lok: add signDocument to "Office" iface - to sign not opened docs.

LOKit function "signDocument" can sign document without the need
to open them. This is useful to sign PDF documents after they are
created from a currently opened (ODF, DOCX) document.

This adds DocumentDigner to sfx2, which could also be used in
desktop LibreOffice without opening them and in further tests.

Change-Id: Id6f242e817f594aa672f94f9c6f9b34e4035d46a
Reviewed-on: https://gerrit.libreoffice.org/65767
Tested-by: Jenkins
Reviewed-by: Tomaž Vajngerl <quikee@gmail.com>

2 files changed, 126 insertions, 0 deletions

diff --git a/sfx2/Library_sfx.mk b/sfx2/Library_sfx.mk
index 97f6f9706e76..18cf9396794d 100644
--- a/sfx2/Library_sfx.mk
+++ b/sfx2/Library_sfx.mk
@@ -194,6 +194,7 @@ $(eval $(call gb_Library_add_exception_objects,sfx,\
     sfx2/source/dialog/tplpitem \
     sfx2/source/dialog/versdlg \
     sfx2/source/doc/DocumentMetadataAccess \
+    sfx2/source/doc/DocumentSigner \
     sfx2/source/doc/Metadatable \
     sfx2/source/doc/QuerySaveDocument \
     sfx2/source/doc/SfxDocumentMetaData \
diff --git a/sfx2/source/doc/DocumentSigner.cxx b/sfx2/source/doc/DocumentSigner.cxx
new file mode 100644
index 000000000000..7e29b02b97b4
--- /dev/null
+++ b/sfx2/source/doc/DocumentSigner.cxx
@@ -0,0 +1,125 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ */
+
+#include <sfx2/DocumentSigner.hxx>
+
+#include <tools/stream.hxx>
+#include <unotools/ucbstreamhelper.hxx>
+#include <unotools/streamwrap.hxx>
+
+#include <comphelper/storagehelper.hxx>
+#include <comphelper/processfactory.hxx>
+
+#include <com/sun/star/embed/XStorage.hpp>
+#include <com/sun/star/embed/StorageFormats.hpp>
+#include <com/sun/star/embed/XTransactedObject.hpp>
+#include <com/sun/star/security/DocumentSignatureInformation.hpp>
+#include <com/sun/star/security/DocumentDigitalSignatures.hpp>
+#include <com/sun/star/io/WrongFormatException.hpp>
+#include <com/sun/star/io/XStream.hpp>
+
+using namespace css;
+
+namespace sfx2
+{
+bool DocumentSigner::signDocument(uno::Reference<security::XCertificate> const& rxCertificate)
+{
+    std::unique_ptr<SvStream> pStream(
+        utl::UcbStreamHelper::CreateStream(m_aUrl, StreamMode::READ | StreamMode::WRITE));
+    uno::Reference<io::XStream> xInputStream(new utl::OStreamWrapper(std::move(pStream)));
+
+    bool bHasValidDocumentSignature = true;
+
+    bool bResult = false;
+    uno::Reference<embed::XStorage> xWriteableZipStore;
+    try
+    {
+        xWriteableZipStore = comphelper::OStorageHelper::GetStorageOfFormatFromStream(
+            ZIP_STORAGE_FORMAT_STRING, xInputStream);
+    }
+    catch (const io::IOException&)
+    {
+    }
+
+    OUString aODFVersion(comphelper::OStorageHelper::GetODFVersionFromStorage(xWriteableZipStore));
+
+    uno::Reference<security::XDocumentDigitalSignatures> xSigner(
+        security::DocumentDigitalSignatures::createWithVersionAndValidSignature(
+            comphelper::getProcessComponentContext(), aODFVersion, bHasValidDocumentSignature));
+
+    try
+    {
+        uno::Reference<embed::XStorage> xMetaInf;
+        uno::Reference<container::XNameAccess> xNameAccess(xWriteableZipStore, uno::UNO_QUERY);
+        if (xNameAccess.is() && xNameAccess->hasByName("META-INF"))
+        {
+            xMetaInf = xWriteableZipStore->openStorageElement("META-INF",
+                                                              embed::ElementModes::READWRITE);
+            if (!xMetaInf.is())
+                throw uno::RuntimeException();
+        }
+        if (xMetaInf.is())
+        {
+            uno::Reference<embed::XStorage> xStorage;
+            xStorage = comphelper::OStorageHelper::GetStorageOfFormatFromStream(
+                ZIP_STORAGE_FORMAT_STRING, xInputStream);
+
+            // ODF.
+            uno::Reference<io::XStream> xStream;
+            xStream.set(
+                xMetaInf->openStreamElement(xSigner->getDocumentContentSignatureDefaultStreamName(),
+                                            embed::ElementModes::READWRITE),
+                uno::UNO_SET_THROW);
+            bool bSuccess = xSigner->signDocumentWithCertificate(rxCertificate, xStorage, xStream);
+            if (bSuccess)
+            {
+                uno::Reference<embed::XTransactedObject> xTransact(xMetaInf, uno::UNO_QUERY_THROW);
+                xTransact->commit();
+                xTransact.set(xWriteableZipStore, uno::UNO_QUERY_THROW);
+                xTransact->commit();
+                bResult = true;
+            }
+        }
+        else if (xWriteableZipStore.is())
+        {
+            uno::Reference<embed::XStorage> xStorage;
+            xStorage = comphelper::OStorageHelper::GetStorageOfFormatFromStream(
+                ZIP_STORAGE_FORMAT_STRING, xInputStream);
+
+            // OOXML.
+            uno::Reference<io::XStream> xStream;
+
+            // We need read-write to be able to add the signature relation.
+            bool bSuccess = xSigner->signDocumentWithCertificate(rxCertificate, xStorage, xStream);
+
+            if (bSuccess)
+            {
+                uno::Reference<embed::XTransactedObject> xTransact(xWriteableZipStore,
+                                                                   uno::UNO_QUERY_THROW);
+                xTransact->commit();
+                bResult = true;
+            }
+        }
+        else
+        {
+            // Something not ZIP based: e.g. PDF.
+            bResult = xSigner->signDocumentWithCertificate(
+                rxCertificate, uno::Reference<embed::XStorage>(), xInputStream);
+        }
+    }
+    catch (const uno::Exception&)
+    {
+    }
+    return bResult;
+}
+
+} // namespace sfx2
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */