@bdking71/spsignature 1.3.0 → 1.3.4

package/README.md

@@ -6,6 +6,8 @@
 
 > ⚠️ **NOT READY FOR PRODUCTION USE!** This module is currently under active development. Please do not use it in production environments at this time.
 
+![Approve Purchase Requisition Screen](/img/SignatureScreen.png)
+
 `@bdking71/spsignature` provides a secure, lightweight, and framework-agnostic digital signature module engineered specifically for Microsoft 365 environments. Built to run inside custom SPFx Web Parts and Extension Application Customizers, it delivers tamper-evident signature collection, automated base64 image encoding, and structured payload generation directly integrated with SharePoint Online list infrastructure.
 
 ---
@@ -33,7 +35,7 @@
 
 To enforce non-repudiation and meet compliance standards, `@bdking71/spsignature` includes a flexible Two-Factor Authentication engine. Rather than relying on rigid third-party SMS gateways, it delegates code delivery to **Power Automate**, allowing organizations to route standard **5-digit** verification codes via Microsoft Teams, Outlook Email, or both.
 
-![Diagram illustrating the 2FA workflow between SPFx, SharePoint, and Power Automate](./img/tfa.jpg)
+![Diagram illustrating the 2FA workflow between SPFx, SharePoint, and Power Automate](/img/TFA.jpg)
 
 ### How the 2FA Workflow Operates
 

package/lib/TransactionSigner.d.ts

@@ -109,23 +109,34 @@ export declare function promptAndGenerateSecureAudit(context: SignerContext, mod
 export declare function getReportableSignature(compressedSignatureData: string): string;
 /**
  * Re-computes the SHA-256 hash of the audit envelope constructed from
- * the supplied parameters and compares it to `storedHash`.
+ * the supplied parameters and compares it to the stored hash.
  *
  * This allows any consumer to independently verify that a signed
  * record has not been tampered with, without needing access to the
  * original signature image.
  *
- * **Note:** Only top-level payload keys are sorted.  If your payload
+ * **Note:** Only top-level payload keys are sorted. If your payload
  * contains nested objects whose key order may vary, consider using a
  * deep-sort utility before calling this function.
  *
- * @param payloadToVerify         - The payload that was originally signed.
- * @param signer                  - The signer identifier used at sign time.
- * @param timestamp               - The ISO-8601 timestamp captured at sign
- *                                  time.
- * @param _compressedSignatureData - The compressed signature (unused by the
- *                                  hash, retained for API symmetry).
- * @param storedHash              - The SHA-256 hex digest to compare against.
- * @returns `true` if the recomputed hash matches `storedHash`.
+ * @param auditRecord - The SharePointAuditRecord returned from `promptAndGenerateSecureAudit`.
+ * @param signer      - The signer's email address or display name (must match original signer).
+ * @param payload     - The original payload object that was signed.
+ * @returns `true` if the signature hash is valid and authentic.
+ *
+ * @example
+ * ```ts
+ * const isValid = await verifySecureAuditRecord(
+ *   auditRecord,
+ *   "user@example.com",
+ *   { amount: 1500, vendor: "Contoso" }
+ * );
+ *
+ * if (isValid) {
+ *   console.log("Signature is authentic!");
+ * } else {
+ *   console.warn("Signature has been tampered with!");
+ * }
+ * ```
  */
-export declare function verifySecureAuditRecord(payloadToVerify: Record<string, unknown>, signer: string, timestamp: string, _compressedSignatureData: string, storedHash: string): Promise<boolean>;
+export declare function verifySecureAuditRecord(auditRecord: SharePointAuditRecord, signer: string, payload: Record<string, unknown>): Promise<boolean>;

package/lib/TransactionSigner.js

@@ -1166,47 +1166,70 @@ function isCanvasEmpty(ctx, width, height) {
 // ---------------------------------------------------------------------------
 /**
  * Re-computes the SHA-256 hash of the audit envelope constructed from
- * the supplied parameters and compares it to `storedHash`.
+ * the supplied parameters and compares it to the stored hash.
  *
  * This allows any consumer to independently verify that a signed
  * record has not been tampered with, without needing access to the
  * original signature image.
  *
- * **Note:** Only top-level payload keys are sorted.  If your payload
+ * **Note:** Only top-level payload keys are sorted. If your payload
  * contains nested objects whose key order may vary, consider using a
  * deep-sort utility before calling this function.
  *
- * @param payloadToVerify         - The payload that was originally signed.
- * @param signer                  - The signer identifier used at sign time.
- * @param timestamp               - The ISO-8601 timestamp captured at sign
- *                                  time.
- * @param _compressedSignatureData - The compressed signature (unused by the
- *                                  hash, retained for API symmetry).
- * @param storedHash              - The SHA-256 hex digest to compare against.
- * @returns `true` if the recomputed hash matches `storedHash`.
+ * @param auditRecord - The SharePointAuditRecord returned from `promptAndGenerateSecureAudit`.
+ * @param signer      - The signer's email address or display name (must match original signer).
+ * @param payload     - The original payload object that was signed.
+ * @returns `true` if the signature hash is valid and authentic.
+ *
+ * @example
+ * ```ts
+ * const isValid = await verifySecureAuditRecord(
+ *   auditRecord,
+ *   "user@example.com",
+ *   { amount: 1500, vendor: "Contoso" }
+ * );
+ *
+ * if (isValid) {
+ *   console.log("Signature is authentic!");
+ * } else {
+ *   console.warn("Signature has been tampered with!");
+ * }
+ * ```
  */
-async function verifySecureAuditRecord(payloadToVerify, signer, timestamp, _compressedSignatureData, storedHash) {
+async function verifySecureAuditRecord(auditRecord, signer, payload) {
     try {
-        if (!payloadToVerify || !storedHash)
+        if (!auditRecord || !signer || !payload) {
+            console.warn("verifySecureAuditRecord: Missing required parameters", {
+                auditRecord: !!auditRecord,
+                signer: !!signer,
+                payload: !!payload,
+            });
             return false;
-        const sortedPayloadString = JSON.stringify(payloadToVerify, Object.keys(payloadToVerify).sort());
+        }
+        // Sort payload keys for consistent hashing
+        const sortedPayloadString = JSON.stringify(payload, Object.keys(payload).sort());
+        // Reconstruct the canonical audit envelope
         const auditEnvelope = {
             payload: JSON.parse(sortedPayloadString),
             signer: signer.toLowerCase().trim(),
-            timestamp: timestamp.trim(),
+            timestamp: auditRecord.signatureTimestamp.trim(),
         };
+        // Hash the audit envelope
         const auditEnvelopeJson = JSON.stringify(auditEnvelope);
         const encoder = new TextEncoder();
         const encodedBytes = encoder.encode(auditEnvelopeJson);
-        // Fixed BufferSource type incompatibility:
         const hashBuffer = await window.crypto.subtle.digest("SHA-256", encodedBytes.buffer);
         const hashArray = Array.from(new Uint8Array(hashBuffer));
         const recomputedHash = hashArray
             .map((b) => b.toString(16).padStart(2, "0"))
             .join("");
-        return recomputedHash === storedHash.trim();
+        // Compare hashes
+        const isValid = recomputedHash === auditRecord.signatureHash.trim();
+        console.log("verifySecureAuditRecord: Verification result =", isValid, "Recomputed hash =", recomputedHash.substring(0, 16) + "...");
+        return isValid;
     }
-    catch (_a) {
+    catch (error) {
+        console.error("verifySecureAuditRecord: Error during verification", error);
         return false;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bdking71/spsignature",
-  "version": "1.3.0",
+  "version": "1.3.4",
   "description": "SharePoint Framework isolated digital signing, LZW compression, and OTP audit engine.",
   "main": "lib/index.js",
   "module": "lib/index.js",