Integration & Server

use mudrit::prelude::*;

let signer = PfxSigner::from_file("signer.pfx", "password")?;
let data   = std::fs::read("invoice.xml")?;

// CAdES-BES (includes the ESS signing-certificate attribute by default)
let p7s = sign_detached_cms(&signer, &data, &CmsOptions::default())?;
std::fs::write("invoice.xml.p7s", &p7s)?;

// CAdES-B-T — add an RFC-3161 signature timestamp
let opts  = CmsOptions::default().timestamp(Timestamp::url("http://timestamp.comodoca.com"));
let p7s_t = sign_detached_cms(&signer, &data, &opts)?;

openssl smime -verify -binary -inform DER -in invoice.xml.p7s \
    -content invoice.xml -noverify -out /dev/null

use mudrit::prelude::*;

// STEP 1 (server) — prepare, no private key used. The cert + chain are known up front.
let identity = SigningCertificate::new(leaf_cert_der).chain(chain_ders);
let cfg      = SignConfig::builder().place("1", [350, 60, 560, 160])?.build();
let prepared = prepare_signature(&pdf, &identity, &cfg)?;
let blob     = prepared.to_bytes()?; // crosses a process/request boundary (DB row, session, queue)

// STEP 2 (remote service) — sign the exposed bytes with the private key
let to_sign   = PreparedSignature::from_bytes(&blob)?;
let signature = remote_sign(to_sign.signed_attributes())?; // your HSM/API call — RSA raw / ECDSA DER {r,s}

// STEP 3 (server) — finalize: embed the external signature
let restored = PreparedSignature::from_bytes(&blob)?;
let signed   = restored.finalize(&signature)?;

use mudrit::prelude::*;

// discover the empty field(s)
for f in list_signature_fields(&pdf)? {
    println!("{} page {} rect {:?} {}", f.name, f.page, f.rect, if f.signed { "SIGNED" } else { "empty" });
}

// sign into the named field — its page + rectangle are reused, no new field is created
let cfg = SignConfig::builder()
    .sign_existing_field("DirectorSignature")
    .reason("Approved")
    .build();
let signed = sign_pdf(&pdf, &signer, &cfg)?;

use mudrit::prelude::*;

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .seed_value(SeedValue::default())   // fill in the constraints you want to mandate
    .build();
let signed = sign_pdf(&pdf, &signer, &cfg)?;

use mudrit::prelude::*;

let vm = ValidationMaterial::new()
    .add_cert(issuer_der)   // an extra chain cert for /DSS /Certs
    .add_crl(crl_der)       // a pre-fetched CRL (DER)
    .add_ocsp(ocsp_der)     // a pre-fetched OCSP response (DER)
    .offline(true);         // embed ONLY the injected material — no network fetches

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .ltv(true)
    .validation_material(vm)
    .ltv_policy(LtvPolicy::Require)      // fail loud if revocation can't be embedded
    .build();

// BestEffort never lies — ask what actually landed in the /DSS:
let (signed, report) = sign_pdf_reported(&pdf, &signer, &cfg)?;
if !report.complete {
    eprintln!("signed without revocation info: {} certs, no CRL/OCSP", report.certs);
}

use mudrit::prelude::*;

let inputs: Vec<Vec<u8>> = vec![std::fs::read("a.pdf")?, std::fs::read("b.pdf")?];
let results = sign_batch(&inputs, &signer, &cfg, &BatchOptions::default());
for (i, r) in results.iter().enumerate() {
    match r {
        Ok(pdf) => println!("#{i}: {} bytes", pdf.len()),
        Err(e)  => eprintln!("#{i}: {e}"),   // this input failed; the rest still succeeded
    }
}

// async (feature = "tokio") — the signer is shared as an Arc across the blocking pool
use std::sync::Arc;

let signer  = Arc::new(PfxSigner::from_file("signer.pfx", "password")?);
let signed  = sign_pdf_async(std::fs::read("in.pdf")?, signer.clone(), cfg.clone()).await?;
let results = sign_batch_async(inputs, signer, cfg, BatchOptions::default()).await?;