pdf-lite 1.0.1-alpha.2 → 1.0.1-alpha.3

package/dist/security/handlers/pubSec.d.ts

@@ -0,0 +1,164 @@
+import { ByteArray, PdfPermissions } from '../../types';
+import { PdfEncryptionDictionary, PdfEncryptionRecipient, PdfId } from '../types';
+import { PdfSecurityHandler, PdfStandardSecurityHandler } from './base';
+/**
+ * Public key security handler implementing certificate-based encryption.
+ * Uses PKCS#7 enveloped data to encrypt the file key for each recipient.
+ *
+ * @example
+ * ```typescript
+ * const handler = new PdfPublicKeySecurityHandler({
+ *     recipients: [{
+ *         certificate: recipientCertBytes,
+ *         privateKey: privateKeyBytes
+ *     }]
+ * })
+ * ```
+ */
+export declare class PdfPublicKeySecurityHandler extends PdfSecurityHandler {
+    /** Underlying standard security handler for key derivation. */
+    private standardSecurityHandler;
+    /** List of recipients with their certificates and optional private keys. */
+    private recipients;
+    /** Random seed for key generation. */
+    private seed;
+    /** Promise resolving to PKCS#7 CMS data for each recipient. */
+    private recipientsCms;
+    /**
+     * Creates a new public key security handler.
+     *
+     * @param options - Configuration including recipients and encryption settings.
+     */
+    constructor(options: {
+        recipients: PdfEncryptionRecipient[];
+        standardSecurityHandler?: PdfStandardSecurityHandler;
+        seed?: ByteArray;
+        permissions?: PdfPermissions | number;
+        encryptMetadata?: boolean;
+    });
+    /**
+     * Gets the security handler filter name.
+     *
+     * @returns 'Adobe.PubSec' for public key encryption.
+     */
+    getName(): string;
+    /**
+     * Checks if metadata encryption is enabled.
+     *
+     * @returns True if metadata should be encrypted.
+     */
+    canEncryptMetadata(): boolean;
+    /**
+     * Sets the document ID.
+     *
+     * @param id - The document ID array.
+     */
+    setDocumentId(id: PdfId): void;
+    /**
+     * Gets the document ID.
+     *
+     * @returns The document ID, or undefined if not set.
+     */
+    getDocumentId(): PdfId | undefined;
+    /**
+     * Checks if the handler is ready.
+     *
+     * @returns True if the underlying handler is ready.
+     */
+    isReady(): boolean;
+    /**
+     * Gets the encryption version number.
+     *
+     * @returns The version from the underlying handler.
+     */
+    getVersion(): number;
+    /**
+     * Gets the encryption revision number.
+     *
+     * @returns The revision from the underlying handler.
+     */
+    getRevision(): number;
+    /**
+     * Initializes encryption keys from the seed and recipient data.
+     *
+     * @param seed - Optional seed to use instead of the default.
+     * @returns The derived encryption key.
+     * @throws Error if no recipients are configured.
+     */
+    private initKeys;
+    /**
+     * Writes the encryption dictionary with public key-specific entries.
+     */
+    write(): Promise<void>;
+    /**
+     * Creates PKCS#7 enveloped data for each recipient.
+     *
+     * @param data - The data to encrypt for recipients.
+     * @returns Array of PKCS#7 CMS bytes for each recipient.
+     * @throws Error if any recipient lacks a certificate.
+     */
+    private getRecipientsPkcs7;
+    /**
+     * Reads encryption parameters from the encryption dictionary.
+     *
+     * @param dictionary - The encryption dictionary from the PDF.
+     * @throws Error if required entries are missing.
+     */
+    readEncryptionDictionary(dictionary: PdfEncryptionDictionary): void;
+    /**
+     * Gets the underlying standard security handler.
+     *
+     * @returns The standard security handler used for encryption.
+     */
+    getStandardSecurityHandler(): PdfStandardSecurityHandler;
+    /**
+     * Decrypts recipient CMS data to recover the seed and permissions.
+     *
+     * @returns The seed and permissions, or throws if no matching recipient is found.
+     * @throws Error if no recipient with private key can decrypt the CMS data.
+     */
+    private getSeed;
+    /**
+     * Decrypts data using the underlying security handler.
+     *
+     * @param type - The type of content being decrypted.
+     * @param data - The encrypted data.
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns The decrypted data.
+     */
+    decrypt(type: 'string' | 'stream' | 'file', data: ByteArray, objectNumber?: number, generationNumber?: number): Promise<ByteArray>;
+    /**
+     * Encrypts data using the underlying security handler.
+     *
+     * @param type - The type of content being encrypted.
+     * @param data - The data to encrypt.
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns The encrypted data.
+     */
+    encrypt(type: 'string' | 'stream' | 'file', data: ByteArray, objectNumber?: number, generationNumber?: number): Promise<ByteArray>;
+    /**
+     * Computes the object encryption key.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns The computed object key.
+     */
+    computeObjectKey(objectNumber?: number, generationNumber?: number): Promise<ByteArray>;
+    /**
+     * Creates PKCS#7 enveloped data for recipients.
+     *
+     * @param options - Data and recipient certificates.
+     * @returns The PKCS#7 CMS bytes.
+     */
+    private pkcs7EnvelopedData;
+    /**
+     * Extracts the seed and permissions from CMS enveloped data.
+     *
+     * @param contentInfoBytes - The CMS content info bytes.
+     * @param privateKey - The private key for decryption.
+     * @returns The extracted seed and permissions.
+     */
+    private extractSeedAndPermissions;
+}

package/dist/security/handlers/pubSec.js

@@ -0,0 +1,299 @@
+import { Certificate } from 'pki-lite/x509/Certificate';
+import { EnvelopedData } from 'pki-lite/pkcs7/EnvelopedData';
+import { PrivateKeyInfo } from 'pki-lite/keys/PrivateKeyInfo';
+import { getRandomBytes, sha1, sha256 } from '../../utils/algos';
+import { PdfV5SecurityHandler } from './v5';
+import { PdfSecurityHandler } from './base';
+import { createStandardSecurityHandlerFromDictionary } from './utils';
+import { PdfName } from '../../core/objects/pdf-name';
+import { PdfArray } from '../../core/objects/pdf-array';
+import { PdfHexadecimal } from '../../core/objects/pdf-hexadecimal';
+/**
+ * Public key security handler implementing certificate-based encryption.
+ * Uses PKCS#7 enveloped data to encrypt the file key for each recipient.
+ *
+ * @example
+ * ```typescript
+ * const handler = new PdfPublicKeySecurityHandler({
+ *     recipients: [{
+ *         certificate: recipientCertBytes,
+ *         privateKey: privateKeyBytes
+ *     }]
+ * })
+ * ```
+ */
+export class PdfPublicKeySecurityHandler extends PdfSecurityHandler {
+    /** Underlying standard security handler for key derivation. */
+    standardSecurityHandler;
+    /** List of recipients with their certificates and optional private keys. */
+    recipients;
+    /** Random seed for key generation. */
+    seed;
+    /** Promise resolving to PKCS#7 CMS data for each recipient. */
+    recipientsCms;
+    /**
+     * Creates a new public key security handler.
+     *
+     * @param options - Configuration including recipients and encryption settings.
+     */
+    constructor(options) {
+        super(options);
+        this.standardSecurityHandler =
+            options.standardSecurityHandler ?? new PdfV5SecurityHandler({});
+        this.recipients = options.recipients;
+        this.seed = options.seed ?? getRandomBytes(20);
+        const pkcs7Input = new Uint8Array(24);
+        pkcs7Input.set(this.seed);
+        pkcs7Input[20] = (this.permissions >> 24) & 0xff;
+        pkcs7Input[21] = (this.permissions >> 16) & 0xff;
+        pkcs7Input[22] = (this.permissions >> 8) & 0xff;
+        pkcs7Input[23] = this.permissions & 0xff;
+        this.recipientsCms = this.getRecipientsPkcs7(pkcs7Input);
+    }
+    /**
+     * Gets the security handler filter name.
+     *
+     * @returns 'Adobe.PubSec' for public key encryption.
+     */
+    getName() {
+        return 'Adobe.PubSec';
+    }
+    /**
+     * Checks if metadata encryption is enabled.
+     *
+     * @returns True if metadata should be encrypted.
+     */
+    canEncryptMetadata() {
+        return this.standardSecurityHandler.canEncryptMetadata();
+    }
+    /**
+     * Sets the document ID.
+     *
+     * @param id - The document ID array.
+     */
+    setDocumentId(id) {
+        this.standardSecurityHandler.setDocumentId(id);
+    }
+    /**
+     * Gets the document ID.
+     *
+     * @returns The document ID, or undefined if not set.
+     */
+    getDocumentId() {
+        return this.standardSecurityHandler.getDocumentId();
+    }
+    /**
+     * Checks if the handler is ready.
+     *
+     * @returns True if the underlying handler is ready.
+     */
+    isReady() {
+        return this.standardSecurityHandler.isReady();
+    }
+    /**
+     * Gets the encryption version number.
+     *
+     * @returns The version from the underlying handler.
+     */
+    getVersion() {
+        return this.standardSecurityHandler.getVersion();
+    }
+    /**
+     * Gets the encryption revision number.
+     *
+     * @returns The revision from the underlying handler.
+     */
+    getRevision() {
+        return this.standardSecurityHandler.getRevision();
+    }
+    /**
+     * Initializes encryption keys from the seed and recipient data.
+     *
+     * @param seed - Optional seed to use instead of the default.
+     * @returns The derived encryption key.
+     * @throws Error if no recipients are configured.
+     */
+    async initKeys(seed = this.seed) {
+        const recipientDers = await this.recipientsCms;
+        if (recipientDers.length === 0) {
+            throw new Error('At least one recipient is required');
+        }
+        const digestLen = seed.length +
+            recipientDers.reduce((acc, der) => acc + der.length, 0) +
+            (!this.encryptMetadata ? 4 : 0);
+        const digestBytes = new Uint8Array(digestLen);
+        let offset = 0;
+        digestBytes.set(seed, offset);
+        offset += seed.length;
+        for (let i = 0; i < recipientDers.length; i++) {
+            digestBytes.set(recipientDers[i], offset);
+            offset += recipientDers[i].length;
+        }
+        if (!this.encryptMetadata) {
+            digestBytes.set(new Uint8Array([0xff, 0xff, 0xff, 0xff]), offset);
+        }
+        let digest;
+        if (this.standardSecurityHandler instanceof PdfV5SecurityHandler) {
+            digest = await sha256(digestBytes);
+        }
+        else {
+            digest = await sha1(digestBytes);
+        }
+        const key = digest.slice(0, this.standardSecurityHandler.getKeyBits() / 8);
+        this.standardSecurityHandler.setMasterKey(key);
+        return key;
+    }
+    /**
+     * Writes the encryption dictionary with public key-specific entries.
+     */
+    async write() {
+        await this.standardSecurityHandler.write();
+        this.dict.copyFrom(this.standardSecurityHandler.dict);
+        const recipientsData = await this.recipientsCms;
+        this.dict.set('Filter', new PdfName('Adobe.PubSec'));
+        this.dict.set('SubFilter', new PdfName('adbe.pkcs7.s4'));
+        this.dict.set('Recipients', new PdfArray(recipientsData.map((data) => new PdfHexadecimal(data))));
+    }
+    /**
+     * Creates PKCS#7 enveloped data for each recipient.
+     *
+     * @param data - The data to encrypt for recipients.
+     * @returns Array of PKCS#7 CMS bytes for each recipient.
+     * @throws Error if any recipient lacks a certificate.
+     */
+    async getRecipientsPkcs7(data) {
+        return await Promise.all(this.recipients.map((recipient) => {
+            if (!recipient.certificate) {
+                throw new Error('Recipient certificate is required');
+            }
+            return this.pkcs7EnvelopedData({
+                data: data,
+                recipientCertificates: [recipient.certificate],
+            });
+        }));
+    }
+    /**
+     * Reads encryption parameters from the encryption dictionary.
+     *
+     * @param dictionary - The encryption dictionary from the PDF.
+     * @throws Error if required entries are missing.
+     */
+    readEncryptionDictionary(dictionary) {
+        this.standardSecurityHandler =
+            createStandardSecurityHandlerFromDictionary(dictionary);
+        this.standardSecurityHandler.readEncryptionDictionary(dictionary);
+        const recipients = dictionary.get('Recipients');
+        if (!recipients) {
+            throw new Error('Missing /Recipients in encryption dictionary');
+        }
+        this.recipientsCms = Promise.resolve(recipients.items.map((value) => {
+            if (!(value instanceof PdfHexadecimal)) {
+                throw new Error('Invalid recipient type');
+            }
+            return value.raw;
+        }));
+    }
+    /**
+     * Gets the underlying standard security handler.
+     *
+     * @returns The standard security handler used for encryption.
+     */
+    getStandardSecurityHandler() {
+        return this.standardSecurityHandler;
+    }
+    /**
+     * Decrypts recipient CMS data to recover the seed and permissions.
+     *
+     * @returns The seed and permissions, or throws if no matching recipient is found.
+     * @throws Error if no recipient with private key can decrypt the CMS data.
+     */
+    async getSeed() {
+        for (const privateKey of this.recipients
+            .filter((x) => x.privateKey)
+            .map((x) => x.privateKey)) {
+            for (const cms of await this.recipientsCms) {
+                const output = await this.extractSeedAndPermissions(cms, privateKey);
+                if (!output)
+                    continue;
+                const { seed, permissions: permissionsBytes } = output;
+                let permissions = 0;
+                for (const byte of permissionsBytes) {
+                    permissions = (permissions << 8) | byte;
+                }
+                await this.initKeys(seed);
+                this.permissions = permissions;
+                return seed;
+            }
+        }
+        throw new Error('No matching recipient found for decryption');
+    }
+    /**
+     * Decrypts data using the underlying security handler.
+     *
+     * @param type - The type of content being decrypted.
+     * @param data - The encrypted data.
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns The decrypted data.
+     */
+    async decrypt(type, data, objectNumber, generationNumber) {
+        await this.getSeed();
+        return this.standardSecurityHandler.decrypt(type, data, objectNumber, generationNumber);
+    }
+    /**
+     * Encrypts data using the underlying security handler.
+     *
+     * @param type - The type of content being encrypted.
+     * @param data - The data to encrypt.
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns The encrypted data.
+     */
+    async encrypt(type, data, objectNumber, generationNumber) {
+        await this.initKeys();
+        return this.standardSecurityHandler.encrypt(type, data, objectNumber, generationNumber);
+    }
+    /**
+     * Computes the object encryption key.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns The computed object key.
+     */
+    async computeObjectKey(objectNumber, generationNumber) {
+        await this.getSeed();
+        return this.standardSecurityHandler.computeObjectKey(objectNumber, generationNumber);
+    }
+    /**
+     * Creates PKCS#7 enveloped data for recipients.
+     *
+     * @param options - Data and recipient certificates.
+     * @returns The PKCS#7 CMS bytes.
+     */
+    async pkcs7EnvelopedData(options) {
+        const { data, recipientCertificates } = options;
+        const envelopedData = await EnvelopedData.builder()
+            .setData(data)
+            .addRecipient(...recipientCertificates.map((certBytes) => ({
+            certificate: Certificate.fromDer(certBytes),
+        })))
+            .build();
+        return envelopedData.toCms().toDer();
+    }
+    /**
+     * Extracts the seed and permissions from CMS enveloped data.
+     *
+     * @param contentInfoBytes - The CMS content info bytes.
+     * @param privateKey - The private key for decryption.
+     * @returns The extracted seed and permissions.
+     */
+    async extractSeedAndPermissions(contentInfoBytes, privateKey) {
+        const privateKeyInfo = PrivateKeyInfo.fromDer(privateKey);
+        const envelopedData = EnvelopedData.fromCms(contentInfoBytes);
+        const content = await envelopedData.decrypt(privateKeyInfo);
+        return {
+            seed: content.slice(0, 20),
+            permissions: content.slice(20, 24),
+        };
+    }
+}

package/dist/security/handlers/utils.d.ts

@@ -0,0 +1,77 @@
+import { PdfEncryptionAlgorithmType, PdfEncryptionDictionary, PdfEncryptionOptions, PdfEncryptionRecipient, PdfId } from '../types';
+import { PdfSecurityHandler, PdfStandardSecurityHandler } from './base';
+import { ByteArray } from '../../types';
+import { PdfCryptFilter } from '../crypt-filters/base';
+/**
+ * Creates a security handler from an encryption dictionary.
+ * Automatically detects the handler type (Standard or Adobe.PubSec) and version.
+ *
+ * @param dict - The encryption dictionary from the PDF trailer.
+ * @param options - Optional configuration including passwords and recipients.
+ * @returns The appropriate security handler instance.
+ * @throws Error if the filter type is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const handler = createFromDictionary(encryptDict, { password: 'secret' })
+ * ```
+ */
+export declare function createFromDictionary(dict: PdfEncryptionDictionary, options?: {
+    password?: string | ByteArray;
+    ownerPassword?: string | ByteArray;
+    recipients?: PdfEncryptionRecipient[];
+    documentId?: PdfId;
+}): PdfSecurityHandler;
+/**
+ * Creates a standard security handler from an encryption dictionary.
+ * Selects the appropriate version (V1-V5) based on the dictionary parameters.
+ *
+ * @param dict - The encryption dictionary from the PDF trailer.
+ * @param options - Optional configuration including passwords and document ID.
+ * @returns The appropriate standard security handler instance.
+ * @throws Error if the version/revision combination is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const handler = createStandardSecurityHandlerFromDictionary(encryptDict, {
+ *     password: 'user',
+ *     ownerPassword: 'owner'
+ * })
+ * ```
+ */
+export declare function createStandardSecurityHandlerFromDictionary(dict: PdfEncryptionDictionary, options?: {
+    password?: string | ByteArray;
+    ownerPassword?: string | ByteArray;
+    documentId?: PdfId;
+}): PdfStandardSecurityHandler;
+/**
+ * Creates a crypt filter for the specified encryption algorithm.
+ *
+ * @param method - The encryption algorithm type.
+ * @returns The appropriate crypt filter instance.
+ * @throws Error if the method is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const filter = getCryptFilter('AES-256-CBC')
+ * ```
+ */
+export declare function getCryptFilter(method: PdfEncryptionAlgorithmType): PdfCryptFilter;
+/**
+ * Creates a security handler from encryption options.
+ * Automatically selects the appropriate handler version based on the encryption method.
+ *
+ * @param options - The encryption configuration options.
+ * @returns A configured security handler.
+ * @throws Error if no encryption is selected or the type is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const handler = createFromEncryptionOptions({
+ *     method: { default: 'AES-256-CBC' },
+ *     password: 'secret',
+ *     permissions: { print: true, copy: false }
+ * })
+ * ```
+ */
+export declare function createFromEncryptionOptions(options: PdfEncryptionOptions): PdfSecurityHandler;