What Web and Crypto components to use for Online Invoiceing REST API?
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
MrSteering · 2022-01-23 22:09

Hi Guys,

Pascal programming is my hobby. I should add an extension to my old
program, what I already succesfully migrated from Delphi 7 to
Lazarus...

The add-on is needed for the Hungarian NAV Online Invoice System REST
API v3.0: https://onlineszamla.nav.gov.hu/api/files/container/download
/Online%20Invoice%20System%203.0%20Interface%20Specification.pdf

I am newbie in web programming and encrypting, and need a bit of
kickstarting help
I need to send, retrieve xml files and make encrypting. I would like
to use as many stable/maintained and free components as possible, even
if it is more work.
Specified encoding/decoding standard needs for the API:
- BASE64 encode/decode (RFC3548)
- SHA-512 encode (RFC6234)
- SHA3-512 encode (FIPS 202)
- AES-128 ECB decode (RFC3826)

Here is an example TokenExchange code I found (with commercial
components), which illlustrates the needs of the REST API:
https://example-code.com/delphiDll/nav_token_exchange.asp

I think I will need:
- fpWeb (TFPHTTPClient)
- CryptoLib4Pascal (as I saw it supports all)
- xml (I am using TXMLDocument already - did not find good xml binding
support)

Can you please support me with some inputs on the components/packages
I should use?
It would be great to have a code example based on the linked example
using your proposed components/packages!

THANK YOU VERY MUCH!

----------------------------------------------------------------------
Thaddy · 2022-01-31 20:32

The best crypto lib is by Xor-El So you are on the right way
https://github.com/Xor-el/CryptoLib4Pascal

----------------------------------------------------------------------
engkin · 2022-02-01 03:50

I agree with Thaddy. You seem to have found all the right packages.

Page 16 of the pdf file has an example for calculating the signatue of
the request. Here is a quick test:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i program
project1; {$mode objfpc}{$H+} uses  {$IFDEF UNIX}  cthreads, 
{$ENDIF}  Classes  ,SysUtils  ,ClpDigestUtilities  ,ClpIDigest 
,ClpCryptoLibTypes  ,ClpConverters   ,ClpEncoders   ,RegExpr   { you
can add units after this }; function Timestamp2Str(const
ATimestamp:string):string;var  re:TRegExpr;begin 
re:=TRegExpr.Create;  try    re.Expression:='(\d{4})-(\d{2})-
(\d{2})T(\d{2}):(\d{2}):(\d{2})(.\d{1,3})?Z';   
re.InputString:=ATimestamp;    if re.Exec then      Result:=re.Match[1
]+re.Match[2]+re.Match[3]+re.Match[4]+re.Match[5]+re.Match[6]    else 
    Result:='';  finally    re.Free;  end;end; function
SHA3_512(AInput:String):String;var  LDigest:IDigest; 
LInputBytes:TCryptoLibByteArray; 
LOutputBytes:TCryptoLibByteArray=();begin 
LDigest:=TDigestUtilities.GetDigest('SHA3-512');  LInputBytes :=
TConverters.ConvertStringToBytes(AInput, TEncoding.UTF8); 
LDigest.BlockUpdate(LInputBytes, 0, Length(LInputBytes)); 
SetLength(LOutputBytes,LDigest.GetDigestSize); 
LDigest.DoFinal(LOutputBytes, 0);  Result:=TConverters.ConvertBytesToH
exString(LOutputBytes,False);end; function invoiceHash(const
AMsg:string; const invoiceOperation: string; const
invoiceData:string):string;var  hash_base:string; 
hash_upper:string;begin  WriteLn(AMsg); 
hash_base:=invoiceOperation+invoiceData;  WriteLn('hash_base:
',hash_base);  hash_upper:=SHA3_512(hash_base);  WriteLn('hash_upper:
',hash_upper);  WriteLn;  Result:=hash_upper;end; var 
requestId:string = 'TSTKFT1222564';  timestamp:string =
'2017-12-30T18:25:45.000Z';  {technical user’s signature }key:string =
'ce-8f5e-215119fa7dd621DLMRHRLH2S';   //the index#1 invoice data
items  invoiceOperation1:string = 'CREATE';  invoiceData1:string =
'QWJjZDEyMzQ=';   //the index#2 invoice data items 
invoiceOperation2:string = 'MODIFY';  invoiceData2:string =
'RGNiYTQzMjE=';   partial_authentication_value:string;   ih:array of
string;  base_signature:string;  request_signature:string;  i:
Integer;begin  ih:=[    invoiceHash('First:', invoiceOperation1,
invoiceData1),    invoiceHash('Second:', invoiceOperation2,
invoiceData2)      ];  
partial_authentication_value:=requestId+Timestamp2Str(timestamp)+key; 
WriteLn('partial authentication value'); 
WriteLn(partial_authentication_value);  WriteLn('');  
base_signature:=partial_authentication_value;  for i:=0 to High(ih)
do    base_signature:=base_signature+ih[i];  SetLength(ih,0);  
WriteLn('base signature:');  WriteLn(base_signature);  WriteLn('');  
request_signature:=SHA3_512(base_signature);  WriteLn('request
signature:');  WriteLn(request_signature);   ReadLn;end.

----------------------------------------------------------------------
MrSteering · 2022-02-02 15:25

Thanx a lot Guys!

I go for it than

----------------------------------------------------------------------
MrSteering · 2022-02-07 00:22

Let me ask for another shot.
Is there some documentation or good examples how to use TFPHttpClient
for my needed operations:
- send requests xmls
- get response xmls
- post specific xmls
???

I think the xml handling I will be able to handle, however as earlier
mentioned an xml binder would be great...

Thanx in advanced again.