Digital Signature for Filament GitHub

#Digital Signature for Filament — Documentation

A Laravel Filament plugin for capturing signatures, issuing X.509 certificates, and embedding cryptographically signed stamps into PDF documents.


#Contents

DocWhat it covers
InstallationStart here. Composer, migrations, plugin registration, admin resource config
ConfigurationEvery config key, all env variables, driver options
Model SetupSignable interface, HasSignatures trait, model attributes
Filament ComponentsSignaturePlugin, SignatureResource, SignaturePad, SignatureColumn, SignDocumentAction
Signing WorkflowFull lifecycle, SignatureManager API, sync vs queued, events, statuses
Ad-hoc SigningHow to sign documents from your own resources, controllers, and pages
On-Demand PDF SigningSigning records whose PDF is generated (DomPDF, etc.), not stored
PDF TemplatesPdfTemplate contract, slot definitions, placement-designer foundations
CertificatesCertificate issuance, UserCertificate model, CA setup, CFSSL
SecurityPKCS#7, DocMDP, HMAC PNG metadata, XMP, signer identity, DB cross-validation, machine lock, CRL, TSA
Signatory RoutingRole-bound slots, signing sessions, consent models, multi-signatory PDFs, Filament v3/v4/v5 compatibility
Integrating documents2.0. Make your app's documents signable through contracts and container bindings: routing, guards, wording, the document of record, testing, recipes
Guide: Route for SignaturesThe 1.x guide, mapped onto 2.0
Drawer Signing UXThe drawer signing surface: inbox and signature library in one drawer, inline PDF viewing, drag-to-place signing
Device RegistrationBrowser signing keys: setup, the attest/register flow, data model, limits
Desktop AgentHardware-bound keys via the Kukux Sign Agent: pairing, approval, endpoints, proof format
Concept: Signatory RoutingThe design record behind the above — trade-offs, rejected approaches, resolved questions

#Quick start

Terminal
composer require kukux/digital-signature
php artisan signature:install

The installer registers the plugin for you. To do it by hand, or to customise it:

PHP
// app/Providers/Filament/AdminPanelProvider.php
->plugins([
    \Kukux\DigitalSignature\SignaturePlugin::make()
        ->navigationGroup('Documents')   // optional
        ->navigationIcon('heroicon-o-pencil-square')  // optional
        ->navigationSort(10),             // optional
])

This registers:

  • Signatures — full admin resource for registering reusable signature images and viewing signature records
  • Sign Document — header actions inside the Signatures resource for signing with a registered signature

#Preparing a signable model

Any model whose PDF can be signed must implement Signable and use HasSignatures.

PHP
use Kukux\DigitalSignature\Contracts\Signable;
use Kukux\DigitalSignature\Traits\HasSignatures;

class Contract extends Model implements Signable
{
    use HasSignatures;

    public function getSignableTitle(): string   { return $this->title; }
    public function getSignablePdfPath(): string { return $this->pdf_path; }
    public function getSignableId(): int|string  { return $this->id; }
}

#Adding the sign action to your own resource

First let users register a reusable signature in the built-in Signatures resource. Then add the signing action to resources whose model implements Signable.

PHP
use Filament\Resources\Resource;
use Filament\Tables\Table;
use Filament\Tables\Columns\TextColumn;
use Kukux\DigitalSignature\Filament\Actions\SignDocumentAction;
use Kukux\DigitalSignature\Filament\Columns\SignatureColumn;

class ContractResource extends Resource
{
    public static function table(Table $table): Table
    {
        return $table
            ->columns([
                TextColumn::make('title'),
                SignatureColumn::make('signature')->thumbSize(80, 32),
            ])
            ->actions([
                SignDocumentAction::make()
                    ->stampAt(page: 1, x: 100, y: 650, w: 200, h: 80),
            ]);
    }
}

SignDocumentAction validates the selected signature and surfaces signing errors as Filament danger notifications.

For custom controller, page, or Livewire flows, see Ad-hoc Signing.


#Security highlights

FeatureDefault
PKCS#7 cryptographic signature embedded in PDFAlways on
DocMDP P=2 — post-signing modification detectionAlways on
HMAC-signed PNG metadata (tEXt + XMP)Always on
Signer identity (name + email) embedded in PNGAlways on
XMP metadata visible in macOS Preview & Windows ExplorerAlways on
Forgery / screenshot upload rejectionAlways on
DB cross-validation on re-upload (Sig-Record-Id)Always on
Document integrity hashes (before + after)Always on
Machine lock — reject re-upload from different deviceSIGNATURE_MACHINE_LOCK=true (default)
CRL certificate revocation checkSIGNATURE_CRL_ENABLED=false
RFC 3161 trusted timestamp via TSASIGNATURE_TSA_URL= (disabled)

For full details see docs/security.md.