"xxx","ADDRESS_LINES":"xxx","ADDRESS_COUNTRY":"xxx","read_only":true},
  "solved": false,
  "pin_transmissions_left": 0,
  "auth_attempts_left": 0,
  "retransmission_time": {
    "t_s": 5
  },

and act on the 'read_only' field in address. But you are right that "fix_address":true ALSO makes sense in this case, so the latest challenger will set that now as well.

sebasjm

2025-04-11 18:04

developer   ~0024515

Last edited: 2025-04-11 18:05

Looks like the payload is ignored.

$ NONCE=$(curl 'http://challenger.taler.test:1180/setup/2' -X 'POST' -H "Content-type: application/json" -H 'Authorization: Bearer secret-token:chal-secret' -d '{"CONTACT_NAME":"xxx","ADDRESS_LINES":"xxx","ADDRESS_COUNTRY":"yyy","read_only":true}' -s | jq -r .nonce);
$ curl "http://challenger.taler.test:1180/authorize/$NONCE?response_type=code&client_id=2&redirect_uri=http%3A%2F%2Fexchange.taler.test%3A1180%2Fkyc-proof%2Fwallet&state=ddd"

{
  "fix_address": false,
  "solved": false,
  "pin_transmissions_left": 0,
  "auth_attempts_left": 0,
  "retransmission_time": {
    "t_s": 5
  },
  "changes_left": 3
}

Christian Grothoff

2025-04-11 18:39

manager   ~0024516

Ok, that was a stupid bug. Fixed 0716368..0afed3f

sebasjm

2025-04-15 16:53

developer   ~0024564

I still can't create a read_only challenge

Christian Grothoff

2025-04-15 18:31

manager   ~0024565

Which exact challenger version did you try?

sebasjm

2025-04-16 23:13

developer   ~0024586

update v0.14.12 to fixed the problem

Issue History

Date ModifiedUsernameFieldChange
2025-04-10 20:00sebasjmNew Issue
2025-04-10 20:00sebasjmStatusnew => assigned
2025-04-10 20:00sebasjmAssigned To => Christian Grothoff
2025-04-11 12:59Christian GrothoffNote Added: 0024512
2025-04-11 12:59Christian GrothoffStatusassigned => informing
2025-04-11 12:59Christian GrothoffResolutionopen => fixed
2025-04-11 12:59Christian GrothoffFixed in Version => 1.0
2025-04-11 12:59Christian GrothoffProduct Version1.0 => git (master)
2025-04-11 18:04sebasjmStatusinforming => feedback
2025-04-11 18:04sebasjmResolutionfixed => reopened
2025-04-11 18:04sebasjmNote Added: 0024515
2025-04-11 18:05sebasjmNote Edited: 0024515
2025-04-11 18:39Christian GrothoffNote Added: 0024516
2025-04-11 18:39Christian GrothoffStatusfeedback => informing
2025-04-11 18:39Christian GrothoffResolutionreopened => fixed
2025-04-15 16:53sebasjmStatusinforming => feedback
2025-04-15 16:53sebasjmResolutionfixed => reopened
2025-04-15 16:53sebasjmNote Added: 0024564
2025-04-15 16:53sebasjmRelationship addedrelated to 0009349
2025-04-15 18:31Christian GrothoffNote Added: 0024565
2025-04-16 23:13sebasjmNote Added: 0024586
2025-04-16 23:13sebasjmStatusfeedback => assigned
2025-04-16 23:13sebasjmStatusassigned => informing
2025-04-16 23:13sebasjmResolutionreopened => fixed
2025-05-10 02:11Christian GrothoffStatusinforming => closed
Powered by locust
Contact administrator for assistance
User Documentation