Digital Signature for Filament GitHub

#Digital Signature for Filament — Documentation

A Laravel Filament plugin for capturing signatures, issuing X.509 certificates, and embedding cryptographically signed stamps into PDF documents.


#Contents

DocWhat it covers
Implementation PlanStart here. Phase-by-phase plan for integrating the package into a host app
InstallationComposer, migrations, plugin registration, admin resource config
ConfigurationEvery config key, all env variables, driver options
Model SetupSignable interface, HasSignatures trait, model attributes
Filament ComponentsSignaturePlugin, SignatureResource, SignaturePad, SignatureColumn, SignDocumentAction
Signing WorkflowFull lifecycle, SignatureManager API, sync vs queued, events, statuses
Ad-hoc SigningHow to sign documents from your own resources, controllers, and pages
On-Demand PDF SigningSigning records whose PDF is generated (DomPDF, etc.), not stored
PDF TemplatesPdfTemplate contract, slot definitions, placement-designer foundations
CertificatesCertificate issuance, UserCertificate model, CA setup, CFSSL
SecurityPKCS#7, DocMDP, HMAC PNG metadata, XMP, signer identity, DB cross-validation, machine lock, CRL, TSA
Signatory RoutingRole-bound slots, signing sessions, consent models, multi-signatory PDFs, Filament v3/v4/v5 compatibility
Drawer Signing UXThe drawer signing surface: inbox and signature library in one drawer, inline PDF viewing, drag-to-place signing
Concept: Signatory RoutingThe design record behind the above — trade-offs, rejected approaches, resolved questions

#Quick start

Terminal
composer require kukux/digital-signature
php artisan vendor:publish --tag=signature-migrations
php artisan vendor:publish --tag=signature-config
php artisan migrate
php artisan filament:assets

Register the plugin:

PHP
// app/Providers/Filament/AdminPanelProvider.php
->plugins([
    \Kukux\DigitalSignature\SignaturePlugin::make()
        ->navigationGroup('Documents')   // optional
        ->navigationIcon('heroicon-o-pencil-square')  // optional
        ->navigationSort(10),             // optional
])

This registers:

  • Signatures — full admin resource for registering reusable signature images and viewing signature records
  • Sign Document — header actions inside the Signatures resource for signing with a registered signature

#Preparing a signable model

Any model whose PDF can be signed must implement Signable and use HasSignatures.

PHP
use Kukux\DigitalSignature\Contracts\Signable;
use Kukux\DigitalSignature\Traits\HasSignatures;

class Contract extends Model implements Signable
{
    use HasSignatures;

    public function getSignableTitle(): string   { return $this->title; }
    public function getSignablePdfPath(): string { return $this->pdf_path; }
    public function getSignableId(): int|string  { return $this->id; }
}

#Adding the sign action to your own resource

First let users register a reusable signature in the built-in Signatures resource. Then add the signing action to resources whose model implements Signable.

PHP
use Filament\Resources\Resource;
use Filament\Tables\Table;
use Filament\Tables\Columns\TextColumn;
use Kukux\DigitalSignature\Filament\Actions\SignDocumentAction;
use Kukux\DigitalSignature\Filament\Columns\SignatureColumn;

class ContractResource extends Resource
{
    public static function table(Table $table): Table
    {
        return $table
            ->columns([
                TextColumn::make('title'),
                SignatureColumn::make('signature')->thumbSize(80, 32),
            ])
            ->actions([
                SignDocumentAction::make()
                    ->stampAt(page: 1, x: 100, y: 650, w: 200, h: 80),
            ]);
    }
}

SignDocumentAction validates the selected signature and surfaces signing errors as Filament danger notifications.

For custom controller, page, or Livewire flows, see Ad-hoc Signing.


#Security highlights

FeatureDefault
PKCS#7 cryptographic signature embedded in PDFAlways on
DocMDP P=2 — post-signing modification detectionAlways on
HMAC-signed PNG metadata (tEXt + XMP)Always on
Signer identity (name + email) embedded in PNGAlways on
XMP metadata visible in macOS Preview & Windows ExplorerAlways on
Forgery / screenshot upload rejectionAlways on
DB cross-validation on re-upload (Sig-Record-Id)Always on
Document integrity hashes (before + after)Always on
Machine lock — reject re-upload from different deviceSIGNATURE_MACHINE_LOCK=true (default)
CRL certificate revocation checkSIGNATURE_CRL_ENABLED=false
RFC 3161 trusted timestamp via TSASIGNATURE_TSA_URL= (disabled)

For full details see docs/security.md.