//// This code is part of Document Solutions for PDF .NET demos.// Copyright (c) MESCIUS inc. All rights reserved.//using System;using System.IO;using System.Drawing;using System.Security.Cryptography.X509Certificates;
using Org.BouncyCastle.Crypto.Digests;
using Azure.Core;using Azure.Identity;using Azure.Security.KeyVault.Certificates;using Azure.Security.KeyVault.Keys.Cryptography;
using GrapeCity.Documents.Pdf;using GrapeCity.Documents.Pdf.Security;

namespace DsPdfWeb.Demos{    // This sample shows how to sign an existing PDF file that contains    // an empty signature field with a certificate that is stored    // in an Azure Key Vault.    //    // The sample includes a ready to use utility class AzureSignatureGenerator    // that implements the GrapeCity.Documents.Pdf.IPkcs7SignatureGenerator interface,    // and can be used to sign PDFs with certificates stored in Azure Key Vault.    //      // Please note that when run directly off the DsPdf demo site,    // this sample will NOT sign the PDF, as it passes dummy Azure credentials    // to the AzureSignatureGenerator's ctor. You will need to download the sample    // and provide your own credentials for the sample code to actually sign a PDF.    //    public class SignAzureKeyVault    {        public int CreatePDF(Stream stream)        {            var doc = new GcPdfDocument();            using var s = File.OpenRead(Path.Combine("Resources", "PDFs", "SignAzureKeyVault.pdf"));            doc.Load(s);
            try            {                // This WILL NOT WORK due to dummy Azure credentials.                // Supply valid credentials to actually sign the PDF.                using var sg = new AzureSignatureGenerator(                    "keyVaultName",                    "tenantId",                    "clientId",                    "clientSecret",                    "certificateName");
                var sp = new SignatureProperties()                {                    SignatureBuilder = new Pkcs7SignatureBuilder()                    {                        SignatureGenerator = sg,                        CertificateChain = new X509Certificate2[] { sg.Certificate },                    },                    SignatureField = doc.AcroForm.Fields[0]                };                doc.Sign(sp, stream);            }            catch (Exception)            {                var page = doc.Pages[0];                var r = doc.AcroForm.Fields[0].Widgets[0].Rect;                Common.Util.AddNote(                    "Signing failed because dummy Azure credentials were used.\n" +                    "Use valid Azure Key Vault credentials to sign the PDF.",                    page,                    new RectangleF(r.Left, r.Bottom + 24, page.Size.Width - r.Left * 2, 0));                doc.Save(stream);            }
            // Done.            return doc.Pages.Count;        }    }
    /// <summary>    /// Implements <see cref="IPkcs7SignatureGenerator"/>     /// and allows generating a digital signature using    /// a certificate stored in Azure Key Vault.    /// </summary>    public class AzureSignatureGenerator : IPkcs7SignatureGenerator, IDisposable    {        private CertificateClient _certificateClient;        private X509Certificate2 _certificate;        private CryptographyClient _cryptographyClient;
        /// <summary>        /// Initializes a new instance of the <see cref="AzureSignatureGenerator"/> class.        /// </summary>        /// <param name="keyVaultName">        /// The name of the Key Vault storage used to create a URL in the form        /// <b>https://{keyVaultName}.vault.azure.net/</b> that will be passed to        /// the <see cref="CertificateClient"/> ctor.</param>        /// <param name="tenantId">        /// The Azure Active Directory tenant (directory) ID of the service principal.        /// This value will be used to create the <see cref="ClientSecretCredential"/>.</param>        /// <param name="clientId">        /// The client (application) ID of the service principal.        /// This value will be used to create the <see cref="ClientSecretCredential"/>.</param>        /// <param name="clientSecret">        /// The client secret that was generated for the App Registration used to authenticate the client.        /// This value will be used to create the <see cref="ClientSecretCredential"/>.</param>        /// <param name="certificateName">        /// The name of the certificate to be used for the signature.</param>        public AzureSignatureGenerator(            string keyVaultName,            string tenantId,            string clientId,            string clientSecret,            string certificateName)        {            var keyVaultUri = new Uri($"https://{keyVaultName}.vault.azure.net/");            TokenCredential credential = new ClientSecretCredential(tenantId, clientId, clientSecret);            _certificateClient = new CertificateClient(keyVaultUri, credential);            var c = _certificateClient.GetCertificate(certificateName);            _certificate = new X509Certificate2(c.Value.Cer);            _cryptographyClient = new CryptographyClient(c.Value.KeyId, credential);        }
        /// <summary>        /// Gets the ID of the hash algorithm.        /// </summary>        public OID HashAlgorithm => OID.HashAlgorithms.SHA256;
        /// <summary>        /// Gets the ID of the encryption algorithm.        /// </summary>        public OID DigestEncryptionAlgorithm => OID.EncryptionAlgorithms.RSA;
        /// <summary>        /// Gets the certificate.        /// </summary>        public X509Certificate2 Certificate => _certificate;
        /// <summary>        /// Signs data.        /// </summary>        /// <param name="input">The input data to sign.</param>        /// <returns>The signed data.</returns>        public byte[] SignData(byte[] input)        {            var hashDigest = new Sha256Digest();            byte[] hash = new byte[hashDigest.GetDigestSize()];            hashDigest.Reset();            hashDigest.BlockUpdate(input, 0, input.Length);            hashDigest.DoFinal(hash, 0);            byte[] result = _cryptographyClient.Sign(SignatureAlgorithm.RS256, hash).Signature;            return result;        }
        /// <summary>        /// Releases resources used by this object.        /// </summary>        public void Dispose()        {            _certificateClient = null;            if (_certificate != null)            {                _certificate.Dispose();                _certificate = null;            }            _cryptographyClient = null;        }    }}