pdf-lite 1.0.1-alpha.2 → 1.0.1-alpha.3

package/packages/pdf-lite/src/security/handlers/v1.ts

@@ -1,225 +0,0 @@
-import { rc4 } from '../../crypto/ciphers/rc4'
-import {
-    computeMasterKey,
-    deriveObjectKey,
-} from '../../crypto/key-derivation/key-derivation'
-import {
-    computeORc4_40,
-    computeURc4_40,
-    decryptUserPasswordRc4_40,
-} from '../../crypto/key-gen/key-gen-rc4-40'
-import { Cipher } from '../../crypto/types'
-import { ByteArray } from '../../types'
-import { assert } from '../../utils/assert'
-import { bytesToString } from '../../utils/bytesToString'
-import { stringToBytes } from '../../utils/stringToBytes'
-import { PdfEncryptionAlgorithmType } from '../types'
-import { PdfStandardSecurityHandler } from './base'
-
-/**
- * V1 security handler implementing 40-bit RC4 encryption.
- * This is the original PDF encryption format (PDF 1.1).
- *
- * @example
- * ```typescript
- * const handler = new PdfV1SecurityHandler({
- *     password: 'user123',
- *     ownerPassword: 'admin456'
- * })
- * ```
- */
-export class PdfV1SecurityHandler extends PdfStandardSecurityHandler {
-    /**
-     * Gets the encryption revision number.
-     *
-     * @returns 2 for V1 encryption.
-     */
-    getRevision(): number {
-        return 2
-    }
-
-    /**
-     * Gets the encryption version number.
-     *
-     * @returns 1 for 40-bit RC4 encryption.
-     */
-    getVersion(): number {
-        return 1
-    }
-
-    /**
-     * Gets the encryption key length in bits.
-     *
-     * @returns 40 for V1 encryption.
-     */
-    getKeyBits(): number {
-        return 40
-    }
-
-    /**
-     * Computes the owner key (O value) using RC4-40 algorithm.
-     *
-     * @returns The computed owner key.
-     */
-    protected async computeOwnerKey(): Promise<ByteArray> {
-        return await computeORc4_40(
-            this.ownerPassword ?? this.password,
-            this.password,
-        )
-    }
-
-    /**
-     * Computes the user key (U value) using RC4-40 algorithm.
-     *
-     * @returns The computed user key.
-     * @throws Error if document ID, owner key, or permissions are not set.
-     */
-    protected async computeUserKey(): Promise<ByteArray> {
-        if (!this.documentId) {
-            throw new Error('Document ID is required to compute U value')
-        }
-
-        if (!this.ownerKey) {
-            throw new Error('Owner key is required to compute U value')
-        }
-
-        if (typeof this.permissions !== 'number') {
-            throw new Error('Permissions are required to compute U value')
-        }
-
-        return await computeURc4_40(
-            this.password,
-            this.ownerKey,
-            this.permissions,
-            this.documentId.items[0].bytes,
-        )
-    }
-
-    /**
-     * Computes the master encryption key from the password.
-     *
-     * @returns The computed master key.
-     * @throws Error if required parameters are missing or password is incorrect.
-     */
-    protected async computeMasterKey(): Promise<ByteArray> {
-        await this.initKeys()
-
-        assert(this.ownerKey, 'ownerKey is required')
-        assert(this.permissions !== undefined, 'Permissions are required')
-        assert(this.documentId, 'Document ID is required')
-        assert(
-            this.encryptMetadata !== undefined,
-            'Encrypt metadata is required',
-        )
-
-        if (this.ownerPassword) {
-            const recoverPass = await this.recoverUserPassword(
-                this.ownerPassword,
-            )
-
-            return await computeMasterKey(
-                stringToBytes(recoverPass),
-                this.ownerKey,
-                this.permissions,
-                this.documentId.items[0].bytes,
-                this.getKeyBits(),
-                this.encryptMetadata,
-                this.getRevision(),
-            )
-        } else {
-            const expectedUValue = await this.computeUserKey()
-
-            assert(
-                this.userKey &&
-                    expectedUValue.length === this.userKey.length &&
-                    expectedUValue.every(
-                        (byte, index) => byte === this.userKey![index],
-                    ),
-                'Incorrect user password',
-            )
-        }
-
-        return await computeMasterKey(
-            this.password,
-            this.ownerKey,
-            this.permissions,
-            this.documentId.items[0].bytes,
-            this.getKeyBits(),
-            this.encryptMetadata,
-            this.getRevision(),
-        )
-    }
-
-    /**
-     * Computes the object-specific encryption key.
-     *
-     * @param objectNumber - The PDF object number.
-     * @param generationNumber - The PDF generation number.
-     * @param algorithm - Optional algorithm type for key derivation.
-     * @returns The computed object key.
-     * @throws Error if object or generation number is invalid.
-     */
-    async computeObjectKey(
-        objectNumber?: number,
-        generationNumber?: number,
-        algorithm?: PdfEncryptionAlgorithmType,
-    ): Promise<ByteArray> {
-        assert(
-            objectNumber !== undefined,
-            'Object number is required to derive the key',
-        )
-        assert(
-            generationNumber !== undefined,
-            'Generation number is required to derive the key',
-        )
-
-        assert(objectNumber > 0, 'Object number cannot be zero or negative')
-        assert(generationNumber >= 0, 'Generation number cannot be negative')
-
-        this.masterKey ||= await this.computeMasterKey()
-
-        const key = await deriveObjectKey(
-            this.masterKey,
-            objectNumber,
-            generationNumber,
-            algorithm === 'AES-128-CBC',
-        )
-
-        return key
-    }
-
-    /**
-     * Gets an RC4 cipher for the specified object.
-     *
-     * @param objectNumber - The PDF object number.
-     * @param generationNumber - The PDF generation number.
-     * @returns An RC4 cipher instance.
-     */
-    protected async getCipher(
-        objectNumber?: number,
-        generationNumber?: number,
-    ): Promise<Cipher> {
-        const key = await this.computeObjectKey(objectNumber, generationNumber)
-
-        return rc4(key)
-    }
-
-    /**
-     * Recovers the user password from the owner password.
-     *
-     * @param ownerPassword - The owner password.
-     * @returns The recovered user password as a string.
-     */
-    async recoverUserPassword(
-        ownerPassword?: ByteArray | string,
-    ): Promise<string> {
-        ownerPassword ||= this.ownerPassword
-
-        const password = await decryptUserPasswordRc4_40(
-            stringToBytes(ownerPassword!),
-            this.ownerKey!,
-        )
-
-        return bytesToString(password)
-    }
-}

package/packages/pdf-lite/src/security/handlers/v4.ts

@@ -1,379 +0,0 @@
-import { PdfDictionary } from '../../core/objects/pdf-dictionary'
-import { PdfName } from '../../core/objects/pdf-name'
-import { PdfNumber } from '../../core/objects/pdf-number'
-import { aes128 } from '../../crypto/ciphers/aes128'
-import { deriveObjectKey } from '../../crypto/key-derivation/key-derivation'
-import { Cipher } from '../../crypto/types'
-import { ByteArray } from '../../types'
-import { assert, assertIfDefined } from '../../utils/assert'
-import { AesV2CryptFilter } from '../crypt-filters/aesv2'
-import { AesV3CryptFilter } from '../crypt-filters/aesv3'
-import { PdfCryptFilter } from '../crypt-filters/base'
-import { IdentityCryptFilter } from '../crypt-filters/identity'
-import { V2CryptFilter } from '../crypt-filters/v2'
-import {
-    CryptFilterType,
-    PdfCryptFilterDictionary,
-    PdfEncryptionAlgorithmType,
-    PdfEncryptionDictionary,
-} from '../types'
-import { PdfStandardSecurityHandlerOptions } from './base'
-import { PdfV2SecurityHandler } from './v2'
-
-const IDENTITY_CRYPT_FILTER = new IdentityCryptFilter({ authEvent: 'DocOpen' })
-
-/**
- * V4 security handler implementing AES-128-CBC encryption with crypt filters.
- * Supports different encryption methods for strings, streams, and embedded files (PDF 1.5).
- *
- * @example
- * ```typescript
- * const handler = new PdfV4SecurityHandler({
- *     password: 'user123',
- *     ownerPassword: 'admin456'
- * })
- * handler.setCryptFilter('StmFilter', new AesV2CryptFilter({ authEvent: 'DocOpen' }))
- * ```
- */
-export class PdfV4SecurityHandler extends PdfV2SecurityHandler {
-    /** Map of named crypt filters. */
-    protected cryptFilters: Map<string, PdfCryptFilter> = new Map([
-        ['Identity', IDENTITY_CRYPT_FILTER],
-    ])
-
-    /** Mapping of content types to crypt filter names. */
-    protected cryptFiltersByType: {
-        [key in CryptFilterType]?: string
-    } = {}
-
-    /**
-     * Creates a new V4 security handler with AES-128 encryption.
-     *
-     * @param options - Configuration options for the handler.
-     */
-    constructor(options: PdfStandardSecurityHandlerOptions) {
-        super(options)
-
-        this.setCryptFilter(
-            'StdCF',
-            new AesV2CryptFilter({
-                authEvent: 'DocOpen',
-            }),
-        )
-
-        this.setCryptFilterForType('stream', 'StdCF')
-        this.setCryptFilterForType('string', 'StdCF')
-    }
-
-    /**
-     * Gets a crypt filter by name.
-     *
-     * @param name - The crypt filter name.
-     * @returns The crypt filter, or undefined if not found.
-     */
-    getCryptFilter(name: string): PdfCryptFilter | undefined {
-        return this.cryptFilters.get(name)
-    }
-
-    /**
-     * Gets the crypt filter assigned to a content type.
-     *
-     * @param type - The content type ('string', 'stream', or 'file').
-     * @returns The assigned crypt filter, or null if none.
-     */
-    getCryptFilterByType(type: CryptFilterType): PdfCryptFilter | null {
-        const name = this.cryptFiltersByType[type]
-        if (name) {
-            return this.cryptFilters.get(name) || null
-        }
-        return null
-    }
-
-    /**
-     * Assigns a crypt filter to a content type.
-     *
-     * @param type - The content type.
-     * @param name - The crypt filter name.
-     */
-    setCryptFilterForType(type: CryptFilterType, name: string): void {
-        this.cryptFiltersByType[type] = name
-    }
-
-    /**
-     * Registers a named crypt filter.
-     *
-     * @param name - The filter name.
-     * @param filter - The crypt filter instance.
-     */
-    setCryptFilter(name: string, filter: PdfCryptFilter): void {
-        filter.setSecurityHandler(this)
-        this.cryptFilters.set(name, filter)
-    }
-
-    /**
-     * Gets the encryption revision number.
-     *
-     * @returns 4 for V4 encryption.
-     */
-    getRevision(): number {
-        return 4
-    }
-
-    /**
-     * Gets the encryption version number.
-     *
-     * @returns 4 for crypt filter-based encryption.
-     */
-    getVersion(): number {
-        return 4
-    }
-
-    /**
-     * Computes the object-specific encryption key.
-     *
-     * @param objectNumber - The PDF object number.
-     * @param generationNumber - The PDF generation number.
-     * @param algorithm - Optional algorithm type for key derivation.
-     * @returns The computed object key.
-     * @throws Error if object or generation number is invalid.
-     */
-    async computeObjectKey(
-        objectNumber?: number,
-        generationNumber?: number,
-        algorithm?: PdfEncryptionAlgorithmType,
-    ): Promise<ByteArray> {
-        assert(
-            objectNumber !== undefined,
-            'Object number is required to derive the key',
-        )
-        assert(
-            generationNumber !== undefined,
-            'Generation number is required to derive the key',
-        )
-
-        assert(objectNumber > 0, 'Object number cannot be zero or negative')
-        assert(generationNumber >= 0, 'Generation number cannot be negative')
-
-        this.masterKey ||= await this.computeMasterKey()
-
-        const key = await deriveObjectKey(
-            this.masterKey,
-            objectNumber,
-            generationNumber,
-            algorithm === 'AES-128-CBC',
-        )
-
-        return key
-    }
-
-    /**
-     * Gets an AES-128 cipher for the specified object.
-     *
-     * @param objectNumber - The PDF object number.
-     * @param generationNumber - The PDF generation number.
-     * @returns An AES-128 cipher instance.
-     */
-    protected async getCipher(
-        objectNumber?: number,
-        generationNumber?: number,
-    ): Promise<Cipher> {
-        const key = await this.computeObjectKey(objectNumber, generationNumber)
-
-        return aes128(key)
-    }
-
-    /**
-     * Reads encryption parameters and crypt filter definitions from the dictionary.
-     *
-     * @param encryptionDictionary - The encryption dictionary from the PDF.
-     */
-    readEncryptionDictionary(
-        encryptionDictionary: PdfEncryptionDictionary,
-    ): void {
-        super.readEncryptionDictionary(encryptionDictionary)
-
-        if (encryptionDictionary.get('CF')) {
-            const cfDict = encryptionDictionary.get('CF')
-            assert(cfDict instanceof PdfDictionary, 'CF must be a dictionary')
-
-            const cfEntries = cfDict.values
-
-            for (const [key, cf] of Object.entries(cfEntries)) {
-                assert(
-                    cf instanceof PdfDictionary,
-                    'Crypt filter must be a dictionary',
-                )
-
-                const cfm = cf.get('CFM')
-                const authEvent = cf.get('AuthEvent')
-                const length = cf.get('Length')
-
-                assertIfDefined(
-                    cfm,
-                    cfm instanceof PdfName,
-                    'CFM must be a name',
-                )
-                assertIfDefined(
-                    authEvent,
-                    authEvent instanceof PdfName,
-                    'AuthEvent must be a name',
-                )
-                assertIfDefined(
-                    length,
-                    length instanceof PdfNumber,
-                    'Length must be a number',
-                )
-
-                assert(cfm, 'CFM is required in crypt filter dictionary')
-                assert(
-                    authEvent,
-                    'AuthEvent is required in crypt filter dictionary',
-                )
-
-                if (cfm.value === 'None') {
-                    this.setCryptFilter(
-                        key,
-                        new IdentityCryptFilter({
-                            authEvent: authEvent.value,
-                        }),
-                    )
-                } else if (cfm.value === 'V2') {
-                    this.setCryptFilter(
-                        key,
-                        new V2CryptFilter({
-                            authEvent: authEvent.value,
-                            length: length.value,
-                        }),
-                    )
-                } else if (cfm.value === 'AESV2') {
-                    this.setCryptFilter(
-                        key,
-                        new AesV2CryptFilter({
-                            authEvent: authEvent.value,
-                        }),
-                    )
-                } else if (cfm.value === 'AESV3') {
-                    this.setCryptFilter(
-                        key,
-                        new AesV3CryptFilter({
-                            authEvent: authEvent.value,
-                        }),
-                    )
-                } else {
-                    throw new Error(`Unsupported CFM value: ${cfm.value}`)
-                }
-            }
-        }
-
-        if (encryptionDictionary.values['StmF']) {
-            const stmF = encryptionDictionary.values['StmF']
-            assert(stmF instanceof PdfName, 'StmF must be a name')
-            assert(
-                this.cryptFilters.has(stmF.value),
-                `StmF references unknown crypt filter: ${stmF.value}`,
-            )
-            this.setCryptFilterForType('stream', stmF.value)
-        }
-
-        if (encryptionDictionary.values['StrF']) {
-            const strF = encryptionDictionary.values['StrF']
-            assert(strF instanceof PdfName, 'StrF must be a name')
-            assert(
-                this.cryptFilters.has(strF.value),
-                `StrF references unknown crypt filter: ${strF.value}`,
-            )
-            this.setCryptFilterForType('string', strF.value)
-        }
-
-        if (encryptionDictionary.values['EFF']) {
-            const eff = encryptionDictionary.values['EFF']
-            assert(eff instanceof PdfName, 'EFF must be a name')
-            assert(
-                this.cryptFilters.has(eff.value),
-                `EFF references unknown crypt filter: ${eff.value}`,
-            )
-            this.setCryptFilterForType('file', eff.value)
-        }
-    }
-
-    /**
-     * Writes the encryption dictionary including crypt filter definitions.
-     */
-    async write(): Promise<void> {
-        await super.write()
-
-        const dict = this.dict
-
-        const cfs: Record<string, PdfCryptFilterDictionary> = {}
-        this.cryptFilters.forEach((cf, name) => {
-            if (cf instanceof IdentityCryptFilter) {
-                // The Identity crypt filter is implicit and should not be included
-                return
-            }
-
-            cfs[name] = cf.toDictionary()
-        })
-
-        if (Object.keys(cfs).length > 0) {
-            dict.set('CF', new PdfDictionary(cfs))
-        }
-
-        if (this.cryptFiltersByType.stream) {
-            dict.set('StmF', new PdfName(this.cryptFiltersByType.stream))
-        }
-
-        if (this.cryptFiltersByType.string) {
-            dict.set('StrF', new PdfName(this.cryptFiltersByType.string))
-        }
-
-        if (this.cryptFiltersByType.file) {
-            dict.set('EFF', new PdfName(this.cryptFiltersByType.file))
-        }
-    }
-
-    /**
-     * Encrypts data using the appropriate crypt filter for the content type.
-     *
-     * @param type - The type of content being encrypted.
-     * @param data - The data to encrypt.
-     * @param objectNumber - The PDF object number.
-     * @param generationNumber - The PDF generation number.
-     * @returns The encrypted data.
-     */
-    encrypt(
-        type: 'string' | 'stream' | 'file',
-        data: ByteArray,
-        objectNumber?: number,
-        generationNumber?: number,
-    ): Promise<ByteArray> {
-        const cryptFilter = this.getCryptFilterByType(type)
-        if (cryptFilter) {
-            return cryptFilter.encrypt(data, objectNumber, generationNumber)
-        }
-
-        return super.encrypt(type, data, objectNumber, generationNumber)
-    }
-
-    /**
-     * Decrypts data using the appropriate crypt filter for the content type.
-     *
-     * @param type - The type of content being decrypted.
-     * @param data - The encrypted data.
-     * @param objectNumber - The PDF object number.
-     * @param generationNumber - The PDF generation number.
-     * @returns The decrypted data.
-     */
-    decrypt(
-        type: 'string' | 'stream' | 'file',
-        data: ByteArray,
-        objectNumber?: number,
-        generationNumber?: number,
-    ): Promise<ByteArray> {
-        const cryptFilter = this.getCryptFilterByType(type)
-        if (cryptFilter) {
-            return cryptFilter.decrypt(data, objectNumber, generationNumber)
-        }
-
-        return super.decrypt(type, data, objectNumber, generationNumber)
-    }
-}