crypt

type Algorithm int

type CryptFilter struct {
	// CFM is the crypt filter method:
	//   - /V2: RC4 encryption
	//   - /AESV2: AES-128 encryption with 16-byte key
	//   - /AESV3: AES-256 encryption with 32-byte key
	//   - /None: Identity (no encryption)
	CFM core.Name

	// Length is the key length in bytes.
	Length int
}

type Encrypter interface {
	// EncryptionDict returns the encryption dictionary to be added to the trailer.
	EncryptionDict() *core.Dictionary

	// FileEncryptionKey returns the derived file encryption key.
	FileEncryptionKey() []byte

	// EncryptString encrypts a PDF string for a specific object.
	EncryptString(data []byte, ref core.Reference) ([]byte, error)

	// EncryptStream returns a WriteCloser that encrypts stream data.
	EncryptStream(w io.Writer, ref core.Reference) (io.WriteCloser, error)

	// Version returns the encryption version (1, 2, 4, or 5).
	Version() int

	// Revision returns the encryption revision (2, 3, 4, 5, or 6).
	Revision() int
}

type EncrypterOptions struct {
	// UserPassword is required to open the document.
	// An empty string allows opening without a password.
	UserPassword string

	// OwnerPassword grants full access regardless of permissions.
	// If empty, defaults to UserPassword.
	OwnerPassword string

	// Permissions is the encoded permission flags (from Permissions.Encode()).
	Permissions int32

	// EncryptMetadata controls whether metadata is encrypted.
	// Default: true
	EncryptMetadata bool
}

type Error struct {
	// Version is the encryption version (1, 2, 4, or 5).
	Version int

	// Revision is the encryption revision (2, 3, 4, 5, or 6).
	Revision int

	// Message describes what went wrong.
	Message string

	// Err is the underlying error, if any. Use [errors.Unwrap] or [errors.Is]
	// to check for wrapped sentinel errors.
	Err error
}

type Handler interface {
	// Authenticate checks the password and derives the encryption key.
	// Returns the derived key on success, or ErrInvalidPassword if authentication fails.
	Authenticate(password string) ([]byte, error)

	// DecryptString decrypts a PDF string object.
	// The ref parameter is the indirect reference of the object containing this string.
	DecryptString(s core.String, ref core.Reference) ([]byte, error)

	// DecryptStream returns a reader that decrypts stream data on-the-fly.
	// The ref parameter is the indirect reference of the stream object.
	DecryptStream(r io.Reader, ref core.Reference) (io.Reader, error)

	// Permissions returns the permission flags from the /P entry.
	Permissions() int32

	// Version returns the encryption version (1, 2, 4, or 5).
	Version() int

	// Revision returns the encryption revision (2, 3, 4, 5, or 6).
	Revision() int
}

type Permissions struct {
	// Printing permissions
	Print        bool // Allow printing (low-resolution for R3+)
	PrintHighRes bool // Allow high-resolution printing (R3+)

	// Content modification permissions
	ModifyContents    bool // Allow modifying document contents
	ModifyAnnotations bool // Allow adding/modifying annotations and form fields
	AssembleDocument  bool // Allow inserting, rotating, or deleting pages (R3+)

	// Content extraction permissions
	ExtractContent    bool // Allow copying text and graphics
	ExtractAccessible bool // Allow extraction for accessibility purposes (R3+)

	// Form permissions
	FillForms bool // Allow filling form fields (even if ModifyAnnotations is false, R3+)
}

type StandardHandler struct {
	// contains filtered or unexported fields
}