o
    Fzc                  
   @   s   d dl Z d dlmZ d dlmZmZmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ z
d dlmZmZ W n eyP Z z
d ZZW Y dZ[ndZ[ww d d	lmZ e d
ZG dd dZdS )    N)Path)x509pemcrlocsp)IncrementalPdfFileWriter)signers
timestamps)SigSeedSubFilter)ValidationContext)open_pkcs11_sessionPKCS11Signer)getFileZ	xhtml2pdfc                   @   s   e Zd Zedd Zedd Zedd Zedd Zed	d
 Zedd Z	edd Z
edd Zedd Zedd Zedd Zedd Zedd Zedd Zedd ZdS ) PDFSignaturec                 C   s*   d| v r| d }t |tr| }|S d S )N
passphrase)
isinstancestrencode)configr    r   /xhtml2pdf/builders/signs.pyget_passphrase   s   
zPDFSignature.get_passphrasec                 C   s   g }d| v r>| d }t |ts|g}|D ])}t |ts t |tr8t|}t| \}}}|t	j
| q|| q|sBd S |S )Nca_chain)r   listr   r   r   r   ZunarmorgetDataappendr   ZCertificateload)r   keyZchainschaincpisafile_Zdigicert_ca_bytesr   r   r   
get_chains   s   
zPDFSignature.get_chainsc                 C   sV   t | }d| v r%d| v r'|r)t | d}tjj| d | d ||d}|S d S d S d S )Nr   Zcertr   )Zca_chain_filesZkey_passphrase)r   r   r"   r   SimpleSignerr   )r   r   r   signerr   r   r   test_simple_signer/   s   
zPDFSignature.test_simple_signerc                 C   s6   t | }d| v r|rtjj| d |d}|S d S d S )Npfx_file)r&   r   )r   r   r   r#   Zload_pkcs12)r   r   r$   r   r   r   test_pkcs12_signer;   s   
zPDFSignature.test_pkcs12_signerc                 C   sx   t | }t|d d d d ddddd d dd}|D ]}|| v r2|dkr,t | d}|||< q| | ||< qtdi |}|S )NFTr   )Zpkcs11_sessionZ
cert_labelZsigning_certr   Z	key_labelZ
prefer_pssZembed_rootsZother_certs_to_pullZ
bulk_fetchZkey_idZcert_idZuse_raw_mechanismr   )r   get_sessiondictr"   r   )r   sessionkeysr   r   r$   r   r   r   test_pkcs11_signerD   s(   


zPDFSignature.test_pkcs11_signerc                 C   s    d| v rt j| d d}|S d S )NZtsa)url)r	   ZHTTPTimeStamper)r   Z
tst_clientr   r   r   get_timestamps\   s   zPDFSignature.get_timestampsc                 C   sl   d| vrd S d }| d }|dkrt | }|S |dkr+td u r$tdtt | }|S |dkr4t | }|S )NengineZpkcs12Zpkcs11zpyhanko.sign.pkcs11 requires pyHanko to be installed with the [pkcs11] option. You can install missing dependencies by running "pip install 'pyHanko[pkcs11]'".simple)r   r'   r   ImportErrorer,   r%   )r   r$   r/   r   r   r   get_signersb   s$   


zPDFSignature.get_signersc                 C   s(   |d dkrt | ||S t | ||S )NtypeZlta)r   lta_signsimple_sign)	inputfileoutputr   r   r   r   signx   s   zPDFSignature.signc                 C   sT   g }| D ]#}t |tst |tr"t|}tj| }|| q|| q|S N)	r   r   r   r   r   ZCertificateListr   r   r   )crlsZ	list_crlsxr    Z	cert_listr   r   r   
parse_crls   s   zPDFSignature.parse_crlsc                 C   s4   g }| D ]}t |}tj| }|| q|S r:   )r   r   ZOCSPResponser   r   r   )ZoscpsZ	list_oscpr<   r    datar   r   r   
parse_oscp   s   zPDFSignature.parse_oscpc                 C   s   t dd}d| v rfd| d v rt| d d | d d< d| d v r/t| d d | d d< d| d v r?t| d| d d< d| d v rOt| d| d d< d| d v r_t| d| d d< || d  td	i |S )
NT)Zallow_fetchingvalidation_contextr;   ZocspsZtrust_rootsZextra_trust_rootsZother_certsr   )r)   r   r=   r?   r"   updater   )r   contextr   r   r   get_validation_context   s   
z#PDFSignature.get_validation_contextc                 C   s@   t ddd d d dddtjd t| d}d| v r|| d  |S )N
Signature1Zsha256FT)
field_nameZmd_algorithmlocationreasonnameZcertifyZembed_validation_infoZuse_pades_ltaZ	subfilterZtimestamp_field_namer@   meta)r)   r
   ZPADESr   rC   rA   )r   rI   r   r   r   get_signature_meta   s   zPDFSignature.get_signature_metac                 C   sD   t |}|r t| }t |}tj|tjdd|||d dS d S )NrD   )rE   )r$   r8   timestamperT)r   r3   IncrementalPdfWriterr.   r   sign_pdfPdfSignatureMetadata)r7   r8   r   r$   wrK   r   r   r   r6      s   

zPDFSignature.simple_signc                 C   s^   t |}t |}t| }t |}tjdi |}|r+|r-tj|||||d dS d S d S )N)signature_metar$   rK   r8   Tr   )r   r3   r.   rL   rJ   r   rN   rM   )r7   r8   r   r$   rK   rO   rI   rP   r   r   r   r5      s   



zPDFSignature.lta_signc                 C   sp   |  dd }|  dd }|  dd }|  dd }|d ur2|d ur4|d us(|d ur6t||||d}|S d S d S d S )Nlib_locationslot_notoken_labeluser_pin)rR   rS   rT   )getr   )r   rQ   rR   rS   rT   r*   r   r   r   r(      s   zPDFSignature.get_sessionN)__name__
__module____qualname__staticmethodr   r"   r%   r'   r,   r.   r3   r9   r=   r?   rC   rJ   r6   r5   r(   r   r   r   r   r      s>    













r   )loggingpathlibr   Z
asn1cryptor   r   r   r   Z$pyhanko.pdf_utils.incremental_writerr   Zpyhanko.signr   r	   Zpyhanko.sign.fieldsr
   Zpyhanko_certvalidatorr   Zpyhanko.sign.pkcs11r   r   r1   r2   Zxhtml2pdf.filesr   	getLoggerlogr   r   r   r   r   <module>   s     
