Node.js Pipeline Ties Watermarked PDF Thumbnails to Signed Audit Records

·1 views

A technical approach published on DEV Community outlines a document-sharing pipeline that generates first-page thumbnails only after a watermark has been applied to a PDF, binding both to a signed audit record via content digests. The core problem it addresses is a failure mode where cached previews can become mismatched with the actual distributed file, showing one recipient's watermark while the downloaded PDF contains another's. The proposed system enforces a strict invariant: each shared document version must map to exactly one output digest, one watermark policy revision, one thumbnail digest, and one audit statement before it can be published. Security measures include isolating PDF rendering with resource limits, using SHA-256 digest-based cache keys instead of filenames or document IDs, and signing audit statements with Ed25519 keys to separately handle integrity and authentication. The architecture distributes responsibilities across a Go signing worker, a Node.js enqueue layer, and an Express server handling authorization and HTTP delivery.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Reversible PII Redaction Layer to Protect Data Sent to LLM APIs

As AI agents increasingly process emails, tickets, and databases, sensitive personal data such as ID numbers and phone numbers routinely gets embedded in prompts and sent to third-party LLM APIs without deliberate intent. A developer reviewed multiple Vietnamese codebases and found a recurring pattern where raw ticket content containing customer PII was passed directly to API calls. To address this, they built a reversible redaction layer using Python and Microsoft Presidio, an open-source PII detection library, extended with custom recognizers for Vietnamese national ID numbers and mobile phone formats. The system replaces sensitive values with placeholder tokens before sending data to the LLM, stores the mappings in a local session vault, and restores real values only after the response is returned. The approach is framed as a compliance necessity given Vietnam's Decree 13/2023 and the Personal Data Protection Law taking effect on January 1, 2026, which impose real legal risk on uncontrolled cross-border data transfers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Learn Python Collections by Building a Personal Expense Tracker

A new tutorial on DEV Community teaches Python developers how to manage collections of data by building a personal expense tracker. The project uses Python lists, dictionaries, and loops to record and display multiple expense entries. Users learn to store structured records by bundling item names and costs into dictionaries, then appending them to a list. A while loop keeps the program running, allowing continuous input until the user chooses to view a summary. The tutorial is aimed at beginners who already understand basic Python variables and the input() function.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

EF Core vs Marten and Polecat: Choosing the Right .NET Data Tool

In .NET development, EF Core remains the default ORM for genuinely relational data — such as tables queried independently or schemas shared across services — but it adds complexity when used to model aggregates like orders with nested items and addresses. Tools like Marten (for PostgreSQL) and Polecat (for SQL Server) store entire domain objects as JSON documents in the same database already in use, eliminating the need for a separate document database. The common pain points of EF Core overuse include growing Include chains, AsSplitQuery workarounds, and frequent migrations for unsettled schemas — symptoms that suggest a document model may be more appropriate. With a document session, an aggregate is loaded by ID, modified, and saved in a single commit, avoiding the mapping overhead EF Core requires to reassemble a unified domain object from relational tables. The core guidance is to use EF Core where data is truly relational and reach for Marten or Polecat where the domain naturally treats an object as one cohesive unit.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Azure DocumentDB 0.109 Uses Native PostgreSQL Indexes to Match MongoDB Query Performance

Azure DocumentDB, a PostgreSQL extension, has demonstrated in version 0.109 that it can handle MongoDB-style queries involving filtering, sorting, and pagination using a single compound index scan. The test replicated an earlier MongoDB benchmark that highlighted the performance advantage of document models over normalized relational databases for one-to-many relationships. DocumentDB achieves this by leveraging PostgreSQL's extensibility to define native Extended RUM indexes suited for non-relational data schemas, rather than relying on standard RDBMS indexes. The execution plan confirmed that a single index scan covered all four query stages — $match, $sort, $limit, and $project — with no additional sort or filter operations required. This positions DocumentDB as a performance-compatible alternative to MongoDB for document-model workloads built on PostgreSQL.

0 comments Read more at DEV Community