zatca 0.1.2 → 1.0.0

data/lib/zatca/signing/csr.rb

@@ -0,0 +1,220 @@
+class ZATCA::Signing::CSR
+  attr_reader :key, :csr_options, :mode
+
+  # For security purposes, please provide your own private key.
+  # If you don't provide one, a new unsecure one will be generated for testing purposes.
+  def initialize(
+    csr_options:,
+    mode: :production,
+    private_key_path: nil,
+    private_key_password: nil
+  )
+    @csr_options = default_csr_options.merge(csr_options)
+    @mode = mode.to_sym
+    @private_key_path = private_key_path
+    @private_key_password = private_key_password
+    @generated_private_key_path = nil
+  end
+
+  # Returns a hash with two keys
+  # - csr
+  # - csr_without_headers
+  def generate(csr_options: {})
+    set_key
+    write_csr_config
+
+    command = generate_openssl_csr_command
+
+    # Run the command and return the output
+    output = `#{command}`
+
+    cleanup_leftover_files
+
+    output
+
+    # TODO: Ruby version
+    # request = OpenSSL::X509::Request.new
+    # request.version = 0
+    # request.subject = OpenSSL::X509::Name.new([
+    #   ["C", csr_options[:country], OpenSSL::ASN1::PRINTABLESTRING],
+    #   ["O", csr_options[:organization], OpenSSL::ASN1::UTF8STRING],
+    #   ["OU", csr_options[:organization_unit], OpenSSL::ASN1::UTF8STRING],
+    #   ["CN", csr_options[:common_name], OpenSSL::ASN1::UTF8STRING]
+    # ])
+
+    # extensions = [
+    #   OpenSSL::X509::ExtensionFactory.new.create_extension("subjectAltName")
+    # ]
+
+    # # add SAN extension to the CSR
+    # attribute_values = OpenSSL::ASN1::Set [OpenSSL::ASN1::Sequence(extensions)]
+    # [
+    #   OpenSSL::X509::Attribute.new("SN", attribute_values),
+    #   OpenSSL::X509::Attribute.new("UID", attribute_values),
+    #   OpenSSL::X509::Attribute.new("title", attribute_values),
+    #   OpenSSL::X509::Attribute.new("registeredAddress", attribute_values),
+    #   OpenSSL::X509::Attribute.new("businessCategory", attribute_values)
+    # ]
+
+    # attribute_values.each do |attribute|
+    #   request.add_attribute attribute
+    # end
+
+    # request.public_key = public_key
+    # csr = request.sign(key, OpenSSL::Digest.new("SHA256"))
+    # csr_pem = csr.to_pem
+    # csr_without_headers = csr_pem
+    #   .to_s
+    #   .gsub("-----BEGIN CERTIFICATE REQUEST-----", "")
+    #   .gsub("-----END CERTIFICATE REQUEST-----", "")
+    #   .delete("\n")
+
+    # {
+    #   csr: csr_pem,
+    #   csr_without_headers: csr_without_headers
+    # }
+  end
+
+  private
+
+  def default_csr_options
+    {
+      common_name: "",
+      organization_identifier: "",
+      organization_name: "",
+      organization_unit: "",
+      country: "SA",
+      invoice_type: "1100",
+      address: "",
+      business_category: "",
+      egs_solution_name: "",
+      egs_model: "",
+      egs_serial_number: ""
+    }
+  end
+
+  def set_key
+    if private_key_provided? && @key.blank?
+      @key = OpenSSL::PKey::EC.new(
+        File.read(@private_key_path),
+        @private_key_password
+      )
+    else
+      generate_key
+    end
+  end
+
+  def generated_key?
+    @key.present?
+  end
+
+  def private_key_provided?
+    @private_key_path.present?
+  end
+
+  def generate_key
+    return if private_key_provided?
+
+    temp_key = OpenSSL::PKey::EC.new("secp256k1").generate_key
+    @generated_private_key_path = "./#{SecureRandom.uuid}.pem"
+    @key = temp_key
+
+    File.write(@generated_private_key_path, @key.to_pem)
+  end
+
+  def delete_generated_key
+    File.delete(@generated_private_key_path) if @generated_private_key_path.present?
+  end
+
+  def cert_environment
+    case mode
+    when :production
+      "ZATCA-Code-Signing"
+    when :simulation
+      "PREZATCA-Code-Signing"
+    when :sandbox
+      "TSTZATCA-Code-Signing"
+    end
+  end
+
+  def generate_openssl_csr_command
+    "openssl req -new -sha256 -key #{@private_key_path || @generated_private_key_path} -config #{@csr_config_path}"
+  end
+
+  def write_csr_config
+    @csr_config_path = "./#{SecureRandom.uuid}.conf"
+    File.write(@csr_config_path, generate_csr_config)
+  end
+
+  def cleanup_leftover_files
+    delete_generated_key
+    delete_csr_config_file
+  end
+
+  def delete_csr_config_file
+    File.delete(@csr_config_path) if @csr_config_path.present?
+  end
+
+  def egs_serial_number
+    "1-#{csr_options[:egs_solution_name]}|2-#{csr_options[:egs_model]}|3-#{csr_options[:egs_serial_number]}"
+  end
+
+  # Adapted from:
+  # https://github.com/wes4m/zatca-xml-js/blob/main/src/zatca/templates/csr_template.ts
+  def generate_csr_config
+    <<~TEMPLATE
+      # ------------------------------------------------------------------
+      # Default section for "req" command csr_options
+      # ------------------------------------------------------------------
+      [req]
+
+      # Password for reading in existing private key file
+      # input_password = todo_private_key_password
+
+      # Prompt for DN field values and CSR attributes in ASCII
+      prompt = no
+      utf8 = no
+
+      # Section pointer for DN field csr_options
+      distinguished_name = my_req_dn_prompt
+
+      # Extensions
+      req_extensions = v3_req
+
+      [ v3_req ]
+      #basicConstraints=CA:FALSE
+      #keyUsage = digitalSignature, keyEncipherment
+      # Production or Testing Template (TSTZATCA-Code-Signing - ZATCA-Code-Signing)
+      1.3.6.1.4.1.311.20.2 = ASN1:PRINTABLESTRING:#{cert_environment}
+      subjectAltName=dirName:dir_sect
+
+      [ dir_sect ]
+      # EGS Serial number (1-SolutionName|2-ModelOrVersion|3-serialNumber)
+      SN = #{egs_serial_number}
+      # VAT Registration number of TaxPayer (Organization identifier [15 digits begins with 3 and ends with 3])
+      UID = #{csr_options[:organization_identifier]}
+      # Invoice type (TSCZ)(1 = supported, 0 not supported) (Tax, Simplified, future use, future use)
+      title = #{csr_options[:invoice_type]}
+      # Location (branch address or website)
+      registeredAddress = #{csr_options[:address]}
+      # Industry (industry sector name)
+      businessCategory = #{csr_options[:business_category]}
+
+      # ------------------------------------------------------------------
+      # Section for prompting DN field values to create "subject"
+      # ------------------------------------------------------------------
+      [my_req_dn_prompt]
+      # Common name (EGS TaxPayer PROVIDED ID [FREE TEXT])
+      commonName = #{csr_options[:common_name]}
+
+      # Organization Unit (Branch name)
+      organizationalUnitName = #{csr_options[:organization_unit]}
+
+      # Organization name (Tax payer name)
+      organizationName = #{csr_options[:organization_name]}
+
+      # ISO2 country code is required with US as default
+      countryName = #{csr_options[:country]}
+    TEMPLATE
+  end
+end

data/lib/zatca/signing/ecdsa.rb

@@ -0,0 +1,59 @@
+require "starkbank-ecdsa"
+
+class ZATCA::Signing::ECDSA
+  def self.sign(content:, private_key: nil, private_key_path: nil, decode_from_base64: false)
+    private_key = parse_private_key(key: private_key, key_path: private_key_path, decode_from_base64: decode_from_base64)
+
+    ecdsa_signature = EllipticCurve::Ecdsa.sign(content, private_key)
+
+    {
+      base64: ecdsa_signature.toBase64,
+      bytes: ecdsa_signature.toDer
+    }
+  end
+
+  def self.add_header_blocks(key_content)
+    # If key is missing header blocks, add them, otherwise return it as is
+    header = "-----BEGIN EC PRIVATE KEY-----"
+    footer = "-----END EC PRIVATE KEY-----"
+
+    unless key_content.include?(header) && key_content.include?(footer)
+      key_content = "#{header}\n#{key_content}\n#{footer}"
+    end
+
+    key_content
+  end
+
+  def self.read_private_key_from_pem(pem)
+    EllipticCurve::PrivateKey.fromPem(add_header_blocks(pem))
+  end
+
+  # Returns a parsed private key
+  # If decode_from_base64 is set to true, the key will be decoded from base64
+  # before passing to OpenSSL to read it. # This is necessary because that's how
+  # ZATCA's sample key is provided.
+  def self.parse_private_key(key: nil, key_path: nil, decode_from_base64: false)
+    parsed_key = if key.is_a?(EllipticCurve::PrivateKey)
+      key
+    elsif key.is_a?(String)
+      key_content = if decode_from_base64
+        Base64.decode64(key)
+      else
+        key
+      end
+
+      read_private_key_from_pem(key_content)
+    elsif key_path.present?
+      key_content = File.read(key_path)
+      key_content = Base64.decode64(key_content) if decode_from_base64
+
+      read_private_key_from_pem(key_content)
+    end
+
+    if parsed_key.blank?
+      raise ArgumentError.new("private_key or private_key_path is required")
+    end
+
+    parsed_key
+  end
+end

data/lib/zatca/tag.rb

@@ -5,9 +5,21 @@ module ZATCA
       vat_registration_number: 2,
       timestamp: 3,
       invoice_total: 4,
-      vat_total: 5
+      vat_total: 5,
+      xml_invoice_hash: 6,
+      ecdsa_signature: 7,
+      ecdsa_public_key: 8,
+      ecdsa_stamp_signature: 9 # TODO: is this needed ?
     }.freeze
 
+    PHASE_1_TAGS = [
+      :seller_name,
+      :vat_registration_number,
+      :timestamp,
+      :invoice_total,
+      :vat_total
+    ].freeze
+
     attr_accessor :id, :key, :value
 
     def initialize(key:, value:)
@@ -20,14 +32,12 @@ module ZATCA
       {id: @id, key: @key, value: @value}
     end
 
-    def to_tlv
-      # TLV should be concatenated together without any separator in the following
-      # format: character_value_of_id character_value_of_value_length value_itself
-      # All of this should be in 8-bit ASCII.
-      tlv = @id.chr + @value.bytesize.chr + value
+    def should_be_utf8_encoded?
+      PHASE_1_TAGS.include?(key)
+    end
 
-      # We need to use force_encoding because encode will raise errors when
-      # trying to encode a string with utf-8 characters.
+    def to_tlv
+      tlv = @id.chr + @value.bytesize.chr + @value
       tlv.force_encoding("ASCII-8BIT")
     end
   end

data/lib/zatca/tags.rb

@@ -33,8 +33,12 @@ module ZATCA
       Base64.strict_encode64(to_tlv)
     end
 
-    private
+    # This is helpful for debugging only, for ZATCA's requirements just call `to_base64`
+    def to_hex_tlv
+      to_tlv.unpack1("H*")
+    end
 
+    # This is helpful for debugging only, for ZATCA's requirements just call `to_base64`
     def to_tlv
       @tags.map(&:to_tlv).join("")
     end

data/lib/zatca/tags_schema.rb

@@ -13,10 +13,10 @@ module ZATCA
     required(:invoice_total).filled(:string)
     required(:vat_total).filled(:string)
 
-    # TODO: Data types required by 1 January 2023
-    # - Hash of XML Invoice
-    # - ECDSA signature
-    # - ECDSA public key
-    # - ECDSA signature of the cryptographic stamp’s public key by ZATCA’s technical CA
+    # Data types required for Phase 2 by 1 January 2023
+    optional(:xml_invoice_hash).filled(:string)
+    optional(:ecdsa_signature).filled(:string)
+    optional(:ecdsa_public_key).filled(:string)
+    optional(:ecdsa_stamp_signature).filled(:string)
   end
 end

data/lib/zatca/types.rb

@@ -0,0 +1,7 @@
+require "dry-types"
+
+module ZATCA
+  module Types
+    include Dry.Types()
+  end
+end

data/lib/zatca/ubl/base_component.rb

@@ -0,0 +1,142 @@
+require "dry-initializer"
+require_relative "../types"
+
+class ZATCA::UBL::BaseComponent
+  extend Dry::Initializer
+  attr_accessor :elements, :attributes, :name, :value, :index
+
+  # def self.guard_dig(obj)
+  #   unless obj.respond_to?(:dig)
+  #     raise TypeError, "#{obj.class.name} does not have #dig method"
+  #   end
+  # end
+
+  ArrayOfBaseComponentOrNil = ZATCA::Types::Array.of(ZATCA::Types.Instance(ZATCA::UBL::BaseComponent))
+    .default { [] }
+    .constructor { |value| value.blank? ? [] : value.compact }
+
+  option :elements,
+    type: ArrayOfBaseComponentOrNil,
+    default: proc { [] },
+    optional: true
+
+  option :attributes, type: ZATCA::Types::Strict::Hash, default: proc { {} }, optional: true
+  option :value, type: ZATCA::Types::Coercible::String, default: proc { "" }, optional: true
+  option :name, type: ZATCA::Types::Strict::String, default: proc { "" }, optional: true
+  option :index, type: ZATCA::Types::Coercible::Integer.optional, default: proc {}, optional: true
+
+  # def initialize(elements: [], attributes: {}, value: "", name: "", index: nil)
+  # @elements = elements
+  # @attributes = attributes
+  # @value = value
+  # @name = name
+
+  # # HACK: Add a nil index property to be used for cases where we need
+  # # sequential IDs, this list can be populated after the array is built
+  # @index = index
+  # end
+
+  # There are cases where we end up constructing elements with no content
+  # and we don't want to include them in the final XML.
+  #
+  # This method helps us to return nil if the element has no attributes,
+  # elements or value.
+  #
+  # which is then caught in the `build_xml` method (using `elements.compact`)
+  # and ignored.
+  def self.build(elements: [], attributes: {}, value: "", name: "", index: nil)
+    return nil if elements.blank? && attributes.blank? && value.blank?
+
+    new(elements: elements, attributes: attributes, value: value, name: name, index: index)
+  end
+
+  def [](name)
+    elements.find { |element| element.name == name }
+  end
+
+  def dig(key, *args)
+    value = self[key]
+    return value if args.length == 0 || value.nil?
+    # DigRb.guard_dig(value)
+    value.dig(*args)
+  end
+
+  # TODO: Under Active Development
+  def find_nested_element_by_path(path)
+    path_parts = path.split("/")
+    nested_element = self
+
+    path_parts.each_with_index do |path_part, index|
+      # byebug
+      # next_path_part = path_parts[index + 1]
+      # found_element = nested_element[path_part]
+      # found_next_path_part = found_element[next_path_part]
+
+      # element_with_next_path_part = found_element.find do |child_element|
+      #   child_element.name == next_path_part
+      # end
+      # byebug
+      # nested_element.elements.each do |element|
+      #   byebug
+      #   next_element = element[path_part]
+
+      #   if next_element && next_element[next_path_part]
+      #     nested_element = next_element[next_path_part]
+      #     break
+      #   elsif next_element.present?
+      #     nested_element = next_element
+      #   end
+      # end
+
+      # nested_element = found_element if found_element.present?
+    end
+
+    nested_element
+  end
+
+  def schema
+    self.class.schema
+  end
+
+  def to_h
+    {
+      name => {
+        attributes: attributes,
+        **elements.map(&:to_h),
+        value: value
+      }
+    }
+  end
+
+  def to_xml
+    builder = Nokogiri::XML::Builder.new(encoding: "UTF-8") do |xml|
+      xml.root { build_xml(xml) }
+    end
+
+    builder.to_xml
+  end
+
+  def build_xml(xml)
+    xml.send(name, attributes) do
+      if elements.length > 0
+        elements.compact.each { |element| element.build_xml(xml) }
+      elsif value.present?
+        xml.text(value)
+      end
+    end
+  end
+
+  def generate_xml(
+    canonicalized: false,
+    spaces: 2,
+    apply_invoice_hacks: false,
+    remove_root_xml_tag: false
+  )
+    ZATCA::UBL::Builder.new(element: self).build(
+      canonicalized: canonicalized,
+      spaces: spaces,
+      apply_invoice_hacks: apply_invoice_hacks,
+      remove_root_xml_tag: remove_root_xml_tag
+    )
+  end
+end

data/lib/zatca/ubl/builder.rb

@@ -0,0 +1,166 @@
+class ZATCA::UBL::Builder
+  extend Dry::Initializer
+
+  option :element, type: ZATCA::Types.Instance(ZATCA::UBL::BaseComponent)
+
+  def build(
+    canonicalized: false,
+    spaces: 4,
+    apply_invoice_hacks: false,
+    remove_root_xml_tag: false
+  )
+    @remove_root_xml_tag = remove_root_xml_tag
+
+    builder = Nokogiri::XML::Builder.new(encoding: "UTF-8") do |xml|
+      element.build_xml(xml)
+    end
+
+    xml = if canonicalized
+      canonicalized_xml(builder: builder)
+    else
+      uncanonicalized_xml(builder: builder, spaces: spaces)
+    end
+
+    xml = apply_hacks_to_invoice(element, xml) if apply_invoice_hacks
+
+    xml
+  end
+
+  private
+
+  # ZATCA sadly requires very specific and unconventional indentation in the XML
+  # when it is pretty (uncanonicalized), the only way we can accomplish this is
+  # to find and replace blocks manually.
+  def apply_hacks_to_invoice(element, xml)
+    return xml unless element.is_a?(ZATCA::UBL::Invoice)
+
+    apply_qualifying_properties_hacks(element, xml)
+  end
+
+  def apply_qualifying_properties_hacks(invoice, xml)
+    return xml if invoice.qualifying_properties.blank?
+
+    regex = ZATCA::Hacks.qualifying_properties_regex
+
+    xml.gsub(regex, invoice.qualifying_properties)
+  end
+
+  # This function does not produce canonicalization matching C14N 1.1, it applies
+  # C14N 1.1 then manually adds back the whitespace in the format that ZATCA
+  # expects.
+  def canonicalized_xml(builder:)
+    builder.doc.canonicalize(Nokogiri::XML::XML_C14N_1_1)
+
+    # TODO: In case ZATCA ever asks us to use their whitespace format again.
+    # In some meetings they say we have to use it, in some meetings they say
+    # we don't. The simpler approach is that we don't use it.
+    #
+    # ZATCA's docs specifically state we must use C14N 1.1 canonicalization.
+    # xml = uncanonicalized_xml(builder: builder, spaces: 4)
+    # xml_doc = Nokogiri::XML(xml)
+
+    # canonical_xml = xml_doc.canonicalize(Nokogiri::XML::XML_C14N_1_1)
+
+    # canonical_xml
+  end
+
+  def uncanonicalized_xml(builder:, spaces: 4)
+    builder.to_xml(indent: spaces.to_i)
+
+    # xml = builder.to_xml(indent: spaces.to_i)
+    # xml = match_xml_string_to_zatca_whitespaces(xml)
+    # xml
+  end
+
+  def match_xml_string_to_zatca_whitespaces(xml)
+    # ZATCA has elements that are not spaced by multiples of 4, and random new
+    # lines with trailing whitespaces, so we need to manually adjust our
+    # indentation to match ZATCA's.
+    zatca_weird_whitespaces.each do |whitespace_hash|
+      xml.gsub!(whitespace_hash[:our_version], whitespace_hash[:zatca_version])
+    end
+
+    # Canonicalization already removes the root XML tag for us, but since we had
+    # to create a new uncanonicalized document for ZATCA's invoice hacks, we
+    # have to remove it manually.
+    if @remove_root_xml_tag
+      xml.gsub!("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n", "")
+    end
+
+    # ZATCA Removes the final newline character, so we do the same
+    xml.chomp
+
+    # This part is not clear, ZATCA shared documents with us that use CRLF
+    # but the samples in the SDK use LF, so we're not sure which one is correct.
+    # ZATCA wants CRLF (\r\n) in their canonicalized form instead of just LF (\n)
+    xml.gsub!("\n", "\r\n")
+
+    xml
+  end
+
+  # Not sure if this is needed, in some meetings ZATCA says you have to match
+  # their whitspace exactly and in some meetings they say you don't.
+  # HACK: This is really hacky, using regexes or XPaths would be better, but
+  # that wasn't easy to build and maintain, so we're using this if/until we run
+  # into issues.
+  #
+  # We may eventually go to an approach where we just have hardcoded XML in each
+  # element's file and we just add in the values instead of generating our own
+  # XML if this gets too hard to maintain.
+  def zatca_weird_whitespaces
+    @_zatca_weird_whitespaces ||= [
+      {
+        our_version: "<cbc:ProfileID>",
+        zatca_version: "\n    <cbc:ProfileID>"
+      },
+      {
+        our_version: "<cac:AccountingSupplierParty>",
+        zatca_version: "\n    \n    <cac:AccountingSupplierParty>"
+      },
+      {
+        our_version: "                <cbc:CompanyID>",
+        zatca_version: "                    <cbc:CompanyID>"
+      },
+      {
+        our_version: "            <cac:TaxCategory>",
+        zatca_version: "             <cac:TaxCategory>"
+      },
+      {
+        our_version: "            </cac:TaxCategory>",
+        zatca_version: "             </cac:TaxCategory>"
+      },
+      {
+        our_version: '                <cbc:ID schemeAgencyID="6" schemeID="UN/ECE 5305">S</cbc:ID>',
+        zatca_version: '                 <cbc:ID schemeAgencyID="6" schemeID="UN/ECE 5305">S</cbc:ID>'
+      },
+      {
+        our_version: "<cac:TaxScheme>\n                    <cbc:ID schemeAgencyID=\"6\" schemeID=\"UN/ECE 5153\">VAT</cbc:ID>",
+        zatca_version: "<cac:TaxScheme>\n                   <cbc:ID schemeAgencyID=\"6\" schemeID=\"UN/ECE 5153\">VAT</cbc:ID>"
+      },
+      {
+        our_version: "<cac:TaxTotal>\n            <cbc:TaxAmount currencyID=\"SAR\">",
+        zatca_version: "<cac:TaxTotal>\n             <cbc:TaxAmount currencyID=\"SAR\">"
+      },
+      {
+        our_version: "            <cbc:RoundingAmount currencyID=\"SAR\">",
+        zatca_version: "             <cbc:RoundingAmount currencyID=\"SAR\">"
+      },
+      {
+        our_version: "                <cbc:ChargeIndicator>",
+        zatca_version: "               <cbc:ChargeIndicator>"
+      },
+      {
+        our_version: "                <cbc:AllowanceChargeReason>",
+        zatca_version: "               <cbc:AllowanceChargeReason>"
+      },
+      {
+        our_version: "                <cbc:Amount currencyID=\"SAR\">",
+        zatca_version: "               <cbc:Amount currencyID=\"SAR\">"
+      },
+      {
+        our_version: "<cbc:ID schemeAgencyID=\"6\" schemeID=\"UN/ECE 5305\">S</cbc:ID>\n                <cbc:Percent>",
+        zatca_version: "<cbc:ID schemeAgencyID=\"6\" schemeID=\"UN/ECE 5305\">S</cbc:ID>\n                 <cbc:Percent>"
+      }
+    ]
+  end
+end