Check PDF Permissions

An encrypted PDF carries a permission bitmask that says what a reader holding only the user password may do: print, modify, copy text, annotate, and so on. PdfReader.CheckAccessRights authenticates a password and hands back both a flag for “can this password open the file at all” and the permissions that password grants.

Nothing in UniPDF enforces these bits on your behalf. They are a declaration to viewer applications, and any code that reads the decrypted document can ignore them. Treat them as policy metadata, not as an access control mechanism.

The permission flags

All of these live in github.com/unidoc/unipdf/v5/core/security as security.Permissions values, a uint32 bitmask.

PermOwner is a separate value, math.MaxUint32, which sets every bit. It is the default when you encrypt without specifying permissions, and it is also what a successful owner-password authentication returns regardless of what the document’s own bitmask says.

Two of these are conditional rather than independent. PermFullPrintQuality is only consulted when PermPrinting is set, and per its doc comment PermFillForms is only consulted when PermAnnotate is clear - a document that allows annotating implicitly allows form filling. The example reflects both, nesting the print-quality check inside the printing check and reporting form filling as allowed whenever annotation is.

Doing it

canView, perms, err := pdfReader.CheckAccessRights([]byte(password))
if err != nil {
    return err
}
if !canView {
    return fmt.Errorf("no access with the specified password")
}

if perms.Allowed(security.PermPrinting) {
    // ...
}

Allowed tests that every bit in its argument is set, so you can pass a combination: perms.Allowed(security.PermPrinting | security.PermFullPrintQuality).

Use model.NewPdfReader to open the file. It does not attempt decryption, so it succeeds on an encrypted document without a password and leaves you free to test several passwords against the same reader. NewPdfReaderFromFile would instead fail outright when ReaderOpts.Password is wrong.

What canView actually tells you

CheckAccessRights runs the standard security handler’s Authenticate, which tries the password as the owner password first and only then as the user password. So:

• Owner password matches: canView is true and permissions are PermOwner, every bit set.
• User password matches: canView is true and permissions are the document’s stored bitmask.
• Neither matches: canView is false and permissions are zero, with no error.

The return values do not distinguish an owner password from a user password on a document whose stored bitmask happens to be PermOwner already, which is the common case for files encrypted with default options.

On a document that is not encrypted, CheckAccessRights returns true and PermOwner for any password, including an empty one. There is no crypter to consult, so full access is assumed.

Limitations

A failed authentication is not an error. Check the canView flag; relying on err being non-nil will treat a wrong password as success.

The bits describe intent only. UniPDF will read, modify and re-save a document whose bitmask forbids modification, once you have a password that authenticates. Setting restrictive permissions with the Protect PDF guide does not make the content inaccessible to anyone who can open the file.

Run the example

The example prints the raw bitmask and then a yes/no line per flag. Read printAccessInfo. The password argument is optional and defaults to empty.

git clone https://github.com/unidoc/unipdf-examples.git
cd unipdf-examples/security
go run pdf_check_permissions.go input.pdf [password]

If this is your first time using UniPDF, follow the getting started guide to create an API key and set up your development environment.

Sample output

Input file test_file01.pdf
Access Permissions: 4294967295
--------
Printing allowed? - Yes
Full print quality (otherwise print in low res)? - Yes
Modifications allowed? - Yes
Allow extracting graphics? Yes
Can annotate? - Yes
Can fill forms? - Yes
Extract text, graphics for users with disabilities? - Yes

4294967295 is PermOwner, so this file either has no restrictions or was opened with its owner password.