Function parseEncryptionDict

src/security/encryption-dict.ts:206–376

(dict: PdfDict)

 * @throws {EncryptionDictError} if the dictionary is invalid or unsupported
 */
export function parseEncryptionDict(dict: PdfDict): EncryptionDict {
  // Check filter - must be "Standard" (we don't support other handlers)
  const filter = dict.getName("Filter")?.value;

  if (filter !== "Standard") {
    throw new EncryptionDictError(
      filter
        ? `Unsupported security handler: ${filter}`
        : "Missing /Filter in encryption dictionary",
    );
  }

  // Parse and validate version and revision using Zod
  const version = parseVersion(dict);
  const revision = parseRevision(dict);

  // Validate V/R compatibility
  validateVersionRevision(version, revision);

  // Parse key length
  let keyLengthBits = dict.getNumber("Length")?.value ?? 40;

  // V1 is always 40-bit
  if (version === 1) {
    keyLengthBits = 40;
  }
  // V5 (R5-R6) is always 256-bit
  else if (version === 5) {
    keyLengthBits = 256;
  }

  // Validate key length
  if (keyLengthBits < 40 || keyLengthBits > 256 || keyLengthBits % 8 !== 0) {
    throw new EncryptionDictError(`Invalid key length: ${keyLengthBits} bits`);
  }

  // Parse owner hash (O)
  const ownerHash = dict.getString("O")?.bytes;

  if (!ownerHash) {
    throw new EncryptionDictError("Missing /O (owner hash) in encryption dictionary");
  }

  // Validate O length based on revision
  // R2-R4: exactly 32 bytes
  // R5-R6: at least 48 bytes (32 hash + 8 validation salt + 8 key salt), may be padded
  if (revision >= 5) {
    if (ownerHash.length < 48) {
      throw new EncryptionDictError(
        `Invalid /O length: expected at least 48 bytes, got ${ownerHash.length}`,
      );
    }
  } else {
    if (ownerHash.length !== 32) {
      throw new EncryptionDictError(
        `Invalid /O length: expected 32 bytes, got ${ownerHash.length}`,
      );
    }