From 816bbce9c6b4c2a48618727b187bbc4f720f6c82 Mon Sep 17 00:00:00 2001
From: TekH <h.tek@digitaldata.works>
Date: Wed, 14 Oct 2026 14:49:15 +0200
Subject: [PATCH] Remove client-side SigningTime handling

The `SigningTime` property has been removed from the `PdfSignOptionsDto` class and related client-side input handling. It is now set automatically on the server side based on the `UseUtcSigningTime` configuration (`UtcNow` or local time).

Updated the `PdfDigitalSignatureService` to always set `SigningTime` server-side, ensuring consistent and deterministic behavior. Removed `SigningTime` from the `PdfSignatureController` and adjusted the logic to exclude it from the `signOptions` object.

Updated the `README.md` to reflect these changes, clarifying that `SigningTime` is now server-side only. These changes improve security and simplify client integration.
---
 EnvelopeGenerator.Application/Common/Dto/PdfSignOptionsDto.cs   | 1 -
 EnvelopeGenerator.Infrastructure.Crypt/README.md                | 1 +
 .../Services/PdfDigitalSignatureService.cs                      | 2 +-
 .../Controllers/PdfSignatureController.cs                       | 2 --
 4 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/EnvelopeGenerator.Application/Common/Dto/PdfSignOptionsDto.cs b/EnvelopeGenerator.Application/Common/Dto/PdfSignOptionsDto.cs
index ab9fa245..654a2c4b 100644
--- a/EnvelopeGenerator.Application/Common/Dto/PdfSignOptionsDto.cs
+++ b/EnvelopeGenerator.Application/Common/Dto/PdfSignOptionsDto.cs
@@ -9,7 +9,6 @@ public sealed record PdfSignOptionsDto
     public string? Reason { get; set; }
     public string? Location { get; set; }
     public string? ContactInfo { get; set; }
-    public DateTimeOffset? SigningTime { get; set; }
     public string? ApplicationName { get; set; }
     public PdfSignatureCertificationLevel? CertificationLevel { get; set; }
 }
diff --git a/EnvelopeGenerator.Infrastructure.Crypt/README.md b/EnvelopeGenerator.Infrastructure.Crypt/README.md
index 2ebbce43..383144d2 100644
--- a/EnvelopeGenerator.Infrastructure.Crypt/README.md
+++ b/EnvelopeGenerator.Infrastructure.Crypt/README.md
@@ -338,6 +338,7 @@ Aktueller Standard:
 - `UUID` kommt aus Sign-Input (nullable string). Wenn ungeltig/leer -> neue Guid wird erzeugt.
 - `Reason` wird intern angereichert mit strukturiertem Meta (`SFMETA:v1`).
 - `ApplicationName` ist rein serverseitig aus `appsettings` gesetzt.
+- `SigningTime` ist rein serverseitig und wird automatisch gesetzt (`UseUtcSigningTime=true` => `UtcNow`, sonst lokale Zeit).
 - `CertificationLevel` wird im Controller serverseitig gesetzt (`FormFillingAndAnnotations`), nicht vom Client.
 
 Damit ist das Verhalten deterministisch und manipulationsaermer fuer Integrationsclients.
diff --git a/EnvelopeGenerator.Infrastructure.Crypt/Services/PdfDigitalSignatureService.cs b/EnvelopeGenerator.Infrastructure.Crypt/Services/PdfDigitalSignatureService.cs
index 7e07a10a..7ab1a290 100644
--- a/EnvelopeGenerator.Infrastructure.Crypt/Services/PdfDigitalSignatureService.cs
+++ b/EnvelopeGenerator.Infrastructure.Crypt/Services/PdfDigitalSignatureService.cs
@@ -43,7 +43,7 @@ public sealed class PdfDigitalSignatureService(IOptions<Pkcs11Options> options)
             Reason = reasonWithMeta,
             Location = request.Location,
             ContactInfo = request.ContactInfo,
-            SigningTime = request.SigningTime ?? (pkcs11Options.UseUtcSigningTime ? DateTimeOffset.UtcNow : DateTimeOffset.Now),
+            SigningTime = pkcs11Options.UseUtcSigningTime ? DateTimeOffset.UtcNow : DateTimeOffset.Now,
             ApplicationName = pkcs11Options.ApplicationName,
             CertificationLevel = ToDevExpressCertificationLevel(request.CertificationLevel)
                 ?? ToDevExpressCertificationLevel(pkcs11Options.DefaultCertificationLevel)
diff --git a/EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/PdfSignatureController.cs b/EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/PdfSignatureController.cs
index d4c347ac..8f4da57d 100644
--- a/EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/PdfSignatureController.cs
+++ b/EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/PdfSignatureController.cs
@@ -18,7 +18,6 @@ public class PdfSignatureController(IPdfDigitalSignatureService signatureService
         public string? Reason { get; set; }
         public string? Location { get; set; }
         public string? ContactInfo { get; set; }
-        public DateTimeOffset? SigningTime { get; set; }
     }
 
     public sealed class CheckPdfSignatureForm
@@ -54,7 +53,6 @@ public class PdfSignatureController(IPdfDigitalSignatureService signatureService
             Reason = request.Reason,
             Location = request.Location,
             ContactInfo = request.ContactInfo,
-            SigningTime = request.SigningTime,
             CertificationLevel = PdfSignatureCertificationLevel.FormFillingAndAnnotations
         };