Upload 5 files

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+core.cpython-311-x86_64-linux-gnu.so filter=lfs diff=lfs merge=lfs -text

Dockerfile

@@ -0,0 +1,22 @@
+FROM python:3.11-slim
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    poppler-utils \
+    gcc \
+    && rm -rf /var/lib/apt/lists/*
+
+# Set working directory
+WORKDIR /app
+
+# Copy all files
+COPY . .
+
+# Install Python dependencies
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Expose port
+EXPOSE 7860
+
+# Start the API server
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "7860"]

core.cpython-311-x86_64-linux-gnu.so

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b4195d6afbb0e7a41ceda99d2a1d623a53d4e0c652c605f81d753c159988c137
+size 1014592

main.py

@@ -0,0 +1,172 @@
+"""
+WaveSign API — Private signing and verification service.
+"""
+
+import io
+import json
+import os
+import zipfile
+
+from fastapi import FastAPI, Form, Request, UploadFile
+from fastapi.responses import JSONResponse, StreamingResponse
+
+from core import embed_watermark, sign_image, verify_image, detect_mode
+from pdf_utils import sign_pdf, verify_pdf
+
+# ---------------------------------------------------------------------------
+# App setup
+# ---------------------------------------------------------------------------
+
+app = FastAPI(title="WaveSign API", docs_url=None, redoc_url=None)
+
+# API key loaded once at startup
+_API_KEY: str = os.environ.get("WS_API_KEY", "")
+
+# Routes that do not require authentication
+_PUBLIC_ROUTES = {"/health"}
+
+
+# ---------------------------------------------------------------------------
+# Auth middleware
+# ---------------------------------------------------------------------------
+
+@app.middleware("http")
+async def require_api_key(request: Request, call_next):
+    if request.url.path in _PUBLIC_ROUTES:
+        return await call_next(request)
+
+    auth_header = request.headers.get("Authorization", "")
+    if not auth_header.startswith("Bearer "):
+        return JSONResponse(
+            status_code=401,
+            content={"detail": "Missing or malformed Authorization header."},
+        )
+    token = auth_header[len("Bearer "):]
+    if not _API_KEY or token != _API_KEY:
+        return JSONResponse(
+            status_code=401,
+            content={"detail": "Invalid API key."},
+        )
+    return await call_next(request)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _is_pdf(filename: str) -> bool:
+    return filename.lower().endswith(".pdf")
+
+
+def _build_zip(files: dict) -> io.BytesIO:
+    """
+    Build an in-memory ZIP archive.
+    files: {archive_name: bytes}
+    """
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, mode="w", compression=zipfile.ZIP_DEFLATED) as zf:
+        for name, data in files.items():
+            zf.writestr(name, data)
+    buf.seek(0)
+    return buf
+
+
+# ---------------------------------------------------------------------------
+# Endpoints
+# ---------------------------------------------------------------------------
+
+@app.get("/health")
+async def health():
+    return {"status": "ok", "service": "WaveSign API"}
+
+
+@app.post("/sign")
+async def sign(
+    file: UploadFile,
+    key: str = Form(),
+):
+    try:
+        raw = await file.read()
+        filename = file.filename or "upload"
+
+        if _is_pdf(filename):
+            # PDF path
+            signed_pdf_bytes, sigs, _ = sign_pdf(raw, secret=key)
+            sig_json = json.dumps(sigs, indent=2).encode()
+            archive = _build_zip({"signed.pdf": signed_pdf_bytes, "sig.json": sig_json})
+        else:
+            # Image path
+            from PIL import Image
+            img = Image.open(io.BytesIO(raw))
+            mode = detect_mode(img)
+            wm_img = embed_watermark(img, key, mode=mode)
+            sig = sign_image(wm_img, key, mode=mode)
+
+            out_buf = io.BytesIO()
+            wm_img.save(out_buf, format="PNG")
+            signed_png = out_buf.getvalue()
+
+            sig_json = json.dumps(sig, indent=2).encode()
+            archive = _build_zip({"signed.png": signed_png, "sig.json": sig_json})
+
+        return StreamingResponse(
+            archive,
+            media_type="application/zip",
+            headers={"Content-Disposition": 'attachment; filename="wavesign_output.zip"'},
+        )
+
+    except Exception as exc:
+        return JSONResponse(status_code=400, content={"detail": str(exc)})
+
+
+@app.post("/verify")
+async def verify(
+    file: UploadFile,
+    sig_file: UploadFile,
+    key: str = Form(),
+):
+    try:
+        raw = await file.read()
+        sig_raw = await sig_file.read()
+        filename = file.filename or "upload"
+
+        sig_data = json.loads(sig_raw.decode())
+
+        if _is_pdf(filename):
+            # sig_data is a list of per-page signature dicts
+            per_page = verify_pdf(raw, secret=key, signatures=sig_data)
+            overall = all(p.get("is_valid", False) for p in per_page)
+            verdict = "AUTHENTIC" if overall else "TAMPERED or INVALID KEY"
+
+            # Normalise per-page entries to use consistent field names
+            normalised = []
+            for p in per_page:
+                normalised.append({
+                    "page_index": p.get("page_index"),
+                    "is_valid": p.get("is_valid", False),
+                    "verdict": "AUTHENTIC" if p.get("is_valid", False) else "TAMPERED or INVALID KEY",
+                    "similarity_score": p.get("similarity_score"),
+                    "mode": p.get("mode"),
+                })
+
+            return JSONResponse({
+                "is_valid": overall,
+                "verdict": verdict,
+                "pages": normalised,
+            })
+
+        else:
+            # Image path — sig_data is a single signature dict
+            from PIL import Image
+            img = Image.open(io.BytesIO(raw))
+            result = verify_image(img, key, sig_data)
+            is_valid = result.get("is_valid", False)
+            return JSONResponse({
+                "is_valid": is_valid,
+                "verdict": "AUTHENTIC" if is_valid else "TAMPERED or INVALID KEY",
+                "similarity_score": result.get("similarity_score"),
+                "mode": result.get("mode"),
+            })
+
+    except Exception as exc:
+        return JSONResponse(status_code=400, content={"detail": str(exc)})

packages.txt

@@ -0,0 +1 @@
+poppler-utils

pdf_utils.py

@@ -0,0 +1,100 @@
+"""
+WaveSign — PDF Support via Rasterization
+-----------------------------------------
+Pipeline:
+  1. Rasterize original PDF pages at 300 DPI
+  2. Embed diffraction watermark into each page image
+  3. Repackage watermarked pages into a signed image-PDF
+  4. Rasterize the signed PDF again — sign those final images
+     (ensures verification always matches the exact output PDF pixels)
+
+Output is an image-PDF (not text-searchable) — correct for tamper-evident signing.
+"""
+
+import io
+from pdf2image import convert_from_bytes
+from reportlab.pdfgen import canvas as rl_canvas
+from reportlab.lib.utils import ImageReader
+from pypdf import PdfReader
+
+from core import embed_watermark, sign_image, verify_image, detect_mode
+
+DPI = 300
+
+
+def pdf_to_images(pdf_bytes: bytes, dpi: int = DPI) -> list:
+    """Rasterize all PDF pages. Returns list of PIL Images."""
+    return convert_from_bytes(pdf_bytes, dpi=dpi)
+
+
+def images_to_pdf(images: list) -> bytes:
+    """Pack PIL Images into a single PDF. Each image fills its page."""
+    buf = io.BytesIO()
+    first_w, first_h = images[0].size
+    c = rl_canvas.Canvas(buf, pagesize=(first_w * 72 / DPI, first_h * 72 / DPI))
+    for img in images:
+        w_px, h_px = img.size
+        pw, ph = w_px * 72 / DPI, h_px * 72 / DPI
+        c.setPageSize((pw, ph))
+        img_buf = io.BytesIO()
+        img.save(img_buf, format="PNG")
+        img_buf.seek(0)
+        c.drawImage(ImageReader(img_buf), 0, 0, width=pw, height=ph)
+        c.showPage()
+    c.save()
+    buf.seek(0)
+    return buf.read()
+
+
+def sign_pdf(pdf_bytes: bytes, secret: str, dpi: int = DPI, strength: float = 0.03):
+    """
+    Sign all pages of a PDF.
+
+    Critical: signatures are computed from the FINAL rasterized output PDF,
+    not from intermediate watermarked images. This ensures verify_pdf always
+    produces matching results without round-trip pixel drift.
+
+    Returns: (signed_pdf_bytes, signatures_list, n_pages)
+    """
+    # Step 1: rasterize original pages
+    images = pdf_to_images(pdf_bytes, dpi=dpi)
+
+    # Step 2: embed watermark into each page
+    watermarked = []
+    for img in images:
+        mode = detect_mode(img)
+        wm   = embed_watermark(img, secret, strength=strength, mode=mode)
+        watermarked.append(wm)
+
+    # Step 3: pack watermarked pages into signed PDF
+    signed_pdf_bytes = images_to_pdf(watermarked)
+
+    # Step 4: rasterize signed PDF — sign these exact pixels
+    final_images = pdf_to_images(signed_pdf_bytes, dpi=dpi)
+    n_pages      = len(final_images)
+    sigs         = []
+    for i, img in enumerate(final_images):
+        sig              = sign_image(img, secret, mode='document')
+        sig["page_index"] = i
+        sigs.append(sig)
+
+    return signed_pdf_bytes, sigs, n_pages
+
+
+def verify_pdf(pdf_bytes: bytes, secret: str, signatures: list) -> list:
+    """
+    Verify all pages of a signed PDF against per-page signatures.
+    Returns list of per-page result dicts with page_index key.
+    """
+    images  = pdf_to_images(pdf_bytes, dpi=DPI)
+    results = []
+    for i, (img, sig) in enumerate(zip(images, signatures)):
+        result              = verify_image(img, secret, sig)
+        result["page_index"] = i
+        results.append(result)
+    return results
+
+
+def get_pdf_page_count(pdf_bytes: bytes) -> int:
+    """Quick page count without rasterization."""
+    return len(PdfReader(io.BytesIO(pdf_bytes)).pages)