1 files changed, 29 insertions, 17 deletions

diff --git a/src/mailman_pgp/commands/eml_key.py b/src/mailman_pgp/commands/eml_key.py
index 9df6065..7b7782d 100644
--- a/src/mailman_pgp/commands/eml_key.py
+++ b/src/mailman_pgp/commands/eml_key.py
@@ -19,6 +19,7 @@
 from email.utils import parseaddr
 
 from mailman.interfaces.command import ContinueProcessing, IEmailCommand
+from mailman.interfaces.pending import IPendings
 from mailman.interfaces.subscriptions import ISubscriptionManager
 from mailman.interfaces.usermanager import IUserManager
 from public import public
@@ -47,6 +48,10 @@ def _cmd_set(pgp_list, mlist, msg, msgdata, arguments, results):
         return ContinueProcessing.no
 
     wrapped = PGPWrapper(msg)
+    if wrapped.is_encrypted():
+        decrypted = wrapped.decrypt(pgp_list.key)
+        wrapped = PGPWrapper(decrypted)
+
     if not wrapped.has_keys():
         print('No keys attached? Send a key.', file=results)
         return ContinueProcessing.no
@@ -66,21 +71,24 @@ def _cmd_set(pgp_list, mlist, msg, msgdata, arguments, results):
         print('No adddress to subscribe with.', file=results)
         return ContinueProcessing.no
 
-    with transaction() as t:
-        pgp_address = PGPAddress.for_address(address)
-        if pgp_address is None:
-            pgp_address = PGPAddress(address)
-        pgp_address.key = keys.pop()
-        t.add(pgp_address)
+    pgp_address = PGPAddress.for_address(address)
+    if pgp_address is None:
+        print('A pgp enabled address not found.', file=results)
+        return ContinueProcessing.no
 
     token = arguments[1]
-    try:
-        ISubscriptionManager(mlist).confirm(token)
-        print('Key succesfully set.', file=results)
-        print('Key fingerprint: {}'.format(pgp_address.key.fingerprint),
-              file=results)
-    except LookupError:
+    pendable = getUtility(IPendings).confirm(token, expunge=False)
+    if pendable is None:
         print('Wrong token.', file=results)
+        return ContinueProcessing.no
+
+    with transaction():
+        pgp_address.key = keys.pop()
+    ISubscriptionManager(mlist).confirm(token)
+
+    print('Key succesfully set.', file=results)
+    print('Key fingerprint: {}'.format(pgp_address.key.fingerprint),
+          file=results)
 
     return ContinueProcessing.no
 
@@ -115,13 +123,17 @@ def _cmd_confirm(pgp_list, mlist, msg, msgdata, arguments, results):
 
     token = arguments[1]
 
-    expecting = CONFIRM_REQUEST.format(pgp_address.key_fingerprint,
-                                       token)
+    pendable = getUtility(IPendings).confirm(token, expunge=False)
+    if pendable is None:
+        print('Wrong token.', file=results)
+        return ContinueProcessing.no
+
+    # TODO differentiate between key change and subscription here.
+
+    expecting = CONFIRM_REQUEST.format(pgp_address.key_fingerprint, token)
     for sig_subject in wrapped.get_signed():
         if expecting in sig_subject:
-            with transaction():
-                pgp_address.key_confirmed = True
-                ISubscriptionManager(mlist).confirm(token)
+            ISubscriptionManager(mlist).confirm(token)
             break
     else:
         print("Message doesn't contain the expected statement.", file=results)