[lars-1987]

Summary

An encrypted PDF used to be reported as damaged. Now it's reported as locked, the card says how it's locked, and for either kind of lock the card links SanctumPDF's in-browser unlock tool. A lock MetaStrip can't classify gets no link.

 stripPdf
-  PDFDocument.load(bytes)              // throws EncryptedPDFError
-    catch → Unreadable                  // "may be damaged", reason "unreadable: pdf"
+  PDFDocument.load(bytes, { ignoreEncryption: true })   // look, never edit
+  if pdfDoc.isEncrypted
+    opensWithoutPassword(pdfDoc)        // standard handler check, empty password
+      true      → Locked("permissions")
+      false     → Locked("password")
+      undefined → Locked("unknown")     // certificates, unknown revision

 <CardReview> failed file
-  "This file could not be read."
+  "This file is locked."               // when reason is locked:*
+  <a SanctumPDF unlock>                // password: "Know the password?"; permissions: "leaving the password blank"
   email link                           // unchanged; locked files never get it

pdf-lock.ts implements ISO 32000 algorithms 2, 4 and 5 (RC4/MD5, revisions 2 to 4) and 2.B (AES-256, revisions 5 and 6, using Web Crypto). Nothing is decrypted: it reads only /ID and /Encrypt, which the standard leaves in the clear.

Telemetry: for these files, file_failed reasons change from unreadable: pdf to locked: pdf password|permissions|unknown. The new unlock_link_clicked {lock} event counts clicks on the link.

Evidence

• Before: every encrypted PDF gave unreadable: pdf with the message "It may be damaged…".
  After: 341 tests pass (15 new). The new tests use 13 real encrypted PDFs made with qpdf 12.4: revisions 2, 3, 4 and 6, with and without object streams, plus R4 with clear metadata. They also cover a non-standard handler. Each test fails on main.

  r3-open opens without a password, so it's locked by permissions   ✓
  r6-pass-objstm needs a password to open                            ✓
  Adobe.PubSec handler → locked: pdf unknown                         ✓
  locked is never "unexplained" (no email link)                      ✓
  

• Built site, headless Chrome, PostHog posts answered locally (nothing sent):
  • r6-pass at 1440 px: the card shows "This file is locked." with the SanctumPDF link. file_failed reason is locked: pdf password, and clicking the link sends unlock_link_clicked lock=password.
  • r4-open-objstm: the card shows the permissions copy and links SanctumPDF "leaving the password blank"; the reason is locked: pdf permissions. It reads the same at 390 px.
  • r3-pass at 390 px: the link shows, with no horizontal overflow.
  • Email link on a truncated PDF: unchanged. It still fires failure_report_clicked.
• Link target: https://sanctumpdf.com/unlock-pdf?utm_source=metastrip&utm_medium=referral&utm_campaign=locked_pdf returns 200.

Merge Danger

Merge order: merge lars-1987/sanctumpdf#1 first and let it deploy. Until it's live, SanctumPDF still disables its button with a blank password, so the link for editing-locked PDFs would lead to a dead end.

Door: two-way

Blast Radius: PDFs

Only encrypted PDFs take the new path; every other PDF loads exactly as before, since ignoreEncryption changes nothing for an unencrypted file. If the check itself throws, the file is still reported as locked (unknown), never as a crash. Weekly reviews must count locked: pdf% alongside unreadable: pdf from now on.

[lars-1987]

looks good