@cenk1cenk2/md-printer 3.1.2 → 3.2.1

package/README.md

@@ -275,7 +275,8 @@ md-printer invoice.yaml -t invoice --sign --sign-certificate ~/id-austria.pem
 - `--sign` enables signing. `--sign-provider` selects the provider, `a-trust` is the only one and the default. `--sign-certificate` is a DER or PEM file of your signer certificate.
 - The same keys can be set as `sign` in front-matter or `settings.json`: `enabled`, `provider`, `certificate`, `reason`, `location`, `contact`. Flags win. `reason`, `location` and `contact` are stored in the signature.
 - Signing only works for PDF output and is skipped with `--preview`.
-- The signing session has to run in your browser. md-printer opens a link to a temporary local page, you log in with ID Austria in the A-Trust page, and paste the resulting signature (starts with `MII`) back into the local page. It waits until the signature arrives, press Ctrl+C to abort.
+- The signing session has to run in your browser. md-printer opens a temporary local page in an app window of the discovered browser, using your normal profile (or with `xdg-open` when none is found), you log in with ID Austria in the A-Trust page, and paste the resulting signature (starts with `MII`) back into the local page. A paste that is cut short is refused on the page, so you can copy it again. It waits until the signature arrives, press Ctrl+C to abort.
+- The returned signature is always verified before it is embedded: its digest must match this document and it must be cryptographically valid. The result is printed with the signer name, serial and issuer. A failed verification fails the run, and with `--log-level debug` the returned signature is written next to the output as `<output>.cms.der`.
 - With a certificate, the signer name, issuer and serial are passed to the template as `signature`, so `SignatureBlock` can show who signed and when. The certificate must be valid at signing time, and the returned signature is rejected if it was not made with it. Without a certificate only the date is available.
 - Verify the result at https://www.signaturpruefung.gv.at.
 

package/dist/services/index.mjs

@@ -2,6 +2,7 @@ import { I18nService } from "./i18n.service.mjs";
 import { MarkdownService } from "./markdown.service.mjs";
 import { BrowserService } from "./renderer/browser.service.mjs";
 import { RendererService } from "./renderer/renderer.service.mjs";
+import { IncompleteSignatureError, SignatureVerificationError, parseSignedData } from "./signature/cms.mjs";
 import { SignatureAdapter } from "./signature/signature.adapter.mjs";
 import { ATrustAdapter } from "./signature/adapters/a-trust.adapter.mjs";
 import { SignatureService } from "./signature/signature.service.mjs";
@@ -11,4 +12,4 @@ import { PreviewService } from "./session/preview.service.mjs";
 import { SessionService } from "./session/session.service.mjs";
 import { PrinterModule } from "./printer.module.mjs";
 import "./signature/index.mjs";
-export { ATrustAdapter, BrowserService, I18nService, MarkdownService, PreviewService, PrinterModule, PrinterService, RendererService, SessionService, SignatureAdapter, SignatureService, TemplateService };
+export { ATrustAdapter, BrowserService, I18nService, IncompleteSignatureError, MarkdownService, PreviewService, PrinterModule, PrinterService, RendererService, SessionService, SignatureAdapter, SignatureService, SignatureVerificationError, TemplateService, parseSignedData };

package/dist/services/printer.service.mjs

@@ -6,25 +6,28 @@ import { I18nService } from "./i18n.service.mjs";
 import { MarkdownService } from "./markdown.service.mjs";
 import { inlineHtml } from "./template/assets.mjs";
 import { RendererService } from "./renderer/renderer.service.mjs";
+import { SignatureVerificationError } from "./signature/cms.mjs";
 import { SignatureService } from "./signature/signature.service.mjs";
 import { TemplateService } from "./template/template.service.mjs";
 import { Injectable } from "@nestjs/common";
 import { basename, dirname, extname, join, resolve } from "path";
-import { FileSystemService, LoggerService } from "@cenk1cenk2/oclif-common";
+import { ConfigService, FileSystemService, LoggerService } from "@cenk1cenk2/oclif-common";
 import { cloneDeep, mergeWith, uniq } from "es-toolkit";
 import { parse } from "yaml";
 //#region src/services/printer.service.ts
 let PrinterService = class PrinterService {
 	fs;
 	logger;
+	config;
 	i18n;
 	markdown;
 	template;
 	renderer;
 	signature;
-	constructor(fs, logger, i18n, markdown, template, renderer, signature) {
+	constructor(fs, logger, config, i18n, markdown, template, renderer, signature) {
 		this.fs = fs;
 		this.logger = logger;
+		this.config = config;
 		this.i18n = i18n;
 		this.markdown = markdown;
 		this.template = template;
@@ -134,6 +137,13 @@ let PrinterService = class PrinterService {
 			...ctx.options.sign,
 			date: ctx.signingTime,
 			certificate: ctx.certificate
+		}).catch(async (err) => {
+			if (err instanceof SignatureVerificationError && this.config.isDebug && ctx.options.dest) {
+				const path = `${ctx.options.dest}.cms.der`;
+				await this.fs.write(path, err.cms);
+				this.logger.debug("The returned signature is written to: %s", path);
+			}
+			throw err;
 		});
 	}
 	signOptions(flags, ...sources) {
@@ -161,6 +171,7 @@ let PrinterService = class PrinterService {
 PrinterService = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [
 	typeof FileSystemService === "undefined" ? Object : FileSystemService,
 	typeof LoggerService === "undefined" ? Object : LoggerService,
+	typeof ConfigService === "undefined" ? Object : ConfigService,
 	typeof I18nService === "undefined" ? Object : I18nService,
 	typeof MarkdownService === "undefined" ? Object : MarkdownService,
 	typeof TemplateService === "undefined" ? Object : TemplateService,

package/dist/services/session/preview.service.mjs

@@ -3,12 +3,14 @@ import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.154.0/hel
 import __decorate from "../../_virtual/_@oxc-project_runtime@0.154.0/helpers/esm/decorate.mjs";
 import { resolveConfined } from "../template/assets.mjs";
 import { isLoopbackRequest } from "../loopback.mjs";
-import { AppWindow } from "../renderer/app-window.mjs";
 import { TemplateService } from "../template/template.service.mjs";
 import { Injectable } from "@nestjs/common";
+import { mkdtemp, rm } from "fs/promises";
 import { join } from "path";
 import { LoggerService } from "@cenk1cenk2/oclif-common";
 import { fileURLToPath } from "url";
+import { tmpdir } from "os";
+import { spawn } from "child_process";
 import { once } from "events";
 import { createServer } from "http";
 import serveStatic from "serve-static";
@@ -20,6 +22,7 @@ let PreviewService = class PreviewService {
 	clients = /* @__PURE__ */ new Set();
 	build;
 	error;
+	profile;
 	window;
 	constructor(logger, template) {
 		this.logger = logger;
@@ -57,26 +60,39 @@ let PreviewService = class PreviewService {
 		this.send("failed", this.error);
 	}
 	async open(executable, url) {
-		this.window = await AppWindow.open(executable, url);
-		await this.window.closed.catch((err) => {
-			this.logger.warn("Can not open the preview window, open it manually: %s (%s)", url, err.message);
-			return new Promise(() => void 0);
+		this.profile = await mkdtemp(join(tmpdir(), "md-printer-preview-"));
+		this.window = spawn(executable, [
+			`--app=${url}`,
+			`--user-data-dir=${this.profile}`,
+			"--no-first-run",
+			"--no-default-browser-check"
+		], { stdio: "ignore" });
+		await new Promise((done) => {
+			this.window.on("exit", () => done());
+			this.window.on("error", (err) => {
+				this.logger.warn("Can not open the preview window, open it manually: %s (%s)", url, err.message);
+			});
 		});
 	}
 	async onModuleDestroy() {
 		await this.close();
 	}
 	async close() {
-		const { server, window } = this;
+		const { server, window, profile } = this;
 		this.server = void 0;
 		this.window = void 0;
+		this.profile = void 0;
 		for (const client of this.clients) client.end();
 		this.clients.clear();
-		await window?.close();
+		if (window && window.exitCode === null && window.signalCode === null && window.kill()) await once(window, "exit");
 		if (server?.listening) {
 			server.close();
 			await once(server, "close");
 		}
+		if (profile) await rm(profile, {
+			recursive: true,
+			force: true
+		});
 	}
 	async handle(req, res, shell) {
 		if (!isLoopbackRequest(req)) {

package/dist/services/signature/adapters/a-trust.adapter.mjs

@@ -3,8 +3,8 @@ import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.154.0/
 import __decorate from "../../../_virtual/_@oxc-project_runtime@0.154.0/helpers/esm/decorate.mjs";
 import { BrowserNotFoundError } from "../../renderer/browser.mjs";
 import { BrowserService } from "../../renderer/browser.service.mjs";
+import { IncompleteSignatureError, parseSignedData } from "../cms.mjs";
 import { isLoopbackRequest } from "../../loopback.mjs";
-import { AppWindow } from "../../renderer/app-window.mjs";
 import { SignatureAdapter } from "../signature.adapter.mjs";
 import { Injectable } from "@nestjs/common";
 import { readFile } from "fs/promises";
@@ -93,39 +93,39 @@ let ATrustAdapter = class ATrustAdapter extends SignatureAdapter {
 				res.writeHead(400);
 				return res.end("This does not look like a signature, it should start with MII.");
 			}
+			const signature = Buffer.from(cms, "base64");
+			try {
+				parseSignedData(signature);
+			} catch (err) {
+				res.writeHead(400);
+				if (err instanceof IncompleteSignatureError) return res.end(`The pasted signature is incomplete (got ${err.received} of ${err.declared} bytes), copy the whole signature text from the A-Trust page.`);
+				return res.end(`The pasted text is not a CMS signature: ${err.message}`);
+			}
 			res.writeHead(200);
-			res.end("Signature received.");
-			resolve(Buffer.from(cms, "base64"));
+			res.end("Signature received, you can close this window.");
+			resolve(signature);
 		});
 		server.listen(0, "127.0.0.1");
 		await once(server, "listening");
 		const url = `http://127.0.0.1:${server.address().port}/`;
 		this.logger.info("Sign the document in the browser, then paste the signature back: %s", url);
-		const window = await this.open(url).catch((err) => {
-			server.close();
-			throw err;
-		});
+		this.open(url);
 		this.context.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error("Signing is aborted.")), { once: true });
-		window?.closed.then(() => reject(/* @__PURE__ */ new Error("The signing window is closed before the signature arrived.")), (err) => this.logger.warn("Can not open the signing window, open the link manually: %s (%s)", url, err.message));
-		return result.finally(async () => {
-			server.close();
-			await window?.close();
-		});
+		return result.finally(() => server.close());
 	}
-	async open(url) {
-		let executable;
+	open(url) {
+		let command;
 		try {
-			executable = this.browser.executable();
+			command = [this.browser.executable(), [`--app=${url}`]];
 		} catch (err) {
 			if (!(err instanceof BrowserNotFoundError)) throw err;
-			this.logger.warn("Can not find a browser to sign in a window of its own, close the tabs of any earlier signing before you continue. %s", err.message);
-			spawn("xdg-open", [url], {
-				stdio: "ignore",
-				detached: true
-			}).on("error", (err) => this.logger.warn("Can not open the browser, open the link manually: %s", err.message)).unref();
-			return;
+			this.logger.warn("Can not find a browser to sign in a new window, close the tabs of any earlier signing before you continue. %s", err.message);
+			command = ["xdg-open", [url]];
 		}
-		return AppWindow.open(executable, url);
+		spawn(...command, {
+			stdio: "ignore",
+			detached: true
+		}).on("error", (err) => this.logger.warn("Can not open the browser, open the link manually: %s", err.message)).unref();
 	}
 };
 ATrustAdapter = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [

package/dist/services/signature/cms.mjs

@@ -0,0 +1,35 @@
+import { fromBER } from "asn1js";
+import { ContentInfo, SignedData } from "pkijs";
+//#region src/services/signature/cms.ts
+var IncompleteSignatureError = class extends Error {
+	received;
+	declared;
+	constructor(received, declared) {
+		super(`The signature is incomplete, got ${received} of ${declared} bytes.`);
+		this.received = received;
+		this.declared = declared;
+	}
+};
+var SignatureVerificationError = class extends Error {
+	cms;
+	constructor(message, cms, options) {
+		super(message, options);
+		this.cms = cms;
+	}
+};
+/**
+* Parses a DER encoded CMS SignedData, telling a signature that is cut short apart from one that is not a signature at all.
+*/
+function parseSignedData(cms) {
+	const { offset, result } = fromBER(new Uint8Array(cms));
+	if (offset === -1) {
+		const declared = result.idBlock.blockLength + result.lenBlock.blockLength + result.lenBlock.length;
+		if (declared > cms.length) throw new IncompleteSignatureError(cms.length, declared);
+		throw new Error(result.error);
+	}
+	const info = new ContentInfo({ schema: result });
+	if (info.contentType !== ContentInfo.SIGNED_DATA) throw new Error(`Expected CMS SignedData but got content type ${info.contentType}.`);
+	return new SignedData({ schema: info.content });
+}
+//#endregion
+export { IncompleteSignatureError, SignatureVerificationError, parseSignedData };

package/dist/services/signature/index.mjs

@@ -1,4 +1,5 @@
+import { IncompleteSignatureError, SignatureVerificationError, parseSignedData } from "./cms.mjs";
 import { SignatureAdapter } from "./signature.adapter.mjs";
 import { ATrustAdapter } from "./adapters/a-trust.adapter.mjs";
 import { SignatureService } from "./signature.service.mjs";
-export { ATrustAdapter, SignatureAdapter, SignatureService };
+export { ATrustAdapter, IncompleteSignatureError, SignatureAdapter, SignatureService, SignatureVerificationError, parseSignedData };

package/dist/services/signature/signature.service.mjs

@@ -1,24 +1,29 @@
 import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.154.0/helpers/esm/decorateMetadata.mjs";
 import __decorate from "../../_virtual/_@oxc-project_runtime@0.154.0/helpers/esm/decorate.mjs";
+import { IncompleteSignatureError, SignatureVerificationError, parseSignedData } from "./cms.mjs";
 import { ATrustAdapter } from "./adapters/a-trust.adapter.mjs";
 import { Injectable } from "@nestjs/common";
 import { readFile } from "fs/promises";
 import { isAbsolute, join } from "path";
+import { LoggerService } from "@cenk1cenk2/oclif-common";
+import { getAlgorithmByOID } from "pkijs";
 import { plainAddPlaceholder } from "@signpdf/placeholder-plain";
 import { SUBFILTER_ETSI_CADES_DETACHED, findByteRange, removeTrailingNewLine } from "@signpdf/utils";
 import { X509Certificate, webcrypto } from "crypto";
 import { homedir } from "os";
-import { ContentInfo, SignedData, getAlgorithmByOID } from "pkijs";
 //#region src/services/signature/signature.service.ts
 var _SignatureService;
 let SignatureService = class SignatureService {
 	static {
 		_SignatureService = this;
 	}
+	logger;
 	static LENGTH = 16384;
 	static MESSAGE_DIGEST = "1.2.840.113549.1.9.4";
 	adapters;
-	constructor(aTrust) {
+	constructor(logger, aTrust) {
+		this.logger = logger;
+		this.logger.setup(this.constructor.name);
 		this.adapters = [aTrust];
 	}
 	get providers() {
@@ -41,7 +46,10 @@ let SignatureService = class SignatureService {
 	async sign(pdf, options) {
 		const request = this.prepare(pdf, options);
 		const cms = await this.adapter(options.provider).sign(request);
-		await this.verify(request, cms, options.certificate);
+		const signer = await this.verify(request, cms, options.certificate).catch((err) => {
+			throw new SignatureVerificationError(err.message, cms, { cause: err });
+		});
+		this.logger.info("Signature is verified, signed by %s: the document digest matches and the signature is valid.", this.identify(signer));
 		return this.embed(request, cms);
 	}
 	adapter(provider) {
@@ -80,15 +88,16 @@ let SignatureService = class SignatureService {
 		const content = new Uint8Array(Buffer.concat([pdf.subarray(0, from), pdf.subarray(to + 1)])).buffer;
 		let signed;
 		try {
-			signed = new SignedData({ schema: ContentInfo.fromBER(new Uint8Array(cms)).content });
+			signed = parseSignedData(cms);
 		} catch (err) {
-			throw new Error(`The returned signature is not a CMS signature: ${err.message}`, { cause: err });
+			if (err instanceof IncompleteSignatureError) throw new Error(`The returned signature is incomplete, got ${err.received} of ${err.declared} bytes.`, { cause: err });
+			throw new Error(`The returned signature can not be parsed as a CMS signature: ${err.message}`, { cause: err });
 		}
 		const [info] = signed.signerInfos;
 		const digest = info?.signedAttrs?.attributes.find((attribute) => attribute.type === _SignatureService.MESSAGE_DIGEST);
 		if (!digest) throw new Error("The returned signature does not carry the digest of the document it signs.");
 		const algorithm = getAlgorithmByOID(info.digestAlgorithm.algorithmId, true, "digestAlgorithm");
-		if (!Buffer.from(digest.values[0].valueBlock.valueHexView).equals(Buffer.from(await webcrypto.subtle.digest(algorithm.name, content)))) throw new Error("The returned signature belongs to a different document, it is likely left over from an earlier signing.");
+		if (!Buffer.from(digest.values[0].valueBlock.valueHexView).equals(Buffer.from(await webcrypto.subtle.digest(algorithm.name, content)))) throw new Error("The returned signature belongs to a different document.");
 		const { signatureVerified, signerCertificate } = await signed.verify({
 			signer: 0,
 			data: content,
@@ -99,6 +108,7 @@ let SignatureService = class SignatureService {
 		const signer = new X509Certificate(Buffer.from(signerCertificate.toSchema().toBER()));
 		if (certificate && !signer.raw.equals(certificate.raw)) throw new Error([`The returned signature is signed by ${this.identify(signer)}, but the configured certificate is ${this.identify(certificate)}.`, "The signature block would show the wrong signer."].join(" "));
 		if (!signatureVerified) throw new Error(`The returned signature does not verify against the certificate of ${this.identify(signer)}.`);
+		return signer;
 	}
 	embed({ pdf, excluded: [from, to] }, cms) {
 		const signature = cms.toString("hex");
@@ -111,12 +121,12 @@ let SignatureService = class SignatureService {
 		]);
 	}
 	identify(certificate) {
-		return `${this.commonName(certificate.subject)} (serial ${certificate.serialNumber})`;
+		return `${this.commonName(certificate.subject)} (serial ${certificate.serialNumber}, issuer ${this.commonName(certificate.issuer)})`;
 	}
 	commonName(name) {
 		return name.split("\n").find((part) => part.startsWith("CN="))?.slice(3);
 	}
 };
-SignatureService = _SignatureService = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [typeof ATrustAdapter === "undefined" ? Object : ATrustAdapter])], SignatureService);
+SignatureService = _SignatureService = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [typeof LoggerService === "undefined" ? Object : LoggerService, typeof ATrustAdapter === "undefined" ? Object : ATrustAdapter])], SignatureService);
 //#endregion
 export { SignatureService };

package/oclif.manifest.json

@@ -198,5 +198,5 @@
       "enableJsonFlag": false
     }
   },
-  "version": "3.1.2"
+  "version": "3.2.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cenk1cenk2/md-printer",
-  "version": "3.1.2",
+  "version": "3.2.1",
   "description": "Render markdown or yaml through Svelte templates into PDF or HTML with Puppeteer.",
   "type": "module",
   "repository": {
@@ -51,15 +51,16 @@
   "dependencies": {
     "@cenk1cenk2/oclif-common": "^8.0.0",
     "@fontsource/montserrat": "^5.3.0",
-    "@listr2/manager": "^4.3.1",
+    "@listr2/manager": "^4.3.2",
     "@nestjs/common": "^12.1.2",
-    "@oclif/core": "^5.1.3",
-    "@oclif/plugin-help": "^7.0.2",
+    "@oclif/core": "^5.1.7",
+    "@oclif/plugin-help": "^7.0.3",
     "@signpdf/placeholder-plain": "^3.3.0",
     "@signpdf/utils": "^3.3.0",
     "@tailwindcss/node": "^4.3.3",
     "@tailwindcss/oxide": "^4.3.3",
     "@tailwindcss/typography": "^0.5.20",
+    "asn1js": "^3.0.10",
     "change-case": "^5.4.4",
     "chokidar": "^5.0.0",
     "enhanced-resolve": "^5.26.0",
@@ -71,7 +72,7 @@
     "highlight.js": "^11.12.0",
     "i18next": "^26.4.2",
     "lightningcss": "^1.33.0",
-    "listr2": "^11.2.0",
+    "listr2": "^11.3.0",
     "lowlight": "^3.3.0",
     "mime": "^4.1.1",
     "perfect-debounce": "^2.1.0",
@@ -113,11 +114,10 @@
     "@types/serve-static": "^2.2.0",
     "@types/which": "^3.0.4",
     "@types/write-file-atomic": "^4.0.3",
-    "asn1js": "^3.0.10",
     "eslint": "^10.12.0",
     "eslint-plugin-svelte": "^3.23.1",
     "execa": "^10.1.0",
-    "oclif": "^6.0.3",
+    "oclif": "^6.0.6",
     "prettier": "^3.9.9",
     "prettier-plugin-svelte": "^4.1.1",
     "svelte-eslint-parser": "^1.9.0",

package/templates/invoice/components/Client.svelte

@@ -29,12 +29,12 @@
     <table class="w-full table-auto my-0!">
       <tbody>
         <tr>
-          <td class="w-[30%] text-left align-middle font-bold">{t('fields.date')}</td>
-          <td class="w-[70%] text-right align-middle font-semibold">{date}</td>
+          <td class="w-[30%] text-left align-middle text-sm font-bold">{t('fields.date')}</td>
+          <td class="w-[70%] text-right align-middle text-sm font-semibold whitespace-nowrap">{date}</td>
         </tr>
         <tr>
-          <td class="w-[30%] text-left align-middle font-bold border-t! border-t-gray-100/30!">{t('fields.id')}</td>
-          <td class="w-[70%] text-right align-middle font-semibold border-t! border-t-gray-100/30!">{id}</td>
+          <td class="w-[30%] text-left align-middle text-sm font-bold border-t! border-t-gray-100/30!">{t('fields.id')}</td>
+          <td class="w-[70%] text-right align-middle text-sm font-semibold whitespace-nowrap border-t! border-t-gray-100/30!">{id}</td>
         </tr>
       </tbody>
     </table>

package/dist/services/renderer/app-window.mjs

@@ -1,44 +0,0 @@
-import { mkdtemp, rm } from "fs/promises";
-import { join } from "path";
-import { tmpdir } from "os";
-import { spawn } from "child_process";
-import { once } from "events";
-//#region src/services/renderer/app-window.ts
-/**
-* A browser window in app mode with a throwaway profile, so it shares no tabs, cookies or history with the browser of the user.
-*/
-var AppWindow = class AppWindow {
-	process;
-	profile;
-	/**
-	* Resolves when the window exits, rejects when the browser can not be started.
-	*/
-	closed;
-	constructor(process, profile) {
-		this.process = process;
-		this.profile = profile;
-		this.closed = new Promise((resolve, reject) => {
-			process.once("exit", () => resolve());
-			process.once("error", reject);
-		});
-		this.closed.catch(() => void 0);
-	}
-	static async open(executable, url) {
-		const profile = await mkdtemp(join(tmpdir(), "md-printer-window-"));
-		return new AppWindow(spawn(executable, [
-			`--app=${url}`,
-			`--user-data-dir=${profile}`,
-			"--no-first-run",
-			"--no-default-browser-check"
-		], { stdio: "ignore" }), profile);
-	}
-	async close() {
-		if (this.process.exitCode === null && this.process.signalCode === null && this.process.kill()) await once(this.process, "exit");
-		await rm(this.profile, {
-			recursive: true,
-			force: true
-		});
-	}
-};
-//#endregion
-export { AppWindow };