@bdking71/spsignature 1.2.0 → 1.3.3

package/README.md

@@ -6,6 +6,8 @@
 
 > ⚠️ **NOT READY FOR PRODUCTION USE!** This module is currently under active development. Please do not use it in production environments at this time.
 
+![Approve Purchase Requisition Screen](/img/SignatureScreen.png)
+
 `@bdking71/spsignature` provides a secure, lightweight, and framework-agnostic digital signature module engineered specifically for Microsoft 365 environments. Built to run inside custom SPFx Web Parts and Extension Application Customizers, it delivers tamper-evident signature collection, automated base64 image encoding, and structured payload generation directly integrated with SharePoint Online list infrastructure.
 
 ---
@@ -33,7 +35,7 @@
 
 To enforce non-repudiation and meet compliance standards, `@bdking71/spsignature` includes a flexible Two-Factor Authentication engine. Rather than relying on rigid third-party SMS gateways, it delegates code delivery to **Power Automate**, allowing organizations to route standard **5-digit** verification codes via Microsoft Teams, Outlook Email, or both.
 
-![Diagram illustrating the 2FA workflow between SPFx, SharePoint, and Power Automate](./img/tfa.jpg)
+![Diagram illustrating the 2FA workflow between SPFx, SharePoint, and Power Automate](/img/TFA.jpg)
 
 ### How the 2FA Workflow Operates
 

package/lib/TransactionSigner.d.ts

@@ -109,23 +109,34 @@ export declare function promptAndGenerateSecureAudit(context: SignerContext, mod
 export declare function getReportableSignature(compressedSignatureData: string): string;
 /**
  * Re-computes the SHA-256 hash of the audit envelope constructed from
- * the supplied parameters and compares it to `storedHash`.
+ * the supplied parameters and compares it to the stored hash.
  *
  * This allows any consumer to independently verify that a signed
  * record has not been tampered with, without needing access to the
  * original signature image.
  *
- * **Note:** Only top-level payload keys are sorted.  If your payload
+ * **Note:** Only top-level payload keys are sorted. If your payload
  * contains nested objects whose key order may vary, consider using a
  * deep-sort utility before calling this function.
  *
- * @param payloadToVerify         - The payload that was originally signed.
- * @param signer                  - The signer identifier used at sign time.
- * @param timestamp               - The ISO-8601 timestamp captured at sign
- *                                  time.
- * @param _compressedSignatureData - The compressed signature (unused by the
- *                                  hash, retained for API symmetry).
- * @param storedHash              - The SHA-256 hex digest to compare against.
- * @returns `true` if the recomputed hash matches `storedHash`.
+ * @param auditRecord - The SharePointAuditRecord returned from `promptAndGenerateSecureAudit`.
+ * @param signer      - The signer's email address or display name (must match original signer).
+ * @param payload     - The original payload object that was signed.
+ * @returns `true` if the signature hash is valid and authentic.
+ *
+ * @example
+ * ```ts
+ * const isValid = await verifySecureAuditRecord(
+ *   auditRecord,
+ *   "user@example.com",
+ *   { amount: 1500, vendor: "Contoso" }
+ * );
+ *
+ * if (isValid) {
+ *   console.log("Signature is authentic!");
+ * } else {
+ *   console.warn("Signature has been tampered with!");
+ * }
+ * ```
  */
-export declare function verifySecureAuditRecord(payloadToVerify: Record<string, unknown>, signer: string, timestamp: string, _compressedSignatureData: string, storedHash: string): Promise<boolean>;
+export declare function verifySecureAuditRecord(auditRecord: SharePointAuditRecord, signer: string, payload: Record<string, unknown>): Promise<boolean>;

package/lib/TransactionSigner.js

@@ -563,35 +563,51 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
          */
         const updateButtonState = () => {
             let isCodeValid = true;
-            if (requireTFA && verificationInput) {
-                const codeValue = verificationInput.value.trim();
-                isCodeValid =
-                    codeValue.length === 5 && codeValue === generatedPasscode;
+            // Check TFA only if it's required
+            if (requireTFA) {
+                if (verificationInput) {
+                    const codeValue = verificationInput.value.trim();
+                    isCodeValid =
+                        codeValue.length === 5 && codeValue === generatedPasscode;
+                    console.log("🔐 TFA Check: Code =", codeValue, "Valid =", isCodeValid);
+                }
+                else {
+                    isCodeValid = false;
+                    console.log("🔐 TFA Check: No input element found");
+                }
             }
+            else {
+                console.log("🔐 TFA not required - skipping TFA validation");
+            }
+            // Check signature validity
             let isSignatureValid = false;
             if (activeMode === "cached") {
                 isSignatureValid = hasCachedSignature;
+                console.log("✍️ Signature Check (CACHED): Valid =", isSignatureValid);
             }
             else if (activeMode === "draw") {
-                isSignatureValid =
-                    hasDrawnContent &&
-                        ctx !== null &&
-                        !isCanvasEmpty(ctx, canvas.width, canvas.height);
+                const canvasHasContent = ctx !== null && !isCanvasEmpty(ctx, canvas.width, canvas.height);
+                isSignatureValid = hasDrawnContent && canvasHasContent;
+                console.log("✍️ Signature Check (DRAW): hasDrawnContent =", hasDrawnContent, "canvasHasContent =", canvasHasContent, "Valid =", isSignatureValid);
             }
             else {
                 isSignatureValid = compressedUploadBase64.trim() !== "";
+                console.log("✍️ Signature Check (UPLOAD): compressedSize =", compressedUploadBase64.length, "Valid =", isSignatureValid);
             }
+            console.log("🔘 FINAL STATE: Code Valid =", isCodeValid, "Sig Valid =", isSignatureValid, "Should Enable =", isCodeValid && isSignatureValid);
             if (isCodeValid && isSignatureValid) {
                 signButton.disabled = false;
                 signButton.style.backgroundColor = "#0078d4";
                 signButton.style.cursor = "pointer";
                 signButton.style.opacity = "1";
+                console.log("✅ Button ENABLED");
             }
             else {
                 signButton.disabled = true;
                 signButton.style.backgroundColor = "#c8c6c4";
                 signButton.style.cursor = "not-allowed";
                 signButton.style.opacity = "0.6";
+                console.log("❌ Button DISABLED");
             }
         };
         // -----------------------------------------------------------------
@@ -619,6 +635,7 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
                     : uploadTabBtn;
             activeBtn.style.color = "#0078d4";
             activeBtn.style.borderBottom = "3px solid #0078d4";
+            console.log("Tab switched to:", mode);
             updateButtonState();
         };
         if (hasCachedSignature) {
@@ -689,8 +706,10 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
                         });
                         if (vResult.success && vResult.itemId) {
                             storedVerificationItemId = vResult.itemId;
+                            console.log("✅ OTP dispatched successfully");
                         }
                         else {
+                            console.error("❌ OTP dispatch failed:", vResult.error);
                             alert("Failed to dispatch verification code. Please try again.");
                         }
                     }
@@ -707,10 +726,14 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
                 await triggerSendCode();
             };
             vInputRef.oninput = () => {
+                console.log("🔐 TFA input changed, checking button state");
                 updateButtonState();
             };
             void triggerSendCode();
         }
+        else if (requireTFA && !context.channel) {
+            console.warn("⚠️ TFA required but no channel provided");
+        }
         // -----------------------------------------------------------------
         // Canvas drawing helpers
         // -----------------------------------------------------------------
@@ -766,12 +789,14 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
             const pos = getPos(e);
             ctx.lineTo(pos.x, pos.y);
             ctx.stroke();
+            console.log("✏️ Drawing, updating button state");
             updateButtonState();
             e.preventDefault();
         };
         /** Ends the current drawing stroke. */
         const stopDraw = () => {
             isDrawing = false;
+            console.log("✋ Drawing stopped, updating button state");
             updateButtonState();
         };
         canvas.addEventListener("mousedown", startDraw);
@@ -786,6 +811,7 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
                 ctx.fillStyle = "#ffffff";
                 ctx.fillRect(0, 0, canvas.width, canvas.height);
                 hasDrawnContent = false;
+                console.log("🧹 Canvas cleared, updating button state");
                 updateButtonState();
             }
         };
@@ -836,6 +862,7 @@ async function promptAndGenerateSecureAudit(context, modalTitle = "Approve Purch
                                     tempCanvas.toDataURL("image/png");
                                 uploadPreview.src = compressedUploadBase64;
                                 uploadPreview.style.display = "block";
+                                console.log("📤 File uploaded, updating button state");
                                 updateButtonState();
                             }
                         };
@@ -1139,47 +1166,70 @@ function isCanvasEmpty(ctx, width, height) {
 // ---------------------------------------------------------------------------
 /**
  * Re-computes the SHA-256 hash of the audit envelope constructed from
- * the supplied parameters and compares it to `storedHash`.
+ * the supplied parameters and compares it to the stored hash.
  *
  * This allows any consumer to independently verify that a signed
  * record has not been tampered with, without needing access to the
  * original signature image.
  *
- * **Note:** Only top-level payload keys are sorted.  If your payload
+ * **Note:** Only top-level payload keys are sorted. If your payload
  * contains nested objects whose key order may vary, consider using a
  * deep-sort utility before calling this function.
  *
- * @param payloadToVerify         - The payload that was originally signed.
- * @param signer                  - The signer identifier used at sign time.
- * @param timestamp               - The ISO-8601 timestamp captured at sign
- *                                  time.
- * @param _compressedSignatureData - The compressed signature (unused by the
- *                                  hash, retained for API symmetry).
- * @param storedHash              - The SHA-256 hex digest to compare against.
- * @returns `true` if the recomputed hash matches `storedHash`.
+ * @param auditRecord - The SharePointAuditRecord returned from `promptAndGenerateSecureAudit`.
+ * @param signer      - The signer's email address or display name (must match original signer).
+ * @param payload     - The original payload object that was signed.
+ * @returns `true` if the signature hash is valid and authentic.
+ *
+ * @example
+ * ```ts
+ * const isValid = await verifySecureAuditRecord(
+ *   auditRecord,
+ *   "user@example.com",
+ *   { amount: 1500, vendor: "Contoso" }
+ * );
+ *
+ * if (isValid) {
+ *   console.log("Signature is authentic!");
+ * } else {
+ *   console.warn("Signature has been tampered with!");
+ * }
+ * ```
  */
-async function verifySecureAuditRecord(payloadToVerify, signer, timestamp, _compressedSignatureData, storedHash) {
+async function verifySecureAuditRecord(auditRecord, signer, payload) {
     try {
-        if (!payloadToVerify || !storedHash)
+        if (!auditRecord || !signer || !payload) {
+            console.warn("verifySecureAuditRecord: Missing required parameters", {
+                auditRecord: !!auditRecord,
+                signer: !!signer,
+                payload: !!payload,
+            });
             return false;
-        const sortedPayloadString = JSON.stringify(payloadToVerify, Object.keys(payloadToVerify).sort());
+        }
+        // Sort payload keys for consistent hashing
+        const sortedPayloadString = JSON.stringify(payload, Object.keys(payload).sort());
+        // Reconstruct the canonical audit envelope
         const auditEnvelope = {
             payload: JSON.parse(sortedPayloadString),
             signer: signer.toLowerCase().trim(),
-            timestamp: timestamp.trim(),
+            timestamp: auditRecord.signatureTimestamp.trim(),
         };
+        // Hash the audit envelope
         const auditEnvelopeJson = JSON.stringify(auditEnvelope);
         const encoder = new TextEncoder();
         const encodedBytes = encoder.encode(auditEnvelopeJson);
-        // Fixed BufferSource type incompatibility:
         const hashBuffer = await window.crypto.subtle.digest("SHA-256", encodedBytes.buffer);
         const hashArray = Array.from(new Uint8Array(hashBuffer));
         const recomputedHash = hashArray
             .map((b) => b.toString(16).padStart(2, "0"))
             .join("");
-        return recomputedHash === storedHash.trim();
+        // Compare hashes
+        const isValid = recomputedHash === auditRecord.signatureHash.trim();
+        console.log("verifySecureAuditRecord: Verification result =", isValid, "Recomputed hash =", recomputedHash.substring(0, 16) + "...");
+        return isValid;
     }
-    catch (_a) {
+    catch (error) {
+        console.error("verifySecureAuditRecord: Error during verification", error);
         return false;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bdking71/spsignature",
-  "version": "1.2.0",
+  "version": "1.3.3",
   "description": "SharePoint Framework isolated digital signing, LZW compression, and OTP audit engine.",
   "main": "lib/index.js",
   "module": "lib/index.js",