@universis/signer-worker 1.1.0 → 1.5.0

package/README.md

@@ -8,7 +8,7 @@ Install `@universis/signer-worker`
 
     npm i @universis/signer-worker
 
-Important note: Verify that [Universis Signer](https://gitlab.com/universis/universis-signer) is already installed as aservice. Follow [installation instructions](https://gitlab.com/universis/universis-signer#installation) to install and configure Universis Signer.
+Important note: Verify that [Universis Signer](https://gitlab.com/universis/universis-signer) is already installed as a service. Follow [installation instructions](https://gitlab.com/universis/universis-signer#installation) to install and configure Universis Signer.
 
 ## Configuration
 
@@ -16,10 +16,96 @@ Configure [Universis api server](https://gitlab.com/universis/universis-api) to
 
     {
         "services": [
-            ...,
             {
                 "serviceType": "@universis/signer-worker#SignerWorker"
             }
         ]
-    ...
     }
+
+or configure  [Universis api server](https://gitlab.com/universis/universis-api) to use `SignerService` service.
+
+    {
+        "services": [
+            {
+                "serviceType": "@universis/signer-worker#SignerService"
+            }
+        ]
+    }
+
+# Sign documents
+
+> `SignerService.signFile(context: DataContext, file: string, contentType?: string, options?: { timestampServer?: string, position?: string, reason?: string })`
+
+`SignerService.signFile` can be used for signing *.pdf files using a server instance of [Universis Signer](https://gitlab.com/universis/universis-signer#use-docker-image)
+
+For completing sign process, the signer service instance should be configured by adding `settings/universis/signerService` section at application configuration
+
+```json
+
+{
+  "settings": {
+    "universis": {
+      "signerService": {
+        "user": "user",
+        "password": "password",
+        "host": "http://localhost:2465"
+      }
+    }
+  }
+}
+
+```
+
+where `host` is the URL of the Universis Signer service, `user` and `password` are the credentials for the Universis Signer service.
+
+Normally, the Universis Signer service which is running on `http://localhost:2465`, uses a PKCS12 store with secret key and certificate for signing.
+In this case, the `user` and `password` are used to access the PKCS12 store. `SignerService` service will try to get valid certificates, 
+and select the first one that is valid for signing. Use the configuration setting `thumbnail` if you want to explicitly define 
+the certificate that should be used for signing.
+
+```json
+{
+  "settings": {
+    "universis": {
+      "signerService": {
+        "user": "user",
+        "password": "password",
+        "host": "http://localhost:2465",
+        "thumbnail": "2d49be3b03db5d176482640549d5aaede84c925d"
+      }
+    }
+  }
+}
+``` 
+
+# Sign data
+
+> `SignerService.sign(context: DataContext, data: unknown, options?: { timestampServer?: string, reason?: string })`
+
+`SignerService.sign` method can be used for signing data. 
+The data can be any JSON-serializable object, and the method will return a signed version of the data.
+
+The `options` parameter can include a `timestampServer` URL for timestamping the signature, a `position` string to specify the position of the signature in the document, 
+and a `reason` string to specify the reason for signing.
+
+# Example
+
+```typescript
+import {SignerService} from '@universis/signer-worker';
+
+function signJson(context: DataContext, data: unknown) {
+    const signerService = context.getApplication().getService(SignerService);
+    return signerService.sign(context, data, {
+        timestampServer: "http://timestamp.server.com",
+        reason: "Signing example data"
+    });
+}
+
+signJson(context, { message: "Hello, World!" })
+    .then(signedData => {
+        console.log("Signed data:", signedData);
+    })
+    .catch(error => {
+        console.error("Error signing data:", error);
+    });
+```

package/dist/SignerService.d.ts

@@ -0,0 +1,72 @@
+/// <reference types="node" />
+import { ApplicationBase, ApplicationService } from '@themost/common';
+import { ExpressDataContext } from '@themost/express';
+import { Certificate, JsonWebKey, VerifySignatureResult, SignJsonSignatureResult, SignerServiceImpl } from './SignerServiceImpl';
+import { TOTPOptions } from 'xotp';
+export declare class SignerService extends ApplicationService implements SignerServiceImpl {
+    protected options?: {
+        host?: string;
+        user?: string;
+        password?: string;
+        secret?: string;
+        thumbprint?: string;
+        inspector?: {
+            text?: string[];
+            textPosition: string;
+            width?: number;
+            height?: number;
+        };
+    };
+    constructor(app: ApplicationBase);
+    /**
+     * @param {ExpressDataContext} context The underlying data context
+     * @param {*} data The data to be verified
+     * @param {{filename: string, contentType: string}=} options Extra attributes (optional)
+     * @returns {Promise<VerifySignatureResult[]>}
+     */
+    verify(context: ExpressDataContext, data: unknown, options?: {
+        filename: string;
+        contentType: string;
+    }): Promise<VerifySignatureResult[]>;
+    getJwks(): Promise<JsonWebKey[]>;
+    getCerts(): Promise<Certificate[]>;
+    /**
+     * Generates a one-time password using the configured secret.
+     */
+    generateVerificationCode(options?: TOTPOptions): string;
+    /**
+     * @param {ExpressDataContext} context The underlying data context
+     * @param {*} data Any JSON object to be signed
+     * @param {{timestampServer?:string}} extraOptions
+     * @returns {Promise<SignJsonSignatureResult>} An array of signatures
+     */
+    sign(context: ExpressDataContext, data: unknown, extraOptions?: {
+        timestampServer?: string;
+        reason?: string;
+    }): Promise<SignJsonSignatureResult>;
+    signFile(context: ExpressDataContext, file: string, contentType?: string, extraOptions?: {
+        page?: number;
+        position?: number[];
+        timestampServer?: string;
+        reason?: string;
+    }): Promise<Buffer>;
+    verifyFile(context: ExpressDataContext, file: string, options?: {
+        filename: string;
+        contentType: string;
+    }): Promise<VerifySignatureResult[]>;
+    inspect(context: ExpressDataContext, file: string, options?: {
+        filename: string;
+        contentType: string;
+    }): Promise<{
+        page: number;
+        position: number[];
+        text: string;
+    }>;
+    requiresVerificationCode(): boolean;
+    protected signFinal<T>(context: ExpressDataContext, file: string, contentType?: string, extraOptions?: {
+        position?: number[];
+        page?: number;
+        timestampServer?: string;
+        reason?: string;
+    }): Promise<T>;
+}

package/dist/SignerServiceImpl.d.ts

@@ -0,0 +1,61 @@
+/// <reference types="node" />
+import { ExpressDataContext } from '@themost/express';
+export declare interface Certificate {
+    version: number;
+    subjectDN: string;
+    sigAlgName?: string;
+    sigAlgOID?: string;
+    issuerDN: string;
+    serialNumber: any;
+    notAfter: string;
+    notBefore: string;
+    expired: boolean;
+    thumbprint: string;
+    commonName: string;
+}
+export declare interface JsonWebKey {
+    kty: string;
+    use: string;
+    kid: string;
+    alg: string;
+    n: string;
+    e: string;
+}
+export declare interface VerifySignatureResult {
+    valid: boolean;
+    certificates: Certificate[];
+    signatureProperties?: {
+        signingDate: string;
+        reason: string;
+        signingCertificate: Certificate;
+    };
+}
+export declare interface SignJsonSignatureResult {
+    payload: string;
+    signatures: {
+        protected: string;
+        signature: string;
+    }[];
+}
+export declare interface SignerServiceImpl {
+    getCerts(): Promise<Certificate[]>;
+    getJwks(): Promise<JsonWebKey[]>;
+    verify(context: ExpressDataContext, document: string, options?: {
+        filename: string;
+        contentType: string;
+    }): Promise<VerifySignatureResult[]>;
+    verifyFile(context: ExpressDataContext, file: string, options?: {
+        filename: string;
+        contentType: string;
+    }): Promise<VerifySignatureResult[]>;
+    signFile(context: ExpressDataContext, file: string, contentType?: string, extraOptions?: {
+        page?: number;
+        position?: number[];
+        timestampServer?: string;
+        reason?: string;
+    }): Promise<Buffer>;
+    sign(context: ExpressDataContext, data: unknown, extraOptions?: {
+        timestampServer?: string;
+        reason?: string;
+    }): Promise<SignJsonSignatureResult>;
+}

package/dist/SignerWorker.d.ts

@@ -1,39 +1,20 @@
 import { ApplicationBase, ApplicationService } from '@themost/common';
 import { ExpressDataContext } from '@themost/express';
-declare interface Certificate {
-    version: number;
-    subjectDN: string;
-    sigAlgName?: string;
-    sigAlgOID?: string;
-    issuerDN: string;
-    serialNumber: any;
-    notAfter: string;
-    notBefore: string;
-    expired: boolean;
-    thumbprint: string;
-    commonName: string;
-}
-declare interface VerifySignatureResult {
-    valid: boolean;
-    certificates: Certificate[];
-    signatureProperties?: {
-        signingDate: string;
-        reason: string;
-        signingCertificate: Certificate;
-    };
-}
+import { VerifySignatureResult } from './SignerServiceImpl';
 export declare class SignerWorker extends ApplicationService {
+    protected options?: {
+        host?: string;
+    };
     constructor(app: ApplicationBase);
     /**
      *
      * @param {ExpressDataContext} context The underlying data context
      * @param {string} document The file path
      * @param {{filename: string, contentType: string}=} options Extra attributes (optional)
-     * @returns
+     * @returns Promise<VerifySignatureResult[]>
      */
     verify(context: ExpressDataContext, document: string, options?: {
         filename: string;
         contentType: string;
     }): Promise<VerifySignatureResult[]>;
 }
-export {};

package/dist/index.d.ts

@@ -1,2 +1,4 @@
 export * from './SignerWorker';
+export * from './SignerServiceImpl';
 export * from './signerWorkerRouter';
+export * from './SignerService';

package/dist/index.esm.js

@@ -1,8 +1,16 @@
-import { HttpMethodNotAllowedError, ApplicationService, HttpError } from '@themost/common';
+import { HttpMethodNotAllowedError, ApplicationService, HttpError, TraceUtils } from '@themost/common';
 import express from 'express';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 import { serviceRouter } from '@themost/express';
 import request from 'superagent';
+import { URL } from 'url';
+import path from 'path';
+import { writeFile as writeFile$1, unlink as unlink$1 } from 'fs';
+import { promisify } from 'util';
+import crypto from 'crypto';
+import os from 'os';
+import { DataCacheStrategy } from '@themost/data';
+import { Secret, TOTP } from 'xotp';
 
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
@@ -29,16 +37,17 @@ function __awaiter(thisArg, _arguments, P, generator) {
     });
 }
 
-function signerWorkerRouter() {
+function signerWorkerRouter(target = 'http://localhost:2465/') {
     const router = express.Router();
     router.use('/sign', (req, res, next) => {
         return next(new HttpMethodNotAllowedError('This method is not supported when using remote services.'));
     });
     router.use(createProxyMiddleware({
-        target: 'http://localhost:2465/',
+        target,
         pathRewrite: {
             '^/api/signer': ''
         },
+        logLevel: 'warn',
         changeOrigin: true
     }));
     return router;
@@ -75,6 +84,10 @@ class ScopeAccessConfiguration {
 class SignerWorker extends ApplicationService {
     constructor(app) {
         super(app);
+        // get configuration
+        this.options = Object.assign({
+            host: 'http://localhost:2465/'
+        }, app.getConfiguration().getSourceAt('settings/universis/signerWorker'));
         const thisApp = app;
         if (thisApp && thisApp.container) {
             thisApp.container.subscribe((container) => {
@@ -85,7 +98,7 @@ class SignerWorker extends ApplicationService {
                         scopeAccess.elements.push.apply(scopeAccess.elements, SignerScopeAccess);
                     }
                     // use signer worker router (for authenticated users)
-                    serviceRouter.use('/signer/', signerWorkerRouter());
+                    serviceRouter.use('/signer/', signerWorkerRouter(this.options.host));
                 }
             });
         }
@@ -95,19 +108,336 @@ class SignerWorker extends ApplicationService {
      * @param {ExpressDataContext} context The underlying data context
      * @param {string} document The file path
      * @param {{filename: string, contentType: string}=} options Extra attributes (optional)
-     * @returns
+     * @returns Promise<VerifySignatureResult[]>
      */
     verify(context, document, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const response = yield request.post('http://localhost:2465/verify')
-                .attach('file', document, options);
-            if (response.ok) {
-                return response.body;
+            try {
+                const response = yield request.post(new URL('/verify', this.options.host).toString())
+                    .attach('file', document, options);
+                if (response.ok) {
+                    return response.body;
+                }
+                // noinspection ExceptionCaughtLocallyJS
+                throw new HttpError(response.statusCode);
+            }
+            catch (err) {
+                if (err.response) {
+                    TraceUtils.error(err);
+                    throw new HttpError(err.response.status);
+                }
+                throw err;
+            }
+        });
+    }
+}
+
+const writeFile = promisify(writeFile$1);
+const unlink = promisify(unlink$1);
+function tmpFile(extension = '.tmp') {
+    const tmpDir = os.tmpdir();
+    const filename = `file-${crypto.randomBytes(16).toString('hex')}${extension}`;
+    return path.join(tmpDir, filename);
+}
+class SignerService extends ApplicationService {
+    constructor(app) {
+        super(app);
+        // get signer worker configuration
+        const options = app.getConfiguration().getSourceAt('settings/universis/signerService') || {};
+        this.options = Object.assign({}, {
+            'host': 'http://localhost:2465/'
+        }, options);
+        const thisApp = app;
+        if (thisApp && thisApp.container) {
+            thisApp.container.subscribe((container) => {
+                if (container) {
+                    container.get('/api/signer/.well-known/jwks', (_req, res, next) => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            const results = yield this.getJwks();
+                            return res.json(results);
+                        }
+                        catch (err) {
+                            return next(err);
+                        }
+                    }));
+                    container.get('/api/signer/.well-known/certs', (_req, res, next) => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            const results = yield this.getCerts();
+                            return res.json(results);
+                        }
+                        catch (err) {
+                            return next(err);
+                        }
+                    }));
+                }
+            });
+        }
+    }
+    /**
+     * @param {ExpressDataContext} context The underlying data context
+     * @param {*} data The data to be verified
+     * @param {{filename: string, contentType: string}=} options Extra attributes (optional)
+     * @returns {Promise<VerifySignatureResult[]>}
+     */
+    verify(context, data, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (data == null) {
+                throw new Error('The given data cannot be empty during sign.');
+            }
+            const json = (typeof data === 'object') ? JSON.stringify(data) : JSON.stringify({
+                value: data,
+            });
+            const file = tmpFile('.json');
+            // write data to temporary file
+            yield writeFile(file, json, { encoding: 'utf8' });
+            try {
+                return yield this.verifyFile(context, file, options);
+            }
+            catch (err) {
+                throw err;
+            }
+            finally {
+                try {
+                    yield unlink(file); // remove temporary file
+                }
+                catch (e) {
+                    // ignore error
+                }
+            }
+        });
+    }
+    getJwks() {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const cache = this.getApplication().getConfiguration().getStrategy(DataCacheStrategy);
+                // check if cache is available
+                return cache.getOrDefault('/api/signer/keystore/jwks', () => __awaiter(this, void 0, void 0, function* () {
+                    try {
+                        const response = yield request
+                            .get(new URL('/keystore/jwks', this.options.host).toString())
+                            .auth(this.options.user, this.options.password);
+                        if (response.ok) {
+                            return response.body;
+                        }
+                        // noinspection ExceptionCaughtLocallyJS
+                        throw new HttpError(response.status, 'Something went wrong while getting json web key set');
+                    }
+                    catch (err) {
+                        TraceUtils.error(err);
+                        throw new HttpError(err.status, 'Failed to get json web key set', err.message);
+                    }
+                }));
+            }
+            catch (err) {
+                throw new HttpError(err.status, 'Failed to get json web key set', err.message);
+            }
+        });
+    }
+    getCerts() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cache = this.getApplication().getConfiguration().getStrategy(DataCacheStrategy);
+            return cache.getOrDefault('/api/signer/keystore/certs', () => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const response = yield request.get(new URL('/keystore/certs', this.options.host).toString())
+                        .auth(this.options.user, this.options.password);
+                    if (response.ok) {
+                        return response.body.filter((item) => {
+                            return item.notAfter && new Date(item.notAfter) > new Date();
+                        });
+                    }
+                    return [];
+                }
+                catch (err) {
+                    TraceUtils.error(err);
+                    throw new HttpError(err.status, 'Failed to get certificates', err.message);
+                }
+            }));
+        });
+    }
+    /**
+     * Generates a one-time password using the configured secret.
+     */
+    generateVerificationCode(options) {
+        if (this.options.secret == null) {
+            throw new Error('One-time password is not supported');
+        }
+        const secret = Secret.from(this.options.secret, 'base32');
+        const opts = Object.assign({
+            algorithm: 'sha1',
+            digits: 6,
+            period: 30,
+        }, options);
+        const totp = new TOTP(opts);
+        return totp.generate({ secret });
+    }
+    /**
+     * @param {ExpressDataContext} context The underlying data context
+     * @param {*} data Any JSON object to be signed
+     * @param {{timestampServer?:string}} extraOptions
+     * @returns {Promise<SignJsonSignatureResult>} An array of signatures
+     */
+    sign(context, data, extraOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (data == null) {
+                throw new Error('The given data cannot be empty during sign.');
+            }
+            const json = (typeof data === 'object') ? JSON.stringify(data) : JSON.stringify({
+                value: data,
+            });
+            const file = tmpFile('.json');
+            // write data to temporary file
+            yield writeFile(file, json, { encoding: 'utf8' });
+            try {
+                return yield this.signFinal(context, file, 'application/json', extraOptions);
+            }
+            catch (err) {
+                if (err.response) {
+                    throw new HttpError(err.status, 'Failed to sign data', err.message);
+                }
+                throw err;
+            }
+            finally {
+                try {
+                    yield unlink(file); // remove temporary file
+                }
+                catch (e) {
+                    // ignore error
+                }
+            }
+        });
+    }
+    signFile(context, file, contentType, extraOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.signFinal(context, file, contentType, extraOptions);
+        });
+    }
+    verifyFile(context, file, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const response = yield request.post(new URL('/verify', this.options.host).toString())
+                    .attach('file', file, options);
+                if (response.ok) {
+                    return response.body;
+                }
+                // noinspection ExceptionCaughtLocallyJS
+                throw new HttpError(response.statusCode);
+            }
+            catch (err) {
+                if (err.response) {
+                    TraceUtils.error(err);
+                    throw new HttpError(err.response.status, 'Failed to verify data', err.message);
+                }
+                throw err;
+            }
+        });
+    }
+    inspect(context, file, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const fields = {};
+                if (this.options.inspector) {
+                    Object.assign(fields, this.options.inspector);
+                }
+                const response = yield request.post(new URL('/signature/inspect', this.options.host).toString())
+                    .field(fields)
+                    .attach('file', file, options);
+                if (response.ok) {
+                    return response.body;
+                }
+                // noinspection ExceptionCaughtLocallyJS
+                throw new HttpError(response.statusCode);
+            }
+            catch (err) {
+                if (err.response) {
+                    TraceUtils.error(err);
+                    throw new HttpError(err.response.status, 'Failed to verify data', err.message);
+                }
+                throw err;
+            }
+        });
+    }
+    requiresVerificationCode() {
+        return typeof this.options.secret === 'string' && this.options.secret.length > 0;
+    }
+    signFinal(context, file, contentType, extraOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // try to find thumbprint if empty
+            if (typeof this.options.thumbprint === 'undefined') {
+                const [cert] = yield this.getCerts();
+                if (cert) {
+                    this.options.thumbprint = cert.thumbprint;
+                }
+                else {
+                    this.options.thumbprint = '';
+                }
+            }
+            const fields = Object.assign({}, extraOptions);
+            // if the file is a PDF or the content type is application/pdf, try to inspect signature position
+            if (path.extname(file) === '.pdf' || contentType === 'application/pdf') {
+                if ((extraOptions === null || extraOptions === void 0 ? void 0 : extraOptions.page) && (extraOptions === null || extraOptions === void 0 ? void 0 : extraOptions.position)) {
+                    // if page and position are defined, use them
+                    Object.assign(fields, {
+                        page: extraOptions.page,
+                        position: extraOptions.position.map((element) => {
+                            return Math.round(element);
+                        }).join(',')
+                    });
+                }
+                else if (this.options.inspector) {
+                    // if inspector is defined, use it
+                    const inspectorResult = yield this.inspect(context, file);
+                    if ((inspectorResult === null || inspectorResult === void 0 ? void 0 : inspectorResult.page) && (inspectorResult === null || inspectorResult === void 0 ? void 0 : inspectorResult.position)) {
+                        Object.assign(fields, {
+                            page: inspectorResult.page,
+                            position: inspectorResult.position.map((element) => {
+                                return Math.round(element);
+                            }).join(',')
+                        });
+                    }
+                }
+            }
+            if (this.options.thumbprint.length) {
+                Object.assign(fields, {
+                    thumbprint: this.options.thumbprint,
+                });
+            }
+            const fileOptions = {
+                filename: path.basename(file)
+            };
+            if (contentType) {
+                Object.assign(fileOptions, {
+                    contentType
+                });
+            }
+            try {
+                // if secret is defined, generate one-time password
+                if (this.requiresVerificationCode()) {
+                    Object.assign(fields, {
+                        otp: this.generateVerificationCode()
+                    });
+                }
+                const response = yield request.post(new URL('/sign', this.options.host).toString())
+                    .type('form')
+                    .auth(this.options.user, this.options.password)
+                    .field(fields)
+                    .buffer(contentType !== 'application/json')
+                    .attach('file', file, fileOptions);
+                if (response.ok) {
+                    return response.body;
+                }
+                // noinspection ExceptionCaughtLocallyJS
+                throw new HttpError(response.status);
+            }
+            catch (err) {
+                if (err.response) {
+                    TraceUtils.error(err);
+                    throw new HttpError(err.response.status, 'Failed to sign data', err.message);
+                }
+                throw err;
             }
-            throw new HttpError(response.statusCode);
         });
     }
 }
 
-export { SignerWorker, signerWorkerRouter };
+export { SignerService, SignerWorker, signerWorkerRouter };
 //# sourceMappingURL=index.esm.js.map