@startuml

title Transfer: 3.4.2 Bad Signed Challenge - Hub Hosted Auth-Service


box "PISP"
participant "PISP Server" as D1
end box
box "Mojaloop"
    participant Switch as S
    participant "Auth-Service" as AUTHS
end box
box "DFSP A"
    participant "DFSP A\n(Payer)" as D2
end box


... PISP has initiated Thirdparty Transaction Request with ""POST /thirdpartyRequests/transactions""...

... DFSP A has received quote, and asked PISP to verify...

note right of D1
  PISP looks up the ""transactionRequestId"" and
  checks the quote with the user,
  and uses the FIDO API to sign the 
  the **""challenge""** string
end note

rnote right of D1 #Light
**""PUT /thirdpartyRequests/authorizations""**
**""    /33333333-0000-0000-0000-000000000000""**
""FSPIOP-Source: pispa""
""FSPIOP-Destination: dfspa""
{
  "authenticationInfo": {
    "authentication": "U2F",
    "authenticationValue": {
      "pinValue": "<base64 encoded binary - the signed challenge>",
      "counter": "1"
    }
  }
  "responseType": "ENTERED"
}
end note
D1 -> S: ""PUT /thirdpartyRequests/authorizations""\n""/33333333-0000-0000-0000-000000000000""
S --> D1: ""200 OK""
S -> D2: ""PUT /thirdpartyRequests/authorizations""\n""/33333333-0000-0000-0000-000000000000""
D2 --> S: ""200 OK""

D2 -> D2: Lookup ""transactionRequestId"" for this ""authorizationId""
D2 -> D2: Lookup ""consentId"" for this ""transactionRequestId""


D2 -> D2: Generate a new ""verificationRequestId"", and associate \n it with the ""thirdpartyTransactionRequestId""

rnote left of D2 #Light
**""POST /thirdpartyRequests/verifications""**
""FSPIOP-Source: dfspa""
""FSPIOP-Destination: central-auth""
{
  "verificationRequestId": "44444444-0000-0000-0000-000000000000",
  "challenge": ""<base64 encoded binary - the encoded challenge>"",
  "value": {
    "authenticationInfo": {
      "authentication": "U2F",
      "authenticationValue": {
        "pinValue": "<base64 encoded binary - the signed challenge>",
        "counter": "1"
      }
    }
    "responseType": "ENTERED"
  },
  "consentId": "123"
}
end note
D2 -> S: ""POST /thirdpartyRequests/verifications""
S --> D2: ""202 Accepted""
S -> AUTHS: ""POST /thirdpartyRequests/verifications""
AUTHS --> S: ""202 Accepted""

AUTHS -> AUTHS: Lookup this consent based on consentId
AUTHS -> AUTHS: Ensure the accountAddress matches what is in Consent
AUTHS -> AUTHS: Check that the signed bytes match the \npublickey we have stored for the consent

rnote right of AUTHS #Light
**""PUT /thirdpartyRequests/verifications""**
**""    /44444444-0000-0000-0000-000000000000/error""**
""FSPIOP-Source: central-auth""
""FSPIOP-Destination: dfspa""
{
  "errorInformation": {
    "errorCode": "6200",
    "errorDescription": "Invalid signed challenge",
    "extensionList": []
  }
}
end note
AUTHS -> S: ""PUT /thirdpartyRequests/verifications""\n""    /44444444-0000-0000-0000-000000000000/error""
S --> AUTHS: ""200 OK""
S -> D2: ""PUT /thirdpartyRequests/verifications""\n""    /44444444-0000-0000-0000-000000000000/error""
D2 --> S: ""200 OK""

note over D2
  Signed challenge is invalid. Transaction Request failed.
end note


rnote left of D2 #Light
**""PUT /thirdpartyRequests/transactions""**
**""    /00000000-0000-0000-0000-000000000000/error""**
""FSPIOP-Source: dfspa""
""FSPIOP-Destination: pispa""
{
  "errorInformation": {
    "errorCode": "6200",
    "errorDescription": "Invalid signed challenge",
    "extensionList": []
  }
}
end note
D2 -> S: ""PUT /thirdpartyRequests/transactions""\n""    /00000000-0000-0000-0000-000000000000/error""
S --> D2: ""200 OK""
S -> D1: ""PUT /thirdpartyRequests/transactions""\n""    /00000000-0000-0000-0000-000000000000/error""
D1 --> S: ""200 OK""

@enduml
