Function generateEncryption

src/security/encryption-generator.ts:49–163

(options: ProtectionOptions)

 * @returns Generated encryption data
 */
export function generateEncryption(options: ProtectionOptions): GeneratedEncryption {
  // Only support AES-256 for new encryption
  const algorithm = options.algorithm ?? "AES-256";

  if (algorithm !== "AES-256") {
    throw new Error(`Only AES-256 encryption is supported for new documents. Got: ${algorithm}`);
  }

  // Encode passwords to UTF-8
  const userPassword = new TextEncoder().encode(options.userPassword ?? "");
  const ownerPassword = new TextEncoder().encode(options.ownerPassword ?? generateRandomPassword());

  // Merge permissions with defaults (omitted = true)
  const permissions: Permissions = {
    ...DEFAULT_PERMISSIONS,
    ...options.permissions,
  };

  // Encode permissions as /P value
  const permissionsRaw = encodePermissions(permissions);

  const encryptMetadata = options.encryptMetadata ?? true;

  // Generate random 32-byte file encryption key
  const fileEncryptionKey = randomBytes(32);

  // Generate user entries (/U and /UE)
  const { u, ue } = generateUserEntries(userPassword, fileEncryptionKey, 6);

  // Generate owner entries (/O and /OE) - needs /U for hash
  const { o, oe } = generateOwnerEntries(ownerPassword, fileEncryptionKey, u, 6);

  // Generate /Perms entry
  const perms = generatePermsEntry(fileEncryptionKey, permissionsRaw, encryptMetadata);

  // Generate file ID (two random 16-byte values)
  const id1 = randomBytes(16);
  const id2 = randomBytes(16);
  const fileId: [Uint8Array, Uint8Array] = [id1, id2];

  // Build encryption dictionary
  const encryptDict = PdfDict.of({
    Filter: PdfName.of("Standard"),
    V: PdfNumber.of(5),
    R: PdfNumber.of(6),
    Length: PdfNumber.of(256),
    O: PdfString.fromBytes(o),
    U: PdfString.fromBytes(u),
    OE: PdfString.fromBytes(oe),
    UE: PdfString.fromBytes(ue),
    P: PdfNumber.of(permissionsRaw),
    Perms: PdfString.fromBytes(perms),
    // Crypt filters for AES-256
    CF: PdfDict.of({
      StdCF: PdfDict.of({
        CFM: PdfName.of("AESV3"),
        AuthEvent: PdfName.of("DocOpen"),
        Length: PdfNumber.of(32),