@ripwords/myinvois-client 0.0.9 → 0.1.0

package/src/utils/debug/debug-document-hash.ts

@@ -0,0 +1,249 @@
+import * as crypto from 'crypto'
+import { DOMParserImpl } from 'xmldom-ts'
+import type { InvoiceV1_1 } from '../../types'
+import { generateDocumentHash, generateSignedInvoiceXML } from '../invoice1-1'
+import type { SigningCredentials } from '../../types/documents/invoice-1_1.d.ts'
+
+/**
+ * Debug Document Hash Issues
+ *
+ * This helps identify why MyInvois is rejecting the document hash
+ */
+
+/**
+ * Compare different hash calculation methods to identify the correct approach
+ */
+export async function debugDocumentHash(
+  invoiceData: InvoiceV1_1,
+  signingCredentials: SigningCredentials,
+): Promise<{
+  signedXML: string
+  documentHashes: {
+    submissionHash: string // The hash sent in submission payload
+    signatureDocDigest: string // The digest value inside the signature
+    rawDocumentHash: string // Hash of raw signed XML
+    minifiedDocumentHash: string // Hash of minified signed XML
+    transformedDocumentHash: string // Hash of transformed document (used in signature)
+  }
+  areEqual: {
+    submissionVsSignature: boolean
+    submissionVsRaw: boolean
+    submissionVsMinified: boolean
+    submissionVsTransformed: boolean
+  }
+  recommendations: string[]
+}> {
+  console.log('\n🔍 DEBUGGING DOCUMENT HASH VALIDATION')
+  console.log('=====================================')
+
+  // Generate the signed XML
+  const signedXML = await generateSignedInvoiceXML(
+    invoiceData,
+    signingCredentials,
+  )
+
+  console.log(`\n📄 Generated signed XML (${signedXML.length} chars)`)
+  console.log('First 200 chars:', signedXML.substring(0, 200) + '...')
+
+  // 1. Calculate the hash used in submission payload (current implementation)
+  const submissionHash = generateDocumentHash(signedXML)
+  console.log(`\n📊 SUBMISSION HASH: ${submissionHash}`)
+
+  // 2. Extract the digest value from the signature itself
+  const parser = new DOMParserImpl()
+  const doc = parser.parseFromString(signedXML, 'application/xml')
+  const digestElements = doc.getElementsByTagName('ds:DigestValue')
+  let signatureDocDigest = ''
+
+  if (digestElements.length > 0) {
+    // First DigestValue should be the document digest
+    signatureDocDigest = digestElements[0]?.textContent || ''
+    console.log(`📊 SIGNATURE DOC DIGEST: ${signatureDocDigest}`)
+  } else {
+    console.error('❌ No DigestValue elements found in signature!')
+  }
+
+  // 3. Calculate hash of raw signed XML (what we're currently sending)
+  const rawDocumentHash = crypto
+    .createHash('sha256')
+    .update(signedXML, 'utf8')
+    .digest('hex')
+  console.log(`📊 RAW DOCUMENT HASH: ${rawDocumentHash}`)
+
+  // 4. Calculate hash of minified XML (MyInvois recommendation)
+  const minifiedXML = signedXML
+    .replace(/>\s+</g, '><')
+    .replace(/\s+/g, ' ')
+    .replace(/>\s/g, '>')
+    .replace(/\s</g, '<')
+    .trim()
+  const minifiedDocumentHash = crypto
+    .createHash('sha256')
+    .update(minifiedXML, 'utf8')
+    .digest('hex')
+  console.log(`📊 MINIFIED DOCUMENT HASH: ${minifiedDocumentHash}`)
+
+  // 5. Calculate hash of the document as it was transformed for signature creation
+  // Note: We can't easily recreate the exact transformation without the template,
+  // so we'll skip this comparison for now
+  console.log(
+    `📊 TRANSFORMED DOCUMENT HASH: [Skipped - requires internal template access]`,
+  )
+
+  // Compare available hashes
+  const areEqual = {
+    submissionVsSignature:
+      submissionHash ===
+      Buffer.from(signatureDocDigest, 'base64').toString('hex'),
+    submissionVsRaw: submissionHash === rawDocumentHash,
+    submissionVsMinified: submissionHash === minifiedDocumentHash,
+    submissionVsTransformed: false, // Skip this comparison
+  }
+
+  console.log('\n🔍 HASH COMPARISONS:')
+  console.log(
+    `Submission vs Signature:   ${areEqual.submissionVsSignature ? '✅' : '❌'}`,
+  )
+  console.log(
+    `Submission vs Raw:         ${areEqual.submissionVsRaw ? '✅' : '❌'}`,
+  )
+  console.log(
+    `Submission vs Minified:    ${areEqual.submissionVsMinified ? '✅' : '❌'}`,
+  )
+  console.log(
+    `Submission vs Transformed: ${areEqual.submissionVsTransformed ? '✅' : '❌'}`,
+  )
+
+  // Generate recommendations
+  const recommendations: string[] = []
+
+  if (!areEqual.submissionVsSignature) {
+    recommendations.push(
+      '❌ Submission hash does not match signature digest - this is likely the root cause!',
+    )
+    recommendations.push(
+      '💡 Consider using the same hash calculation method for both signature and submission',
+    )
+  }
+
+  if (!areEqual.submissionVsRaw) {
+    recommendations.push(
+      '⚠️  Current implementation calculates different hashes for signature vs submission',
+    )
+  }
+
+  if (areEqual.submissionVsMinified && !areEqual.submissionVsRaw) {
+    recommendations.push('💡 Try using minified XML hash for submission')
+  }
+
+  if (areEqual.submissionVsTransformed) {
+    recommendations.push(
+      '💡 The transformed document hash matches - this might be what MyInvois expects',
+    )
+  }
+
+  // Check if we're using the wrong document for submission hash
+  if (!areEqual.submissionVsSignature) {
+    recommendations.push(
+      '🔧 POTENTIAL FIX: Use the digest value from signature as documentHash in submission',
+    )
+    recommendations.push(
+      '🔧 ALTERNATIVE: Ensure submission hash uses same canonicalization as signature creation',
+    )
+  }
+
+  console.log('\n💡 RECOMMENDATIONS:')
+  recommendations.forEach(rec => console.log(`   ${rec}`))
+
+  return {
+    signedXML,
+    documentHashes: {
+      submissionHash,
+      signatureDocDigest,
+      rawDocumentHash,
+      minifiedDocumentHash,
+      transformedDocumentHash: '',
+    },
+    areEqual,
+    recommendations,
+  }
+}
+
+/**
+ * Test different approaches to calculate the submission hash
+ */
+export async function testSubmissionHashMethods(
+  invoiceData: InvoiceV1_1,
+  signingCredentials: SigningCredentials,
+): Promise<{
+  methods: {
+    current: string // Current implementation
+    signatureDigest: string // Use digest from signature
+    canonicalized: string // Use same canonicalization as signature
+    transformed: string // Use transformed document
+  }
+  recommendations: string[]
+}> {
+  console.log('\n🧪 TESTING SUBMISSION HASH METHODS')
+  console.log('==================================')
+
+  // Generate signed XML
+  const signedXML = await generateSignedInvoiceXML(
+    invoiceData,
+    signingCredentials,
+  )
+
+  // Method 1: Current implementation (direct SHA256 of signed XML)
+  const currentHash = generateDocumentHash(signedXML)
+  console.log(`Method 1 - Current: ${currentHash}`)
+
+  // Method 2: Extract digest from signature
+  const parser = new DOMParserImpl()
+  const doc = parser.parseFromString(signedXML, 'application/xml')
+  const digestElements = doc.getElementsByTagName('ds:DigestValue')
+  const signatureDigest = digestElements[0]?.textContent || ''
+  const signatureDigestHex = Buffer.from(signatureDigest, 'base64').toString(
+    'hex',
+  )
+  console.log(`Method 2 - Signature Digest: ${signatureDigestHex}`)
+
+  // Method 3: Use same canonicalization as signature creation
+  // Note: Skip this method as it requires internal template access
+  console.log(`Method 3 - Canonicalized: [Skipped - requires internal access]`)
+
+  // Method 4: Hash the transformed document directly
+  // Note: Skip this method as it requires internal template access
+  console.log(`Method 4 - Transformed: [Skipped - requires internal access]`)
+
+  const methods = {
+    current: currentHash,
+    signatureDigest: signatureDigestHex,
+    canonicalized: '', // Skipped
+    transformed: '', // Skipped
+  }
+
+  const recommendations: string[] = []
+
+  if (methods.current !== methods.signatureDigest) {
+    recommendations.push(
+      '🔧 PRIMARY RECOMMENDATION: Use signature digest as submission hash',
+    )
+    recommendations.push(
+      '   Update generateDocumentHash() to extract digest from signed XML',
+    )
+  }
+
+  if (methods.current !== methods.canonicalized) {
+    recommendations.push(
+      '🔧 ALTERNATIVE: Use canonicalized document hash for submission',
+    )
+  }
+
+  console.log('\n💡 RECOMMENDATIONS:')
+  recommendations.forEach(rec => console.log(`   ${rec}`))
+
+  return {
+    methods,
+    recommendations,
+  }
+}

package/src/utils/debug/debug-invoice-submission.ts

@@ -0,0 +1,355 @@
+import { DOMParserImpl } from 'xmldom-ts'
+import {
+  extractCertificateInfo,
+  generateSignedInvoiceXML,
+  generateUBLXMLTemplate,
+  validateKeyPair,
+} from '../invoice1-1'
+import type {
+  InvoiceV1_1,
+  SigningCredentials,
+} from '../../types/documents/invoice-1_1.d.ts'
+import { transformXmlInvoice } from '../signature/transform'
+import {
+  canonicalizeAndHashDocument,
+  canonicalizeAndHashDocumentWithC14N11Fallback,
+} from '../signature/canonicalize'
+
+/**
+ * Tests both canonicalization algorithms and compares their output
+ * This can help determine if the algorithm difference affects signature validation
+ * @param xmlDocument - The XML document string to test
+ * @returns Object with canonicalization results and comparison
+ */
+export const testCanonicalizationAlgorithms = async (
+  xmlDocument: string,
+): Promise<{
+  exclusiveC14N: { success: boolean; digest?: string; error?: string }
+  c14n11Fallback: { success: boolean; digest?: string; error?: string }
+  areEqual: boolean
+}> => {
+  const parser = new DOMParserImpl()
+  const doc = parser.parseFromString(xmlDocument, 'application/xml')
+
+  const results = {
+    exclusiveC14N: { success: false } as any,
+    c14n11Fallback: { success: false } as any,
+    areEqual: false,
+  }
+
+  // Test Exclusive C14N
+  try {
+    const exclusiveDigest = await canonicalizeAndHashDocument(
+      doc,
+      'http://www.w3.org/2001/10/xml-exc-c14n#',
+    )
+    results.exclusiveC14N = { success: true, digest: exclusiveDigest }
+  } catch (error: any) {
+    results.exclusiveC14N = { success: false, error: error.message }
+  }
+
+  // Test C14N 1.1 fallback
+  try {
+    const c14n11Digest =
+      await canonicalizeAndHashDocumentWithC14N11Fallback(doc)
+    results.c14n11Fallback = { success: true, digest: c14n11Digest }
+  } catch (error: any) {
+    results.c14n11Fallback = { success: false, error: error.message }
+  }
+
+  // Compare results
+  if (results.exclusiveC14N.success && results.c14n11Fallback.success) {
+    results.areEqual =
+      results.exclusiveC14N.digest === results.c14n11Fallback.digest
+  }
+
+  return results
+}
+
+/**
+ * Simple validation function that checks basic XML structure requirements
+ */
+export function validateXMLStructure(xmlString: string): {
+  isValid: boolean
+  errors: string[]
+  warnings: string[]
+} {
+  const errors: string[] = []
+  const warnings: string[] = []
+
+  try {
+    const parser = new DOMParserImpl()
+    const doc = parser.parseFromString(xmlString, 'application/xml')
+
+    // Check for parser errors
+    const parserErrors = doc.getElementsByTagName('parsererror')
+    if (parserErrors.length > 0) {
+      errors.push('XML parsing failed')
+      return { isValid: false, errors, warnings }
+    }
+
+    // Check required elements
+    const requiredElements = [
+      'Invoice',
+      'UBLExtensions',
+      'cbc:ID',
+      'cbc:IssueDate',
+      'cbc:IssueTime',
+      'cbc:InvoiceTypeCode',
+      'ds:Signature',
+      'ds:SignatureValue',
+      'ds:X509Certificate',
+    ]
+
+    for (const element of requiredElements) {
+      const elements = element.includes(':')
+        ? doc.getElementsByTagName(element)
+        : doc.getElementsByTagName(element)
+
+      if (elements.length === 0) {
+        errors.push(`Missing required element: ${element}`)
+      }
+    }
+
+    // Check namespace declarations
+    const expectedNamespaces = [
+      'urn:oasis:names:specification:ubl:schema:xsd:Invoice-2',
+      'urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2',
+      'urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2',
+    ]
+
+    for (const ns of expectedNamespaces) {
+      if (!xmlString.includes(ns)) {
+        warnings.push(`Missing namespace declaration: ${ns}`)
+      }
+    }
+  } catch (error: any) {
+    errors.push(`XML validation error: ${error.message}`)
+  }
+
+  return {
+    isValid: errors.length === 0,
+    errors,
+    warnings,
+  }
+}
+
+/**
+ * Comprehensive debugging function to help identify issues with generated XML
+ * This validates the structure against MyInvois requirements and provides detailed feedback
+ */
+export async function debugSignedInvoiceXML(
+  invoiceInfo: InvoiceV1_1,
+  signingCredentials: SigningCredentials,
+): Promise<{
+  success: boolean
+  signedXML?: string
+  validationResults: {
+    xmlStructure: { valid: boolean; errors: string[] }
+    signatureElements: { valid: boolean; errors: string[] }
+    digestValues: { valid: boolean; errors: string[] }
+    certificateInfo: { valid: boolean; errors: string[] }
+    canonicalizationTest: any
+  }
+  stepByStepResults: {
+    step1_template: { success: boolean; error?: string }
+    step2_transform: { success: boolean; error?: string }
+    step3_docDigest: { success: boolean; digest?: string; error?: string }
+    step4_signature: { success: boolean; signature?: string; error?: string }
+    step5_certDigest: { success: boolean; digest?: string; error?: string }
+    step6_signedProps: { success: boolean; error?: string }
+    step7_propsDigest: { success: boolean; digest?: string; error?: string }
+    step8_finalDoc: { success: boolean; error?: string }
+  }
+}> {
+  const stepResults = {
+    step1_template: { success: false } as any,
+    step2_transform: { success: false } as any,
+    step3_docDigest: { success: false } as any,
+    step4_signature: { success: false } as any,
+    step5_certDigest: { success: false } as any,
+    step6_signedProps: { success: false } as any,
+    step7_propsDigest: { success: false } as any,
+    step8_finalDoc: { success: false } as any,
+  }
+
+  const validationResults = {
+    xmlStructure: { valid: false, errors: [] as string[] },
+    signatureElements: { valid: false, errors: [] as string[] },
+    digestValues: { valid: false, errors: [] as string[] },
+    certificateInfo: { valid: false, errors: [] as string[] },
+    canonicalizationTest: null as any,
+  }
+
+  let signedXML: string | undefined
+
+  try {
+    // Step 1: Generate template
+    try {
+      const xmlTemplate = generateUBLXMLTemplate(invoiceInfo)
+      stepResults.step1_template = { success: true }
+
+      // Validate XML structure
+      const parser = new DOMParserImpl()
+      const doc = parser.parseFromString(xmlTemplate, 'application/xml')
+      const parserErrors = doc.getElementsByTagName('parsererror')
+      if (parserErrors.length > 0) {
+        validationResults.xmlStructure.errors.push(
+          'XML template parsing failed',
+        )
+      } else {
+        validationResults.xmlStructure.valid = true
+      }
+    } catch (error: any) {
+      stepResults.step1_template = { success: false, error: error.message }
+      validationResults.xmlStructure.errors.push(
+        `Template generation failed: ${error.message}`,
+      )
+    }
+
+    // Step 2: Transform
+    try {
+      const xmlTemplate = generateUBLXMLTemplate(invoiceInfo)
+      const transformedXml = transformXmlInvoice(xmlTemplate)
+      stepResults.step2_transform = { success: true }
+
+      // Check if transformation worked correctly
+      if (transformedXml.includes('UBLExtensions')) {
+        validationResults.xmlStructure.errors.push(
+          'UBLExtensions not properly removed in transformation',
+        )
+      }
+      if (transformedXml.includes('<cac:Signature>')) {
+        validationResults.xmlStructure.errors.push(
+          'cac:Signature elements not properly removed in transformation',
+        )
+      }
+    } catch (error: any) {
+      stepResults.step2_transform = { success: false, error: error.message }
+    }
+
+    // Test canonicalization
+    try {
+      const xmlTemplate = generateUBLXMLTemplate(invoiceInfo)
+      validationResults.canonicalizationTest =
+        await testCanonicalizationAlgorithms(xmlTemplate)
+    } catch (error: any) {
+      validationResults.canonicalizationTest = { error: error.message }
+    }
+
+    // Continue with full signing process
+    try {
+      signedXML = await generateSignedInvoiceXML(
+        invoiceInfo,
+        signingCredentials,
+      )
+
+      // Parse the final signed XML for validation
+      const parser = new DOMParserImpl()
+      const finalDoc = parser.parseFromString(signedXML, 'application/xml')
+
+      // Check signature elements are populated
+      const signatureValue =
+        finalDoc.getElementsByTagName('ds:SignatureValue')[0]
+      const x509Certificate =
+        finalDoc.getElementsByTagName('ds:X509Certificate')[0]
+      const digestValues = finalDoc.getElementsByTagName('ds:DigestValue')
+
+      if (!signatureValue || !signatureValue.textContent?.trim()) {
+        validationResults.signatureElements.errors.push(
+          'SignatureValue is empty',
+        )
+      }
+
+      if (!x509Certificate || !x509Certificate.textContent?.trim()) {
+        validationResults.signatureElements.errors.push(
+          'X509Certificate is empty',
+        )
+      }
+
+      if (digestValues.length < 2) {
+        validationResults.digestValues.errors.push(
+          'Missing digest values (expected at least 2)',
+        )
+      } else {
+        let emptyDigests = 0
+        for (let i = 0; i < digestValues.length; i++) {
+          const digestElement = digestValues[i]
+          if (!digestElement || !digestElement.textContent?.trim()) {
+            emptyDigests++
+          }
+        }
+        if (emptyDigests > 0) {
+          validationResults.digestValues.errors.push(
+            `${emptyDigests} digest values are empty`,
+          )
+        }
+      }
+
+      // Validate certificate info
+      try {
+        const certInfo = extractCertificateInfo(
+          signingCredentials.certificatePem,
+        )
+        const keyPairValid = validateKeyPair(
+          signingCredentials.certificatePem,
+          signingCredentials.privateKeyPem,
+        )
+
+        if (!keyPairValid) {
+          validationResults.certificateInfo.errors.push(
+            'Certificate and private key do not match',
+          )
+        }
+
+        if (!certInfo.issuerName || !certInfo.serialNumber) {
+          validationResults.certificateInfo.errors.push(
+            'Certificate info extraction failed',
+          )
+        }
+
+        if (validationResults.certificateInfo.errors.length === 0) {
+          validationResults.certificateInfo.valid = true
+        }
+      } catch (error: any) {
+        validationResults.certificateInfo.errors.push(
+          `Certificate validation failed: ${error.message}`,
+        )
+      }
+
+      // Set validation flags
+      if (validationResults.signatureElements.errors.length === 0) {
+        validationResults.signatureElements.valid = true
+      }
+      if (validationResults.digestValues.errors.length === 0) {
+        validationResults.digestValues.valid = true
+      }
+
+      // Mark individual steps as successful if we got here
+      stepResults.step3_docDigest = { success: true }
+      stepResults.step4_signature = { success: true }
+      stepResults.step5_certDigest = { success: true }
+      stepResults.step6_signedProps = { success: true }
+      stepResults.step7_propsDigest = { success: true }
+      stepResults.step8_finalDoc = { success: true }
+    } catch (error: any) {
+      console.error('Error during signing process:', error)
+      stepResults.step8_finalDoc = { success: false, error: error.message }
+    }
+  } catch (error: any) {
+    console.error('Fatal error in debugging:', error)
+  }
+
+  const allValid =
+    validationResults.xmlStructure.valid &&
+    validationResults.signatureElements.valid &&
+    validationResults.digestValues.valid &&
+    validationResults.certificateInfo.valid
+
+  return {
+    success: allValid,
+    signedXML,
+    validationResults,
+    stepByStepResults: stepResults,
+  }
+}

package/src/utils/getBaseUrl.ts

@@ -1,4 +1,4 @@
-export const getBaseUrl = (environment: 'sandbox' | 'production') => {
+export const getBaseUrl = (environment: 'sandbox' | 'production'): string => {
   return environment === 'sandbox'
     ? 'https://preprod-api.myinvois.hasil.gov.my'
     : 'https://api.myinvois.hasil.gov.my'