From a770c10b86e77ef0e01f1b5c3db7b6eb70e34c5a Mon Sep 17 00:00:00 2001
From: Laurent-Corron <laurent.corron@acsone.eu>
Date: Wed, 30 Jun 2021 10:22:39 +0200
Subject: [PATCH] [IMP] report_qweb_signer add endesive

---
 report_qweb_signer/__manifest__.py            |  2 +-
 .../demo/report_certificate_demo.xml          |  1 +
 .../models/ir_actions_report.py               | 72 +++++++++++++++----
 .../models/report_certificate.py              | 17 +++++
 .../views/report_certificate_view.xml         | 17 +++++
 requirements.txt                              |  2 +
 6 files changed, 96 insertions(+), 15 deletions(-)

diff --git a/report_qweb_signer/__manifest__.py b/report_qweb_signer/__manifest__.py
index bcb67ffd5..99674868c 100644
--- a/report_qweb_signer/__manifest__.py
+++ b/report_qweb_signer/__manifest__.py
@@ -13,7 +13,7 @@
     "license": "AGPL-3",
     "installable": True,
     "depends": ["web_editor"],
-    "external_dependencies": {"bin": ["/usr/bin/java"]},
+    "external_dependencies": {"python": ["endesive", "cryptography"]},
     "data": [
         "data/defaults.xml",
         "security/ir.model.access.csv",
diff --git a/report_qweb_signer/demo/report_certificate_demo.xml b/report_qweb_signer/demo/report_certificate_demo.xml
index 65542ecfb..8d8257d6d 100644
--- a/report_qweb_signer/demo/report_certificate_demo.xml
+++ b/report_qweb_signer/demo/report_certificate_demo.xml
@@ -10,6 +10,7 @@ License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html).
         <field name="name">Test OCA certificate</field>
         <field name="path">test.p12</field>
         <field name="password_file">test.passwd</field>
+        <field name="signing_method">java</field>
         <field name="model_id" ref="base.model_res_partner" />
         <field name="allow_only_one" eval="True" />
         <field
diff --git a/report_qweb_signer/models/ir_actions_report.py b/report_qweb_signer/models/ir_actions_report.py
index 771ae0f04..4db4237c7 100644
--- a/report_qweb_signer/models/ir_actions_report.py
+++ b/report_qweb_signer/models/ir_actions_report.py
@@ -3,6 +3,7 @@
 # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html).
 
 import base64
+import datetime
 import logging
 import os
 import subprocess
@@ -10,6 +11,10 @@ import tempfile
 import time
 from contextlib import closing
 
+from cryptography.hazmat import backends
+from cryptography.hazmat.primitives.serialization import pkcs12
+from endesive import pdf
+
 from odoo import _, models
 from odoo.exceptions import AccessError, UserError
 from odoo.tools.safe_eval import safe_eval
@@ -120,28 +125,67 @@ class IrActionsReport(models.Model):
         jar = "{}/../static/jar/jPdfSign.jar".format(me)
         return "{} {} {} {}".format(java_bin, java_param, jar, opts)
 
+    def _get_endesive_params(self, certificate):
+        date = datetime.datetime.utcnow() - datetime.timedelta(hours=12)
+        date = date.strftime("D:%Y%m%d%H%M%S+00'00'")
+        return {
+            "sigflags": 3,
+            "sigpage": 0,
+            "sigbutton": False,
+            "contact": certificate.endesive_certificate_mail,
+            "location": certificate.endesive_certificate_location,
+            "signingdate": date.encode(),
+            "reason": certificate.endesive_certificate_reason,
+            "signature": "",
+            "signaturebox": (0, 0, 0, 0),
+            "text": {"fontsize": 0},
+        }
+
+    def _signer_endesive(self, params, p12filepath, pdfpath, pdfsigned, passwd):
+        stringpassword = ""
+        with open(passwd, "r") as pw:
+            for line in pw:
+                stringpassword += line.rstrip()
+        password = stringpassword.encode("utf-8")
+        with open(p12filepath, "rb") as fp:
+            p12 = pkcs12.load_key_and_certificates(
+                fp.read(), password, backends.default_backend()
+            )
+            with open(pdfpath, "rb") as fh:
+                datau = fh.read()
+            datas = pdf.cms.sign(datau, params, p12[0], p12[1], p12[2], "sha256")
+        with open(pdfsigned, "wb") as res:
+            res.write(datau)
+            res.write(datas)
+        return pdfsigned
+
     def pdf_sign(self, pdf, certificate):
         pdfsigned = pdf + ".signed.pdf"
         p12 = _normalize_filepath(certificate.path)
         passwd = _normalize_filepath(certificate.password_file)
-        if not (p12 and passwd):
+        method_used = certificate.signing_method
+        if not (p12 or passwd):
             raise UserError(
                 _("Signing report (PDF): " "Certificate or password file not found")
             )
-        signer_opts = '"{}" "{}" "{}" "{}"'.format(p12, pdf, pdfsigned, passwd)
-        signer = self._signer_bin(signer_opts)
-        process = subprocess.Popen(
-            signer, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
-        )
-        out, err = process.communicate()
-        if process.returncode:
-            raise UserError(
-                _(
-                    "Signing report (PDF): jPdfSign failed (error code: %s). "
-                    "Message: %s. Output: %s"
-                )
-                % (process.returncode, err, out)
+        if method_used == "java":
+            signer_opts = '"{}" "{}" "{}" "{}"'.format(p12, pdf, pdfsigned, passwd)
+            signer = self._signer_bin(signer_opts)
+            process = subprocess.Popen(
+                signer, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
             )
+            out, err = process.communicate()
+            if process.returncode:
+                raise UserError(
+                    _(
+                        "Signing report (PDF): jPdfSign failed (error code: %s). "
+                        "Message: %s. Output: %s"
+                    )
+                    % (process.returncode, err, out)
+                )
+        elif method_used == "endesive":
+            params = self._get_endesive_params(certificate)
+            self._signer_endesive(params, p12, pdf, pdfsigned, passwd)
         return pdfsigned
 
     def render_qweb_pdf(self, res_ids=None, data=None):
diff --git a/report_qweb_signer/models/report_certificate.py b/report_qweb_signer/models/report_certificate.py
index 7384b2aac..6159fa176 100644
--- a/report_qweb_signer/models/report_certificate.py
+++ b/report_qweb_signer/models/report_certificate.py
@@ -52,3 +52,20 @@ class ReportCertificate(models.Model):
         required=True,
         default=_default_company,
     )
+    signing_method = fields.Selection(
+        selection=[("java", "Java"), ("endesive", "Endesive")],
+        default="java",
+        string="Signing Method",
+        required=True,
+    )
+    endesive_certificate_mail = fields.Char(
+        string="Signature e-mail",
+        help="E-mail address to include in PDF digital signature.",
+    )
+    endesive_certificate_location = fields.Char(
+        string="Signature location",
+        help="Location to include in digital signature (typically, a city name). ",
+    )
+    endesive_certificate_reason = fields.Char(
+        string="Signature reason", help="Reason text to include in digital signature.",
+    )
diff --git a/report_qweb_signer/views/report_certificate_view.xml b/report_qweb_signer/views/report_certificate_view.xml
index 1d06e4383..812157edd 100644
--- a/report_qweb_signer/views/report_certificate_view.xml
+++ b/report_qweb_signer/views/report_certificate_view.xml
@@ -22,6 +22,7 @@ License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html).
                             <field name="path" />
                             <field name="password_file" />
                             <field name="model_id" />
+                            <field name="signing_method" />
                         </group>
                         <group>
                             <field name="domain" />
@@ -33,6 +34,22 @@ License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html).
                                 groups="base.group_multi_company"
                             />
                         </group>
+                        <group
+                            attrs="{'invisible': [('signing_method', '!=', 'endesive')]}"
+                        >
+                            <field
+                                name="endesive_certificate_mail"
+                                attrs="{'required': [('signing_method', '=', 'endesive')]}"
+                            />
+                            <field
+                                name="endesive_certificate_location"
+                                attrs="{'required': [('signing_method', '=', 'endesive')]}"
+                            />
+                            <field
+                                name="endesive_certificate_reason"
+                                attrs="{'required': [('signing_method', '=', 'endesive')]}"
+                            />
+                        </group>
                     </group>
                 </sheet>
             </form>
diff --git a/requirements.txt b/requirements.txt
index a84c05839..66dfb2dcb 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,5 @@
 py3o.template
 py3o.formats
 genshi>=0.7
+cryptography
+endesive