ENH: Improve/rewrite PDF permission retrieval

[stefan6419846]

Fixes #2391. Fixes #2399.

[MartinThoma]

Nice work!

[MartinThoma]

@pubpub-zz What do you think about this approach? Is it fine in your opinion you as well?

[pubpub-zz]

from my understanding of §3.5.3, permissions can also be attached to different users through PKCS#7.
it may be good to add a constructor to initialize properly the R1/R2/R6/R7 (for #2401) we should not merge this PR with this issue active

[MartinThoma]

Thanks for pointing this out. That's something I wasn't aware of. I will read up on the specs before merging it 👍

[stefan6419846]

from my understanding of §3.5.3, permissions can also be attached to different users through PKCS#7.

Do we really have support for certificate-based encryption anywhere? AFAIK we can only use user and owner passwords at the moment.

According to table 23 of PDF 3200-1:2008, the most important difference is "If bit 2 is set to 1, all other bits are ignored and all operations are permitted. If bit 2 is set to 0, permission for operations are based on the values of the remaining flags defined in Table 24." This seems to change the semantics of R2 only nevertheless.

it may be good to add a constructor to initialize properly the R1/R2/R6/R7 (for #2401) we should not merge this PR with this issue active

IMHO this is a separate issue (and rather a bug than an enhancement) and should get a dedicated PR. This PR primarily is about PDF permission retrieval, as the title indicates.

[MartinThoma]

I've just checked other software:

• PyMuPDF: What we call PdfReader.user_access_permissions is simply called Document.permissions there.
• QPDF: qpdf --show-encryption 005-libreoffice-writer-password/libreoffice-writer-password.pdf --password=openpassword gives a dictionary-like output
• PDFium: permission_flags = pdfium_c.FPDF_GetDocPermission(pdf)

from my understanding of §3.5.3, permissions can also be attached to different users through PKCS#7.
it may be good to add a constructor to initialize properly the R1/R2/R6/R7

For the moment, I think it's best to ignore that complexity. We already have a user interface which is public and I think the user_access_permissions property is better than the existing interface. It's also similar to PDFium and PyMuPDF - both are very good projects which I respect a lot.

I leave this open until Saturday (maybe Sunday), but if there are no new arguments / new insights, I would merge it.

[pubpub-zz]

proposition to prepare future

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (480e840) 94.42% compared to head (e24b305) 94.42%.
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2400   +/-   ##
=======================================
  Coverage   94.42%   94.42%           
=======================================
  Files          49       49           
  Lines        7961     7998   +37     
  Branches     1608     1616    +8     
=======================================
+ Hits         7517     7552   +35     
- Misses        274      276    +2     
  Partials      170      170           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.