@cj-tech-master/excelts 9.4.2 → 9.5.0

package/dist/cjs/modules/word/digital-signatures.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * DOCX Digital Signatures (OPC Package Digital Signature)
+ *
+ * DOCX documents may contain digital signatures stored in:
+ *   _xmlsignatures/origin.sigs
+ *   _xmlsignatures/sig1.xml, sig2.xml, ...
+ *   _xmlsignatures/_rels/origin.sigs.rels
+ *
+ * The signatures use W3C XML Digital Signature (XMLDSig) format with
+ * Office-specific OfficeObject extensions per MS-OFFCRYPTO.
+ *
+ * This module provides:
+ * - Detection and extraction of signature metadata
+ * - Preservation of signatures through round-trip (via opaqueParts)
+ *
+ * Note: Creating new signatures requires X.509 certificate handling and
+ * is outside the scope of this module. Consider using a dedicated signing
+ * tool for the actual signing step.
+ *
+ * References:
+ *   - OPC: Open Packaging Conventions (ECMA-376 Part 2)
+ *   - XMLDSig: https://www.w3.org/TR/xmldsig-core/
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasDigitalSignatures = hasDigitalSignatures;
+exports.parseSignatureXml = parseSignatureXml;
+exports.extractSignatures = extractSignatures;
+exports.isWellFormedSignature = isWellFormedSignature;
+/**
+ * Check if a document has digital signatures.
+ *
+ * @param opaquePaths - Set of paths in the package (typically from opaqueParts).
+ * @returns True if signatures are present.
+ */
+function hasDigitalSignatures(opaquePaths) {
+    return opaquePaths.some(p => p.startsWith("_xmlsignatures/sig"));
+}
+/**
+ * Extract digital signature metadata from sig XML content.
+ *
+ * @param xmlStr - The signature XML content.
+ * @param fileName - The file name (e.g. "sig1.xml").
+ * @returns Parsed signature info.
+ */
+function parseSignatureXml(xmlStr, fileName) {
+    const info = {
+        rawXml: xmlStr,
+        fileName
+    };
+    // Extract Office-specific metadata from <SignatureInfoV1>
+    const sigTextMatch = /<SignatureText[^>]*>([^<]*)<\/SignatureText>/.exec(xmlStr);
+    if (sigTextMatch) {
+        info.signer = decodeEntities(sigTextMatch[1]);
+    }
+    const sigCommentsMatch = /<SignatureComments[^>]*>([^<]*)<\/SignatureComments>/.exec(xmlStr);
+    if (sigCommentsMatch) {
+        info.signatureComments = decodeEntities(sigCommentsMatch[1]);
+    }
+    const purposeMatch = /<SignaturePurpose[^>]*>([^<]*)<\/SignaturePurpose>/.exec(xmlStr);
+    if (purposeMatch) {
+        info.purpose = decodeEntities(purposeMatch[1]);
+    }
+    const dateMatch = /<SignatureDate[^>]*>([^<]*)<\/SignatureDate>/.exec(xmlStr);
+    if (dateMatch) {
+        info.signDate = dateMatch[1];
+    }
+    const providerMatch = /<SignatureProviderUrl[^>]*>([^<]*)<\/SignatureProviderUrl>/.exec(xmlStr);
+    if (providerMatch) {
+        info.providerUrl = decodeEntities(providerMatch[1]);
+    }
+    // Commitment type
+    const commitMatch = /<CommitmentType[^>]*>\s*<CommitmentTypeIndication[^>]*>\s*<CommitmentTypeId>([^<]*)<\/CommitmentTypeId>/.exec(xmlStr);
+    if (commitMatch) {
+        info.commitmentType = commitMatch[1];
+    }
+    // Extract signature value (base64)
+    const sigValMatch = /<SignatureValue[^>]*>([^]*?)<\/SignatureValue>/.exec(xmlStr);
+    if (sigValMatch) {
+        info.signatureValue = sigValMatch[1].trim();
+    }
+    // Certificate details from <X509Data>
+    const certSubjectMatch = /<X509SubjectName[^>]*>([^<]*)<\/X509SubjectName>/.exec(xmlStr);
+    if (certSubjectMatch) {
+        info.certificateSubject = decodeEntities(certSubjectMatch[1]);
+    }
+    const certIssuerMatch = /<X509IssuerName[^>]*>([^<]*)<\/X509IssuerName>/.exec(xmlStr);
+    if (certIssuerMatch) {
+        info.certificateIssuer = decodeEntities(certIssuerMatch[1]);
+    }
+    const certSerialMatch = /<X509SerialNumber[^>]*>([^<]*)<\/X509SerialNumber>/.exec(xmlStr);
+    if (certSerialMatch) {
+        info.certificateSerialNumber = certSerialMatch[1];
+    }
+    return info;
+}
+/**
+ * Extract all digital signatures from opaque parts of a document.
+ *
+ * @param opaqueParts - Opaque parts (from DocxDocument.opaqueParts).
+ * @returns Array of parsed signature info.
+ */
+function extractSignatures(opaqueParts) {
+    if (!opaqueParts) {
+        return [];
+    }
+    const signatures = [];
+    const decoder = new TextDecoder("utf-8");
+    for (const part of opaqueParts) {
+        if (part.path.startsWith("_xmlsignatures/sig") && part.path.endsWith(".xml")) {
+            const xmlStr = decoder.decode(part.data);
+            const fileName = part.path.split("/").pop() ?? "";
+            signatures.push(parseSignatureXml(xmlStr, fileName));
+        }
+    }
+    return signatures;
+}
+/**
+ * Verify that a digital signature's structural integrity is intact.
+ *
+ * Note: This does NOT verify the cryptographic signature — that requires
+ * access to the signer's public key and a full XMLDSig implementation.
+ * Use a dedicated XMLDSig library for cryptographic verification.
+ *
+ * @returns True if the signature structure is well-formed.
+ */
+function isWellFormedSignature(info) {
+    return (info.rawXml.includes("<Signature ") &&
+        info.rawXml.includes("<SignedInfo") &&
+        info.rawXml.includes("<SignatureValue") &&
+        info.rawXml.includes("<KeyInfo"));
+}
+function decodeEntities(s) {
+    return s
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, "&");
+}