From b8c30343a83efa3ab718cba3e4bde80f95688055 Mon Sep 17 00:00:00 2001
From: Jan Suchal <jan.suchal@slovensko.digital>
Date: Tue, 21 Nov 2023 15:54:26 +0100
Subject: [PATCH 01/10] Set sane .idea defaults

---
 .gitignore | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 21e7defe..5b6c02c2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,7 +9,9 @@ buildNumber.properties
 .mvn/timing.properties
 # https://github.com/takari/maven-wrapper#usage-without-binary-jar
 .mvn/wrapper/maven-wrapper.jar
-.idea/
+.idea/workspace.xml
+.idea/usage.statistics.xml
+.idea/shelf
 whitelabel.iml
 
 # IDE - It's up to developer to decide, we don't want to force configuration
@@ -28,3 +30,5 @@ secret
 .autogram
 
 /fakeTokenDriver
+
+/cache

From e5a2a919fb1a8d05c59fe69988a120e385dfc383 Mon Sep 17 00:00:00 2001
From: Jan Suchal <jan.suchal@slovensko.digital>
Date: Tue, 21 Nov 2023 15:56:07 +0100
Subject: [PATCH 02/10] Add experimental WIP native pkcs signature token

---
 .idea/compiler.xml                            |  18 ++
 .run/Main.run.xml                             |   4 +-
 .../drivers/NativePkcs11SignatureToken.java   | 172 ++++++++++++++++++
 .../autogram/drivers/PKCS11TokenDriver.java   |   2 +-
 4 files changed, 193 insertions(+), 3 deletions(-)
 create mode 100644 .idea/compiler.xml
 create mode 100644 src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java

diff --git a/.idea/compiler.xml b/.idea/compiler.xml
new file mode 100644
index 00000000..18548bc5
--- /dev/null
+++ b/.idea/compiler.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="CompilerConfiguration">
+    <annotationProcessing>
+      <profile name="Maven default annotation processors profile" enabled="true">
+        <sourceOutputDir name="target/generated-sources/annotations" />
+        <sourceTestOutputDir name="target/generated-test-sources/test-annotations" />
+        <outputRelativeToContentRoot value="true" />
+        <module name="autogram" />
+      </profile>
+    </annotationProcessing>
+  </component>
+  <component name="JavacSettings">
+    <option name="ADDITIONAL_OPTIONS_OVERRIDE">
+      <module name="autogram" options="--add-exports jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED --add-modules jdk.crypto.cryptoki" />
+    </option>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.run/Main.run.xml b/.run/Main.run.xml
index 705017da..0e7a99a1 100644
--- a/.run/Main.run.xml
+++ b/.run/Main.run.xml
@@ -5,7 +5,7 @@
     <option name="MAIN_CLASS_NAME" value="digital.slovensko.autogram.Main" />
     <module name="autogram" />
     <option name="PROGRAM_PARAMETERS" value="--url=autogram://listen?protocol=http&amp;host=localhost&amp;port=37200&amp;origin=*&amp;language=sk" />
-    <option name="VM_PARAMETERS" value="--add-exports javafx.graphics/com.sun.javafx.tk=ALL-UNNAMED" />
+    <option name="VM_PARAMETERS" value="--add-exports jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED" />
     <extension name="coverage">
       <pattern>
         <option name="PATTERN" value="digital.slovensko.autogram.ui.*" />
@@ -16,4 +16,4 @@
       <option name="Make" enabled="true" />
     </method>
   </configuration>
-</component>
+</component>
\ No newline at end of file
diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
new file mode 100644
index 00000000..535a6801
--- /dev/null
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -0,0 +1,172 @@
+package digital.slovensko.autogram.drivers;
+
+import eu.europa.esig.dss.enumerations.SignatureAlgorithm;
+import eu.europa.esig.dss.model.DSSException;
+import eu.europa.esig.dss.model.SignatureValue;
+import eu.europa.esig.dss.model.ToBeSigned;
+import eu.europa.esig.dss.token.DSSPrivateKeyEntry;
+import eu.europa.esig.dss.token.KSPrivateKeyEntry;
+import eu.europa.esig.dss.token.Pkcs11SignatureToken;
+import eu.europa.esig.dss.token.PrefilledPasswordCallback;
+import sun.security.pkcs11.wrapper.CK_ATTRIBUTE;
+import sun.security.pkcs11.wrapper.PKCS11;
+import sun.security.pkcs11.wrapper.PKCS11Constants;
+import sun.security.pkcs11.wrapper.PKCS11Exception;
+
+import java.lang.reflect.Field;
+import java.security.GeneralSecurityException;
+import java.security.PrivateKey;
+import java.security.Signature;
+import java.security.spec.AlgorithmParameterSpec;
+import java.util.Objects;
+
+public class NativePkcs11SignatureToken extends Pkcs11SignatureToken {
+    private static final long CKU_CONTEXT_SPECIFIC = 2L;
+
+    public NativePkcs11SignatureToken(String pkcsPath, PrefilledPasswordCallback prefilledPasswordCallback, int slotId, Integer bogus) {
+        super(pkcsPath, prefilledPasswordCallback, slotId, null);
+    }
+
+    private byte[] sign(final byte[] bytes, final String javaSignatureAlgorithm, final AlgorithmParameterSpec param, final DSSPrivateKeyEntry keyEntry) throws GeneralSecurityException {
+        if (!(keyEntry instanceof KSPrivateKeyEntry)) {
+            throw new IllegalArgumentException("Only KSPrivateKeyEntry are supported");
+        }
+
+        final Signature signature = getSignatureInstance(javaSignatureAlgorithm);
+        if (param != null) {
+            signature.setParameter(param);
+        }
+        var pk = ((KSPrivateKeyEntry) keyEntry).getPrivateKey();
+
+        signature.initSign(pk);
+        if (isAlwaysAuthenticate(signature, pk)) {
+            var pin = "123456".toCharArray(); // TODO actually get this somehow from password protection
+            runContextSpecificLogin(signature, pk, pin);
+        }
+        signature.update(bytes);
+        return signature.sign();
+    }
+
+    private boolean isAlwaysAuthenticate(Signature signature, PrivateKey pk) {
+        // TODO cache this?
+        try {
+            var p11 = getP11(signature);
+            var sessionId = getSessionId(signature);
+            var keyID = getKeyID(pk);
+            var attrs = new CK_ATTRIBUTE[]{new CK_ATTRIBUTE(PKCS11Constants.CKA_ALWAYS_AUTHENTICATE)};
+
+            p11.C_GetAttributeValue(sessionId, keyID, attrs);
+
+            var result = attrs[0].pValue;
+            if (result instanceof byte[]) {
+                return ((byte[]) result)[0] == 1;
+            } else {
+                return false; // CKA_ALWAYS_AUTHENTICATE not found
+            }
+        } catch (PKCS11Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private void runContextSpecificLogin(Signature signature, PrivateKey pk, char[] pin) throws GeneralSecurityException {
+        try {
+            var p11 = getP11(signature);
+            var sessionId = getSessionId(signature);
+            var attrs = new CK_ATTRIBUTE[]{new CK_ATTRIBUTE(PKCS11Constants.CKA_ALWAYS_AUTHENTICATE)};
+            var keyID = getKeyID(pk);
+            p11.C_GetAttributeValue(sessionId, keyID, attrs); // TODO cache this?
+
+            p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, pin);
+        } catch (PKCS11Exception e) {
+            throw new GeneralSecurityException(e);
+        }
+    }
+
+    private static long getKeyID(PrivateKey pk) {
+        try {
+            var keyIDHolderField = pk.getClass().getSuperclass().getDeclaredField("keyIDHolder");
+            keyIDHolderField.setAccessible(true);
+            var keyIDHolder = keyIDHolderField.get(pk);
+
+            var keyIDField = keyIDHolder.getClass().getDeclaredField("keyID");
+            keyIDField.setAccessible(true);
+
+            return (long) keyIDField.get(keyIDHolder);
+        } catch (IllegalAccessException | NoSuchFieldException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static long getSessionId(Signature signature) {
+        try {
+            Field sigSpiField = signature.getClass().getDeclaredField("sigSpi");
+            sigSpiField.setAccessible(true);
+            var sigSpi = sigSpiField.get(signature);
+
+            var sessionField = sigSpi.getClass().getDeclaredField("session");
+            sessionField.setAccessible(true);
+            var session = sessionField.get(sigSpi);
+
+            var idField = session.getClass().getDeclaredField("id");
+            idField.setAccessible(true);
+
+            return (long) idField.get(session);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static PKCS11 getP11(Signature signature) {
+        try {
+            Field sigSpiField = signature.getClass().getDeclaredField("sigSpi");
+            sigSpiField.setAccessible(true);
+            var sigSpi = sigSpiField.get(signature);
+
+            var tokenField = sigSpi.getClass().getDeclaredField("token");
+            tokenField.setAccessible(true);
+            var token = tokenField.get(sigSpi);
+
+            var p11Field = token.getClass().getDeclaredField("p11");
+            p11Field.setAccessible(true);
+            var p11 = p11Field.get(token);
+
+            return (PKCS11) p11;
+        } catch (NoSuchFieldException | IllegalAccessException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    // copy & paste just to call overridden private sign method
+    @Override
+    public SignatureValue sign(ToBeSigned toBeSigned, SignatureAlgorithm signatureAlgorithm, DSSPrivateKeyEntry keyEntry) throws DSSException {
+        assertEncryptionAlgorithmValid(signatureAlgorithm, keyEntry);
+
+        final String javaSignatureAlgorithm = signatureAlgorithm.getJCEId();
+        final byte[] bytes = toBeSigned.getBytes();
+        AlgorithmParameterSpec param = null;
+        if (signatureAlgorithm.getMaskGenerationFunction() != null) {
+            param = createPSSParam(signatureAlgorithm.getDigestAlgorithm());
+        }
+
+        try {
+            final byte[] signatureValue = sign(bytes, javaSignatureAlgorithm, param, keyEntry);
+            SignatureValue value = new SignatureValue();
+            value.setAlgorithm(signatureAlgorithm);
+            value.setValue(signatureValue);
+            return value;
+        } catch (Exception e) {
+            throw new DSSException(String.format("Unable to sign : %s", e.getMessage()), e);
+        }
+    }
+
+    // copy & paste
+    private void assertEncryptionAlgorithmValid(SignatureAlgorithm signatureAlgorithm, DSSPrivateKeyEntry keyEntry) {
+        Objects.requireNonNull(signatureAlgorithm, "SignatureAlgorithm shall be provided.");
+        Objects.requireNonNull(signatureAlgorithm.getEncryptionAlgorithm(), "EncryptionAlgorithm shall be provided within the SignatureAlgorithm.");
+        Objects.requireNonNull(keyEntry, "keyEntry shall be provided.");
+        if (!signatureAlgorithm.getEncryptionAlgorithm().isEquivalent(keyEntry.getEncryptionAlgorithm())) {
+            throw new IllegalArgumentException(String.format("The provided SignatureAlgorithm '%s' cannot be used to sign with " +
+                    "the token's implied EncryptionAlgorithm '%s'", signatureAlgorithm.getName(), keyEntry.getEncryptionAlgorithm().getName()));
+        }
+    }
+}
diff --git a/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java b/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
index add8d3f5..afb58931 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
@@ -14,6 +14,6 @@ public PKCS11TokenDriver(String name, Path path, boolean needsPassword, String s
 
     @Override
     public AbstractKeyStoreTokenConnection createTokenWithPassword(Integer slotId, char[] password) {
-        return new Pkcs11SignatureToken(getPath().toString(), new PrefilledPasswordCallback(new KeyStore.PasswordProtection(password)), -1, slotId, null);
+        return new NativePkcs11SignatureToken(getPath().toString(), new PrefilledPasswordCallback(new KeyStore.PasswordProtection(password)), -1, slotId);
     }
 }

From 9ad58382b51cb84d01ab665c8e6e0b8753228ecd Mon Sep 17 00:00:00 2001
From: Jan Suchal <jan.suchal@slovensko.digital>
Date: Tue, 21 Nov 2023 16:01:50 +0100
Subject: [PATCH 03/10] Cleanup a bit

---
 .../slovensko/autogram/drivers/NativePkcs11SignatureToken.java | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
index 535a6801..74ea7f11 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -72,9 +72,6 @@ private void runContextSpecificLogin(Signature signature, PrivateKey pk, char[]
         try {
             var p11 = getP11(signature);
             var sessionId = getSessionId(signature);
-            var attrs = new CK_ATTRIBUTE[]{new CK_ATTRIBUTE(PKCS11Constants.CKA_ALWAYS_AUTHENTICATE)};
-            var keyID = getKeyID(pk);
-            p11.C_GetAttributeValue(sessionId, keyID, attrs); // TODO cache this?
 
             p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, pin);
         } catch (PKCS11Exception e) {

From 161d9a99164e65a4d3b0fa41ef49f0f40883df9b Mon Sep 17 00:00:00 2001
From: Jan Suchal <jan.suchal@slovensko.digital>
Date: Tue, 21 Nov 2023 16:10:50 +0100
Subject: [PATCH 04/10] Fix tests

---
 pom.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 94ca6ad8..5c797154 100644
--- a/pom.xml
+++ b/pom.xml
@@ -193,11 +193,16 @@
                 <version>3.11.0</version>
 
                 <configuration>
-                    <release>${java.version}</release>
                     <fork>true</fork>
                     <executable>${jlink.jdk.path}${file.separator}bin${file.separator}javac</executable>
                     <source>17</source>
                     <target>17</target>
+                    <compilerArgs>
+                        <arg>--add-exports</arg>
+                        <arg>jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED</arg>
+                        <arg>--add-modules</arg>
+                        <arg>jdk.crypto.cryptoki</arg>
+                    </compilerArgs>
                 </configuration>
             </plugin>
 

From e7c7bcd01f27129e8b9167429bd20e789de285e2 Mon Sep 17 00:00:00 2001
From: Jan Suchal <jan.suchal@slovensko.digital>
Date: Tue, 21 Nov 2023 16:24:41 +0100
Subject: [PATCH 05/10] Refactor a bit

---
 .../drivers/NativePkcs11SignatureToken.java   | 33 ++++++++-----------
 1 file changed, 13 insertions(+), 20 deletions(-)

diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
index 74ea7f11..8d667899 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -39,17 +39,14 @@ private byte[] sign(final byte[] bytes, final String javaSignatureAlgorithm, fin
         var pk = ((KSPrivateKeyEntry) keyEntry).getPrivateKey();
 
         signature.initSign(pk);
-        if (isAlwaysAuthenticate(signature, pk)) {
-            var pin = "123456".toCharArray(); // TODO actually get this somehow from password protection
-            runContextSpecificLogin(signature, pk, pin);
-        }
+        runContextSpecificLoginIfNeeded(signature, pk);
         signature.update(bytes);
         return signature.sign();
     }
 
-    private boolean isAlwaysAuthenticate(Signature signature, PrivateKey pk) {
-        // TODO cache this?
+    private void runContextSpecificLoginIfNeeded(Signature signature, PrivateKey pk) throws GeneralSecurityException {
         try {
+            // TODO cache & short-circuit
             var p11 = getP11(signature);
             var sessionId = getSessionId(signature);
             var keyID = getKeyID(pk);
@@ -57,25 +54,21 @@ private boolean isAlwaysAuthenticate(Signature signature, PrivateKey pk) {
 
             p11.C_GetAttributeValue(sessionId, keyID, attrs);
 
-            var result = attrs[0].pValue;
-            if (result instanceof byte[]) {
-                return ((byte[]) result)[0] == 1;
-            } else {
-                return false; // CKA_ALWAYS_AUTHENTICATE not found
+            if (isAlwaysAuthenticate(attrs)) {
+                var pin = "123456".toCharArray(); // TODO actually get this somehow from password protection
+                p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, pin);
             }
         } catch (PKCS11Exception e) {
-            throw new RuntimeException(e);
+            throw new GeneralSecurityException(e);
         }
     }
 
-    private void runContextSpecificLogin(Signature signature, PrivateKey pk, char[] pin) throws GeneralSecurityException {
-        try {
-            var p11 = getP11(signature);
-            var sessionId = getSessionId(signature);
-
-            p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, pin);
-        } catch (PKCS11Exception e) {
-            throw new GeneralSecurityException(e);
+    private static boolean isAlwaysAuthenticate(CK_ATTRIBUTE[] attrs) {
+        var result = attrs[0].pValue;
+        if (result instanceof byte[]) {
+            return ((byte[]) result)[0] == 1;
+        } else {
+            return false; // CKA_ALWAYS_AUTHENTICATE not found
         }
     }
 

From f8fd6c161529864911f14d6b24d8fd007ccf0519 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Ce=C4=BEuch?= <celuchmarek@gmail.com>
Date: Tue, 21 Nov 2023 16:48:55 +0100
Subject: [PATCH 06/10] fix slotIndex usage

---
 .../autogram/drivers/NativePkcs11SignatureToken.java          | 4 ++--
 .../digital/slovensko/autogram/drivers/PKCS11TokenDriver.java | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
index 8d667899..e29b9f50 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -23,8 +23,8 @@
 public class NativePkcs11SignatureToken extends Pkcs11SignatureToken {
     private static final long CKU_CONTEXT_SPECIFIC = 2L;
 
-    public NativePkcs11SignatureToken(String pkcsPath, PrefilledPasswordCallback prefilledPasswordCallback, int slotId, Integer bogus) {
-        super(pkcsPath, prefilledPasswordCallback, slotId, null);
+    public NativePkcs11SignatureToken(String pkcsPath, PrefilledPasswordCallback prefilledPasswordCallback, int slotIndex) {
+        super(pkcsPath, prefilledPasswordCallback, -1, slotIndex, null);
     }
 
     private byte[] sign(final byte[] bytes, final String javaSignatureAlgorithm, final AlgorithmParameterSpec param, final DSSPrivateKeyEntry keyEntry) throws GeneralSecurityException {
diff --git a/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java b/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
index afb58931..841e5c54 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
@@ -13,7 +13,7 @@ public PKCS11TokenDriver(String name, Path path, boolean needsPassword, String s
     }
 
     @Override
-    public AbstractKeyStoreTokenConnection createTokenWithPassword(Integer slotId, char[] password) {
-        return new NativePkcs11SignatureToken(getPath().toString(), new PrefilledPasswordCallback(new KeyStore.PasswordProtection(password)), -1, slotId);
+    public AbstractKeyStoreTokenConnection createTokenWithPassword(Integer slotIndex, char[] password) {
+        return new NativePkcs11SignatureToken(getPath().toString(), new PrefilledPasswordCallback(new KeyStore.PasswordProtection(password)), slotIndex);
     }
 }

From 2be8d7e42a563ac82aceed9fc4986a76cd06571e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Ce=C4=BEuch?= <celuchmarek@gmail.com>
Date: Wed, 22 Nov 2023 09:42:30 +0100
Subject: [PATCH 07/10] use the same password for token and cka_A_A and provide
 it based on needsPassword

---
 .../drivers/NativePkcs11SignatureToken.java         | 13 +++++++++----
 .../autogram/drivers/PKCS11TokenDriver.java         |  4 ++--
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
index e29b9f50..09f59672 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -23,8 +23,14 @@
 public class NativePkcs11SignatureToken extends Pkcs11SignatureToken {
     private static final long CKU_CONTEXT_SPECIFIC = 2L;
 
-    public NativePkcs11SignatureToken(String pkcsPath, PrefilledPasswordCallback prefilledPasswordCallback, int slotIndex) {
+    private final PrefilledPasswordCallback prefilledPasswordCallback;
+    private final boolean shouldProvidePasswordForCkaAA;
+
+    public NativePkcs11SignatureToken(String pkcsPath, PrefilledPasswordCallback prefilledPasswordCallback, int slotIndex, boolean shouldProvidePasswordForCkaAA) {
         super(pkcsPath, prefilledPasswordCallback, -1, slotIndex, null);
+
+        this.prefilledPasswordCallback = prefilledPasswordCallback;
+        this.shouldProvidePasswordForCkaAA = shouldProvidePasswordForCkaAA;
     }
 
     private byte[] sign(final byte[] bytes, final String javaSignatureAlgorithm, final AlgorithmParameterSpec param, final DSSPrivateKeyEntry keyEntry) throws GeneralSecurityException {
@@ -54,9 +60,8 @@ private void runContextSpecificLoginIfNeeded(Signature signature, PrivateKey pk)
 
             p11.C_GetAttributeValue(sessionId, keyID, attrs);
 
-            if (isAlwaysAuthenticate(attrs)) {
-                var pin = "123456".toCharArray(); // TODO actually get this somehow from password protection
-                p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, pin);
+            if (shouldProvidePasswordForCkaAA && isAlwaysAuthenticate(attrs)) {
+                p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, prefilledPasswordCallback.getPassword());
             }
         } catch (PKCS11Exception e) {
             throw new GeneralSecurityException(e);
diff --git a/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java b/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
index 841e5c54..da83cdf3 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/PKCS11TokenDriver.java
@@ -1,7 +1,6 @@
 package digital.slovensko.autogram.drivers;
 
 import eu.europa.esig.dss.token.AbstractKeyStoreTokenConnection;
-import eu.europa.esig.dss.token.Pkcs11SignatureToken;
 import eu.europa.esig.dss.token.PrefilledPasswordCallback;
 
 import java.nio.file.Path;
@@ -14,6 +13,7 @@ public PKCS11TokenDriver(String name, Path path, boolean needsPassword, String s
 
     @Override
     public AbstractKeyStoreTokenConnection createTokenWithPassword(Integer slotIndex, char[] password) {
-        return new NativePkcs11SignatureToken(getPath().toString(), new PrefilledPasswordCallback(new KeyStore.PasswordProtection(password)), slotIndex);
+        // TODO: shouldProvidePasswordForCkaAA happens to correlate with needsPassword() for now, because eID is different. Might be changed in the future.
+        return new NativePkcs11SignatureToken(getPath().toString(), new PrefilledPasswordCallback(new KeyStore.PasswordProtection(password)), slotIndex, needsPassword());
     }
 }

From 18d1ecfd99fb43060f199200190fd765f2d76294 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Ce=C4=BEuch?= <celuchmarek@gmail.com>
Date: Wed, 22 Nov 2023 15:09:42 +0100
Subject: [PATCH 08/10] cancel batch sign if context_specific password is
 incorrect

---
 .run/Main.run.xml                             | 18 +++++++++++++-
 .../slovensko/autogram/core/Autogram.java     | 22 ++++++++++-------
 .../autogram/core/ResponderInBatch.java       |  4 ++++
 .../core/errors/AutogramException.java        |  2 ++
 .../errors/KeyPinDifferentFromTokenPin.java   |  7 ++++++
 .../drivers/NativePkcs11SignatureToken.java   | 12 +++++++---
 .../autogram/server/dto/ErrorResponse.java    |  1 +
 .../autogram/ui/BatchGuiFileResponder.java    |  1 +
 .../slovensko/autogram/ui/cli/CliUI.java      | 24 +++----------------
 .../slovensko/autogram/ui/gui/GUI.java        | 11 ++++-----
 10 files changed, 62 insertions(+), 40 deletions(-)
 create mode 100644 src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java

diff --git a/.run/Main.run.xml b/.run/Main.run.xml
index 0e7a99a1..172ac938 100644
--- a/.run/Main.run.xml
+++ b/.run/Main.run.xml
@@ -4,7 +4,23 @@
     <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="true" />
     <option name="MAIN_CLASS_NAME" value="digital.slovensko.autogram.Main" />
     <module name="autogram" />
-    <option name="PROGRAM_PARAMETERS" value="--url=autogram://listen?protocol=http&amp;host=localhost&amp;port=37200&amp;origin=*&amp;language=sk" />
+    <option name="VM_PARAMETERS" value="--add-exports jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED" />
+    <extension name="coverage">
+      <pattern>
+        <option name="PATTERN" value="digital.slovensko.autogram.ui.*" />
+        <option name="ENABLED" value="true" />
+      </pattern>
+    </extension>
+    <method v="2">
+      <option name="Make" enabled="true" />
+    </method>
+  </configuration>
+  <configuration default="false" name="CLI" type="Application" factoryName="Application" nameIsGenerated="true">
+    <option name="ALTERNATIVE_JRE_PATH" value="$PROJECT_DIR$/target/jdkCache/LIBERICA_jdk17.0.7+7_linux_amd64-full" />
+    <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="true" />
+    <option name="MAIN_CLASS_NAME" value="digital.slovensko.autogram.Main" />
+    <module name="autogram" />
+    <option name="PROGRAM_PARAMETERS" value="--cli -s pom.xml -t .autogram/pom_signed.asice --parents -d fake" />
     <option name="VM_PARAMETERS" value="--add-exports jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED" />
     <extension name="coverage">
       <pattern>
diff --git a/src/main/java/digital/slovensko/autogram/core/Autogram.java b/src/main/java/digital/slovensko/autogram/core/Autogram.java
index c4165c24..f2ae718d 100644
--- a/src/main/java/digital/slovensko/autogram/core/Autogram.java
+++ b/src/main/java/digital/slovensko/autogram/core/Autogram.java
@@ -1,10 +1,6 @@
 package digital.slovensko.autogram.core;
 
-import digital.slovensko.autogram.core.errors.AutogramException;
-import digital.slovensko.autogram.core.errors.BatchConflictException;
-import digital.slovensko.autogram.core.errors.BatchNotStartedException;
-import digital.slovensko.autogram.core.errors.ResponseNetworkErrorException;
-import digital.slovensko.autogram.core.errors.UnrecognizedException;
+import digital.slovensko.autogram.core.errors.*;
 import digital.slovensko.autogram.core.visualization.DocumentVisualizationBuilder;
 import digital.slovensko.autogram.core.visualization.UnsupportedVisualization;
 import digital.slovensko.autogram.drivers.TokenDriver;
@@ -103,12 +99,14 @@ public void sign(SigningJob job, SigningKey signingKey) {
             try {
                 job.signWithKeyAndRespond(signingKey);
                 ui.onUIThreadDo(() -> ui.onSigningSuccess(job));
+            } catch (ResponseNetworkErrorException e) {
+                onSigningFailed(e, job);
+            } catch (AutogramException e) {
+                onSigningFailed(e);
             } catch (DSSException e) {
                 onSigningFailed(AutogramException.createFromDSSException(e));
             } catch (IllegalArgumentException e) {
                 onSigningFailed(AutogramException.createFromIllegalArgumentException(e));
-            } catch (ResponseNetworkErrorException e) {
-                onSigningFailed(e, job);
             } catch (Exception e) {
                 onSigningFailed(new UnrecognizedException(e));
             }
@@ -145,7 +143,15 @@ public void batchSign(SigningJob job, String batchId) {
         batch.addJob(batchId);
 
         ui.onWorkThreadDo(() -> {
-            ui.signBatch(job, batch.getSigningKey());
+            try {
+                ui.signBatch(job, batch.getSigningKey());
+            } catch (KeyPinDifferentFromTokenPin e) {
+                ui.onUIThreadDo(() -> {
+                    ui.cancelBatch(batch);
+                });
+
+                throw e;
+            }
         });
     }
 
diff --git a/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java b/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java
index 74904276..6e42a25e 100644
--- a/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java
+++ b/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java
@@ -1,6 +1,7 @@
 package digital.slovensko.autogram.core;
 
 import digital.slovensko.autogram.core.errors.AutogramException;
+import digital.slovensko.autogram.core.errors.KeyPinDifferentFromTokenPin;
 
 public class ResponderInBatch extends Responder {
     private final Responder responder;
@@ -18,6 +19,9 @@ public void onDocumentSigned(SignedDocument signedDocument) {
 
     public void onDocumentSignFailed(AutogramException error) {
         batch.onJobFailure();
+        if (error instanceof KeyPinDifferentFromTokenPin)
+            batch.end();
+
         responder.onDocumentSignFailed(error);
     }
 }
diff --git a/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java b/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java
index 7686c484..0092975e 100644
--- a/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java
+++ b/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java
@@ -37,6 +37,8 @@ public String getDescription() {
     public static AutogramException createFromDSSException(DSSException e) {
         for (Throwable cause = e; cause != null && cause.getCause() != cause; cause = cause.getCause()) {
             if (cause.getMessage() != null) {
+                if (cause instanceof KeyPinDifferentFromTokenPin)
+                    return (KeyPinDifferentFromTokenPin) cause;
                 if (cause instanceof java.security.ProviderException && cause.getMessage().contains("slotListIndex is 0 but token only has 0 slots")) {
                     return new InitializationFailedException();
                 } else if (cause.getMessage().equals("CKR_FUNCTION_CANCELED")) {
diff --git a/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java b/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java
new file mode 100644
index 00000000..59c6cf93
--- /dev/null
+++ b/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java
@@ -0,0 +1,7 @@
+package digital.slovensko.autogram.core.errors;
+
+public class KeyPinDifferentFromTokenPin extends AutogramException {
+    public KeyPinDifferentFromTokenPin(Throwable e) {
+        super("Nepodporovaný PIN certifikátu", "PIN podpisového certifikátu je iný než PIN úložiska certifikátov. Ďalšie podpisovanie môže viesť k zablokovaniu karty!", "Použitý certifikát má nastavený atribút CKA_ALWAYS_AUTHENTICATE a jeho PIN je iný než PIN úložiska certifikátov. Toto zatiaľ nepodporujeme. Kontaktujte nás, prosím, na podpora@slovensko.digital", e);
+    }
+}
diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
index 09f59672..26b1485e 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -1,5 +1,7 @@
 package digital.slovensko.autogram.drivers;
 
+import digital.slovensko.autogram.core.errors.AutogramException;
+import digital.slovensko.autogram.core.errors.KeyPinDifferentFromTokenPin;
 import eu.europa.esig.dss.enumerations.SignatureAlgorithm;
 import eu.europa.esig.dss.model.DSSException;
 import eu.europa.esig.dss.model.SignatureValue;
@@ -59,11 +61,13 @@ private void runContextSpecificLoginIfNeeded(Signature signature, PrivateKey pk)
             var attrs = new CK_ATTRIBUTE[]{new CK_ATTRIBUTE(PKCS11Constants.CKA_ALWAYS_AUTHENTICATE)};
 
             p11.C_GetAttributeValue(sessionId, keyID, attrs);
-
-            if (shouldProvidePasswordForCkaAA && isAlwaysAuthenticate(attrs)) {
+            if (shouldProvidePasswordForCkaAA && isAlwaysAuthenticate(attrs))
                 p11.C_Login(sessionId, CKU_CONTEXT_SPECIFIC, prefilledPasswordCallback.getPassword());
-            }
+
         } catch (PKCS11Exception e) {
+            if (e.getMessage().equals("CKR_PIN_INCORRECT"))
+                throw new KeyPinDifferentFromTokenPin(e);
+
             throw new GeneralSecurityException(e);
         }
     }
@@ -149,6 +153,8 @@ public SignatureValue sign(ToBeSigned toBeSigned, SignatureAlgorithm signatureAl
             value.setAlgorithm(signatureAlgorithm);
             value.setValue(signatureValue);
             return value;
+        } catch (AutogramException e) {
+            throw e;
         } catch (Exception e) {
             throw new DSSException(String.format("Unable to sign : %s", e.getMessage()), e);
         }
diff --git a/src/main/java/digital/slovensko/autogram/server/dto/ErrorResponse.java b/src/main/java/digital/slovensko/autogram/server/dto/ErrorResponse.java
index f3e3e654..e2b91105 100644
--- a/src/main/java/digital/slovensko/autogram/server/dto/ErrorResponse.java
+++ b/src/main/java/digital/slovensko/autogram/server/dto/ErrorResponse.java
@@ -48,6 +48,7 @@ public static ErrorResponse buildFromException(Exception e) {
             case "BatchNotStartedException" -> new ErrorResponse(400, "BATCH_NOT_STARTED", (AutogramException) e);
             case "BatchInvalidIdException" -> new ErrorResponse(404, "BATCH_NOT_FOUND", (AutogramException) e);
             case "BatchConflictException" -> new ErrorResponse(400, "BATCH_CONFLICT", (AutogramException) e);
+            case "KeyPinDifferentFromTokenPin" -> new ErrorResponse(400, "CARD_NOT_SUPPORTED", (AutogramException) e);
             default -> new ErrorResponse(500, "INTERNAL_ERROR", "Unexpected exception signing document", e.getMessage());
         };
     }
diff --git a/src/main/java/digital/slovensko/autogram/ui/BatchGuiFileResponder.java b/src/main/java/digital/slovensko/autogram/ui/BatchGuiFileResponder.java
index cae70365..948994e5 100644
--- a/src/main/java/digital/slovensko/autogram/ui/BatchGuiFileResponder.java
+++ b/src/main/java/digital/slovensko/autogram/ui/BatchGuiFileResponder.java
@@ -63,6 +63,7 @@ public void onBatchStartSuccess(Batch batch) {
                 autogram.batchSign(job, batch.getBatchId());
             } catch (AutogramException e) {
                 autogram.onSigningFailed(e);
+
                 break;
             }
         }
diff --git a/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java b/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
index b142d940..d686ffaf 100644
--- a/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
+++ b/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
@@ -14,27 +14,7 @@
 import digital.slovensko.autogram.core.SigningKey;
 import digital.slovensko.autogram.core.Updater;
 import digital.slovensko.autogram.core.ValidationReports;
-import digital.slovensko.autogram.core.errors.AutogramException;
-import digital.slovensko.autogram.core.errors.FunctionCanceledException;
-import digital.slovensko.autogram.core.errors.InitializationFailedException;
-import digital.slovensko.autogram.core.errors.NoDriversDetectedException;
-import digital.slovensko.autogram.core.errors.NoKeysDetectedException;
-import digital.slovensko.autogram.core.errors.PDFAComplianceException;
-import digital.slovensko.autogram.core.errors.PDFSignatureLevelIsNotValidException;
-import digital.slovensko.autogram.core.errors.PINIncorrectException;
-import digital.slovensko.autogram.core.errors.PINLockedException;
-import digital.slovensko.autogram.core.errors.SigningCanceledByUserException;
-import digital.slovensko.autogram.core.errors.SigningWithExpiredCertificateException;
-import digital.slovensko.autogram.core.errors.SlotIdIsNotANumberException;
-import digital.slovensko.autogram.core.errors.SourceAndTargetTypeMismatchException;
-import digital.slovensko.autogram.core.errors.SourceDoesNotExistException;
-import digital.slovensko.autogram.core.errors.SourceNotDefindedException;
-import digital.slovensko.autogram.core.errors.TargetAlreadyExistsException;
-import digital.slovensko.autogram.core.errors.TargetDirectoryDoesNotExistException;
-import digital.slovensko.autogram.core.errors.TokenDriverDoesNotExistException;
-import digital.slovensko.autogram.core.errors.TokenNotRecognizedException;
-import digital.slovensko.autogram.core.errors.TokenRemovedException;
-import digital.slovensko.autogram.core.errors.UnableToCreateDirectoryException;
+import digital.slovensko.autogram.core.errors.*;
 import digital.slovensko.autogram.core.visualization.Visualization;
 import digital.slovensko.autogram.drivers.TokenDriver;
 import digital.slovensko.autogram.ui.BatchUiResult;
@@ -275,6 +255,8 @@ public void showError(AutogramException e) {
             errMessage = "Slot ID is not a number";
         } else if (e instanceof PDFSignatureLevelIsNotValidException) {
             errMessage = "PDF signature level is not valid";
+        } else if (e instanceof KeyPinDifferentFromTokenPin) {
+            errMessage = "PIN for signing key is different from card PIN. Not supported.";
         } else {
             errMessage = "Unknown error occurred";
             e.printStackTrace();
diff --git a/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java b/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
index 27742d0a..53590c0d 100644
--- a/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
+++ b/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
@@ -8,15 +8,10 @@
 import java.util.function.Consumer;
 
 import digital.slovensko.autogram.core.*;
+import digital.slovensko.autogram.core.errors.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import digital.slovensko.autogram.core.errors.AutogramException;
-import digital.slovensko.autogram.core.errors.NoDriversDetectedException;
-import digital.slovensko.autogram.core.errors.NoKeysDetectedException;
-import digital.slovensko.autogram.core.errors.NoValidKeysDetectedException;
-import digital.slovensko.autogram.core.errors.SigningCanceledByUserException;
-import digital.slovensko.autogram.core.errors.TokenRemovedException;
 import digital.slovensko.autogram.core.visualization.Visualization;
 import digital.slovensko.autogram.drivers.TokenDriver;
 import digital.slovensko.autogram.ui.BatchUiResult;
@@ -80,13 +75,15 @@ public void cancelBatch(Batch batch) {
     }
 
     @Override
-    public void signBatch(SigningJob job, SigningKey key) {
+    public void signBatch(SigningJob job, SigningKey key) throws KeyPinDifferentFromTokenPin {
         assertOnWorkThread();
         try {
             job.signWithKeyAndRespond(key);
             Logging.log("GUI: Signing batch job: " + job.hashCode() + " file " + job.getDocument().getName());
         } catch (AutogramException e) {
             job.onDocumentSignFailed(e);
+            if (e instanceof KeyPinDifferentFromTokenPin)
+                throw  e;
         } catch (DSSException e) {
             job.onDocumentSignFailed(AutogramException.createFromDSSException(e));
         } catch (Exception e) {

From f3a2be12e3796f70870cacdc1869fbf95761b304 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Ce=C4=BEuch?= <celuchmarek@gmail.com>
Date: Wed, 22 Nov 2023 15:56:42 +0100
Subject: [PATCH 09/10] add batchCanContinue to AutogramException and rename
 the new exception

---
 .../java/digital/slovensko/autogram/core/Autogram.java   | 2 +-
 .../slovensko/autogram/core/ResponderInBatch.java        | 3 +--
 .../autogram/core/errors/AutogramException.java          | 8 ++++++--
 ...in.java => KeyPinDifferentFromTokenPinException.java} | 9 +++++++--
 .../autogram/drivers/NativePkcs11SignatureToken.java     | 4 ++--
 .../java/digital/slovensko/autogram/ui/cli/CliUI.java    | 2 +-
 src/main/java/digital/slovensko/autogram/ui/gui/GUI.java | 4 ++--
 7 files changed, 20 insertions(+), 12 deletions(-)
 rename src/main/java/digital/slovensko/autogram/core/errors/{KeyPinDifferentFromTokenPin.java => KeyPinDifferentFromTokenPinException.java} (67%)

diff --git a/src/main/java/digital/slovensko/autogram/core/Autogram.java b/src/main/java/digital/slovensko/autogram/core/Autogram.java
index f2ae718d..5e9ce837 100644
--- a/src/main/java/digital/slovensko/autogram/core/Autogram.java
+++ b/src/main/java/digital/slovensko/autogram/core/Autogram.java
@@ -145,7 +145,7 @@ public void batchSign(SigningJob job, String batchId) {
         ui.onWorkThreadDo(() -> {
             try {
                 ui.signBatch(job, batch.getSigningKey());
-            } catch (KeyPinDifferentFromTokenPin e) {
+            } catch (KeyPinDifferentFromTokenPinException e) {
                 ui.onUIThreadDo(() -> {
                     ui.cancelBatch(batch);
                 });
diff --git a/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java b/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java
index 6e42a25e..b6ad9ad3 100644
--- a/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java
+++ b/src/main/java/digital/slovensko/autogram/core/ResponderInBatch.java
@@ -1,7 +1,6 @@
 package digital.slovensko.autogram.core;
 
 import digital.slovensko.autogram.core.errors.AutogramException;
-import digital.slovensko.autogram.core.errors.KeyPinDifferentFromTokenPin;
 
 public class ResponderInBatch extends Responder {
     private final Responder responder;
@@ -19,7 +18,7 @@ public void onDocumentSigned(SignedDocument signedDocument) {
 
     public void onDocumentSignFailed(AutogramException error) {
         batch.onJobFailure();
-        if (error instanceof KeyPinDifferentFromTokenPin)
+        if (!error.batchCanContinue())
             batch.end();
 
         responder.onDocumentSignFailed(error);
diff --git a/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java b/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java
index 0092975e..c268aa6d 100644
--- a/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java
+++ b/src/main/java/digital/slovensko/autogram/core/errors/AutogramException.java
@@ -37,8 +37,8 @@ public String getDescription() {
     public static AutogramException createFromDSSException(DSSException e) {
         for (Throwable cause = e; cause != null && cause.getCause() != cause; cause = cause.getCause()) {
             if (cause.getMessage() != null) {
-                if (cause instanceof KeyPinDifferentFromTokenPin)
-                    return (KeyPinDifferentFromTokenPin) cause;
+                if (cause instanceof KeyPinDifferentFromTokenPinException)
+                    return (KeyPinDifferentFromTokenPinException) cause;
                 if (cause instanceof java.security.ProviderException && cause.getMessage().contains("slotListIndex is 0 but token only has 0 slots")) {
                     return new InitializationFailedException();
                 } else if (cause.getMessage().equals("CKR_FUNCTION_CANCELED")) {
@@ -69,4 +69,8 @@ public static AutogramException createFromIllegalArgumentException(IllegalArgume
 
         return new UnrecognizedException(e);
     }
+
+    public boolean batchCanContinue() {
+        return true;
+    }
 }
diff --git a/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java b/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPinException.java
similarity index 67%
rename from src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java
rename to src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPinException.java
index 59c6cf93..f4d8bd03 100644
--- a/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPin.java
+++ b/src/main/java/digital/slovensko/autogram/core/errors/KeyPinDifferentFromTokenPinException.java
@@ -1,7 +1,12 @@
 package digital.slovensko.autogram.core.errors;
 
-public class KeyPinDifferentFromTokenPin extends AutogramException {
-    public KeyPinDifferentFromTokenPin(Throwable e) {
+public class KeyPinDifferentFromTokenPinException extends AutogramException {
+    public KeyPinDifferentFromTokenPinException(Throwable e) {
         super("Nepodporovaný PIN certifikátu", "PIN podpisového certifikátu je iný než PIN úložiska certifikátov. Ďalšie podpisovanie môže viesť k zablokovaniu karty!", "Použitý certifikát má nastavený atribút CKA_ALWAYS_AUTHENTICATE a jeho PIN je iný než PIN úložiska certifikátov. Toto zatiaľ nepodporujeme. Kontaktujte nás, prosím, na podpora@slovensko.digital", e);
     }
+
+    @Override
+    public boolean batchCanContinue() {
+        return false;
+    }
 }
diff --git a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
index 26b1485e..22880a2d 100644
--- a/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
+++ b/src/main/java/digital/slovensko/autogram/drivers/NativePkcs11SignatureToken.java
@@ -1,7 +1,7 @@
 package digital.slovensko.autogram.drivers;
 
 import digital.slovensko.autogram.core.errors.AutogramException;
-import digital.slovensko.autogram.core.errors.KeyPinDifferentFromTokenPin;
+import digital.slovensko.autogram.core.errors.KeyPinDifferentFromTokenPinException;
 import eu.europa.esig.dss.enumerations.SignatureAlgorithm;
 import eu.europa.esig.dss.model.DSSException;
 import eu.europa.esig.dss.model.SignatureValue;
@@ -66,7 +66,7 @@ private void runContextSpecificLoginIfNeeded(Signature signature, PrivateKey pk)
 
         } catch (PKCS11Exception e) {
             if (e.getMessage().equals("CKR_PIN_INCORRECT"))
-                throw new KeyPinDifferentFromTokenPin(e);
+                throw new KeyPinDifferentFromTokenPinException(e);
 
             throw new GeneralSecurityException(e);
         }
diff --git a/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java b/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
index d686ffaf..db27eb71 100644
--- a/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
+++ b/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
@@ -255,7 +255,7 @@ public void showError(AutogramException e) {
             errMessage = "Slot ID is not a number";
         } else if (e instanceof PDFSignatureLevelIsNotValidException) {
             errMessage = "PDF signature level is not valid";
-        } else if (e instanceof KeyPinDifferentFromTokenPin) {
+        } else if (e instanceof KeyPinDifferentFromTokenPinException) {
             errMessage = "PIN for signing key is different from card PIN. Not supported.";
         } else {
             errMessage = "Unknown error occurred";
diff --git a/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java b/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
index 53590c0d..54987478 100644
--- a/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
+++ b/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
@@ -75,14 +75,14 @@ public void cancelBatch(Batch batch) {
     }
 
     @Override
-    public void signBatch(SigningJob job, SigningKey key) throws KeyPinDifferentFromTokenPin {
+    public void signBatch(SigningJob job, SigningKey key) throws KeyPinDifferentFromTokenPinException {
         assertOnWorkThread();
         try {
             job.signWithKeyAndRespond(key);
             Logging.log("GUI: Signing batch job: " + job.hashCode() + " file " + job.getDocument().getName());
         } catch (AutogramException e) {
             job.onDocumentSignFailed(e);
-            if (e instanceof KeyPinDifferentFromTokenPin)
+            if (!e.batchCanContinue())
                 throw  e;
         } catch (DSSException e) {
             job.onDocumentSignFailed(AutogramException.createFromDSSException(e));

From bafd69a5dbaa495cd92f8e91dd7c00006dd693bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Ce=C4=BEuch?= <celuchmarek@gmail.com>
Date: Wed, 22 Nov 2023 17:31:33 +0100
Subject: [PATCH 10/10] add jvm args to package.sh

---
 pom.xml                     | 4 ++--
 src/main/scripts/package.sh | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 5c797154..10e98371 100644
--- a/pom.xml
+++ b/pom.xml
@@ -195,8 +195,8 @@
                 <configuration>
                     <fork>true</fork>
                     <executable>${jlink.jdk.path}${file.separator}bin${file.separator}javac</executable>
-                    <source>17</source>
-                    <target>17</target>
+                    <source>${java.version}</source>
+                    <target>${java.version}</target>
                     <compilerArgs>
                         <arg>--add-exports</arg>
                         <arg>jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED</arg>
diff --git a/src/main/scripts/package.sh b/src/main/scripts/package.sh
index f469da20..ab6c8c7d 100644
--- a/src/main/scripts/package.sh
+++ b/src/main/scripts/package.sh
@@ -27,7 +27,7 @@ while read -r key value; do
 done <"$resourcesDir/build.properties"
 unset IFS
 
-jvmOptions="-Dfile.encoding=UTF-8 -Dprism.maxvram=2G --add-exports javafx.graphics/com.sun.javafx.tk=ALL-UNNAMED"
+jvmOptions="-Dfile.encoding=UTF-8 -Dprism.maxvram=2G --add-exports javafx.graphics/com.sun.javafx.tk=ALL-UNNAMED --add-exports jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED"
 arguments=(
     "--input" "$appDirectory"
     "--runtime-image" "$jdkDirectory"