99 lines
3.5 KiB
PHP
99 lines
3.5 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
declare(strict_types=1);
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Config.php
|
||
|
|
*
|
||
|
|
* @since 2026-07-15
|
||
|
|
* @category Library
|
||
|
|
* @package PdfSign
|
||
|
|
* @author Nicola Asuni <info@tecnick.com>
|
||
|
|
* @copyright 2026 Nicola Asuni - Tecnick.com LTD
|
||
|
|
* @license https://www.gnu.org/copyleft/lesser.html GNU-LGPL v3 (see LICENSE)
|
||
|
|
* @link https://github.com/tecnickcom/tc-lib-pdf-sign
|
||
|
|
*
|
||
|
|
* This file is part of tc-lib-pdf-sign software library.
|
||
|
|
*/
|
||
|
|
|
||
|
|
namespace Com\Tecnick\Pdf\Sign\Timestamp;
|
||
|
|
|
||
|
|
use Com\Tecnick\Pdf\Sign\DigestAlgorithm;
|
||
|
|
use Com\Tecnick\Pdf\Sign\Exception;
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Com\Tecnick\Pdf\Sign\Timestamp\Config
|
||
|
|
*
|
||
|
|
* Immutable RFC 3161 Time Stamping Authority (TSA) configuration. The codec
|
||
|
|
* fields (hash algorithm, policy OID, nonce) drive request construction; the
|
||
|
|
* transport fields (host, timeout, credentials, CA file, peer verification)
|
||
|
|
* are consumed by the caller-provided transport.
|
||
|
|
*
|
||
|
|
* @since 2026-07-15
|
||
|
|
* @category Library
|
||
|
|
* @package PdfSign
|
||
|
|
* @author Nicola Asuni <info@tecnick.com>
|
||
|
|
* @copyright 2026 Nicola Asuni - Tecnick.com LTD
|
||
|
|
* @license https://www.gnu.org/copyleft/lesser.html GNU-LGPL v3 (see LICENSE)
|
||
|
|
* @link https://github.com/tecnickcom/tc-lib-pdf-sign
|
||
|
|
*/
|
||
|
|
final class Config
|
||
|
|
{
|
||
|
|
/**
|
||
|
|
* Supported TSA message-imprint digest algorithms.
|
||
|
|
*
|
||
|
|
* @var list<string>
|
||
|
|
*/
|
||
|
|
public const HASH_ALGORITHMS = ['sha256', 'sha384', 'sha512'];
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Selected message-imprint digest algorithm (one of HASH_ALGORITHMS).
|
||
|
|
*/
|
||
|
|
public readonly string $hashAlgorithm;
|
||
|
|
|
||
|
|
/**
|
||
|
|
* @param string $host TSA endpoint URL (https).
|
||
|
|
* @param string|DigestAlgorithm $hashAlgorithm Message-imprint digest name or enum case.
|
||
|
|
* @param string $policyOid Optional requested TSA policy OID (dotted form).
|
||
|
|
* @param bool $nonceEnabled Add a random nonce to the request.
|
||
|
|
* @param int $timeout Transport timeout in seconds (>= 1).
|
||
|
|
* @param bool $verifyPeer Validate the TSA TLS certificate.
|
||
|
|
* @param string $username Optional HTTP basic-auth username.
|
||
|
|
* @param string $password Optional HTTP basic-auth password.
|
||
|
|
* @param string $cert Optional CA bundle path for the transport.
|
||
|
|
*
|
||
|
|
* @throws Exception If any option is invalid.
|
||
|
|
*/
|
||
|
|
public function __construct(
|
||
|
|
public readonly string $host,
|
||
|
|
string|DigestAlgorithm $hashAlgorithm = 'sha256',
|
||
|
|
public readonly string $policyOid = '',
|
||
|
|
public readonly bool $nonceEnabled = true,
|
||
|
|
public readonly int $timeout = 5,
|
||
|
|
public readonly bool $verifyPeer = true,
|
||
|
|
public readonly string $username = '',
|
||
|
|
#[\SensitiveParameter]
|
||
|
|
public readonly string $password = '',
|
||
|
|
public readonly string $cert = '',
|
||
|
|
) {
|
||
|
|
$hashAlgorithm = $hashAlgorithm instanceof DigestAlgorithm ? $hashAlgorithm->value : $hashAlgorithm;
|
||
|
|
$this->hashAlgorithm = $hashAlgorithm;
|
||
|
|
|
||
|
|
if ($host === '') {
|
||
|
|
throw new Exception('Invalid TSA host');
|
||
|
|
}
|
||
|
|
|
||
|
|
if (!\in_array($hashAlgorithm, self::HASH_ALGORITHMS, true)) {
|
||
|
|
throw new Exception('Invalid TSA hash algorithm: ' . $hashAlgorithm);
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($policyOid !== '' && \preg_match('/^\d+(?:\.\d+)+$/', $policyOid) !== 1) {
|
||
|
|
throw new Exception('Invalid TSA policy OID: ' . $policyOid);
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($timeout < 1) {
|
||
|
|
throw new Exception('Invalid TSA timeout: ' . $timeout);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|