eimzo-sign-core 0.1.0

package/src/types.ts

@@ -0,0 +1,112 @@
+import type { EimzoErrorCode } from './errors'
+
+/** Sertifikat turi. `idcard` — ID-karta (alohida oqim, `loadKey` chaqirilmaydi). */
+export type CertType = 'pfx' | 'ftjc' | 'idcard'
+
+/**
+ * Normallashtirilgan sertifikat. `raw` — vendor xom obyekti, `loadKey` ga
+ * o'zgarishsiz uzatiladi (undan tashqarida foydalanmang).
+ */
+export interface Cert {
+  serialNumber: string
+  /** CN — egasi (F.I.Sh yoki tashkilot rahbari). */
+  CN: string
+  /** STIR / JSHSHIR. */
+  TIN: string
+  UID: string
+  /** Tashkilot nomi (jismoniy shaxs kalitida bo'sh). */
+  O: string
+  T: string
+  validFrom: Date
+  validTo: Date
+  type: CertType
+  /** @internal vendor xom obyekti */
+  raw: unknown
+}
+
+export interface EimzoVersion {
+  major: number
+  minor: number
+}
+
+export interface EimzoClientOptions {
+  /**
+   * Domen API kalitlari: `[[domen, kalit], ...]`.
+   * E-IMZO tomonidan har domen uchun beriladi.
+   *
+   * MUHIM: kutubxonada default YO'Q. Ilova (consumer) o'z kalitlarini
+   * shu yerda beradi; prod kalitlari kutubxona kodiga yozilmaydi.
+   */
+  apiKeys: ReadonlyArray<readonly [domain: string, key: string]>
+
+  /** Har bir CAPIWS chaqiruvi uchun timeout, ms. Default: 30000. */
+  timeoutMs?: number
+
+  /**
+   * Kalit yuklash (parol kiritish) uchun alohida, uzunroq timeout, ms.
+   * Default: 120000.
+   */
+  keyLoadTimeoutMs?: number
+
+  /** Minimal talab qilinadigan E-IMZO versiyasi. Default: 3.37. */
+  minVersion?: EimzoVersion
+
+  /**
+   * Audit hook. Kutubxona HECH QACHON `console` ga yozmaydi — barcha
+   * kuzatuv shu yerdan o'tadi. Ilova buni o'z jurnaliga / SIEM'ga yozadi.
+   * Hook'dagi istisno kutubxonani buzmaydi (yutiladi).
+   *
+   * DIQQAT: `AuditEvent` ataylab minimal — faqat `serial` va `docId`.
+   * CN / TIN / JSHSHIR / imzo bloblari uzatilmaydi.
+   */
+  onAudit?: (event: AuditEvent) => void
+}
+
+/** Imzolanadigan bitta hujjat. */
+export interface SignDoc {
+  /** Ilova ichidagi barqaror identifikator (natijani hujjatga bog'lash uchun). */
+  id: string
+  /** Imzolanadigan XOM kontent (matn / XML / base64). Base64 kodlashni kutubxona bajaradi. */
+  content: string
+}
+
+/** Bitta hujjat bo'yicha imzo natijasi. */
+export interface SignResult {
+  id: string
+  pkcs7_64: string
+  signature_hex: string
+  signer_serial_number: string
+}
+
+/** Partiyadagi bitta element — muvaffaqiyat yoki xato. */
+export type BatchSignItem =
+  | ({ id: string; ok: true } & Omit<SignResult, 'id'>)
+  | { id: string; ok: false; error: import('./errors').EimzoError }
+
+export interface BatchProgress {
+  /** Tugagan hujjatlar soni. */
+  done: number
+  /** Jami hujjatlar. */
+  total: number
+  /** Hozir imzolanayotgan hujjat id'si (tugagach — undefined). */
+  currentId?: string
+}
+
+export interface SignBatchOptions {
+  /** Tashqi bekor qilish signali (idle-taymer, modal yopilishi). */
+  signal?: AbortSignal
+  /** Har bir hujjatdan oldin/keyin chaqiriladi. */
+  onProgress?: (progress: BatchProgress) => void
+}
+
+/**
+ * Audit hodisalari. Ataylab minimal maydonlar — shaxsiy ma'lumot yo'q.
+ */
+export type AuditEvent =
+  | { type: 'version_checked'; ts: string; major: number; minor: number }
+  | { type: 'certs_listed'; ts: string; count: number }
+  | { type: 'key_loaded'; ts: string; serial: string }
+  | { type: 'sign_started'; ts: string; serial: string; docId: string }
+  | { type: 'sign_ok'; ts: string; serial: string; docId: string }
+  | { type: 'sign_failed'; ts: string; docId: string; code: EimzoErrorCode }
+  | { type: 'session_ended'; ts: string; serial: string; signed: number; failed: number }

package/src/util.ts

@@ -0,0 +1,69 @@
+import { EimzoError } from './errors'
+
+export function nowIso(): string {
+  return new Date().toISOString()
+}
+
+/** Seriya raqamlarini solishtirish uchun normallashtirish (registr + bo'shliqlar). */
+export function normalizeSerial(value: unknown): string {
+  return String(value ?? '')
+    .toUpperCase()
+    .replace(/\s+/g, '')
+}
+
+export function throwIfAborted(signal?: AbortSignal): void {
+  if (signal?.aborted) {
+    throw new EimzoError('E_CANCELLED', 'Amal bekor qilindi')
+  }
+}
+
+/**
+ * Callback uslubidagi vendor chaqiruvini timeout bilan Promise'ga o'raydi.
+ * `settle` bir martagina ishlaydi (double-resolve himoyasi).
+ */
+export function withTimeout<T>(
+  timeoutMs: number,
+  timeoutError: () => EimzoError,
+  executor: (
+    resolve: (value: T) => void,
+    reject: (error: unknown) => void,
+  ) => void,
+  signal?: AbortSignal,
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let settled = false
+
+    const cleanup = (): void => {
+      clearTimeout(timer)
+      signal?.removeEventListener('abort', onAbort)
+    }
+    const settleResolve = (value: T): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      resolve(value)
+    }
+    const settleReject = (error: unknown): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      reject(error)
+    }
+
+    const onAbort = (): void =>
+      settleReject(new EimzoError('E_CANCELLED', 'Amal bekor qilindi'))
+    const timer = setTimeout(() => settleReject(timeoutError()), timeoutMs)
+
+    if (signal?.aborted) {
+      settleReject(new EimzoError('E_CANCELLED', 'Amal bekor qilindi'))
+      return
+    }
+    signal?.addEventListener('abort', onAbort)
+
+    try {
+      executor(settleResolve, settleReject)
+    } catch (error) {
+      settleReject(error)
+    }
+  })
+}

package/src/vendor/VENDOR.md

@@ -0,0 +1,59 @@
+# Vendored E-IMZO SDK fayllari
+
+Bu papkadagi fayllar **E-IMZO'ning rasmiy brauzer SDK'sidan** olingan.
+Ta'minot zanjiri (supply-chain) xavfsizligi uchun ular repozitoriyga qo'lda kiritilgan,
+`npm` orqali emas.
+
+| Fayl | Manba | Versiya | Holati | SHA-256 |
+|---|---|---|---|---|
+| `e-imzo.js` | https://e-imzo.uz | `< to'ldiring >` | 4 qatorlik patch (pastga qarang) | `751b0ca8592db0e37bd6f095161b1766651a47951e01cf13a4c68e1373fb1cc3` |
+| `e-imzo-client.js` | https://e-imzo.uz | `< to'ldiring >` | O'zgartirilmagan | `b02a60e05854d305081affcf69785d4f185b130aadc2506d7de62a9d873b120c` |
+
+## `e-imzo.js` ga kiritilgan patch
+
+Sabab: rasmiy fayl klassik `<script>` sifatida yozilgan — top-level `this` global
+obyekt deb faraz qiladi, `CAPIWS` ni **implicit global** deб e'lon qiladi va modul
+yuklanganda `window.location` ni o'qiydi. ESM bundler (tsup/esbuild) ichida
+`this === undefined`, implicit global taqiqlangan, SSR/Node'da esa `window` yo'q.
+Quyidagi 4 ta o'zgarish kiritildi. **Xatti-harakat brauzerda o'zgarmaydi**,
+`eval` / `new Function` ishlatilmaydi.
+
+```diff
+- 375:    window.Base64 = global.Base64;
++ 375:    if (typeof window !== 'undefined') window.Base64 = global.Base64;
+
+- 376: })(this);
++ 376: })(typeof globalThis !== 'undefined' ? globalThis : this);
+
+- 378: CAPIWS = (typeof EIMZOEXT !== 'undefined') ? EIMZOEXT : {
++ 378: globalThis.CAPIWS = (typeof EIMZOEXT !== 'undefined') ? EIMZOEXT : {
+
+  379:    URL: (
+-           window.location.protocol.toLowerCase() === "https:"
++           (typeof window !== 'undefined' ? window.location.protocol : '').toLowerCase() === "https:"
+          ? "wss://127.0.0.1:64443" : "ws://127.0.0.1:64646") + "/service/cryptapi",
+```
+
+## Yangilash tartibi
+
+1. Rasmiy SDK'dan yangi faylni yuklab oling.
+2. `git diff` bilan o'zgarishlarni ko'zdan kechiring (yangi tarmoq manzillari,
+   `eval` / `Function` / `innerHTML` / `document.write` paydo bo'lmaganini tekshiring).
+3. Yuqoridagi 3 patchни qayta qo'llang.
+4. `shasum -a 256 e-imzo.js e-imzo-client.js` — jadvalни yangilang.
+5. `pnpm --filter eimzo-sign-core test` — kontrakt testlari o'tishини tasdiqlang.
+6. Alohida commit: `chore(vendor): E-IMZO SDK x.y.z ga yangilash`.
+
+CI `verify-vendor` bosqichi jadvaldagi SHA-256 bilan haqiqiy fayлларни solиштиради —
+mos kelmаса build to'xtаyди.
+
+## Ma'lum xususiyatlar (audit uchun)
+
+- `e-imzo-client.js` `Date.prototype` va `String.prototype` ga metod qo'shади
+  (`yyyymmdd`, `ddmmyyyy`, `splitKeep`). Bu rasmiy SDK xatti-harakати.
+- `e-imzo.js` global `CAPIWS` va `window.Base64` ni o'rnатади.
+- Tashqи tarmoqqа chiqмайди; faqat lokal soket:
+  `ws://127.0.0.1:64646` (http) / `wss://127.0.0.1:64443` (https).
+- `eval` / `new Function` / `document.write` / `innerHTML` ishlатилмайди.
+- SSR eslатма: `e-imzo.js` modul yuklанганда `window.location.protocol` ni o'qийди —
+  paketни faqat brauzер muhitида import qiling (Vue qatlами buni ta'минлайди).