Merge pull request #297 from solver-it-sro/AG-6/display-expired-key-e…

…rror AG-6 Add invalid certificate warning to certificate picker
slovensko-digital · Oct 12, 2023 · 70b9b6b · 70b9b6b
2 parents 427dd35 + 02cc0dd
commit 70b9b6b
Show file tree

Hide file tree

Showing 13 changed files with 150 additions and 71 deletions.
diff --git a/src/main/java/digital/slovensko/autogram/core/SigningJob.java b/src/main/java/digital/slovensko/autogram/core/SigningJob.java
@@ -80,6 +80,7 @@ private DSSDocument signDocumentAsCAdeS(SigningKey key) {
 
         signatureParameters.setSigningCertificate(key.getCertificate());
         signatureParameters.setCertificateChain(key.getCertificateChain());
+        signatureParameters.setSignWithExpiredCertificate(true);
 
         var dataToSign = service.getDataToSign(getDocument(), signatureParameters);
         var signatureValue = key.sign(dataToSign, jobParameters.getDigestAlgorithm());
@@ -102,6 +103,7 @@ private DSSDocument signDocumentAsAsiCWithXAdeS(SigningKey key) {
 
         signatureParameters.setSigningCertificate(key.getCertificate());
         signatureParameters.setCertificateChain(key.getCertificateChain());
+        signatureParameters.setSignWithExpiredCertificate(true);
 
         var dataToSign = service.getDataToSign(doc, signatureParameters);
         var signatureValue = key.sign(dataToSign, getParameters().getDigestAlgorithm());
@@ -117,6 +119,7 @@ private DSSDocument signDocumentAsXAdeS(SigningKey key) {
 
         signatureParameters.setSigningCertificate(key.getCertificate());
         signatureParameters.setCertificateChain(key.getCertificateChain());
+        signatureParameters.setSignWithExpiredCertificate(true);
 
         var dataToSign = service.getDataToSign(getDocument(), signatureParameters);
         var signatureValue = key.sign(dataToSign, jobParameters.getDigestAlgorithm());
@@ -132,6 +135,7 @@ private DSSDocument signDocumentAsASiCWithCAdeS(SigningKey key) {
 
         signatureParameters.setSigningCertificate(key.getCertificate());
         signatureParameters.setCertificateChain(key.getCertificateChain());
+        signatureParameters.setSignWithExpiredCertificate(true);
 
         var dataToSign = service.getDataToSign(getDocument(), signatureParameters);
         var signatureValue = key.sign(dataToSign, jobParameters.getDigestAlgorithm());
@@ -147,6 +151,7 @@ private DSSDocument signDocumentAsPAdeS(SigningKey key) {
 
         signatureParameters.setSigningCertificate(key.getCertificate());
         signatureParameters.setCertificateChain(key.getCertificateChain());
+        signatureParameters.setSignWithExpiredCertificate(true);
 
         var dataToSign = service.getDataToSign(getDocument(), signatureParameters);
         var signatureValue = key.sign(dataToSign, jobParameters.getDigestAlgorithm());

diff --git a/src/main/java/digital/slovensko/autogram/core/UserSettings.java b/src/main/java/digital/slovensko/autogram/core/UserSettings.java
@@ -18,12 +18,13 @@ public class UserSettings {
     private boolean signaturesValidity;
     private boolean pdfaCompliance;
     private boolean serverEnabled;
+    private boolean expiredCertsEnabled;
     private List<String> trustedList;
 
     private UserSettings(SignatureLevel signatureLevel, String driver, boolean en319132,
             boolean signIndividually, boolean correctDocumentDisplay,
             boolean signaturesValidity, boolean pdfaCompliance,
-            boolean serverEnabled, List<String> trustedList) {
+            boolean serverEnabled, boolean expiredCertsEnabled, List<String> trustedList) {
         this.signatureLevel = signatureLevel;
         this.driver = driver;
         this.en319132 = en319132;
@@ -32,6 +33,7 @@ private UserSettings(SignatureLevel signatureLevel, String driver, boolean en319
         this.signaturesValidity = signaturesValidity;
         this.pdfaCompliance = pdfaCompliance;
         this.serverEnabled = serverEnabled;
+        this.expiredCertsEnabled = expiredCertsEnabled;
         this.trustedList = trustedList;
     }
 
@@ -46,6 +48,7 @@ public static UserSettings load() {
         var signaturesValidity = prefs.getBoolean("SIGNATURES_VALIDITY", true);
         var pdfaCompliance = prefs.getBoolean("PDFA_COMPLIANCE", true);
         var serverEnabled = prefs.getBoolean("SERVER_ENABLED", true);
+        var expiredCertsEnabled = prefs.getBoolean("EXPIRED_CERTS_ENABLED", false);
         var trustedList = prefs.get("TRUSTED_LIST", "SK,CZ,AT,PL,HU");
 
         var signatureLevelStringConverter = new SignatureLevelStringConverter();
@@ -65,6 +68,7 @@ public static UserSettings load() {
                 signaturesValidity,
                 pdfaCompliance,
                 serverEnabled,
+                expiredCertsEnabled,
                 trustedList == null ? new ArrayList<>() : new ArrayList<>(List.of(trustedList.split(","))));
     }
 
@@ -144,6 +148,15 @@ public void setServerEnabled(boolean serverEnabled) {
         save();
     }
 
+    public boolean isExpiredCertsEnabled() {
+        return expiredCertsEnabled;
+    }
+
+    public void setExpiredCertsEnabled(boolean expiredCertsEnabled) {
+        this.expiredCertsEnabled = expiredCertsEnabled;
+        save();
+    }
+
     public List<String> getTrustedList() {
         return trustedList;
     }
@@ -169,6 +182,7 @@ private void save() {
         prefs.putBoolean("SIGNATURES_VALIDITY", signaturesValidity);
         prefs.putBoolean("PDFA_COMPLIANCE", pdfaCompliance);
         prefs.putBoolean("SERVER_ENABLED", serverEnabled);
+        prefs.putBoolean("EXPIRED_CERTS_ENABLED", expiredCertsEnabled);
         prefs.put("TRUSTED_LIST", trustedList.stream().collect(Collectors.joining(",")));
     }
 }
diff --git a/src/main/java/digital/slovensko/autogram/core/errors/NoKeysDetectedException.java b/src/main/java/digital/slovensko/autogram/core/errors/NoKeysDetectedException.java
@@ -2,6 +2,6 @@
 
 public class NoKeysDetectedException extends AutogramException {
     public NoKeysDetectedException() {
-        super("Nastala chyba", "Nenašli sa žiadne podpisové klúče", "Na karte sa pravdepodobne nenachádzajú žiadne klúče, ktoré by sa dali použiť na podpisovanie.\n\nV prípade nového občianskeho preukazu to môže znamenať, že si potrebujete certifikáty na podpisovanie cez občiansky preukaz vydať. Robí sa to pomocou eID klienta.", null);
+        super("Nastala chyba", "Nenašli sa žiadne podpisové certifikáty", "V úložisku certifikátov sa pravdepodobne nenachádzajú žiadne platné podpisové certifikáty, ktoré by sa dali použiť na podpisovanie.\n\nV prípade nového občianskeho preukazu to môže znamenať, že si potrebujete certifikáty na podpisovanie cez občiansky preukaz vydať. Robí sa to pomocou obslužného softvéru eID klient.", null);
     }
 }
diff --git a/src/main/java/digital/slovensko/autogram/core/errors/NoValidKeysDetectedException.java b/src/main/java/digital/slovensko/autogram/core/errors/NoValidKeysDetectedException.java
@@ -0,0 +1,7 @@
+package digital.slovensko.autogram.core.errors;
+
+public class NoValidKeysDetectedException extends AutogramException {
+    public NoValidKeysDetectedException() {
+        super("Nastala chyba", "Nenašli sa žiadne platné podpisové certifikáty", "V úložisku certifikátov sa pravdepodobne nenachádzajú žiadne platné podpisové certifikáty, ktoré by sa dali použiť na podpisovanie. Boli však nájdené ekspirované certifikáty, ktorými je možné podpisovať až po zmene v nastaveniach.\n\nV prípade nového občianskeho preukazu to môže znamenať, že si potrebujete certifikáty na podpisovanie cez občiansky preukaz vydať. Robí sa to pomocou obslužného softvéru eID klient.", null);
+    }
+}
diff --git a/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java b/src/main/java/digital/slovensko/autogram/ui/cli/CliUI.java
@@ -130,15 +130,17 @@ public void pickKeyAndThen(List<DSSPrivateKeyEntry> keys, Consumer<DSSPrivateKey
             return;
         }
 
-        var i = new AtomicInteger(1);
         System.out.println("Pick Key:");
-        keys.forEach(key -> {
-            System.out.print("[" + i + "] ");
-            System.out.println(parseCN(key.getCertificate().getSubject().getRFC2253()));
-            i.addAndGet(1);
-        });
-        var pickedKey = keys.get(CliUtils.readInteger() - 1);
+        var i = 1;
+        for (var key : keys) {
+            var keyText = parseCN(key.getCertificate().getSubject().getRFC2253());
+            if (!key.getCertificate().isValidOn(new java.util.Date()))
+                keyText += " (expired certificate)";
+
+            System.out.println("[" + i++ + "] " + keyText);
+        }
 
+        var pickedKey = keys.get(CliUtils.readInteger() - 1);
         callback.accept(pickedKey);
     }
 

diff --git a/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java b/src/main/java/digital/slovensko/autogram/ui/gui/GUI.java
@@ -14,6 +14,7 @@
 import digital.slovensko.autogram.core.errors.AutogramException;
 import digital.slovensko.autogram.core.errors.NoDriversDetectedException;
 import digital.slovensko.autogram.core.errors.NoKeysDetectedException;
+import digital.slovensko.autogram.core.errors.NoValidKeysDetectedException;
 import digital.slovensko.autogram.core.errors.SigningCanceledByUserException;
 import digital.slovensko.autogram.core.errors.TokenRemovedException;
 import digital.slovensko.autogram.core.visualization.Visualization;
@@ -178,7 +179,18 @@ public void pickKeyAndThen(List<DSSPrivateKeyEntry> keys, Consumer<DSSPrivateKey
             return;
         }
 
-        var controller = new PickKeyDialogController(keys, callback);
+        if (!userSettings.isExpiredCertsEnabled())
+            keys = keys.stream().filter(k -> k.getCertificate().isValidOn(new java.util.Date())).toList();
+
+        if (keys.isEmpty()) {
+            showError(new NoValidKeysDetectedException());
+            refreshKeyOnAllJobs();
+            enableSigningOnAllJobs();
+
+            return;
+        }
+
+        var controller = new PickKeyDialogController(keys, callback, userSettings.isExpiredCertsEnabled());
         var root = GUIUtils.loadFXML(controller, "pick-key-dialog.fxml");
 
         var stage = new Stage();

diff --git a/src/main/java/digital/slovensko/autogram/ui/gui/PickKeyDialogController.java b/src/main/java/digital/slovensko/autogram/ui/gui/PickKeyDialogController.java
@@ -3,9 +3,11 @@
 import eu.europa.esig.dss.token.DSSPrivateKeyEntry;
 import javafx.event.ActionEvent;
 import javafx.fxml.FXML;
+import javafx.scene.Node;
 import javafx.scene.control.RadioButton;
 import javafx.scene.control.ToggleGroup;
 import javafx.scene.control.Tooltip;
+import javafx.scene.layout.HBox;
 import javafx.scene.layout.VBox;
 import javafx.scene.text.Text;
 import javafx.util.Duration;
@@ -19,6 +21,7 @@
 public class PickKeyDialogController {
     private final Consumer<DSSPrivateKeyEntry> callback;
     private final List<DSSPrivateKeyEntry> keys;
+    private final boolean expiredCertsEnabled;
 
     @FXML
     VBox formGroup;
@@ -31,20 +34,29 @@ public class PickKeyDialogController {
     private ToggleGroup toggleGroup;
 
 
-    public PickKeyDialogController(List<DSSPrivateKeyEntry> keys, Consumer<DSSPrivateKeyEntry> callback) {
+    public PickKeyDialogController(List<DSSPrivateKeyEntry> keys, Consumer<DSSPrivateKeyEntry> callback, boolean expiredCertsEnabled) {
         this.keys = keys;
         this.callback = callback;
+        this.expiredCertsEnabled = expiredCertsEnabled;
     }
 
     public void initialize() {
         toggleGroup = new ToggleGroup();
-        for (DSSPrivateKeyEntry key : keys) {
+        for (var key : keys) {
+            Node badge = new HBox();
+            if (!key.getCertificate().isValidOn(new java.util.Date())) {
+                badge = SignatureBadgeFactory.createInfoBadge("Ekspirovaný certifikát");
+
+                if (!expiredCertsEnabled)
+                    continue;
+            }
+
             var radioButton = new RadioButton(parseCN(key.getCertificate().getSubject().getRFC2253()));
             radioButton.setToggleGroup(toggleGroup);
             radioButton.setUserData(key);
-            radios.getChildren().add(radioButton);
+            radios.getChildren().add(new HBox(radioButton, badge));
 
-            Tooltip tooltip = new Tooltip(buildTooltipLabel(key));
+            var tooltip = new Tooltip(buildTooltipLabel(key));
             tooltip.setShowDuration(Duration.seconds(10));
             tooltip.setWrapText(true);
             tooltip.setPrefWidth(400);

diff --git a/src/main/java/digital/slovensko/autogram/ui/gui/SettingsDialogController.java b/src/main/java/digital/slovensko/autogram/ui/gui/SettingsDialogController.java
@@ -35,6 +35,8 @@ public class SettingsDialogController {
     @FXML
     private HBox checkPDFAComplianceRadios;
     @FXML
+    private HBox expiredCertsRadios;
+    @FXML
     private HBox localServerEnabledRadios;
     @FXML
     private Button saveButton;
@@ -54,6 +56,7 @@ public void initialize() {
         initializeCorrectDocumentDisplayCheckBox();
         initializeSignatureValidationCheckBox();
         initializeCheckPDFAComplianceCheckBox();
+        initializeExpiredCertsEnabledCheckBox();
         initializeLocalServerEnabledCheckBox();
         initializeTrustedCountriesList();
     }
@@ -128,6 +131,11 @@ private void initializeCheckPDFAComplianceCheckBox() {
                 userSettings.isPdfaCompliance());
     }
 
+    private void initializeExpiredCertsEnabledCheckBox() {
+        initializeBooleanRadios(expiredCertsRadios, t -> userSettings.setExpiredCertsEnabled(t),
+                userSettings.isExpiredCertsEnabled());
+    }
+
     private void initializeLocalServerEnabledCheckBox() {
         initializeBooleanRadios(localServerEnabledRadios, t -> userSettings.setServerEnabled(t),
                 userSettings.isServerEnabled());

diff --git a/src/main/java/digital/slovensko/autogram/ui/gui/SignatureBadgeFactory.java b/src/main/java/digital/slovensko/autogram/ui/gui/SignatureBadgeFactory.java
@@ -46,6 +46,10 @@ public static Node createWarningBadge(String label) {
         return createBadge(label, "autogram-tag-warning");
     }
 
+    public static Node createInfoBadge(String label) {
+        return createBadge(label, "autogram-tag-info");
+    }
+
     public static Node createBadgeFromQualification(SignatureQualification qualification) {
         if (qualification == null)
             return createInProgressBadge();

diff --git a/src/main/resources/digital/slovensko/autogram/ui/gui/idsk.css b/src/main/resources/digital/slovensko/autogram/ui/gui/idsk.css
@@ -618,18 +618,17 @@ TextFlow.autogram-body-s {
   -fx-padding: 0 -1em 0 0;
 }
 
-.autogram-settings-tab-pane AnchorPane {
+.autogram-settings-tab-pane ScrollPane {
   -fx-border-color: -autogram-input-border-colour;
   -fx-border-width: 1px;
-  -fx-max-width: 52em;
-  -fx-min-width: 52em;
+  -fx-max-height: 560px;
+  -fx-hbar-policy: never;
 }
 
-.autogram-settings-tab-pane AnchorPane > VBox,
-  .autogram-settings-tab-pane .container {
-  -fx-padding: 2em;
-  -fx-max-width: 52em;
-  -fx-min-width: 52em;
+.autogram-settings-tab-pane ScrollPane .container {
+  -fx-padding: 2em 0 2em 2em;
+  -fx-max-width: 50em;
+  -fx-min-width: 50em;
 }
 
 .autogram-settings-row {
@@ -882,6 +881,11 @@ TextFlow.autogram-body-s {
   -fx-spacing: 10px;
 }
 
+.autogram-radios HBox {
+  -fx-spacing: 1em;
+  -fx-alignment: center-left;
+}
+
 .autogram-actions {
   -fx-spacing: 15px;
   -fx-alignment: center-left;
@@ -998,6 +1002,11 @@ TextFlow.autogram-body-s {
   -fx-border-color: #FFF7BF;
 }
 
+.autogram-tag-info {
+  -fx-background-color: #eeefef;
+  -fx-border-color: #eeefef;
+}
+
 .autogram-tag-processing Text {
   -fx-text-fill: #144E81;
   -fx-fill: #144E81;
@@ -1028,6 +1037,11 @@ TextFlow.autogram-body-s {
   -fx-fill: #594D00;
 }
 
+.autogram-tag-info Text {
+  -fx-text-fill: #383f43;
+  -fx-fill: #383f43;
+}
+
 .autogram-progress-bar {
     -fx-border-color: -autogram-input-border-colour;
     /* -fx-background-color: -autogram-focus-colour; */

diff --git a/src/main/resources/digital/slovensko/autogram/ui/gui/pick-key-dialog.fxml b/src/main/resources/digital/slovensko/autogram/ui/gui/pick-key-dialog.fxml
@@ -6,7 +6,7 @@
 <?import javafx.scene.text.TextFlow?>
 <VBox xmlns="http://javafx.com/javafx"
       xmlns:fx="http://javafx.com/fxml"
-      prefHeight="200" prefWidth="450" minWidth="450"
+      prefHeight="200" prefWidth="600"
       fx:id="mainBox">
 
     <VBox fx:id="formGroup" styleClass="autogram-form-group">