Krajowy system e-Faktur

Array
(
    [referenceNumber] => 20260125-AU-4DA8400000-B7CE22ED5B-B5
    [authenticationToken] => Array
        (
            [token] => eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJBdXRoZW50aWNhdGlvblRva2VuIiwiYXJuIjoiMjAyNjAxMjUtQVUtNERBODQwMDAwMC1CN0NFMjJFRDVCLUI1IiwiZXhwIjoxNzY5MzgzMzI5LCJpYXQiOjE3NjkzODA2MjksImlzcyI6ImtzZWYtYXBpLXRlIiwiYXVkIjoia3NlZi1hcGktdGUifQ.ndaarLgFK66NwkWhk6lRi_pa9TJaxtS_CfmiHsc0dLQ
            [validUntil] => 2026-01-25T23:22:09.5341373+00:00
        )

)

header('Authorization: Bearer eyJhbGciOiJIUzI....');

Array
(
    [exception] => Array
        (
            [exceptionDetailList] => Array
                (
                    [0] => Array
                        (
                            [exceptionCode] => 21301
                            [exceptionDescription] => Brak autoryzacji.
                            [details] => Array
                                (
                                    [0] => Status uwierzytelniania (460) nie pozwala na pobranie tokenów.
                                )

                        )

                )

            [serviceCode] => 00-b2c800acea789294cbfe138c86ca3dde-819a95749e33afa6-00
            [timestamp] => 2026-01-25T23:58:07.1185957Z
        )

)

<?xml version="1.0" encoding="utf-8"?>
            <AuthTokenRequest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://ksef.mf.gov.pl/auth/token/2.0">
                <Challenge>20260126-CR-30CE768000-573721EB31-A6</Challenge>
                <ContextIdentifier><Nip>000000000</Nip></ContextIdentifier>
                <SubjectIdentifierType>certificateSubject</SubjectIdentifierType>
            </AuthTokenRequest>

      public static class XadesSigner
    {
        private const string EcdsaSha256AlgorithmUrl = "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256";
        private const string XadesNsUrl = "http://uri.etsi.org/01903/v1.3.2#";
        private const string SignedPropertiesType = "http://uri.etsi.org/01903#SignedProperties";
        private static readonly TimeSpan CertificateTimeBuffer = TimeSpan.FromMinutes(-1);

        /// <summary>
        /// Podpisuje wskazany dokument XML w formacie XAdES, 
        /// używając dostarczonego certyfikatu z kluczem prywatnym.
        /// Metoda modyfikuje przekazany dokument w miejscu, dodając element podpisu.
        /// </summary>
        /// <param name="xmlDocument">
        /// Dokument XML do podpisania. Musi posiadać element główny.
        /// Zalecane jest ustawienie PreserveWhitespace = true.
        /// </param>
        /// <param name="certificate">
        /// Certyfikat X.509 zawierający klucz prywatny, 
        /// którym ma zostać złożony podpis.
        /// </param>
        /// <returns>
        /// Ten sam obiekt XmlDocument co przekazany w parametrze, 
        /// zmodyfikowany przez dodanie elementu podpisu XAdES.
        /// </returns>
        public static XmlDocument Sign(XmlDocument xmlDocument, X509Certificate2 certificate, byte[] privateKey, string privateKeyPassword)
        {
            //ArgumentNullException.ThrowIfNull(xmlDocument);
            //ArgumentNullException.ThrowIfNull(certificate);

            if (xmlDocument.DocumentElement == null)
            {
                throw new ArgumentException("Dokument XML nie ma elementu głównego", nameof(xmlDocument));
            }

            //if (!certificate.HasPrivateKey)
            //{
            //    throw new InvalidOperationException("Certyfikat nie zawiera klucza prywatnego");
            //}

            //RSA rsaKey = certificate.GetRSAPrivateKey();
            //ECDsa ecdsaKey = certificate.GetECDsaPrivateKey();
            ECDsa ecdsaKey =LoadEncryptedPkcs8EcdsaPrivateKey(privateKey, privateKeyPassword);

            if (/*rsaKey == null && */ecdsaKey == null)
            {
                throw new InvalidOperationException("Nie można wyodrębnić klucza prywatnego");
            }

            string signatureId = "Signature";
            string signedPropertiesId = "SignedProperties";

            SignedXmlFixed signedXml = new SignedXmlFixed(xmlDocument);

            //if (rsaKey != null)
            //{
            //    signedXml.SigningKey = rsaKey;
            //}
            //else if (ecdsaKey != null)
            {
                signedXml.SigningKey = ecdsaKey;
                signedXml.SignedInfo.SignatureMethod = EcdsaSha256AlgorithmUrl;
            }

            signedXml.Signature.Id = signatureId;

            AddKeyInfo(signedXml, certificate);
            AddRootReference(signedXml);
            AddSignedPropertiesReference(signedXml, signedPropertiesId);

            XmlNodeList qualifyingProperties = BuildQualifyingProperties(
                 signatureId, signedPropertiesId,
                 certificate, DateTimeOffset.UtcNow.Add(CertificateTimeBuffer));

            DataObject dataObject = new DataObject() { Data = qualifyingProperties };

            signedXml.AddDataObject(dataObject);
            signedXml.ComputeSignature();
            XmlElement xmlSignature = signedXml.GetXml();

            xmlDocument.DocumentElement.AppendChild(xmlDocument.ImportNode(xmlSignature, true));

            return xmlDocument;
        }
       

        private class SignedXmlFixed : SignedXml
        {
            private readonly List<DataObject> _dataObjects = new List<DataObject>();

            public SignedXmlFixed(XmlDocument document) : base(document)
            {
            }

            public override XmlElement GetIdElement(XmlDocument document, string idValue)
            {
                XmlElement elem = base.GetIdElement(document, idValue);
                if (elem != null)
                    return elem;

                // Sprawdzenie w atrybucie wsu:Id
                XmlNamespaceManager mgr = new XmlNamespaceManager(document.NameTable);
                mgr.AddNamespace("wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
                var nodes = document.SelectNodes($"//*[@wsu:Id='{idValue}']", mgr);

                if (nodes != null && nodes.Count > 0)
                    return nodes[0] as XmlElement;


                //// Najpierw próbujemy znaleźć element standardowo
                //XmlElement element = base.GetIdElement(document, idValue);
                //if (element != null)
                //    return element;

                //// Jeśli nie znaleziono, przeszukujemy nasze DataObjects
                //foreach (var dataObject in _dataObjects)
                //{
                //    foreach (XmlNode node in dataObject.Data)
                //    {
                //        XmlElement found = node.SelectSingleNode($"//*[@Id='{idValue}']") as XmlElement;
                //        if (found != null)
                //            return found;
                //    }
                //}

                return null;
            }

            public void AddDataObject(DataObject dataObject)
            {
                if (dataObject == null)
                    throw new ArgumentNullException(nameof(dataObject));

                _dataObjects.Add(dataObject);
                AddObject(dataObject); // metoda klasy bazowej SignedXml
            }
        }

        private static void AddKeyInfo(SignedXml signedXml, X509Certificate2 certificate)
        {
            signedXml.KeyInfo = new KeyInfo();
            signedXml.KeyInfo.AddClause(new KeyInfoX509Data(certificate));
        }

        private static void AddRootReference(SignedXml signedXml)
        {
            Reference rootReference = new Reference(string.Empty);
            rootReference.AddTransform(new XmlDsigEnvelopedSignatureTransform());
            rootReference.AddTransform(new XmlDsigExcC14NTransform());
            signedXml.AddReference(rootReference);
        }

        private static void AddSignedPropertiesReference(SignedXml signedXml, string id)
        {
            Reference xadesReference = new Reference("#" + id)
            {
                Type = SignedPropertiesType
            };

            xadesReference.AddTransform(new XmlDsigExcC14NTransform());
            signedXml.AddReference(xadesReference);
        }

        private static XmlNodeList BuildQualifyingProperties(string signatureId, string signedPropertiesId,
            X509Certificate2 signingCertificate, DateTimeOffset signingTime)
        {
            string certificateDigest = Convert.ToBase64String(signingCertificate.GetCertHash(HashAlgorithmName.SHA256));
            string certificateIssuerName = signingCertificate.Issuer;
            string certificateSerialNumber = GetCertificateSerialNumber(signingCertificate);

            XmlDocument document = new XmlDocument();
            document.LoadXml(
    string.Format(
        "<xades:QualifyingProperties Target=\"#{0}\" xmlns:xades=\"{1}\" xmlns=\"{2}\">" +
        "<xades:SignedProperties Id=\"{3}\">" +
            "<xades:SignedSignatureProperties>" +
                "<xades:SigningTime>{4}</xades:SigningTime>" +
                "<xades:SigningCertificate>" +
                    "<xades:Cert>" +
                        "<xades:CertDigest>" +
                            "<DigestMethod Algorithm=\"{5}\" />" +
                            "<DigestValue>{6}</DigestValue>" +
                        "</xades:CertDigest>" +
                        "<xades:IssuerSerial>" +
                            "<X509IssuerName>{7}</X509IssuerName>" +
                            "<X509SerialNumber>{8}</X509SerialNumber>" +
                        "</xades:IssuerSerial>" +
                    "</xades:Cert>" +
                "</xades:SigningCertificate>" +
            "</xades:SignedSignatureProperties>" +
        "</xades:SignedProperties>" +
        "</xades:QualifyingProperties>",
        signatureId,
        XadesNsUrl,
        SignedXml.XmlDsigNamespaceUrl,
        signedPropertiesId,
        signingTime.ToString("o"), // ISO 8601
        SignedXml.XmlDsigSHA256Url,
        certificateDigest,
        certificateIssuerName,
        certificateSerialNumber
    )
);


            return document.ChildNodes;
        }

        public static string GetCertificateSerialNumber(X509Certificate2 certificate)
        {
            if (certificate == null)
                throw new ArgumentNullException(nameof(certificate));

            // GetSerialNumber() w .NET zwraca tablicę bajtów w kolejności little-endian
            byte[] serialBytes = certificate.GetSerialNumber();

            // Tworzymy BigInteger, interpretując tablicę jako little-endian
            BigInteger serialNumber = new BigInteger(serialBytes);

            // Zwracamy w formacie invariant culture
            return serialNumber.ToString(CultureInfo.InvariantCulture);
        }

        #region Decrypt private key

        private static ECDsa LoadEncryptedPkcs8EcdsaPrivateKey(byte[] pemBytes, string password)
        {
            string pemText = Encoding.UTF8.GetString(pemBytes);
            using (var reader = new StringReader(pemText))
            {
                var pemReader = new Org.BouncyCastle.OpenSsl.PemReader(reader, new PasswordFinder(password));
                object keyObj = pemReader.ReadObject();

                if (keyObj is ECPrivateKeyParameters ecPrivate)
                    return CreateEcdsaFromBc(ecPrivate);

                throw new CryptographicException("Nie udało się odczytać EC Private Key.");
            }
        }

        private sealed class PasswordFinder : Org.BouncyCastle.OpenSsl.IPasswordFinder
        {
            private readonly string _password;
            public PasswordFinder(string password) { _password = password; }
            public char[] GetPassword() => _password.ToCharArray();
        }

        private static ECDsa CreateEcdsaFromBc(ECPrivateKeyParameters bcKey)
        {
            var q = bcKey.Parameters.G.Multiply(bcKey.D).Normalize();

            var ecParams = new ECParameters
            {
                Curve = GetNamedCurve(bcKey),
                D = bcKey.D.ToByteArrayUnsigned(),
                Q = new ECPoint
                {
                    X = q.AffineXCoord.GetEncoded(),
                    Y = q.AffineYCoord.GetEncoded()
                }
            };

            return ECDsa.Create(ecParams);
        }

        private static ECCurve GetNamedCurve(ECPrivateKeyParameters key)
        {
            string oid = key.PublicKeyParamSet?.Id;
            switch (oid)
            {
                case "1.2.840.10045.3.1.7": return ECCurve.NamedCurves.nistP256;
                case "1.3.132.0.34": return ECCurve.NamedCurves.nistP384;
                case "1.3.132.0.35": return ECCurve.NamedCurves.nistP521;
                default:
                    throw new CryptographicException($"Nieobsługiwana krzywa EC: {oid}");
            }
        }


        #endregion
    }

    [subjectIdentifier] => Array
        (
            [type] => Fingerprint
            [value] => BD1255FC99F765FE0363031101C1D514E114F38D05BB6235B023895138CAD84C
        )

    [permissions] => Array
        (
            [0] => InvoiceWrite
            [1] => InvoiceRead
            [2] => CredentialsManage
            [3] => CredentialsRead
        )

    [description] => Maria Nowak fingerprint
    [subjectDetails] => Array
        (
            [subjectDetailsType] => PersonByFingerprintWithoutIdentifier
            [personById] => 
            [personByFpWithId] => 
            [personByFpNoId] => Array
                (
                    [firstName] => Maria
                    [lastName] => Nowak
                    [birthDate] => 2000-01-12T00:00:00.000Z
                    [idDocument] => Array
                        (
                            [type] => Dowód osobisty
                            [number] => CBD567896
                            [country] => PL

{
    "type": "security_blocked",
    "message": {
        "title": "Request blocked",
        "status": 403,
        "detail": "This request was blocked by our security service",
        "security": {
            "incidentId": "68600052**********-*******6978064",
            "clientIp": "***********"
        }
    }
}```