nix-community · nilp0inter · Mar 2, 2025
diff --git a/flake.nix b/flake.nix
@@ -195,6 +195,8 @@
             hm-as-nixos-module-autofirma-firefoxIntegration-connection-method-xhr = pkgs.callPackage ./nix/tests/hm-as-nixos-module/autofirma/firefoxIntegration/connection-method/xhr { inherit self home-manager; };
             hm-as-nixos-module-autofirma-firefoxIntegration-connection-method-auxiliary-servers = pkgs.callPackage ./nix/tests/hm-as-nixos-module/autofirma/firefoxIntegration/connection-method/auxiliary-servers { inherit self home-manager; };
             hm-as-nixos-module-autofirma-config-omitAskOnClose = pkgs.callPackage ./nix/tests/hm-as-nixos-module/autofirma/config/omitAskOnClose.nix { inherit self home-manager; };
+            hm-as-nixos-module-autofirma-librewolfIntegration-protocol-handler = pkgs.callPackage ./nix/tests/hm-as-nixos-module/autofirma/librewolfIntegration/protocol-handler { inherit self home-manager; };
+            hm-as-nixos-module-autofirma-librewolfIntegration-connection-method-websocket = pkgs.callPackage ./nix/tests/hm-as-nixos-module/autofirma/librewolfIntegration/connection-method/websocket { inherit self home-manager; };
             # HM standalone installation
             ### AutoFirma
             hm-standalone-autofirma-cli-sign-document = pkgs.callPackage ./nix/tests/hm-standalone/autofirma/cli/sign-document.nix { inherit self home-manager; };

diff --git a/nix/autofirma/default.nix b/nix/autofirma/default.nix
@@ -221,6 +221,7 @@
         --add-flags "-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel" \
         --add-flags "-Dawt.useSystemAAFontSettings=lcd" \
         --add-flags "-Dswing.aatext=true" \
+        --add-flags "-Des.gob.afirma.keystores.mozilla.UseEnvironmentVariables=true" \
         --add-flags "-jar ${autofirma-jar}/lib/AutoFirma/AutoFirma.jar"
 
       substituteInPlace $out/etc/firefox/pref/AutoFirma.js \
@@ -246,11 +247,17 @@
     genericName = "Herramienta de firma";
     exec = "autofirma %u";
     icon = "${thisPkg}/lib/AutoFirma/AutoFirma.png";
-    mimeTypes = ["x-scheme-handler/afirma"];
+    # mimeTypes = ["x-scheme-handler/afirma"];
     categories = ["Office" "X-Utilities" "X-Signature" "Java"];
     startupNotify = true;
     startupWMClass = "autofirma";
   };
+  protocolItem = makeDesktopItem {
+    name = "AutoFirmaProto";
+    desktopName = "AutoFirmaProto";
+    mimeTypes = ["x-scheme-handler/afirma"];
+    categories = ["Office" "X-Utilities" "X-Signature" "Java"];
+  };
 in
   buildFHSEnv {
     name = name;
@@ -265,7 +272,7 @@ in
       cp "${desktopItem}/share/applications/"* $out/share/applications
 
       mkdir -p $out/etc/firefox/pref
-      ln -s ${thisPkg}/etc/firefox/pref/AutoFirma.js $out/etc/firefox/pref/AutoFirma.js
+      # ln -s ${thisPkg}/etc/firefox/pref/AutoFirma.js $out/etc/firefox/pref/AutoFirma.js
     '';
     extraBwrapArgs = [
       "--ro-bind-try /etc/AutoFirma /etc/AutoFirma"

diff --git a/nix/autofirma/hm-module.nix b/nix/autofirma/hm-module.nix
@@ -14,6 +14,7 @@ with lib; let
     text = builtins.readFile ./create-autofirma-cert;
   };
   anyFirefoxIntegrationProfileIsEnabled = builtins.any (x: x.enable) (lib.attrsets.attrValues cfg.firefoxIntegration.profiles);
+  anyLibrewolfIntegrationProfileIsEnabled = builtins.any (x: x.enable) (lib.attrsets.attrValues cfg.librewolfIntegration.profiles);
   defaultAutofirmaSettings = lib.recursiveUpdate cfg.finalPackage.clienteafirma.preferences {
     "default.locale".default = if osConfig ? defaultLocale then osConfig.defaultLocale else "en_US";
   };
@@ -49,6 +50,11 @@ with lib; let
     };
     generate = name: value: json-to-xmlprefs name (boolsToStrings value);
   };
+  autofirma-librewolf-wrapper = pkgs.writeScriptBin "autofirma-librewolf-wrapper" ''
+    echo Holiiiiiiii
+    export AFIRMA_NSS_PROFILES_INI=$HOME/.librewolf/profiles.ini
+    exec ${cfg.finalPackage}/bin/autofirma "$@"
+  '';
 in {
   options.programs.autofirma.truststore = {
     package = mkPackageOption inputs.self.packages.${system} "autofirma-truststore" {};
@@ -101,6 +107,25 @@ in {
       description = "Firefox profiles to integrate AutoFirma with.";
     };
 
+    librewolfIntegration.profiles = mkOption {
+      type = types.attrsOf (types.submodule ({
+        config,
+        name,
+        ...
+      }: {
+        options = {
+          name = mkOption {
+            type = types.str;
+            default = name;
+            description = "Profile name.";
+          };
+
+          enable = mkEnableOption "Enable AutoFirma in this librewolf profile.";
+        };
+      }));
+      description = "Firefox profiles to integrate AutoFirma with.";
+    };
+
     config = mkOption {
       type = autofirma-prefs-format.type;
       description = "Settings to apply to the AutoFirma package.";
@@ -143,5 +168,18 @@ in {
         "network.protocol-handler.external.afirma" = true;
       };
     });
+
+    programs.librewolf.policies.Certificates = mkIf anyLibrewolfIntegrationProfileIsEnabled {
+      ImportEnterpriseRoots = true;
+      Install = [ "${config.home.homeDirectory}/.afirma/AutoFirma/AutoFirma_ROOT.cer" ];
+    };
+    programs.librewolf.profiles = flip mapAttrs cfg.librewolfIntegration.profiles (name: {enable, ...}: {
+      settings = mkIf enable {
+        "network.protocol-handler.app.afirma" = "${autofirma-librewolf-wrapper}/bin/autofirma-librewolf-wrapper";
+        "network.protocol-handler.warn-external.afirma" = false;
+        "network.protocol-handler.external.afirma" = true;
+        "network.protocol-handler.expose.afirma" = true;
+      };
+    });
   };
 }
diff --git a/...-module/autofirma/librewolfIntegration/connection-method/build-connection-method-test.nix b/...-module/autofirma/librewolfIntegration/connection-method/build-connection-method-test.nix
@@ -0,0 +1,71 @@
+{ testName, jsTestFile }:
+{ self, pkgs, system, home-manager }:
+let
+  testCerts = pkgs.callPackage ../../../../_common/pkgs/test_certs.nix {};
+in
+pkgs.nixosTest {
+  name = testName;
+  nodes.machine = { config, pkgs, modulesPath, ... }: {
+    imports = [
+      home-manager.nixosModules.home-manager
+      (modulesPath + "./../tests/common/x11.nix")
+      ../../../../_common/tests/autofirma_test_server
+      ../../../../_common/hm-as-nixos-module/autofirma-user.nix
+    ];
+
+    home-manager.users.autofirma-user = {config, osConfig, ... }: {
+      imports = [
+        self.homeManagerModules.autofirma
+      ];
+
+      programs.autofirma.enable = true;
+      programs.autofirma.truststore.package = self.packages."${system}".autofirma-truststore.override (old: {
+        caBundle = osConfig.environment.etc."ssl/certs/ca-certificates.crt".source;
+        govTrustedCerts = old.govTrustedCerts ++ osConfig.security.pki.certificateFiles;
+      });
+      programs.autofirma.librewolfIntegration.profiles.default.enable = true;
+
+      programs.librewolf.enable = true;
+      programs.librewolf.profiles.default.id = 0;
+      # Allow Librewolf to open AutoConfig settings without user interaction
+      programs.librewolf.profiles.default.settings."network.protocol-handler.expose.afirma" = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      nss.tools
+    ];
+
+    autofirma-test-server.jsTestFile = jsTestFile;
+  };
+
+  testScript = ''
+    def user_cmd(cmd):
+      return f"su -l autofirma-user --shell /bin/sh -c $'export XDG_RUNTIME_DIR=/run/user/$UID ; {cmd}'"
+
+    machine.wait_for_unit("default.target")
+    machine.wait_for_x()
+
+    machine.wait_for_open_port(port=443)
+
+    profile_dir = "default"
+    machine.execute(user_cmd("librewolf >&2 &"))
+
+    machine.wait_for_file(f"/home/autofirma-user/.librewolf/{profile_dir}/cert9.db")
+    machine.wait_for_file(f"/home/autofirma-user/.librewolf/{profile_dir}/key4.db")
+    machine.sleep(5)
+
+    machine.succeed(user_cmd(f'pk12util -i ${testCerts}/ciudadano_scard_act.p12 -d sql:/home/autofirma-user/.librewolf/{profile_dir} -W ""'))
+    machine.sleep(5)
+
+    machine.succeed("rm -f /tmp/test_output.txt")
+
+    # Open librewolf and allow it to import AutoConfig settings
+    machine.execute(user_cmd("librewolf --new-tab https://autofirma-nix.com/index.php >&2 &"))
+
+    machine.wait_for_file("/tmp/test_output.txt")
+    machine.sleep(5)
+    machine.succeed("grep 'Signature Successful:' /tmp/test_output.txt")
+
+  '';
+}
+
diff --git a/...hm-as-nixos-module/autofirma/librewolfIntegration/connection-method/websocket/default.nix b/...hm-as-nixos-module/autofirma/librewolfIntegration/connection-method/websocket/default.nix
@@ -0,0 +1,4 @@
+import ../build-connection-method-test.nix {
+  testName = "test-hm-as-nixos-module-autofirma-librewolfIntegration-connection-method-websocket";
+  jsTestFile = ./test.js;
+}
diff --git a/...sts/hm-as-nixos-module/autofirma/librewolfIntegration/connection-method/websocket/test.js b/...sts/hm-as-nixos-module/autofirma/librewolfIntegration/connection-method/websocket/test.js
@@ -0,0 +1,61 @@
+// JavaScript implementation for TestAutoFirma using provided signing services
+
+(function() {
+    function initializeMiniApplet(storageUrl, retrieverUrl) {
+        console.log(`Initializing MiniApplet with ${storageUrl} and ${retrieverUrl}`);
+        MiniApplet.cargarAppAfirma(storageUrl);
+    }
+
+    function generateSignature(data, onSuccess, onError) {
+        try {
+            MiniApplet.sign(data, "SHA256withRSA", "CAdES", "headless=true", onSuccess, onError);
+        } catch (error) {
+            onError("Exception", error.message);
+        }
+    }
+
+    function sendResultToServer(message) {
+        const formData = new FormData();
+        formData.append("test_output", message);
+
+        fetch("/test.php", {
+            method: "POST",
+            body: formData
+        }).then(response => {
+            if (response.ok) {
+                console.log("Result sent successfully.");
+            } else {
+                console.error("Failed to send result to server.");
+            }
+        }).catch(error => {
+            console.error("Error sending result to server:", error);
+        });
+    }
+
+    function handleSignatureResult(message) {
+        console.log(`Signature Successful: ${message}`);
+        sendResultToServer(`Signature Successful: ${message}`);
+    }
+
+    function handleError(errorType, errorMessage) {
+        console.error(`Error (${errorType}): ${errorMessage}`);
+        sendResultToServer(`Error (${errorType}): ${errorMessage}`);
+    }
+
+    function startSigningProcess() {
+        const storageUrl = '/afirma-signature-storage';
+        const retrieverUrl = '/afirma-signature-retriever';
+        const dataToSign = btoa(document.documentElement.outerHTML);
+
+        initializeMiniApplet(storageUrl, retrieverUrl);
+
+        generateSignature(
+            dataToSign,
+            handleSignatureResult,
+            handleError
+        );
+    }
+
+    // Automatically start the signing process on page load
+    window.addEventListener('DOMContentLoaded', startSigningProcess);
+})();
diff --git a/nix/tests/hm-as-nixos-module/autofirma/librewolfIntegration/protocol-handler/default.nix b/nix/tests/hm-as-nixos-module/autofirma/librewolfIntegration/protocol-handler/default.nix
@@ -0,0 +1,61 @@
+{ self, pkgs, home-manager, lib }:
+pkgs.nixosTest {
+  name = "test-hm-as-nixos-module-autofirma-librewolfIntegration-protocol-handler";
+  nodes.machine = { config, pkgs, modulesPath, ... }: {
+    imports = [
+      home-manager.nixosModules.home-manager
+      (modulesPath + "./../tests/common/x11.nix")
+      ../../../../_common/hm-as-nixos-module/autofirma-user.nix
+    ];
+
+    home-manager.users.autofirma-user = {config, ... }: {
+      imports = [
+        self.homeManagerModules.autofirma
+      ];
+      programs.librewolf.enable = true;
+      programs.librewolf.profiles.default.id = 0;
+      programs.librewolf.profiles.default.settings."network.protocol-handler.expose.afirma" = true;
+
+      programs.autofirma.enable = true;
+      programs.autofirma.librewolfIntegration.profiles.default.enable = true;
+
+      home.packages = [
+        (pkgs.writeScriptBin "open-autofirma-via-librewolf" ''
+          cat <<'EOF' > /tmp/autofirma.html
+          <html>
+            <head>
+              <meta http-equiv="refresh" content="0;url=afirma://sign?op=sign&algorithm=SHA256withRSA&format=AUTO">
+            </head>
+            <body>
+              <p>Redirecting to autofirma...</p>
+            </body>
+          </html>
+          EOF
+
+          ${lib.getExe config.programs.librewolf.finalPackage} /tmp/autofirma.html
+        '')
+      ];
+    };
+  };
+
+  testScript = ''
+    def user_cmd(cmd):
+      return f"su -l autofirma-user --shell /bin/sh -c $'export XDG_RUNTIME_DIR=/run/user/$UID ; {cmd}'"
+
+    machine.wait_for_unit("default.target")
+    machine.wait_for_x()
+
+    # Open librewolf and allow it to import AutoConfig settings
+    machine.execute(user_cmd("librewolf >&2 &"))
+    machine.wait_for_window("LibreWolf")
+    machine.sleep(5)
+
+    # Open an afirma:// URL in Librewolf
+    machine.execute(user_cmd("open-autofirma-via-librewolf"))
+
+    # Wait for the AutoFirma window to appear
+    machine.wait_for_window('Seleccione el fichero de datos a firmar', 30)
+    machine.sleep(5)
+    machine.screenshot("screen")
+  '';
+}