edockit 0.2.1 → 0.2.3

package/dist/index.esm.js

@@ -107,9 +107,16 @@ function createXMLParser() {
 function queryByXPath(parent, xpathExpression, namespaces = NAMESPACES) {
     try {
         // Browser environment with native XPath
-        if (typeof document !== "undefined" && document.evaluate) {
+        if (typeof document !== "undefined" && typeof document.evaluate === "function") {
+            // Use the document that owns the parent node, not the global document
+            const ownerDoc = "ownerDocument" in parent ? parent.ownerDocument : parent;
+            if (!ownerDoc || typeof ownerDoc.evaluate !== "function") {
+                // XMLDocuments from DOMParser don't have evaluate - silently return null
+                // (caller should use DOM traversal fallback)
+                return null;
+            }
             const nsResolver = createNsResolverForBrowser(namespaces);
-            const result = document.evaluate(xpathExpression, parent, nsResolver, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+            const result = ownerDoc.evaluate(xpathExpression, parent, nsResolver, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
             return result.singleNodeValue;
         }
         // Node.js environment with xpath module
@@ -157,9 +164,16 @@ function queryByXPath(parent, xpathExpression, namespaces = NAMESPACES) {
 function queryAllByXPath(parent, xpathExpression, namespaces = NAMESPACES) {
     try {
         // Browser environment with native XPath
-        if (typeof document !== "undefined" && document.evaluate) {
+        if (typeof document !== "undefined" && typeof document.evaluate === "function") {
+            // Use the document that owns the parent node, not the global document
+            const ownerDoc = "ownerDocument" in parent ? parent.ownerDocument : parent;
+            if (!ownerDoc || typeof ownerDoc.evaluate !== "function") {
+                // XMLDocuments from DOMParser don't have evaluate - silently return empty
+                // (caller should use DOM traversal fallback)
+                return [];
+            }
             const nsResolver = createNsResolverForBrowser(namespaces);
-            const result = document.evaluate(xpathExpression, parent, nsResolver, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE, null);
+            const result = ownerDoc.evaluate(xpathExpression, parent, nsResolver, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE, null);
             const elements = [];
             for (let i = 0; i < result.snapshotLength; i++) {
                 elements.push(result.snapshotItem(i));
@@ -10118,7 +10132,7 @@ async function verifyTimestamp(timestampBase64, options = {}) {
             // Check TSA certificate revocation if requested
             if (options.checkTsaRevocation !== false) {
                 try {
-                    tsaRevocation = await checkCertificateRevocation(tsaCert);
+                    tsaRevocation = await checkCertificateRevocation(tsaCert, options.revocationOptions);
                     // If TSA certificate is revoked, the timestamp is invalid
                     if (tsaRevocation.status === "revoked") {
                         return {
@@ -10526,6 +10540,7 @@ async function verifySignature(signatureInfo, files, options = {}) {
         timestampResult = await verifyTimestamp(signatureInfo.signatureTimestamp, {
             signatureValue: signatureInfo.signatureValue,
             verifyTsaCertificate: true,
+            revocationOptions: options.revocationOptions,
         });
         if (timestampResult.isValid && timestampResult.info) {
             // Use timestamp time as the trusted signing time
@@ -10550,11 +10565,23 @@ async function verifySignature(signatureInfo, files, options = {}) {
                 ...options.revocationOptions,
             });
             certResult.revocation = revocationResult;
-            // If certificate is revoked, mark certificate as invalid
+            // If certificate is revoked, check if signature was made before revocation (LTV)
             if (revocationResult.status === "revoked") {
-                certResult.isValid = false;
-                certResult.reason = revocationResult.reason || "Certificate has been revoked";
-                errors.push(`Certificate revoked: ${revocationResult.reason || "No reason provided"}`);
+                const revokedAt = revocationResult.revokedAt;
+                // Long-Term Validation: if we have a trusted timestamp proving the signature
+                // was made before revocation, the signature is still valid
+                if (revokedAt && trustedSigningTime < revokedAt) {
+                    // Signature was made before revocation - still valid (LTV)
+                    certResult.revocation.isValid = true;
+                    certResult.revocation.reason = `Certificate was revoked on ${revokedAt.toISOString()}, but signature was made on ${trustedSigningTime.toISOString()} (before revocation)`;
+                }
+                else {
+                    // Signature was made after revocation or no revocation date available
+                    certResult.isValid = false;
+                    const revokedAtStr = revokedAt ? ` on ${revokedAt.toISOString()}` : "";
+                    certResult.reason = `Certificate was revoked${revokedAtStr}`;
+                    errors.push(`Certificate revoked${revokedAtStr}`);
+                }
             }
             // Note: 'unknown' status is a soft fail - certificate remains valid
             // but user can check revocation.status to see if it couldn't be verified