@muhammara/native-core 7.1.0 → 7.2.0

package/lib/Recipe.js

@@ -390,14 +390,7 @@ class Recipe {
         }
       }
       if (this.needToEncrypt) {
-        if (this.isBufferSrc) {
-          // eslint-disable-next-line no-console
-          console.log(
-            "Feature: Encryption is not supported in Buffer Mode yet.",
-          );
-        } else {
-          this._encrypt();
-        }
+        this._encrypt();
       }
 
       if (this.isBufferSrc && this.output) {

package/lib/recipe/encrypt.js

@@ -1,5 +1,6 @@
 const fs = require("fs");
 const { Permission } = require("../recipe-constants");
+const PDFWStreamForBuffer = require("../PDFWStreamForBuffer");
 
 /**
  * Encryption user access permissions
@@ -101,8 +102,9 @@ exports._getEncryptOptions = function _getEncryptOptions(
  * @param {string} [options.ownerPassword] - The password for editing.
  * @param {string} [options.userPassword] - The password for viewing & encryption.
  * @param {number} [options.userProtectionFlag] - The flag for the security level, see `permission()`.
- * @returns {Recipe} The recipe instance. The file is encrypted by `endPDF()`;
- *   Buffer sources are not encrypted.
+ * @returns {Recipe} The recipe instance. The output is encrypted by `endPDF()`:
+ *   the output file for a path source, and the Buffer passed to the callback
+ *   (or written to the output path) for a Buffer source.
  */
 exports.encrypt = function encrypt(options = {}) {
   this.needToEncrypt = true;
@@ -113,18 +115,43 @@ exports.encrypt = function encrypt(options = {}) {
 
 // http://pdfhummus.com/post/147451287581/hummus-1058-and-pdf-writer-updates-encryption
 /**
- * Re-encrypt the finished output file with the encrypt() options.
+ * Re-encrypt the finished output with the encrypt() options. A path source
+ * re-encrypts the output file in place; a Buffer source re-encrypts the
+ * collected output bytes, so the callback and an output path receive the
+ * encrypted PDF. Nothing happens when encrypt() was given no password, as on
+ * Wasm. The finished output is opened with the password the Recipe was
+ * created with, or none for an empty user password, so a PDF whose
+ * constructor options already encrypted it can still be re-encrypted with new
+ * passwords.
  * @private
  * @returns {void}
  * @throws {Error} If the output cannot be renamed, re-encrypted or removed.
  */
 exports._encrypt = function _encrypt() {
-  if (!this.encryption_) {
+  if (!this.encryption_ || Object.keys(this.encryption_).length === 0) {
+    return;
+  }
+  const recryptOptions = Object.assign({}, this.encryption_, {
+    password: this.encryptOptions.password,
+  });
+
+  if (this.isBufferSrc) {
+    const encrypted = new PDFWStreamForBuffer();
+    this.muhammara.recrypt(
+      new this.muhammara.PDFRStreamForBuffer(
+        this.outStream.buffer || Buffer.alloc(0),
+      ),
+      encrypted,
+      recryptOptions,
+    );
+    // Replace the collected bytes instead of the stream, so the unencrypted
+    // output is dropped rather than kept alive next to the encrypted one.
+    this.outStream.buffer = encrypted.buffer;
     return;
   }
 
   const tmp = this.output + ".tmp.pdf";
   fs.renameSync(this.output, tmp);
-  this.muhammara.recrypt(tmp, this.output, this.encryption_);
+  this.muhammara.recrypt(tmp, this.output, recryptOptions);
   fs.unlinkSync(tmp);
 };

package/muhammara.d.ts

@@ -4182,8 +4182,9 @@ declare namespace muhammara {
      * @param options.ownerPassword - The password for editing.
      * @param options.userPassword - The password for viewing & encryption.
      * @param options.userProtectionFlag - The flag for the security level, see `permission()`.
-     * @returns The recipe instance. The file is encrypted by `endPDF()`;
-     *   Buffer sources are not encrypted.
+     * @returns The recipe instance. The output is encrypted by `endPDF()`:
+     *   the output file for a path source, and the Buffer passed to the
+     *   callback (or written to the output path) for a Buffer source.
      */
     encrypt(options?: Recipe.EncryptOptions): Recipe;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@muhammara/native-core",
-  "version": "7.1.0",
+  "version": "7.2.0",
   "description": "Shared JavaScript API for MuhammaraJS native packages",
   "homepage": "https://muhammarajs.readthedocs.io/",
   "license": "Apache-2.0",