@fin.cx/skr 1.1.0 → 1.2.0

package/ts/skr.security.ts

@@ -0,0 +1,405 @@
+import * as plugins from './plugins.js';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import * as https from 'https';
+
+export interface ISigningOptions {
+  certificatePem?: string;
+  privateKeyPem?: string;
+  privateKeyPassphrase?: string;
+  timestampServerUrl?: string;
+  includeTimestamp?: boolean;
+}
+
+export interface ISignatureResult {
+  signature: string;
+  signatureFormat: 'CAdES-B' | 'CAdES-T' | 'CAdES-LT';
+  signingTime: string;
+  certificateChain?: string[];
+  timestampToken?: string;
+  timestampTime?: string;
+}
+
+export interface ITimestampResponse {
+  token: string;
+  time: string;
+  serverUrl: string;
+  hashAlgorithm: string;
+}
+
+export class SecurityManager {
+  private options: ISigningOptions;
+  private logger: plugins.smartlog.ConsoleLog;
+  
+  constructor(options: ISigningOptions = {}) {
+    this.options = {
+      timestampServerUrl: options.timestampServerUrl || 'http://timestamp.digicert.com',
+      includeTimestamp: options.includeTimestamp !== false,
+      ...options
+    };
+    this.logger = new plugins.smartlog.ConsoleLog();
+  }
+
+  /**
+   * Creates a CAdES-B (Basic) signature for data
+   */
+  public async createCadesSignature(
+    data: Buffer | string,
+    certificatePem?: string,
+    privateKeyPem?: string
+  ): Promise<ISignatureResult> {
+    const cert = certificatePem || this.options.certificatePem;
+    const key = privateKeyPem || this.options.privateKeyPem;
+    
+    if (!cert || !key) {
+      throw new Error('Certificate and private key are required for signing');
+    }
+
+    try {
+      // Parse certificate and key
+      const certificate = plugins.nodeForge.pki.certificateFromPem(cert);
+      const privateKey = this.options.privateKeyPassphrase 
+        ? plugins.nodeForge.pki.decryptRsaPrivateKey(key, this.options.privateKeyPassphrase)
+        : plugins.nodeForge.pki.privateKeyFromPem(key);
+
+      // Create PKCS#7 signed data (CMS)
+      const p7 = plugins.nodeForge.pkcs7.createSignedData();
+      
+      // Add content
+      if (typeof data === 'string') {
+        p7.content = plugins.nodeForge.util.createBuffer(data, 'utf8');
+      } else {
+        p7.content = plugins.nodeForge.util.createBuffer(data.toString('latin1'));
+      }
+
+      // Add certificate
+      p7.addCertificate(certificate);
+
+      // Add signer
+      p7.addSigner({
+        key: privateKey,
+        certificate: certificate,
+        digestAlgorithm: plugins.nodeForge.pki.oids.sha256,
+        authenticatedAttributes: [
+          {
+            type: plugins.nodeForge.pki.oids.contentType,
+            value: plugins.nodeForge.pki.oids.data
+          },
+          {
+            type: plugins.nodeForge.pki.oids.messageDigest
+          },
+          {
+            type: plugins.nodeForge.pki.oids.signingTime,
+            value: new Date().toISOString()
+          }
+        ]
+      });
+
+      // Sign the data
+      p7.sign({ detached: true });
+
+      // Convert to PEM
+      const pem = plugins.nodeForge.pkcs7.messageToPem(p7);
+      
+      // Extract base64 signature
+      const signature = pem
+        .replace(/-----BEGIN PKCS7-----/, '')
+        .replace(/-----END PKCS7-----/, '')
+        .replace(/\r?\n/g, '');
+
+      const result: ISignatureResult = {
+        signature: signature,
+        signatureFormat: 'CAdES-B',
+        signingTime: new Date().toISOString(),
+        certificateChain: [cert]
+      };
+
+      // Add timestamp if requested
+      if (this.options.includeTimestamp && this.options.timestampServerUrl) {
+        try {
+          const timestampResponse = await this.requestTimestamp(signature);
+          result.timestampToken = timestampResponse.token;
+          result.timestampTime = timestampResponse.time;
+          result.signatureFormat = 'CAdES-T';
+        } catch (error) {
+          this.logger.log('warn', `Failed to obtain timestamp: ${error}`);
+        }
+      }
+
+      return result;
+    } catch (error) {
+      throw new Error(`Failed to create CAdES signature: ${error}`);
+    }
+  }
+
+  /**
+   * Requests an RFC 3161 timestamp from a TSA
+   */
+  public async requestTimestamp(dataHash: string | Buffer): Promise<ITimestampResponse> {
+    try {
+      // Create hash of the data
+      let hash: Buffer;
+      if (typeof dataHash === 'string') {
+        hash = crypto.createHash('sha256').update(dataHash).digest();
+      } else {
+        hash = crypto.createHash('sha256').update(dataHash).digest();
+      }
+
+      // Create timestamp request (simplified - in production use proper ASN.1 encoding)
+      const tsRequest = this.createTimestampRequest(hash);
+      
+      // Send request to TSA
+      const response = await this.sendTimestampRequest(tsRequest);
+      
+      return {
+        token: response.toString('base64'),
+        time: new Date().toISOString(),
+        serverUrl: this.options.timestampServerUrl!,
+        hashAlgorithm: 'sha256'
+      };
+    } catch (error) {
+      throw new Error(`Failed to obtain timestamp: ${error}`);
+    }
+  }
+
+  /**
+   * Creates a timestamp request (simplified version)
+   */
+  private createTimestampRequest(hash: Buffer): Buffer {
+    // In production, use proper ASN.1 encoding library
+    // This is a simplified placeholder
+    const request = {
+      version: 1,
+      messageImprint: {
+        hashAlgorithm: { algorithm: '2.16.840.1.101.3.4.2.1' }, // SHA-256 OID
+        hashedMessage: hash
+      },
+      reqPolicy: null,
+      nonce: crypto.randomBytes(8),
+      certReq: true
+    };
+    
+    // Convert to DER-encoded ASN.1 (simplified)
+    return Buffer.from(JSON.stringify(request));
+  }
+
+  /**
+   * Sends timestamp request to TSA server
+   */
+  private async sendTimestampRequest(request: Buffer): Promise<Buffer> {
+    return new Promise((resolve, reject) => {
+      const url = new URL(this.options.timestampServerUrl!);
+      
+      const options = {
+        hostname: url.hostname,
+        port: url.port || 443,
+        path: url.pathname,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/timestamp-query',
+          'Content-Length': request.length
+        }
+      };
+
+      const req = https.request(options, (res) => {
+        const chunks: Buffer[] = [];
+        
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => {
+          const response = Buffer.concat(chunks);
+          if (res.statusCode === 200) {
+            resolve(response);
+          } else {
+            reject(new Error(`TSA server returned status ${res.statusCode}`));
+          }
+        });
+      });
+
+      req.on('error', reject);
+      req.write(request);
+      req.end();
+    });
+  }
+
+  /**
+   * Verifies a CAdES signature
+   */
+  public async verifyCadesSignature(
+    data: Buffer | string,
+    signature: string,
+    certificatePem?: string
+  ): Promise<boolean> {
+    try {
+      // Add PEM headers if not present
+      let pemSignature = signature;
+      if (!signature.includes('BEGIN PKCS7')) {
+        pemSignature = `-----BEGIN PKCS7-----\n${signature}\n-----END PKCS7-----`;
+      }
+
+      // Parse the PKCS#7 message
+      const p7 = plugins.nodeForge.pkcs7.messageFromPem(pemSignature);
+      
+      // Prepare content for verification
+      let content: plugins.nodeForge.util.ByteStringBuffer;
+      if (typeof data === 'string') {
+        content = plugins.nodeForge.util.createBuffer(data, 'utf8');
+      } else {
+        content = plugins.nodeForge.util.createBuffer(data.toString('latin1'));
+      }
+
+      // Verify the signature
+      const verified = (p7 as any).verify({ 
+        content: content,
+        detached: true 
+      });
+
+      return verified;
+    } catch (error) {
+      this.logger.log('error', `Signature verification failed: ${error}`);
+      return false;
+    }
+  }
+
+  /**
+   * Generates a self-signed certificate for testing
+   */
+  public async generateSelfSignedCertificate(
+    commonName: string = 'SKR Export System',
+    validDays: number = 365
+  ): Promise<{ certificate: string; privateKey: string }> {
+    const keys = plugins.nodeForge.pki.rsa.generateKeyPair(2048);
+    const cert = plugins.nodeForge.pki.createCertificate();
+    
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = '01';
+    cert.validity.notBefore = new Date();
+    cert.validity.notAfter = new Date();
+    cert.validity.notAfter.setDate(cert.validity.notAfter.getDate() + validDays);
+    
+    const attrs = [
+      { name: 'commonName', value: commonName },
+      { name: 'countryName', value: 'DE' },
+      { name: 'organizationName', value: 'SKR Export System' },
+      { shortName: 'OU', value: 'Accounting' }
+    ];
+    
+    cert.setSubject(attrs);
+    cert.setIssuer(attrs);
+    
+    cert.setExtensions([
+      {
+        name: 'basicConstraints',
+        cA: true
+      },
+      {
+        name: 'keyUsage',
+        keyCertSign: true,
+        digitalSignature: true,
+        nonRepudiation: true,
+        keyEncipherment: true,
+        dataEncipherment: true
+      },
+      {
+        name: 'extKeyUsage',
+        serverAuth: true,
+        clientAuth: true,
+        codeSigning: true,
+        emailProtection: true,
+        timeStamping: true
+      },
+      {
+        name: 'nsCertType',
+        client: true,
+        server: true,
+        email: true,
+        objsign: true,
+        sslCA: true,
+        emailCA: true,
+        objCA: true
+      },
+      {
+        name: 'subjectAltName',
+        altNames: [
+          { type: 2, value: commonName }
+        ]
+      }
+    ]);
+    
+    // Self-sign certificate
+    cert.sign(keys.privateKey, plugins.nodeForge.md.sha256.create());
+    
+    // Convert to PEM
+    const certificatePem = plugins.nodeForge.pki.certificateToPem(cert);
+    const privateKeyPem = plugins.nodeForge.pki.privateKeyToPem(keys.privateKey);
+    
+    return {
+      certificate: certificatePem,
+      privateKey: privateKeyPem
+    };
+  }
+
+  /**
+   * Creates a detached signature file
+   */
+  public async createDetachedSignature(
+    dataPath: string,
+    outputPath: string
+  ): Promise<void> {
+    const data = await plugins.smartfile.fs.toBuffer(dataPath);
+    const signature = await this.createCadesSignature(data);
+    
+    const signatureData = {
+      signature: signature.signature,
+      format: signature.signatureFormat,
+      signingTime: signature.signingTime,
+      timestamp: signature.timestampToken,
+      timestampTime: signature.timestampTime,
+      algorithm: 'SHA256withRSA',
+      signedFile: path.basename(dataPath)
+    };
+    
+    await plugins.smartfile.memory.toFs(
+      JSON.stringify(signatureData, null, 2),
+      outputPath
+    );
+  }
+
+  /**
+   * Verifies a detached signature file
+   */
+  public async verifyDetachedSignature(
+    dataPath: string,
+    signaturePath: string
+  ): Promise<boolean> {
+    try {
+      const data = await plugins.smartfile.fs.toBuffer(dataPath);
+      const signatureJson = await plugins.smartfile.fs.toStringSync(signaturePath);
+      const signatureData = JSON.parse(signatureJson);
+      
+      return await this.verifyCadesSignature(data, signatureData.signature);
+    } catch (error) {
+      this.logger.log('error', `Failed to verify detached signature: ${error}`);
+      return false;
+    }
+  }
+
+  /**
+   * Adds Long-Term Validation (LTV) information
+   */
+  public async addLtvInformation(
+    signature: ISignatureResult,
+    ocspResponse?: Buffer,
+    crlData?: Buffer
+  ): Promise<ISignatureResult> {
+    // Add OCSP response and CRL data for long-term validation
+    const ltv = {
+      ...signature,
+      signatureFormat: 'CAdES-LT' as const,
+      ocsp: ocspResponse?.toString('base64'),
+      crl: crlData?.toString('base64'),
+      ltvTime: new Date().toISOString()
+    };
+    
+    return ltv;
+  }
+}

package/ts/skr.types.ts

@@ -136,6 +136,7 @@ export interface ITransactionFilter {
 export interface IDatabaseConfig {
   mongoDbUrl: string;
   dbName?: string;
+  invoiceExportPath?: string; // Optional path for invoice storage
 }
 
 export interface IReportParams {