Mattsson
07e89d9b52
* feat(invoices): add Peppol delivery foundation * fix(invoices): harden Peppol compliance guards * fix(api): narrow Peppol document loading * test(pg): hash Peppol fixture payload * fix(invoices): address Peppol review findings * test(pg): isolate Peppol provider events * test(pg): isolate Peppol submission fixtures
55 lines
1.6 KiB
PL/PgSQL
55 lines
1.6 KiB
PL/PgSQL
-- Ensure immutable Peppol documents are cryptographically bound to their
|
|
-- stored SHA-256 values even when an RPC is called outside the application.
|
|
|
|
CREATE OR REPLACE FUNCTION public.enforce_peppol_delivery_payload_hash()
|
|
RETURNS trigger
|
|
LANGUAGE plpgsql
|
|
SECURITY INVOKER
|
|
SET search_path = pg_catalog, public, extensions
|
|
AS $$
|
|
BEGIN
|
|
IF encode(extensions.digest(NEW.xml_payload, 'sha256'), 'hex')
|
|
IS DISTINCT FROM NEW.xml_sha256
|
|
THEN
|
|
RAISE EXCEPTION 'Peppol XML SHA-256 does not match the staged payload'
|
|
USING ERRCODE = '23514';
|
|
END IF;
|
|
|
|
RETURN NEW;
|
|
END;
|
|
$$;
|
|
|
|
CREATE TRIGGER enforce_peppol_delivery_payload_hash
|
|
BEFORE INSERT ON public.peppol_deliveries
|
|
FOR EACH ROW EXECUTE FUNCTION public.enforce_peppol_delivery_payload_hash();
|
|
|
|
CREATE OR REPLACE FUNCTION public.enforce_peppol_evidence_document_hash()
|
|
RETURNS trigger
|
|
LANGUAGE plpgsql
|
|
SECURITY INVOKER
|
|
SET search_path = pg_catalog, public, extensions
|
|
AS $$
|
|
BEGIN
|
|
IF NEW.document_payload IS NOT NULL
|
|
AND encode(extensions.digest(NEW.document_payload, 'sha256'), 'hex')
|
|
IS DISTINCT FROM NEW.document_sha256
|
|
THEN
|
|
RAISE EXCEPTION 'Peppol evidence document SHA-256 does not match the payload'
|
|
USING ERRCODE = '23514';
|
|
END IF;
|
|
|
|
RETURN NEW;
|
|
END;
|
|
$$;
|
|
|
|
CREATE TRIGGER enforce_peppol_evidence_document_hash
|
|
BEFORE INSERT ON public.peppol_delivery_evidence
|
|
FOR EACH ROW EXECUTE FUNCTION public.enforce_peppol_evidence_document_hash();
|
|
|
|
REVOKE ALL ON FUNCTION public.enforce_peppol_delivery_payload_hash()
|
|
FROM PUBLIC, anon, authenticated;
|
|
REVOKE ALL ON FUNCTION public.enforce_peppol_evidence_document_hash()
|
|
FROM PUBLIC, anon, authenticated;
|
|
|
|
NOTIFY pgrst, 'reload schema';
|