pdf-lite 1.0.1-alpha.2 → 1.0.1

package/packages/pdf-lite/src/security/handlers/v5.ts

@@ -1,298 +0,0 @@
-import { aes256 } from '../../crypto/ciphers/aes256'
-import { getFileKey } from '../../crypto/key-derivation/key-derivation-aes256'
-import {
-    generateOandOe,
-    generateUandUe,
-} from '../../crypto/key-gen/key-gen-aes256'
-import { ByteArray } from '../../types'
-import { aes256ecbEncrypt, getRandomBytes } from '../../utils/algos'
-import { assert } from '../../utils/assert'
-import { PdfEncryptionDictionary } from '../types'
-import { PdfV4SecurityHandler } from './v4'
-import { PdfStandardSecurityHandlerOptions } from './base'
-import { AesV3CryptFilter } from '../crypt-filters/aesv3'
-import { PdfHexadecimal } from '../../core/objects/pdf-hexadecimal'
-import { PdfString } from '../../core/objects/pdf-string'
-import { Cipher } from '../../crypto/types'
-
-/**
- * V5 security handler implementing AES-256-CBC encryption.
- * This is the most secure encryption method (PDF 2.0).
- *
- * @example
- * ```typescript
- * const handler = new PdfV5SecurityHandler({
- *     password: 'strongPassword123',
- *     ownerPassword: 'adminPassword456'
- * })
- * ```
- */
-export class PdfV5SecurityHandler extends PdfV4SecurityHandler {
-    /** User encrypted file key (UE value). */
-    protected userEncryptedFileKey?: ByteArray
-    /** Owner encrypted file key (OE value). */
-    protected ownerEncryptedFileKey?: ByteArray
-    /** Permissions entry (Perms value). */
-    protected perms?: ByteArray
-    /** Promise resolving to the file encryption key. */
-    protected fileKey?: Promise<ByteArray>
-
-    /**
-     * Creates a new V5 security handler with AES-256 encryption.
-     *
-     * @param options - Configuration options including optional pre-computed keys.
-     */
-    constructor(
-        options: PdfStandardSecurityHandlerOptions & {
-            userEncryptedFileKey?: ByteArray
-            ownerEncryptedFileKey?: ByteArray
-        },
-    ) {
-        super(options)
-        this.userEncryptedFileKey = options.userEncryptedFileKey
-        this.ownerEncryptedFileKey = options.ownerEncryptedFileKey
-
-        this.setCryptFilter(
-            'StdCF',
-            new AesV3CryptFilter({
-                authEvent: 'DocOpen',
-            }),
-        )
-
-        this.setCryptFilterForType('stream', 'StdCF')
-        this.setCryptFilterForType('string', 'StdCF')
-    }
-
-    /**
-     * Checks if the handler is ready (has user encrypted file key).
-     *
-     * @returns True if the handler has the required keys.
-     */
-    isReady(): boolean {
-        return !!this.userEncryptedFileKey
-    }
-
-    /**
-     * Initializes encryption keys, either deriving from existing values or generating new ones.
-     */
-    protected async initKeys(): Promise<void> {
-        this.fileKey ||= (async () => {
-            if (
-                this.userEncryptedFileKey &&
-                this.ownerEncryptedFileKey &&
-                this.userKey &&
-                this.ownerKey &&
-                this.perms
-            ) {
-                const derivedFileKey = await getFileKey(
-                    this.password,
-                    this.ownerPassword ?? this.password,
-                    this.userKey,
-                    this.userEncryptedFileKey,
-                    this.ownerKey,
-                    this.ownerEncryptedFileKey,
-                )
-
-                return derivedFileKey
-            }
-            const fileKey = getRandomBytes(32)
-
-            const { U, UE } = await generateUandUe(this.password, fileKey)
-
-            this.userKey = U
-            this.userEncryptedFileKey = UE
-
-            const { O, OE } = await generateOandOe(
-                this.ownerPassword ?? this.password,
-                U,
-                fileKey,
-            )
-
-            this.ownerKey = O
-            this.ownerEncryptedFileKey = OE
-
-            this.perms = await this.buildPermsEntry(
-                this.permissions ?? 0,
-                this.encryptMetadata,
-                fileKey,
-            )
-
-            return fileKey
-        })()
-
-        await this.fileKey
-    }
-
-    /**
-     * Computes the master encryption key.
-     *
-     * @returns The file encryption key.
-     * @throws Error if file key is not initialized.
-     */
-    protected async computeMasterKey(): Promise<ByteArray> {
-        await this.initKeys()
-
-        if (!this.fileKey) {
-            throw new Error('File key not initialized')
-        }
-
-        return this.fileKey
-    }
-
-    /**
-     * Builds the Perms entry for the encryption dictionary.
-     *
-     * @param flags - The permission flags.
-     * @param encryptMetadata - Whether metadata is encrypted.
-     * @param fileKey - The file encryption key.
-     * @returns The encrypted permissions entry.
-     */
-    private async buildPermsEntry(
-        flags: number,
-        encryptMetadata: boolean,
-        fileKey: ByteArray,
-    ): Promise<ByteArray> {
-        const block = new Uint8Array(16)
-
-        // a + b) permissions + 0xFFFFFFFF (little-endian)
-        const view = new DataView(block.buffer)
-        view.setUint32(0, flags, true) // little-endian
-        view.setUint32(4, 0xffffffff, true) // upper 32 bits
-
-        // c) "T" or "F"
-        block[8] = encryptMetadata ? 'T'.charCodeAt(0) : 'F'.charCodeAt(0)
-
-        // d) "adb"
-        block[9] = 'a'.charCodeAt(0)
-        block[10] = 'd'.charCodeAt(0)
-        block[11] = 'b'.charCodeAt(0)
-
-        // e) random 4 bytes
-        const randomBytes = getRandomBytes(4)
-        block.set(randomBytes, 12)
-
-        return await aes256ecbEncrypt(fileKey, block)
-    }
-
-    /**
-     * Gets the encryption key length in bits.
-     *
-     * @returns 256 for V5 encryption.
-     */
-    getKeyBits(): number {
-        return 256
-    }
-
-    /**
-     * Gets an AES-256 cipher.
-     *
-     * @returns An AES-256 cipher instance.
-     */
-    protected async getCipher(): Promise<Cipher> {
-        this.masterKey ||= await this.computeMasterKey()
-
-        return aes256(this.masterKey)
-    }
-
-    /**
-     * Gets the encryption version number.
-     *
-     * @returns 5 for AES-256 encryption.
-     */
-    getVersion(): number {
-        return 5
-    }
-
-    /**
-     * Gets the encryption revision number.
-     *
-     * @returns 6 for V5 encryption.
-     */
-    getRevision(): number {
-        return 6
-    }
-
-    /**
-     * Writes the encryption dictionary including V5-specific entries.
-     *
-     * @throws Error if required keys are not computed.
-     */
-    async write(): Promise<void> {
-        await super.write()
-        const dict = this.dict
-
-        assert(this.userEncryptedFileKey, 'User Encrypted File Key not set')
-        assert(this.ownerEncryptedFileKey, 'Owner Encrypted File Key not set')
-        assert(this.perms, 'Permissions entry not set')
-
-        dict.set('UE', new PdfString(this.userEncryptedFileKey))
-        dict.set('OE', new PdfString(this.ownerEncryptedFileKey))
-        dict.set('Perms', new PdfString(this.perms))
-    }
-
-    /**
-     * Reads V5-specific encryption parameters from the dictionary.
-     *
-     * @param encryptionDictionary - The encryption dictionary from the PDF.
-     * @throws Error if required entries are missing or invalid.
-     */
-    readEncryptionDictionary(
-        encryptionDictionary: PdfEncryptionDictionary,
-    ): void {
-        super.readEncryptionDictionary(encryptionDictionary)
-
-        const { values } = encryptionDictionary
-
-        assert(
-            values['UE'] instanceof PdfHexadecimal ||
-                values['UE'] instanceof PdfString,
-            'Invalid or missing /UE entry',
-        )
-        assert(
-            values['OE'] instanceof PdfHexadecimal ||
-                values['OE'] instanceof PdfString,
-            'Invalid or missing /OE entry',
-        )
-        assert(
-            values['Perms'] instanceof PdfString ||
-                values['Perms'] instanceof PdfHexadecimal,
-            'Invalid or missing /Perms entry',
-        )
-
-        this.userEncryptedFileKey =
-            values['UE'] instanceof PdfHexadecimal
-                ? values['UE'].bytes
-                : values['UE'].raw
-        this.ownerEncryptedFileKey =
-            values['OE'] instanceof PdfHexadecimal
-                ? values['OE'].bytes
-                : values['OE'].raw
-        this.perms =
-            values['Perms'] instanceof PdfHexadecimal
-                ? values['Perms'].bytes
-                : values['Perms'].raw
-    }
-
-    /**
-     * Computes the object encryption key (same as master key for V5).
-     *
-     * @returns The master encryption key.
-     */
-    async computeObjectKey(): Promise<ByteArray> {
-        return await this.computeMasterKey()
-    }
-
-    /**
-     * Recovers the user password from the owner password.
-     * Not supported for AES-256 encryption.
-     *
-     * @throws Error always, as this operation is not supported for V5.
-     */
-    async recoverUserPassword(
-        ownerPassword?: ByteArray | string,
-    ): Promise<string> {
-        throw new Error(
-            'Recovering user password from owner password is not supported for AES-256',
-        )
-    }
-}

package/packages/pdf-lite/src/signing/document-security-store.ts

@@ -1,224 +0,0 @@
-import { PdfArray } from '../core/objects/pdf-array'
-import { PdfDate } from '../core/objects/pdf-date'
-import { PdfDictionary } from '../core/objects/pdf-dictionary'
-import { PdfIndirectObject } from '../core/objects/pdf-indirect-object'
-import { PdfName } from '../core/objects/pdf-name'
-import { PdfObjectReference } from '../core/objects/pdf-object-reference'
-import { PdfStream } from '../core/objects/pdf-stream'
-import { PdfString } from '../core/objects/pdf-string'
-import { PdfDocument } from '../pdf/pdf-document'
-import { ByteArray } from '../types'
-import { RevocationInfo } from './types'
-
-/**
- * Indirect object containing a certificate stream.
- */
-export class PdfCertObject extends PdfIndirectObject<PdfStream> {}
-
-/**
- * Indirect object containing a CRL stream.
- */
-export class PdfCrlObject extends PdfIndirectObject<PdfStream> {}
-
-/**
- * Indirect object containing an OCSP response stream.
- */
-export class PdfOcspObject extends PdfIndirectObject<PdfStream> {}
-
-/**
- * Validation Related Information (VRI) dictionary.
- * Associates revocation data with specific certificate hashes.
- */
-export type PdfVriObject = PdfIndirectObject<
-    PdfDictionary<{
-        [CertHash: string]: PdfDictionary<{
-            Type?: PdfName<'VRI'>
-            Cert?: PdfObjectReference
-            OCSP?: PdfObjectReference
-            CRL?: PdfObjectReference
-            TU?: PdfDate
-            TS?: PdfString
-        }>
-    }>
->
-
-/**
- * Dictionary for the Document Security Store (DSS).
- * Contains arrays of certificates, CRLs, OCSPs, and VRI entries.
- */
-export class PdfDocumentSecurityStoreDictionary extends PdfDictionary<{
-    Type?: PdfName<'DSS'>
-    VRI?: PdfObjectReference
-    OCSPs?: PdfArray<PdfObjectReference>
-    CRLs?: PdfArray<PdfObjectReference>
-    Certs?: PdfArray<PdfObjectReference>
-}> {}
-
-/**
- * Document Security Store (DSS) object for PAdES LTV signatures.
- * Stores validation data (certificates, CRLs, OCSPs) for long-term validation.
- *
- * @example
- * ```typescript
- * const dss = new PdfDocumentSecurityStoreObject(document)
- * await dss.addCert(certificateBytes)
- * await dss.addCrl(crlBytes)
- * await dss.addOcsp(ocspBytes)
- * ```
- */
-export class PdfDocumentSecurityStoreObject extends PdfIndirectObject<PdfDocumentSecurityStoreDictionary> {
-    /** Reference to the parent document. */
-    private document: PdfDocument
-
-    /**
-     * Creates a new DSS object.
-     *
-     * @param document - The parent PDF document.
-     * @param content - Optional pre-existing DSS dictionary.
-     */
-    constructor(
-        document: PdfDocument,
-        content?: PdfDocumentSecurityStoreDictionary,
-    ) {
-        super(content ?? new PdfDocumentSecurityStoreDictionary())
-        this.document = document
-    }
-
-    /**
-     * Adds an OCSP response to the DSS, avoiding duplicates.
-     *
-     * @param ocsp - The DER-encoded OCSP response.
-     * @returns The created or existing OCSP object.
-     */
-    async addOcsp(ocsp: ByteArray): Promise<PdfOcspObject> {
-        const newOcsp = new PdfStream(ocsp)
-        let ocspArray = this.content.get('OCSPs')
-
-        const currentOcsps = (await Promise.all(
-            (ocspArray?.items ?? []).map(async (ref) => {
-                const obj = await this.document.readObject(ref)
-                return obj
-            }),
-        )) as PdfIndirectObject<PdfStream>[]
-
-        for (const existingOcsp of currentOcsps) {
-            if (existingOcsp.content.equals(newOcsp)) {
-                return existingOcsp as PdfOcspObject
-            }
-        }
-
-        const ocspObject = new PdfOcspObject(newOcsp)
-        this.document.add(ocspObject)
-
-        if (!ocspArray) {
-            ocspArray = new PdfArray<PdfObjectReference>([])
-            this.content.set('OCSPs', ocspArray)
-        }
-
-        ocspArray.items.push(ocspObject.reference)
-
-        return ocspObject
-    }
-
-    /**
-     * Adds a CRL to the DSS, avoiding duplicates.
-     *
-     * @param crl - The DER-encoded CRL.
-     * @returns The created or existing CRL object.
-     */
-    async addCrl(crl: ByteArray): Promise<PdfCrlObject> {
-        let crlArray = this.content.get('CRLs')
-
-        const currentCrls = (await Promise.all(
-            (crlArray?.items ?? []).map(async (ref) => {
-                const obj = await this.document.readObject(ref)
-                return obj
-            }),
-        )) as PdfIndirectObject<PdfStream>[]
-
-        for (const existingCrl of currentCrls) {
-            if (existingCrl.content.equals(new PdfStream(crl))) {
-                return existingCrl as PdfCrlObject
-            }
-        }
-
-        const crlObject = new PdfCrlObject(new PdfStream(crl))
-        this.document.add(crlObject)
-
-        if (!crlArray) {
-            crlArray = new PdfArray<PdfObjectReference>([])
-            this.content.set('CRLs', crlArray)
-        }
-
-        crlArray.items.push(crlObject.reference)
-
-        return crlObject
-    }
-
-    /**
-     * Adds a certificate to the DSS, avoiding duplicates.
-     *
-     * @param cert - The DER-encoded certificate.
-     * @returns The created or existing certificate object.
-     */
-    async addCert(cert: ByteArray): Promise<PdfCertObject> {
-        let certArray = this.content.get('Certs')
-
-        const currentCerts = (await Promise.all(
-            (certArray?.items ?? []).map(async (ref) => {
-                const obj = await this.document.readObject(ref)
-                return obj
-            }),
-        )) as PdfIndirectObject<PdfStream>[]
-
-        for (const existingCert of currentCerts) {
-            if (existingCert.content.equals(new PdfStream(cert))) {
-                return existingCert as PdfCertObject
-            }
-        }
-
-        const certObject = new PdfCertObject(new PdfStream(cert))
-        this.document.add(certObject)
-
-        if (!certArray) {
-            certArray = new PdfArray<PdfObjectReference>([])
-            this.content.set('Certs', certArray)
-        }
-
-        certArray.items.push(certObject.reference)
-
-        return certObject
-    }
-
-    /**
-     * Adds revocation information (CRLs and OCSPs) to the DSS.
-     *
-     * @param revocationInfo - The revocation information to add.
-     */
-    async addRevocationInfo(revocationInfo: RevocationInfo): Promise<void> {
-        for (const ocsp of revocationInfo.ocsps ?? []) {
-            await this.addOcsp(ocsp)
-        }
-
-        for (const crl of revocationInfo.crls ?? []) {
-            await this.addCrl(crl)
-        }
-    }
-
-    /**
-     * Checks if the DSS is empty (contains no certificates, CRLs, or OCSPs).
-     *
-     * @returns True if the DSS has no stored data.
-     */
-    isEmpty(): boolean {
-        const certs = this.content.get('Certs')
-        const crls = this.content.get('CRLs')
-        const ocsps = this.content.get('OCSPs')
-
-        return (
-            (!certs || certs.items.length === 0) &&
-            (!crls || crls.items.length === 0) &&
-            (!ocsps || ocsps.items.length === 0)
-        )
-    }
-}

package/packages/pdf-lite/src/signing/index.ts

@@ -1,3 +0,0 @@
-export * from './signatures'
-export * from './document-security-store'
-export * from './types'

package/packages/pdf-lite/src/signing/signatures/adbe-pkcs7-detached.ts

@@ -1,154 +0,0 @@
-import { RevocationInfo, TimeStampAuthority } from '../types'
-import { SignedData } from 'pki-lite/pkcs7/SignedData'
-import { Certificate } from 'pki-lite/x509/Certificate'
-import { SignerInfo } from 'pki-lite/pkcs7/SignerInfo'
-import { Attribute } from 'pki-lite/x509/Attribute'
-import { RevocationInfoArchival } from 'pki-lite/adobe/RevocationInfoArchival'
-import { CertificateList } from 'pki-lite/x509/CertificateList'
-import { OCSPResponse } from 'pki-lite/ocsp/OCSPResponse'
-import { PrivateKeyInfo } from 'pki-lite/keys/PrivateKeyInfo'
-import { OtherRevInfo } from 'pki-lite/adobe/OtherRevInfo'
-import { AsymmetricEncryptionAlgorithmParams } from 'pki-lite/core/index'
-import { fetchRevocationInfo } from '../utils'
-import { PdfSignatureObject, PdfSignatureSignOptions } from './base'
-import { ByteArray } from '../../types'
-
-/**
- * PKCS#7 detached signature object (adbe.pkcs7.detached).
- * Creates CMS SignedData with the document hash as external data.
- *
- * @example
- * ```typescript
- * const signature = new PdfAdbePkcs7DetachedSignatureObject({
- *     privateKey: keyBytes,
- *     certificate: certBytes,
- *     reason: 'Document approval',
- *     timeStampAuthority: true
- * })
- * ```
- */
-export class PdfAdbePkcs7DetachedSignatureObject extends PdfSignatureObject {
-    /** Private key for signing. */
-    privateKey: ByteArray
-    /** Signer certificate. */
-    certificate: ByteArray
-    /** Additional certificates for chain building. */
-    additionalCertificates: ByteArray[]
-    /** Issuer certificate for OCSP requests. */
-    issuerCertificate?: ByteArray
-    /** Signing date. */
-    date?: Date
-    /** Signature algorithm parameters. */
-    algorithm?: AsymmetricEncryptionAlgorithmParams
-    /** Revocation information or 'fetch' to retrieve automatically. */
-    revocationInfo?: RevocationInfo | 'fetch'
-    /** Timestamp authority configuration. */
-    timeStampAuthority?: TimeStampAuthority
-
-    /**
-     * Creates a new PKCS#7 detached signature object.
-     *
-     * @param options - Signature configuration options.
-     */
-    constructor(
-        options: PdfSignatureSignOptions & {
-            privateKey: ByteArray
-            certificate: ByteArray
-            issuerCertificate?: ByteArray
-            additionalCertificates?: ByteArray[]
-            algorithm?: AsymmetricEncryptionAlgorithmParams
-            revocationInfo?: RevocationInfo | 'fetch'
-            timeStampAuthority?: TimeStampAuthority | true
-        },
-    ) {
-        super({
-            ...options,
-            subfilter: 'adbe.pkcs7.detached',
-        })
-
-        this.privateKey = options.privateKey
-        this.certificate = options.certificate
-        this.issuerCertificate = options.issuerCertificate
-        this.additionalCertificates = options.additionalCertificates || []
-        this.date = options.date
-        this.algorithm = options.algorithm
-        this.revocationInfo = options.revocationInfo
-        this.timeStampAuthority =
-            options.timeStampAuthority === true
-                ? {
-                      url: 'http://timestamp.digicert.com',
-                  }
-                : options.timeStampAuthority
-    }
-
-    /**
-     * Signs the document bytes using PKCS#7 detached format.
-     *
-     * @param options - Signing options with bytes and revocation embedding flag.
-     * @returns The CMS SignedData and revocation information.
-     */
-    sign: PdfSignatureObject['sign'] = async (options) => {
-        const { bytes } = options
-
-        const certificate: Certificate = Certificate.fromDer(this.certificate)
-        const additionalCertificates: Certificate[] =
-            this.additionalCertificates.map(Certificate.fromDer)
-
-        const signedAttributes = new SignerInfo.SignedAttributes()
-        const unsignedAttributes = new SignerInfo.UnsignedAttributes()
-
-        signedAttributes.push(Attribute.signingTime(this.date ?? new Date()))
-
-        const revocationInfo =
-            this.revocationInfo === 'fetch'
-                ? await fetchRevocationInfo({
-                      certificates: [
-                          this.certificate,
-                          ...(this.additionalCertificates ?? []),
-                      ],
-                      issuerCertificate: this.issuerCertificate,
-                  })
-                : this.revocationInfo
-
-        if (options.embedRevocationInfo && revocationInfo) {
-            signedAttributes.push(
-                Attribute.adobeRevocationInfoArchival(
-                    new RevocationInfoArchival({
-                        crls: revocationInfo.crls?.map((x) =>
-                            CertificateList.fromDer(x),
-                        ),
-                        ocsps: revocationInfo.ocsps?.map((x) =>
-                            OCSPResponse.fromDer(x),
-                        ),
-                        otherRevInfo: revocationInfo.otherRevInfo?.map(
-                            (x) =>
-                                new OtherRevInfo({
-                                    type: x.type,
-                                    value: x.value,
-                                }),
-                        ),
-                    }),
-                ),
-            )
-        }
-
-        const signedData = await SignedData.builder()
-            .addCertificate(...additionalCertificates)
-            .setData(bytes)
-            .setDetached(true)
-            .addSigner({
-                certificate,
-                privateKeyInfo: PrivateKeyInfo.fromDer(this.privateKey),
-                encryptionAlgorithm: this.algorithm,
-                signedAttrs: signedAttributes,
-                unsignedAttrs: unsignedAttributes,
-                tsa: this.timeStampAuthority,
-            })
-            .build()
-
-        return {
-            signedBytes: signedData.toCms().toDer(),
-            revocationInfo,
-        }
-    }
-}