cool#10630 doc electronic sign: send the hash on the server #10672
Conversation
vmiklos
commented
Dec 6, 2024
vmiklos
commented
- cool#10630 doc electronic sign: expose the name of the document
- wsd: fix clang 18 -Werror,-Wvla-cxx-extension
- cool#10630 doc electronic sign: send the hash on the server
vmiklos
changed the title
|
https://cpci.cbg.collabora.co.uk:8080/job/github_android_app_co-24.04/2810/console fails because I forgot that it seems our mobile apps don't do any networking, so just put that inside a mobile ifdef for now. Perhaps as a next step it'll be useful to add a wsd/ClientSession-$PLATFORM.cpp similar to e.g. common/Util-mobile.cpp, to avoid the ifdefs. |
vmiklos
force-pushed
the
private/vmiklos/master
branch
from
86a9090 to
545163e
Compare
|
https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04/3660/console failed in unit-bad-doc-load, retry to see if this fails reliably. |
|
https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04/3661/consoleFull failed in unit-storage and unit-storage but both pass for me locally, retry. |
|
https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04/3662/consoleFull hmm, same failure here, retry. https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04/3665/console failed in unit-bad-doc-load. |
|
https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04_cypress_desktop/3112/console had 5 failures: impress/undo_redo_spec.js, writer/annotation_spec.js, writer/navigator_spec.js, writer/scrolling_spec.js and writer/searchbar_spec.js, retry to see if this is persistent. |
|
Ah, I could not reproduce the failure locally because my core was too old: https://gerrit.libreoffice.org/c/core/+/177957 is meant to help here. https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04/3672/console was the last try before that went in. https://cpci.cbg.collabora.co.uk:8080/job/github_online_master_debug_vs_co-24.04_cypress_desktop/3117/ was the last cypress desktop try before the core update. |
Open a PDF in Draw, insert -> esign, pick a provider which does 2FA (e.g. d-trust-sign-me-qes-signature), get a notification if you want to sign "document.pdf". So after all that fileName field in the hash send call does matter, it can show up when the user is asked to confirm the signing on an other device. Just test that the value we set looks reasonable since cypress tests use random file names, so asserting equality would be too strict. Signed-off-by: Miklos Vajna <[email protected]> Change-Id: Ia077e094aa7fb945844c63d89becc7c241f27ec1
Similar to commit c93f597 (net: fix clang 18 -Werror,-Wvla-cxx-extension, 2024-12-05), this was the last variable length array in the code. Signed-off-by: Miklos Vajna <[email protected]> Change-Id: I1151da0ccbd788e12f990e29d80df96f453cbbaf
I missed this so far, but <https://docs.eideasy.com/guide/api-credentials.html> suggests that the the API calls the require a secret (and not just the client ID) has to be performed on the server, so the secret can be kept there. Add a new .uno:PrepareSignature UNO command that performs the API call on the server and generates a command result; so the new setup is quite similar to the old fetch() API which did a HTTP request in the browser and also had a callback. This requires adapting the cypress test that used to intercept network calls via cy.intercept(). Now we want to intercept traffic on the websocket instead. This seems to be possible by using <https://docs.cypress.io/api/commands/fixture> to load test data, then <https://docs.cypress.io/api/commands/stub> to intercept sending a specific UNO command, finally using the underlying <https://sinonjs.org/releases/latest/stubs/#stubcallthrough> to leave the rest of the UNO commands unchanged. The other problematic "download signature" step is not yet changed here. Signed-off-by: Miklos Vajna <[email protected]> Change-Id: I84e7eee60fe9dc6e620cd71f8b85a086a0d08c4c
vmiklos
force-pushed
the
private/vmiklos/master
branch
from
545163e to
735a0d1
Compare
|
After rebase:
|
|
@caolanm could you please review this? Thanks. The point is that the credentials are a pair of client ID + secret, so secret is needed to initiate a sign (which has costs; results in a "document ID"), but the browser can do the signing without the secret now. This will also allow undoing the CSP rules for that specific domain, which I always disliked. The CI is still in a bad shape, but this one at least passed now. |
