HOWTO: Use PDF conversion operations with Nuxeo Studio

If the main document format stored in the Nuxeo repository is PDF, it should be convenient to manipulate it without having to use a desktop software. Nuxeo gives the opportunity to safely and automatically execute PDF operations from the Nuxeo interface.

In this tutorial we will implement a document management security politic that requires to control each downloaded PDF files with a "confidential" watermark and ask for a password in order to open the document.

Nuxeo integrates PDF tools operations, under the Conversion category so that all this can be done easily from automation chains.

This how to requires knowledge about:

Setting Up the Automation Chain

To implement the behavior defined in the introduction, create an automation chain which retrieves the blob from the File document, encrypts and watermarks with a picture previously uploaded in the Nuxeo instance (in a "Test" workspace under the and called confidential.png).

To use watermark with picture, we recommend to use pictures with transparency. Note that although the files are picture files, you do not need to create Picture document types in Nuxeo and so do not need to use the Nuxeo DAM addon.

The automation chain should be:

- Context.FetchDocument
- Document.GetBlob:
    xpath: "file:content"
- Context.SetInputAsVar:
    name: pdfToWatermark
- Repository.GetDocument:
    value: /default-domain/workspaces/Test/confidential.png
- Document.GetBlob:
    xpath: "file:content"
- Context.SetInputAsVar:
    name: watermark
- Context.RestoreBlobInput:
    name: pdfToWatermark
- PDF.WatermarkWithImage:
    image: "@{watermark}"
- PDF.EncryptReadOnly:
    keyLength: "128"
    ownerPwd: Adm1nPassw0rd
    userPwd: Us3rPassw0rd
    xpath: "file:content"
- WebUI.DownloadFile

JSF UI Deprecation

This requires to have the JSF UI addon installed on your server that is deprecated since Nuxeo Platform LTS 2019.
Please refer to the Web UI documentation.

Now, plug the automation chain to a button called safeDownloadButton available:

in the contextual tools
only for File document type
to users with Read permission

Result

After you deploy the Studio customization, a new icon is created on the Contextual Toolbar.

The PDF is secured by a password:

And the "Confidential" watermark is printed on each page:

Going further

To complete the configuration, it should be a good idea to filter the classic download option and the document versioning to an authorized group by editing the File tab for example (with an EL expression like #{currentUser.isMemberOf('security_department')}.

Other PDF Conversion Operations

Here is the list of the PDF conversion operations:

PDF: Add Page Numbers
PDF: Convert to Pictures: Generates PNG pictures of each PDF page
PDF: Encrypt: Full version of encryption. Admin can grant permissions on the PDF as print, modify, copy...
PDF: Extract Links: Returns a JSON string of an array of objects with page, subType, text and link fields
PDF: Extract Pages: Generates a PDF from a range of PDF pages
PDF: Merge with Blob(s) and PDF: Merge with Documents (s): Document concatenation
PDF: Remove Encryption: Secures the PDF opening with a password
PDF: Watermark with Text and PDF: Watermark with PDF: Watermarked PDF with text editor options (rotation, transparency, font...)