Skip to content

Commit e2f72ee

Browse files
shunkicashunkica
committed
refactor: move types to types.ts, rename test file
1 parent 255663b commit e2f72ee

File tree

3 files changed

+133
-130
lines changed

3 files changed

+133
-130
lines changed

‎src/types.ts‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
import * as crypto from "crypto";
1010
import { XMLDSIG_URIS } from "./xmldsig-uris";
11+
import { KeyLike, X509Certificate } from "node:crypto";
1112
const {
1213
SIGNATURE_ALGORITHMS,
1314
DIGEST_ALGORITHMS,
@@ -282,3 +283,130 @@ export function createOptionalCallbackFunction<T, A extends unknown[]>(
282283
(...args: [...A, ErrorFirstCallback<T>]): void;
283284
};
284285
}
286+
287+
/*** XmlDSigVerifier types ***/
288+
289+
export type CertificateKeySelector = {
290+
/** Public certificate or key to use for verification */
291+
publicCert: KeyLike;
292+
};
293+
294+
export type KeyInfoKeySelector = {
295+
/** Function to extract the public key from KeyInfo element */
296+
getCertFromKeyInfo: (keyInfo?: Node | null) => string | null;
297+
};
298+
299+
export type KeySelector = CertificateKeySelector | KeyInfoKeySelector;
300+
301+
export interface XmlDSigVerifierSecurityOptions {
302+
/**
303+
* Maximum number of transforms allowed per Reference element.
304+
* Limits complexity to prevent denial-of-service attacks.
305+
* @default {@link DEFAULT_MAX_TRANSFORMS}
306+
*/
307+
maxTransforms?: number;
308+
309+
/**
310+
* Check certificate expiration dates during verification.
311+
* If true, signatures with expired certificates will be considered invalid.
312+
* This only applies when using KeyInfoKeySelector
313+
* @default true
314+
*/
315+
checkCertExpiration?: boolean;
316+
317+
/**
318+
* Optional truststore of trusted certificates
319+
* When provided, the certificate used to sign the XML must chain to one of these trusted certificates.
320+
* These must be PEM or DER encoded X509 certificates
321+
*/
322+
truststore?: Array<string | Buffer | X509Certificate>;
323+
324+
/**
325+
* Signature algorithms allowed during verification.
326+
*
327+
* @default {@link SignedXml.getDefaultSignatureAlgorithms()}
328+
*/
329+
signatureAlgorithms?: SignatureAlgorithmMap;
330+
331+
/**
332+
* Hash algorithms allowed during verification.
333+
*
334+
* @default {@link SignedXml.getDefaultDigestAlgorithms()}
335+
*/
336+
hashAlgorithms?: DigestAlgorithmMap;
337+
338+
/**
339+
* Transform algorithms allowed during verification. (This must include canonicalization algorithms)
340+
*
341+
* @default all algorithms in {@link SignedXml.getDefaultTransformAlgorithms()}
342+
*/
343+
transformAlgorithms?: TransformAlgorithmMap;
344+
345+
/**
346+
* Canonicalization algorithms allowed during verification.
347+
*
348+
* @default all algorithms in {@link SignedXml.getDefaultCanonicalizationAlgorithms()}
349+
*/
350+
canonicalizationAlgorithms?: TransformAlgorithmMap;
351+
}
352+
353+
/**
354+
* Common configuration options for XML-DSig verification.
355+
*/
356+
export interface XmlDSigVerifierOptions {
357+
/**
358+
* Key selector for determining the public key to use for verification.
359+
*/
360+
keySelector: KeySelector;
361+
362+
/**
363+
* Names of XML attributes to treat as element identifiers.
364+
* Used when resolving URI references in signatures.
365+
* When passing strings, only the localName is matched, ignoring namespace.
366+
* To explicitly match attributes without namespaces, use: { localName: "Id", namespaceUri: undefined }
367+
* @default {@link SignedXml.getDefaultIdAttributes()}
368+
* @example For WS-Security: [{ localName: "Id", namespaceUri: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" }]
369+
*/
370+
idAttributes?: VerificationIdAttributeType[];
371+
372+
/**
373+
* Transforms to apply implicitly during canonicalization.
374+
* Used for specific XML-DSig profiles that require additional transforms.
375+
*/
376+
implicitTransforms?: ReadonlyArray<string>;
377+
378+
/**
379+
* Whether to throw an exception on verification failure.
380+
* If false, errors are returned in the XmlDsigVerificationResult.
381+
* @default false
382+
*/
383+
throwOnError?: boolean;
384+
385+
/**
386+
* Security options for verification.
387+
*/
388+
security?: XmlDSigVerifierSecurityOptions;
389+
}
390+
391+
/**
392+
* Verification result containing the outcome and signed content.
393+
*/
394+
export type SuccessfulXmlDsigVerificationResult = {
395+
/** Whether the signature was successfully verified */
396+
success: true;
397+
error?: undefined;
398+
/** The canonicalized XML content that passed verification */
399+
signedReferences: string[];
400+
};
401+
402+
export type FailedXmlDsigVerificationResult = {
403+
/** Whether the signature was sucessfuly verified */
404+
success: false;
405+
/** Error message if verification failed */
406+
error: string;
407+
signedReferences?: undefined;
408+
};
409+
410+
export type XmlDsigVerificationResult =
411+
| SuccessfulXmlDsigVerificationResult
412+
| FailedXmlDsigVerificationResult;

‎src/xmldsig-verifier.ts‎

Lines changed: 4 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -3,143 +3,19 @@ import { DOMParser } from "@xmldom/xmldom";
33
import { SignedXml } from "./signed-xml";
44
import {
55
KeySelectorFunction,
6-
DigestAlgorithmMap,
7-
TransformAlgorithmMap,
8-
SignatureAlgorithmMap,
96
SignedXmlOptions,
107
VerificationIdAttributeType,
8+
KeySelector,
9+
XmlDSigVerifierSecurityOptions,
10+
XmlDSigVerifierOptions,
11+
XmlDsigVerificationResult,
1112
} from "./types";
1213
import { isArrayHasLength } from "./utils";
1314

1415
const DEFAULT_MAX_TRANSFORMS = 4;
1516
const DEFAULT_THROW_ON_ERROR = false;
1617
const DEFAULT_CHECK_CERT_EXPIRATION = true;
1718

18-
export type CertificateKeySelector = {
19-
/** Public certificate or key to use for verification */
20-
publicCert: KeyLike;
21-
};
22-
23-
export type KeyInfoKeySelector = {
24-
/** Function to extract the public key from KeyInfo element */
25-
getCertFromKeyInfo: (keyInfo?: Node | null) => string | null;
26-
};
27-
28-
export type KeySelector = CertificateKeySelector | KeyInfoKeySelector;
29-
30-
export interface XmlDSigVerifierSecurityOptions {
31-
/**
32-
* Maximum number of transforms allowed per Reference element.
33-
* Limits complexity to prevent denial-of-service attacks.
34-
* @default {@link DEFAULT_MAX_TRANSFORMS}
35-
*/
36-
maxTransforms?: number;
37-
38-
/**
39-
* Check certificate expiration dates during verification.
40-
* If true, signatures with expired certificates will be considered invalid.
41-
* This only applies when using KeyInfoKeySelector
42-
* @default true
43-
*/
44-
checkCertExpiration?: boolean;
45-
46-
/**
47-
* Optional truststore of trusted certificates
48-
* When provided, the certificate used to sign the XML must chain to one of these trusted certificates.
49-
* These must be PEM or DER encoded X509 certificates
50-
*/
51-
truststore?: Array<string | Buffer | X509Certificate>;
52-
53-
/**
54-
* Signature algorithms allowed during verification.
55-
*
56-
* @default {@link SignedXml.getDefaultSignatureAlgorithms()}
57-
*/
58-
signatureAlgorithms?: SignatureAlgorithmMap;
59-
60-
/**
61-
* Hash algorithms allowed during verification.
62-
*
63-
* @default {@link SignedXml.getDefaultDigestAlgorithms()}
64-
*/
65-
hashAlgorithms?: DigestAlgorithmMap;
66-
67-
/**
68-
* Transform algorithms allowed during verification. (This must include canonicalization algorithms)
69-
*
70-
* @default all algorithms in {@link SignedXml.getDefaultTransformAlgorithms()}
71-
*/
72-
transformAlgorithms?: TransformAlgorithmMap;
73-
74-
/**
75-
* Canonicalization algorithms allowed during verification.
76-
*
77-
* @default all algorithms in {@link SignedXml.getDefaultCanonicalizationAlgorithms()}
78-
*/
79-
canonicalizationAlgorithms?: TransformAlgorithmMap;
80-
}
81-
82-
/**
83-
* Common configuration options for XML-DSig verification.
84-
*/
85-
export interface XmlDSigVerifierOptions {
86-
/**
87-
* Key selector for determining the public key to use for verification.
88-
*/
89-
keySelector: KeySelector;
90-
91-
/**
92-
* Names of XML attributes to treat as element identifiers.
93-
* Used when resolving URI references in signatures.
94-
* When passing strings, only the localName is matched, ignoring namespace.
95-
* To explicitly match attributes without namespaces, use: { localName: "Id", namespaceUri: undefined }
96-
* @default {@link SignedXml.getDefaultIdAttributes()}
97-
* @example For WS-Security: [{ localName: "Id", namespaceUri: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" }]
98-
*/
99-
idAttributes?: VerificationIdAttributeType[];
100-
101-
/**
102-
* Transforms to apply implicitly during canonicalization.
103-
* Used for specific XML-DSig profiles that require additional transforms.
104-
*/
105-
implicitTransforms?: ReadonlyArray<string>;
106-
107-
/**
108-
* Whether to throw an exception on verification failure.
109-
* If false, errors are returned in the XmlDsigVerificationResult.
110-
* @default false
111-
*/
112-
throwOnError?: boolean;
113-
114-
/**
115-
* Security options for verification.
116-
*/
117-
security?: XmlDSigVerifierSecurityOptions;
118-
}
119-
120-
/**
121-
* Verification result containing the outcome and signed content.
122-
*/
123-
export type SuccessfulXmlDsigVerificationResult = {
124-
/** Whether the signature was successfully verified */
125-
success: true;
126-
error?: undefined;
127-
/** The canonicalized XML content that passed verification */
128-
signedReferences: string[];
129-
};
130-
131-
export type FailedXmlDsigVerificationResult = {
132-
/** Whether the signature was sucessfuly verified */
133-
success: false;
134-
/** Error message if verification failed */
135-
error: string;
136-
signedReferences?: undefined;
137-
};
138-
139-
export type XmlDsigVerificationResult =
140-
| SuccessfulXmlDsigVerificationResult
141-
| FailedXmlDsigVerificationResult;
142-
14319
type ResolvedXmlDsigVerifierOptions = {
14420
keySelector: KeySelector;
14521
idAttributes: VerificationIdAttributeType[];

test/xmldsig-validator.spec.ts renamed to test/xmldsig-verifier.spec.ts

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
import * as fs from "fs";
22
import { expect } from "chai";
33
import { XmlDSigVerifier, SignedXml, ExclusiveCanonicalization } from "../src";
4-
import { XmlDsigVerificationResult } from "../src/xmldsig-verifier";
54
import { RsaSha1 } from "../src/signature-algorithms";
65
import { Sha1 } from "../src/hash-algorithms";
76
import { EnvelopedSignature } from "../src/enveloped-signature";
8-
import { XMLDSIG_URIS } from "../src/xmldsig-uris";
7+
import { XMLDSIG_URIS, XmlDsigVerificationResult } from "../src/";
98

109
const {
1110
CANONICALIZATION_ALGORITHMS,

0 commit comments

Comments
 (0)