Digital signatures of PDF and Encrypt/Decrypt PDF, on JavaScript.

This library override pdf-lib some functions.
Maybe comatible with original ,but not limited to the warranties.
Using "@ts-ignore" to access pdf-lib private properties | functions, which may not fit your policy.
Not adequately tested,"NOT LIMITED TO THE WARRANTIES"

The issue post at pdf-lib on how to sign was helpful.
PR#1015 on pdf-lib about encryption was helpful.

import {pdfSigner} from "spdf";
const signer = new pdfSigner();

• New Sign
  
• Add Sign
  
• Add TimeStamp
  
• Add DSS
  
• ADD LastTimeStamp-DSS
  

import {decryptPDF, encryptPDF} from "spdf";

• encryptPDF
  
• decryptPDF
  

• Create a signed PDF.

pdfSigner.newSing: (pdf:string | Uint8Array | ArrayBuffer, certs: CERTIFICATEs, options?: newSignOptions) => Promise<Uint8Array>

Import Certificate and Key is dependency on jsrsasign,Support format look jsrsasign reference.

The value of DocMDP is quoted to the ISO-32000-1.
1.No changes to the document shall be permitted; any change to the document shall invalidate the signature.
2.Permitted changes shall be filling in forms, instantiating page templates, and signing; other changes shall invalidate the signature.
3.Permitted changes shall be the same as for 2, as well as annotation creation, deletion, and modification; other changes shall invalidate the signature.

see

Visible signature.

Not available in web browsers due to CORS.

• Allocate Size
  PDF signatures must be pre-allocated space.
  The size of the space is estimated from the certificate and allocated,
  but the timestamp cannot check the size of the certificate in advance.
  If there is not enough space, the timestamp will be set to a sufficient size based on the results obtained once,
  but it will need to be signed again.
  In other words, if there is not enough space, the timestamping will be requested twice.
  If the area is large enough, it cannot be reduced.

• Add(inculumental) a signature.
  Add a new signature without modifying the PDF document.
  Existing content, including signatures, will be maintained.
  If encrypted,encryption is maintained.
  

pdfSigner.pdfSigner.inculumentalSign: (pdf:string | Uint8Array | ArrayBuffer, certs: CERTIFICATEs, options?: inclumentalSignOptions) => Promise<Uint8Array>

See

• Add(inculumental) a Timestamp.
  Add a new timestamp without modifying the PDF document.
  Existing content, including signatures, will be maintained.
  If encrypted,encryption is maintained.
  

pdfSigner.inculumentalTimeStamp: (pdf:string | Uint8Array | ArrayBuffer, tsaPram: timeStampOptions) => Promise<Uint8Array>

• Add(inculumental) a DSS.
  Embeds the verification information of the currently embedded certificate.
  Add a DSS without modifying the PDF document.
  Existing content, including signatures, will be maintained.
  If encrypted,encryption is maintained.
  Simply, it enables LTV.
  Processes all signatures, if you have already embedded the DSS, you will need to embed the DSS for the added timestamp only.
  See ADD LastTimeStamp-DSS

pdfSigner.addDSSAllCerts: (pdf:string | Uint8Array | ArrayBuffer, options?: addDssOptions) => Promise<Uint8Array>

To obtain verification information, CRLs are obtained, OCSP queries are made, and CA certificates are acquired. Not available in web browsers due to CORS.

• Add(inculumental) a LastTimeStamp-DSS.
  Embeds the verification information of the currently embedded certificate.
  Add a DSS without modifying the PDF document.
  Existing content, including signatures, will be maintained.
  If encrypted,encryption is maintained.
  Simply, Extended document Time-stamp.
  

pdfSigner.addDSSLastTimeStamp: (pdf:string | Uint8Array | ArrayBuffer, options?: addDssOptions) => Promise<Uint8Array>

see

const encryptPDF: (pdf: string | Uint8Array | ArrayBuffer, encryptOptions: encryptOptions) => Promise<Uint8Array>

UserPermission default all deny.

decryptPDF: (pdf: string | Uint8Array | ArrayBuffer, ownerPassword: string) => Promise<Uint8Array>

Import "PDFDocument" from 'pdf-lib_patch' instead of 'pdf-lib'.

This then,is

import { PDFDocument, rgb} from "pdf-lib";
const pdfData = await PDFDocument.load(readFileSync("input.pdf"));
const page1 = pdfData.getPage(0);
page1.drawCircle({ "opacity":1, x:100, y:740,size:100,color:rgb(0.8,0.2,0.2)});
page1.drawCircle({ "opacity":1, x:150, y:740,size:100,color:rgb(0.2,0.8,0.2)});
writeFileSync("output.pdf",await pdfData.save());

do this.

import {rgb} from "pdf-lib";
import {PDFDocument} from "pdf-lib_patch";
const pdfData = await PDFDocument.load(readFileSync("input.pdf"),{"password":"ownerpassword"});
const page1 = pdfData.getPage(0);
page1.drawCircle({ "opacity":1, x:100, y:740,size:100,color:rgb(0.8,0.2,0.2)});
page1.drawCircle({ "opacity":1, x:150, y:740,size:100,color:rgb(0.2,0.8,0.2)});
pdfData.encrypt({
  "keyBits":256,
  "userPassword":"",
  "ownerPassword":"newownerpassword",
  "permission":{"printing":"highResolution"}
});
writeFileSync("output.pdf",await pdfData.save({"useObjectStreams":false}));
//{"useObjectStreams":false} is requested,because pdf broken.