@universis/signer-worker 1.1.0 → 1.6.0

package/src/RemoteSignerWorker.ts

@@ -0,0 +1,34 @@
+import { ApplicationBase } from '@themost/common';
+import { SignerWorker, ApplicationBaseWithContainer } from './SignerWorker';
+import { Application } from 'express';
+import { remoteSignerWorkerRouter } from './remoteSignerWorkerRouter';
+
+class ScopeAccessConfiguration {
+    public elements = [];
+}
+
+class RemoteSignerWorker extends SignerWorker {
+
+    constructor(app: ApplicationBase) {
+        super(app);
+    }
+
+    install(): void {
+        // get configuration
+        this.options = Object.assign({
+            host: 'http://localhost:8480/'
+        }, this.getApplication().getConfiguration().getSourceAt('settings/universis/remoteSignerWorker'));
+        const thisApp = this.getApplication() as ApplicationBaseWithContainer;
+        if (thisApp && thisApp.container) {
+            thisApp.container.subscribe((container: Application) => {
+                if (container) {
+                    // use signer worker router (for authenticated users)
+                    container.use('/services/remoteSigner/', remoteSignerWorkerRouter(this.options.host));
+                }
+            });
+        }
+    }
+
+}
+
+export { RemoteSignerWorker };

package/src/SignerService.ts

@@ -0,0 +1,339 @@
+import { ApplicationBase, ApplicationService, HttpError, TraceUtils } from '@themost/common';
+import { BehaviorSubject } from 'rxjs';
+import { Application } from 'express';
+import { ExpressDataContext } from '@themost/express';
+import request from 'superagent';
+import { URL } from 'url';
+import path from 'path';
+import { writeFile as writeFileWithCallback, unlink as unlinkWithCallback } from 'fs';
+import { promisify } from 'util';
+import crypto from 'crypto';
+import os from 'os';
+import { DataCacheStrategy } from '@themost/data';
+import { Certificate, JsonWebKey, VerifySignatureResult, SignJsonSignatureResult, SignerServiceImpl } from './SignerServiceImpl';
+import {Secret, TOTP, TOTPOptions} from 'xotp';
+
+const writeFile = promisify(writeFileWithCallback);
+const unlink = promisify(unlinkWithCallback);
+declare interface ApplicationBaseWithContainer extends ApplicationBase {
+    container?: BehaviorSubject<Application>;
+}
+
+function tmpFile(extension: string = '.tmp'): string {
+    const tmpDir = os.tmpdir();
+    const filename = `file-${crypto.randomBytes(16).toString('hex')}${extension}`;
+    return path.join(tmpDir, filename);
+}
+
+
+export class SignerService extends ApplicationService implements SignerServiceImpl {
+
+    protected options?: {
+        host?: string;
+        user?: string;
+        password?: string;
+        secret?: string;
+        thumbprint?: string;
+        inspector?: {
+            text?: string[];
+            textPosition: string;
+            width?: number;
+            height?: number;
+        }
+    }
+
+    constructor(app: ApplicationBase) {
+        super(app);
+
+        // get signer worker configuration
+        const options = app.getConfiguration().getSourceAt('settings/universis/signerService') || {};
+
+        this.options = Object.assign({}, {
+            'host': 'http://localhost:2465/'
+        }, options);
+
+        const thisApp = app as ApplicationBaseWithContainer;
+        if (thisApp && thisApp.container) {
+            thisApp.container.subscribe((container: Application) => {
+                if (container) {
+                    container.get('/api/signer/.well-known/jwks', async (_req: any, res: any, next: any) => {
+                        try {
+                            const results = await this.getJwks();
+                            return res.json(results);
+                        } catch (err) {
+                            return next(err);
+                        }
+                    });
+                    container.get('/api/signer/.well-known/certs', async (_req: any, res: any, next: any) => {
+                        try {
+                            const results = await this.getCerts();
+                            return res.json(results);
+                        } catch (err) {
+                            return next(err);
+                        }
+                    });
+                }
+            });
+        }
+    }
+
+    /**
+     * @param {ExpressDataContext} context The underlying data context
+     * @param {*} data The data to be verified
+     * @param {{filename: string, contentType: string}=} options Extra attributes (optional)
+     * @returns {Promise<VerifySignatureResult[]>}
+     */
+    async verify(context: ExpressDataContext, data: unknown, options?: { filename: string; contentType: string }): Promise<VerifySignatureResult[]> {
+        if (data == null) {
+            throw new Error('The given data cannot be empty during sign.');
+        }
+        const json = (typeof data === 'object') ? JSON.stringify(data) : JSON.stringify({
+            value: data,
+        });
+        const file = tmpFile('.json');
+        // write data to temporary file
+        await writeFile(file, json, { encoding: 'utf8' });
+        try {
+            return await this.verifyFile(context, file, options);
+        } catch (err) {
+            throw err;
+        } finally {
+            try {
+                await unlink(file); // remove temporary file
+            } catch (e) {
+                // ignore error
+            }
+        }
+    }
+
+    public async getJwks(): Promise<JsonWebKey[]> {
+        try {
+            const cache = this.getApplication().getConfiguration().getStrategy(DataCacheStrategy);
+            // check if cache is available
+            return cache.getOrDefault('/api/signer/keystore/jwks', async () => {
+                try {
+                    const response = await request
+                        .get(new URL('/keystore/jwks', this.options.host).toString())
+                        .auth(this.options.user, this.options.password);
+                    if (response.ok) {
+                        return response.body;
+                    }
+                    // noinspection ExceptionCaughtLocallyJS
+                    throw new HttpError(response.status, 'Something went wrong while getting json web key set');
+                } catch (err) {
+                    TraceUtils.error(err);
+                    throw new HttpError(err.status, 'Failed to get json web key set', err.message);
+                }
+            });
+        } catch (err) {
+            throw new HttpError(err.status, 'Failed to get json web key set', err.message);
+        }
+    }
+
+    public async getCerts(): Promise<Certificate[]> {
+        const cache = this.getApplication().getConfiguration().getStrategy(DataCacheStrategy);
+        return cache.getOrDefault('/api/signer/keystore/certs', async () => {
+            try {
+                const response = await request.get(new URL('/keystore/certs', this.options.host).toString())
+                    .auth(this.options.user, this.options.password);
+                if (response.ok) {
+                    return (response.body as Certificate[]).filter((item) => {
+                        return item.notAfter && new Date(item.notAfter) > new Date();
+                    });
+                }
+                return [];
+            } catch (err) {
+                TraceUtils.error(err);
+                throw new HttpError(err.status, 'Failed to get certificates', err.message);
+            }
+        });
+    }
+
+    /**
+     * Generates a one-time password using the configured secret.
+     */
+    public generateVerificationCode(options?: TOTPOptions): string {
+        if (this.options.secret == null) {
+            throw new Error('One-time password is not supported');
+        }
+        const secret = Secret.from(this.options.secret, 'base32');
+        const opts: TOTPOptions = Object.assign({
+            algorithm: 'sha1',
+            digits: 6,
+            period: 30,
+        }, options);
+        const totp = new TOTP(opts);
+        return totp.generate({ secret });
+    }
+
+    /**
+     * @param {ExpressDataContext} context The underlying data context
+     * @param {*} data Any JSON object to be signed
+     * @param {{timestampServer?:string}} extraOptions
+     * @returns {Promise<SignJsonSignatureResult>} An array of signatures
+     */
+    async sign(context: ExpressDataContext, data: unknown, extraOptions?: {
+        timestampServer?: string,
+        reason?: string
+    }): Promise<SignJsonSignatureResult> {
+        if (data == null) {
+            throw new Error('The given data cannot be empty during sign.');
+        }
+        const json = (typeof data === 'object') ? JSON.stringify(data) : JSON.stringify({
+            value: data,
+        });
+        const file = tmpFile('.json');
+        // write data to temporary file
+        await writeFile(file, json, { encoding: 'utf8' });
+        try {
+            return await this.signFinal<SignJsonSignatureResult>(context, file,  'application/json', extraOptions);
+        } catch(err) {
+            if (err.response) {
+                throw new HttpError(err.status, 'Failed to sign data', err.message);
+            }
+            throw err;
+        } finally {
+            try {
+                await unlink(file); // remove temporary file
+            } catch (e) {
+                // ignore error
+            }
+        }
+    }
+
+    public async signFile(context: ExpressDataContext, file: string, contentType?: string, extraOptions?: {
+        page?: number,
+        position?: number[],
+        timestampServer?: string,
+        reason?: string
+    }): Promise<Buffer> {
+        return this.signFinal<Buffer>(context, file, contentType, extraOptions);
+    }
+
+    public async verifyFile(context: ExpressDataContext, file: string, options?: { filename: string; contentType: string }): Promise<VerifySignatureResult[]> {
+        try {
+            const response = await request.post(new URL('/verify', this.options.host).toString())
+                .attach('file',file, options);
+            if (response.ok) {
+                return response.body;
+            }
+            // noinspection ExceptionCaughtLocallyJS
+            throw new HttpError(response.statusCode);
+        } catch (err) {
+            if (err.response) {
+                TraceUtils.error(err);
+                throw new HttpError(err.response.status, 'Failed to verify data', err.message);
+            }
+            throw err;
+        }
+    }
+
+    public async inspect(context: ExpressDataContext, file: string, options?: { filename: string; contentType: string }): Promise<{ page: number, position: number[], text: string }> {
+        try {
+            const fields: Record<string, string> = {};
+            if (this.options.inspector) {
+                Object.assign(fields, this.options.inspector);
+            }
+            const response = await request.post(new URL('/signature/inspect', this.options.host).toString())
+                .field(fields)
+                .attach('file',file, options);
+            if (response.ok) {
+                return response.body;
+            }
+            // noinspection ExceptionCaughtLocallyJS
+            throw new HttpError(response.statusCode);
+        } catch (err) {
+            if (err.response) {
+                TraceUtils.error(err);
+                throw new HttpError(err.response.status, 'Failed to verify data', err.message);
+            }
+            throw err;
+        }
+    }
+
+    public requiresVerificationCode(): boolean {
+        return typeof this.options.secret === 'string' && this.options.secret.length > 0;
+    }
+
+    protected async signFinal<T>(context: ExpressDataContext, file: string, contentType?: string, extraOptions?: {
+        position?: number[],
+        page?: number,
+        timestampServer?: string,
+        reason?: string
+    }): Promise<T> {
+        // try to find thumbprint if empty
+        if (typeof this.options.thumbprint === 'undefined') {
+            const [cert] = await this.getCerts();
+            if (cert) {
+                this.options.thumbprint = cert.thumbprint;
+            } else {
+                this.options.thumbprint = '';
+            }
+        }
+        const fields = Object.assign({}, extraOptions);
+        // if the file is a PDF or the content type is application/pdf, try to inspect signature position
+        if (path.extname(file) === '.pdf' || contentType === 'application/pdf' ) {
+            if (extraOptions?.page && extraOptions?.position) {
+                // if page and position are defined, use them
+                Object.assign(fields, {
+                    page: extraOptions.page,
+                    position: extraOptions.position.map((element) => {
+                        return Math.round(element);
+                    }).join(',')
+                });
+            } else if (this.options.inspector) {
+                // if inspector is defined, use it
+                const inspectorResult = await this.inspect(context, file);
+                if (inspectorResult?.page && inspectorResult?.position) {
+                    Object.assign(fields, {
+                        page: inspectorResult.page,
+                        position: inspectorResult.position.map((element) => {
+                            return Math.round(element);
+                        }).join(',')
+                    })
+                }
+            }
+        }
+
+        if (this.options.thumbprint.length) {
+            Object.assign(fields, {
+                thumbprint: this.options.thumbprint,
+            });
+        }
+        const fileOptions = {
+            filename: path.basename(file)
+        };
+        if (contentType) {
+            Object.assign(fileOptions, {
+                contentType
+            });
+        }
+        try {
+            // if secret is defined, generate one-time password
+            if (this.requiresVerificationCode()) {
+                Object.assign(fields, {
+                    otp: this.generateVerificationCode()
+                });
+            }
+            const response = await request.post(new URL('/sign', this.options.host).toString())
+                .type('form')
+                .auth(this.options.user, this.options.password)
+                .field(fields)
+                .buffer(contentType !== 'application/json')
+                .attach('file',file, fileOptions);
+            if (response.ok) {
+                return response.body as T;
+            }
+            // noinspection ExceptionCaughtLocallyJS
+            throw new HttpError(response.status);
+        } catch (err) {
+            if (err.response) {
+                TraceUtils.error(err);
+                throw new HttpError(err.response.status, 'Failed to sign data', err.message);
+            }
+            throw err;
+        }
+
+    }
+
+}

package/src/SignerServiceImpl.ts

@@ -0,0 +1,58 @@
+import { ExpressDataContext } from '@themost/express';
+
+
+export declare interface Certificate {
+    version: number;
+    subjectDN: string;
+    sigAlgName?: string;
+    sigAlgOID?: string;
+    issuerDN: string;
+    serialNumber: any;
+    notAfter: string;
+    notBefore: string;
+    expired: boolean;
+    thumbprint: string;
+    commonName: string;
+}
+
+export declare interface JsonWebKey {
+    kty: string;
+    use: string;
+    kid: string;
+    alg: string;
+    n: string;
+    e: string
+}
+
+export declare interface VerifySignatureResult {
+    valid: boolean;
+    certificates: Certificate[];
+    signatureProperties?: {
+        signingDate: string;
+        reason: string;
+        signingCertificate: Certificate
+    };
+}
+
+export declare interface SignJsonSignatureResult {
+    payload: string;
+    signatures: { protected: string; signature: string }[];
+}
+
+export declare interface SignerServiceImpl {
+    getCerts(): Promise<Certificate[]>;
+    getJwks(): Promise<JsonWebKey[]>;
+    verify(context: ExpressDataContext, document: string, options?: { filename: string; contentType: string }): Promise<VerifySignatureResult[]>
+    verifyFile(context: ExpressDataContext, file: string, options?: { filename: string; contentType: string }): Promise<VerifySignatureResult[]>
+    signFile(context: ExpressDataContext, file: string, contentType?: string, extraOptions?: {
+        page?: number
+        position?: number[],
+        timestampServer?: string,
+        reason?: string
+    }): Promise<Buffer>;
+    sign(context: ExpressDataContext, data: unknown, extraOptions?: {
+        timestampServer?: string,
+        reason?: string
+    }): Promise<SignJsonSignatureResult>;
+    
+}

package/src/SignerWorker.ts

@@ -1,80 +1,17 @@
-import { ApplicationBase, ApplicationService, HttpError, HttpForbiddenError } from '@themost/common';
+import {ApplicationBase, ApplicationService, HttpError, HttpForbiddenError, TraceUtils} from '@themost/common';
 import { BehaviorSubject } from 'rxjs';
-import { Application, RequestHandler, Router } from 'express';
+import { Application, RequestHandler } from 'express';
 import { signerWorkerRouter } from './signerWorkerRouter';
 import { SignerScopeAccess } from './SignerScopeAccess';
 import { ExpressDataContext, serviceRouter } from '@themost/express';
 import request from 'superagent';
-import path from 'path';
+import { VerifySignatureResult } from './SignerServiceImpl';
+import {URL} from 'url';
 
-declare interface ApplicationBaseWithContainer extends ApplicationBase {
+export declare interface ApplicationBaseWithContainer extends ApplicationBase {
     container?: BehaviorSubject<Application>;
 }
 
-declare interface Certificate {
-    version: number;
-    subjectDN: string;
-    sigAlgName?: string;
-    sigAlgOID?: string;
-    issuerDN: string;
-    serialNumber: any;
-    notAfter: string;
-    notBefore: string;
-    expired: boolean;
-    thumbprint: string;
-    commonName: string;
-  }
-  
-
-declare interface VerifySignatureResult {
-    valid: boolean;
-    certificates: Certificate[];
-    signatureProperties?: {
-      signingDate: string;
-      reason: string;
-      signingCertificate: Certificate
-    };
-  }
-  
-
-function insertRouterAfter(parent: Router, after: any, insert: any) {
-    const afterIndex = parent.stack.findIndex( (item) => {
-        return item === after;
-    });
-    if (afterIndex < 0) {
-        throw new Error('Target router cannot be found in parent stack.');
-    }
-    const findIndex = parent.stack.findIndex( (item) => {
-        return item === insert;
-    });
-    if (findIndex < 0) {
-        throw new Error('Router to be inserted cannot be found in parent stack.');
-    }
-    // remove last router
-    parent.stack.splice(findIndex, 1);
-    // move up
-    parent.stack.splice(afterIndex + 1, 0, insert);
-}
-
-function insertRouterBefore(parent: Router, before: any, insert: any) {
-    const beforeIndex = parent.stack.findIndex( (item) => {
-        return item === before;
-    });
-    if (beforeIndex < 0) {
-        throw new Error('Target router cannot be found in parent stack.');
-    }
-    const findIndex = parent.stack.findIndex( (item) => {
-        return item === insert;
-    });
-    if (findIndex < 0) {
-        throw new Error('Router to be inserted cannot be found in parent stack.');
-    }
-    // remove last router
-    parent.stack.splice(findIndex, 1);
-    // move up
-    parent.stack.splice(beforeIndex, 0, insert);
-}
-
 class ScopeAccessConfiguration {
     public elements = [];
 }
@@ -84,7 +21,7 @@ class ScopeAccessConfiguration {
  * @returns {Function}
  */
  function validateScope(): RequestHandler {
-    return (req: any, res: any, next: any) => {
+    return (req: any, _res: any, next: any) => {
         const scopeAccessConfiguration = req.context.getApplication().getConfiguration().getStrategy(ScopeAccessConfiguration);
         if (scopeAccessConfiguration == null) {
             return next();
@@ -101,38 +38,61 @@ class ScopeAccessConfiguration {
 }
 
 export class SignerWorker extends ApplicationService {
+
+    protected options?: {
+        host?: string;
+    }
+
     constructor(app: ApplicationBase) {
         super(app);
-        const thisApp = app as ApplicationBaseWithContainer;
+        this.install();
+    }
+
+    install(): void {
+        // get configuration
+        this.options = Object.assign({
+            host: 'http://localhost:2465/'
+        }, this.getApplication().getConfiguration().getSourceAt('settings/universis/signerWorker'));
+        const thisApp = this.getApplication() as ApplicationBaseWithContainer;
         if (thisApp && thisApp.container) {
             thisApp.container.subscribe((container: Application) => {
                 if (container) {
                     // add scope access
-                    const scopeAccess = app.getConfiguration().getStrategy(ScopeAccessConfiguration);
+                    const scopeAccess = thisApp.getConfiguration().getStrategy(ScopeAccessConfiguration);
                     if (scopeAccess) {
                         scopeAccess.elements.push.apply(scopeAccess.elements, SignerScopeAccess);
                     }
                     // use signer worker router (for authenticated users)
-                    serviceRouter.use('/signer/', signerWorkerRouter());
+                    serviceRouter.use('/signer/', signerWorkerRouter(this.options.host));
                 }
             });
         }
     }
 
     /**
-     * 
+     *
      * @param {ExpressDataContext} context The underlying data context
      * @param {string} document The file path
      * @param {{filename: string, contentType: string}=} options Extra attributes (optional)
-     * @returns 
+     * @returns Promise<VerifySignatureResult[]>
      */
     async verify(context: ExpressDataContext, document: string, options?: { filename: string; contentType: string }): Promise<VerifySignatureResult[]> {
-        const response = await request.post('http://localhost:2465/verify')
-            .attach('file',document, options);
-        if (response.ok) {
-            return response.body;
+        try {
+            const response = await request.post(new URL('/verify', this.options.host).toString())
+                .attach('file',document, options);
+            if (response.ok) {
+                return response.body;
+            }
+            // noinspection ExceptionCaughtLocallyJS
+            throw new HttpError(response.statusCode);
+        } catch (err) {
+            if (err.response) {
+                TraceUtils.error(err);
+                throw new HttpError(err.response.status);
+            }
+            throw err;
         }
-        throw new HttpError(response.statusCode);
+
     }
 
 }

package/src/index.ts

@@ -1,2 +1,6 @@
 export * from './SignerWorker';
-export * from './signerWorkerRouter';
+export * from './SignerServiceImpl';
+export * from './signerWorkerRouter';
+export * from './SignerService';
+export * from './RemoteSignerWorker';
+export * from './remoteSignerWorkerRouter';

package/src/remoteSignerWorkerRouter.ts

@@ -0,0 +1,16 @@
+import { HttpMethodNotAllowedError } from '@themost/common';
+import express from 'express';
+import { createProxyMiddleware } from 'http-proxy-middleware';
+
+export function remoteSignerWorkerRouter(target: string = 'http://localhost:8480/') {
+    const router = express.Router();
+    router.use(createProxyMiddleware({
+        target,
+        pathRewrite: {
+            '^/services/remoteSigner' : ''
+        },
+        logLevel: 'warn',
+        changeOrigin: true
+    }));
+    return router;
+}

package/src/signerWorkerRouter.ts

@@ -2,16 +2,17 @@ import { HttpMethodNotAllowedError } from '@themost/common';
 import express from 'express';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 
-export function signerWorkerRouter() {
+export function signerWorkerRouter(target: string = 'http://localhost:2465/') {
     const router = express.Router();
     router.use('/sign', (req, res, next) => {
         return next(new HttpMethodNotAllowedError('This method is not supported when using remote services.'))
     });
     router.use(createProxyMiddleware({
-        target: 'http://localhost:2465/',
+        target,
         pathRewrite: {
             '^/api/signer' : ''
         },
+        logLevel: 'warn',
         changeOrigin: true
     }));
     return router;