pdf-lite 1.0.0

package/packages/pdf-lite/src/signing/signer.ts

@@ -0,0 +1,120 @@
+import { PdfCommentToken } from '../core/tokens/comment-token'
+import { PdfHexadecimalToken } from '../core/tokens/hexadecimal-token'
+import { PdfNameToken } from '../core/tokens/name-token'
+import { PdfToken } from '../core/tokens/token'
+import { PdfDocument } from '../pdf/pdf-document'
+import { concatUint8Arrays } from '../utils/concatUint8Arrays'
+import { PdfDocumentSecurityStoreObject } from './document-security-store'
+import { PdfSignatureObject } from './signatures'
+
+/**
+ * Handles digital signing operations for PDF documents.
+ * Processes signature objects and optionally stores revocation information in the DSS.
+ *
+ * @example
+ * ```typescript
+ * const signer = new PdfSigner()
+ * const signedDoc = await signer.sign(document)
+ * ```
+ */
+export class PdfSigner {
+    /** Whether to use the Document Security Store for revocation information. */
+    useDocumentSecurityStore: boolean = true
+
+    /**
+     * Signs all signature objects in the document.
+     * Computes byte ranges, generates signatures, and optionally adds revocation info to DSS.
+     *
+     * @param document - The PDF document to sign.
+     * @returns The signed document.
+     */
+    async sign(document: PdfDocument): Promise<PdfDocument> {
+        const signatures: PdfSignatureObject[] = [
+            ...document.objects.filter((x) => x instanceof PdfSignatureObject),
+        ]
+
+        const dss = this.useDocumentSecurityStore
+            ? (document.objects.find(
+                  (x) => x instanceof PdfDocumentSecurityStoreObject,
+              ) ?? new PdfDocumentSecurityStoreObject(document))
+            : undefined
+
+        for (let i = 0; i < signatures.length; i++) {
+            const signature = signatures[i]
+            const tokens = document.tokensWithObjects()
+            const signableTokens: PdfToken[] = []
+
+            let contentsOffset = 0
+            let contentsLength = 0
+            let byteCount = 0
+            let seen = 0
+
+            for (let j = 0; j < tokens.length; j++) {
+                let { token, object } = tokens[j]
+
+                if (!(object instanceof PdfSignatureObject)) {
+                    signableTokens.push(token)
+                } else if (
+                    !(token instanceof PdfNameToken) ||
+                    token.name !== 'Contents'
+                ) {
+                    signableTokens.push(token)
+                } else {
+                    while (token instanceof PdfHexadecimalToken === false) {
+                        byteCount += token.byteLength
+                        token = tokens[++j].token
+                    }
+
+                    const contentsToken = token
+
+                    const tokenStr = contentsToken.toString()
+                    const start = tokenStr.indexOf('<')
+
+                    contentsOffset = byteCount + start
+                    contentsLength = tokenStr.indexOf('>') - start + 1
+                    seen++
+                }
+
+                byteCount += token.byteLength
+
+                if (
+                    seen === i + 1 &&
+                    PdfCommentToken.isEofCommentToken(token)
+                ) {
+                    break
+                }
+            }
+
+            const byteRange = [
+                0,
+                contentsOffset,
+                contentsOffset + contentsLength,
+                byteCount - (contentsOffset + contentsLength),
+            ]
+            signature.setByteRange(byteRange)
+
+            const allBytes = document.toBytes()
+
+            const toSign = concatUint8Arrays(
+                allBytes.slice(byteRange[0], byteRange[1]),
+                allBytes.slice(byteRange[2], byteRange[3] + byteRange[2]),
+            )
+
+            const { signedBytes, revocationInfo } = await signature.sign({
+                bytes: toSign,
+                embedRevocationInfo: !Boolean(dss),
+            })
+
+            signature.setSignedBytes(signedBytes)
+            if (dss && revocationInfo) {
+                await dss.addRevocationInfo(revocationInfo)
+            }
+        }
+
+        if (dss && !dss.isEmpty()) {
+            await document.setDocumentSecurityStore(dss)
+        }
+
+        return document
+    }
+}

package/packages/pdf-lite/src/signing/types.ts

@@ -0,0 +1,86 @@
+import { HashAlgorithm } from 'pki-lite/core/crypto/index.js'
+import { PdfDictionary } from '../core/objects/pdf-dictionary'
+import { PdfName } from '../core/objects/pdf-name'
+import { PdfHexadecimal } from '../core/objects/pdf-hexadecimal'
+import { PdfArray } from '../core/objects/pdf-array'
+import { PdfNumber } from '../core/objects/pdf-number'
+import { PdfString } from '../core/objects/pdf-string'
+import { ByteArray } from '../types'
+
+/**
+ * PDF signature subfilter types defining the signature format.
+ * - 'adbe.pkcs7.detached': PKCS#7 detached signature
+ * - 'adbe.pkcs7.sha1': PKCS#7 SHA-1 signature
+ * - 'adbe.x509.rsa_sha1': X.509 RSA-SHA1 signature
+ * - 'ETSI.CAdES.detached': CAdES detached signature
+ * - 'ETSI.RFC3161': RFC 3161 timestamp signature
+ */
+export type PdfSignatureSubType =
+    | 'adbe.pkcs7.detached'
+    | 'adbe.pkcs7.sha1'
+    | 'adbe.x509.rsa_sha1'
+    | 'ETSI.CAdES.detached'
+    | 'ETSI.RFC3161'
+
+/**
+ * PDF signature type.
+ * - 'Sig': Standard digital signature
+ * - 'DocTimeStamp': Document timestamp
+ */
+export type PdfSignatureType = 'Sig' | 'DocTimeStamp'
+
+/**
+ * Entries in a PDF signature dictionary.
+ */
+export type PdfSignatureDictionaryEntries = {
+    Type: PdfName<PdfSignatureType>
+    Filter: PdfName
+    SubFilter: PdfName<PdfSignatureSubType>
+    Contents: PdfHexadecimal
+    ByteRange: PdfArray<PdfNumber>
+    Reason?: PdfString
+    M?: PdfString
+    Name?: PdfString
+    Reference?: PdfArray<PdfDictionary>
+    Location?: PdfString
+    ContactInfo?: PdfString
+    V?: PdfName<'2.2'>
+    Changes?: PdfArray<PdfNumber>
+    Cert?: PdfArray<PdfString | PdfHexadecimal> | PdfString | PdfHexadecimal
+}
+
+/**
+ * Configuration for a timestamp authority (TSA).
+ */
+export type TimeStampAuthority = {
+    /** URL of the timestamp authority service. */
+    url: string
+    /** Optional username for authentication. */
+    username?: string
+    /** Optional password for authentication. */
+    password?: string
+}
+
+/**
+ * Revocation information for certificate validation.
+ */
+export type RevocationInfo = {
+    /** Certificate Revocation Lists (CRLs). */
+    crls?: ByteArray[]
+    /** OCSP responses. */
+    ocsps?: ByteArray[]
+    /** Other revocation information types. */
+    otherRevInfo?: { type: string; value: ByteArray }[]
+}
+
+/**
+ * Signature policy document reference for CAdES signatures.
+ */
+export type SignaturePolicyDocument = {
+    /** Object Identifier for the signature policy. */
+    oid: string
+    /** Hash of the policy document. */
+    hash: ByteArray
+    /** Hash algorithm used for the policy document. */
+    hashAlgorithm: HashAlgorithm
+}

package/packages/pdf-lite/src/signing/utils.ts

@@ -0,0 +1,71 @@
+import { Certificate } from 'pki-lite/x509/Certificate'
+import { RevocationInfo } from './types'
+import { ByteArray } from '../types'
+
+/**
+ * Fetches revocation information (CRLs and OCSPs) for certificates.
+ * Uses the certificate's embedded URLs to retrieve revocation data.
+ *
+ * @param options - Configuration for fetching revocation info.
+ * @param options.certificates - Array of DER-encoded certificates.
+ * @param options.issuerCertificate - Optional issuer certificate for OCSP requests.
+ * @param options.ocspUrls - Optional additional OCSP URLs.
+ * @param options.crlUrls - Optional additional CRL URLs.
+ * @param options.retrieveOcsps - Whether to fetch OCSP responses (default: true).
+ * @param options.retrieveCrls - Whether to fetch CRLs (default: true).
+ * @returns The fetched revocation information.
+ *
+ * @example
+ * ```typescript
+ * const revInfo = await fetchRevocationInfo({
+ *     certificates: [certBytes],
+ *     retrieveCrls: true,
+ *     retrieveOcsps: true
+ * })
+ * ```
+ */
+export async function fetchRevocationInfo(options: {
+    certificates: ByteArray[]
+    issuerCertificate?: ByteArray
+    ocspUrls?: string[] // URLs to fetch OCSPs from
+    crlUrls?: string[] // URLs to fetch CRLs from
+    retrieveOcsps?: boolean // Whether to fetch OCSPs
+    retrieveCrls?: boolean // Whether to fetch CRLs
+}): Promise<RevocationInfo> {
+    const { certificates, retrieveCrls = true, retrieveOcsps = true } = options
+
+    const crls: ByteArray[] = []
+    const ocsps: ByteArray[] = []
+
+    for (const certificateBytes of certificates) {
+        const certificate = Certificate.fromDer(certificateBytes)
+
+        if (retrieveCrls) {
+            const crl = await certificate.requestCrl()
+
+            if (crl) {
+                crls.push(crl.toDer())
+            }
+        }
+
+        if (retrieveOcsps) {
+            const ocsp = await certificate.requestOcsp({
+                issuerCertificate: options.issuerCertificate
+                    ? Certificate.fromDer(
+                          options.issuerCertificate as ByteArray,
+                      )
+                    : undefined,
+            })
+
+            if (ocsp) {
+                ocsps.push(ocsp.toDer())
+            }
+        }
+    }
+
+    return {
+        crls,
+        ocsps,
+        otherRevInfo: [],
+    }
+}

package/packages/pdf-lite/src/types.ts

@@ -0,0 +1,44 @@
+export type ByteArray = Uint8Array<ArrayBuffer>
+
+export type HashAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512'
+export type ChangeType = 'add' | 'update' | 'delete'
+
+export type PdfEncryptionAlgorithm =
+    | 'RC4-40'
+    | 'RC4-128'
+    | 'AES-128-CBC'
+    | 'AES-256-CBC'
+    | 'none'
+
+export type DecodeParms = {
+    Predictor?: number
+    Columns?: number
+    Colors?: number
+    BitsPerComponent?: number
+}
+
+export type PdfPermissions = {
+    all?: boolean
+    print?: boolean
+    modify?: boolean
+    copy?: boolean
+    annotate?: boolean
+    fill?: boolean
+    extract?: boolean
+    assemble?: boolean
+    printHighQuality?: boolean
+}
+
+export const PERMISSION_FLAGS: Record<keyof PdfPermissions, number> = {
+    all: 0xffffffff,
+    print: 0x00000004,
+    modify: 0x00000008,
+    copy: 0x00000010,
+    annotate: 0x00000020,
+    fill: 0x00000100,
+    extract: 0x00000200,
+    assemble: 0x00000400,
+    printHighQuality: 0x00000800,
+}
+
+export type PdfVersion = 1.3 | 1.4 | 1.5 | 1.6 | 1.7 | 2.0

package/packages/pdf-lite/src/utils/IterableReadableStream.ts

@@ -0,0 +1,30 @@
+/**
+ * A ReadableStream that supports async iteration.
+ * Extends the standard ReadableStream with Symbol.asyncIterator support.
+ *
+ * @typeParam T - The type of chunks yielded by the stream.
+ *
+ * @example
+ * ```typescript
+ * const stream = new IterableReadableStream<Uint8Array>(...)
+ * for await (const chunk of stream) {
+ *   console.log(chunk)
+ * }
+ * ```
+ */
+export class IterableReadableStream<T> extends ReadableStream<T> {
+    /**
+     * Returns an async iterator for the stream.
+     *
+     * @returns An async iterator that yields chunks from the stream.
+     */
+    [Symbol.asyncIterator]() {
+        const reader = this.getReader()
+        return {
+            async next(): Promise<IteratorResult<T>> {
+                const result = await reader.read()
+                return result as IteratorResult<T>
+            },
+        }
+    }
+}