From d47895c990ed3d1141103f8688ca9197f428c5d9 Mon Sep 17 00:00:00 2001
From: Furqan-14 <furqan076@gmail.com>
Date: Fri, 12 Jun 2026 15:04:09 +0530
Subject: [PATCH] feat: implemented base editing, underline and striking

---
 bindings/python/pdfengine_py.cpp              |  15 ++
 corpus/edge-cases/restricted.pdf              |  41 +++++
 engine/include/pdfengine/pdf_document.hpp     |  20 +++
 engine/src/parser/pdfium_document.cpp         | 152 ++++++++++++------
 engine/src/parser/pdfium_document.hpp         |   1 +
 frontend/src/App.tsx                          |  82 ++++++++--
 frontend/src/components/InspectorPanel.tsx    |  47 +++++-
 frontend/src/components/PasswordModal.tsx     |  96 +++++++++++
 frontend/src/components/ToolRail.tsx          |  21 ++-
 frontend/src/components/TopBar.tsx            |  12 +-
 frontend/src/lib/gatewayService.ts            |  52 +++++-
 frontend/src/viewer/PDFViewer.tsx             |   6 +
 gateway/app/routers/documents.py              |  26 +++
 gateway/app/routers/edits.py                  |  40 ++++-
 gateway/app/services/store.py                 |  38 ++++-
 tests/edits/test_decorations.py               |  73 +++++++++
 .../edge-cases__restricted.pdf__p0.png        | Bin 0 -> 15378 bytes
 tests/security/test_permissions.py            |  99 ++++++++++++
 18 files changed, 730 insertions(+), 91 deletions(-)
 create mode 100644 corpus/edge-cases/restricted.pdf
 create mode 100644 frontend/src/components/PasswordModal.tsx
 create mode 100644 tests/edits/test_decorations.py
 create mode 100644 tests/regression/baseline/edge-cases__restricted.pdf__p0.png
 create mode 100644 tests/security/test_permissions.py

diff --git a/bindings/python/pdfengine_py.cpp b/bindings/python/pdfengine_py.cpp
index 10921a5..e920050 100644
--- a/bindings/python/pdfengine_py.cpp
+++ b/bindings/python/pdfengine_py.cpp
@@ -80,6 +80,20 @@ PYBIND11_MODULE(pdfengine, m) {
             return "DocumentMetadata(title='" + self.title + "', author='" + self.author + "')";
         });
 
+    py::class_<pdfengine::DocumentPermissions>(m, "DocumentPermissions")
+        .def_readonly("is_encrypted", &pdfengine::DocumentPermissions::isEncrypted)
+        .def_readonly("encryption", &pdfengine::DocumentPermissions::encryption)
+        .def_readonly("security_revision", &pdfengine::DocumentPermissions::securityRevision)
+        .def_readonly("owner_unlocked", &pdfengine::DocumentPermissions::ownerUnlocked)
+        .def_readonly("can_print", &pdfengine::DocumentPermissions::canPrint)
+        .def_readonly("can_print_high_res", &pdfengine::DocumentPermissions::canPrintHighRes)
+        .def_readonly("can_modify", &pdfengine::DocumentPermissions::canModify)
+        .def_readonly("can_copy", &pdfengine::DocumentPermissions::canCopy)
+        .def_readonly("can_annotate", &pdfengine::DocumentPermissions::canAnnotate)
+        .def_readonly("can_fill_forms", &pdfengine::DocumentPermissions::canFillForms)
+        .def_readonly("can_extract_for_accessibility", &pdfengine::DocumentPermissions::canExtractForAccessibility)
+        .def_readonly("can_assemble", &pdfengine::DocumentPermissions::canAssemble);
+
     py::class_<pdfengine::PageImage>(m, "PageImage")
         .def_readonly("width", &pdfengine::PageImage::width)
         .def_readonly("height", &pdfengine::PageImage::height)
@@ -270,6 +284,7 @@ PYBIND11_MODULE(pdfengine, m) {
         }, py::arg("data"), py::arg("password") = "")
         .def_property_readonly("page_count", &pdfengine::PdfDocument::pageCount)
         .def_property_readonly("metadata", &pdfengine::PdfDocument::metadata)
+        .def_property_readonly("permissions", &pdfengine::PdfDocument::permissions)
         .def("extract_outline", [](const pdfengine::PdfDocument& self) {
             auto res = get_or_throw(self.extractOutline());
             py::list out;
diff --git a/corpus/edge-cases/restricted.pdf b/corpus/edge-cases/restricted.pdf
new file mode 100644
index 0000000..a1d389e
--- /dev/null
+++ b/corpus/edge-cases/restricted.pdf
@@ -0,0 +1,41 @@
+%PDF-1.7
+%����
+1 0 obj
+<< /Extensions << /ADBE << /BaseVersion /1.7 /ExtensionLevel 8 >> >> /Pages 2 0 R /Type /Catalog >>
+endobj
+2 0 obj
+<< /Count 1 /Kids [ 3 0 R ] /Type /Pages >>
+endobj
+3 0 obj
+<< /Contents 4 0 R /MediaBox [ 0 0 612 792 ] /Parent 2 0 R /Resources << /Font << /F1 5 0 R /F2 6 0 R >> >> /Type /Page >>
+endobj
+4 0 obj
+<< /Length 352 /Filter /FlateDecode >>
+stream
+�����y��L4W��{���
+���\����ӂ˼`�S���8�1�4�v��n˳?�D<���#��6��J��?������
3��� g&e�k��A���p�@����Q�������>ȃ'���� l��:���*��S@5xw^�u������v�v��Y\B�&Ť.��ռ�f(+��K�N.��I���U��xu&���Tt��7����<c>�"������e�Mq�U]濗��ʸ�=%dɮ�(�y��M���7��v_�����X�PO�\'f_�Y�of7}/t�aC���Inh����\�V�wR��[pq5X�3;��|�� s�t�Jՠ
+endstream
+endobj
+5 0 obj
+<< /BaseFont /Helvetica /Encoding /WinAnsiEncoding /Subtype /Type1 /Type /Font >>
+endobj
+6 0 obj
+<< /BaseFont /Times-Roman /Encoding /WinAnsiEncoding /Subtype /Type1 /Type /Font >>
+endobj
+7 0 obj
+<< /CF << /StdCF << /AuthEvent /DocOpen /CFM /AESV3 /Length 32 >> >> /Filter /Standard /Length 256 /O <eed09d7bae817b88ec68c4bba71e4688bad49a26f13d5f1b558fd8d6246663774b7e74b08734ad7a57473b33ec19e47d> /OE <33dc073711e1735085e2efd64928fa75af518dcf25ec7ff7d3ae22976ab8ded4> /P -3136 /Perms <b360a35c81e6b6380ef770702952140a> /R 6 /StmF /StdCF /StrF /StdCF /U <0d6d86441425cdaee0cda2eec22acd2391b314ff4c0bb60c90e9955907889824f87b528709af1246ab59dd722a89cb2a> /UE <2da7189a149f6fcbdf38688a565f280f8e6a4b727a3f528dbb9e014a88ebd88f> /V 5 >>
+endobj
+xref
+0 8
+0000000000 65535 f 
+0000000015 00000 n 
+0000000130 00000 n 
+0000000189 00000 n 
+0000000327 00000 n 
+0000000751 00000 n 
+0000000848 00000 n 
+0000000947 00000 n 
+trailer << /Root 1 0 R /Size 8 /ID [<f341436d4fd6835a35fb5f4313bdd156><f341436d4fd6835a35fb5f4313bdd156>] /Encrypt 7 0 R >>
+startxref
+1497
+%%EOF
diff --git a/engine/include/pdfengine/pdf_document.hpp b/engine/include/pdfengine/pdf_document.hpp
index 444c81b..f3105fe 100644
--- a/engine/include/pdfengine/pdf_document.hpp
+++ b/engine/include/pdfengine/pdf_document.hpp
@@ -28,6 +28,25 @@ struct DocumentMetadata {
     std::string modificationDate;
 };
 
+// Encryption + permission state of a loaded document. Booleans are the EFFECTIVE
+// permissions for how the doc was opened (an owner-unlocked doc reports all true).
+// The engine only surfaces these — enforcement happens in the gateway/app layers.
+struct DocumentPermissions {
+    bool isEncrypted = false;
+    std::string encryption = "None"; // "None", "RC4-40", "RC4-128", "AES-128", "AES-256"
+    int securityRevision = -1;       // FPDF_GetSecurityHandlerRevision (-1 if unencrypted)
+    bool ownerUnlocked = false;      // encrypted but opened with full (owner) access
+
+    bool canPrint = true;
+    bool canPrintHighRes = true;
+    bool canModify = true;
+    bool canCopy = true;                  // extract text / graphics
+    bool canAnnotate = true;              // add/modify annotations
+    bool canFillForms = true;
+    bool canExtractForAccessibility = true;
+    bool canAssemble = true;              // insert / rotate / delete pages
+};
+
 struct PageImage {
     int width;
     int height;
@@ -214,6 +233,7 @@ public:
 
     [[nodiscard]] virtual int pageCount() const noexcept = 0;
     [[nodiscard]] virtual DocumentMetadata metadata() const noexcept = 0;
+    [[nodiscard]] virtual DocumentPermissions permissions() const noexcept = 0;
 
     // A single entry in the document outline (bookmarks), flattened with a depth level.
     struct OutlineItem {
diff --git a/engine/src/parser/pdfium_document.cpp b/engine/src/parser/pdfium_document.cpp
index 83d922b..28f36b2 100644
--- a/engine/src/parser/pdfium_document.cpp
+++ b/engine/src/parser/pdfium_document.cpp
@@ -1299,6 +1299,10 @@ std::expected<std::vector<PdfPage::AnnotationInfo>, EngineError> PdfiumPage::ext
             info.type = "ink";
         } else if (subtype == FPDF_ANNOT_STRIKEOUT) {
             info.type = "strikeout";
+        } else if (subtype == FPDF_ANNOT_UNDERLINE) {
+            info.type = "underline";
+        } else if (subtype == FPDF_ANNOT_SQUIGGLY) {
+            info.type = "squiggly";
         } else if (subtype == FPDF_ANNOT_WIDGET) {
             info.type = "widget";
             
@@ -1605,6 +1609,49 @@ DocumentMetadata PdfiumDocument::metadata() const noexcept {
     return meta;
 }
 
+DocumentPermissions PdfiumDocument::permissions() const noexcept {
+    DocumentPermissions perms; // defaults: unencrypted, everything allowed
+#ifdef PDFENGINE_WITH_PDFIUM
+    if (!doc_) return perms;
+
+    const int rev = FPDF_GetSecurityHandlerRevision(doc_);
+    perms.securityRevision = rev;
+    perms.isEncrypted = (rev != -1);
+    if (!perms.isEncrypted) {
+        return perms; // "None", all true
+    }
+
+    switch (rev) {
+        case 2: perms.encryption = "RC4-40"; break;
+        case 3: perms.encryption = "RC4-128"; break;
+        case 4: perms.encryption = "AES-128"; break; // R4 may be RC4-128; PDFium hides /CFM
+        case 5:
+        case 6: perms.encryption = "AES-256"; break;
+        default: perms.encryption = "Unknown"; break;
+    }
+
+    // FPDF_GetDocPermissions returns the EFFECTIVE /P flags for how the doc was
+    // opened; FPDF_GetDocUserPermissions always returns the user-level flags. When
+    // they differ, the doc was unlocked with the owner password (full access).
+    // (PDFium grants full effective perms without always returning exactly
+    // 0xFFFFFFFF, so a direct equality check is unreliable.)
+    const unsigned long p = FPDF_GetDocPermissions(doc_);
+    const unsigned long up = FPDF_GetDocUserPermissions(doc_);
+    perms.ownerUnlocked = (p != up);
+
+    auto allowed = [p](unsigned long bit) { return (p & bit) != 0ul; };
+    perms.canPrint = allowed(0x4);                    // bit 3
+    perms.canModify = allowed(0x8);                   // bit 4
+    perms.canCopy = allowed(0x10);                    // bit 5
+    perms.canAnnotate = allowed(0x20);                // bit 6
+    perms.canFillForms = allowed(0x100);              // bit 9
+    perms.canExtractForAccessibility = allowed(0x200);// bit 10
+    perms.canAssemble = allowed(0x400);               // bit 11
+    perms.canPrintHighRes = allowed(0x800);           // bit 12
+#endif
+    return perms;
+}
+
 #ifdef PDFENGINE_WITH_PDFIUM
 namespace {
 // Depth-first flatten of the bookmark tree into OutlineItems with a depth level.
@@ -2269,13 +2316,6 @@ std::expected<void, EngineError> PdfiumDocument::applyEdits(const std::string& e
                     return std::unexpected(EngineError::InvalidFormat);
                 }
                 auto data = op["data"];
-                double x = data.value("x", 0.0);
-                double y = data.value("y", 0.0);
-                double width = data.value("width", 0.0);
-                double thickness = data.value("thickness", 1.0);
-                std::string color = data.value("color", "#000000");
-                
-                spdlog::info("Parsed {} operation: x={}, y={}, width={}", type, x, y, width);
 
                 FPDF_PAGE page = FPDF_LoadPage(doc_, pageIndex);
                 if (!page) {
@@ -2283,59 +2323,67 @@ std::expected<void, EngineError> PdfiumDocument::applyEdits(const std::string& e
                     return std::unexpected(EngineError::Unknown);
                 }
 
-                pdfengine::Path path;
-                if (type == "underline") {
-                    path = DecorationBuilder::buildUnderline(x, y, width, thickness);
-                } else if (type == "strikeout") {
-                    path = DecorationBuilder::buildStrikeout(x, y, width, thickness);
-                } else if (type == "squiggly") {
-                    path = DecorationBuilder::buildSquiggly(x, y, width);
+                // Adobe-grade: create a real text-markup annotation (editable, deletable,
+                // round-trips, and positioned within the text quad by PDFium's appearance
+                // generator) instead of baking a fixed-offset path. Mirrors the highlight handler.
+                int subtype = FPDF_ANNOT_UNDERLINE;
+                if (type == "strikeout") subtype = FPDF_ANNOT_STRIKEOUT;
+                else if (type == "squiggly") subtype = FPDF_ANNOT_SQUIGGLY;
+
+                FPDF_ANNOTATION annot = FPDFPage_CreateAnnot(page, subtype);
+                if (!annot) {
+                    spdlog::error("Failed to create {} annotation", type);
+                    FPDF_ClosePage(page);
+                    return std::unexpected(EngineError::Unknown);
                 }
 
-                if (!path.empty()) {
-                    const auto& segments = path.segments();
-                    float startX = segments[0].points[0].x;
-                    float startY = segments[0].points[0].y;
-                    FPDF_PAGEOBJECT pathObj = FPDFPageObj_CreateNewPath(startX, startY);
+                double pageHeight = FPDF_GetPageHeightF(page);
+                unsigned int r = 0, g = 0, b = 0;
+                parseHexColor(data.value("color", "#000000"), r, g, b);
+                FPDFAnnot_SetColor(annot, FPDFANNOT_COLORTYPE_Color, r, g, b, 255);
 
-                    bool isFill = (type != "squiggly");
-                    bool isStroke = (type == "squiggly");
+                if (data.contains("quadPoints") && data["quadPoints"].is_array()) {
+                    FS_RECTF boundingBox;
+                    boundingBox.left = 99999.0f;
+                    boundingBox.right = -99999.0f;
+                    boundingBox.top = -99999.0f;
+                    boundingBox.bottom = 99999.0f;
 
-                    for (size_t i = 1; i < segments.size(); ++i) { // Start from 1 to skip first MoveTo
-                        const auto& seg = segments[i];
-                        if (seg.verb == Path::Verb::MoveTo) {
-                            FPDFPath_MoveTo(pathObj, seg.points[0].x, seg.points[0].y);
-                        } else if (seg.verb == Path::Verb::LineTo) {
-                            FPDFPath_LineTo(pathObj, seg.points[0].x, seg.points[0].y);
-                        } else if (seg.verb == Path::Verb::CubicBezierTo) {
-                            FPDFPath_BezierTo(pathObj, seg.points[0].x, seg.points[0].y, 
-                                              seg.points[1].x, seg.points[1].y, 
-                                              seg.points[2].x, seg.points[2].y);
-                        } else if (seg.verb == Path::Verb::Close) {
-                            FPDFPath_Close(pathObj);
-                        }
+                    for (const auto& quad : data["quadPoints"]) {
+                        FS_QUADPOINTSF points;
+                        // Frontend is top-down; backend is bottom-up.
+                        points.x1 = static_cast<float>(quad.value("x1", 0.0));
+                        points.y1 = static_cast<float>(pageHeight - quad.value("y1", 0.0));
+                        points.x2 = static_cast<float>(quad.value("x2", 0.0));
+                        points.y2 = static_cast<float>(pageHeight - quad.value("y2", 0.0));
+                        points.x3 = static_cast<float>(quad.value("x3", 0.0));
+                        points.y3 = static_cast<float>(pageHeight - quad.value("y3", 0.0));
+                        points.x4 = static_cast<float>(quad.value("x4", 0.0));
+                        points.y4 = static_cast<float>(pageHeight - quad.value("y4", 0.0));
+
+                        FPDFAnnot_AppendAttachmentPoints(annot, &points);
+
+                        float minX = (std::min)({points.x1, points.x2, points.x3, points.x4});
+                        float maxX = (std::max)({points.x1, points.x2, points.x3, points.x4});
+                        float minY = (std::min)({points.y1, points.y2, points.y3, points.y4});
+                        float maxY = (std::max)({points.y1, points.y2, points.y3, points.y4});
+                        if (minX < boundingBox.left) boundingBox.left = minX;
+                        if (maxX > boundingBox.right) boundingBox.right = maxX;
+                        if (minY < boundingBox.bottom) boundingBox.bottom = minY;
+                        if (maxY > boundingBox.top) boundingBox.top = maxY;
                     }
-
-                    FPDFPath_SetDrawMode(pathObj, isFill ? FPDF_FILLMODE_ALTERNATE : FPDF_FILLMODE_NONE, isStroke);
-
-                    unsigned int r = 0, g = 0, b = 0;
-                    parseHexColor(color, r, g, b);
-
-                    if (isFill) {
-                        FPDFPageObj_SetFillColor(pathObj, r, g, b, 255);
-                    }
-                    if (isStroke) {
-                        FPDFPageObj_SetStrokeColor(pathObj, r, g, b, 255);
-                        FPDFPageObj_SetStrokeWidth(pathObj, thickness);
-                    }
-
-                    FPDFPage_InsertObject(page, pathObj);
-
-                    if (!FPDFPage_GenerateContent(page)) {
-                        spdlog::error("Failed to generate page content after adding decoration");
+                    if (boundingBox.left <= boundingBox.right) {
+                        FPDFAnnot_SetRect(annot, &boundingBox);
                     }
                 }
 
+                std::string author = data.value("author", "");
+                if (!author.empty()) {
+                    auto utf16 = utf8_to_utf16le(author);
+                    FPDFAnnot_SetStringValue(annot, "T", reinterpret_cast<FPDF_WIDESTRING>(utf16.data()));
+                }
+
+                FPDFPage_CloseAnnot(annot);
                 FPDF_ClosePage(page);
             } else if (type == "redaction") {
                 if (!op.contains("data") || !op["data"].is_object()) {
diff --git a/engine/src/parser/pdfium_document.hpp b/engine/src/parser/pdfium_document.hpp
index fde4c54..6f0bf97 100644
--- a/engine/src/parser/pdfium_document.hpp
+++ b/engine/src/parser/pdfium_document.hpp
@@ -85,6 +85,7 @@ public:
 
     int pageCount() const noexcept override;
     DocumentMetadata metadata() const noexcept override;
+    DocumentPermissions permissions() const noexcept override;
     std::expected<std::vector<OutlineItem>, EngineError> extractOutline() const override;
 
     std::expected<std::shared_ptr<PdfPage>, EngineError> getPage(int pageIndex) override;
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 17d2198..9b69ec6 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -13,8 +13,9 @@ import { PDFViewer } from './viewer/PDFViewer';
 import type { PDFViewerRef } from './viewer/PDFViewer';
 import type { Annotation } from './viewer/AnnotationLayer';
 import type { EditableRun } from './viewer/TextEditLayer';
-import { gatewayService } from './lib/gatewayService';
-import type { DocumentInfo, SearchResult, EditOperation, DocumentMetadata, FontInfo, OutlineItem } from './lib/gatewayService';
+import { gatewayService, PasswordError } from './lib/gatewayService';
+import { PasswordModal } from './components/PasswordModal';
+import type { DocumentInfo, SearchResult, EditOperation, DocumentMetadata, FontInfo, OutlineItem, PDFPermissions } from './lib/gatewayService';
 import { viewportRectToPdf } from './lib/coordinateMapping';
 import type { Rect } from './lib/coordinateMapping';
 import { wasmLoader } from './lib/wasmLoader';
@@ -37,6 +38,20 @@ function App() {
   const canRedo = hist.index < hist.stack.length - 1;
   const preservePageRef = useRef(false);
 
+  // Effective PDF permissions for the active document (carried forward across edits).
+  // `can` defaults to allowed when permissions are unknown / unencrypted.
+  const permissions = activeDoc?.permissions ?? null;
+  const can = (flag: keyof PDFPermissions) => !permissions || permissions[flag] !== false;
+  const denyToast = (label: string) =>
+    toast(`${label} is not permitted by this document's restrictions`, 'error');
+  // Tools the active document's permissions forbid (greyed out in the rail).
+  const disabledTools = new Set<ToolId>();
+  if (!can('canAnnotate'))
+    (['highlight', 'underline', 'strikeout', 'squiggly', 'draw', 'comment', 'textbox', 'stamp', 'signature'] as ToolId[]).forEach((t) => disabledTools.add(t));
+  if (!can('canModify')) (['edit_text', 'redact'] as ToolId[]).forEach((t) => disabledTools.add(t));
+  const disabledToolsRef = useRef(disabledTools);
+  disabledToolsRef.current = disabledTools;
+
   // View / tools
   const [zoom, setZoom] = useState(1.0);
   const [activeTool, setActiveTool] = useState<ToolId>('select');
@@ -59,6 +74,7 @@ function App() {
   const [pendingSignature, setPendingSignature] = useState<{ url: string; aspect: number } | null>(null);
   const [signatureModalOpen, setSignatureModalOpen] = useState(false);
   const [aboutModalOpen, setAboutModalOpen] = useState(false);
+  const [passwordPrompt, setPasswordPrompt] = useState<{ file: File; filename: string; error?: string } | null>(null);
   const [activeStamp, setActiveStamp] = useState<{ label: string; color: string } | null>(null);
   const [confirmState, setConfirmState] = useState<(CustomConfirmationOptions & { onConfirm: () => void }) | null>(null);
 
@@ -200,7 +216,11 @@ function App() {
       if (typing || mod) return;
 
       const tool = TOOL_SHORTCUTS[e.key.toLowerCase()];
-      if (tool) { setActiveTool(tool); if (tool === 'signature' && !pendingSignature) setSignatureModalOpen(true); }
+      if (tool) {
+        if (disabledToolsRef.current.has(tool)) { denyToast('This tool'); return; }
+        setActiveTool(tool);
+        if (tool === 'signature' && !pendingSignature) setSignatureModalOpen(true);
+      }
     };
     window.addEventListener('keydown', onKey);
     return () => window.removeEventListener('keydown', onKey);
@@ -231,6 +251,7 @@ function App() {
 
   /* -------------------------------------- annotation creation (optimistic) */
   const handleAnnotationAdded = (a: Annotation) => {
+    if (!can('canAnnotate')) { denyToast('Annotations'); return; }
     setAnnotations((prev) => [...prev, a]);
     if (inspectorTab !== 'notes') setInspectorTab('notes');
     const page = a.pageIndex ?? currentPage;
@@ -264,15 +285,15 @@ function App() {
 
   /* ---------------------------------------------- new overlay placements */
   const handleDecorateText = (pageIndex: number, lines: Rect[], type: 'underline' | 'strikeout' | 'squiggly', color: string) => {
-    const ops: EditOperation[] = lines.map(line => {
-      const pdf = viewportRectToPdf(line, zoom, pageHeightPts(pageIndex));
-      return {
-        id: rid('decor'), type, pageIndex,
-        data: { x: pdf.x, y: pdf.y, width: pdf.width, thickness: 1.5, color }
-      };
+    if (!can('canAnnotate')) { denyToast('Text decorations'); return; }
+    // One markup annotation covering all selected lines. quadPoints are in top-left
+    // points (line px ÷ zoom); the engine flips to bottom-up, mirroring highlight.
+    const quadPoints = lines.map((line) => {
+      const lx = line.x / zoom, ly = line.y / zoom, lw = line.width / zoom, lh = line.height / zoom;
+      return { x1: lx, y1: ly + lh, x2: lx + lw, y2: ly + lh, x3: lx + lw, y3: ly, x4: lx, y4: ly };
     });
 
-    // Optimistically show local overlays
+    // Optimistically show local overlays until the edit round-trips.
     const newAnnos = lines.map(line => ({
       id: rid('locdec'),
       type,
@@ -281,12 +302,13 @@ function App() {
       color,
       author: 'Current User',
     } as Annotation));
-    
     setAnnotations(prev => [...prev, ...newAnnos]);
-    applyOps(ops);
+
+    applyOps([{ id: rid('decor'), type, pageIndex, data: { quadPoints, color, author: 'Current User' } }]);
   };
 
   const handlePlaceText = (pageIndex: number, rectPts: Rect, text: string) => {
+    if (!can('canAnnotate')) { denyToast('Adding text'); setActiveTool('select'); return; }
     const pdf = viewportRectToPdf(rectPts, 1, pageHeightPts(pageIndex));
     applyOps([{
       id: rid('txt'), type: 'text_overlay', pageIndex,
@@ -298,6 +320,7 @@ function App() {
   // Rewrite existing page text in place via replace_text, which targets stable
   // page-object indices (no coordinates) and reflows the rest of the line.
   const handleEditText = (pageIndex: number, run: EditableRun, newText: string) => {
+    if (!can('canModify')) { denyToast('Editing text'); setActiveTool('select'); return; }
     applyOps([{
       id: rid('edit'), type: 'replace_text', pageIndex,
       data: {
@@ -312,6 +335,7 @@ function App() {
 
   const handlePlaceStamp = (pageIndex: number, point: { x: number; y: number }) => {
     if (!activeStamp) return;
+    if (!can('canAnnotate')) { denyToast('Stamping'); return; }
     const fontSize = 22;
     const width = Math.max(60, activeStamp.label.length * fontSize * 0.62);
     const height = fontSize * 1.5;
@@ -324,6 +348,7 @@ function App() {
 
   const handlePlaceSignature = (pageIndex: number, point: { x: number; y: number }) => {
     if (!pendingSignature) return;
+    if (!can('canAnnotate')) { denyToast('Signing'); setActiveTool('select'); return; }
     const width = 160;
     const height = width / (pendingSignature.aspect || 3);
     const pdf = viewportRectToPdf({ x: point.x, y: point.y, width, height }, 1, pageHeightPts(pageIndex));
@@ -337,11 +362,13 @@ function App() {
   /* ---------------------------------------------------------- page ops */
   const handleRotate = () => {
     if (!activeDoc) return;
+    if (!can('canAssemble')) { denyToast('Rotating pages'); return; }
     applyOps([{ id: rid('rot'), type: 'page_rotation', pageIndex: currentPage, data: { rotation: 90 } }], 'Page rotated');
   };
 
   const handleDeletePage = (pageIndex: number) => {
     if (!activeDoc) return;
+    if (!can('canAssemble')) { denyToast('Deleting pages'); return; }
     if (activeDoc.totalPages <= 1) { toast('Cannot delete the only page', 'error'); return; }
     setConfirmState({
       title: 'Delete page?',
@@ -356,12 +383,14 @@ function App() {
 
   const handleReorderPage = (from: number, to: number) => {
     if (!activeDoc || to < 0 || to >= activeDoc.totalPages) return;
+    if (!can('canAssemble')) { denyToast('Reordering pages'); return; }
     applyOps([{ id: rid('reorder'), type: 'page_reorder', pageIndex: from, data: { destPageIndex: to } }], 'Page moved');
     setCurrentPage(to);
   };
 
   const handleRedactArea = (pageIndex: number, bounds: Rect) => {
     if (!activeDoc) return;
+    if (!can('canModify')) { denyToast('Redaction'); return; }
     const pdf = viewportRectToPdf(bounds, zoom, pageHeightPts(pageIndex));
     setConfirmState({
       title: 'Redact area?',
@@ -378,16 +407,22 @@ function App() {
   };
 
   /* ----------------------------------------------------------- doc-level */
-  const handleUpload = async (file: File) => {
+  const handleUpload = async (file: File, password = '') => {
     try {
       setIsLoading(true);
-      const newDoc = await gatewayService.uploadDocument(file);
+      const newDoc = await gatewayService.uploadDocument(file, password);
       setDocuments((prev) => [newDoc, ...prev]);
       openDocument(newDoc.id);
       toast(`Opened ${newDoc.filename}`, 'success');
+      setPasswordPrompt(null);
     } catch (e) {
-      console.error('Upload failed', e);
-      toast('Upload failed', 'error');
+      if (e instanceof PasswordError) {
+        // Needs a password (missing or wrong) — prompt and retry.
+        setPasswordPrompt({ file, filename: file.name, error: password ? 'Incorrect password — please try again.' : undefined });
+      } else {
+        console.error('Upload failed', e);
+        toast('Upload failed', 'error');
+      }
     } finally {
       setIsLoading(false);
     }
@@ -395,6 +430,7 @@ function App() {
 
   const handleExport = async () => {
     if (!activeDoc) return;
+    if (!can('canCopy')) { denyToast('Exporting'); return; }
     try {
       await gatewayService.exportDocument(selectedDocId, activeDoc.filename);
       toast('Exported', 'success');
@@ -406,6 +442,7 @@ function App() {
 
   const handlePrint = async () => {
     if (!activeDoc) return;
+    if (!can('canPrint')) { denyToast('Printing'); return; }
     try {
       toast('Preparing print...', 'info');
       const bytes = await gatewayService.fetchDocumentBytes(selectedDocId);
@@ -504,6 +541,9 @@ function App() {
         onRotate={handleRotate}
         onExport={handleExport}
         onPrint={handlePrint}
+        canPrint={can('canPrint')}
+        canExport={can('canCopy')}
+        canAssemble={can('canAssemble')}
         onUpload={handleUpload}
         isInspectorOpen={isInspectorOpen}
         onToggleInspector={toggleInspector}
@@ -516,6 +556,7 @@ function App() {
           hasSignature={!!pendingSignature}
           onOpenSignature={() => setSignatureModalOpen(true)}
           onOpenAbout={() => setAboutModalOpen(true)}
+          disabledTools={disabledTools}
         />
 
         <div className="flex min-w-0 flex-1 flex-col">
@@ -549,7 +590,9 @@ function App() {
                 hasSignature={!!pendingSignature}
                 activeStamp={activeStamp?.label ?? null}
                 annotations={annotations}
+                canCopy={can('canCopy')}
                 onFieldChange={(id, value, i) => {
+                  if (!can('canFillForms')) { denyToast('Filling form fields'); return; }
                   applyOps([{
                     id,
                     type: 'update_field',
@@ -623,6 +666,7 @@ function App() {
             searchCurrentMatch={searchCurrentMatch}
             onSelectSearchMatch={selectSearchMatch}
             metadata={metadata}
+            permissions={permissions ?? undefined}
             fonts={fonts}
           />
         )}
@@ -645,6 +689,12 @@ function App() {
       />
 
       <CustomConfirmationModal state={confirmState} onClose={() => setConfirmState(null)} />
+
+      <PasswordModal
+        state={passwordPrompt}
+        onSubmit={(pw) => { if (passwordPrompt) handleUpload(passwordPrompt.file, pw); }}
+        onClose={() => setPasswordPrompt(null)}
+      />
       <ToastViewport />
     </div>
   );
diff --git a/frontend/src/components/InspectorPanel.tsx b/frontend/src/components/InspectorPanel.tsx
index 4953db5..b824d8f 100644
--- a/frontend/src/components/InspectorPanel.tsx
+++ b/frontend/src/components/InspectorPanel.tsx
@@ -1,6 +1,6 @@
 import { CustomButton } from './custom/CustomButton';
 import React from 'react';
-import type { DocumentInfo, SearchResult, DocumentMetadata, FontInfo, OutlineItem } from '../lib/gatewayService';
+import type { DocumentInfo, SearchResult, DocumentMetadata, FontInfo, OutlineItem, PDFPermissions } from '../lib/gatewayService';
 import type { Annotation } from '../viewer/AnnotationLayer';
 import { Thumbnail } from './Thumbnail';
 import { EmptyState, Popover } from './ui';
@@ -46,6 +46,7 @@ interface InspectorPanelProps {
   onSelectSearchMatch: (i: number) => void;
 
   metadata: DocumentMetadata | null;
+  permissions?: PDFPermissions;
   fonts: FontInfo[];
 }
 
@@ -140,7 +141,7 @@ export const InspectorPanel: React.FC<InspectorPanelProps> = (p) => {
           {p.activeTab === 'pages' && <PagesTab {...p} />}
           {p.activeTab === 'notes' && <NotesTab annotations={p.annotations.filter((a) => a.type !== 'widget')} onNavigate={p.onNavigateAnnotation} onDelete={p.onDeleteAnnotation} onUpdate={p.onUpdateAnnotation} />}
           {p.activeTab === 'search' && <SearchTab {...p} />}
-          {p.activeTab === 'properties' && <PropertiesTab metadata={p.metadata} sizeBytes={p.sizeBytes} totalPages={p.totalPages} filename={selectedDoc?.filename} />}
+          {p.activeTab === 'properties' && <PropertiesTab metadata={p.metadata} permissions={p.permissions} sizeBytes={p.sizeBytes} totalPages={p.totalPages} filename={selectedDoc?.filename} />}
           {p.activeTab === 'fonts' && <FontsTab fonts={p.fonts} />}
           {p.activeTab === 'outline' && <OutlineTab outline={p.outline} onNavigate={p.onNavigateOutline} />}
           {p.activeTab === 'forms' && <FormsTab fields={p.annotations.filter((a) => a.type === 'widget')} onNavigate={p.onNavigateAnnotation} />}
@@ -363,7 +364,16 @@ const SearchTab: React.FC<InspectorPanelProps> = (p) => {
   );
 };
 
-const PropertiesTab: React.FC<{ metadata: DocumentMetadata | null; sizeBytes?: number; totalPages: number; filename?: string }> = ({ metadata, sizeBytes, totalPages, filename }) => {
+const PERM_LABELS: [keyof PDFPermissions, string][] = [
+  ['canPrint', 'Print'],
+  ['canCopy', 'Copy / extract'],
+  ['canModify', 'Modify content'],
+  ['canAnnotate', 'Annotate'],
+  ['canFillForms', 'Fill forms'],
+  ['canAssemble', 'Assemble pages'],
+];
+
+const PropertiesTab: React.FC<{ metadata: DocumentMetadata | null; permissions?: PDFPermissions; sizeBytes?: number; totalPages: number; filename?: string }> = ({ metadata, permissions, sizeBytes, totalPages, filename }) => {
   const rows: [string, string | undefined][] = [
     ['File name', filename],
     ['Title', metadata?.title],
@@ -385,7 +395,36 @@ const PropertiesTab: React.FC<{ metadata: DocumentMetadata | null; sizeBytes?: n
           <span className="break-words text-[12.5px] text-[#18212e]">{v && v.trim() ? v : <span className="text-[#98a1ad]">—</span>}</span>
         </div>
       ))}
-      <p className="pt-2 text-[10.5px] text-[#98a1ad]">Document properties are read-only.</p>
+
+      {/* Security / permissions */}
+      <div className="mt-3 border-t border-[#ebedf0] pt-3">
+        <div className="mb-2 flex items-center gap-1.5">
+          <span className="text-[11px] font-semibold uppercase tracking-wide text-[#98a1ad]">Security</span>
+          {permissions?.isEncrypted
+            ? <span className="rounded bg-[#fdecec] px-1.5 py-0.5 text-[9px] font-bold uppercase text-[#dc2626]">{permissions.encryption}</span>
+            : <span className="rounded bg-[#edeff2] px-1.5 py-0.5 text-[9px] font-bold uppercase text-[#98a1ad]">Unencrypted</span>}
+          {permissions?.ownerUnlocked && <span className="rounded bg-[#eef4ff] px-1.5 py-0.5 text-[9px] font-bold uppercase text-[#2563eb]">Owner</span>}
+        </div>
+        {permissions?.isEncrypted && !permissions.ownerUnlocked ? (
+          <div className="flex flex-col gap-1">
+            {PERM_LABELS.map(([key, label]) => {
+              const allowed = permissions[key] !== false;
+              return (
+                <div key={key} className="flex items-center justify-between text-[12px]">
+                  <span className="text-[#5b6573]">{label}</span>
+                  <span className={allowed ? 'font-semibold text-[#16a34a]' : 'font-semibold text-[#dc2626]'}>
+                    {allowed ? 'Allowed' : 'Restricted'}
+                  </span>
+                </div>
+              );
+            })}
+          </div>
+        ) : (
+          <p className="text-[11px] text-[#98a1ad]">No usage restrictions.</p>
+        )}
+      </div>
+
+      <p className="pt-3 text-[10.5px] text-[#98a1ad]">Document properties are read-only.</p>
     </div>
   );
 };
diff --git a/frontend/src/components/PasswordModal.tsx b/frontend/src/components/PasswordModal.tsx
new file mode 100644
index 0000000..213f761
--- /dev/null
+++ b/frontend/src/components/PasswordModal.tsx
@@ -0,0 +1,96 @@
+import React, { useEffect, useRef, useState } from 'react';
+import { CustomButton } from './custom/CustomButton';
+
+export interface PasswordPromptState {
+  filename: string;
+  error?: string; // shown on a failed attempt ("Incorrect password…")
+}
+
+interface PasswordModalProps {
+  state: PasswordPromptState | null;
+  onSubmit: (password: string) => void;
+  onClose: () => void;
+}
+
+export const PasswordModal: React.FC<PasswordModalProps> = ({ state, onSubmit, onClose }) => {
+  const [value, setValue] = useState('');
+  const inputRef = useRef<HTMLInputElement>(null);
+
+  // Reset the field and focus whenever the prompt (re)opens.
+  useEffect(() => {
+    if (!state) return;
+    setValue('');
+    const t = setTimeout(() => inputRef.current?.focus(), 30);
+    const onKey = (e: KeyboardEvent) => { if (e.key === 'Escape') onClose(); };
+    document.addEventListener('keydown', onKey);
+    return () => { clearTimeout(t); document.removeEventListener('keydown', onKey); };
+  }, [state, onClose]);
+
+  if (!state) return null;
+
+  const submit = () => { if (value) onSubmit(value); };
+
+  return (
+    <div className="fixed inset-0 z-[200] flex items-center justify-center p-4" onMouseDown={onClose}>
+      <div className="absolute inset-0 bg-[#0f172a]/30 backdrop-blur-[2px]" style={{ animation: 'toastIn 0.2s ease-out' }} />
+
+      <div
+        style={{ width: 440, animation: 'slideUp 0.25s cubic-bezier(0.16, 1, 0.3, 1)' }}
+        className="relative flex max-h-[90vh] flex-col overflow-hidden rounded-[16px] bg-[#ffffff] shadow-[0_24px_48px_rgba(16,24,40,0.18)] ring-1 ring-[#ebedf0]"
+        onMouseDown={(e) => e.stopPropagation()}
+      >
+        <div className="flex flex-col gap-2.5 p-7 pb-5">
+          <div className="flex items-center gap-3">
+            <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-[#eef4ff] text-[#2563eb]">
+              <svg width="22" height="22" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                <rect x="5" y="11" width="14" height="10" rx="2" />
+                <path strokeLinecap="round" strokeLinejoin="round" d="M8 11V7a4 4 0 0 1 8 0v4" />
+              </svg>
+            </div>
+            <div className="min-w-0">
+              <h2 className="text-[17.5px] font-bold tracking-tight text-[#18212e]">Password required</h2>
+              <p className="truncate text-[12.5px] text-[#98a1ad]" title={state.filename}>{state.filename}</p>
+            </div>
+          </div>
+          <p className="pl-[52px] text-[13.5px] leading-relaxed text-[#5b6573]">
+            This document is protected. Enter the password to open it.
+          </p>
+
+          <form
+            className="pl-[52px] pt-1"
+            onSubmit={(e) => { e.preventDefault(); submit(); }}
+          >
+            <input
+              ref={inputRef}
+              type="password"
+              value={value}
+              onChange={(e) => setValue(e.target.value)}
+              placeholder="Document password"
+              autoComplete="off"
+              className={`w-full rounded-[8px] border bg-white px-3 py-2 text-[13.5px] outline-none transition-colors focus:ring-2 ${
+                state.error
+                  ? 'border-[#dc2626] focus:border-[#dc2626] focus:ring-[#fdecec]'
+                  : 'border-[#d6dae0] focus:border-[#2563eb] focus:ring-[#eef4ff]'
+              }`}
+            />
+            {state.error && <p className="mt-1.5 text-[12px] font-medium text-[#dc2626]">{state.error}</p>}
+          </form>
+        </div>
+
+        <div className="flex items-center justify-end gap-3 border-t border-[#ebedf0] bg-[#f6f7f9] px-7 py-5">
+          <CustomButton variant="ghost" onClick={onClose} className="rounded-[8px] px-4 font-semibold text-[#5b6573]">
+            Cancel
+          </CustomButton>
+          <CustomButton
+            variant="primary"
+            onClick={submit}
+            disabled={!value}
+            className="rounded-[8px] bg-[#2563eb] px-5 font-semibold text-white shadow-sm transition-colors hover:bg-[#1d4ed8] disabled:opacity-50"
+          >
+            Open
+          </CustomButton>
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/components/ToolRail.tsx b/frontend/src/components/ToolRail.tsx
index 75504a8..085011f 100644
--- a/frontend/src/components/ToolRail.tsx
+++ b/frontend/src/components/ToolRail.tsx
@@ -1,6 +1,7 @@
 import { CustomButton } from './custom/CustomButton';
 import React from 'react';
 import type { ToolId } from '../lib/tools';
+import { toast } from '../lib/toast';
 import { Popover } from './ui';
 import {
   SelectIcon, PanIcon, HighlightIcon, DrawIcon, CommentIcon, TextBoxIcon,
@@ -44,28 +45,36 @@ interface ToolRailProps {
   hasSignature: boolean;
   onOpenSignature: () => void;
   onOpenAbout: () => void;
+  disabledTools?: Set<ToolId>;
 }
 
-const RailButton: React.FC<{ t: ToolDef; active: boolean; onClick: () => void }> = ({ t, active, onClick }) => (
+const RailButton: React.FC<{ t: ToolDef; active: boolean; disabled?: boolean; onClick: () => void }> = ({ t, active, disabled, onClick }) => (
   <CustomButton variant="unstyled"
-    title={`${t.label}  ·  ${t.shortcut}`}
+    title={disabled ? `${t.label} — not permitted by this document` : `${t.label}  ·  ${t.shortcut}`}
     aria-label={t.label}
     aria-pressed={active}
+    aria-disabled={disabled}
     onClick={onClick}
     className={`relative flex h-11 w-11 items-center justify-center rounded-[10px] transition-colors ${
-      active
+      disabled
+        ? 'cursor-not-allowed text-[#c5cad1]'
+        : active
         ? t.danger ? 'bg-[#fdecec] text-[#dc2626]' : 'bg-[#eef4ff] text-[#2563eb]'
         : t.danger ? 'text-[#5b6573] hover:bg-[#fdecec] hover:text-[#dc2626]'
                    : 'text-[#5b6573] hover:bg-[#edeff2] hover:text-[#18212e]'
     }`}
   >
-    {active && <span className="absolute left-[-10px] h-5 w-[3px] rounded-full" style={{ background: t.danger ? '#dc2626' : '#2563eb' }} />}
+    {active && !disabled && <span className="absolute left-[-10px] h-5 w-[3px] rounded-full" style={{ background: t.danger ? '#dc2626' : '#2563eb' }} />}
     {React.isValidElement(t.icon) ? React.cloneElement(t.icon as React.ReactElement<{ size?: number }>, { size: 22 }) : t.icon}
   </CustomButton>
 );
 
-export const ToolRail: React.FC<ToolRailProps> = ({ activeTool, onToolChange, hasSignature, onOpenSignature, onOpenAbout }) => {
+export const ToolRail: React.FC<ToolRailProps> = ({ activeTool, onToolChange, hasSignature, onOpenSignature, onOpenAbout, disabledTools }) => {
   const pickTool = (id: ToolId) => {
+    if (disabledTools?.has(id)) {
+      toast("This tool is not permitted by this document's restrictions", 'error');
+      return;
+    }
     onToolChange(id);
     if (id === 'signature' && !hasSignature) onOpenSignature();
   };
@@ -75,7 +84,7 @@ export const ToolRail: React.FC<ToolRailProps> = ({ activeTool, onToolChange, ha
       {TOOLS.map((t, i) =>
         t === 'divider'
           ? <div key={`d${i}`} className="my-0.5 h-px w-6 bg-[#ebedf0]" />
-          : <RailButton key={t.id} t={t} active={activeTool === t.id} onClick={() => pickTool(t.id)} />,
+          : <RailButton key={t.id} t={t} active={activeTool === t.id} disabled={disabledTools?.has(t.id)} onClick={() => pickTool(t.id)} />,
       )}
 
       <div className="flex-1" />
diff --git a/frontend/src/components/TopBar.tsx b/frontend/src/components/TopBar.tsx
index 58b444f..83511d1 100644
--- a/frontend/src/components/TopBar.tsx
+++ b/frontend/src/components/TopBar.tsx
@@ -28,6 +28,9 @@ interface TopBarProps {
   onUpload: (file: File) => void;
   isInspectorOpen: boolean;
   onToggleInspector: () => void;
+  canPrint?: boolean;
+  canExport?: boolean;
+  canAssemble?: boolean;
 }
 
 const ZOOM_PRESETS = [0.5, 0.75, 1, 1.25, 1.5, 2, 3];
@@ -37,6 +40,7 @@ export const TopBar: React.FC<TopBarProps> = ({
   currentPage, totalPages, onGoToPage, canUndo, canRedo, onUndo, onRedo,
   isSaving, isDirtySaved, onRotate, onExport, onPrint, onUpload,
   isInspectorOpen, onToggleInspector,
+  canPrint = true, canExport = true, canAssemble = true,
 }) => {
   const fileRef = useRef<HTMLInputElement>(null);
   const handleFile = (e: React.ChangeEvent<HTMLInputElement>) => {
@@ -72,8 +76,8 @@ export const TopBar: React.FC<TopBarProps> = ({
         >
           <div className="flex flex-col text-[13px]">
             <MenuItem icon={<UploadIcon size={16} />} onClick={() => fileRef.current?.click()}>Open PDF…</MenuItem>
-            <MenuItem icon={<DownloadIcon size={16} />} onClick={onExport} disabled={!documentName}>Export / Download</MenuItem>
-            <MenuItem icon={<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth={2} strokeLinecap="round" strokeLinejoin="round"><polyline points="6 9 6 2 18 2 18 9"></polyline><path d="M6 18H4a2 2 0 0 1-2-2v-5a2 2 0 0 1 2-2h16a2 2 0 0 1 2 2v5a2 2 0 0 1-2 2h-2"></path><rect x="6" y="14" width="12" height="8"></rect></svg>} onClick={onPrint} disabled={!documentName}>Print</MenuItem>
+            <MenuItem icon={<DownloadIcon size={16} />} onClick={onExport} disabled={!documentName || !canExport}>Export / Download</MenuItem>
+            <MenuItem icon={<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth={2} strokeLinecap="round" strokeLinejoin="round"><polyline points="6 9 6 2 18 2 18 9"></polyline><path d="M6 18H4a2 2 0 0 1-2-2v-5a2 2 0 0 1 2-2h16a2 2 0 0 1 2 2v5a2 2 0 0 1-2 2h-2"></path><rect x="6" y="14" width="12" height="8"></rect></svg>} onClick={onPrint} disabled={!documentName || !canPrint}>Print</MenuItem>
           </div>
         </Popover>
 
@@ -119,7 +123,7 @@ export const TopBar: React.FC<TopBarProps> = ({
           <CustomButton variant="icon" label="Zoom in" size={30} onClick={() => onZoomChange(Math.min(5, zoom + 0.1))}><ZoomInIcon size={17} /></CustomButton>
         </div>
 
-        <CustomButton variant="icon" label="Rotate page 90°" size={34} onClick={onRotate} disabled={!documentName}><RotateIcon size={18} /></CustomButton>
+        <CustomButton variant="icon" label="Rotate page 90°" size={34} onClick={onRotate} disabled={!documentName || !canAssemble}><RotateIcon size={18} /></CustomButton>
 
         {documentName && (
           <div className="flex items-center gap-1 text-[12px] font-semibold text-[#5b6573]">
@@ -143,7 +147,7 @@ export const TopBar: React.FC<TopBarProps> = ({
       <div className="flex shrink-0 items-center gap-2">
         <SaveState isSaving={isSaving} saved={isDirtySaved} />
         <HealthChip healthy={backendHealthy} engineReady={!!engineReady} />
-        <CustomButton variant="primary" size="sm" onClick={onExport} disabled={!documentName}><DownloadIcon size={15} /> Export</CustomButton>
+        <CustomButton variant="primary" size="sm" onClick={onExport} disabled={!documentName || !canExport}><DownloadIcon size={15} /> Export</CustomButton>
         <CustomButton variant="icon"
           label={isInspectorOpen ? "Hide panel" : "Show panel"}
           size={34}
diff --git a/frontend/src/lib/gatewayService.ts b/frontend/src/lib/gatewayService.ts
index a899be8..f0bcf77 100644
--- a/frontend/src/lib/gatewayService.ts
+++ b/frontend/src/lib/gatewayService.ts
@@ -4,6 +4,31 @@ export interface PageInfo {
   height: number;
 }
 
+// Thrown by uploadDocument when the PDF needs a password (missing or wrong).
+export class PasswordError extends Error {
+  detail: string;
+  constructor(detail: string) {
+    super(detail);
+    this.name = 'PasswordError';
+    this.detail = detail;
+  }
+}
+
+export interface PDFPermissions {
+  isEncrypted: boolean;
+  encryption: string; // "None" | "RC4-40" | "RC4-128" | "AES-128" | "AES-256"
+  securityRevision: number;
+  ownerUnlocked: boolean;
+  canPrint: boolean;
+  canPrintHighRes: boolean;
+  canModify: boolean;
+  canCopy: boolean;
+  canAnnotate: boolean;
+  canFillForms: boolean;
+  canExtractForAccessibility: boolean;
+  canAssemble: boolean;
+}
+
 export interface DocumentInfo {
   id: string;
   filename: string;
@@ -14,6 +39,7 @@ export interface DocumentInfo {
   uploadedAt: string;
   status: 'processing' | 'ready' | 'error';
   pages?: PageInfo[];
+  permissions?: PDFPermissions;
 }
 
 export interface RenderParams {
@@ -194,8 +220,20 @@ export type EditOperationDataMap = {
   delete_annotation: DeleteAnnotationData;
   update_annotation: UpdateAnnotationData;
   replace_text: ReplaceTextData;
+  underline: DecorationData;
+  strikeout: DecorationData;
+  squiggly: DecorationData;
 };
 
+// Text decoration (underline / strikeout / squiggly) as a markup annotation,
+// positioned by quadpoints over the text lines (mirrors HighlightData).
+export interface DecorationData {
+  quadPoints: HighlightQuadPoint[];
+  color: string;
+  author?: string;
+  content?: string;
+}
+
 // In-place rewrite of existing page text. Targets stable page-object indices
 // (from getPageModel's run.object_indices) — no coordinates, so no Y-flip and no
 // bbox ambiguity. The engine reflows subsequent same-line text by the width delta.
@@ -273,15 +311,25 @@ class GatewayService {
     }
   }
 
-  async uploadDocument(file: File): Promise<DocumentInfo> {
+  async uploadDocument(file: File, password = ''): Promise<DocumentInfo> {
     const formData = new FormData();
     formData.append('file', file);
 
-    const response = await fetch(`${this.baseUrl}/documents`, {
+    const url = password
+      ? `${this.baseUrl}/documents?password=${encodeURIComponent(password)}`
+      : `${this.baseUrl}/documents`;
+    const response = await fetch(url, {
       method: 'POST',
       body: formData,
     });
 
+    // 401 = the PDF needs a password (missing or wrong) — surface a typed error
+    // so the UI can prompt and retry.
+    if (response.status === 401) {
+      const body = await response.json().catch(() => ({ detail: 'Password required' }));
+      throw new PasswordError(body.detail || 'Password required');
+    }
+
     if (response.status === 501) {
       // Simulate upload for Phase 0 scaffolding
       return new Promise((resolve) => {
diff --git a/frontend/src/viewer/PDFViewer.tsx b/frontend/src/viewer/PDFViewer.tsx
index 20bed4e..a9e8791 100644
--- a/frontend/src/viewer/PDFViewer.tsx
+++ b/frontend/src/viewer/PDFViewer.tsx
@@ -40,6 +40,7 @@ interface PDFViewerProps {
   onPlaceSignature?: (pageIndex: number, pointPts: { x: number; y: number }) => void;
   onDecorateText?: (pageIndex: number, lines: Rect[], type: 'underline' | 'strikeout' | 'squiggly', color: string) => void;
   onFieldChange?: (id: string, value: string | boolean, pageIndex: number) => void;
+  canCopy?: boolean;
 }
 
 interface PageLayout {
@@ -81,6 +82,7 @@ export const PDFViewer = React.forwardRef<PDFViewerRef, PDFViewerProps>(({
   onPlaceSignature,
   onDecorateText,
   onFieldChange,
+  canCopy = true,
 }, ref) => {
   const containerRef = useRef<HTMLDivElement | null>(null);
   const [scrollPosition, setScrollPosition] = useState({ scrollLeft: 0, scrollTop: 0 });
@@ -293,6 +295,10 @@ export const PDFViewer = React.forwardRef<PDFViewerRef, PDFViewerProps>(({
 
   const handleTextSelection = (text: string, bbox: Rect, lines: Rect[], pageIndex: number) => {
     if (activeTool === 'select') {
+      if (!canCopy) {
+        toast("Copying is not permitted by this document's restrictions", 'error');
+        return;
+      }
       if (text.trim()) {
         navigator.clipboard?.writeText(text).then(
           () => toast(`Copied ${text.length} character${text.length > 1 ? 's' : ''}`, 'success'),
diff --git a/gateway/app/routers/documents.py b/gateway/app/routers/documents.py
index 657ca24..7be2655 100644
--- a/gateway/app/routers/documents.py
+++ b/gateway/app/routers/documents.py
@@ -13,6 +13,21 @@ class PageInfoResponse(BaseModel):
     height: float
 
 
+class PermissionsResponse(BaseModel):
+    isEncrypted: bool = False
+    encryption: str = "None"
+    securityRevision: int = -1
+    ownerUnlocked: bool = False
+    canPrint: bool = True
+    canPrintHighRes: bool = True
+    canModify: bool = True
+    canCopy: bool = True
+    canAnnotate: bool = True
+    canFillForms: bool = True
+    canExtractForAccessibility: bool = True
+    canAssemble: bool = True
+
+
 class DocumentInfoResponse(BaseModel):
     id: str
     filename: str
@@ -23,6 +38,7 @@ class DocumentInfoResponse(BaseModel):
     uploadedAt: str
     status: str
     pages: list[PageInfoResponse] = []
+    permissions: PermissionsResponse = PermissionsResponse()
 
 
 def make_document_response(d: dict) -> DocumentInfoResponse:
@@ -35,6 +51,7 @@ def make_document_response(d: dict) -> DocumentInfoResponse:
                 pages_list.append(PageInfoResponse(index=i, width=page.width, height=page.height))
             except Exception:
                 pass
+    perms = d.get("permissions")
     return DocumentInfoResponse(
         id=d["id"],
         filename=d["filename"],
@@ -45,6 +62,7 @@ def make_document_response(d: dict) -> DocumentInfoResponse:
         uploadedAt=d["uploadedAt"],
         status=d["status"],
         pages=pages_list,
+        permissions=PermissionsResponse(**perms) if perms else PermissionsResponse(),
     )
 
 
@@ -598,6 +616,14 @@ def export_document(document_id: str):
     if not d:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Document not found")
 
+    # Exporting a decrypted copy is a form of content extraction — gate on copy permission.
+    perms = d.get("permissions") or {}
+    if perms.get("canCopy", True) is False:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Exporting is not permitted by this document's restrictions (canCopy).",
+        )
+
     try:
         doc = d["doc_instance"]
         bytes_data = doc.save_full()
diff --git a/gateway/app/routers/edits.py b/gateway/app/routers/edits.py
index fb2ee79..b7552ac 100644
--- a/gateway/app/routers/edits.py
+++ b/gateway/app/routers/edits.py
@@ -224,11 +224,12 @@ class ReplaceTextOperation(BaseModel):
 
 
 class DecorationData(BaseModel):
-    x: float
-    y: float
-    width: float
-    thickness: float | None = None
-    color: str | None = None
+    # Text-markup annotation (underline/strikeout/squiggly) over one or more text
+    # lines — quadpoints in PDF top-down space, mirroring HighlightData.
+    quadPoints: list[HighlightQuadPoint]
+    color: str = "#000000"
+    author: str = "User"
+    content: str | None = None
 
 class UnderlineOperation(BaseModel):
     id: str
@@ -275,6 +276,19 @@ class EditsRequest(BaseModel):
     operations: list[EditOperation]
 
 
+# Which PDF permission each edit operation requires. Unencrypted / owner-unlocked
+# docs report every flag True (in the engine), so this never blocks them.
+_OP_PERMISSION = {
+    "highlight": "canAnnotate", "underline": "canAnnotate", "strikeout": "canAnnotate",
+    "squiggly": "canAnnotate", "comment": "canAnnotate", "freehand": "canAnnotate",
+    "free_text": "canAnnotate", "text_overlay": "canAnnotate", "image_overlay": "canAnnotate",
+    "delete_annotation": "canAnnotate", "update_annotation": "canAnnotate",
+    "replace_text": "canModify", "redaction": "canModify",
+    "update_field": "canFillForms",
+    "page_rotation": "canAssemble", "page_deletion": "canAssemble", "page_reorder": "canAssemble",
+}
+
+
 def apply_edits_impl(document_id: str, request: EditsRequest):
     if not engine.is_available():
         raise HTTPException(
@@ -286,6 +300,17 @@ def apply_edits_impl(document_id: str, request: EditsRequest):
     if not doc_info:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Document not found")
 
+    # Enforce document permissions (defense-in-depth; the UI also gates these).
+    # Done before the try so the 403 isn't rewritten to 400 by the broad handler.
+    perms = doc_info.get("permissions") or {}
+    for op in request.operations:
+        required = _OP_PERMISSION.get(op.type)
+        if required and perms.get(required, True) is False:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=f"Operation '{op.type}' is not permitted by this document's restrictions ({required}).",
+            )
+
     created_temp_files = []
     try:
         pdfengine = engine.require()
@@ -347,8 +372,11 @@ def apply_edits_impl(document_id: str, request: EditsRequest):
 
         new_doc = pdfengine.PdfDocument.load_from_memory(new_bytes)
 
+        # Carry the original permissions forward — the saved bytes are decrypted, so
+        # a fresh load would report full access and defeat enforcement.
         new_info = document_store.add_document(
-            filename=doc_info["filename"], bytes_data=new_bytes, doc_instance=new_doc
+            filename=doc_info["filename"], bytes_data=new_bytes, doc_instance=new_doc,
+            permissions=doc_info.get("permissions"),
         )
 
         return {"success": True, "newDocumentId": new_info["id"]}
diff --git a/gateway/app/services/store.py b/gateway/app/services/store.py
index cb299b4..70b6ffa 100644
--- a/gateway/app/services/store.py
+++ b/gateway/app/services/store.py
@@ -4,12 +4,41 @@ from datetime import UTC, datetime
 from typing import Any
 
 
+def extract_permissions(doc_instance: Any) -> dict[str, Any] | None:
+    """Read the engine's DocumentPermissions off a doc into a plain dict, or None
+    if unavailable (treated downstream as unrestricted)."""
+    try:
+        p = doc_instance.permissions
+        return {
+            "isEncrypted": p.is_encrypted,
+            "encryption": p.encryption,
+            "securityRevision": p.security_revision,
+            "ownerUnlocked": p.owner_unlocked,
+            "canPrint": p.can_print,
+            "canPrintHighRes": p.can_print_high_res,
+            "canModify": p.can_modify,
+            "canCopy": p.can_copy,
+            "canAnnotate": p.can_annotate,
+            "canFillForms": p.can_fill_forms,
+            "canExtractForAccessibility": p.can_extract_for_accessibility,
+            "canAssemble": p.can_assemble,
+        }
+    except Exception:
+        return None
+
+
 class DocumentStore:
     def __init__(self):
         self._lock = threading.Lock()
         self._documents: dict[str, dict[str, Any]] = {}
 
-    def add_document(self, filename: str, bytes_data: bytes, doc_instance: Any) -> dict[str, Any]:
+    def add_document(
+        self,
+        filename: str,
+        bytes_data: bytes,
+        doc_instance: Any,
+        permissions: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
         doc_id = str(uuid.uuid4())
         uploaded_at = datetime.now(UTC).isoformat().replace("+00:00", "Z")
         page_width = 612.0
@@ -22,6 +51,12 @@ class DocumentStore:
             except Exception:
                 pass
 
+        # Permissions are computed from the freshly-loaded doc at upload; on derived
+        # docs (post-edit, which are saved decrypted) the caller passes the original's
+        # permissions forward so enforcement stays consistent.
+        if permissions is None:
+            permissions = extract_permissions(doc_instance)
+
         info = {
             "id": doc_id,
             "filename": filename,
@@ -33,6 +68,7 @@ class DocumentStore:
             "status": "ready",
             "doc_instance": doc_instance,
             "bytes_data": bytes_data,
+            "permissions": permissions,
         }
 
         with self._lock:
diff --git a/tests/edits/test_decorations.py b/tests/edits/test_decorations.py
new file mode 100644
index 0000000..9bff314
--- /dev/null
+++ b/tests/edits/test_decorations.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+"""Text-markup decoration tests (underline / strikeout / squiggly).
+
+Decorations are real PDF text-markup annotations (not baked paths): they round-trip,
+are extractable with the correct subtype + geometry, and are deletable like any
+annotation. PDFium positions them within the text quad.
+
+Run: gateway/.venv/Scripts/python.exe tests/edits/test_decorations.py
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "gateway"))
+import pdfengine  # noqa: E402
+
+CORPUS = ROOT / "corpus" / "fonts" / "utf-8.pdf"
+
+
+def _load():
+    return pdfengine.PdfDocument.load_from_memory(CORPUS.read_bytes(), "")
+
+
+def _quad(run, page_height):
+    top, bot = page_height - (run.y + run.h), page_height - run.y
+    return {"x1": run.x, "y1": top, "x2": run.x + run.w, "y2": top,
+            "x3": run.x + run.w, "y3": bot, "x4": run.x, "y4": bot}
+
+
+def _op(deco, run, page_height):
+    return {"version": "1.0", "operations": [{
+        "id": deco, "type": deco, "pageIndex": 0,
+        "data": {"quadPoints": [_quad(run, page_height)], "color": "#ff0000", "author": "Me"}}]}
+
+
+def test_decorations_are_annotations_and_deletable():
+    for deco in ("underline", "strikeout", "squiggly"):
+        d = _load()
+        m = d.get_page(0).extract_document_model()
+        run = m.paragraphs[0].lines[0].runs[0]
+        d.apply_edits(json.dumps(_op(deco, run, m.height)))
+        doc2 = pdfengine.PdfDocument.load_from_memory(d.save_full(), "")
+        annots = doc2.get_page(0).extract_annotations()
+        match = [a for a in annots if a.type == deco]
+        assert match, f"{deco}: expected a '{deco}' annotation, got {[a.type for a in annots]}"
+        a = match[0]
+        # geometry roughly covers the run (top-left frame)
+        assert abs(a.x - run.x) < 3 and a.width > 10, f"{deco}: bbox off ({a.x},{a.width})"
+
+        # deletable like any annotation
+        doc2.apply_edits(json.dumps({"version": "1.0", "operations": [
+            {"id": "del", "type": "delete_annotation", "pageIndex": 0, "data": {"annotationId": a.id}}]}))
+        after = [x.type for x in pdfengine.PdfDocument.load_from_memory(doc2.save_full(), "").get_page(0).extract_annotations()]
+        assert deco not in after, f"{deco}: still present after delete ({after})"
+        print(f"  ok  {deco}: round-trips as annotation (bbox x={a.x:.0f} w={a.width:.0f}) and deletes cleanly")
+
+
+def main() -> int:
+    try:
+        test_decorations_are_annotations_and_deletable()
+    except AssertionError as exc:
+        print(f"  FAIL: {exc}")
+        return 1
+    print("\n1/1 passed.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/regression/baseline/edge-cases__restricted.pdf__p0.png b/tests/regression/baseline/edge-cases__restricted.pdf__p0.png
new file mode 100644
index 0000000000000000000000000000000000000000..a254a3ba18fff6027dbfbf5e757d919baa8ae1a0
GIT binary patch
literal 15378
zcmeIZXH-+&_wTy{0xAM33Mx%RMY@Xgst71mYUrRy@4bW&6gy3&DqRS@NrwOdsnUX!
z0HK2rAcPh|OFKNz|BO4vx%YqWxcB9~<M(o9kF2%Vnsd!H_xyg=$7gz)EN8Es1pt8M
z>66EX06_N=0O+rrKKTJq#pikgfWqX{#}AEz)9^DvswPBQ_YP-rpT>pH{F^ZacU~{v
z{_~)w|C^*=uACt*)jY|<)!fzGv3+uAc)0gVaasd-VV2&T?nW=~!7OSk&QILxe9=}N
zi8>jqMEwZaY{2@7D@QVi4Pxc*od11aag{v_rmUf{c;)Ix`<FLkzkHGX|7;_AUw&vn
zE~khNH`r9*0148|OskOyHQQ?5`(6KOq9XK>nERYU!~8>S#be;Z(eoxqTkU}6ZCL>)
zN9MkKAR-)&rB~f511hkV-O4eb6ek`g00l0>Wc)e;Bml1Dw)x2)`3h8KjKI?mGc8|d
zraqsWAJv1;^dH~b!PHKZAu~Z;txaJAdUhs11|nHc{yoL>il88>I=dgWoRh=urJ)IK
z*mLV!U0p2#D(sy@GC@p$?1Sjo=`FsQ#%laktIZ&GU@#;4Q_<dF)*fwfnyC5pJOX-4
z#9R6Hondp@;pomM-89gt(c_xF7@YoQuspHf`R@kuvMCoN?IIa?x#8U_w11bM|HE${
zM(%wsGp)I5g+=wgFHl{On&wT>m~cf{#UT`)3fX*Og~c&l_pV?L^|zeU<Wmen#oVr0
zd?DZ1!GjN;kW{LzIgqyJ3d-I1S-tyvc6i(0vzV;;^&Ck(Z}@A3`+PiGYI^Yl+bL-`
zgJSkEjs(!TQklOQzBu_EM=g!WgjaQuf-ziGFYI$xR3F(c2TdQau^PaLsJy;*_d4gu
zbZ*Rpkl|j)%BA=Ki1*)GWz2k1{?~QA^pzveguWd)0}+^bT;UiQ<{?L$_$<siqAYfh
zq&C*KRaODLIhjehffyeE{#LhCzce6Jm!(?LwKkM1dwm&oz#9SApcxhU&!Nfe2V@a3
z?Wv6#sFmh}!>+?~E$wU>Bhu8BS8=00suTAm05M@=#bcSO25mmk!eNMbakO=kl8HDi
z!#5x09H}rp`?q<=Jpi|262uqozSng%@0+#Y(tuo5)q6z<ob>il+)YH4?Mnx=I^c!>
zgczNPfRtL&sWv(39=^>0BGxy%VLW&v!P`Q^#K$R|kE|A-wV$33hU!1wJQX33`HhlC
ze^;0}OO!#-lqMNepLD!;{swEX%{{jC<M6hWV>|t_g6R^kXHEFY+@ns{NG`ReKZPS~
z$1CR#&TR>M*G(g~mjrvt=*KbJ+w<Ui&jVq)D~3dp@ZGCkbP<*rXPyukfVpdyBkK#<
zmm5&+0%v-DOa8hFC>ljrRpCKRl77=)5>2+h&%!II-$hB&Rq!GF2#Kk^R+7sW1?^dh
zg>;9mMJ9iuUyS{h_$c<O_bF~};L42326I)r2a~4iB*{oseS&iEvduGdnU|Tw3Owtp
zn64%~aRXFwW6QlcZHc+(ALD17ELN;Er<!M4)Li;}f$NJoM<bvt&)&EScdc^p-+Hwb
z6rXtrL~nD`^?*&f*{jA0cay9CDjF}7mm5@?!!k=gq^1S69B9i2IW-J`Max&BJg2$t
zS|J?>PcGUW^n|HQ*w#RhnjnC><xwE};#WHm@vcEEx?lq=1>n0_#E=wwn8!h&Kt@3(
z-VqWJ%H9PoB_F#5Y^qc*<w~;r64z;hRb+R~zoSNyBd74EB0PBYvcbuwXNMTQj;24m
zj_0fItzWocM`DiS#K{yF+l+Xb@jboIO?^El>MPDwRDTH)cWXBL22Eq9jsT91ranIm
zc-3+5{>AQ|C)@%8KGD(tYh%)jqigwqRY5)G%$>j%^4H<!vtC1aMB6kK<qA8?7pBW_
zR{fQ^=^v;aSpUAyNApC`d=!J&TrFj;U6FJJ@W)&KY7i5m^e8CdI46Tc{}2)ZLfUt0
zf(*QQq>9SP{5@gQ#CdL-z%Pj8vOT+}QaJ^#RM2;5IT~KbUh5o8R`LJQ!{}iF8)i)X
zc9?WQ<<}HqzBV8hiEkGb2tO5(>IY#F^Iu#^7nYZoZ<N>aUVXzqRJy8xR8pa<KZFl-
zxT$4L4Ky@o2!n&?%56={UXj1jkX0vxhy>jp)gb<s2^1_N5S4s-;W4PO_y9Hrb@?0N
zFb@VZy)<8!C3e^_E>Pi8IvPgtwpf}^>4OMBxvR|&9G>0nwoQ$Jh1fc65s*p9CYegm
zeb|$yKBJD?-I;rhGlTT1InMz*sQ+dLm#*vD_(kU>1;)m|nW&bc!Ea&!auCPZXa})V
z^LW!=nuwA<S55x>b&-4Z2Os~^GpjL<pnYo!zv9q^r-&Fa=-I(I>Rp7o>2JS{Ea`xj
z0c$V4-)Sv~$&cnZy}06M4y0C>sf>?Ll$9O?kvAO$9ZMDDsy)-!?W1&XwuBdb(I2&^
zeGMf|<<Y@?+3U+e$f^d*)EL|6JDv9gc+d7f9RQ5AX7TPGjI`g`0k{VP$Zgg_Ob$<m
zR*^ygMgUWD3UgRkm2Xi^m{e9&l%sy(0C-88?vecgGfLGL=<=7PyuVR=PkNZD$`4gc
zG!9y?=4giY>f@Bf#RQl4Hj*@%-lhmbO?O%dIdl0N%ew`=db;QWW){?R_)*CxmZ_Qs
zj89EdXX&7%u~y&j<64$6R8brzx3KVwkX9kIjWfZ}bynD6Q)ZI9N+-2{^rj+Y-M2ln
zMlF`R$k=AiMXUMVGyK`L{Z(s14s(K`usC^pZAeM@=Ngu)DAPo%Fpbqg*tp;sB#yc&
z@qN~SYc`!P0PIm5WXPqGJ*kg5n%+<}g4b~6Bp6OwI~LPlNZz~P`BvQY%s}`jW|g#|
z4MF^ANdC*ha?4!NwU?Ob4U6%@Ua}$T5mplxO|dxyQ=DffQJSP9`W94)Vu<`~bcE`m
z>`lRU**ZC752}Ml9udb_dNn}Y@lANnY6%4APByjX@Z7Ha>xFjO)+8m5dB$Bkdxg%Z
zMl+LjM<ZX)zP;)EqOTSgUj#Ai#{AW9X8~~~<dvU44H7RwPu2A@<hW{9q~v8NSeT}s
z3y|Tz_>Kb+Y|=_=^(=SdtkIQu(`2zj7a=mU2<b1Ula;5tEAI%JJerDT49?@sKxZoK
z6Y{o#e$EQZ<7QW>3o%?z5k7v&2X)eH!;aeu?FA~Ja@VmU6Q40YeBzmoQa@dK-(9Qf
z9S|ifEv*WG))LjOs%))0RK(g<9P#NX{Mvo)(A~U{>*3?u&v<`JMdcV87$th&b7fg!
zZnn_ru2aWK^k&#i8(NW(^lnswz2)<&QacOeZHms;s|Jz|<5KftY%!`!rrCNSl~0Ca
z!>D^@_Z7*Ra9rbd=DW)hmhjOmbSpQU#ip|-E}e_>+m;vP%@V);qj4t@dsFH8vEZkM
zzrOa+sO)O{QKJ68sT!9#TDUg(ro}~y)K<TIM~jT!PAVf9hdjRIUiA$P6Pa-KpCj~_
zSg>2#K18gsM=4ZDbJ5<H#<ypFyOxR6j~G~{2k!oHesGO%-0S2m6rBIrxSWa$9|r?6
zSx3vgw_3_0!C#K3wVGFg5rGKbb-hTO2hiTPeC_Rc+Mb|_HcgM#xHg`|=LW7i=PbMM
zFtZ!^vDM-V%;VjRq=wap5bDFsE@UrqQ{?J>Q|`UZx%r2gohNOH`^T_umEZquB3m`(
zMfTEdX3pC0c;u$MoWXVv=rL=O7JF&@5<?+uEY0fpc^ArMeI?c^zvq*#^T1Lp&C3Pv
z%+AO`AD#6W>PC8Xr_@M<<Nq+#A8QB$Z**##jZ}iJ?~`aiGP3^apE-Gj%2o4WuYZE#
zo|x2+oSb$ZW)JeQ0|OwL6c^f!gz4NPY#7zPt9A)qU06ESg|fn0eh{buXxtes*~Ah)
zc4n`CM{%3-W#eI*pA>GKZt40H^GPAd3c6xB?|Xm{L-NL3lFf&=D(2?I)8(b;v-C^G
zS4IT45XWlZ>wdHmr3)cjFVa<$q20i!n}d9?REadu3U`A>2d}52xQ+JBERH&?X1OM>
zJH){g*}R4G3<>th2O7t+t6ofY={cD&rH4P9y0Ytw#G)YtFm?`?!8Ij(8mPWtSoZFh
zBUvo_UaSZE!Puvva@mTE#sk28Vpi}8%($zOk>3SZ?1qhPZts($XX-=wmnto;NF7X1
zm_EFBGQjSZA&mh-du3&tYnwVp)3MMy3mklyEaZ8_al>bSv_zZrpaoL8@S%R*#a_dL
zZ)w=g^~K`9>EA%l(}5w!>G90wJL|z_<!PhQiLnDUN91EE`W|Eku=8Ibve+(wnrP{o
zl(Fj~bzPV1`POKA?GozQnBJi8LFV1^s=&^Nf8xh^iT#sr=LV+;ErFYNC=O(+EHB&Z
zgOk<@Epmd1Zv9m7hEyEs(NV<N%dgo)qZ^BB#}HWq`TFL=zjG4|*S0ie!Qa0pokTMD
zFiAPRc_Z66;Q9?4q08)HRzfv7XmgK@=A%Ch$I&EaVo<@v$8kREtS;qp6m~qW(3na*
zMXHfIwCDR>&%2wA8G00hPsz5yLvwz|zP{kz&6Zk>HkK>XKxWzcRFo~JFR<5Gqh;#L
z5~u}#S9yu7LX_!5ixCYW_~`Fr!rl@Nd~Jx&0a^Z%S5ocyorA=dCot9PVcaD~yGmU#
z+EyxRF{kXlCn=(qJF+nqDP^YB$`ATxa#2;N%n{fa{I)P^h&2m^WfPUn3s-tLV&%cw
z5)crcRj6<cf9hHADcoTh|MuxUwKWJ@g!R)9-xzspQ$kuibgpGVKl+ZWGDT+NK;)d7
zYK^OjmEv%<`Z143IGyas>Ur{eXNe}P*EcM4ow$tW^b_X{WP4j{<*_1(EJxuLX8Ts`
z1-g@h%7p3Qh^It|a);=#qgU?N+ppeHd_+BDWrS+tE;FgG#@+Y2gD70R+>2w34IeY}
z4m<XmARWAX%dz(Uo(PvJ{8KsKlPP53t%w@F7F*^I#|}{r1|25Q{AjrLdj@C121^&@
z#0b|mi*-`x`lV*o?h%ek$Jx2ZR_3S9A@{9*ae91Kc@!#oHm+R6|MKgB-)?c3`T&!L
zx&cfBF1GmrG&hHMc*`nA_14dze+Je3Co~0z8UECq47b(*P5ODU-r*aS^j#!e=0Fvl
z2I|_QU-30fj>)51X7)Z}G?lkJi^yGj!uUM>CYUnp#Pamja);9G$#^bPoH<ZhbD>u8
z^`j+A^-GOs`7`(LNO?S-_$!91_8S+IJIMWW#ot0D{0vy&*%_*NJV$p!|FI<>jqel8
z^o9?ug!yTsES0JZTVA56QL0+3hixw+t-t<1{cK0*5}ytN^Xr+gsh2*CfZyvgtQz`L
zb!OUr+mFlI`0wc>*5<Ki0Y{uiedukRky;w1D*p2P{MOfSChwhwbYzqYVDy8U!6J@<
z|NS=UaIQ1%^h*oHFKZd;xd66x`X=S#MYg)vUrK0o-&n^FPDLn??q5TryS(=UL7!b_
zIA`I&%bWDx{s;G4_m!PsCL4sie>30yUNo!Fbiuy?fS{NRK=fn7HgPC3-M&@D{&vz#
zhB|qdEv-w@LYgMB)GIjxx=u=-MBo@~quf+<EkDh7K$43Jqpx+91;nAI&X1k1Z}y-r
z0p82}nObs?zQ=zv3R-+|)o(T(p3C{+G>HS<;Az`y3oufAgKpQDOD3{U9FQZ;$qn&e
zF^5=(gNCtQ%y(_dsJ=v!#;FRtE_k}k(7_awR43uj#ZzCb@BEp*vhJ_AtL0t8^T72W
ze92#)3_u#iV-ON}^jl8TajTF$>|qS|3VEPv!NHR}TtJ?&wF$Z0n$9=-gtaswsLVLd
zz~QrncUu38OwIG&OOZ;6Gxv-0RScW$;<l>U>BL+7nytEsnwr5Yl*YsNE5+njC2EqQ
z<%(ps5Skjo+KSV%VQuEM<y9WnPFFs$Uttc^jvC!hhFYZsdwQ{kAyIu^M(b`%Q(8hq
z;(?YBJXW{IG`TlOy3kD^aUJLPL?}^a`IBM3Ylx?zmRRupnr(3{p_=niiH3EWLII`t
zrH@+6I)$~(s~@xq+uLvnjTfbig`@^Oatz((Bt_tka!Tn&&Ntx+jnES9Wiz<(qrbxN
z!LiArQ9-kk`x(BWMq<Z?g>bWiQ8q6Tc*6YvR@qWxv;tf}TsU<pVNY?NiS4ODZ}n)9
zL$*>^gNLz}N142Wej(07Vb)j}foT6M3QzbhHR4H=W=o;i#LG3*PlTB(`tSDM#tX<W
zwQfJAv}*zzT;t1fPOY;3drGb5TnKA5AVL!cElk>N20RANEyX)Td=BE7)9K0{@JbeL
zVg{ULpxyk024+bzfaNTXmbDFj3>^O9rz_Y^k^r1EIa}eSpb47i_D$>~0Z@dO^Ic%x
z(dzbmwkK#4nAQvq`#8UUykMaY0NmC<EAg#N9P+cLU)sft?y)}(j)@@d%rO3(A>P4Q
z@z%l%&r#Q2W!1$tCD14DzUo`C0O}FcWEvgJ{E-BCpty@cTwkOf|F@`Lb>E+uApI&t
z)dQz==9>u!7*i{?+?BW}&u7M{+WnkKxt_YO{jhVBZhp4YVxoax_zIv1v9>aFehfq`
zFMhSk(xZk7^Q_Yc+58U6v2)?|xCx-g*&O<sIHTx22lis987|H)P=ZN$?c0p?2#qPW
zN$&hN*q>x)7#`0INk+ip^vezc86p^Cz*`JyHpK+A1v&n-df@&_);@AmtRA}ka^~)Q
zN4Bt3_0(m;cp%1fPZvs94of@>#4fd~gjKrz_Hy;N<E*$<{AK^~YbBWYgBw7W+Yl~}
z_WFM97LP}W7ph`VU9-|4oZR54&50_`n~QD+!#j5Rs&%SjLufuFmLuq7G%C;HJt^=B
z1_!68V5hHp2u7UcL(s5hAD1XBXDEleP;F$m2+}>DM``mtrO%>&pXr4WMGMqp<2UQ>
zynUr&_s+!^$`YG9SB-j8P$`)p;8fEe5jfOG0hB`09sJ{>+7w9@&z~KvV~#lu6wn4%
z`GWS-t;SY-rj*aY{_M1TaX&X0?lStC1BkFngAJ@Lf6a7r=tvIc#-R~)R$-qYqQG^0
zZ4{Mmj_)Th^kV<RpE<^)dfHrUKe#egvoY&w$NmVW6bHd7?|IyfaQ7>_8sS!6;!?-!
zcPhi|=VJa&XU41U>dPW^77|B++e$|}P%y-;i&AZ0rZ5jsEOXlC&72?W{zdtPDZAD7
zu8?nEn>{P)m`nF<JVRLO*bit;!a6<P!iUZA9*uf&cQ=kDc-%RX#Ls8#<vWei^0ySI
zL)zbN#T^C-5E9)9iR!GarCv2)z5%9u=ryG)s-GdhtYJVbk=u2hGx;iFIl=#Pgbl`0
z*M_<}f>m+lGWlimPE#B-HpYTSH&6S%)ff#?96yLrml!R~pL@_8uwgQ_WUeV}_x%Mm
z3r0H=a0BGedpxBt%^{_&7#mRRG&!NrISt?0MW&TBM?ZPJ4;|TFT)tdG<43kcbb#+0
zi4M!?@Z1mH-dmr;(e?)8*OB4es_paI$dk=9Z#ScKv!tW04LTvgrHZNMFSSLbrdbW!
zyb_BD%y?gIavtTN_>aT4)^WayIOw(_bv8c7JC$}_1v)PC{_grXmd>3jQ5!}g>2nGp
zn)!rxWYMMJ1DobB`Fbxg{=>&`SFEeNjVaB%6>3`bO@;ERjmEpdXRdQ@Kh(d-8W9-9
zi!JT5NlH!M8MbZ>dflEz8W%n)>QI{@UAc=Yn>xe8v`NZ(<COwLaKzy$48XAIgDWT2
z0#wN;fZK9~c45BvC919olnVnp-?aQ4;;Cv(_{wpvhIsT-`NAz;K^Sg3>+Me<Lcnbk
zNm~={+XA(gGcmryrP3+0n$egTX^;xrmm!mDa)9_i$rp-?CMU4E_*0gl$Jj-6^blXZ
z3@Bl_uO<T5*#Td%5TGK!iOOH8BZslIsuXnu^5l5$!n|K3fV!|ECuOW{ao}?va!Yc0
z?hI@}(L3nT?$@ke0(7dgqePBr>kB*QKRf<@I5-+5p+R>S_QhS{tN6G(=vnsx__{*5
z*k@4c@UTHe#}7F!;QnlAb2rzZdaO}D!TIp{3l!e*Z#c5qK3i#6R8BRW;b*xMAlT)f
zvUqyBk1?W=phbPU;MHw|9Gkg6^!u4ulYtm^RZ=Yt;SSca4(a;6^GA&N+K<8RIup!N
zY$=BbTrbXL3>KUjOW4d6W7Ry`RDviPudCtsrInxWg)c`NCf`mBIK4GlW$AphWI3gP
zrs@@rep9|f>Meb3eNvNf2*2}4`3c%H7q;g;zKOTdHeUDqav|~frEy(B?SSo*XFHN2
zvX8~A7uI=++wE+1EYjkYSDz~AtasO>zvnU4^7xeUGqk@XE#WA;;NYXO#`^1LZ^Vaa
zB|iI?z49x>tyA~R;=!xYQ7~Su!jbl3@W;>>>KS;+F}){30S;DEyw<$dU-FGNQkQ?U
z^gq)ojN`=M=2jjq-DkMf^Won6LkiV%kLm773GnFut(vkCSYv3&F<lZ*zF4(zq!9l;
zUcxmQm!YtNe&n9v6Z_}F5a+y)w}jF5rX^-qKIE2Yf4oDpb7!Bnf=*s?o4fDtCyXa)
zUFu85wB9v@S!@ZH6@~hRt(?caWj@KJJ@nuqS~~^>8*BJDkddeKv9zX`P=Y&SecXv~
z5duCatxomJi-l=V-UX6!xuFL9^DCfaz53L%&Nw=k;`5*<li#Kqxv3T#Ql0y)*EMk$
zMe;>tY1r|(X*nO)hFPtXtioZnrG`g(3djAahwG=V5ZrjW2^jZWVtTJgjyKdQ#7Wew
z%2aRVVx_xbS5`00;{SY)nbk2^U&%L_K91v($+K?8`D`6RSg*>|W}<@Oqv>m65TzNv
z)&5T5aJ?*_RnL)h3AGE9$be|63(D^|xh9%QG+NhQr{+Da5?41FmD%vblA8z0ep7CT
z&#VZ-jR$)_6#di^A|T-07n<~iYI0rW)NryMb(wuF*$Ia4DWEu_me6ID>I1ZYVp(a*
zkXE5?T*;)0zgC8!B}RgjwW);&qi%GC7ayl>2c_je_r7NvZg_1$o<rWA%(te&Ak8pS
zs=))2Vvkf9o{53EyXnl^oy=6oC_iFE>sHW?MZSCTxRA?pUWaw#%@RXb>?Qc%16;U~
zP(bcNFudQI94i7JeIS?$>xhf`s8i@t`-P_@;Bh)cP#sB(OxAt5@{>n$bT~BmESeoN
zf_;44G#ukqZ0`kM8SwsIcCr(GMiRKRghrTAda2SX)<OX#ZGXApqqDVqqPA2MLLo!(
z`Of#{2CkmVIY`n|GVLXD{AC&c<)mAnRw8{(S~wQr9m9xe3~=(qf^34^O+WXfv6B!2
z(7Lra4~jTGzX|{}!N7Kip4h!9@p7Z#Uy9zNWq&;OPZ?$mq;Q_T9+tsy_X>*!;2l^I
z655HxHzV*dl7*fH#79>tN%4^b)`F%rL7IPO%9+vZpI|u|-90UwgW13Q;L#M383usx
zzO<LF^-uI<yr9YwsDrI=|Epw#TW0LqluYk%ncd|d#4`b}_VeJK8Do(zx;d$!W<5{3
zhya$o<WpCZs{^1Hb%cZ>me)&PLwTxwif=Y2+he9H6}@Ff!lc-HGL8qv;?c}|UN&Rm
zZ*-f!G6M}CpTx<~<7`?2MDNjp-_|+a=7_!k+g<J$s})>*uG9C^+D4ETdxM#<%GWtl
z9OZyubS_?!3L&>(Q~jSJucIy%TT3NFZkZ#YV1xkH_u6O3O4HinZ=F`|OxT5^ft!@b
z$b%yK@Z~x>baFSem_GIbqvl~fonyH;P$5^U0GK6-dLU)FB9@!E%0qxw_C$c&r`WRM
z>>nY9>sevckt6L2tbTGcMMal>)ANrh8$w~>=+;1{-u==KpKPqEb`q`C9D_W4b9)4M
zH*4)iH#WWvB1mY<sXX7KgMQ76qpyfUK!h3v8^cVyDvS0SOwG<rVb4d0EXS{#kaA}Z
z$L{Tu{Dxw|FN<BCn6<UZpdm$=pfe10x^sDf-V%W!=`T1}euhEm*NSKMmfxgVa>@~_
z;&fB3-IReeSBug`CdU*`7D}~Rxn*lz`U)H6lImuYf#jo%miUGvvq3abC<#ufRc2QT
zri&QOcLP%%EA$%J3$=DGS$v5U94%o0R;2XnPI(6`%Q^w|ILvDDf^|7P7A$pA_g@cz
zVs%TK&zkc4Y9T>a(mq*QuYxM4WM-M0N8UA*8o7=Y>`9N67dCx~+%?u2YAs2~aF{&~
zU(fDdG_jglL8os$*es>g#i^w;Yr%E>AdBw<_#J8sSsc)=khHUNg^R9_i|f1k5<}+*
zeQ8UVaT2=FcE89*6IhC2e)ZDjN!RdlFY3`WKJan#>R#eWsM_3&6jYk4+~6`7ZW+?v
z-8_y7xsp42K3Vg4uLz87G+g&dHf4LCs8F<6#E@a2RoE<<*R*d?xxTscclA$>W}Pq9
zrVwP{lIOWlH}+!ul_io{s7g)DHNM1DuDQ5&RJq_j?-|)rj@Uk<xez_Wb;?P&z?apl
zTbIn@>oHc1w2ukzxo+QqC#)|+%nF<ImJ<!v6MNC%%0fKSSgSA-A}^zI65ier*Ix{s
z1OWIV(>0P~u|%{-QkjcYIPzoysbWDQ@P59~;IP7k<KB=G^O=(IU!Js*eLEBbn47Wm
zxVqUwY4`#V3#DaT$c}>&bO_hCS`rb>R}nz3Lh-8FMJvXz8K}B7N?1I{QoyTqeU%Jp
z@pX;RvXy<|U?`b2{!9Ou6e0z^Xt1?9=WOcM?I+$ewr$mx9TYOIi9)q(tg`}Tc(<Df
z8?&qE!o%f&5@x~!jbAT;2-FYEni0q-R*nt$?zCT0|A)z&&*F0Hk4Qk?36dxKa)oXa
zCH)S3u*D_1u^JgW_tptj$isS2a3vSId>}t8+_kR8-Lt3uwrISU{v9uID9oo(1-QbU
z4vK>JSf-YjO|Ss#=juuzfeNMwm9H@UPKH>wI1L-$@Sg&`%JMh}a5&b$8`1Bk4^@%(
zI?s#Saq&!y#BR}6sMjY0Ofo-6E3l^WaESo2iHm2iJmR$W+?@Y=Dy>AiGzB(|6QGS0
zw&nhugMc)yD_(~&TuO;U$b$x+Ph$U`N+=D!#>xs<ojcwYMK4{RbrlFQAH4Lp0Z)Tp
z24tlQB3bc}Xv`{jV^_XYtbb`T|3MSopiMCwFs6M(qPu$trkg(lK=tBeobFJ9+yX>8
z1Z@a_B5ymKJ)IjQIIl;}dMK@SxMIZ?8Cgz+NXSG5c0CNas%lf~lwBo9TyhTrwjuSz
zAwHh~&vx*a@3p$RbinvM6`Lp>zkRw#I5(9s@<e6yfbe6u@>Ez}87|NBK&6|hrwq9h
z#QPNy9HQ@`Zk!_riYPa*<s0LdKBM|a-KeF3bM0`N8M!JkHm!xYJiY8Kc1HC_TS_3C
z_r7@JZKIv;DxU{VnEAGL+W`xk3jL9H<NB8nO?o@bgg4-~UWonyj5jN*y0TFw+ZxSA
z49B909cE<}8~|Pr`s->g@SL~*d3E`ZDc=kx1o9(_$ZwI+mWNR7vUXbpPSi+2hBdy%
zJ)ege;}Qyi+&vA|`cuYbKRA2MeP0=ZSb@*MO=9j~e%}!CGRK^>Gk8~U1yr$>naJx(
zCOSZOa^xLgy$oOJxtwLx^d%m&k<GtQykr&Hd?LI!0Orqu<(IklP%ZZDB6Gl6X3knV
zRCUujm2=PgStn0<PtEq65;`jok5R&THGW14i41h+Pb>#$*`zo<p7CPkAnBA32KTHa
zd^N<7z~r^l-u?*N2K!`C>!Q(7>Wu2}`(yDIC5y89nxCt2Y-}N!fT!T3_|0z*?9F)Q
z^8(uo>54q$gSY34D%)jTEx*!VyFTm<sz`CAYxPmP^Qq)f_1<tl5>3Z^BE*P{oI*W(
z*8=~X93LOWsJ}T84N-|MV9+i*6a1rVPuz&qZ5dSSTpnO?s}ofCkoYQksrBG;=r7&Q
z5``0Y64r;fx{mv<j(by0I;Mj`D~ilnpP2-cnIUM4IB;<Bk%}%6q{rjQ1hm9;N-*h|
z1D}-+Rs{ymiv4@wH<&v@*RqOilXxomRBNwB2=$$uq-#l5S1Rz^mDVnndUAiQ9uATn
zt@{+A2OpEWkwd?Nyvg-OPC<EFT3i`uj|n&W*ROPp7%L#2PY_A59Id&c5uHDvZ;NOB
zoNfmiuY%0R*|n~D$R168{V3@}i8v$Y=FT~<Ks30xImoy0{&u=)-qL!F6EL6e=wOF9
zd!fQ{LGxDWmBXwFoZtsyb5j?s=py5+;XR39c@|93aQ<8W&6?{HUM^DkubdL(XB&(=
zg<OsYow}1*zXxa+rU@C?it<$G7Q%UF-Vu4d4GI%l9P<C3L|XZYuAD)q+i>yyvbkcK
za^hhTq(+~O&D*`!1iCsWq^Dx@r8ERJI>I<{&3wJn3_glZx}&s!{Wz-^prB}2N5ust
zRGQo5=e`Zm)87l+Xw)FtztZ}~K0{pNXNyxQ9c)=#nsBIDLzBkN|1^VMF@w%NLOz`g
z%2Th#D+}lfjr{r!$M6{lLrfV^87I{ht$Q#Nlu}rYoV@{yTAbH?R#PD2lP%x+>d^D4
z^>=y#)hbtJHfhuSdfmp<&__Wv$s2<rV{WkvIiV=j$l&5X#{zWu+EDgX;7OrwHej_k
zobOwr;ct&1VfZeX->^_cWsX)(#Dx>*!Ndk145Cb=!hPf23funUTpmk8$IR%c<oi$J
z9!|>NF0U9))9YxmQ*fLu*hP5Oc|4N=VJ(-j1^CQ6VrIE%Yy0+&wDe(l-H)Bfa6(2_
z*4!L6^ZHRIZ4~5<Yq{*p!<Ddo+P(vt>N?s3Glo*=QKrXCyqF(7CPn0r@d>+G0wdo<
zZ<TSAP@hjsmzq6@m0^Jm3GQB3T=hx@fWAhy7raOMOH9yfKVk=_Qa8r;8(fh{tP0BZ
z#{FZbr9HR*9c%G_Lt%Iv6Fci9xu<`TAeS-qqYF<dIRwz#&5snSO6#(Or^a5L_^p%_
z6LXT?zgU=1S2*%s8nMS^Yi~3k0bAL%B)JXW-b&qdUeN6}jXMwx$Ey4di&#h(T<5@C
zs@hkNySUGol(0z@)F7q)gJ9&AvS3Ed$yN)6$H<OVz7x!AB#<=b)WRShgq+&N-D|*b
z^nKtXl6o~Y1!tpU%Xa(z%v~FtvLtz-IdHFyHN*X21F;_E>Ku~^$vaLfjJBIWl5TE~
z7Cgplmy^g5YJ$`bXBc=N@wubaiDfh`%~<?j?m^=wW#jO(OazzZl<^xE%|&@zq*1qs
zv=3v%|3;uQZM=5&`pr}K8rlJ~a5*jmE?GYIOKazVq;{Veef7T`{{9~oFn_v1vX_kt
z<pA!c;{p+&?-iFAMY7IRd8&H1aOrYtinJ8-C#Agt63Ahv+Uj&U>-9}R?H_J~RLkcz
zl4z;ZPc8Y(S+>0vn)+^CL`<)Hor&>rPpvOEeY~%qEy%*wAP{c5w&DN)`LSU47ZcC&
zIm9zpqa(rXuJ&<8uWcn$0&kW<E}5rF{%C&wkFr@yjQ9DMCMi}~0V$iXE66)iC#tz4
z4k<N>;SZc%Zm2dd;jQueM>OUWS}O_hv`}UA;NuqFDBR+}oQZMV#4DV|3U<Ge&91>o
z@7{pL==$Rt1_vO4dOuuzs7~TMcB92tdtlf|Sqhu$xRD+@u^&+!d!$EJJpL~P4tdEg
zqf&f5vg20JT#T=rvY;#6eq=K0N9=oDI%(bDsmp+A#$F0J1nv^TLWeZ}r~8o1nXCH)
zCF{hw^?=|YhWwqr9}#JghPwFfY1WJfo_qhQlOv$k-;<@t-IxwADAB3FRnVz{q@ObW
zLc^wAgwP@{Q|+>wE0qX1JGDTT==zQR2rRzNkGb0L4{<l}?^Lil1*v<pu3!&D;JTZQ
z`?q^OPZLGt%xvBMCVX~9wp5*Mt#!KbRiAAvE@@=^qBo{=4SC}}!unwg3K3n0I7oJ-
zC5RFOqH;6XO$MXW?K9U8wPFpmtet~b{8xDsC-(e2wxm1~47JirRP_H##`FmHf7td@
zgVjXqr2RbHceiu9Sy(C*Zn*w(mA|HZy(~a%t017%s7o1^O=Z2Tu=BWToXa(;Gj=^K
z+h!9c;{S74Gc-tbkX<U-%H7A)y<5}>`Se7@(4E?QYY;S68_M}L2QsQ~qQY{07i7yU
z7~TGT=DFY4cj4}_RnCjQX2C%gqNIZMnG!fSp_11NyyRB*9dEV&tVsU+1(o$3MM}u6
zHv=X=7Z7`Rt-_Oc>9>UUQ*MjEIUcm6U{;uky;tDIf!M3U@a2~jXTDl(qpE8+CvYRQ
zWJhGCI6dp!Q_}nxMHi!oSH34hbhMY%kN(w5F)58I>Iy}_v31T)zDWu_;08Si(9HRv
z%|fU80nsKQuxWUZg<;a8|KL|1eJzoBvt`|oJ<;jVsX5+Ued_#LY!`UJbW+|h>d@#Q
zbSrA7{IwmpyAnPARPfgcxN;FoSVt?Xm$mt^ywc3#({jr8w+|jyBs|er_7pCd?{C+_
ztIVTUPxRe~akdSgt{u(MPd}R9OtPP01+FA0tuN@_wp*H(8`BP;E}%2ILDNsqseRKx
z=kR#^{n(>I5a^!!U=4fw+}U=exA$N4<nP}!`VINln|uRG#dB*(PISZW<2%+e-h0Iw
z*SUJ`c!t>01IvcQ))=k>8~SIMuT0wF+zBUqV8r`gwUzb9OHJsJn$C>MS2~<mqS0So
zTcaU$$fmLw$><94u~WghAh{3?!n?}U5|t=fvj`mz9!n-B;4b#pSBoM{ZKfr%rFy<!
zNuktoDm%e4nM=m==7T!x&l7;Ec^$p#<^(FWWsX5s{`m{-EH$!)y#S!mEqZ+_^g;Q9
z>sY>U^{PZ`fxej(3xab`$`Emqcc4WlHr@LSRq0yu7y4Ga!2)|TPfSRMBR<z&LYHst
zv>m?TjRfXO^ucFd2#r5-M!8RkW1lDDd|kP&n?#$;+I0HzZ9r-o{7oA94R1_^$BTdf
zH`L6r=rv&POVc&+v&?#PBbD2roc&EnF~71ZA6${I7tZZH1Ldo)cN|{1(AJS0mPg!c
z8Otb*xAIo>mkq5K_z^z&!u(P;tn+nS+H<9{f&FO7W~P-*$<DZq8BSI2F}9p0(4l(x
z7hm^cqO->Vw>IqtJMHX#)P`wAJPJ|%maX0zVJ#PcRZ0AX@n1h%-$cd<1JpMBU{hW8
z;)gSAoQih88w6vzvPSMq$&{e0PK2+;B+X5gqAey;ap2a$9UwDk9BjQ6RbiuagHDTn
zJ0!?xStbum=Ng>~y#Tl#cum{g1Wv6A)cp3`;55v3T%fPzlBp)|$5rLWoK9_WNUvRc
ziv3O#+Dm1r%MC?Ed&!SpnI3|D9@u&9W?UYFX3s3I2sTxR>eJ=}AvJOCbr2QFVsr-@
zY)Y-HFnl%>-_;$jKnMI6NQC>t%R8(jI+fESpFuNbJ66xWMq1>XJJ1-h-scU6_9>{#
z+<GwQIL_Y^qPRqj5v&ubY4W%iM5d>xb6ADg4btXKcFVE&8_TJvu7)|}(f)@oaOHJy
zKMzfnO}SE>)>#)lEKocVvNxjVHG81;9^3O`_A3sy;%y%s_d>evJ5v5&42ixm_M(3N
z?8hb1bN_8BakBWkDS4&0Z(Rz~$GD--C~LQfPc-@;(G*8_#)nHZl^Fn8Sos?z_N5B{
zNt&V_HMl&Vwq{RGofP{&*vn3e+ZDRfEo$Iua2t9qqn(y&MNb?-W5+ogUS~x(bi^Hj
z>B(ngU~Xt-ia3H|zSf(5rp5s3`=a+F=DpjytDh^ohkG?s-)~)6rGu^@HBxEi0}FL&
zvdhC=g4En`eBf`AmW)I^r1rIboASSyW3}9YI9D-RElg*IU{e=K&vOA;UgYPf`_g0Z
zgLsXAPkK3@ot$sBM*W|_zyA~dsah}3D1qF$Gkl@dgu-3Ur{~6<)=;xMnRi+LA9^zf
zg-}^cm>=IbUa0PBLr+rcf8NSkj-)Y9&m}cehchN}DZ8m!g##v*u|>o@c}xK$PD69R
z3(R-%o@m*mzK^Z~OY!mRkP}fR0b^NgIlj$oFH(cE_OTpHc_&~g-B80{fv>{h&TU@g
z2+G-6e+}Iq-$cWyU*7a+s9_Ypl3i`%zuym2vzu}PKhT~wrF^WF>c08r{a$E6XH8I~
z%}Gi3`>gZJ!-_`&v`f<gTNBu^{%er}8BZpyss`qJ<4xM+%F6B)fR6_1eyL?n|48pF
zl{U~HbxXTjq;(KfP1^e+!=!$$?5MI?*@&jRpStcBV(gHA+ii5kRdWoLjXl;gT90{!
z4mnhDk)#>D(>K;yUL(*H98)sW!br<i!qV>J@7A46sA<P!Xsv&GQNILn6g$1eh6omP
z9XWY2w&J*x?o?DAXuo$v<h*uLHCpx$@4ke1fC~JJixYolpE>R{=2aGGCFb?zM?!dP
za`m^vx<{NM6w$qqgB)Iz5e9nPlUmGUBx0F2fj1(0*&{irCMu0#4_x<@jZ5FHclmM7
zvYib*_@T_kH{?ilgGJX3(%5`t4jm4as{-xff+fj)H(+{Dsxp!N#&c&M>r6ksb)-nw
z@D-{9Xj(Tq!YMZ(ym|i$w#~0duQUJ^_!7@DQUc~Yb?R4l8=a~`x7)E!SY7WB>X-ah
z%ez1F+O}L*Uo9_`_8%xY9NTYjO#Y}{d-oYEVxyXIM((!$0h`zK6HF<povHd84U;i=
zOoq_|0dUK(xFZuF2Xy4OPB@TTOJR9wft^MKnImg!B%&Ds4Xo&OH5C}{@mEhQhdj#z
zOl*nup<8of>phsE!9V@xD6`Mmy$R<)ha3zZRqfS$dF~C2dNpxMQEnsDIj+hOcGJC1
zxUaRC2HRt4*Ot|;W>7mZ<S;^-U|ZZ~lu2U)J`7x)IeOB>094BnS0?tz(2HCWPqoZ0
z7NQz75h7CxxSXTMqRm0R_SE>hCzZ-^YSezaRkOS1;0Z+3#!aEimsts4<H{ZAsFRC&
z9dfXCd}5cq{0Xtjp<5&_6SG54S#nE3B{X(CikLcPQof98A9td<AuO;odez6q?}r4W
zmO!ehMwvq{MpWe)Tk-KbO)EE{gGxp36Ig08_8(&#^_eX4xsI9Yrp^TGl1qlO+A4S&
zv`zp^=9N{>ZPJh4eL0g8=a6<XxVts0iPY!&M&*Ved#0xEPtLxt9&C_d`|dXLayIzs
zH_{-PkIigYZdPV%cD9N_gHtt-WVvSY-<P=V|A|n}4hoP{S7vCiO41%q1OmZ8pzr&)
zEKL}__Xrsb<IfyRWLIa9xk08>rCaGa%h<67HWg0-EnWFOMJ{bge^Hh>@_$9#|M#C=
z|9SF%x()E31^Lf{{9mq!{KqN&;}rjKivQ;B)c-#=#sN(EX+r#ydu3(+T=spcuJ^d?
Ik=^V60k(CR!~g&Q

literal 0
HcmV?d00001

diff --git a/tests/security/test_permissions.py b/tests/security/test_permissions.py
new file mode 100644
index 0000000..2aa3bd5
--- /dev/null
+++ b/tests/security/test_permissions.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Permission surfacing + enforcement tests for encrypted PDFs.
+
+- Engine surfaces encryption + permission flags (FPDF_GetDocPermissions / revision).
+- Gateway exposes them on the document response and ENFORCES forbidden edit ops (403).
+
+Run: gateway/.venv/Scripts/python.exe tests/security/test_permissions.py
+Requires the restricted fixture corpus/edge-cases/restricted.pdf (generated below if missing).
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "gateway"))
+import pdfengine  # noqa: E402
+
+RESTRICTED = ROOT / "corpus" / "edge-cases" / "restricted.pdf"
+NORMAL = ROOT / "corpus" / "fonts" / "utf-8.pdf"
+
+
+def _ensure_fixture():
+    if RESTRICTED.exists():
+        return
+    import pikepdf  # noqa: PLC0415
+    src = pikepdf.open(NORMAL)
+    perm = pikepdf.Permissions(extract=False, print_highres=False, print_lowres=False,
+                               modify_other=False, modify_annotation=False)
+    src.save(RESTRICTED, encryption=pikepdf.Encryption(owner="owner", user="", R=6, allow=perm))
+
+
+def test_engine_surfaces_permissions():
+    p = pdfengine.PdfDocument.load_from_memory(RESTRICTED.read_bytes(), "").permissions
+    assert p.is_encrypted and p.encryption == "AES-256" and p.security_revision == 6
+    assert not p.owner_unlocked
+    assert p.can_copy is False and p.can_print is False and p.can_modify is False and p.can_annotate is False
+    assert p.can_fill_forms is True  # not denied in the fixture
+
+    n = pdfengine.PdfDocument.load_from_memory(NORMAL.read_bytes(), "").permissions
+    assert not n.is_encrypted and n.encryption == "None"
+    assert n.can_copy and n.can_print and n.can_modify and n.can_annotate
+    print("  ok  engine surfaces AES-256 + correct flags (restricted) and all-true (normal)")
+
+
+def test_gateway_surface_and_enforce():
+    from app.services.store import document_store  # noqa: PLC0415
+    from app.routers.documents import make_document_response  # noqa: PLC0415
+    from app.routers.edits import apply_edits_impl, EditsRequest  # noqa: PLC0415
+    from fastapi import HTTPException  # noqa: PLC0415
+
+    data = RESTRICTED.read_bytes()
+    doc = pdfengine.PdfDocument.load_from_memory(data, "")
+    info = document_store.add_document("restricted.pdf", data, doc)
+
+    # surface
+    resp = make_document_response(info)
+    assert resp.permissions.isEncrypted and resp.permissions.encryption == "AES-256"
+    assert resp.permissions.canModify is False and resp.permissions.canAnnotate is False
+
+    def apply(op):
+        apply_edits_impl(info["id"], EditsRequest.model_validate({"version": "1.0", "operations": [op]}))
+
+    # forbidden -> 403
+    forbidden = {"id": "a", "type": "replace_text", "pageIndex": 0,
+                 "data": {"objectIndices": [0], "text": "x", "internalFontId": "F", "fontSize": 12.0}}
+    try:
+        apply(forbidden)
+        raise AssertionError("forbidden replace_text should have been rejected")
+    except HTTPException as ex:
+        assert ex.status_code == 403, f"expected 403, got {ex.status_code}"
+
+    # allowed (fill forms) -> not a 403
+    allowed = {"id": "b", "type": "update_field", "pageIndex": 0,
+               "data": {"value": "hi", "annotationId": "missing"}}
+    try:
+        apply(allowed)
+    except HTTPException as ex:
+        assert ex.status_code != 403, "fill-forms is allowed; should not be 403"
+    print("  ok  gateway surfaces permissions + enforces 403 on forbidden op, allows permitted op")
+
+
+def main() -> int:
+    _ensure_fixture()
+    tests = [test_engine_surfaces_permissions, test_gateway_surface_and_enforce]
+    failed = 0
+    for t in tests:
+        try:
+            t()
+        except AssertionError as exc:
+            print(f"  FAIL {t.__name__}: {exc}")
+            failed += 1
+    print(f"\n{len(tests) - failed}/{len(tests)} passed.")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())