pdf password related

frontend/src/App.tsx

@@ -876,7 +876,14 @@ function App() {
       setProtectModalState(null);
       setIsInspectorOpen(true);
       setInspectorTab('properties');
-      setExportModalOpen(true);
+      
+      if (isRemote) {
+        await gatewayService.exportRemoteDocument(targetDocId, urlToken);
+        const parentOrigin = urlParams.get('parent_origin') || import.meta.env.VITE_PARENT_ORIGIN || '*';
+        window.parent.postMessage({ type: 'REMOTE_SAVE_COMPLETE' }, parentOrigin);
+      } else {
+        setExportModalOpen(true);
+      }
     } catch (e: any) {
       console.error('Protection failed', e);
       throw e;
@@ -895,7 +902,14 @@ function App() {
       setUnlockModalState(null);
       setIsInspectorOpen(true);
       setInspectorTab('properties');
-      setExportModalOpen(true);
+      
+      if (isRemote) {
+        await gatewayService.exportRemoteDocument(selectedDocId, urlToken);
+        const parentOrigin = urlParams.get('parent_origin') || import.meta.env.VITE_PARENT_ORIGIN || '*';
+        window.parent.postMessage({ type: 'REMOTE_SAVE_COMPLETE' }, parentOrigin);
+      } else {
+        setExportModalOpen(true);
+      }
     } catch (e: any) {
       console.error('Unlock failed', e);
       throw e;

gateway/app/routers/documents/export.py

@@ -77,8 +77,13 @@ async def export_remote_document(document_id: str, body: ExportRemoteRequest | N
         )
 
     try:
-        doc = d["doc_instance"]
-        bytes_data = doc.save_full_for_export()
+        # ALWAYS use the stored bytes_data, which accurately reflects the current state (including encryption).
+        # doc.save_full_for_export() drops encryption or corrupts the output when exporting a protected PDF.
+        bytes_data = d.get("bytes_data")
+        if not bytes_data:
+            doc = d["doc_instance"]
+            bytes_data = doc.save_full_for_export()
+            
         filename = d["filename"]
         if not filename.endswith(".pdf"):
             filename += ".pdf"