personal certs working

**Backend fixes:**
- SigningSessionController: Gracefully skip SERVER certificate type when feature unavailable
- Change createSession endpoint to return ResponseEntity<SigningSession> with JSON content type
- Prevents errors in non-proprietary/unlicensed deployments

**Frontend enhancements:**
- SigningWorkflow: Auto-detect JSON session files and skip to finalization
- Add JSON file support to tool registry (supportedFormats: pdf, json)
- Enable session owners to re-upload JSON and finalize without recreating
- Debug logging for troubleshooting session detection

**Routing:**
- Core App.tsx: Add query param detection for participant URLs
- Proprietary App.tsx: Add /signing-session route with React Router integration
- Both apps now support: /signing-session?sessionId={id}&token={token}

**Complete end-to-end workflow:**
1. Owner creates session → downloads JSON with participant tokens
2. Participants access unique URLs → submit certificates (PEM/PKCS12/PFX/JKS)
3. Owner re-uploads JSON → clicks finalize → downloads signed PDF
4. SERVER certificate type gracefully skipped when feature unavailable

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.dockerignore

@@ -5,7 +5,6 @@ frontend/dist
 frontend/build
 frontend/.vite
 frontend/.tauri
-frontend/src-tauri/target
 
 # Gradle build artifacts
 .gradle

.github/scripts/check_language_json.py

@@ -1,6 +1,6 @@
 """
 Author: Ludy87
-Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
+Description: This script processes JSON translation files for localization checks. It compares translation files in a branch with
 a reference file to ensure consistency. The script performs two main checks:
 1. Verifies that the number of translation keys in the translation files matches the reference file.
 2. Ensures that all keys in the translation files are present in the reference file and vice versa.
@@ -9,10 +9,10 @@ The script also provides functionality to update the translation files to match
 adjusting the format.
 
 Usage:
-    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+    python check_language_json.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_json.py --reference-file frontend/public/locales/en-GB/translation.json --branch "" --files frontend/public/locales/de-DE/translation.json frontend/public/locales/fr-FR/translation.json
 
 import copy
 import glob
@@ -20,14 +20,12 @@ import os
 import argparse
 import re
 import json
-import tomllib  # Python 3.11+ (stdlib)
-import tomli_w  # For writing TOML files
 
 
 def find_duplicate_keys(file_path, keys=None, prefix=""):
     """
-    Identifies duplicate keys in a TOML file (including nested keys).
-    :param file_path: Path to the TOML file.
+    Identifies duplicate keys in a JSON file (including nested keys).
+    :param file_path: Path to the JSON file.
     :param keys: Dictionary to track keys (used for recursion).
     :param prefix: Prefix for nested keys.
     :return: List of tuples (key, first_occurrence_path, duplicate_path).
@@ -37,9 +35,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
 
     duplicates = []
 
-    # Load TOML file
-    with open(file_path, 'rb') as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def process_dict(obj, current_prefix=""):
         for key, value in obj.items():
@@ -57,18 +54,18 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for TOML files (e.g., 500 KB)
+# Maximum size for JSON files (e.g., 500 KB)
 MAX_FILE_SIZE = 500 * 1024
 
 
-def parse_toml_file(file_path):
+def parse_json_file(file_path):
     """
-    Parses a TOML translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the TOML file.
+    Parses a JSON translation file and returns a flat dictionary of all keys.
+    :param file_path: Path to the JSON file.
     :return: Dictionary with flattened keys.
     """
-    with open(file_path, 'rb') as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
         items = {}
@@ -102,37 +99,38 @@ def unflatten_dict(d, sep="."):
     return result
 
 
-def write_toml_file(file_path, updated_properties):
+def write_json_file(file_path, updated_properties):
     """
-    Writes updated properties back to the TOML file.
-    :param file_path: Path to the TOML file.
+    Writes updated properties back to the JSON file.
+    :param file_path: Path to the JSON file.
     :param updated_properties: Dictionary of updated properties to write.
     """
     nested_data = unflatten_dict(updated_properties)
 
-    with open(file_path, "wb") as file:
-        tomli_w.dump(nested_data, file)
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        json.dump(nested_data, file, ensure_ascii=False, indent=2)
+        file.write("\n")  # Add trailing newline
 
 
 def update_missing_keys(reference_file, file_list, branch=""):
     """
     Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference TOML file.
+    :param reference_file: Path to the reference JSON file.
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_properties = parse_toml_file(reference_file)
+    reference_properties = parse_json_file(reference_file)
 
     for file_path in file_list:
         basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
             basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".toml")
+            or not file_path.endswith(".json")
             or not os.path.dirname(file_path).endswith("locales")
         ):
             continue
 
-        current_properties = parse_toml_file(os.path.join(branch, file_path))
+        current_properties = parse_json_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -143,16 +141,16 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_toml_file(os.path.join(branch, file_path), updated_properties)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
     update_missing_keys(reference_file, file_list, branch)
 
 
-def read_toml_keys(file_path):
+def read_json_keys(file_path):
     if os.path.isfile(file_path) and os.path.exists(file_path):
-        return parse_toml_file(file_path)
+        return parse_json_file(file_path)
     return {}
 
 
@@ -162,7 +160,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_toml_keys(reference_file)
+    reference_keys = read_json_keys(reference_file)
     has_differences = False
 
     only_reference_file = True
@@ -199,12 +197,12 @@ def check_for_differences(reference_file, file_list, branch, actor):
         ):
             continue
 
-        if not file_normpath.endswith(".toml") or basename_current_file != "translation.toml":
+        if not file_normpath.endswith(".json") or basename_current_file != "translation.json":
             continue
 
         only_reference_file = False
         report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_toml_keys(os.path.join(branch, file_path))
+        current_keys = read_json_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -274,7 +272,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.json](https://github.com/Stirling-Tools/Stirling-PDF/blob/V2/frontend/public/locales/en-GB/translation.json)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -288,7 +286,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
+    parser = argparse.ArgumentParser(description="Find missing keys")
     parser.add_argument(
         "--actor",
         required=False,
@@ -339,9 +337,9 @@ if __name__ == "__main__":
                     "public",
                     "locales",
                     "*",
-                    "translation.toml",
+                    "translation.json",
                 )
             )
         update_missing_keys(args.reference_file, file_list)
     else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_properties.py

@@ -0,0 +1,403 @@
+"""
+Author: Ludy87
+Description: This script processes .properties files for localization checks. It compares translation files in a branch with
+a reference file to ensure consistency. The script performs two main checks:
+1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
+2. Ensures that all keys in the translation files are present in the reference file and vice versa.
+
+The script also provides functionality to update the translation files to match the reference file by adding missing keys and
+adjusting the format.
+
+Usage:
+    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+"""
+# Sample for Windows:
+# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
+
+import copy
+import glob
+import os
+import argparse
+import re
+
+
+def find_duplicate_keys(file_path):
+    """
+    Identifies duplicate keys in a .properties file.
+    :param file_path: Path to the .properties file.
+    :return: List of tuples (key, first_occurrence_line, duplicate_line).
+    """
+    keys = {}
+    duplicates = []
+
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Skip empty lines and comments
+            if not stripped_line or stripped_line.startswith("#"):
+                continue
+
+            # Split the line into key and value
+            if "=" in stripped_line:
+                key, _ = stripped_line.split("=", 1)
+                key = key.strip()
+
+                # Check if the key already exists
+                if key in keys:
+                    duplicates.append((key, keys[key], line_number))
+                else:
+                    keys[key] = line_number
+
+    return duplicates
+
+
+# Maximum size for properties files (e.g., 200 KB)
+MAX_FILE_SIZE = 200 * 1024
+
+
+def parse_properties_file(file_path):
+    """
+    Parses a .properties file and returns a structured list of its contents.
+    :param file_path: Path to the .properties file.
+    :return: List of dictionaries representing each line in the file.
+    """
+    properties_list = []
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Handle empty lines
+            if not stripped_line:
+                properties_list.append(
+                    {"line_number": line_number, "type": "empty", "content": ""}
+                )
+                continue
+
+            # Handle comments
+            if stripped_line.startswith("#"):
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "comment",
+                        "content": stripped_line,
+                    }
+                )
+                continue
+
+            # Handle key-value pairs
+            match = re.match(r"^([^=]+)=(.*)$", line)
+            if match:
+                key, value = match.groups()
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "entry",
+                        "key": key.strip(),
+                        "value": value.strip(),
+                    }
+                )
+
+    return properties_list
+
+
+def write_json_file(file_path, updated_properties):
+    """
+    Writes updated properties back to the file in their original format.
+    :param file_path: Path to the .properties file.
+    :param updated_properties: List of updated properties to write.
+    """
+    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
+
+    # Sort lines by their numbers and retain comments and empty lines
+    all_lines = sorted(set(updated_lines.keys()))
+
+    original_format = []
+    for line in all_lines:
+        if line in updated_lines:
+            entry = updated_lines[line]
+        else:
+            entry = None
+        ref_entry = updated_lines[line]
+        if ref_entry["type"] in ["comment", "empty"]:
+            original_format.append(ref_entry)
+        elif entry is None:
+            # Add missing entries from the reference file
+            original_format.append(ref_entry)
+        elif entry["type"] == "entry":
+            # Replace entries with those from the current JSON
+            original_format.append(entry)
+
+    # Write the updated content back to the file
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        for entry in original_format:
+            if entry["type"] == "comment":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "empty":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "entry":
+                file.write(f"{entry['key']}={entry['value']}\n")
+
+
+def update_missing_keys(reference_file, file_list, branch=""):
+    """
+    Updates missing keys in the translation files based on the reference file.
+    :param reference_file: Path to the reference .properties file.
+    :param file_list: List of translation files to update.
+    :param branch: Branch where the files are located.
+    """
+    reference_properties = parse_properties_file(reference_file)
+    for file_path in file_list:
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
+        if (
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+
+        current_properties = parse_properties_file(os.path.join(branch, file_path))
+        updated_properties = []
+        for ref_entry in reference_properties:
+            ref_entry_copy = copy.deepcopy(ref_entry)
+            for current_entry in current_properties:
+                if current_entry["type"] == "entry":
+                    if ref_entry_copy["type"] != "entry":
+                        continue
+                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
+                        ref_entry_copy["value"] = current_entry["value"]
+            updated_properties.append(ref_entry_copy)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
+
+
+def check_for_missing_keys(reference_file, file_list, branch):
+    update_missing_keys(reference_file, file_list, branch)
+
+
+def read_properties(file_path):
+    if os.path.isfile(file_path) and os.path.exists(file_path):
+        with open(file_path, "r", encoding="utf-8") as file:
+            return file.read().splitlines()
+    return [""]
+
+
+def check_for_differences(reference_file, file_list, branch, actor):
+    reference_branch = reference_file.split("/")[0]
+    basename_reference_file = os.path.basename(reference_file)
+
+    report = []
+    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
+    reference_lines = read_properties(reference_file)
+    has_differences = False
+
+    only_reference_file = True
+
+    file_arr = file_list
+
+    if len(file_list) == 1:
+        file_arr = file_list[0].split()
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "app", "core", "src", "main", "resources")
+    )
+
+    for file_path in file_arr:
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)
+        # Verify that file is within the expected directory
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")
+        # Verify file size before processing
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
+            )
+
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        if (
+            basename_current_file == basename_reference_file
+            or (
+                # only local windows command
+                not file_normpath.startswith(
+                    os.path.join(
+                        "", "app", "core", "src", "main", "resources", "messages_"
+                    )
+                )
+                and not file_normpath.startswith(
+                    os.path.join(
+                        os.getcwd(),
+                        "app",
+                        "core",
+                        "src",
+                        "main",
+                        "resources",
+                        "messages_",
+                    )
+                )
+            )
+            or not file_normpath.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+        only_reference_file = False
+        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
+        current_lines = read_properties(os.path.join(branch, file_path))
+        reference_line_count = len(reference_lines)
+        current_line_count = len(current_lines)
+
+        if reference_line_count != current_line_count:
+            report.append("")
+            report.append("1. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            has_differences = True
+            if reference_line_count > current_line_count:
+                report.append(
+                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
+                )
+            elif reference_line_count < current_line_count:
+                report.append(
+                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
+                )
+        else:
+            report.append("1. **Test Status:** ✅ **_Passed_**")
+
+        # Check for missing or extra keys
+        current_keys = []
+        reference_keys = []
+        for line in current_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                current_keys.append(key)
+        for line in reference_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                reference_keys.append(key)
+
+        current_keys_set = set(current_keys)
+        reference_keys_set = set(reference_keys)
+        missing_keys = current_keys_set.difference(reference_keys_set)
+        extra_keys = reference_keys_set.difference(current_keys_set)
+        missing_keys_list = list(missing_keys)
+        extra_keys_list = list(extra_keys)
+
+        if missing_keys_list or extra_keys_list:
+            has_differences = True
+            missing_keys_str = "`, `".join(missing_keys_list)
+            extra_keys_str = "`, `".join(extra_keys_list)
+            report.append("2. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            if missing_keys_list:
+                spaces_keys_list = []
+                for key in missing_keys_list:
+                    if " " in key:
+                        spaces_keys_list.append(key)
+                if spaces_keys_list:
+                    spaces_keys_str = "`, `".join(spaces_keys_list)
+                    report.append(
+                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
+                    )
+                report.append(
+                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
+                )
+            if extra_keys_list:
+                report.append(
+                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
+                )
+        else:
+            report.append("2. **Test Status:** ✅ **_Passed_**")
+
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
+            has_differences = True
+            output = "\n".join(
+                [
+                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
+                    for key, first, duplicate in find_duplicate_keys(
+                        os.path.join(branch, file_normpath)
+                    )
+                ]
+            )
+            report.append("3. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            report.append("    - duplicate entries were found:")
+            report.append(output)
+        else:
+            report.append("3. **Test Status:** ✅ **_Passed_**")
+
+        report.append("")
+        report.append("---")
+        report.append("")
+    if has_differences:
+        report.append("## ❌ Overall Check Status: **_Failed_**")
+        report.append("")
+        report.append(
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/resources/messages_en_GB.properties)"
+        )
+    else:
+        report.append("## ✅ Overall Check Status: **_Success_**")
+        report.append("")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )
+
+    if not only_reference_file:
+        print("\n".join(report))
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser.add_argument(
+        "--actor",
+        required=False,
+        help="Actor from PR.",
+    )
+    parser.add_argument(
+        "--reference-file",
+        required=True,
+        help="Path to the reference file.",
+    )
+    parser.add_argument(
+        "--branch",
+        type=str,
+        required=True,
+        help="Branch name.",
+    )
+    parser.add_argument(
+        "--check-file",
+        type=str,
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    parser.add_argument(
+        "--files",
+        nargs="+",
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    args = parser.parse_args()
+
+    # Sanitize --actor input to avoid injection attacks
+    if args.actor:
+        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
+
+    # Sanitize --branch input to avoid injection attacks
+    if args.branch:
+        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
+
+    file_list = args.files
+    if file_list is None:
+        if args.check_file:
+            file_list = [args.check_file]
+        else:
+            file_list = glob.glob(
+                os.path.join(
+                    os.getcwd(),
+                    "app",
+                    "core",
+                    "src",
+                    "main",
+                    "resources",
+                    "messages_*.properties",
+                )
+            )
+        update_missing_keys(args.reference_file, file_list)
+    else:
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -52,6 +52,7 @@ jobs:
             core.setOutput('repository', pr.head.repo.full_name);
             core.setOutput('ref', pr.head.ref);
             core.setOutput('is_fork', String(pr.head.repo.fork));
+            core.setOutput('base_ref', pr.base.ref);
             core.setOutput('author', pr.user.login);
             core.setOutput('state', pr.state);
 
@@ -64,6 +65,10 @@ jobs:
           IS_FORK: ${{ steps.resolve.outputs.is_fork }}
           # nur bei workflow_dispatch gesetzt:
           ALLOW_FORK_INPUT: ${{ inputs.allow_fork }}
+          # für Auto-PR-Logik:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_BASE: ${{ steps.resolve.outputs.base_ref }}
           PR_AUTHOR: ${{ steps.resolve.outputs.author }}
         run: |
           set -e
@@ -84,8 +89,14 @@ jobs:
           else
             auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
             is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
-            if [ "$is_auth" = true ]; then
+            if [ "$PR_BASE" = "V2" ] && [ "$is_auth" = true ]; then
               should=true
+            else
+              title_has_v2=false; echo "$PR_TITLE" | grep -qiE 'v2|version.?2|version.?two' && title_has_v2=true
+              branch_has_kw=false; echo "$PR_BRANCH" | grep -qiE 'v2|react' && branch_has_kw=true
+              if [ "$is_auth" = true ] && { [ "$title_has_v2" = true ] || [ "$branch_has_kw" = true ]; }; then
+                should=true
+              fi
             fi
           fi
 
@@ -163,7 +174,7 @@ jobs:
               owner,
               repo,
               issue_number: prNumber,
-              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment for approved V2 contributors._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
+              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment triggered by V2/version2 keywords in the PR title or V2/React keywords in the branch name._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
             });
             return newComment.id;
 
@@ -383,7 +394,7 @@ jobs:
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                               `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
-                              `🔄 **Auto-deployed** for approved V2 contributors.`;
+                              `🔄 **Auto-deployed** because PR title or branch name contains V2/version2/React keywords.`;
 
             await github.rest.issues.createComment({
               owner,

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -14,7 +14,6 @@ jobs:
     permissions:
       issues: write
     if: |
-      vars.CI_PROFILE != 'lite' &&
       github.event.issue.pull_request &&
       (
         contains(github.event.comment.body, 'prdeploy') ||
@@ -181,7 +180,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha

.github/workflows/build.yml

@@ -262,13 +262,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
+        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -278,13 +272,6 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
@@ -314,7 +301,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./${{ matrix.docker-rev }}
+          file: ./docker/backend/${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -326,7 +313,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
+          name: reports-docker-${{ matrix.docker-rev }}
           path: |
             build/reports/tests/
             build/test-results/

.github/workflows/check_properties.yml

@@ -1,14 +1,19 @@
-name: Check TOML Translation Files on PR
-
-# This workflow validates TOML translation files
+name: Check Properties Files on PR
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
-      - "frontend/public/locales/*/translation.toml"
+      - "app/core/src/main/resources/messages_*.properties"
 
 # cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
   cancel-in-progress: true
@@ -68,22 +73,22 @@ jobs:
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
-          # Check if PR number exists
-          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-            echo "Error: PR number is empty"
-            exit 1
-          fi
-          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
-          # Check if any files were found
-          if [ ! -s changed_files.txt ]; then
-            echo "No TOML translation files changed in this PR"
-            echo "Workflow will exit early as no relevant files to check"
-            exit 0
-          fi
-          echo "Found $(wc -l < changed_files.txt) matching TOML files"
+                   # Check if PR number exists
+            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+              echo "Error: PR number is empty"
+              exit 1
+            fi
+            # Get changed files and filter for properties files, handle case where no matches are found
+            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
+            # Check if any files were found
+            if [ ! -s changed_files.txt ]; then
+              echo "No properties files changed in this PR"
+              echo "Workflow will exit early as no relevant files to check"
+              exit 0
+            fi
+            echo "Found $(wc -l < changed_files.txt) matching properties files"
 
-      - name: Determine reference file
+      - name: Determine reference file test
         id: determine-file
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -120,11 +125,11 @@ jobs:
               pull_number: prNumber,
             });
 
-            // Filter for relevant TOML files based on the PR changes
+            // Filter for relevant files based on the PR changes
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^app\/core\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -164,16 +169,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
+            if (changedFiles.includes("app/core/src/main/resources/messages_en_GB.properties")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-GB.toml";
+              referenceFilePath = "pr-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -181,11 +186,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-GB.toml";
+              referenceFilePath = "main-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -193,20 +198,11 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Python dependencies
-        run: |
-          pip install tomli-w
-
       - name: Run Python script to check files
         id: run-check
         run: |
-          echo "Running Python script to check TOML files..."
-          python .github/scripts/check_language_toml.py \
+          echo "Running Python script to check files..."
+          python .github/scripts/check_language_properties.py \
             --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
@@ -217,7 +213,7 @@ jobs:
         id: capture-output
         run: |
           if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Capturing output..."
+            echo "Test, capturing output..."
             SCRIPT_OUTPUT=$(cat result.txt)
             echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
             echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
@@ -231,7 +227,7 @@ jobs:
               echo "FAIL_JOB=false" >> $GITHUB_ENV
             fi
           else
-            echo "No output found."
+            echo "No update found."
             echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
             echo "FAIL_JOB=false" >> $GITHUB_ENV
           fi
@@ -253,7 +249,7 @@ jobs:
               issue_number: issueNumber
             });
 
-            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
+            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
 
             // Only update or create comments by the action user
             const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
@@ -264,7 +260,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 comment_id: comment.id,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Updated existing comment.");
             } else if (!comment) {
@@ -273,7 +269,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 issue_number: issueNumber,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Created new comment.");
             } else {
@@ -291,6 +287,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
+          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/multiOSReleases.yml

@@ -31,7 +31,6 @@ permissions:
 
 jobs:
   determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}

.github/workflows/push-docker-v2.yml

@@ -5,7 +5,6 @@ on:
   push:
     branches:
       - V2-master
-      - alljavadocker
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -24,7 +23,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-24.04-8core
     permissions:
       packages: write
@@ -95,10 +93,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
             type=raw,value=latest
 
-      - name: Generate tags for latest (alljavadocker branch - test)
+      - name: Generate tags for latest (V2-demo branch - test)
         id: meta-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
+        if: github.ref == 'refs/heads/V2-demo'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -112,7 +110,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./docker/Dockerfile.unified
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -151,10 +149,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
             type=raw,value=latest-fat
 
-      - name: Generate tags for latest-fat (alljavadocker branch - test)
+      - name: Generate tags for latest-fat (V2-demo branch - test)
         id: meta-fat-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
+        if: github.ref == 'refs/heads/V2-demo'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -168,7 +166,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./docker/Dockerfile.unified
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -205,10 +203,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
             type=raw,value=latest-ultra-lite
 
-      - name: Generate tags for ultra-lite (alljavadocker branch - test)
+      - name: Generate tags for ultra-lite (V2-demo branch - test)
         id: meta-lite-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
+        if: github.ref == 'refs/heads/V2-demo'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -222,7 +220,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
+          file: ./docker/Dockerfile.unified-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/push-docker.yml

@@ -24,7 +24,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -108,7 +107,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -153,7 +152,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
+          file: ./Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -184,7 +183,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/scorecards.yml

@@ -17,7 +17,6 @@ permissions: read-all
 
 jobs:
   analysis:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:

.github/workflows/sonarqube.yml

@@ -27,7 +27,6 @@ permissions:
 
 jobs:
   sonarqube:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/stale.yml

@@ -10,7 +10,6 @@ permissions:
 
 jobs:
   stale:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/swagger.yml

@@ -23,7 +23,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/sync_files.yml

@@ -0,0 +1,122 @@
+name: Sync Files
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+      - "README.md"
+      - "app/core/src/main/resources/messages_*.properties"
+      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
+      - "scripts/ignore_translation.toml"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-files:
+    runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+
+      - name: Sync translation property files
+        run: |
+          python .github/scripts/check_language_properties.py --reference-file "app/core/src/main/resources/messages_en_GB.properties" --branch main
+
+      - name: Commit translation files
+        run: |
+          git add app/core/src/main/resources/messages_*.properties
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+
+      - name: Install dependencies
+        # Wheels-only + Hash-Pinning
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+
+      - name: Sync README.md
+        run: |
+          python scripts/counter_translation.py
+
+      - name: Run git add
+        run: |
+          git add README.md scripts/ignore_translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
+
+      - name: Create Pull Request
+        if: always()
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: Update files
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: sync_readme
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          body: |
+            ### Description of Changes
+
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+
+            #### **1. Synchronization of Translation Files**
+            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
+            - Ensured consistency and synchronization across all supported language files.
+            - Highlighted any missing or incomplete translations.
+
+            #### **2. Update README.md**
+            - Generated the translation progress table in `README.md`.
+            - Added a summary of the current translation status for all supported languages.
+            - Included up-to-date statistics on translation coverage.
+
+            #### **Why these changes are necessary**
+            - Keeps translation files aligned with the latest reference updates.
+            - Ensures the documentation reflects the current translation progress.
+
+            ---
+
+            Auto-generated by [create-pull-request][1].
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
+          add-paths: |
+            README.md
+            app/core/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,15 +1,15 @@
-name: Sync Files (TOML)
+name: Sync Files V2
 
 on:
   workflow_dispatch:
   push:
     branches:
-      - main
+      - V2
       - syncLangTest
     paths:
       - "build.gradle"
       - "README.md"
-      - "frontend/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.json"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
       - "scripts/ignore_translation.toml"
 
@@ -52,25 +52,21 @@ jobs:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
-      - name: Install Python dependencies
+      - name: Sync translation JSON files
         run: |
-          pip install tomli-w
-
-      - name: Sync translation TOML files
-        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
+          python .github/scripts/check_language_json.py --reference-file "frontend/public/locales/en-GB/translation.json" --branch V2
 
       - name: Commit translation files
         run: |
-          git add frontend/public/locales/*/translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
+          git add frontend/public/locales/*/translation.json
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
 
-      - name: Install README dependencies
+      - name: Install dependencies
         run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Sync README.md
         run: |
-          python scripts/counter_translation_v3.py
+          python scripts/counter_translation_v2.py
 
       - name: Run git add
         run: |
@@ -86,22 +82,21 @@ jobs:
           committer: ${{ steps.setup-bot.outputs.committer }}
           author: ${{ steps.setup-bot.outputs.committer }}
           signoff: true
-          branch: sync_readme_v3
-          base: main
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          branch: sync_readme_v2
+          base: V2
+          title: ":globe_with_meridians: [V2] Sync Translations + Update README Progress Table"
           body: |
             ### Description of Changes
 
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation for the **V2 branch**. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.json`) to reflect changes in the reference file `en-GB/translation.json`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
-            - **Format**: TOML
 
             #### **2. Update README.md**
-            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
+            - Generated the translation progress table in `README.md`.
             - Added a summary of the current translation status for all supported languages.
             - Included up-to-date statistics on translation coverage.
 
@@ -120,5 +115,4 @@ jobs:
           sign-commits: true
           add-paths: |
             README.md
-            frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            frontend/public/locales/*/translation.json

.github/workflows/tauri-build.yml

@@ -28,7 +28,6 @@ permissions:
 
 jobs:
   determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -637,8 +636,6 @@ jobs:
           if [ "${{ needs.build.result }}" = "success" ]; then
             echo "✅ All Tauri builds completed successfully!"
             echo "Artifacts are ready for distribution."
-          elif [ "${{ needs.build.result }}" = "skipped" ]; then
-            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
           else
             echo "❌ Some Tauri builds failed."
             echo "Please check the logs and fix any issues."

.github/workflows/testdriver.yml

@@ -21,7 +21,6 @@ permissions:
 
 jobs:
   deploy:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -67,7 +66,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

ADDING_TOOLS.md

@@ -202,10 +202,10 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-GB/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.json`
 
 **Required Translation Keys**:
-```toml
+```json
 {
   "home": {
     "[toolName]": {
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-GB/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.json`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

README.md

@@ -1,69 +1,173 @@
-<p align="center">
-  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
-</p>
+<p align="center"><img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80"></p>
+<h1 align="center">Stirling-PDF</h1>
 
-<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
+[![Docker Pulls](https://img.shields.io/docker/pulls/frooodle/s-pdf)](https://hub.docker.com/r/frooodle/s-pdf)
+[![Discord](https://img.shields.io/discord/1068636748814483718?label=Discord)](https://discord.gg/HYmhKj45pU)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge)](https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF)
+[![GitHub Repo stars](https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social)](https://github.com/Stirling-Tools/stirling-pdf)
 
-Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
+<a href="https://www.producthunt.com/posts/stirling-pdf?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-stirling&#0045;pdf" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=641239&theme=light" alt="Stirling&#0032;PDF - Open&#0032;source&#0032;locally&#0032;hosted&#0032;web&#0032;PDF&#0032;editor | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/apps/new?repo=https://github.com/Stirling-Tools/Stirling-PDF/tree/digitalOcean&refcode=c3210994b1af)
 
-<p align="center">
-  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
-    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
-  </a>
-  <a href="https://discord.gg/HYmhKj45pU">
-    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
-  </a>
-  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
-    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
-  </a>
-  <a href="https://github.com/Stirling-Tools/stirling-pdf">
-    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
-  </a>
-</p>
+[Stirling-PDF](https://www.stirlingpdf.com) is a robust, locally hosted web-based PDF manipulation tool using Docker. It enables you to carry out various operations on PDF files, including splitting, merging, converting, reorganizing, adding images, rotating, compressing, and more. This locally hosted web application has evolved to encompass a comprehensive set of features, addressing all your PDF requirements.
 
-![Stirling PDF - Dashboard](images/home-light.png)
+All files and PDFs exist either exclusively on the client side, reside in server memory only during task execution, or temporarily reside in a file solely for the execution of the task. Any file downloaded by the user will have been deleted from the server by that point.
 
-## Key Capabilities
+Homepage: [https://stirlingpdf.com](https://stirlingpdf.com)
 
-- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
-- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
-- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
-- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
-- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
-- **Global UI** - Interface available in 40+ languages.
+All documentation available at [https://docs.stirlingpdf.com/](https://docs.stirlingpdf.com/)
 
-For a full feature list, see the docs: **https://docs.stirlingpdf.com**
+![stirling-home](images/stirling-home.jpg)
 
-## Quick Start
+## Features
 
-```bash
-docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
-```
+- 50+ PDF Operations
+- Parallel file processing and downloads
+- Dark mode support
+- Custom download options
+- Custom 'Pipelines' to run multiple features in a automated queue
+- API for integration with external scripts
+- Optional Login and Authentication support (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/System%20and%20Security) for documentation)
+- Database Backup and Import (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/DATABASE) for documentation)
+- Enterprise features like SSO (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/Single%20Sign-On%20Configuration) for documentation)
 
-Then open: http://localhost:8080
+## PDF Features
 
-For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
+### Page Operations
 
-## Resources
+- View and modify PDFs - View multi-page PDFs with custom viewing, sorting, and searching. Plus, on-page edit features like annotating, drawing, and adding text and images. (Using PDF.js with Joxit and Liberation fonts)
+- Full interactive GUI for merging/splitting/rotating/moving PDFs and their pages
+- Merge multiple PDFs into a single resultant file
+- Split PDFs into multiple files at specified page numbers or extract all pages as individual files
+- Reorganize PDF pages into different orders
+- Rotate PDFs in 90-degree increments
+- Remove pages
+- Multi-page layout (format PDFs into a multi-paged page)
+- Scale page contents size by set percentage
+- Adjust contrast
+- Crop PDF
+- Auto-split PDF (with physically scanned page dividers)
+- Extract page(s)
+- Convert PDF to a single page
+- Overlay PDFs on top of each other
+- PDF to a single page
+- Split PDF by sections
 
-- [**Documentation**](https://docs.stirlingpdf.com)
-- [**Homepage**](https://stirling.com)
-- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
-- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
+### Conversion Operations
 
-## Support
+- Convert PDFs to and from images
+- Convert any common file to PDF (using LibreOffice)
+- Convert PDF to Word/PowerPoint/others (using LibreOffice)
+- Convert HTML to PDF
+- Convert PDF to XML
+- Convert PDF to CSV
+- URL to PDF
+- Markdown to PDF
 
-- **Community** [Discord](https://discord.gg/HYmhKj45pU)
-- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+### Security & Permissions
 
-## Contributing
+- Add and remove passwords
+- Change/set PDF permissions
+- Add watermark(s)
+- Certify/sign PDFs
+- Sanitize PDFs
+- Auto-redact text
 
-We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+### Other Operations
 
-For development setup, see the [Developer Guide](DeveloperGuide.md).
+- Add/generate/write signatures
+- Split by Size or PDF
+- Repair PDFs
+- Detect and remove blank pages
+- Compare two PDFs and show differences in text
+- Add images to PDFs
+- Compress PDFs to decrease their filesize (using qpdf)
+- Extract images from PDF
+- Remove images from PDF
+- Extract images from scans
+- Remove annotations
+- Add page numbers
+- Auto-rename files by detecting PDF header text
+- OCR on PDF (using Tesseract OCR)
+- PDF/A conversion (using LibreOffice)
+- Edit metadata
+- Flatten PDFs
+- Get all information on a PDF to view or export as JSON
+- Show/detect embedded JavaScript
 
-For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
 
-## License
 
-Stirling PDF is open-core. See [LICENSE](LICENSE) for details.
+# 📖 Get Started
+
+Visit our comprehensive documentation at [docs.stirlingpdf.com](https://docs.stirlingpdf.com) for:
+
+- Installation guides for all platforms
+- Configuration options
+- Feature documentation
+- API reference
+- Security setup
+- Enterprise features
+
+
+## Supported Languages
+
+Stirling-PDF currently supports 40 languages!
+
+| Language                                     | Progress                               |
+| -------------------------------------------- | -------------------------------------- |
+| Arabic (العربية) (ar_AR)                        | ![87%](https://geps.dev/progress/87)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![86%](https://geps.dev/progress/86)   |
+| Basque (Euskara) (eu_ES)                     | ![86%](https://geps.dev/progress/86)   |
+| Bulgarian (Български) (bg_BG)                | ![86%](https://geps.dev/progress/86)   |
+| Catalan (Català) (ca_CA)                     | ![85%](https://geps.dev/progress/85)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![86%](https://geps.dev/progress/86)   |
+| Czech (Česky) (cs_CZ)                        | ![84%](https://geps.dev/progress/84)   |
+| Danish (Dansk) (da_DK)                       | ![85%](https://geps.dev/progress/85)   |
+| Dutch (Nederlands) (nl_NL)                   | ![85%](https://geps.dev/progress/85)   |
+| English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
+| English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
+| French (Français) (fr_FR)                    | ![85%](https://geps.dev/progress/85)   |
+| German (Deutsch) (de_DE)                     | ![86%](https://geps.dev/progress/86)   |
+| Greek (Ελληνικά) (el_GR)                     | ![86%](https://geps.dev/progress/86)   |
+| Hindi (हिंदी) (hi_IN)                          | ![86%](https://geps.dev/progress/86)   |
+| Hungarian (Magyar) (hu_HU)                   | ![86%](https://geps.dev/progress/86)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![85%](https://geps.dev/progress/85)   |
+| Irish (Gaeilge) (ga_IE)                      | ![86%](https://geps.dev/progress/86)   |
+| Italian (Italiano) (it_IT)                   | ![85%](https://geps.dev/progress/85)   |
+| Japanese (日本語) (ja_JP)                    | ![86%](https://geps.dev/progress/86)   |
+| Korean (한국어) (ko_KR)                      | ![86%](https://geps.dev/progress/86)   |
+| Norwegian (Norsk) (no_NB)                    | ![86%](https://geps.dev/progress/86)   |
+| Persian (فارسی) (fa_IR)                      | ![86%](https://geps.dev/progress/86)   |
+| Polish (Polski) (pl_PL)                      | ![86%](https://geps.dev/progress/86)   |
+| Portuguese (Português) (pt_PT)               | ![86%](https://geps.dev/progress/86)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![86%](https://geps.dev/progress/86)   |
+| Romanian (Română) (ro_RO)                    | ![85%](https://geps.dev/progress/85)   |
+| Russian (Русский) (ru_RU)                    | ![86%](https://geps.dev/progress/86)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![86%](https://geps.dev/progress/86)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![87%](https://geps.dev/progress/87)   |
+| Slovakian (Slovensky) (sk_SK)                | ![86%](https://geps.dev/progress/86)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![86%](https://geps.dev/progress/86)   |
+| Spanish (Español) (es_ES)                    | ![86%](https://geps.dev/progress/86)   |
+| Swedish (Svenska) (sv_SE)                    | ![86%](https://geps.dev/progress/86)   |
+| Thai (ไทย) (th_TH)                           | ![86%](https://geps.dev/progress/86)   |
+| Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![87%](https://geps.dev/progress/87)   |
+| Turkish (Türkçe) (tr_TR)                     | ![86%](https://geps.dev/progress/86)   |
+| Ukrainian (Українська) (uk_UA)               | ![86%](https://geps.dev/progress/86)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![86%](https://geps.dev/progress/86)   |
+| Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
+
+## Stirling PDF Enterprise
+
+Stirling PDF offers an Enterprise edition of its software. This is the same great software but with added features, support and comforts.
+Check out our [Enterprise docs](https://docs.stirlingpdf.com/Pro)
+
+
+## 🤝 Looking to contribute?
+
+Join our community:
+- [Contribution Guidelines](CONTRIBUTING.md)
+- [Translation Guide (How to add custom languages)](devGuide/HowToAddNewLanguage.md)
+- [Developer Guide](devGuide/DeveloperGuide.md)
+- [Issue Tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+- [Discord Community](https://discord.gg/HYmhKj45pU)

app/common/build.gradle

@@ -33,16 +33,16 @@ dependencies {
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
-    api 'org.apache.commons:commons-lang3:3.19.0'
+    api 'org.apache.commons:commons-lang3:3.17.0'
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:2.10'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.13"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14"
     api 'jakarta.mail:jakarta.mail-api:2.1.5'
     runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
 }

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -491,9 +491,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Ghostscript", "repair");
         addEndpointToGroup("Ghostscript", "compress-pdf");
 
-        /* ImageMagick */
-        addEndpointToGroup("ImageMagick", "compress-pdf");
-
         /* tesseract */
         addEndpointToGroup("tesseract", "ocr-pdf");
 
@@ -577,7 +574,6 @@ public class EndpointConfiguration {
                 || "Javascript".equals(group)
                 || "Weasyprint".equals(group)
                 || "Pdftohtml".equals(group)
-                || "ImageMagick".equals(group)
                 || "rar".equals(group);
     }
 

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
-                Use these endpoints to understand what's inside a document without changing it.
+                Document analysis and information extraction services for content intelligence and insights.
 
-                Typical uses:
-                • Get page counts and dimensions for layout or print rules
-                • List fonts and annotations to spot compatibility issues
-                • Inspect form fields before deciding how to fill or modify them
-                • Pull metadata and security settings for audits or reports
+                This endpoint group provides analytical capabilities to understand document structure,
+                extract information, and generate insights from PDF content for automated processing.
+
+                Common use cases:
+                • Document inventory management and content audit for compliance verification
+                • Quality assurance workflows and business intelligence analytics
+                • Migration planning, accessibility evaluation, and document forensics
+
+                Business applications:
+                • Legal discovery, financial document review, and healthcare records analysis
+                • Academic research, government processing, and publishing optimization
+
+                Operational scenarios:
+                • Large-scale profiling, migration assessment, and performance optimization
+                • Automated quality control and content strategy development
+
+                Target users: Data analysts, QA teams, administrators, and business intelligence
+                professionals requiring detailed document insights.
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
-                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
+                Document format transformation services for cross-platform compatibility and workflow integration.
 
-                Typical uses:
-                • Turn PDFs into Word or text for editing
-                • Convert office files, images, HTML, or email (EML) into PDFs
-                • Create PDF/A for long-term archiving
-                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
+                This endpoint group enables transformation between various formats, supporting
+                diverse business workflows and system integrations for mixed document ecosystems.
+
+                Common use cases:
+                • Legacy system integration, document migration, and cross-platform sharing
+                • Archive standardization, publishing preparation, and content adaptation
+                • Accessibility compliance and mobile-friendly document preparation
+
+                Business applications:
+                • Enterprise content management, digital publishing, and educational platforms
+                • Legal document processing, healthcare interoperability, and government standardization
+
+                Integration scenarios:
+                • API-driven pipelines, automated workflow preparation, and batch conversions
+                • Real-time format adaptation for user requests
+
+                Target users: System integrators, content managers, digital archivists, and
+                organizations requiring flexible document format interoperability.
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
-                Use these endpoints as a "pre-check" step to decide what to do with a file next.
+                Document content filtering and search operations for information discovery and organization.
 
-                Typical uses:
-                • Reject files that are too big or too small
-                • Detect image-only PDFs that should go through OCR
-                • Ensure a document has enough pages before it enters a workflow
-                • Check orientation of pages before printing or merging
+                This endpoint group enables intelligent content discovery and organization within
+                document collections for content-based processing and information extraction.
+
+                Common use cases:
+                • Legal discovery, research organization, and compliance auditing
+                • Content moderation, academic research, and business intelligence
+                • Quality assurance and content validation workflows
+
+                Business applications:
+                • Contract analysis, financial review, and healthcare records organization
+                • Government processing, educational curation, and IP protection
+
+                Workflow scenarios:
+                • Large-scale processing, automated classification, and information extraction
+                • Document preparation for further processing or analysis
+
+                Target users: Legal professionals, researchers, compliance officers, and
+                organizations requiring intelligent document content discovery and organization.
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,13 +22,21 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
-                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
+                Core PDF processing operations for fundamental document manipulation workflows.
 
-                Typical uses:
-                • Split a large PDF into smaller files (by pages, chapters, or size)
-                • Merge several PDFs into one report or pack
-                • Rotate or reorder pages before sending or archiving
-                • Turn a multi-page document into one long scrolling page
+                This endpoint group provides essential PDF functionality that forms the foundation
+                of most document processing workflows across various industries.
+
+                Common use cases:
+                • Document preparation for archival systems and content organization
+                • File preparation for distribution, accessibility compliance, and batch processing
+                • Document consolidation for reporting and legal compliance workflows
+
+                Typical applications:
+                • Content management, publishing workflows, and educational content distribution
+                • Business process automation and archive management
+
+                Target users: Content managers, document processors, and organizations requiring
+                reliable foundational PDF manipulation capabilities.
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,15 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
-                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
+                Specialized utilities and supplementary tools for enhanced document processing workflows.
 
-                Typical uses:
-                • Repair a damaged PDF or remove blank pages
-                • Run OCR on scanned PDFs so they become searchable
-                • Compress large PDFs for email or web download
-                • Extract embedded images or scans
-                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
-                • Update PDF metadata (title, author, etc.)
+                This endpoint group provides utility operations that support core document processing
+                tasks and address specific workflow needs in real-world scenarios.
+
+                Common use cases:
+                • Document optimization for bandwidth-limited environments and storage cost management
+                • Document repair, content extraction, and validation for quality assurance
+                • Accessibility improvement and custom processing for specialized needs
+
+                Business applications:
+                • Web publishing optimization, email attachment management, and archive efficiency
+                • Mobile compatibility, print production, and legacy document recovery
+
+                Operational scenarios:
+                • Batch processing, quality control, and performance optimization
+                • Troubleshooting and recovery of problematic documents
+
+                Target users: System administrators, document specialists, and organizations requiring
+                specialized document processing and optimization tools.
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,12 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
-                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
+                Automated document processing workflows for complex multi-stage business operations.
 
-                Typical uses:
-                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
-                • Normalise documents before they enter an archive
-                • Wrap a complex document flow behind a single API call for your own apps
+                This endpoint group enables organizations to create sophisticated document processing
+                workflows that combine multiple operations into streamlined, repeatable processes.
+
+                Common use cases:
+                • Invoice processing, legal document review, and healthcare records standardization
+                • Government processing, educational content preparation, and publishing automation
+                • Contract lifecycle management and approval processes
+
+                Business applications:
+                • Automated compliance reporting, large-scale migration, and quality assurance
+                • Archive preparation, content delivery, and document approval workflows
+
+                Operational scenarios:
+                • Scheduled batch processing and event-driven document processing
+                • Multi-department coordination and business system integration
+
+                Target users: Business process managers, IT automation specialists, and organizations
+                requiring consistent, repeatable document processing workflows.
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
-                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
+                Document security and protection services for confidential and sensitive content.
 
-                Typical uses:
-                • Add or remove a password on a PDF
-                • Redact personal or confidential information (manually or automatically)
-                • Validate or remove digital signatures
-                • Sanitize a PDF to strip scripts and embedded content
+                This endpoint group provides essential security operations for organizations handling
+                sensitive documents and materials requiring controlled access.
+
+                Common use cases:
+                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
+                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
+                • Contract security for business transactions
+
+                Business applications:
+                • Document authentication, confidential sharing, and secure archiving
+                • Content watermarking, access control, and privacy protection through redaction
+
+                Industry scenarios:
+                • Legal discovery, medical records exchange, financial audit documentation
+                • Enterprise policy enforcement and data governance
+
+                Target users: Legal professionals, healthcare administrators, compliance officers,
+                government agencies, and enterprises handling sensitive content.
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -68,7 +68,6 @@ public class ApplicationProperties {
 
     private AutoPipeline autoPipeline = new AutoPipeline();
     private ProcessExecutor processExecutor = new ProcessExecutor();
-    private PdfEditor pdfEditor = new PdfEditor();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -101,46 +100,6 @@ public class ApplicationProperties {
         private String outputFolder;
     }
 
-    @Data
-    public static class PdfEditor {
-        private Cache cache = new Cache();
-        private FontNormalization fontNormalization = new FontNormalization();
-        private CffConverter cffConverter = new CffConverter();
-        private Type3 type3 = new Type3();
-        private String fallbackFont = "classpath:/static/fonts/NotoSans-Regular.ttf";
-
-        @Data
-        public static class Cache {
-            private long maxBytes = -1;
-            private int maxPercent = 20;
-        }
-
-        @Data
-        public static class FontNormalization {
-            private boolean enabled = false;
-        }
-
-        @Data
-        public static class CffConverter {
-            private boolean enabled = true;
-            private String method = "python";
-            private String pythonCommand = "/opt/venv/bin/python3";
-            private String pythonScript = "/scripts/convert_cff_to_ttf.py";
-            private String fontforgeCommand = "fontforge";
-        }
-
-        @Data
-        public static class Type3 {
-            private Library library = new Library();
-
-            @Data
-            public static class Library {
-                private boolean enabled = true;
-                private String index = "classpath:/type3/library/index.json";
-            }
-        }
-    }
-
     @Data
     public static class Legal {
         private String termsAndConditions;
@@ -153,6 +112,7 @@ public class ApplicationProperties {
     @Data
     public static class Security {
         private Boolean enableLogin;
+        private Boolean csrfDisabled;
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
@@ -398,7 +358,6 @@ public class ApplicationProperties {
         private Boolean enableAnalytics;
         private Boolean enablePosthog;
         private Boolean enableScarf;
-        private Boolean enableDesktopInstallSlide;
         private Datasource datasource;
         private Boolean disableSanitize;
         private int maxDPI;
@@ -409,12 +368,10 @@ public class ApplicationProperties {
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
         private List<String> corsAllowedOrigins = new ArrayList<>();
-        private String backendUrl; // Backend base URL for SAML/OAuth/API callbacks (e.g.
-        // 'http://localhost:8080', 'https://api.example.com'). Required for
-        // SSO.
-        private String frontendUrl; // Frontend URL for invite email links (e.g.
+        private String
+                frontendUrl; // Base URL for frontend (used for invite links, etc.). If not set,
 
-        // 'https://app.example.com'). If not set, falls back to backendUrl.
+        // falls back to backend URL.
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -579,7 +536,6 @@ public class ApplicationProperties {
         @ToString.Exclude private String key;
         private String UUID;
         private String appVersion;
-        private Boolean isNewServer;
     }
 
     // TODO: Remove post migration
@@ -619,16 +575,6 @@ public class ApplicationProperties {
         private String username;
         @ToString.Exclude private String password;
         private String from;
-        // STARTTLS upgrades a plain SMTP connection to TLS after connecting (RFC 3207)
-        private Boolean startTlsEnable = true;
-        private Boolean startTlsRequired;
-        // SSL/TLS wrapper for implicit TLS (typically port 465)
-        private Boolean sslEnable;
-        // Hostnames or patterns (e.g., "smtp.example.com" or "*") to trust for TLS certificates;
-        // defaults to "*" (trust all) when not set
-        private String sslTrust;
-        // Enables hostname verification for TLS connections
-        private Boolean sslCheckServerIdentity;
     }
 
     @Data
@@ -697,7 +643,6 @@ public class ApplicationProperties {
             private int weasyPrintSessionLimit;
             private int installAppSessionLimit;
             private int calibreSessionLimit;
-            private int imageMagickSessionLimit;
             private int qpdfSessionLimit;
             private int tesseractSessionLimit;
             private int ghostscriptSessionLimit;
@@ -735,10 +680,6 @@ public class ApplicationProperties {
                 return calibreSessionLimit > 0 ? calibreSessionLimit : 1;
             }
 
-            public int getImageMagickSessionLimit() {
-                return imageMagickSessionLimit > 0 ? imageMagickSessionLimit : 4;
-            }
-
             public int getGhostscriptSessionLimit() {
                 return ghostscriptSessionLimit > 0 ? ghostscriptSessionLimit : 8;
             }
@@ -768,8 +709,6 @@ public class ApplicationProperties {
             @JsonProperty("calibretimeoutMinutes")
             private long calibreTimeoutMinutes;
 
-            private long imageMagickTimeoutMinutes;
-
             private long tesseractTimeoutMinutes;
             private long qpdfTimeoutMinutes;
             private long ghostscriptTimeoutMinutes;
@@ -807,10 +746,6 @@ public class ApplicationProperties {
                 return calibreTimeoutMinutes > 0 ? calibreTimeoutMinutes : 30;
             }
 
-            public long getImageMagickTimeoutMinutes() {
-                return imageMagickTimeoutMinutes > 0 ? imageMagickTimeoutMinutes : 30;
-            }
-
             public long getGhostscriptTimeoutMinutes() {
                 return ghostscriptTimeoutMinutes > 0 ? ghostscriptTimeoutMinutes : 30;
             }

app/common/src/main/java/stirling/software/common/model/api/security/AddParticipantsRequest.java

@@ -0,0 +1,14 @@
+package stirling.software.common.model.api.security;
+
+import java.util.List;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class AddParticipantsRequest {
+    private List<Long> participantUserIds;
+}

app/common/src/main/java/stirling/software/common/model/api/security/CreateSigningSessionRequest.java

@@ -0,0 +1,48 @@
+package stirling.software.common.model.api.security;
+
+import java.util.List;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import stirling.software.common.model.api.PDFFile;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class CreateSigningSessionRequest extends PDFFile {
+
+    @Schema(description = "Owner email used for activity updates")
+    private String ownerEmail;
+
+    @Schema(
+            description = "User IDs of participants to invite for signing",
+            requiredMode = Schema.RequiredMode.REQUIRED)
+    private List<Long> participantUserIds;
+
+    @Schema(description = "Optional message included in notifications")
+    private String message;
+
+    @Schema(description = "Optional due date for reminders (ISO-8601 date)")
+    private String dueDate;
+
+    @Schema(description = "Whether to send notifications immediately")
+    private Boolean notifyOnCreate;
+
+    // Signature appearance settings (owner-controlled, applied to all participants)
+    @Schema(description = "Whether to show visible signature")
+    private Boolean showSignature;
+
+    @Schema(description = "Page number for signature (1-indexed)")
+    private Integer pageNumber;
+
+    @Schema(description = "Signature reason")
+    private String reason;
+
+    @Schema(description = "Signature location")
+    private String location;
+
+    @Schema(description = "Whether to show Stirling PDF logo in signature")
+    private Boolean showLogo;
+}

app/common/src/main/java/stirling/software/common/model/api/security/NotifySigningParticipantsRequest.java

@@ -0,0 +1,17 @@
+package stirling.software.common.model.api.security;
+
+import java.util.List;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+
+@Data
+public class NotifySigningParticipantsRequest {
+
+    @Schema(description = "Participants to notify; defaults to all if omitted")
+    private List<String> participantEmails;
+
+    @Schema(description = "Notification message to deliver")
+    private String message;
+}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantCertificateRequest.java

@@ -0,0 +1,50 @@
+package stirling.software.common.model.api.security;
+
+import org.springframework.web.multipart.MultipartFile;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+
+@Data
+public class ParticipantCertificateRequest {
+
+    @Schema(
+            description = "Certificate type for the participant",
+            allowableValues = {"PEM", "PKCS12", "PFX", "JKS", "SERVER"},
+            requiredMode = Schema.RequiredMode.REQUIRED)
+    private String certType;
+
+    @Schema(description = "Password for keystore or private key", format = "password")
+    private String password;
+
+    @Schema(description = "Private key for PEM flow")
+    private MultipartFile privateKeyFile;
+
+    @Schema(description = "Certificate for PEM flow")
+    private MultipartFile certFile;
+
+    @Schema(description = "PKCS12/PFX keystore")
+    private MultipartFile p12File;
+
+    @Schema(description = "JKS keystore")
+    private MultipartFile jksFile;
+
+    @Schema(description = "Display the signature visually")
+    private Boolean showSignature;
+
+    @Schema(description = "Page number for visible signature (1-indexed)")
+    private Integer pageNumber;
+
+    @Schema(description = "Custom signer name override")
+    private String name;
+
+    @Schema(description = "Signing reason")
+    private String reason;
+
+    @Schema(description = "Signing location")
+    private String location;
+
+    @Schema(description = "Show the Stirling PDF logo in the appearance")
+    private Boolean showLogo;
+}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantCertificateSubmission.java

@@ -0,0 +1,21 @@
+package stirling.software.common.model.api.security;
+
+import lombok.Builder;
+import lombok.Data;
+
+@Data
+@Builder
+public class ParticipantCertificateSubmission {
+    private String certType;
+    private String password;
+    private byte[] privateKey;
+    private byte[] certificate;
+    private byte[] p12Keystore;
+    private byte[] jksKeystore;
+    private Boolean showSignature;
+    private Integer pageNumber;
+    private String name;
+    private String reason;
+    private String location;
+    private Boolean showLogo;
+}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantDTO.java

@@ -0,0 +1,25 @@
+package stirling.software.common.model.api.security;
+
+import java.time.LocalDateTime;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class ParticipantDTO {
+    private Long userId;
+    private String username;
+    private String displayName;
+    private ParticipantStatus status;
+    private LocalDateTime lastUpdated;
+
+    // Signature appearance settings (owner-controlled)
+    private Boolean showSignature;
+    private Integer pageNumber;
+    private String reason;
+    private String location;
+    private Boolean showLogo;
+}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantStatus.java

@@ -0,0 +1,9 @@
+package stirling.software.common.model.api.security;
+
+public enum ParticipantStatus {
+    PENDING,
+    NOTIFIED,
+    VIEWED,
+    SIGNED,
+    DECLINED
+}

app/common/src/main/java/stirling/software/common/model/api/security/SignDocumentRequest.java

@@ -0,0 +1,81 @@
+package stirling.software.common.model.api.security;
+
+import org.springframework.web.multipart.MultipartFile;
+
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * Request object for signing a document. Combines certificate submission data with optional wet
+ * signature (visual signature) metadata.
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SignDocumentRequest {
+
+    // Certificate-related fields
+    @NotNull(message = "Certificate type is required")
+    @Pattern(
+            regexp = "SERVER|USER_CERT|UPLOAD|PEM|PKCS12|PFX|JKS",
+            message = "Invalid certificate type")
+    private String certType;
+
+    private MultipartFile p12File;
+    private String password;
+    private MultipartFile privateKeyFile;
+    private MultipartFile certFile;
+
+    // Wet signature metadata fields (optional)
+    private String wetSignatureType; // "canvas" | "image" | "text"
+    private String wetSignatureData; // Base64 image data or text
+    private Integer wetSignaturePage; // Zero-indexed page number
+    private Double wetSignatureX; // X coordinate in PDF points
+    private Double wetSignatureY; // Y coordinate in PDF points (top-left origin)
+    private Double wetSignatureWidth; // Width in PDF points
+    private Double wetSignatureHeight; // Height in PDF points
+
+    /**
+     * Checks if this request includes wet signature metadata.
+     *
+     * @return true if wet signature data is present
+     */
+    public boolean hasWetSignature() {
+        return wetSignatureType != null
+                && wetSignatureData != null
+                && wetSignaturePage != null
+                && wetSignatureX != null
+                && wetSignatureY != null
+                && wetSignatureWidth != null
+                && wetSignatureHeight != null;
+    }
+
+    /**
+     * Extracts wet signature metadata into a dedicated DTO.
+     *
+     * @return WetSignatureMetadata object if wet signature is present, null otherwise
+     */
+    public WetSignatureMetadata extractWetSignatureMetadata() {
+        if (!hasWetSignature()) {
+            return null;
+        }
+
+        WetSignatureMetadata metadata = new WetSignatureMetadata();
+        metadata.setType(wetSignatureType);
+        metadata.setData(wetSignatureData);
+        metadata.setPage(wetSignaturePage);
+        metadata.setX(wetSignatureX);
+        metadata.setY(wetSignatureY);
+        metadata.setWidth(wetSignatureWidth);
+        metadata.setHeight(wetSignatureHeight);
+
+        // Validate the metadata
+        metadata.validate();
+
+        return metadata;
+    }
+}

app/common/src/main/java/stirling/software/common/model/api/security/SignRequestDetailDTO.java

@@ -0,0 +1,25 @@
+package stirling.software.common.model.api.security;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** DTO for sign request detail (participant view) */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SignRequestDetailDTO {
+    private String sessionId;
+    private String documentName;
+    private String ownerUsername;
+    private String message;
+    private String dueDate;
+    private String createdAt;
+    private ParticipantStatus myStatus;
+    // Signature appearance settings (read-only, configured by owner)
+    private Boolean showSignature;
+    private Integer pageNumber;
+    private String reason;
+    private String location;
+    private Boolean showLogo;
+}

app/common/src/main/java/stirling/software/common/model/api/security/SignRequestSummaryDTO.java

@@ -0,0 +1,18 @@
+package stirling.software.common.model.api.security;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** DTO for sign request summary (participant view) */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SignRequestSummaryDTO {
+    private String sessionId;
+    private String documentName;
+    private String ownerUsername;
+    private String createdAt;
+    private String dueDate;
+    private ParticipantStatus myStatus;
+}

app/common/src/main/java/stirling/software/common/model/api/security/SigningParticipant.java

@@ -0,0 +1,26 @@
+package stirling.software.common.model.api.security;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+
+import lombok.Data;
+
+@Data
+public class SigningParticipant {
+
+    private Long userId; // Database user ID (null for in-memory sessions)
+    private String email;
+    private String name;
+    private ParticipantStatus status = ParticipantStatus.PENDING;
+    private List<String> notifications = new ArrayList<>();
+    private String shareToken = UUID.randomUUID().toString();
+    private String lastUpdated = Instant.now().toString();
+    private ParticipantCertificateSubmission certificateSubmission;
+
+    public void recordNotification(String message) {
+        notifications.add(message);
+        lastUpdated = Instant.now().toString();
+    }
+}

app/common/src/main/java/stirling/software/common/model/api/security/SigningSession.java

@@ -0,0 +1,26 @@
+package stirling.software.common.model.api.security;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+
+import lombok.Data;
+
+@Data
+public class SigningSession {
+    private String sessionId = UUID.randomUUID().toString();
+    private String documentName;
+    private byte[] originalPdf;
+    private byte[] signedPdf;
+    private String ownerEmail;
+    private String message;
+    private String dueDate;
+    private String createdAt = Instant.now().toString();
+    private String updatedAt = Instant.now().toString();
+    private List<SigningParticipant> participants = new ArrayList<>();
+
+    public void touch() {
+        updatedAt = Instant.now().toString();
+    }
+}

app/common/src/main/java/stirling/software/common/model/api/security/SigningSessionDetailDTO.java

@@ -0,0 +1,23 @@
+package stirling.software.common.model.api.security;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SigningSessionDetailDTO {
+    private String sessionId;
+    private String documentName;
+    private String ownerEmail;
+    private String message;
+    private String dueDate;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private boolean finalized;
+    private List<ParticipantDTO> participants;
+}

app/common/src/main/java/stirling/software/common/model/api/security/SigningSessionSummaryDTO.java

@@ -0,0 +1,19 @@
+package stirling.software.common.model.api.security;
+
+import java.time.LocalDateTime;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SigningSessionSummaryDTO {
+    private String sessionId;
+    private String documentName;
+    private LocalDateTime createdAt;
+    private int participantCount;
+    private int signedCount;
+    private boolean finalized;
+}

app/common/src/main/java/stirling/software/common/model/api/security/UserSummaryDTO.java

@@ -0,0 +1,16 @@
+package stirling.software.common.model.api.security;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class UserSummaryDTO {
+    private Long userId;
+    private String username;
+    private String displayName;
+    private String teamName;
+    private boolean enabled;
+}

app/common/src/main/java/stirling/software/common/model/api/security/WetSignatureMetadata.java

@@ -0,0 +1,96 @@
+package stirling.software.common.model.api.security;
+
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Positive;
+import jakarta.validation.constraints.PositiveOrZero;
+import jakarta.validation.constraints.Size;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * Data Transfer Object for wet signature (visual signature) metadata. Contains information about a
+ * signature annotation placed by a participant on the PDF. This data is used to overlay the
+ * signature on the PDF during finalization.
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class WetSignatureMetadata {
+
+    /** Type of wet signature: "canvas" (drawn), "image" (uploaded), or "text" (typed) */
+    @NotNull(message = "Wet signature type is required")
+    @Pattern(
+            regexp = "canvas|image|text",
+            message = "Wet signature type must be canvas, image, or text")
+    private String type;
+
+    /**
+     * Base64-encoded image data or text content for the signature. For canvas/image types:
+     * data:image/png;base64,... format For text type: plain text string
+     */
+    @NotNull(message = "Wet signature data is required")
+    @Size(max = 5_000_000, message = "Wet signature data exceeds maximum size of 5MB")
+    private String data;
+
+    /** Zero-indexed page number where the signature is placed */
+    @NotNull(message = "Page number is required")
+    @PositiveOrZero(message = "Page number must be zero or positive")
+    private Integer page;
+
+    /** X coordinate (in PDF points) of the signature rectangle, measured from left edge */
+    @NotNull(message = "X coordinate is required")
+    @PositiveOrZero(message = "X coordinate must be zero or positive")
+    private Double x;
+
+    /**
+     * Y coordinate (in PDF points) of the signature rectangle, measured from top edge. Note: This
+     * is UI coordinate system (top-left origin). Will be converted to PDF coordinate system
+     * (bottom-left origin) during overlay.
+     */
+    @NotNull(message = "Y coordinate is required")
+    @PositiveOrZero(message = "Y coordinate must be zero or positive")
+    private Double y;
+
+    /** Width of the signature rectangle in PDF points */
+    @NotNull(message = "Width is required")
+    @Positive(message = "Width must be positive")
+    private Double width;
+
+    /** Height of the signature rectangle in PDF points */
+    @NotNull(message = "Height is required")
+    @Positive(message = "Height must be positive")
+    private Double height;
+
+    /**
+     * Validates that the wet signature data is properly formatted based on type. For image types,
+     * ensures data starts with data:image prefix.
+     *
+     * @return true if validation passes
+     * @throws IllegalArgumentException if validation fails
+     */
+    public boolean validate() {
+        if (type.equals("canvas") || type.equals("image")) {
+            if (!data.startsWith("data:image/")) {
+                throw new IllegalArgumentException(
+                        "Image wet signature data must start with data:image/ prefix");
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Extracts just the base64 data portion from a data URL. Removes the "data:image/png;base64,"
+     * prefix.
+     *
+     * @return pure base64 string without data URL prefix
+     */
+    public String extractBase64Data() {
+        if (data != null && data.contains(",")) {
+            return data.substring(data.indexOf(",") + 1);
+        }
+        return data;
+    }
+}

app/common/src/main/java/stirling/software/common/service/LineArtConversionService.java

@@ -1,12 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
-
-public interface LineArtConversionService {
-    PDImageXObject convertImageToLineArt(
-            PDDocument doc, PDImageXObject originalImage, double threshold, int edgeLevel)
-            throws IOException;
-}

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -1,21 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-/**
- * Interface for personal signature access (proprietary feature). Implemented only in proprietary
- * module to provide authenticated users access to their personal signatures.
- */
-public interface PersonalSignatureServiceInterface {
-
-    /**
-     * Get a personal signature from the user's folder. Only checks personal folder, not shared
-     * folder.
-     *
-     * @param username Username of the signature owner
-     * @param fileName Signature filename
-     * @return Personal signature image bytes
-     * @throws IOException If file not found or read error
-     */
-    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
-}

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -254,7 +254,10 @@ public class PostHogService {
                 properties,
                 "security_enableLogin",
                 applicationProperties.getSecurity().getEnableLogin());
-        addIfNotEmpty(properties, "security_csrfDisabled", true);
+        addIfNotEmpty(
+                properties,
+                "security_csrfDisabled",
+                applicationProperties.getSecurity().getCsrfDisabled());
         addIfNotEmpty(
                 properties,
                 "security_loginAttemptCount",

app/common/src/main/java/stirling/software/common/service/SigningSessionServiceInterface.java

@@ -0,0 +1,155 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+import java.util.List;
+
+public interface SigningSessionServiceInterface {
+
+    /**
+     * Creates a new signing session
+     *
+     * @param request The session creation request
+     * @param username The username of the session owner (optional, pass null for non-authenticated)
+     * @return The created session (implementation-specific return type)
+     */
+    Object createSession(Object request, String username) throws IOException;
+
+    /**
+     * Gets a signing session by ID
+     *
+     * @param sessionId The session ID
+     * @return The session object (implementation-specific return type)
+     */
+    Object getSession(String sessionId);
+
+    /**
+     * Lists all sessions for a user
+     *
+     * @param username The username
+     * @return List of session summaries (implementation-specific return type)
+     */
+    List<?> listUserSessions(String username);
+
+    /**
+     * Gets detailed session information with ownership validation
+     *
+     * @param sessionId The session ID
+     * @param username The username for ownership validation
+     * @return Detailed session object (implementation-specific return type)
+     */
+    Object getSessionDetail(String sessionId, String username);
+
+    /**
+     * Deletes a session
+     *
+     * @param sessionId The session ID
+     * @param username The username for ownership validation
+     */
+    void deleteSession(String sessionId, String username);
+
+    /**
+     * Adds participants to a session
+     *
+     * @param sessionId The session ID
+     * @param request The request containing participant emails and names
+     * @param username The username for ownership validation
+     * @return Updated session detail (implementation-specific return type)
+     */
+    Object addParticipants(String sessionId, Object request, String username);
+
+    /**
+     * Removes a participant from a session
+     *
+     * @param sessionId The session ID
+     * @param userId The participant's user ID
+     * @param username The username for ownership validation
+     */
+    void removeParticipant(String sessionId, Long userId, String username);
+
+    /**
+     * Notifies participants
+     *
+     * @param sessionId The session ID
+     * @param request The notification request
+     * @return The updated session (implementation-specific return type)
+     */
+    Object notifyParticipants(String sessionId, Object request);
+
+    /**
+     * Attaches a certificate for a participant
+     *
+     * @param sessionId The session ID
+     * @param userId The participant's user ID
+     * @param request The certificate request
+     * @return The updated session (implementation-specific return type)
+     */
+    Object attachCertificate(String sessionId, Long userId, Object request) throws IOException;
+
+    /**
+     * Marks a session as finalized
+     *
+     * @param sessionId The session ID
+     * @param signedPdf The final signed PDF bytes
+     */
+    void markSessionFinalized(String sessionId, byte[] signedPdf);
+
+    /**
+     * Gets the PDF for a session with user authentication
+     *
+     * @param sessionId The session ID
+     * @param username The participant's username
+     * @return The PDF bytes
+     */
+    byte[] getSessionPdf(String sessionId, String username);
+
+    /**
+     * Gets the signed PDF from a finalized session with ownership validation
+     *
+     * @param sessionId The session ID
+     * @param username The username for ownership validation
+     * @return The signed PDF bytes, or null if not finalized
+     */
+    byte[] getSignedPdf(String sessionId, String username);
+
+    /**
+     * Lists sign requests for a participant
+     *
+     * @param username The participant's username
+     * @return List of sign requests where user is a participant
+     */
+    List<?> listSignRequests(String username);
+
+    /**
+     * Gets sign request detail for a participant
+     *
+     * @param sessionId The session ID
+     * @param username The participant's username
+     * @return Sign request detail DTO (implementation-specific return type)
+     */
+    Object getSignRequestDetail(String sessionId, String username);
+
+    /**
+     * Declines a sign request
+     *
+     * @param sessionId The session ID
+     * @param username The participant's username
+     */
+    void declineSignRequest(String sessionId, String username);
+
+    /**
+     * Signs a document with optional wet signature metadata
+     *
+     * @param sessionId The session ID
+     * @param username The participant's username
+     * @param request The sign document request containing certificate and wet signature data
+     * @throws IOException if certificate processing fails
+     */
+    void signDocument(String sessionId, String username, Object request) throws IOException;
+
+    /**
+     * Checks if this is the database-backed implementation
+     *
+     * @return true if database-backed, false if in-memory
+     */
+    boolean isDatabaseBacked();
+}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -86,11 +86,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getCalibreSessionLimit();
-                                case IMAGEMAGICK ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getSessionLimit()
-                                                .getImageMagickSessionLimit();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -146,11 +141,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getCalibreTimeoutMinutes();
-                                case IMAGEMAGICK ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getTimeoutMinutes()
-                                                .getImageMagickTimeoutMinutes();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -311,7 +301,6 @@ public class ProcessExecutor {
         WEASYPRINT,
         INSTALL_APP,
         CALIBRE,
-        IMAGEMAGICK,
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -26,7 +26,6 @@ public class RequestUriUtils {
                 || normalizedUri.startsWith("/public/")
                 || normalizedUri.startsWith("/pdfjs/")
                 || normalizedUri.startsWith("/pdfjs-legacy/")
-                || normalizedUri.startsWith("/pdfium/")
                 || normalizedUri.startsWith("/assets/")
                 || normalizedUri.startsWith("/locales/")
                 || normalizedUri.startsWith("/Login/")
@@ -40,7 +39,6 @@ public class RequestUriUtils {
         // Specific static files bundled with the frontend
         if (normalizedUri.equals("/robots.txt")
                 || normalizedUri.equals("/favicon.ico")
-                || normalizedUri.equals("/manifest.json")
                 || normalizedUri.equals("/site.webmanifest")
                 || normalizedUri.equals("/manifest-classic.json")
                 || normalizedUri.equals("/index.html")) {
@@ -62,8 +60,7 @@ public class RequestUriUtils {
                 || normalizedUri.endsWith(".css")
                 || normalizedUri.endsWith(".mjs")
                 || normalizedUri.endsWith(".html")
-                || normalizedUri.endsWith(".toml")
-                || normalizedUri.endsWith(".wasm");
+                || normalizedUri.endsWith(".toml");
     }
 
     public static boolean isFrontendRoute(String contextPath, String requestURI) {
@@ -127,13 +124,11 @@ public class RequestUriUtils {
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
                 || requestURI.endsWith(".toml")
-                || requestURI.endsWith(".wasm")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
                 || requestURI.startsWith("/fonts")
-                || requestURI.startsWith("/pdfjs")
-                || requestURI.startsWith("/pdfium"));
+                || requestURI.startsWith("/pdfjs"));
     }
 
     /**
@@ -164,11 +159,10 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith(
                         "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
                 // enableLogin)
-                || trimmedUri.startsWith(
-                        "/api/v1/ui-data/footer-info") // Public footer configuration
+                || trimmedUri.startsWith("/v1/api-docs")
                 || trimmedUri.startsWith("/api/v1/invite/validate")
                 || trimmedUri.startsWith("/api/v1/invite/accept")
-                || trimmedUri.startsWith("/v1/api-docs");
+                || trimmedUri.contains("/v1/api-docs");
     }
 
     private static String stripContextPath(String contextPath, String requestURI) {

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -24,9 +24,6 @@ public class RequestUriUtilsTest {
         assertTrue(
                 RequestUriUtils.isStaticResource("/pdfjs/pdf.worker.js"),
                 "PDF.js files should be static");
-        assertTrue(
-                RequestUriUtils.isStaticResource("/pdfium/pdfium.wasm"),
-                "PDFium wasm should be static");
         assertTrue(
                 RequestUriUtils.isStaticResource("/api/v1/info/status"),
                 "API status should be static");
@@ -113,8 +110,7 @@ public class RequestUriUtilsTest {
                 "/downloads/document.png",
                 "/assets/brand.ico",
                 "/any/path/with/image.svg",
-                "/deep/nested/folder/icon.png",
-                "/pdfium/pdfium.wasm"
+                "/deep/nested/folder/icon.png"
             })
     void testIsStaticResourceWithFileExtensions(String path) {
         assertTrue(
@@ -152,9 +148,6 @@ public class RequestUriUtilsTest {
         assertFalse(
                 RequestUriUtils.isTrackableResource("/script.js"),
                 "JS files should not be trackable");
-        assertFalse(
-                RequestUriUtils.isTrackableResource("/pdfium/pdfium.wasm"),
-                "PDFium wasm should not be trackable");
         assertFalse(
                 RequestUriUtils.isTrackableResource("/swagger/index.html"),
                 "Swagger files should not be trackable");
@@ -231,8 +224,7 @@ public class RequestUriUtilsTest {
                 "/api/v1/info/health",
                 "/site.webmanifest",
                 "/fonts/roboto.woff",
-                "/pdfjs/viewer.js",
-                "/pdfium/pdfium.wasm"
+                "/pdfjs/viewer.js"
             })
     void testNonTrackableResources(String path) {
         assertFalse(

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -46,7 +46,6 @@ public class ExternalAppDepConfig {
                         put("qpdf", List.of("qpdf"));
                         put("tesseract", List.of("tesseract"));
                         put("rar", List.of("rar")); // Required for real CBR output
-                        put("magick", List.of("ImageMagick"));
                     }
                 };
     }
@@ -129,7 +128,6 @@ public class ExternalAppDepConfig {
         checkDependencyAndDisableGroup("pdftohtml");
         checkDependencyAndDisableGroup(unoconvPath);
         checkDependencyAndDisableGroup("rar");
-        checkDependencyAndDisableGroup("magick");
         // Special handling for Python/OpenCV dependencies
         boolean pythonAvailable = isCommandAvailable("python3") || isCommandAvailable("python");
         if (!pythonAvailable) {

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -34,6 +34,7 @@ public class InitialSetup {
     public void init() throws IOException {
         initUUIDKey();
         initSecretKey();
+        initEnableCSRFSecurity();
         initLegalUrls();
         initSetAppVersion();
         GeneralUtils.extractPipeline();
@@ -59,6 +60,18 @@ public class InitialSetup {
         }
     }
 
+    public void initEnableCSRFSecurity() throws IOException {
+        if (GeneralUtils.isVersionHigher(
+                "0.46.0", applicationProperties.getAutomaticallyGenerated().getAppVersion())) {
+            Boolean csrf = applicationProperties.getSecurity().getCsrfDisabled();
+            if (!csrf) {
+                GeneralUtils.saveKeyToSettings("security.csrfDisabled", false);
+                GeneralUtils.saveKeyToSettings("system.enableAnalytics", true);
+                applicationProperties.getSecurity().setCsrfDisabled(false);
+            }
+        }
+    }
+
     public void initLegalUrls() throws IOException {
         // Initialize Terms and Conditions
         String termsUrl = applicationProperties.getLegal().getTermsAndConditions();
@@ -94,7 +107,6 @@ public class InitialSetup {
         }
         GeneralUtils.saveKeyToSettings("AutomaticallyGenerated.appVersion", appVersion);
         applicationProperties.getAutomaticallyGenerated().setAppVersion(appVersion);
-        applicationProperties.getAutomaticallyGenerated().setIsNewServer(isNewServer);
     }
 
     public static boolean isNewServer() {

app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java

@@ -62,15 +62,10 @@ public class OpenApiConfig {
 
         // Add server configuration from environment variable
         String swaggerServerUrl = System.getenv("SWAGGER_SERVER_URL");
-        Server server;
         if (swaggerServerUrl != null && !swaggerServerUrl.trim().isEmpty()) {
-            server = new Server().url(swaggerServerUrl).description("API Server");
-        } else {
-            // Use relative path so Swagger uses the current browser origin to avoid CORS issues
-            // when accessing via different ports
-            server = new Server().url("/").description("Current Server");
+            Server server = new Server().url(swaggerServerUrl).description("API Server");
+            openAPI.addServersItem(server);
         }
-        openAPI.addServersItem(server);
 
         // Add ErrorResponse schema to components
         Schema<?> errorResponseSchema =

app/core/src/main/java/stirling/software/SPDF/config/SpringDocConfig.java

@@ -21,9 +21,6 @@ public class SpringDocConfig {
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
                         "/api/v1/team/**",
-                        "/api/v1/auth/**",
-                        "/api/v1/invite/**",
-                        "/api/v1/audit/**",
                         "/api/v1/ui-data/**",
                         "/api/v1/proprietary/ui-data/**",
                         "/api/v1/info/**",
@@ -36,7 +33,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - Processing API")
                                             .description(
-                                                    "APIs for converting, editing, securing, and analysing PDF documents. Use these endpoints to automate common PDF tasks (like split, merge, convert, OCR) and plug them into your own apps and backend jobs."));
+                                                    "API documentation for PDF processing operations including conversion, manipulation, security, and utilities."));
                         })
                 .build();
     }
@@ -50,17 +47,14 @@ public class SpringDocConfig {
                         "/api/v1/admin/**",
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
-                        "/api/v1/team/**",
-                        "/api/v1/auth/**",
-                        "/api/v1/invite/**",
-                        "/api/v1/audit/**")
+                        "/api/v1/team/**")
                 .addOpenApiCustomizer(
                         openApi -> {
                             openApi.info(
                                     openApi.getInfo()
-                                            .title("Stirling PDF - Management API")
+                                            .title("Stirling PDF - Admin API")
                                             .description(
-                                                    "Endpoints for authentication, user management, invitations, audit logging, and system configuration."));
+                                                    "API documentation for administrative functions, user management, and system configuration."));
                         })
                 .build();
     }
@@ -82,7 +76,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - System API")
                                             .description(
-                                                    "System information, UI metadata, job status, and file management endpoints."));
+                                                    "API documentation for system information, UI data, and utility endpoints."));
                         })
                 .build();
     }

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -1,14 +1,10 @@
 package stirling.software.SPDF.config;
 
-import java.util.concurrent.TimeUnit;
-
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.http.CacheControl;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import lombok.RequiredArgsConstructor;
@@ -29,41 +25,6 @@ public class WebMvcConfig implements WebMvcConfigurer {
         registry.addInterceptor(endpointInterceptor);
     }
 
-    @Override
-    public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        // Cache hashed assets (JS/CSS with content hashes) for 1 year
-        // These files have names like index-ChAS4tCC.js that change when content changes
-        // Check customFiles/static first, then fall back to classpath
-        registry.addResourceHandler("/assets/**")
-                .addResourceLocations(
-                        "file:"
-                                + stirling.software.common.configuration.InstallationPathConfig
-                                        .getStaticPath()
-                                + "assets/",
-                        "classpath:/static/assets/")
-                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS).cachePublic());
-
-        // Don't cache index.html - it needs to be fresh to reference latest hashed assets
-        // Note: index.html is handled by ReactRoutingController for dynamic processing
-        registry.addResourceHandler("/index.html")
-                .addResourceLocations(
-                        "file:"
-                                + stirling.software.common.configuration.InstallationPathConfig
-                                        .getStaticPath(),
-                        "classpath:/static/")
-                .setCacheControl(CacheControl.noCache().mustRevalidate());
-
-        // Handle all other static resources (js, css, images, fonts, etc.)
-        // Check customFiles/static first for user overrides
-        registry.addResourceHandler("/**")
-                .addResourceLocations(
-                        "file:"
-                                + stirling.software.common.configuration.InstallationPathConfig
-                                        .getStaticPath(),
-                        "classpath:/static/")
-                .setCacheControl(CacheControl.maxAge(1, TimeUnit.HOURS));
-    }
-
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         // Check if running in Tauri mode

app/core/src/main/java/stirling/software/SPDF/controller/api/SettingsController.java

@@ -124,6 +124,7 @@ public class SettingsController {
         ApplicationProperties.Security security = applicationProperties.getSecurity();
 
         settings.put("enableLogin", security.getEnableLogin());
+        settings.put("csrfDisabled", security.getCsrfDisabled());
         settings.put("loginMethod", security.getLoginMethod());
         settings.put("loginAttemptCount", security.getLoginAttemptCount());
         settings.put("loginResetTimeMinutes", security.getLoginResetTimeMinutes());
@@ -158,6 +159,12 @@ public class SettingsController {
                     .getSecurity()
                     .setEnableLogin((Boolean) settings.get("enableLogin"));
         }
+        if (settings.containsKey("csrfDisabled")) {
+            GeneralUtils.saveKeyToSettings("security.csrfDisabled", settings.get("csrfDisabled"));
+            applicationProperties
+                    .getSecurity()
+                    .setCsrfDisabled((Boolean) settings.get("csrfDisabled"));
+        }
         if (settings.containsKey("loginMethod")) {
             GeneralUtils.saveKeyToSettings("security.loginMethod", settings.get("loginMethod"));
             applicationProperties

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -26,7 +26,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.Dependency;
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.SPDF.service.SignatureService;
 import stirling.software.common.annotations.api.UiDataApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
@@ -40,14 +40,14 @@ import stirling.software.common.util.GeneralUtils;
 public class UIDataController {
 
     private final ApplicationProperties applicationProperties;
-    private final SharedSignatureService signatureService;
+    private final SignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
-            SharedSignatureService signatureService,
+            SignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {
@@ -58,21 +58,6 @@ public class UIDataController {
         this.runtimePathConfig = runtimePathConfig;
     }
 
-    @GetMapping("/footer-info")
-    @Operation(summary = "Get public footer configuration data")
-    public ResponseEntity<FooterData> getFooterData() {
-        FooterData data = new FooterData();
-        data.setAnalyticsEnabled(applicationProperties.getSystem().getEnableAnalytics());
-        data.setTermsAndConditions(applicationProperties.getLegal().getTermsAndConditions());
-        data.setPrivacyPolicy(applicationProperties.getLegal().getPrivacyPolicy());
-        data.setAccessibilityStatement(
-                applicationProperties.getLegal().getAccessibilityStatement());
-        data.setCookiePolicy(applicationProperties.getLegal().getCookiePolicy());
-        data.setImpressum(applicationProperties.getLegal().getImpressum());
-
-        return ResponseEntity.ok(data);
-    }
-
     @GetMapping("/home")
     @Operation(summary = "Get home page data")
     public ResponseEntity<HomeData> getHomeData() {
@@ -252,16 +237,6 @@ public class UIDataController {
     }
 
     // Data classes
-    @Data
-    public static class FooterData {
-        private Boolean analyticsEnabled;
-        private String termsAndConditions;
-        private String privacyPolicy;
-        private String accessibilityStatement;
-        private String cookiePolicy;
-        private String impressum;
-    }
-
     @Data
     public static class HomeData {
         private boolean showSurveyFromDocker;

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -1,60 +0,0 @@
-package stirling.software.SPDF.controller.api.converters;
-
-import java.nio.charset.StandardCharsets;
-
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ControllerAdvice;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.exception.CacheUnavailableException;
-
-@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
-@Slf4j
-@RequiredArgsConstructor
-public class ConvertPdfJsonExceptionHandler {
-
-    private final ObjectMapper objectMapper;
-
-    @ExceptionHandler(CacheUnavailableException.class)
-    @ResponseBody
-    public ResponseEntity<byte[]> handleCacheUnavailable(CacheUnavailableException ex) {
-        try {
-            byte[] body =
-                    objectMapper.writeValueAsBytes(
-                            java.util.Map.of(
-                                    "error", "cache_unavailable",
-                                    "action", "reupload",
-                                    "message", ex.getMessage()));
-            return ResponseEntity.status(HttpStatus.GONE)
-                    .contentType(MediaType.APPLICATION_JSON)
-                    .body(body);
-        } catch (Exception e) {
-            log.warn("Failed to serialize cache_unavailable response", e);
-            var fallbackBody =
-                    java.util.Map.of(
-                            "error", "cache_unavailable",
-                            "action", "reupload",
-                            "message", String.valueOf(ex.getMessage()));
-            try {
-                return ResponseEntity.status(HttpStatus.GONE)
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .body(objectMapper.writeValueAsBytes(fallbackBody));
-            } catch (Exception ignored) {
-                // Truly last-ditch fallback
-                return ResponseEntity.status(HttpStatus.GONE)
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .body(
-                                "{\"error\":\"cache_unavailable\",\"action\":\"reupload\",\"message\":\"Cache unavailable\"}"
-                                        .getBytes(StandardCharsets.UTF_8));
-            }
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/CompressController.java

@@ -28,13 +28,10 @@ import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.graphics.PDXObject;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.server.ResponseStatusException;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -47,7 +44,6 @@ import stirling.software.SPDF.model.api.misc.OptimizePdfRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.MiscApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.service.LineArtConversionService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
@@ -62,9 +58,6 @@ public class CompressController {
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final EndpointConfiguration endpointConfiguration;
 
-    @Autowired(required = false)
-    private LineArtConversionService lineArtConversionService;
-
     private boolean isQpdfEnabled() {
         return endpointConfiguration.isGroupEnabled("qpdf");
     }
@@ -73,10 +66,6 @@ public class CompressController {
         return endpointConfiguration.isGroupEnabled("Ghostscript");
     }
 
-    private boolean isImageMagickEnabled() {
-        return endpointConfiguration.isGroupEnabled("ImageMagick");
-    }
-
     @Data
     @AllArgsConstructor
     @NoArgsConstructor
@@ -671,9 +660,6 @@ public class CompressController {
         Integer optimizeLevel = request.getOptimizeLevel();
         String expectedOutputSizeString = request.getExpectedOutputSize();
         Boolean convertToGrayscale = request.getGrayscale();
-        Boolean convertToLineArt = request.getLineArt();
-        Double lineArtThreshold = request.getLineArtThreshold();
-        Integer lineArtEdgeLevel = request.getLineArtEdgeLevel();
         if (expectedOutputSizeString == null && optimizeLevel == null) {
             throw new Exception("Both expected output size and optimize level are not specified");
         }
@@ -703,26 +689,6 @@ public class CompressController {
                 optimizeLevel = determineOptimizeLevel(sizeReductionRatio);
             }
 
-            if (Boolean.TRUE.equals(convertToLineArt)) {
-                if (lineArtConversionService == null) {
-                    throw new ResponseStatusException(
-                            HttpStatus.FORBIDDEN,
-                            "Line art conversion is unavailable - ImageMagick service not found");
-                }
-                if (!isImageMagickEnabled()) {
-                    throw new IOException(
-                            "ImageMagick is not enabled but line art conversion was requested");
-                }
-                double thresholdValue =
-                        lineArtThreshold == null
-                                ? 55d
-                                : Math.min(100d, Math.max(0d, lineArtThreshold));
-                int edgeLevel =
-                        lineArtEdgeLevel == null ? 1 : Math.min(3, Math.max(1, lineArtEdgeLevel));
-                currentFile =
-                        applyLineArtConversion(currentFile, tempFiles, thresholdValue, edgeLevel);
-            }
-
             boolean sizeMet = false;
             boolean imageCompressionApplied = false;
             boolean externalCompressionApplied = false;
@@ -844,75 +810,6 @@ public class CompressController {
         }
     }
 
-    private Path applyLineArtConversion(
-            Path currentFile, List<Path> tempFiles, double threshold, int edgeLevel)
-            throws IOException {
-
-        Path lineArtFile = Files.createTempFile("lineart_output_", ".pdf");
-        tempFiles.add(lineArtFile);
-
-        try (PDDocument doc = pdfDocumentFactory.load(currentFile.toFile())) {
-            Map<String, List<ImageReference>> uniqueImages = findImages(doc);
-            CompressionStats stats = new CompressionStats();
-            stats.uniqueImagesCount = uniqueImages.size();
-            calculateImageStats(uniqueImages, stats);
-
-            Map<String, PDImageXObject> convertedImages =
-                    createLineArtImages(doc, uniqueImages, stats, threshold, edgeLevel);
-
-            replaceImages(doc, uniqueImages, convertedImages, stats);
-
-            log.info(
-                    "Applied line art conversion to {} unique images ({} total references)",
-                    stats.uniqueImagesCount,
-                    stats.totalImages);
-
-            doc.save(lineArtFile.toString());
-            return lineArtFile;
-        }
-    }
-
-    private Map<String, PDImageXObject> createLineArtImages(
-            PDDocument doc,
-            Map<String, List<ImageReference>> uniqueImages,
-            CompressionStats stats,
-            double threshold,
-            int edgeLevel)
-            throws IOException {
-
-        Map<String, PDImageXObject> convertedImages = new HashMap<>();
-
-        for (Entry<String, List<ImageReference>> entry : uniqueImages.entrySet()) {
-            String imageHash = entry.getKey();
-            List<ImageReference> references = entry.getValue();
-            if (references.isEmpty()) continue;
-
-            PDImageXObject originalImage = getOriginalImage(doc, references.get(0));
-
-            int originalSize = (int) originalImage.getCOSObject().getLength();
-            stats.totalOriginalBytes += originalSize;
-
-            PDImageXObject converted =
-                    lineArtConversionService.convertImageToLineArt(
-                            doc, originalImage, threshold, edgeLevel);
-            convertedImages.put(imageHash, converted);
-            stats.compressedImages++;
-
-            int convertedSize = (int) converted.getCOSObject().getLength();
-            stats.totalCompressedBytes += convertedSize * references.size();
-
-            double reductionPercentage = 100.0 - ((convertedSize * 100.0) / originalSize);
-            log.info(
-                    "Image hash {}: Line art conversion {} → {} (reduced by {}%)",
-                    imageHash,
-                    GeneralUtils.formatBytes(originalSize),
-                    GeneralUtils.formatBytes(convertedSize),
-                    String.format("%.1f", reductionPercentage));
-        }
-
-        return convertedImages;
-    }
-
     // Run Ghostscript compression
     private void applyGhostscriptCompression(
             OptimizePdfRequest request, int optimizeLevel, Path currentFile, List<Path> tempFiles)

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -74,7 +74,6 @@ public class ConfigController {
             configData.put("appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
             configData.put("languages", applicationProperties.getUi().getLanguages());
             configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
-            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());
 
             // Security settings
             // enableLogin requires both the config flag AND proprietary features to be loaded
@@ -124,9 +123,6 @@ public class ConfigController {
                     "enableAnalytics", applicationProperties.getSystem().getEnableAnalytics());
             configData.put("enablePosthog", applicationProperties.getSystem().getEnablePosthog());
             configData.put("enableScarf", applicationProperties.getSystem().getEnableScarf());
-            configData.put(
-                    "enableDesktopInstallSlide",
-                    applicationProperties.getSystem().getEnableDesktopInstallSlide());
 
             // Premium/Enterprise settings
             configData.put("premiumEnabled", applicationProperties.getPremium().isEnabled());
@@ -230,10 +226,4 @@ public class ConfigController {
         }
         return ResponseEntity.ok(result);
     }
-
-    @GetMapping("/group-enabled")
-    public ResponseEntity<Boolean> isGroupEnabled(@RequestParam(name = "group") String group) {
-        boolean enabled = endpointConfiguration.isGroupEnabled(group);
-        return ResponseEntity.ok(enabled);
-    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java

@@ -72,6 +72,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
+import stirling.software.SPDF.model.api.security.MultiSignPDFWithCertRequest;
 import stirling.software.SPDF.model.api.security.SignPDFWithCertRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.service.CustomPDFDocumentFactory;
@@ -113,7 +114,7 @@ public class CertSignController {
         this.serverCertificateService = serverCertificateService;
     }
 
-    private static void sign(
+    static void sign(
             CustomPDFDocumentFactory pdfDocumentFactory,
             MultipartFile input,
             OutputStream output,
@@ -149,6 +150,42 @@ public class CertSignController {
         }
     }
 
+    static void sign(
+            CustomPDFDocumentFactory pdfDocumentFactory,
+            InputStream input,
+            OutputStream output,
+            CreateSignature instance,
+            Boolean showSignature,
+            Integer pageNumber,
+            String name,
+            String location,
+            String reason,
+            Boolean showLogo) {
+        try (PDDocument doc = pdfDocumentFactory.load(input)) {
+            PDSignature signature = new PDSignature();
+            signature.setFilter(PDSignature.FILTER_ADOBE_PPKLITE);
+            signature.setSubFilter(PDSignature.SUBFILTER_ADBE_PKCS7_DETACHED);
+            signature.setName(name);
+            signature.setLocation(location);
+            signature.setReason(reason);
+            signature.setSignDate(Calendar.getInstance());
+            if (Boolean.TRUE.equals(showSignature)) {
+                SignatureOptions signatureOptions = new SignatureOptions();
+                signatureOptions.setVisualSignature(
+                        instance.createVisibleSignature(doc, signature, pageNumber, showLogo));
+                signatureOptions.setPage(pageNumber);
+
+                doc.addSignature(signature, instance, signatureOptions);
+
+            } else {
+                doc.addSignature(signature, instance);
+            }
+            doc.saveIncremental(output);
+        } catch (Exception e) {
+            ExceptionUtils.logException("PDF signing", e);
+        }
+    }
+
     @AutoJobPostMapping(
             consumes = {
                 MediaType.MULTIPART_FORM_DATA_VALUE,
@@ -191,12 +228,6 @@ public class CertSignController {
 
         switch (certType) {
             case "PEM":
-                privateKeyFile =
-                        validateFilePresent(
-                                privateKeyFile, "PEM private key", "private key file is required");
-                certFile =
-                        validateFilePresent(
-                                certFile, "PEM certificate", "certificate file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(null);
                 PrivateKey privateKey = getPrivateKeyFromPEM(privateKeyFile.getBytes(), password);
@@ -206,16 +237,10 @@ public class CertSignController {
                 break;
             case "PKCS12":
             case "PFX":
-                p12File =
-                        validateFilePresent(
-                                p12File, "PKCS12 keystore", "PKCS12/PFX keystore file is required");
                 ks = KeyStore.getInstance("PKCS12");
                 ks.load(p12File.getInputStream(), password.toCharArray());
                 break;
             case "JKS":
-                jksfile =
-                        validateFilePresent(
-                                jksfile, "JKS keystore", "JKS keystore file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(jksfile.getInputStream(), password.toCharArray());
                 break;
@@ -263,18 +288,143 @@ public class CertSignController {
                 GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_signed.pdf"));
     }
 
-    private MultipartFile validateFilePresent(
-            MultipartFile file, String argumentName, String errorDescription) {
-        if (file == null || file.isEmpty()) {
+    @AutoJobPostMapping(
+            consumes = {
+                MediaType.MULTIPART_FORM_DATA_VALUE,
+                MediaType.APPLICATION_FORM_URLENCODED_VALUE
+            },
+            value = "/cert-sign/multi")
+    @StandardPdfResponse
+    @Operation(
+            summary = "Sign PDF with multiple Digital Certificates",
+            description =
+                    "This endpoint accepts a PDF file and multiple digital certificates to"
+                            + " sequentially sign the document. Input:PDF Output:PDF Type:SISO")
+    public ResponseEntity<byte[]> multiSignPDFWithCert(
+            @ModelAttribute MultiSignPDFWithCertRequest request) throws Exception {
+        if (request.getCertTypes() == null || request.getCertTypes().isEmpty()) {
             throw ExceptionUtils.createIllegalArgumentException(
-                    "error.invalidArgument",
-                    "Invalid argument: {0}",
-                    argumentName + " - " + errorDescription);
+                    "error.optionsNotSpecified",
+                    "{0} options are not specified",
+                    "certificate types");
         }
-        return file;
+
+        byte[] currentPdf = request.getFileInput().getBytes();
+        String originalFilename = request.getFileInput().getOriginalFilename();
+
+        for (int i = 0; i < request.getCertTypes().size(); i++) {
+            String certType = request.getCertTypes().get(i);
+            KeyStore ks = null;
+            String keystorePassword = getFromList(request.getPasswords(), i, "");
+
+            switch (certType) {
+                case "PEM":
+                    ks = KeyStore.getInstance("JKS");
+                    ks.load(null);
+                    MultipartFile privateKeyFile =
+                            getFromList(request.getPrivateKeyFiles(), i, null);
+                    MultipartFile certFile = getFromList(request.getCertFiles(), i, null);
+                    if (privateKeyFile == null || certFile == null) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.optionsNotSpecified",
+                                "{0} options are not specified",
+                                "certificate and key files for signer " + (i + 1));
+                    }
+                    PrivateKey privateKey =
+                            getPrivateKeyFromPEM(privateKeyFile.getBytes(), keystorePassword);
+                    Certificate cert = (Certificate) getCertificateFromPEM(certFile.getBytes());
+                    ks.setKeyEntry(
+                            "alias",
+                            privateKey,
+                            keystorePassword.toCharArray(),
+                            new Certificate[] {cert});
+                    break;
+                case "PKCS12":
+                case "PFX":
+                    MultipartFile p12File = getFromList(request.getP12Files(), i, null);
+                    if (p12File == null) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.optionsNotSpecified",
+                                "{0} options are not specified",
+                                "PKCS12/PFX keystore for signer " + (i + 1));
+                    }
+                    ks = KeyStore.getInstance("PKCS12");
+                    ks.load(p12File.getInputStream(), keystorePassword.toCharArray());
+                    break;
+                case "JKS":
+                    MultipartFile jksfile = getFromList(request.getJksFiles(), i, null);
+                    if (jksfile == null) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.optionsNotSpecified",
+                                "{0} options are not specified",
+                                "JKS keystore for signer " + (i + 1));
+                    }
+                    ks = KeyStore.getInstance("JKS");
+                    ks.load(jksfile.getInputStream(), keystorePassword.toCharArray());
+                    break;
+                case "SERVER":
+                    if (serverCertificateService == null) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.serverCertificateNotAvailable",
+                                "Server certificate service is not available in this edition");
+                    }
+                    if (!serverCertificateService.isEnabled()) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.serverCertificateDisabled",
+                                "Server certificate feature is disabled");
+                    }
+                    if (!serverCertificateService.hasServerCertificate()) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.serverCertificateNotFound",
+                                "No server certificate configured");
+                    }
+                    ks = serverCertificateService.getServerKeyStore();
+                    keystorePassword = serverCertificateService.getServerCertificatePassword();
+                    break;
+                default:
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.invalidArgument",
+                            "Invalid argument: {0}",
+                            "certificate type: " + certType);
+            }
+
+            CreateSignature createSignature =
+                    new CreateSignature(ks, keystorePassword.toCharArray());
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            String signerName = getFromList(request.getNames(), i, "SPDF");
+            String location = getFromList(request.getLocations(), i, "SPDF");
+            String reason = getFromList(request.getReasons(), i, "Signed by SPDF");
+            Boolean showSignature = getFromList(request.getShowSignatures(), i, Boolean.FALSE);
+            Boolean showLogo = getFromList(request.getShowLogos(), i, Boolean.TRUE);
+            Integer pageNumber = getFromList(request.getPageNumbers(), i, null);
+            pageNumber = pageNumber != null ? pageNumber - 1 : null;
+
+            sign(
+                    pdfDocumentFactory,
+                    new ByteArrayInputStream(currentPdf),
+                    baos,
+                    createSignature,
+                    showSignature,
+                    pageNumber,
+                    signerName,
+                    location,
+                    reason,
+                    showLogo);
+            currentPdf = baos.toByteArray();
+        }
+
+        return WebResponseUtils.bytesToWebResponse(
+                currentPdf, GeneralUtils.generateFilename(originalFilename, "_multi_signed.pdf"));
     }
 
-    private PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
+    private static <T> T getFromList(List<T> list, int index, T defaultValue) {
+        if (list == null || list.size() <= index) {
+            return defaultValue;
+        }
+        return list.get(index);
+    }
+
+    public PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
             throws IOException, OperatorCreationException, PKCSException {
         try (PEMParser pemParser =
                 new PEMParser(new InputStreamReader(new ByteArrayInputStream(pemBytes)))) {
@@ -296,14 +446,14 @@ public class CertSignController {
         }
     }
 
-    private Certificate getCertificateFromPEM(byte[] pemBytes)
+    public Certificate getCertificateFromPEM(byte[] pemBytes)
             throws IOException, CertificateException {
         try (ByteArrayInputStream bis = new ByteArrayInputStream(pemBytes)) {
             return CertificateFactory.getInstance("X.509").generateCertificate(bis);
         }
     }
 
-    class CreateSignature extends CreateSignatureBase {
+    static class CreateSignature extends CreateSignatureBase {
         File logoFile;
 
         public CreateSignature(KeyStore keystore, char[] pin)

app/core/src/main/java/stirling/software/SPDF/controller/api/security/SigningSessionController.java

@@ -0,0 +1,678 @@
+package stirling.software.SPDF.controller.api.security;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.security.KeyStore;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.cert.Certificate;
+import java.util.List;
+import java.util.Locale;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.validation.constraints.NotBlank;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.config.swagger.StandardPdfResponse;
+import stirling.software.SPDF.controller.api.security.CertSignController.CreateSignature;
+import stirling.software.SPDF.service.SigningSessionService;
+import stirling.software.common.model.api.security.*;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.service.ServerCertificateServiceInterface;
+import stirling.software.common.service.SigningSessionServiceInterface;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.service.UserServerCertificateService;
+
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/security")
+@Tag(name = "Security", description = "Security APIs")
+public class SigningSessionController {
+
+    private final SigningSessionService signingSessionService;
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final ServerCertificateServiceInterface serverCertificateServiceInterface;
+    private final SigningSessionServiceInterface sessionServiceInterface;
+    private final UserServerCertificateService userServerCertificateService;
+
+    public SigningSessionController(
+            SigningSessionService signingSessionService,
+            CustomPDFDocumentFactory pdfDocumentFactory,
+            @Autowired(required = false)
+                    ServerCertificateServiceInterface serverCertificateServiceInterface,
+            @Autowired(required = false)
+                    List<SigningSessionServiceInterface> signingSessionServices,
+            @Autowired(required = false)
+                    UserServerCertificateService userServerCertificateService) {
+        this.signingSessionService = signingSessionService;
+        this.pdfDocumentFactory = pdfDocumentFactory;
+        this.serverCertificateServiceInterface = serverCertificateServiceInterface;
+        this.userServerCertificateService = userServerCertificateService;
+        // Use database-backed service if available, otherwise fall back to in-memory
+        this.sessionServiceInterface =
+                signingSessionServices != null && !signingSessionServices.isEmpty()
+                        ? signingSessionServices.stream()
+                                .filter(SigningSessionServiceInterface::isDatabaseBacked)
+                                .findFirst()
+                                .orElse(signingSessionService)
+                        : signingSessionService;
+    }
+
+    @Operation(summary = "List all signing sessions for current user")
+    @GetMapping(value = "/cert-sign/sessions")
+    public ResponseEntity<?> listSessions(Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            List<?> sessions = sessionServiceInterface.listUserSessions(principal.getName());
+            return ResponseEntity.ok(sessions);
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body("Error listing sessions");
+        }
+    }
+
+    @PostMapping(
+            consumes = {
+                MediaType.MULTIPART_FORM_DATA_VALUE,
+                MediaType.APPLICATION_FORM_URLENCODED_VALUE
+            },
+            value = "/cert-sign/sessions",
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @Operation(
+            summary = "Create a shared signing session",
+            description =
+                    "Starts a collaboration session, distributes share links, and optionally notifies participants."
+                            + " Input:PDF Output:JSON Type:SISO")
+    public ResponseEntity<?> createSession(
+            @ModelAttribute CreateSigningSessionRequest request, Principal principal)
+            throws Exception {
+        if (sessionServiceInterface.isDatabaseBacked() && principal != null) {
+            Object session = sessionServiceInterface.createSession(request, principal.getName());
+            return ResponseEntity.ok(session);
+        } else {
+            SigningSession session = signingSessionService.createSession(request);
+            return ResponseEntity.ok(session);
+        }
+    }
+
+    @Operation(summary = "Fetch signing session details")
+    @GetMapping(value = "/cert-sign/sessions/{sessionId}")
+    public ResponseEntity<?> getSession(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
+        if (sessionServiceInterface.isDatabaseBacked() && principal != null) {
+            try {
+                Object session =
+                        sessionServiceInterface.getSessionDetail(sessionId, principal.getName());
+                return ResponseEntity.ok(session);
+            } catch (Exception e) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body("Access denied or session not found");
+            }
+        } else {
+            SigningSession session = signingSessionService.getSession(sessionId);
+            return ResponseEntity.ok(session);
+        }
+    }
+
+    @Operation(summary = "Delete a signing session")
+    @DeleteMapping(value = "/cert-sign/sessions/{sessionId}")
+    public ResponseEntity<?> deleteSession(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            sessionServiceInterface.deleteSession(sessionId, principal.getName());
+            return ResponseEntity.noContent().build();
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body("Cannot delete session: " + e.getMessage());
+        }
+    }
+
+    @Operation(summary = "Add participants to an existing session")
+    @PostMapping(value = "/cert-sign/sessions/{sessionId}/participants")
+    public ResponseEntity<?> addParticipants(
+            @PathVariable("sessionId") @NotBlank String sessionId,
+            @RequestBody AddParticipantsRequest request,
+            Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            Object session =
+                    sessionServiceInterface.addParticipants(
+                            sessionId, request, principal.getName());
+            return ResponseEntity.ok(session);
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body("Cannot add participants: " + e.getMessage());
+        }
+    }
+
+    @Operation(summary = "Remove a participant from a session")
+    @DeleteMapping(value = "/cert-sign/sessions/{sessionId}/participants/{userId}")
+    public ResponseEntity<?> removeParticipant(
+            @PathVariable("sessionId") @NotBlank String sessionId,
+            @PathVariable("userId") Long userId,
+            Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            sessionServiceInterface.removeParticipant(sessionId, userId, principal.getName());
+            return ResponseEntity.noContent().build();
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body("Cannot remove participant: " + e.getMessage());
+        }
+    }
+
+    @Operation(summary = "Get session PDF for participant view")
+    @GetMapping(value = "/cert-sign/sessions/{sessionId}/pdf")
+    public ResponseEntity<byte[]> getSessionPdf(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        }
+        try {
+            byte[] pdfBytes = sessionServiceInterface.getSessionPdf(sessionId, principal.getName());
+            return WebResponseUtils.bytesToWebResponse(pdfBytes, "document.pdf");
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+    }
+
+    @PostMapping(value = "/cert-sign/sessions/{sessionId}/notify")
+    @Operation(summary = "Notify signing participants about outstanding requests")
+    public SigningSession notifyParticipants(
+            @PathVariable("sessionId") @NotBlank String sessionId,
+            @RequestBody NotifySigningParticipantsRequest request) {
+        return (SigningSession) sessionServiceInterface.notifyParticipants(sessionId, request);
+    }
+
+    @PostMapping(
+            value = "/cert-sign/sessions/{sessionId}/participants/{userId}/certificate",
+            consumes = {
+                MediaType.MULTIPART_FORM_DATA_VALUE,
+                MediaType.APPLICATION_FORM_URLENCODED_VALUE
+            })
+    @Operation(summary = "Attach certificate details for a specific participant")
+    public SigningSession attachCertificate(
+            @PathVariable("sessionId") @NotBlank String sessionId,
+            @PathVariable("userId") Long userId,
+            @ModelAttribute ParticipantCertificateRequest request)
+            throws Exception {
+        return (SigningSession)
+                sessionServiceInterface.attachCertificate(sessionId, userId, request);
+    }
+
+    @Operation(summary = "Get signed PDF from finalized session")
+    @GetMapping(value = "/cert-sign/sessions/{sessionId}/signed-pdf")
+    @StandardPdfResponse
+    public ResponseEntity<byte[]> getSignedPdf(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        }
+        try {
+            byte[] signedPdf = sessionServiceInterface.getSignedPdf(sessionId, principal.getName());
+            if (signedPdf == null) {
+                return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                        .body("Session not finalized".getBytes());
+            }
+            SigningSession session = (SigningSession) sessionServiceInterface.getSession(sessionId);
+            return WebResponseUtils.bytesToWebResponse(
+                    signedPdf,
+                    GeneralUtils.generateFilename(session.getDocumentName(), "_shared_signed.pdf"));
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+    }
+
+    @PostMapping(value = "/cert-sign/sessions/{sessionId}/finalize")
+    @Operation(
+            summary = "Finalize signing session",
+            description =
+                    "Applies collected certificates in order and returns the signed document.")
+    @StandardPdfResponse
+    public ResponseEntity<byte[]> finalizeSession(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal)
+            throws Exception {
+        // Validate ownership if database service is available
+        if (sessionServiceInterface.isDatabaseBacked() && principal != null) {
+            try {
+                sessionServiceInterface.getSessionDetail(sessionId, principal.getName());
+            } catch (Exception e) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+            }
+        }
+
+        SigningSession session = (SigningSession) sessionServiceInterface.getSession(sessionId);
+        byte[] pdf = session.getOriginalPdf();
+
+        // Step 1: Apply wet signatures (visual annotations) FIRST
+        if (sessionServiceInterface.isDatabaseBacked()) {
+            try {
+                pdf = applyWetSignatures(pdf, sessionId);
+            } catch (Exception e) {
+                log.error(
+                        "Failed to apply wet signatures for session {}: {}",
+                        sessionId,
+                        e.getMessage());
+                // Continue with certificate signing even if wet signatures fail
+            }
+        }
+
+        // Step 2: Apply digital certificates
+        for (SigningParticipant participant : session.getParticipants()) {
+            ParticipantCertificateSubmission submission = participant.getCertificateSubmission();
+            if (submission == null || participant.getStatus() != ParticipantStatus.SIGNED) {
+                continue;
+            }
+
+            // Skip SERVER certificate type if feature is not available/enabled
+            if ("SERVER".equalsIgnoreCase(submission.getCertType())) {
+                if (serverCertificateServiceInterface == null
+                        || !serverCertificateServiceInterface.isEnabled()
+                        || !serverCertificateServiceInterface.hasServerCertificate()) {
+                    // Skip this participant - server certificate not available
+                    continue;
+                }
+            }
+
+            // Handle USER_CERT type - auto-generate if needed
+            if ("USER_CERT".equalsIgnoreCase(submission.getCertType())) {
+                if (userServerCertificateService == null
+                        || !sessionServiceInterface.isDatabaseBacked()) {
+                    log.warn(
+                            "USER_CERT requested but service not available, skipping participant: {}",
+                            participant.getEmail());
+                    continue;
+                }
+            }
+
+            KeyStore keystore = buildKeystore(submission, participant);
+            boolean usingServer = "SERVER".equalsIgnoreCase(submission.getCertType());
+            boolean usingUserCert = "USER_CERT".equalsIgnoreCase(submission.getCertType());
+            String password;
+            if (usingServer && serverCertificateServiceInterface != null) {
+                password = serverCertificateServiceInterface.getServerCertificatePassword();
+            } else if (usingUserCert && userServerCertificateService != null) {
+                password = submission.getPassword(); // Password stored in submission for user cert
+            } else {
+                password = submission.getPassword();
+            }
+            CreateSignature createSignature =
+                    new CreateSignature(
+                            keystore, password != null ? password.toCharArray() : new char[0]);
+
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            CertSignController.sign(
+                    pdfDocumentFactory,
+                    new ByteArrayInputStream(pdf),
+                    baos,
+                    createSignature,
+                    submission.getShowSignature(),
+                    submission.getPageNumber() != null
+                            ? Math.max(submission.getPageNumber() - 1, 0)
+                            : null,
+                    StringUtils.defaultIfBlank(participant.getName(), "Shared Signing"),
+                    StringUtils.defaultIfBlank(submission.getLocation(), ""),
+                    StringUtils.defaultIfBlank(submission.getReason(), "Document Signing"),
+                    submission.getShowLogo());
+
+            pdf = baos.toByteArray();
+        }
+
+        session.setSignedPdf(pdf);
+
+        // Mark session as finalized in database if database service is available
+        sessionServiceInterface.markSessionFinalized(sessionId, pdf);
+
+        // Step 3: Clean up wet signature metadata (GDPR compliance)
+        if (sessionServiceInterface.isDatabaseBacked()) {
+            try {
+                clearWetSignatureMetadata(sessionId);
+            } catch (Exception e) {
+                log.error(
+                        "Failed to clear wet signature metadata for session {}: {}",
+                        sessionId,
+                        e.getMessage());
+                // Don't fail the finalization if cleanup fails
+            }
+        }
+
+        return WebResponseUtils.bytesToWebResponse(
+                pdf,
+                GeneralUtils.generateFilename(session.getDocumentName(), "_shared_signed.pdf"));
+    }
+
+    private KeyStore buildKeystore(
+            ParticipantCertificateSubmission submission, SigningParticipant participant)
+            throws Exception {
+        CertSignController certSignController =
+                new CertSignController(pdfDocumentFactory, serverCertificateServiceInterface);
+        String certType = submission.getCertType().toUpperCase(Locale.ROOT);
+        String password = submission.getPassword();
+        switch (certType) {
+            case "USER_CERT":
+                if (userServerCertificateService == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.userCertificateNotAvailable",
+                            "User certificate service is not available in this edition");
+                }
+                // Get user ID from participant
+                Long userId = getUserIdFromParticipant(participant);
+                if (userId == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.userNotFound", "Cannot determine user ID for participant");
+                }
+                // Auto-generate certificate if user doesn't have one
+                try {
+                    userServerCertificateService.getOrCreateUserCertificate(userId);
+                    KeyStore userKeyStore = userServerCertificateService.getUserKeyStore(userId);
+                    String userPassword =
+                            userServerCertificateService.getUserKeystorePassword(userId);
+                    // Store password in submission for later use
+                    submission.setPassword(userPassword);
+                    return userKeyStore;
+                } catch (Exception e) {
+                    log.error("Failed to get/create user certificate for user {}", userId, e);
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.userCertificateFailure",
+                            "Failed to get user certificate: " + e.getMessage());
+                }
+            case "PEM":
+                KeyStore pemStore = KeyStore.getInstance("JKS");
+                pemStore.load(null);
+                if (submission.getPrivateKey() == null || submission.getCertificate() == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.optionsNotSpecified",
+                            "{0} options are not specified",
+                            "PEM certificate and key bytes for signer");
+                }
+                PrivateKey privateKey =
+                        certSignController.getPrivateKeyFromPEM(
+                                submission.getPrivateKey(), password);
+                Certificate certificate =
+                        (Certificate)
+                                certSignController.getCertificateFromPEM(
+                                        submission.getCertificate());
+                pemStore.setKeyEntry(
+                        "alias",
+                        privateKey,
+                        password.toCharArray(),
+                        new Certificate[] {certificate});
+                return pemStore;
+            case "PKCS12":
+            case "PFX":
+                if (submission.getP12Keystore() == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.optionsNotSpecified",
+                            "{0} options are not specified",
+                            "PKCS12 keystore bytes");
+                }
+                KeyStore p12Store = KeyStore.getInstance("PKCS12");
+                p12Store.load(
+                        new ByteArrayInputStream(submission.getP12Keystore()),
+                        password.toCharArray());
+                return p12Store;
+            case "JKS":
+                if (submission.getJksKeystore() == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.optionsNotSpecified",
+                            "{0} options are not specified",
+                            "JKS keystore bytes");
+                }
+                KeyStore jksStore = KeyStore.getInstance("JKS");
+                jksStore.load(
+                        new ByteArrayInputStream(submission.getJksKeystore()),
+                        password.toCharArray());
+                return jksStore;
+            case "SERVER":
+                if (serverCertificateServiceInterface == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.serverCertificateNotAvailable",
+                            "Server certificate service is not available in this edition");
+                }
+                if (!serverCertificateServiceInterface.isEnabled()) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.serverCertificateDisabled",
+                            "Server certificate feature is disabled");
+                }
+                if (!serverCertificateServiceInterface.hasServerCertificate()) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.serverCertificateNotFound", "No server certificate configured");
+                }
+                return serverCertificateServiceInterface.getServerKeyStore();
+            default:
+                throw ExceptionUtils.createIllegalArgumentException(
+                        "error.invalidArgument",
+                        "Invalid argument: {0}",
+                        "certificate type: " + submission.getCertType());
+        }
+    }
+
+    /**
+     * Applies wet signatures (visual annotations) to the PDF. This must be done BEFORE applying
+     * digital certificates.
+     *
+     * @param pdfBytes Original PDF bytes
+     * @param sessionId Session ID
+     * @return PDF bytes with wet signatures overlaid
+     * @throws Exception if PDF processing fails
+     */
+    private byte[] applyWetSignatures(byte[] pdfBytes, String sessionId) throws Exception {
+        // Cast to database service to access wet signature methods
+        if (!(sessionServiceInterface
+                instanceof
+                stirling.software.proprietary.security.service.DatabaseSigningSessionService)) {
+            return pdfBytes; // Skip if not database service
+        }
+
+        stirling.software.proprietary.security.service.DatabaseSigningSessionService dbService =
+                (stirling.software.proprietary.security.service.DatabaseSigningSessionService)
+                        sessionServiceInterface;
+
+        List<WetSignatureMetadata> wetSignatures = dbService.getAllWetSignatures(sessionId);
+        if (wetSignatures.isEmpty()) {
+            return pdfBytes; // No wet signatures to apply
+        }
+
+        // Load PDF document
+        org.apache.pdfbox.pdmodel.PDDocument document =
+                pdfDocumentFactory.load(new ByteArrayInputStream(pdfBytes));
+
+        try {
+            for (WetSignatureMetadata wetSig : wetSignatures) {
+                applyWetSignatureToPage(document, wetSig);
+            }
+
+            // Save modified PDF
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            document.save(baos);
+            return baos.toByteArray();
+        } finally {
+            document.close();
+        }
+    }
+
+    /**
+     * Applies a single wet signature to the appropriate page of the PDF.
+     *
+     * @param document PDF document
+     * @param wetSig Wet signature metadata
+     * @throws Exception if image processing or PDF manipulation fails
+     */
+    private void applyWetSignatureToPage(
+            org.apache.pdfbox.pdmodel.PDDocument document, WetSignatureMetadata wetSig)
+            throws Exception {
+        if (wetSig.getPage() >= document.getNumberOfPages()) {
+            log.warn(
+                    "Wet signature page {} exceeds document pages {}, skipping",
+                    wetSig.getPage(),
+                    document.getNumberOfPages());
+            return;
+        }
+
+        org.apache.pdfbox.pdmodel.PDPage page = document.getPage(wetSig.getPage());
+        org.apache.pdfbox.pdmodel.PDPageContentStream contentStream =
+                new org.apache.pdfbox.pdmodel.PDPageContentStream(
+                        document,
+                        page,
+                        org.apache.pdfbox.pdmodel.PDPageContentStream.AppendMode.APPEND,
+                        true,
+                        true);
+
+        try {
+            // Extract base64 data (remove data:image/png;base64, prefix if present)
+            String base64Data = wetSig.extractBase64Data();
+            byte[] imageBytes = java.util.Base64.getDecoder().decode(base64Data);
+
+            // Create PDImageXObject from bytes
+            org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject image =
+                    org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject.createFromByteArray(
+                            document, imageBytes, "signature");
+
+            // Convert Y coordinate from UI (top-left) to PDF (bottom-left) coordinate system
+            float pdfY =
+                    page.getMediaBox().getHeight()
+                            - wetSig.getY().floatValue()
+                            - wetSig.getHeight().floatValue();
+
+            // Draw image at specified position
+            contentStream.drawImage(
+                    image,
+                    wetSig.getX().floatValue(),
+                    pdfY,
+                    wetSig.getWidth().floatValue(),
+                    wetSig.getHeight().floatValue());
+        } finally {
+            contentStream.close();
+        }
+    }
+
+    /**
+     * Clears wet signature metadata from all participants. Called after successful finalization for
+     * GDPR compliance.
+     *
+     * @param sessionId Session ID
+     */
+    private void clearWetSignatureMetadata(String sessionId) {
+        if (sessionServiceInterface
+                instanceof
+                stirling.software.proprietary.security.service.DatabaseSigningSessionService) {
+            stirling.software.proprietary.security.service.DatabaseSigningSessionService dbService =
+                    (stirling.software.proprietary.security.service.DatabaseSigningSessionService)
+                            sessionServiceInterface;
+            dbService.clearWetSignatureMetadata(sessionId);
+        }
+    }
+
+    /**
+     * Helper method to get user ID from participant. Returns null if not available (e.g., in-memory
+     * sessions).
+     *
+     * @param participant The signing participant
+     * @return User ID or null
+     */
+    private Long getUserIdFromParticipant(SigningParticipant participant) {
+        return participant.getUserId();
+    }
+
+    @Operation(summary = "List sign requests for authenticated user")
+    @GetMapping(value = "/cert-sign/sign-requests")
+    public ResponseEntity<?> listSignRequests(Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            return ResponseEntity.ok(sessionServiceInterface.listSignRequests(principal.getName()));
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body("Cannot list sign requests: " + e.getMessage());
+        }
+    }
+
+    @Operation(summary = "Get sign request detail for participant")
+    @GetMapping(value = "/cert-sign/sign-requests/{sessionId}")
+    public ResponseEntity<?> getSignRequestDetail(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            return ResponseEntity.ok(
+                    sessionServiceInterface.getSignRequestDetail(sessionId, principal.getName()));
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body("Access denied or sign request not found: " + e.getMessage());
+        }
+    }
+
+    @Operation(summary = "Decline a sign request")
+    @PostMapping(value = "/cert-sign/sign-requests/{sessionId}/decline")
+    public ResponseEntity<?> declineSignRequest(
+            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            sessionServiceInterface.declineSignRequest(sessionId, principal.getName());
+            return ResponseEntity.noContent().build();
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body("Cannot decline sign request: " + e.getMessage());
+        }
+    }
+
+    @Operation(
+            summary = "Sign a document with optional wet signature",
+            description =
+                    "Submits certificate and optional wet signature annotation metadata for a signing session")
+    @PostMapping(
+            value = "/cert-sign/sessions/{sessionId}/sign",
+            consumes = {
+                MediaType.MULTIPART_FORM_DATA_VALUE,
+                MediaType.APPLICATION_FORM_URLENCODED_VALUE
+            })
+    public ResponseEntity<?> signDocument(
+            @PathVariable("sessionId") @NotBlank String sessionId,
+            @ModelAttribute SignDocumentRequest request,
+            Principal principal) {
+        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
+        }
+        try {
+            sessionServiceInterface.signDocument(sessionId, principal.getName(), request);
+            return ResponseEntity.noContent().build();
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(e.getMessage());
+        } catch (Exception e) {
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body("Cannot sign document: " + e.getMessage());
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java

@@ -25,7 +25,7 @@ import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.SPDF.service.SignatureService;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.UserServiceInterface;
@@ -37,13 +37,13 @@ import stirling.software.common.util.GeneralUtils;
 @Slf4j
 public class GeneralWebController {
 
-    private final SharedSignatureService signatureService;
+    private final SignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public GeneralWebController(
-            SharedSignatureService signatureService,
+            SignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,129 +1,20 @@
 package stirling.software.SPDF.controller.web;
 
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-import jakarta.annotation.PostConstruct;
-import jakarta.servlet.http.HttpServletRequest;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Slf4j
 @Controller
 public class ReactRoutingController {
 
-    @Value("${server.servlet.context-path:/}")
-    private String contextPath;
-
-    private String cachedIndexHtml;
-    private boolean indexHtmlExists = false;
-    private boolean useExternalIndexHtml = false;
-
-    @PostConstruct
-    public void init() {
-        log.info("Static files custom path: {}", InstallationPathConfig.getStaticPath());
-
-        // Check for external index.html first (customFiles/static/)
-        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
-        log.debug("Checking for custom index.html at: {}", externalIndexPath);
-        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
-            log.info("Using custom index.html from: {}", externalIndexPath);
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-                this.useExternalIndexHtml = true;
-                return;
-            } catch (IOException e) {
-                log.warn("Failed to load custom index.html, falling back to classpath", e);
-            }
-        }
-
-        // Fall back to classpath index.html
-        ClassPathResource resource = new ClassPathResource("static/index.html");
-        if (resource.exists()) {
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-                this.useExternalIndexHtml = false;
-            } catch (IOException e) {
-                // Failed to cache, will process on each request
-                log.warn("Failed to cache index.html", e);
-                this.indexHtmlExists = false;
-            }
-        }
-    }
-
-    private String processIndexHtml() throws IOException {
-        Resource resource = getIndexHtmlResource();
-
-        try (InputStream inputStream = resource.getInputStream()) {
-            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-
-            // Replace %BASE_URL% with the actual context path for base href
-            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-            html = html.replace("%BASE_URL%", baseUrl);
-            // Also rewrite any existing <base> tag (Vite may have baked one in)
-            html =
-                    html.replaceFirst(
-                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
-                            "<base href=\\\"" + baseUrl + "\\\" />");
-
-            // Inject context path as a global variable for API calls
-            String contextPathScript =
-                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
-            html = html.replace("</head>", contextPathScript + "</head>");
-
-            return html;
-        }
-    }
-
-    private Resource getIndexHtmlResource() throws IOException {
-        // Check external location first
-        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
-        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
-            return new FileSystemResource(externalIndexPath.toFile());
-        }
-
-        // Fall back to classpath
-        return new ClassPathResource("static/index.html");
+    @GetMapping(
+            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*$}")
+    public String forwardRootPaths() {
+        return "forward:/index.html";
     }
 
     @GetMapping(
-            value = {"/", "/index.html"},
-            produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
-        if (indexHtmlExists && cachedIndexHtml != null) {
-            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
-        }
-        // Fallback: process on each request (dev mode or cache failed)
-        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
-    }
-
-    @GetMapping(
-            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
-    public ResponseEntity<String> forwardRootPaths(HttpServletRequest request) throws IOException {
-        return serveIndexHtml(request);
-    }
-
-    @GetMapping(
-            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
-    public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
-            throws IOException {
-        return serveIndexHtml(request);
+            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    public String forwardNestedPaths() {
+        return "forward:/index.html";
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java

@@ -0,0 +1,48 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import stirling.software.SPDF.service.SignatureService;
+import stirling.software.common.service.UserServiceInterface;
+
+// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
+@RequestMapping("/api/v1/general")
+public class SignatureController {
+
+    private final SignatureService signatureService;
+
+    private final UserServiceInterface userService;
+
+    public SignatureController(
+            SignatureService signatureService,
+            @Autowired(required = false) UserServiceInterface userService) {
+        this.signatureService = signatureService;
+        this.userService = userService;
+    }
+
+    @GetMapping("/sign/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
+            throws IOException {
+        String username = "NON_SECURITY_USER";
+        if (userService != null) {
+            username = userService.getCurrentUsername();
+        }
+        // Verify access permission
+        if (!signatureService.hasAccessToFile(username, fileName)) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
+        return ResponseEntity.ok()
+                .contentType( // Adjust based on file type
+                        MediaType.IMAGE_JPEG)
+                .body(imageBytes);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureImageController.java

@@ -1,84 +0,0 @@
-package stirling.software.SPDF.controller.web;
-
-import java.io.IOException;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.service.SharedSignatureService;
-import stirling.software.common.service.PersonalSignatureServiceInterface;
-import stirling.software.common.service.UserServiceInterface;
-
-/**
- * Unified signature image controller that works for both authenticated and unauthenticated users.
- * Uses composition pattern: - Core SharedSignatureService (always available): reads shared
- * signatures - PersonalSignatureService (proprietary, optional): reads personal signatures For
- * authenticated signature management (save/delete), see proprietary SignatureController.
- */
-@Slf4j
-@RestController
-@RequestMapping("/api/v1/general")
-public class SignatureImageController {
-
-    private final SharedSignatureService sharedSignatureService;
-    private final PersonalSignatureServiceInterface personalSignatureService;
-    private final UserServiceInterface userService;
-
-    public SignatureImageController(
-            SharedSignatureService sharedSignatureService,
-            @Autowired(required = false) PersonalSignatureServiceInterface personalSignatureService,
-            @Autowired(required = false) UserServiceInterface userService) {
-        this.sharedSignatureService = sharedSignatureService;
-        this.personalSignatureService = personalSignatureService;
-        this.userService = userService;
-    }
-
-    /**
-     * Get a signature image (works for both authenticated and unauthenticated users). -
-     * Authenticated with proprietary: tries personal first, then shared - Unauthenticated or
-     * community: tries shared only
-     */
-    @GetMapping("/signatures/{fileName}")
-    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName) {
-        try {
-            byte[] imageBytes = null;
-
-            // If proprietary service available and user authenticated, try personal folder first
-            if (personalSignatureService != null && userService != null) {
-                try {
-                    String username = userService.getCurrentUsername();
-                    imageBytes =
-                            personalSignatureService.getPersonalSignatureBytes(username, fileName);
-                } catch (Exception e) {
-                    // Not found in personal folder or not authenticated, will try shared
-                    log.debug("Personal signature not found, trying shared: {}", e.getMessage());
-                }
-            }
-
-            // If not found in personal (or no personal service), try shared
-            if (imageBytes == null) {
-                imageBytes = sharedSignatureService.getSharedSignatureBytes(fileName);
-            }
-
-            // Determine content type from file extension
-            MediaType contentType = MediaType.IMAGE_PNG; // Default
-            String lowerFileName = fileName.toLowerCase();
-            if (lowerFileName.endsWith(".jpg") || lowerFileName.endsWith(".jpeg")) {
-                contentType = MediaType.IMAGE_JPEG;
-            }
-
-            return ResponseEntity.ok().contentType(contentType).body(imageBytes);
-        } catch (IOException e) {
-            log.debug("Signature not found: {}", fileName);
-            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/exception/CacheUnavailableException.java

@@ -1,8 +0,0 @@
-package stirling.software.SPDF.exception;
-
-public class CacheUnavailableException extends RuntimeException {
-
-    public CacheUnavailableException(String message) {
-        super(message);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/model/api/misc/OptimizePdfRequest.java

@@ -45,26 +45,4 @@ public class OptimizePdfRequest extends PDFFile {
             requiredMode = Schema.RequiredMode.REQUIRED,
             defaultValue = "false")
     private Boolean grayscale = false;
-
-    @Schema(
-            description =
-                    "Whether to convert images to high-contrast line art using ImageMagick. Default is false.",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "false")
-    private Boolean lineArt = false;
-
-    @Schema(
-            description = "Threshold to use for line art conversion (0-100).",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "55")
-    private Double lineArtThreshold = 55d;
-
-    @Schema(
-            description =
-                    "Edge detection strength to use for line art conversion (1-3). This maps to"
-                            + " ImageMagick's -edge radius.",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "1",
-            allowableValues = {"1", "2", "3"})
-    private Integer lineArtEdgeLevel = 1;
 }

app/core/src/main/java/stirling/software/SPDF/model/api/security/MultiSignPDFWithCertRequest.java

@@ -0,0 +1,68 @@
+package stirling.software.SPDF.model.api.security;
+
+import java.util.List;
+
+import org.springframework.web.multipart.MultipartFile;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import stirling.software.common.model.api.PDFFile;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class MultiSignPDFWithCertRequest extends PDFFile {
+
+    @Schema(
+            description = "The list of certificate types for each signer",
+            allowableValues = {"PEM", "PKCS12", "PFX", "JKS", "SERVER"},
+            requiredMode = Schema.RequiredMode.REQUIRED)
+    private List<String> certTypes;
+
+    @Schema(
+            description =
+                    "Private key files for PEM certificates (supports .pem, .der, or .key files)."
+                            + " Should match the order of certTypes when PEM is selected")
+    private List<MultipartFile> privateKeyFiles;
+
+    @Schema(
+            description =
+                    "Certificate files for PEM certificates (supports .pem, .der, .crt, or .cer files)."
+                            + " Should match the order of certTypes when PEM is selected")
+    private List<MultipartFile> certFiles;
+
+    @Schema(
+            description =
+                    "PKCS12/PFX keystore files. Should match the order of certTypes when PKCS12 or PFX is selected")
+    private List<MultipartFile> p12Files;
+
+    @Schema(
+            description =
+                    "JKS keystore files. Should match the order of certTypes when JKS is selected")
+    private List<MultipartFile> jksFiles;
+
+    @Schema(description = "Passwords for keystores or private keys", format = "password")
+    private List<String> passwords;
+
+    @Schema(description = "Whether to visually show each signature in the PDF")
+    private List<Boolean> showSignatures;
+
+    @Schema(description = "Reasons for signing, aligned with certTypes")
+    private List<String> reasons;
+
+    @Schema(description = "Locations for signing, aligned with certTypes")
+    private List<String> locations;
+
+    @Schema(description = "Signer names, aligned with certTypes")
+    private List<String> names;
+
+    @Schema(
+            description =
+                    "Page numbers for visible signatures (1-indexed). Required when showSignature is true for a signer")
+    private List<Integer> pageNumbers;
+
+    @Schema(description = "Whether to show a signature logo for each signer")
+    private List<Boolean> showLogos;
+}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureRequest.java

@@ -1,18 +0,0 @@
-package stirling.software.SPDF.model.api.signature;
-
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-public class SavedSignatureRequest {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureResponse.java

@@ -1,22 +0,0 @@
-package stirling.software.SPDF.model.api.signature;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SavedSignatureResponse {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types (or URL to fetch image)
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-    private Long createdAt;
-    private Long updatedAt;
-}

app/core/src/main/java/stirling/software/SPDF/service/SharedSignatureService.java

@@ -1,308 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.nio.file.StandardOpenOption;
-import java.util.ArrayList;
-import java.util.Base64;
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.springframework.stereotype.Service;
-import org.springframework.util.StringUtils;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.model.api.signature.SavedSignatureRequest;
-import stirling.software.SPDF.model.api.signature.SavedSignatureResponse;
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Service
-@Slf4j
-public class SharedSignatureService {
-
-    private final String SIGNATURE_BASE_PATH;
-    private final String ALL_USERS_FOLDER = "ALL_USERS";
-    private final ObjectMapper objectMapper;
-
-    public SharedSignatureService() {
-        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
-        this.objectMapper = new ObjectMapper();
-    }
-
-    public boolean hasAccessToFile(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // Check if file exists in user's personal folder or ALL_USERS folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-
-        return Files.exists(userPath) || Files.exists(allUsersPath);
-    }
-
-    public List<SignatureFile> getAvailableSignatures(String username) {
-        List<SignatureFile> signatures = new ArrayList<>();
-
-        // Get signatures from user's personal folder
-        if (StringUtils.hasText(username)) {
-            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-            if (Files.exists(userFolder)) {
-                try {
-                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
-                } catch (IOException e) {
-                    log.error("Error reading user signatures folder", e);
-                }
-            }
-        }
-
-        // Get signatures from ALL_USERS folder
-        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(allUsersFolder)) {
-            try {
-                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
-            } catch (IOException e) {
-                log.error("Error reading shared signatures folder", e);
-            }
-        }
-
-        return signatures;
-    }
-
-    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
-            throws IOException {
-        try (Stream<Path> stream = Files.list(folder)) {
-            return stream.filter(this::isImageFile)
-                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
-                    .toList();
-        }
-    }
-
-    /**
-     * Get a signature from the shared (ALL_USERS) folder. This is always available for both
-     * authenticated and unauthenticated users.
-     */
-    public byte[] getSharedSignatureBytes(String fileName) throws IOException {
-        validateFileName(fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-        if (!Files.exists(allUsersPath)) {
-            throw new FileNotFoundException("Shared signature file not found");
-        }
-        return Files.readAllBytes(allUsersPath);
-    }
-
-    private boolean isImageFile(Path path) {
-        String fileName = path.getFileName().toString().toLowerCase();
-        return fileName.endsWith(".jpg") || fileName.endsWith(".jpeg") || fileName.endsWith(".png");
-    }
-
-    private void validateFileName(String fileName) {
-        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
-            throw new IllegalArgumentException("Invalid filename");
-        }
-        // Only allow alphanumeric, hyphen, underscore, and dot (for extensions)
-        if (!fileName.matches("^[a-zA-Z0-9_.-]+$")) {
-            throw new IllegalArgumentException("Filename contains invalid characters");
-        }
-    }
-
-    private String validateAndNormalizeExtension(String extension) {
-        String normalized = extension.toLowerCase().trim();
-        // Whitelist only safe image extensions
-        if (normalized.equals("png") || normalized.equals("jpg") || normalized.equals("jpeg")) {
-            return normalized;
-        }
-        throw new IllegalArgumentException("Unsupported image extension: " + extension);
-    }
-
-    private void verifyPathWithinDirectory(Path resolvedPath, Path targetDirectory)
-            throws IOException {
-        Path canonicalTarget = targetDirectory.toAbsolutePath().normalize();
-        Path canonicalResolved = resolvedPath.toAbsolutePath().normalize();
-        if (!canonicalResolved.startsWith(canonicalTarget)) {
-            throw new IOException("Resolved path is outside the target directory");
-        }
-    }
-
-    /** Save a signature as image file */
-    public SavedSignatureResponse saveSignature(String username, SavedSignatureRequest request)
-            throws IOException {
-        validateFileName(request.getId());
-
-        // Determine folder based on scope
-        String scope = request.getScope();
-        if (scope == null || scope.isEmpty()) {
-            scope = "personal"; // Default to personal
-        }
-
-        String folderName = "shared".equals(scope) ? ALL_USERS_FOLDER : username;
-        Path targetFolder = Paths.get(SIGNATURE_BASE_PATH, folderName);
-        Files.createDirectories(targetFolder);
-
-        long timestamp = System.currentTimeMillis();
-
-        SavedSignatureResponse response = new SavedSignatureResponse();
-        response.setId(request.getId());
-        response.setLabel(request.getLabel());
-        response.setType(request.getType());
-        response.setScope(scope);
-        response.setCreatedAt(timestamp);
-        response.setUpdatedAt(timestamp);
-
-        // Extract and save image data
-        String dataUrl = request.getDataUrl();
-        if (dataUrl != null && dataUrl.startsWith("data:image/")) {
-            // Extract base64 data
-            String base64Data = dataUrl.substring(dataUrl.indexOf(",") + 1);
-            byte[] imageBytes = Base64.getDecoder().decode(base64Data);
-
-            // Determine and validate file extension from data URL
-            String mimeType = dataUrl.substring(dataUrl.indexOf(":") + 1, dataUrl.indexOf(";"));
-            String rawExtension = mimeType.substring(mimeType.indexOf("/") + 1);
-            String extension = validateAndNormalizeExtension(rawExtension);
-
-            // Save image file only
-            String imageFileName = request.getId() + "." + extension;
-            Path imagePath = targetFolder.resolve(imageFileName);
-
-            // Verify path is within target directory
-            verifyPathWithinDirectory(imagePath, targetFolder);
-
-            Files.write(
-                    imagePath,
-                    imageBytes,
-                    StandardOpenOption.CREATE,
-                    StandardOpenOption.TRUNCATE_EXISTING);
-
-            // Store reference to image file
-            response.setDataUrl("/api/v1/general/signatures/" + imageFileName);
-        }
-
-        log.info("Saved signature {} for user {}", request.getId(), username);
-        return response;
-    }
-
-    /** Get all saved signatures for a user */
-    public List<SavedSignatureResponse> getSavedSignatures(String username) throws IOException {
-        List<SavedSignatureResponse> signatures = new ArrayList<>();
-
-        // Load personal signatures
-        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-        if (Files.exists(personalFolder)) {
-            try (Stream<Path> stream = Files.list(personalFolder)) {
-                stream.filter(this::isImageFile)
-                        .forEach(
-                                path -> {
-                                    try {
-                                        String fileName = path.getFileName().toString();
-                                        String id =
-                                                fileName.substring(0, fileName.lastIndexOf('.'));
-
-                                        SavedSignatureResponse sig = new SavedSignatureResponse();
-                                        sig.setId(id);
-                                        sig.setLabel(id); // Use ID as label
-                                        sig.setType("image"); // Default type
-                                        sig.setScope("personal");
-                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
-                                        sig.setCreatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-                                        sig.setUpdatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-
-                                        signatures.add(sig);
-                                    } catch (IOException e) {
-                                        log.error("Error reading signature file: " + path, e);
-                                    }
-                                });
-            }
-        }
-
-        // Load shared signatures
-        Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(sharedFolder)) {
-            try (Stream<Path> stream = Files.list(sharedFolder)) {
-                stream.filter(this::isImageFile)
-                        .forEach(
-                                path -> {
-                                    try {
-                                        String fileName = path.getFileName().toString();
-                                        String id =
-                                                fileName.substring(0, fileName.lastIndexOf('.'));
-
-                                        SavedSignatureResponse sig = new SavedSignatureResponse();
-                                        sig.setId(id);
-                                        sig.setLabel(id); // Use ID as label
-                                        sig.setType("image"); // Default type
-                                        sig.setScope("shared");
-                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
-                                        sig.setCreatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-                                        sig.setUpdatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-
-                                        signatures.add(sig);
-                                    } catch (IOException e) {
-                                        log.error("Error reading signature file: " + path, e);
-                                    }
-                                });
-            }
-        }
-
-        return signatures;
-    }
-
-    /** Delete a saved signature */
-    public void deleteSignature(String username, String signatureId) throws IOException {
-        validateFileName(signatureId);
-
-        // Try to find and delete image file in personal folder
-        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-        boolean deleted = false;
-
-        if (Files.exists(personalFolder)) {
-            try (Stream<Path> stream = Files.list(personalFolder)) {
-                List<Path> matchingFiles =
-                        stream.filter(
-                                        path ->
-                                                path.getFileName()
-                                                        .toString()
-                                                        .startsWith(signatureId + "."))
-                                .toList();
-                for (Path file : matchingFiles) {
-                    Files.delete(file);
-                    deleted = true;
-                }
-            }
-        }
-
-        // Try shared folder if not found in personal
-        if (!deleted) {
-            Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-            if (Files.exists(sharedFolder)) {
-                try (Stream<Path> stream = Files.list(sharedFolder)) {
-                    List<Path> matchingFiles =
-                            stream.filter(
-                                            path ->
-                                                    path.getFileName()
-                                                            .toString()
-                                                            .startsWith(signatureId + "."))
-                                    .toList();
-                    for (Path file : matchingFiles) {
-                        Files.delete(file);
-                        deleted = true;
-                    }
-                }
-            }
-        }
-
-        if (!deleted) {
-            throw new FileNotFoundException("Signature not found");
-        }
-
-        log.info("Deleted signature {} for user {}", signatureId, username);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/service/SignatureService.java

@@ -0,0 +1,107 @@
+package stirling.software.SPDF.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.SignatureFile;
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Service
+@Slf4j
+public class SignatureService {
+
+    private final String SIGNATURE_BASE_PATH;
+    private final String ALL_USERS_FOLDER = "ALL_USERS";
+
+    public SignatureService() {
+        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
+    }
+
+    public boolean hasAccessToFile(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // Check if file exists in user's personal folder or ALL_USERS folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+
+        return Files.exists(userPath) || Files.exists(allUsersPath);
+    }
+
+    public List<SignatureFile> getAvailableSignatures(String username) {
+        List<SignatureFile> signatures = new ArrayList<>();
+
+        // Get signatures from user's personal folder
+        if (StringUtils.hasText(username)) {
+            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+            if (Files.exists(userFolder)) {
+                try {
+                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
+                } catch (IOException e) {
+                    log.error("Error reading user signatures folder", e);
+                }
+            }
+        }
+
+        // Get signatures from ALL_USERS folder
+        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(allUsersFolder)) {
+            try {
+                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
+            } catch (IOException e) {
+                log.error("Error reading shared signatures folder", e);
+            }
+        }
+
+        return signatures;
+    }
+
+    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
+            throws IOException {
+        try (Stream<Path> stream = Files.list(folder)) {
+            return stream.filter(this::isImageFile)
+                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
+                    .toList();
+        }
+    }
+
+    public byte[] getSignatureBytes(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // First try user's personal folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        if (Files.exists(userPath)) {
+            return Files.readAllBytes(userPath);
+        }
+
+        // Then try ALL_USERS folder
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+        if (Files.exists(allUsersPath)) {
+            return Files.readAllBytes(allUsersPath);
+        }
+
+        throw new FileNotFoundException("Signature file not found");
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg")
+                || fileName.endsWith(".jpeg")
+                || fileName.endsWith(".png")
+                || fileName.endsWith(".gif");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/SigningSessionService.java

@@ -0,0 +1,214 @@
+package stirling.software.SPDF.service;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+
+import stirling.software.common.model.api.security.CreateSigningSessionRequest;
+import stirling.software.common.model.api.security.NotifySigningParticipantsRequest;
+import stirling.software.common.model.api.security.ParticipantCertificateRequest;
+import stirling.software.common.model.api.security.ParticipantCertificateSubmission;
+import stirling.software.common.model.api.security.ParticipantStatus;
+import stirling.software.common.model.api.security.SigningParticipant;
+import stirling.software.common.model.api.security.SigningSession;
+import stirling.software.common.service.SigningSessionServiceInterface;
+import stirling.software.common.util.ExceptionUtils;
+
+@Service
+public class SigningSessionService implements SigningSessionServiceInterface {
+
+    private final Map<String, SigningSession> sessions = new ConcurrentHashMap<>();
+
+    public SigningSession createSession(CreateSigningSessionRequest request) throws IOException {
+        return createSession(request, null);
+    }
+
+    @Override
+    public SigningSession createSession(Object requestObj, String username) throws IOException {
+        // In-memory implementation not supported for user-based signing (requires database)
+        throw new UnsupportedOperationException(
+                "User-based signing requires database-backed implementation");
+    }
+
+    public SigningSession getSession(String sessionId) {
+        SigningSession session = sessions.get(sessionId);
+        if (session == null) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.notFound", "Signing session {0} was not found", sessionId);
+        }
+        return session;
+    }
+
+    @Override
+    public SigningSession notifyParticipants(String sessionId, Object requestObj) {
+        NotifySigningParticipantsRequest request = (NotifySigningParticipantsRequest) requestObj;
+        SigningSession session = getSession(sessionId);
+        List<SigningParticipant> targets = getTargets(session, request.getParticipantEmails());
+        String message =
+                StringUtils.defaultIfBlank(
+                        request.getMessage(), "A reminder to review and sign the document.");
+
+        for (SigningParticipant participant : targets) {
+            participant.recordNotification(message);
+            if (participant.getStatus() == ParticipantStatus.PENDING) {
+                participant.setStatus(ParticipantStatus.NOTIFIED);
+            }
+        }
+        session.touch();
+        return session;
+    }
+
+    @Override
+    public SigningSession attachCertificate(String sessionId, Long userId, Object requestObj)
+            throws IOException {
+        // In-memory implementation doesn't support user-based participants
+        throw new UnsupportedOperationException(
+                "User-based signing not supported in non-database mode");
+    }
+
+    private void broadcastNotification(SigningSession session, String message) {
+        for (SigningParticipant participant : session.getParticipants()) {
+            participant.recordNotification(message);
+            if (participant.getStatus() == ParticipantStatus.PENDING) {
+                participant.setStatus(ParticipantStatus.NOTIFIED);
+            }
+        }
+        session.touch();
+    }
+
+    private ParticipantCertificateSubmission toSubmission(ParticipantCertificateRequest request)
+            throws IOException {
+        return ParticipantCertificateSubmission.builder()
+                .certType(request.getCertType())
+                .password(request.getPassword())
+                .privateKey(toBytes(request.getPrivateKeyFile()))
+                .certificate(toBytes(request.getCertFile()))
+                .p12Keystore(toBytes(request.getP12File()))
+                .jksKeystore(toBytes(request.getJksFile()))
+                .showSignature(request.getShowSignature())
+                .pageNumber(request.getPageNumber())
+                .name(request.getName())
+                .reason(request.getReason())
+                .location(request.getLocation())
+                .showLogo(request.getShowLogo())
+                .build();
+    }
+
+    private byte[] toBytes(MultipartFile file) throws IOException {
+        if (file == null || file.isEmpty()) {
+            return null;
+        }
+        return file.getBytes();
+    }
+
+    private List<SigningParticipant> getTargets(
+            SigningSession session, List<String> requestedEmails) {
+        if (requestedEmails == null || requestedEmails.isEmpty()) {
+            return session.getParticipants();
+        }
+
+        List<SigningParticipant> participants = new ArrayList<>();
+        for (String email : requestedEmails) {
+            Optional<SigningParticipant> participant =
+                    session.getParticipants().stream()
+                            .filter(p -> Objects.equals(p.getEmail(), email))
+                            .findFirst();
+            participant.ifPresent(participants::add);
+        }
+        return participants;
+    }
+
+    // Interface methods that are not supported by in-memory implementation
+    @Override
+    public List<?> listUserSessions(String username) {
+        // In-memory implementation doesn't support user filtering
+        return Collections.emptyList();
+    }
+
+    @Override
+    public Object getSessionDetail(String sessionId, String username) {
+        // In-memory implementation doesn't have separate detail view
+        return getSession(sessionId);
+    }
+
+    @Override
+    public void deleteSession(String sessionId, String username) {
+        // In-memory implementation doesn't support deletion
+        throw new UnsupportedOperationException(
+                "Session deletion not supported in non-database mode");
+    }
+
+    @Override
+    public Object addParticipants(String sessionId, Object request, String username) {
+        // In-memory implementation doesn't support adding participants
+        throw new UnsupportedOperationException(
+                "Adding participants not supported in non-database mode");
+    }
+
+    @Override
+    public void removeParticipant(String sessionId, Long userId, String username) {
+        // In-memory implementation doesn't support user-based participants
+        throw new UnsupportedOperationException(
+                "User-based signing not supported in non-database mode");
+    }
+
+    @Override
+    public void markSessionFinalized(String sessionId, byte[] signedPdf) {
+        SigningSession session = getSession(sessionId);
+        session.setSignedPdf(signedPdf);
+    }
+
+    @Override
+    public byte[] getSessionPdf(String sessionId, String username) {
+        // In-memory implementation doesn't support user authentication
+        throw new UnsupportedOperationException(
+                "User-based signing not supported in non-database mode");
+    }
+
+    @Override
+    public byte[] getSignedPdf(String sessionId, String username) {
+        throw new UnsupportedOperationException(
+                "getSignedPdf is only available in database-backed mode");
+    }
+
+    @Override
+    public List<?> listSignRequests(String username) {
+        // In-memory implementation doesn't support user-based sign requests
+        return Collections.emptyList();
+    }
+
+    @Override
+    public Object getSignRequestDetail(String sessionId, String username) {
+        // In-memory implementation doesn't support user-based signing
+        throw new UnsupportedOperationException(
+                "User-based signing not supported in non-database mode");
+    }
+
+    @Override
+    public void declineSignRequest(String sessionId, String username) {
+        // In-memory implementation doesn't support user-based signing
+        throw new UnsupportedOperationException(
+                "User-based signing not supported in non-database mode");
+    }
+
+    @Override
+    public void signDocument(String sessionId, String username, Object request) throws IOException {
+        // In-memory implementation doesn't support user-based signing with wet signatures
+        throw new UnsupportedOperationException(
+                "User-based signing not supported in non-database mode");
+    }
+
+    @Override
+    public boolean isDatabaseBacked() {
+        return false;
+    }
+}

app/core/src/main/resources/application.properties

@@ -37,8 +37,11 @@ spring.datasource.url=jdbc:h2:file:./configs/stirling-pdf-DB-2.3.232;DB_CLOSE_DE
 spring.datasource.driver-class-name=org.h2.Driver
 spring.datasource.username=sa
 spring.datasource.password=
-spring.h2.console.enabled=false
+spring.h2.console.enabled=true
 spring.jpa.hibernate.ddl-auto=update
+spring.jpa.properties.hibernate.format_sql=true
+logging.level.org.hibernate.SQL=error
+logging.level.org.hibernate.type.descriptor.sql.BasicBinder=TRACE
 # Defer datasource initialization to ensure that the database is fully set up
 # before Hibernate attempts to access it. This is particularly useful when
 # using database initialization scripts or tools.
@@ -65,3 +68,9 @@ java.io.tmpdir=${stirling.tempfiles.directory:${java.io.tmpdir}/stirling-pdf}
 
 # V2 features
 v2=true
+
+# User personal certificates (per-user signing certificates)
+system.userCertificates.enabled=true
+system.userCertificates.autoGenerate=true
+system.userCertificates.validity=365
+system.userCertificates.keySize=2048

app/core/src/main/resources/settings.yml.template

@@ -12,6 +12,7 @@
 
 security:
   enableLogin: true # set to 'true' to enable login
+  csrfDisabled: false # set to 'true' to disable CSRF protection (not recommended for production)
   loginAttemptCount: 5 # lock user account after 5 tries; when using e.g. Fail2Ban you can deactivate the function with -1
   loginResetTimeMinutes: 120 # lock account for 2 hours after x attempts
   loginMethod: all # Accepts values like 'all' and 'normal'(only Login with Username/Password), 'oauth2'(only Login with OAuth2) or 'saml2'(only Login with SAML2)
@@ -58,8 +59,6 @@ security:
     idpCert: classpath:okta.cert # The certificate your Provider will use to authenticate your app's SAML authentication requests. Provided by your Provider
     privateKey: classpath:saml-private-key.key # Your private key. Generated from your keypair
     spCert: classpath:saml-public-cert.crt # Your signing certificate. Generated from your keypair
-    # IMPORTANT: For SAML setup, download your SP metadata from the BACKEND URL: http://localhost:8080/saml2/service-provider-metadata/{registrationId}
-    # Do NOT use the frontend dev server URL (localhost:5173) as it will generate incorrect ACS URLs. Always use the backend URL (localhost:8080) for SAML configuration.
   jwt: # This feature is currently under development and not yet fully supported. Do not use in production.
     persistence: true # Set to 'true' to enable JWT key store
     enableKeyRotation: true # Set to 'true' to enable key pair rotation
@@ -106,11 +105,6 @@ mail:
   username: '' # SMTP server username
   password: '' # SMTP server password
   from: '' # sender email address
-  startTlsEnable: true # enable STARTTLS (explicit TLS upgrade after connecting) when supported by the SMTP server
-  startTlsRequired: false # require STARTTLS; connection fails if the upgrade command is not supported
-  sslEnable: false # enable SSL/TLS wrapper for implicit TLS (typically used with port 465)
-  sslTrust: '' # optional trusted host override, e.g. "smtp.example.com" or "*"; defaults to "*" (trust all) when empty
-  sslCheckServerIdentity: false # enable hostname verification when using SSL/TLS
 
 legal:
   termsAndConditions: https://www.stirling.com/legal/terms-of-service # URL to the terms and conditions of your application (e.g. https://example.com/terms). Empty string to disable or filename to load from local file in static folder
@@ -128,15 +122,13 @@ system:
   customHTMLFiles: false # enable to have files placed in /customFiles/templates override the existing template HTML files
   tessdataDir: /usr/share/tessdata # path to the directory containing the Tessdata files. This setting is relevant for Windows systems. For Windows users, this path should be adjusted to point to the appropriate directory where the Tessdata files are stored.
   enableAnalytics: null # Master toggle for analytics: set to 'true' to enable all analytics, 'false' to disable all analytics, or leave as 'null' to prompt admin on first launch
-  enableDesktopInstallSlide: true # Set to 'false' to hide the desktop app installation slide in the onboarding flow
   enablePosthog: null # Enable PostHog analytics (open-source product analytics): set to 'true' to enable, 'false' to disable, or 'null' to enable by default when analytics is enabled
   enableScarf: null # Enable Scarf tracking pixel: set to 'true' to enable, 'false' to disable, or 'null' to enable by default when analytics is enabled
   enableUrlToPDF: false # Set to 'true' to enable URL to PDF, INTERNAL ONLY, known security issues, should not be used externally
   disableSanitize: false # set to true to disable Sanitize HTML; (can lead to injections in HTML)
   maxDPI: 500 # Maximum allowed DPI for PDF to image conversion
-  corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS. For local development with frontend on port 5173, add 'http://localhost:5173'
-  backendUrl: '' # Backend base URL for SAML/OAuth/API callbacks (e.g. 'http://localhost:8080' for dev, 'https://api.example.com' for production). REQUIRED for SSO authentication to work correctly. This is where your IdP will send SAML responses and OAuth callbacks. Leave empty to default to 'http://localhost:8080' in development.
-  frontendUrl: '' # Frontend URL for invite email links (e.g. 'https://app.example.com'). Optional - if not set, will use backendUrl. This is the URL users click in invite emails.
+  corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS.
+  frontendUrl: '' # Base URL for frontend (e.g. 'https://pdf.example.com'). Used for generating invite links in emails. If empty, falls back to backend URL.
   serverCertificate:
     enabled: true # Enable server-side certificate for "Sign with Stirling-PDF" option
     organizationName: Stirling-PDF # Organization name for generated certificates
@@ -182,6 +174,23 @@ system:
   databaseBackup:
     cron: '0 0 0 * * ?' # Cron expression for automatic database backups "0 0 0 * * ?" daily at midnight
 
+stirling:
+  pdf:
+    fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
+    json:
+      font-normalization:
+        enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
+      cff-converter:
+        enabled: true # Wrap CFF/Type1C fonts as OpenType-CFF for browser compatibility
+        method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
+        python-command: /opt/venv/bin/python3 # Python interpreter path
+        python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
+        fontforge-command: fontforge # Override if FontForge is installed under a different name/path
+      type3:
+        library:
+          enabled: true # Match common Type3 fonts against the built-in library of converted programs
+          index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)
+
 ui:
   appNameNavbar: '' # name displayed on the navigation bar
   logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
@@ -210,7 +219,6 @@ processExecutor:
     weasyPrintSessionLimit: 16
     installAppSessionLimit: 1
     calibreSessionLimit: 1
-    imageMagickSessionLimit: 4
     ghostscriptSessionLimit: 8
     ocrMyPdfSessionLimit: 2
   timeoutMinutes: # Process executor timeout in minutes
@@ -220,26 +228,7 @@ processExecutor:
     weasyPrinttimeoutMinutes: 30
     installApptimeoutMinutes: 60
     calibretimeoutMinutes: 30
-    imageMagickTimeoutMinutes: 30
     tesseractTimeoutMinutes: 30
     qpdfTimeoutMinutes: 30
     ghostscriptTimeoutMinutes: 30
     ocrMyPdfTimeoutMinutes: 30
-
-pdfEditor:
-  fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
-  cache:
-    max-bytes: -1 # Max in-memory cache size in bytes; -1 disables byte cap
-    max-percent: 20 # Max in-memory cache as % of JVM max; used when max-bytes <= 0
-  font-normalization:
-    enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
-  cff-converter:
-    enabled: true # Wrap CFF/Type1CFF fonts as OpenType-CFF for browser compatibility
-    method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
-    python-command: /opt/venv/bin/python3 # Python interpreter path
-    python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
-    fontforge-command: fontforge # Override if FontForge is installed under a different name/path
-  type3:
-    library:
-      enabled: true # Match common Type3 fonts against the built-in library of converted programs
-      index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)

app/core/src/main/resources/static/css/cookieconsentCustomisation.css

@@ -24,8 +24,8 @@
     --cc-toggle-on-knob-bg: var(--cc-btn-primary-color);
     --cc-toggle-off-knob-bg: var(--cc-btn-primary-color);
 
-    --cc-toggle-enabled-icon-color: var(--cc-btn-primary-color);
-    --cc-toggle-disabled-icon-color: var(--cc-btn-primary-color);
+    --cc-toggle-enabled-icon-color: var(--cc-btn-primary-color);   
+    --cc-toggle-disabled-icon-color: var(--cc-btn-primary-color);  
 
     --cc-toggle-readonly-bg: var(--md-sys-color-surface);
     --cc-toggle-readonly-knob-bg: var(--md-sys-color-outline);
@@ -34,10 +34,10 @@
     --cc-section-category-border: var(--md-sys-color-outline);
 
     --cc-cookie-category-block-bg: var(--cc-btn-secondary-bg);
-    --cc-cookie-category-block-border: var(--cc-btn-secondary-bg);
+    --cc-cookie-category-block-border: var(--cc-btn-secondary-bg); 
     --cc-cookie-category-block-hover-bg: var(--cc-btn-secondary-bg);
     --cc-cookie-category-block-hover-border: var(--cc-btn-secondary-bg);
-
+    
     --cc-cookie-category-expanded-block-bg: var(--cc-btn-secondary-bg);
     --cc-cookie-category-expanded-block-hover-bg: var(--cc-toggle-readonly-bg);
 
@@ -47,7 +47,7 @@
 */
     --cc-footer-bg: var(--cc-bg);
     --cc-footer-color: var(--cc-primary-color);
-    --cc-footer-border-color: var(--cc-bg);
+    --cc-footer-border-color: var(--cc-bg); 
 }
 .cm__body{
     max-width: 90% !important;
@@ -81,4 +81,4 @@
 /* Lower z-index so cookie banner appears behind onboarding modals */
 #cc-main {
     z-index: 100 !important;
-}
+}

app/core/src/test/java/stirling/software/SPDF/controller/api/security/CertSignControllerTest.java

@@ -1,10 +1,9 @@
 package stirling.software.SPDF.controller.api.security;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.when;
 
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
@@ -108,8 +107,7 @@ class CertSignControllerTest {
             derCertBytes = baos.toByteArray();
         }
 
-        lenient()
-                .when(pdfDocumentFactory.load(any(MultipartFile.class)))
+        when(pdfDocumentFactory.load(any(MultipartFile.class)))
                 .thenAnswer(
                         invocation -> {
                             MultipartFile file = invocation.getArgument(0);
@@ -169,31 +167,6 @@ class CertSignControllerTest {
         assertTrue(response.getBody().length > 0);
     }
 
-    @Test
-    void testSignPdfWithMissingPkcs12FileThrowsError() {
-        MockMultipartFile pdfFile =
-                new MockMultipartFile(
-                        "fileInput", "test.pdf", MediaType.APPLICATION_PDF_VALUE, pdfBytes);
-
-        SignPDFWithCertRequest request = new SignPDFWithCertRequest();
-        request.setFileInput(pdfFile);
-        request.setCertType("PFX");
-        request.setPassword("password");
-        request.setShowSignature(false);
-        request.setReason("test");
-        request.setLocation("test");
-        request.setName("tester");
-        request.setPageNumber(1);
-        request.setShowLogo(false);
-
-        IllegalArgumentException exception =
-                assertThrows(
-                        IllegalArgumentException.class,
-                        () -> certSignController.signPDFWithCert(request));
-
-        assertTrue(exception.getMessage().contains("PKCS12 keystore"));
-    }
-
     @Test
     void testSignPdfWithJks() throws Exception {
         MockMultipartFile pdfFile =

app/core/src/test/java/stirling/software/SPDF/service/SignatureServiceTest.java

@@ -23,7 +23,7 @@ import stirling.software.common.configuration.InstallationPathConfig;
 class SignatureServiceTest {
 
     @TempDir Path tempDir;
-    private SharedSignatureService signatureService;
+    private SignatureService signatureService;
     private Path personalSignatureFolder;
     private Path sharedSignatureFolder;
     private final String ALL_USERS_FOLDER = "ALL_USERS";
@@ -53,7 +53,7 @@ class SignatureServiceTest {
                     .thenReturn(tempDir.toString());
 
             // Initialize the service with our temp directory
-            signatureService = new SharedSignatureService();
+            signatureService = new SignatureService();
         }
     }
 
@@ -165,7 +165,7 @@ class SignatureServiceTest {
     }
 
     @Test
-    void testGetSharedSignatureBytes_SharedFile() throws IOException {
+    void testGetSignatureBytes_PersonalFile() throws IOException {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -173,8 +173,28 @@ class SignatureServiceTest {
                     .when(InstallationPathConfig::getSignaturesPath)
                     .thenReturn(tempDir.toString());
 
-            // Test - core service only reads shared signatures
-            byte[] bytes = signatureService.getSharedSignatureBytes("shared.jpg");
+            // Test
+            byte[] bytes = signatureService.getSignatureBytes(TEST_USER, "personal.png");
+
+            // Verify
+            assertEquals(
+                    "personal signature content",
+                    new String(bytes),
+                    "Should return the correct content for personal file");
+        }
+    }
+
+    @Test
+    void testGetSignatureBytes_SharedFile() throws IOException {
+        // Mock static method for each test
+        try (MockedStatic<InstallationPathConfig> mockedConfig =
+                mockStatic(InstallationPathConfig.class)) {
+            mockedConfig
+                    .when(InstallationPathConfig::getSignaturesPath)
+                    .thenReturn(tempDir.toString());
+
+            // Test
+            byte[] bytes = signatureService.getSignatureBytes(TEST_USER, "shared.jpg");
 
             // Verify
             assertEquals(
@@ -185,7 +205,7 @@ class SignatureServiceTest {
     }
 
     @Test
-    void testGetSharedSignatureBytes_FileNotFound() {
+    void testGetSignatureBytes_FileNotFound() {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -196,13 +216,13 @@ class SignatureServiceTest {
             // Test and verify
             assertThrows(
                     FileNotFoundException.class,
-                    () -> signatureService.getSharedSignatureBytes("nonexistent.png"),
+                    () -> signatureService.getSignatureBytes(TEST_USER, "nonexistent.png"),
                     "Should throw exception for non-existent files");
         }
     }
 
     @Test
-    void testGetSharedSignatureBytes_InvalidFileName() {
+    void testGetSignatureBytes_InvalidFileName() {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -213,28 +233,11 @@ class SignatureServiceTest {
             // Test and verify
             assertThrows(
                     IllegalArgumentException.class,
-                    () -> signatureService.getSharedSignatureBytes("../invalid.png"),
+                    () -> signatureService.getSignatureBytes(TEST_USER, "../invalid.png"),
                     "Should throw exception for file names with directory traversal");
         }
     }
 
-    @Test
-    void testGetSharedSignatureBytes_CannotAccessPersonalFiles() {
-        // Mock static method for each test
-        try (MockedStatic<InstallationPathConfig> mockedConfig =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedConfig
-                    .when(InstallationPathConfig::getSignaturesPath)
-                    .thenReturn(tempDir.toString());
-
-            // Test and verify - core service should NOT be able to read personal files
-            assertThrows(
-                    FileNotFoundException.class,
-                    () -> signatureService.getSharedSignatureBytes("personal.png"),
-                    "Core service should not have access to personal signatures");
-        }
-    }
-
     @Test
     void testGetAvailableSignatures_EmptyUsername() throws IOException {
         // Mock static method for each test

app/proprietary/build.gradle

@@ -57,7 +57,7 @@ dependencies {
 
     implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5:3.1.3.RELEASE'
     api 'io.micrometer:micrometer-registry-prometheus'
-    implementation 'com.unboundid.product.scim2:scim2-sdk-client:4.0.0'
+    implementation 'com.unboundid.product.scim2:scim2-sdk-client:4.1.0'
 
     api "io.jsonwebtoken:jjwt-api:$jwtVersion"
     runtimeOnly "io.jsonwebtoken:jjwt-impl:$jwtVersion"

app/proprietary/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -31,10 +31,12 @@ import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.JobOwnershipService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.security.config.PremiumEndpoint;
 
 @Slf4j
 @ConvertApi
 @RequiredArgsConstructor
+@PremiumEndpoint
 public class ConvertPdfJsonController {
 
     private final PdfJsonConversionService pdfJsonConversionService;