var forge = require('node-forge');
var select = require('xml-crypto').xpath
  , dom = require('xmldom').DOMParser
  , SignedXml = require('xml-crypto').SignedXml
  , FileKeyInfo = require('xml-crypto').FileKeyInfo  
  , fs = require('fs')


function SignKeyInfo(prefix) {
      this.getKeyInfo = function(key, prefix) {
        prefix = prefix || ''
        prefix = prefix ? prefix + ':' : prefix
        return "<" + prefix + "X509Data><" + prefix + "X509Certificate>" +
                     removeHeaderFromPem(forge.pki.certificateToPem(cert)) +  
                    "</" + prefix + "X509Certificate></" + prefix + "X509Data>"
      }
      this.getKey = function(keyInfo) {
        //you can use the keyInfo parameter to extract the key in any way you want       
        return forge.pki.privateKeyToPem(privateKey)
      }
    }

function ValidateKeyInfo(prefix) {
      this.getKeyInfo = function(key, prefix) {
        prefix = prefix || ''
        prefix = prefix ? prefix + ':' : prefix
        return "<" + prefix + "X509Data><" + prefix + "X509Certificate>" +
                     removeHeaderFromPem(forge.pki.certificateToPem(cert)) +  
                    "</" + prefix + "X509Certificate></" + prefix + "X509Data>"
      }
      this.getKey = function(keyInfo) {
        //you can use the keyInfo parameter to extract the key in any way you want       
        return forge.pki.certificateToPem(cert)
      }
    }



function removeHeaderFromPem(pem) {
  var lines = pem.split('\n');
  var encoded = '';
  for(var i = 0;i < lines.length;i++){
    if (lines[i].trim().length > 0 &&
        lines[i].indexOf('-BEGIN CERTIFICATE-') < 0 && 
        lines[i].indexOf('-BEGIN RSA PRIVATE KEY-') < 0 && 
        lines[i].indexOf('-BEGIN RSA PUBLIC KEY-') < 0 &&
        lines[i].indexOf('-BEGIN PUBLIC KEY-') < 0 &&
        lines[i].indexOf('-END CERTIFICATE-') < 0 &&
        lines[i].indexOf('-END PUBLIC KEY-') < 0 &&
        lines[i].indexOf('-END RSA PRIVATE KEY-') < 0 &&
        lines[i].indexOf('-END RSA PUBLIC KEY-') < 0) {
      encoded += lines[i].trim();
    }
  }
  return encoded;
}


function signXml(xml, xpath, key, dest)
{
  var sig = new SignedXml()
  //sig.signingKey = fs.readFileSync(key)
  sig.signingKey = key
  sig.addReference(xpath)
  sig.keyInfoProvider = new SignKeyInfo('ds')    
  sig.computeSignature(xml,{
  prefix: 'ds'
  })
  fs.writeFileSync(dest, sig.getSignedXml())
}

function validateXml(xml, key)
{
  var doc = new dom().parseFromString(xml)    
  var signature = select(doc, "/*/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']")[0]
  var sig = new SignedXml()
//  sig.keyInfoProvider = new FileKeyInfo(key)
  sig.keyInfoProvider = new ValidateKeyInfo('ds')
  sig.loadSignature(signature.toString())
  var res = sig.checkSignature(xml)
  if (!res) console.log(sig.validationErrors)
  return res;
}

//----------------------------------------------------------------
//Начало

var keyFile = fs.readFileSync("./RSA256_....p12", 'binary');

var p12Asn1 = forge.asn1.fromDer(keyFile);

// pkcs12 с паролем
var p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, '123456');

var bags = p12.getBags({bagType: forge.pki.oids.certBag});

// Сертификат
var certBag = bags[forge.pki.oids.certBag][0];
var cert = certBag.cert;
//console.log(forge.pki.certificateToPem(cert));
//-----BEGIN CERTIFICATE-----

// Приватный ключ
var keyBags = p12.getBags({bagType: forge.pki.oids.pkcs8ShroudedKeyBag});
var keyBag = keyBags[forge.pki.oids.pkcs8ShroudedKeyBag][0];
var privateKey = keyBag.key;
//console.log(forge.pki.privateKeyToPem(privateKey));
//-----BEGIN RSA PRIVATE KEY-----


// Публичный ключ
var publicKey = forge.pki.setRsaPublicKey(privateKey.n, privateKey.e);
//console.log(forge.pki.publicKeyToPem(publicKey));
//-----BEGIN PUBLIC KEY-----


//----------------------------------------------------------------------------------
// Проверка XMLDSIG 


var xml = "<library>" +
            "<book>" +
              "<name>Harry Potter</name>" +
            "</book>" +
          "</library>"

//sign an xml document
//signXml(xml, 
//  "//*[local-name(.)='book']", 
//  "client.pem", 
//  "result.xml")


// Подписываем приватным ключом
signXml(xml, 
  "//*[local-name(.)='book']", 
  forge.pki.privateKeyToPem(privateKey), 
  "result.xml")


console.log("xml signed succesfully")

var signedXml = fs.readFileSync("result.xml").toString()
console.log("validating signature...")

//validate an xml document
//if (validateXml(signedXml, "client_public.pem"))
//Проверяем сертификатом
if (validateXml(signedXml, forge.pki.certificateToPem(cert)))

  console.log("signature is valid")
else
  console.log("signature not valid")