pdf-lite 1.0.1-alpha.2 → 1.0.1-alpha.3

package/dist/security/handlers/utils.js

@@ -0,0 +1,244 @@
+import { assert, assertIfDefined } from '../../utils/assert';
+import { PdfV1SecurityHandler } from './v1';
+import { PdfV2SecurityHandler } from './v2';
+import { PdfV4SecurityHandler } from './v4';
+import { PdfV5SecurityHandler } from './v5';
+import { V2CryptFilter } from '../crypt-filters/v2';
+import { AesV2CryptFilter } from '../crypt-filters/aesv2';
+import { AesV3CryptFilter } from '../crypt-filters/aesv3';
+import { IdentityCryptFilter } from '../crypt-filters/identity';
+import { PdfName } from '../../core/objects/pdf-name';
+import { PdfNumber } from '../../core/objects/pdf-number';
+import { PdfPublicKeySecurityHandler } from './pubSec';
+/**
+ * Creates a security handler from an encryption dictionary.
+ * Automatically detects the handler type (Standard or Adobe.PubSec) and version.
+ *
+ * @param dict - The encryption dictionary from the PDF trailer.
+ * @param options - Optional configuration including passwords and recipients.
+ * @returns The appropriate security handler instance.
+ * @throws Error if the filter type is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const handler = createFromDictionary(encryptDict, { password: 'secret' })
+ * ```
+ */
+export function createFromDictionary(dict, options) {
+    const { password, ownerPassword, recipients = [], documentId, } = options ?? {};
+    const filter = dict.get('Filter');
+    assert(filter instanceof PdfName, 'Filter must be a name');
+    if (filter.value === 'Standard') {
+        return createStandardSecurityHandlerFromDictionary(dict, {
+            password,
+            ownerPassword,
+            documentId,
+        });
+    }
+    else if (filter.value === 'Adobe.PubSec') {
+        const pubSecHandler = new PdfPublicKeySecurityHandler({
+            standardSecurityHandler: createStandardSecurityHandlerFromDictionary(dict, {
+                password,
+                ownerPassword,
+            }),
+            recipients,
+        });
+        pubSecHandler.readEncryptionDictionary(dict);
+        return pubSecHandler;
+    }
+    else {
+        throw new Error(`Unsupported security handler: ${filter.value}`);
+    }
+}
+/**
+ * Creates a standard security handler from an encryption dictionary.
+ * Selects the appropriate version (V1-V5) based on the dictionary parameters.
+ *
+ * @param dict - The encryption dictionary from the PDF trailer.
+ * @param options - Optional configuration including passwords and document ID.
+ * @returns The appropriate standard security handler instance.
+ * @throws Error if the version/revision combination is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const handler = createStandardSecurityHandlerFromDictionary(encryptDict, {
+ *     password: 'user',
+ *     ownerPassword: 'owner'
+ * })
+ * ```
+ */
+export function createStandardSecurityHandlerFromDictionary(dict, options) {
+    const { password, ownerPassword, documentId = dict.get('ID'), } = options ?? {};
+    const V = dict.get('V');
+    const R = dict.get('R');
+    const Length = dict.get('Length');
+    assert(V instanceof PdfNumber, 'V must be a number if defined');
+    assert(R instanceof PdfNumber, 'R must be a number if defined');
+    assertIfDefined(Length, Length instanceof PdfNumber, 'Length must be a number if defined');
+    const version = V.value;
+    const revision = R.value;
+    let standardSecurityHandler;
+    if (version === 1) {
+        standardSecurityHandler = new PdfV1SecurityHandler({
+            password,
+            ownerPassword,
+            documentId,
+        });
+    }
+    else if (version === 2) {
+        standardSecurityHandler = new PdfV2SecurityHandler({
+            password,
+            ownerPassword,
+            documentId,
+        });
+    }
+    else if (version === 4) {
+        standardSecurityHandler = new PdfV4SecurityHandler({
+            password,
+            ownerPassword,
+            documentId,
+        });
+    }
+    else if (version >= 5) {
+        standardSecurityHandler = new PdfV5SecurityHandler({
+            password,
+            ownerPassword,
+            documentId,
+        });
+    }
+    else {
+        throw new Error(`Unsupported standard security handler: V=${version} R=${revision}`);
+    }
+    standardSecurityHandler.readEncryptionDictionary(dict);
+    return standardSecurityHandler;
+}
+/**
+ * Creates a crypt filter for the specified encryption algorithm.
+ *
+ * @param method - The encryption algorithm type.
+ * @returns The appropriate crypt filter instance.
+ * @throws Error if the method is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const filter = getCryptFilter('AES-256-CBC')
+ * ```
+ */
+export function getCryptFilter(method) {
+    if (method === 'none') {
+        return new IdentityCryptFilter({
+            authEvent: 'DocOpen',
+        });
+    }
+    else if (method === 'RC4-40') {
+        return new V2CryptFilter({
+            authEvent: 'DocOpen',
+            length: 40,
+        });
+    }
+    else if (method === 'RC4-128') {
+        return new V2CryptFilter({
+            authEvent: 'DocOpen',
+            length: 128,
+        });
+    }
+    else if (method === 'AES-128-CBC') {
+        return new AesV2CryptFilter({
+            authEvent: 'DocOpen',
+        });
+    }
+    else if (method === 'AES-256-CBC') {
+        return new AesV3CryptFilter({
+            authEvent: 'DocOpen',
+        });
+    }
+    else {
+        throw new Error(`Unsupported crypt filter type: ${method}`);
+    }
+}
+/**
+ * Creates a security handler from encryption options.
+ * Automatically selects the appropriate handler version based on the encryption method.
+ *
+ * @param options - The encryption configuration options.
+ * @returns A configured security handler.
+ * @throws Error if no encryption is selected or the type is unsupported.
+ *
+ * @example
+ * ```typescript
+ * const handler = createFromEncryptionOptions({
+ *     method: { default: 'AES-256-CBC' },
+ *     password: 'secret',
+ *     permissions: { print: true, copy: false }
+ * })
+ * ```
+ */
+export function createFromEncryptionOptions(options) {
+    let defaultEncryption = options.method?.default ?? 'AES-256-CBC';
+    let handler;
+    if (defaultEncryption === 'RC4-40') {
+        handler = new PdfV1SecurityHandler({
+            password: options.password,
+            ownerPassword: options.ownerPassword,
+        });
+    }
+    else if (defaultEncryption === 'RC4-128') {
+        handler = new PdfV2SecurityHandler({
+            password: options.password,
+            ownerPassword: options.ownerPassword,
+        });
+    }
+    else if (defaultEncryption === 'AES-128-CBC') {
+        handler = new PdfV4SecurityHandler({
+            password: options.password,
+            ownerPassword: options.ownerPassword,
+        });
+    }
+    else if (defaultEncryption === 'AES-256-CBC') {
+        handler = new PdfV5SecurityHandler({
+            password: options.password,
+            ownerPassword: options.ownerPassword,
+        });
+    }
+    else if (defaultEncryption === 'none') {
+        throw new Error('No encryption selected');
+    }
+    else {
+        throw new Error(`Unsupported encryption type: ${defaultEncryption}`);
+    }
+    let uniqueCryptFilters = new Set();
+    const cryptFilterForType = {};
+    if (options.method &&
+        'streams' in options.method &&
+        options.method.streams) {
+        uniqueCryptFilters.add(options.method.streams);
+        cryptFilterForType['stream'] = options.method.streams;
+    }
+    if (options.method && 'files' in options.method && options.method.files) {
+        uniqueCryptFilters.add(options.method.files);
+        cryptFilterForType['file'] = options.method.files;
+    }
+    if (options.method &&
+        'strings' in options.method &&
+        options.method.strings) {
+        uniqueCryptFilters.add(options.method.strings);
+        cryptFilterForType['string'] = options.method.strings;
+    }
+    if (handler instanceof PdfV4SecurityHandler) {
+        const uniqueCryptFiltersArray = Array.from(uniqueCryptFilters);
+        for (let i = 0; i < uniqueCryptFiltersArray.length; i++) {
+            const cryptFilter = getCryptFilter(uniqueCryptFiltersArray[i]);
+            const name = cryptFilter instanceof IdentityCryptFilter
+                ? 'Identity'
+                : `CF${i + 1}`;
+            handler.setCryptFilter(name, cryptFilter);
+            for (const type in cryptFilterForType) {
+                if (cryptFilterForType[type] ===
+                    uniqueCryptFiltersArray[i]) {
+                    handler.setCryptFilterForType(type, name);
+                }
+            }
+        }
+    }
+    return handler;
+}

package/dist/security/handlers/v1.d.ts

@@ -0,0 +1,81 @@
+import { Cipher } from '../../crypto/types';
+import { ByteArray } from '../../types';
+import { PdfEncryptionAlgorithmType } from '../types';
+import { PdfStandardSecurityHandler } from './base';
+/**
+ * V1 security handler implementing 40-bit RC4 encryption.
+ * This is the original PDF encryption format (PDF 1.1).
+ *
+ * @example
+ * ```typescript
+ * const handler = new PdfV1SecurityHandler({
+ *     password: 'user123',
+ *     ownerPassword: 'admin456'
+ * })
+ * ```
+ */
+export declare class PdfV1SecurityHandler extends PdfStandardSecurityHandler {
+    /**
+     * Gets the encryption revision number.
+     *
+     * @returns 2 for V1 encryption.
+     */
+    getRevision(): number;
+    /**
+     * Gets the encryption version number.
+     *
+     * @returns 1 for 40-bit RC4 encryption.
+     */
+    getVersion(): number;
+    /**
+     * Gets the encryption key length in bits.
+     *
+     * @returns 40 for V1 encryption.
+     */
+    getKeyBits(): number;
+    /**
+     * Computes the owner key (O value) using RC4-40 algorithm.
+     *
+     * @returns The computed owner key.
+     */
+    protected computeOwnerKey(): Promise<ByteArray>;
+    /**
+     * Computes the user key (U value) using RC4-40 algorithm.
+     *
+     * @returns The computed user key.
+     * @throws Error if document ID, owner key, or permissions are not set.
+     */
+    protected computeUserKey(): Promise<ByteArray>;
+    /**
+     * Computes the master encryption key from the password.
+     *
+     * @returns The computed master key.
+     * @throws Error if required parameters are missing or password is incorrect.
+     */
+    protected computeMasterKey(): Promise<ByteArray>;
+    /**
+     * Computes the object-specific encryption key.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @param algorithm - Optional algorithm type for key derivation.
+     * @returns The computed object key.
+     * @throws Error if object or generation number is invalid.
+     */
+    computeObjectKey(objectNumber?: number, generationNumber?: number, algorithm?: PdfEncryptionAlgorithmType): Promise<ByteArray>;
+    /**
+     * Gets an RC4 cipher for the specified object.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns An RC4 cipher instance.
+     */
+    protected getCipher(objectNumber?: number, generationNumber?: number): Promise<Cipher>;
+    /**
+     * Recovers the user password from the owner password.
+     *
+     * @param ownerPassword - The owner password.
+     * @returns The recovered user password as a string.
+     */
+    recoverUserPassword(ownerPassword?: ByteArray | string): Promise<string>;
+}

package/dist/security/handlers/v1.js

@@ -0,0 +1,135 @@
+import { rc4 } from '../../crypto/ciphers/rc4';
+import { computeMasterKey, deriveObjectKey, } from '../../crypto/key-derivation/key-derivation';
+import { computeORc4_40, computeURc4_40, decryptUserPasswordRc4_40, } from '../../crypto/key-gen/key-gen-rc4-40';
+import { assert } from '../../utils/assert';
+import { bytesToString } from '../../utils/bytesToString';
+import { stringToBytes } from '../../utils/stringToBytes';
+import { PdfStandardSecurityHandler } from './base';
+/**
+ * V1 security handler implementing 40-bit RC4 encryption.
+ * This is the original PDF encryption format (PDF 1.1).
+ *
+ * @example
+ * ```typescript
+ * const handler = new PdfV1SecurityHandler({
+ *     password: 'user123',
+ *     ownerPassword: 'admin456'
+ * })
+ * ```
+ */
+export class PdfV1SecurityHandler extends PdfStandardSecurityHandler {
+    /**
+     * Gets the encryption revision number.
+     *
+     * @returns 2 for V1 encryption.
+     */
+    getRevision() {
+        return 2;
+    }
+    /**
+     * Gets the encryption version number.
+     *
+     * @returns 1 for 40-bit RC4 encryption.
+     */
+    getVersion() {
+        return 1;
+    }
+    /**
+     * Gets the encryption key length in bits.
+     *
+     * @returns 40 for V1 encryption.
+     */
+    getKeyBits() {
+        return 40;
+    }
+    /**
+     * Computes the owner key (O value) using RC4-40 algorithm.
+     *
+     * @returns The computed owner key.
+     */
+    async computeOwnerKey() {
+        return await computeORc4_40(this.ownerPassword ?? this.password, this.password);
+    }
+    /**
+     * Computes the user key (U value) using RC4-40 algorithm.
+     *
+     * @returns The computed user key.
+     * @throws Error if document ID, owner key, or permissions are not set.
+     */
+    async computeUserKey() {
+        if (!this.documentId) {
+            throw new Error('Document ID is required to compute U value');
+        }
+        if (!this.ownerKey) {
+            throw new Error('Owner key is required to compute U value');
+        }
+        if (typeof this.permissions !== 'number') {
+            throw new Error('Permissions are required to compute U value');
+        }
+        return await computeURc4_40(this.password, this.ownerKey, this.permissions, this.documentId.items[0].bytes);
+    }
+    /**
+     * Computes the master encryption key from the password.
+     *
+     * @returns The computed master key.
+     * @throws Error if required parameters are missing or password is incorrect.
+     */
+    async computeMasterKey() {
+        await this.initKeys();
+        assert(this.ownerKey, 'ownerKey is required');
+        assert(this.permissions !== undefined, 'Permissions are required');
+        assert(this.documentId, 'Document ID is required');
+        assert(this.encryptMetadata !== undefined, 'Encrypt metadata is required');
+        if (this.ownerPassword) {
+            const recoverPass = await this.recoverUserPassword(this.ownerPassword);
+            return await computeMasterKey(stringToBytes(recoverPass), this.ownerKey, this.permissions, this.documentId.items[0].bytes, this.getKeyBits(), this.encryptMetadata, this.getRevision());
+        }
+        else {
+            const expectedUValue = await this.computeUserKey();
+            assert(this.userKey &&
+                expectedUValue.length === this.userKey.length &&
+                expectedUValue.every((byte, index) => byte === this.userKey[index]), 'Incorrect user password');
+        }
+        return await computeMasterKey(this.password, this.ownerKey, this.permissions, this.documentId.items[0].bytes, this.getKeyBits(), this.encryptMetadata, this.getRevision());
+    }
+    /**
+     * Computes the object-specific encryption key.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @param algorithm - Optional algorithm type for key derivation.
+     * @returns The computed object key.
+     * @throws Error if object or generation number is invalid.
+     */
+    async computeObjectKey(objectNumber, generationNumber, algorithm) {
+        assert(objectNumber !== undefined, 'Object number is required to derive the key');
+        assert(generationNumber !== undefined, 'Generation number is required to derive the key');
+        assert(objectNumber > 0, 'Object number cannot be zero or negative');
+        assert(generationNumber >= 0, 'Generation number cannot be negative');
+        this.masterKey ||= await this.computeMasterKey();
+        const key = await deriveObjectKey(this.masterKey, objectNumber, generationNumber, algorithm === 'AES-128-CBC');
+        return key;
+    }
+    /**
+     * Gets an RC4 cipher for the specified object.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns An RC4 cipher instance.
+     */
+    async getCipher(objectNumber, generationNumber) {
+        const key = await this.computeObjectKey(objectNumber, generationNumber);
+        return rc4(key);
+    }
+    /**
+     * Recovers the user password from the owner password.
+     *
+     * @param ownerPassword - The owner password.
+     * @returns The recovered user password as a string.
+     */
+    async recoverUserPassword(ownerPassword) {
+        ownerPassword ||= this.ownerPassword;
+        const password = await decryptUserPasswordRc4_40(stringToBytes(ownerPassword), this.ownerKey);
+        return bytesToString(password);
+    }
+}

package/dist/security/handlers/v2.d.ts

@@ -0,0 +1,63 @@
+import { Cipher } from '../../crypto/types';
+import { ByteArray } from '../../types';
+import { PdfV1SecurityHandler } from './v1';
+/**
+ * V2 security handler implementing 128-bit RC4 encryption.
+ * Extends V1 with stronger key length (PDF 1.4).
+ *
+ * @example
+ * ```typescript
+ * const handler = new PdfV2SecurityHandler({
+ *     password: 'user123',
+ *     ownerPassword: 'admin456'
+ * })
+ * ```
+ */
+export declare class PdfV2SecurityHandler extends PdfV1SecurityHandler {
+    /**
+     * Gets the encryption revision number.
+     *
+     * @returns 3 for V2 encryption.
+     */
+    getRevision(): number;
+    /**
+     * Gets the encryption version number.
+     *
+     * @returns 2 for 128-bit RC4 encryption.
+     */
+    getVersion(): number;
+    /**
+     * Gets the encryption key length in bits.
+     *
+     * @returns 128 for V2 encryption.
+     */
+    getKeyBits(): number;
+    /**
+     * Computes the owner key (O value) using RC4-128 algorithm.
+     *
+     * @returns The computed owner key.
+     */
+    protected computeOwnerKey(): Promise<ByteArray>;
+    /**
+     * Computes the user key (U value) using RC4-128 algorithm.
+     *
+     * @returns The computed user key.
+     * @throws Error if document ID, owner key, or permissions are not set.
+     */
+    protected computeUserKey(): Promise<ByteArray>;
+    /**
+     * Gets an RC4 cipher for the specified object.
+     *
+     * @param objectNumber - The PDF object number.
+     * @param generationNumber - The PDF generation number.
+     * @returns An RC4 cipher instance.
+     */
+    protected getCipher(objectNumber?: number, generationNumber?: number): Promise<Cipher>;
+    /**
+     * Recovers the user password from the owner password.
+     *
+     * @param ownerPassword - The owner password.
+     * @returns The recovered user password as a string.
+     */
+    recoverUserPassword(ownerPassword?: ByteArray | string): Promise<string>;
+}

package/{packages/pdf-lite/src/security/handlers/v2.ts → dist/security/handlers/v2.js}

@@ -1,15 +1,8 @@
-import { rc4 } from '../../crypto/ciphers/rc4'
-import {
-    computeOValueRc4_128,
-    computeUValueRc4_128,
-    decryptUserPasswordRc4_128,
-} from '../../crypto/key-gen/key-gen-rc4-128'
-import { Cipher } from '../../crypto/types'
-import { ByteArray } from '../../types'
-import { bytesToString } from '../../utils/bytesToString'
-import { stringToBytes } from '../../utils/stringToBytes'
-import { PdfV1SecurityHandler } from './v1'
-
+import { rc4 } from '../../crypto/ciphers/rc4';
+import { computeOValueRc4_128, computeUValueRc4_128, decryptUserPasswordRc4_128, } from '../../crypto/key-gen/key-gen-rc4-128';
+import { bytesToString } from '../../utils/bytesToString';
+import { stringToBytes } from '../../utils/stringToBytes';
+import { PdfV1SecurityHandler } from './v1';
 /**
  * V2 security handler implementing 128-bit RC4 encryption.
  * Extends V1 with stronger key length (PDF 1.4).
@@ -28,69 +21,51 @@ export class PdfV2SecurityHandler extends PdfV1SecurityHandler {
      *
      * @returns 3 for V2 encryption.
      */
-    getRevision(): number {
-        return 3
+    getRevision() {
+        return 3;
     }
-
     /**
      * Gets the encryption version number.
      *
      * @returns 2 for 128-bit RC4 encryption.
      */
-    getVersion(): number {
-        return 2
+    getVersion() {
+        return 2;
     }
-
     /**
      * Gets the encryption key length in bits.
      *
      * @returns 128 for V2 encryption.
      */
-    getKeyBits(): number {
-        return 128
+    getKeyBits() {
+        return 128;
     }
-
     /**
      * Computes the owner key (O value) using RC4-128 algorithm.
      *
      * @returns The computed owner key.
      */
-    protected async computeOwnerKey(): Promise<ByteArray> {
-        return await computeOValueRc4_128(
-            this.ownerPassword ?? this.password,
-            this.password,
-        )
+    async computeOwnerKey() {
+        return await computeOValueRc4_128(this.ownerPassword ?? this.password, this.password);
     }
-
     /**
      * Computes the user key (U value) using RC4-128 algorithm.
      *
      * @returns The computed user key.
      * @throws Error if document ID, owner key, or permissions are not set.
      */
-    protected async computeUserKey(): Promise<ByteArray> {
+    async computeUserKey() {
         if (!this.documentId) {
-            throw new Error('Document ID is required to compute U value')
+            throw new Error('Document ID is required to compute U value');
         }
-
         if (!this.ownerKey) {
-            throw new Error('Owner key is required to compute U value')
+            throw new Error('Owner key is required to compute U value');
         }
-
         if (typeof this.permissions !== 'number') {
-            throw new Error('Permissions are required to compute U value')
+            throw new Error('Permissions are required to compute U value');
         }
-
-        return await computeUValueRc4_128(
-            this.password,
-            this.ownerKey,
-            this.permissions,
-            this.documentId.items[0].bytes,
-            this.encryptMetadata,
-            this.getRevision(),
-        )
+        return await computeUValueRc4_128(this.password, this.ownerKey, this.permissions, this.documentId.items[0].bytes, this.encryptMetadata, this.getRevision());
     }
-
     /**
      * Gets an RC4 cipher for the specified object.
      *
@@ -98,31 +73,19 @@ export class PdfV2SecurityHandler extends PdfV1SecurityHandler {
      * @param generationNumber - The PDF generation number.
      * @returns An RC4 cipher instance.
      */
-    protected async getCipher(
-        objectNumber?: number,
-        generationNumber?: number,
-    ): Promise<Cipher> {
-        const key = await this.computeObjectKey(objectNumber, generationNumber)
-
-        return rc4(key)
+    async getCipher(objectNumber, generationNumber) {
+        const key = await this.computeObjectKey(objectNumber, generationNumber);
+        return rc4(key);
     }
-
     /**
      * Recovers the user password from the owner password.
      *
      * @param ownerPassword - The owner password.
      * @returns The recovered user password as a string.
      */
-    async recoverUserPassword(
-        ownerPassword?: ByteArray | string,
-    ): Promise<string> {
-        ownerPassword ||= this.ownerPassword
-
-        const password = await decryptUserPasswordRc4_128(
-            stringToBytes(ownerPassword!),
-            this.ownerKey!,
-        )
-
-        return bytesToString(password)
+    async recoverUserPassword(ownerPassword) {
+        ownerPassword ||= this.ownerPassword;
+        const password = await decryptUserPasswordRc4_128(stringToBytes(ownerPassword), this.ownerKey);
+        return bytesToString(password);
     }
 }