Assinando e verificando um JWS PIX (RFC 7515)

// Importa o cliente Dinamo HSM
import { hsm } from "@dinamonetworks/hsm-dinamo";

// Define os parâmetros de conexão com o HSM
const options = {
  host: "127.0.0.1",
  authUsernamePassword: {
    username: "master",
    password: "12345678",
  },
};

// Chave privada RSA-2048 de teste do RFC 7515, Apêndice A.2 (PKCS#1 DER)
const testKey = Buffer.from(
  "MIIEowIBAAKCAQEAofgWCuLjybRlzo0tZWJjNiuSfb4p4fAkd/wWJcyQoTbji9k0l8W26mPddxHmfHQp+Vaw+4qPCJrcS2mJPMEz" +
    "P1Pt0Bm4d4QlL+yRT+SFd2lZS+pCgNMsD1W/YpRPEwOWvG6b32690r2jZ47soMZo9wGzjb/7OMg0LOL+bSf63kpaSHSXndS5z5re" +
    "xMdbBYUsLA9e+KXBdQOS+UTo7WTBEMa2R2CapHg665xsmtdVMTBQY4uDZlxvb3qCo5ZwKh9kG4LT6/I5IhlJH7aGhyxXFvUK+DWN" +
    "moudF8NAco9/h9iaGNj8q2ethFkMLs91kzk2PAcDTW9gb54h4FRWyuXpoQIDAQABAoIBABKucaRpzQorw35SbEUAVx8dYXUdZOlJ" +
    "cHtiWQ+dC6V8ljxAHj/PLyzTveyI5QO/xkObCyjIL303l2cfUhPu2MFaJdjVzqACXuOrLot/eSFvxjvqVidTtAZExqFRJ9mylUVA" +
    "oLvhowVWmC1On95fZCXxTUtxNEG1Xcc7m0rtzJKs45J+N/V9DP1edYH6USyPSWGp6wuA+KgHRnKKVf9GRx80JQY7nVNkL17eHoTW" +
    "Ewga+lwi0FEoW9Y7lDtWXYmKBWhUE+U8PGxlJf8f40493HDw1WRQ/aSLoS4QTp3rn7gYgeHEvfJdkkf0UMhlknlo53M09EFPdadQ" +
    "4TlUbjqKc50CgYEA4BzEEOtIpmVdVEZNCqS7baC4crd0pqnRH/5IB3jw3bcxGn6QLvnEtfdUdiYrqBdss1l58BQ3KhooKeQTa9AB" +
    "0Hw/Py5PJdTJNPY8cQn7ouZ2KKDcmnPGBY5t7yLc1QlQ5xHdwW1VhvKn+nXqhJTBgIPgtldC+KDV5z+y2XDwGUcCgYEAuQPEfgmV" +
    "tjL0Uyyx88GZFF1fOunH3+7cepKmtH4pxhtCoHqpWmT8YAmZxaewHgHAjLYsp1ZSe7zFYHj7C6ul7TjeLQeZD/YwD66t62wDmpe/" +
    "HlB+TnBA+njbglfIsRLtXlnDzQkv5dTltRJ11BKBBypeeF6689rjcJIDEz9RWdcCgYAHAp9XcCSrn8wVkMVkKdb7DOX4IKjzdahm" +
    "+ctDAJN4O/y7OW5FKebvUjdAIt2GuoTZ71iTG+7F0F+lP88jtjP4U4qe7VHoewl4MKOfXZKTe+YCS1XbNvfgwJ3Ltyl1OH9hWvu2" +
    "yza7q+d5PCsDzqtm27kxuvULVeya+TEdAB1ijQKBgQCH/3r6YrVH/uCWGy6bzV1nGNOdjKc9tmkfOJmN54dxdixdpozCQ6U4OxZr" +
    "sj3FcOhHBsqAHvX2uuYjagqvo3cOj1TRqNocX40omfCCMx3bD1yPPf/6TI2XECva/ggqEY2mYzmIiA5LVVmc5nrybr+lssFKneey" +
    "xN2Wq93S0iJMdQKBgCGHewxzoa1r8ZMD0LETNrToK423K377UCYqXfg5XMclbrjPbEC3YI1ZNqMtuhdBJqUnBi6tjKMF+34Xf0CU" +
    "N8ncuXGO2CAYvO8PdyCixHX52ybaDjy1FtCE6yUXjoKNXKvUm7MWGsAYH6f4IegOetN5NvmUMFStCSkh7ixZLkN1",
  "base64"
);

// Certificado de teste da chave acima (X.509 DER), usado como âncora de confiança
const testCert = Buffer.from(
  "MIIDIDCCAgigAwIBAgIEeZYC0TANBgkqhkiG9w0BAQUFADApMQ8wDQYDVQQLDAZDU1BCLTExFjAUBgNVBAsMDUlTUEItMTIzNDU2" +
    "NzgwHhcNMjAwMjA5MjMwMDQwWhcNMzcxMTI2MjMwMDQwWjApMQ8wDQYDVQQLDAZDU1BCLTExFjAUBgNVBAsMDUlTUEItMTIzNDU2" +
    "NzgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCh+BYK4uPJtGXOjS1lYmM2K5J9vinh8CR3/BYlzJChNuOL2TSXxbbq" +
    "Y913EeZ8dCn5VrD7io8ImtxLaYk8wTM/U+3QGbh3hCUv7JFP5IV3aVlL6kKA0ywPVb9ilE8TA5a8bpvfbr3SvaNnjuygxmj3AbON" +
    "v/s4yDQs4v5tJ/reSlpIdJed1LnPmt7Ex1sFhSwsD174pcF1A5L5ROjtZMEQxrZHYJqkeDrrnGya11UxMFBji4NmXG9veoKjlnAq" +
    "H2QbgtPr8jkiGUkftoaHLFcW9Qr4NY2ai50Xw0Byj3+H2JoY2PyrZ62EWQwuz3WTOTY8BwNNb2BvniHgVFbK5emhAgMBAAGjUDBO" +
    "MB0GA1UdDgQWBBQzGIiPp7+DkM3e011UielRYxna2TAfBgNVHSMEGDAWgBQzGIiPp7+DkM3e011UielRYxna2TAMBgNVHRMEBTAD" +
    "AQH/MA0GCSqGSIb3DQEBBQUAA4IBAQChf74OjGSOaoenQTKB5dGrnco5yg4R0+YzkFz7F/ogRYxU8vXNyIoLNHoBp4+iwF5V6eGH" +
    "LK1iAwBhhAR4m8A1wL0aZ01AAzlzr2kAv32oXvkIbonFZ6FQZDCwGuH+oLqlU4zLAOxeMww/GIKLa6iLV8X28DazjsKAjlfABSWW" +
    "dFc7WspuycETfraYx6rbfTDHSxFXoechpAeZr/Z2agz2lIyJGFWA6OJDgzqO45vBqpjDWQE09EZonrUlGyjbMltYglImWrb7d/e7" +
    "SEprNjzeN2hIm/Fc4nPr5lpRJf7p8Bi62U7i8Ic0FhoB41MzNYOE7/SoGOM1B6Tb5wZzi8iv",
  "base64"
);

async function pixJwsSignCheck() {
  // Conecta ao HSM
  const conn = await hsm.connect(options);

  const keyName = "jws_example_key";
  const certName = "jws_example_cert";

  // Remove objetos de execuções anteriores, se existirem
  for (const name of [keyName, certName]) {
    try {
      await conn.key.delete(name);
    } catch {
      // Objeto não existe
    }
  }

  // Importa a chave privada e o certificado
  await conn.key.import(keyName, hsm.enums.RSA_ASYMMETRIC_KEYS.ALG_RSA_2048, testKey, true);
  await conn.key.importCertificate(certName, testCert);
  console.log("Chave e certificado importados");

  // Cabeçalho e payload JWS (JSON)
  const header = Buffer.from(JSON.stringify({ alg: "RS256" }));
  const payload = Buffer.from(
    JSON.stringify({
      calendario: { expiracao: 86400 },
      valor: { original: "1.23" },
      chave: "teste@teste.com",
      solicitacaoPagador: "Pergunta de teste?",
    })
  );

  // Gera o JWS (Compact Serialization: header.payload.assinatura em base64url)
  const jws = await conn.pix.PIXJWSSign(
    keyName, // Nome da chave privada
    0, // Flags de geração
    header, // Cabeçalho JWS
    payload // Payload JWS
  );
  console.log("JWS gerado:", jws.toString());

  // Verifica o JWS no HSM usando o certificado como âncora de confiança.
  // Em caso de assinatura inválida, chave incorreta ou certificado expirado,
  // uma exceção HsmError é lançada com o código de erro retornado pelo HSM.
  const checked = await conn.pix.PIXJWSCheck(
    certName, // Nome do certificado/cadeia de confiança
    null, // CRL (opcional)
    jws, // JWS a ser verificado
    0 // Flags de verificação
  );
  console.log("JWS verificado com sucesso");
  console.log("Cabeçalho retornado:", checked.header.toString());
  console.log("Payload retornado:", checked.payload.toString());

  // Remove os objetos criados
  for (const name of [keyName, certName]) {
    await conn.key.delete(name);
  }

  // Desconecta do HSM
  await conn.disconnect();
}

// Executa a função pixJwsSignCheck
pixJwsSignCheck();

Copy