Release notes

Document access

• Tracking, audit, and document pages show only files you uploaded or are asked to sign
• A direct link to someone else's document is treated as not found

Signing security

• Signer email addresses are checked on the server
• Signature data embedded in the page can no longer break out of the script
• Invitation emails escape the document name
• The signer IP is taken from the reverse proxy, not the raw forwarded header
• Logout ends the Cognito session as well as the local session

Office upload limits

• Uploads are limited to 25 MB
• Word and Excel archives are rejected if they expand too far
• LibreOffice runs without the application's secrets

Dependencies

• PyJWT 2.15.0, cryptography 49.0.0, requests 2.33.0, Flask 3.1.3, and python-dotenv 1.2.2

Document deletion

• Owner can delete a document while it is Pending placement or Pending signer
• The PDF is removed from storage
• The record is marked Deleted and hidden from tracking
• Completed documents cannot be deleted

Audit trail

• Audit page lists uploads, signatures, and deletions for each person
• Deleted documents stay in the audit trail after the file is removed
• Each new action records the system version

Upload checks

• Unsupported file types are rejected before upload
• Supported formats: PDF, Word (.doc, .docx), Excel (.xls, .xlsx)

Release notes

• Current version is read from the first line of versions.txt
• Version is shown next to the logo and links to this page

Authentication

• AWS Cognito Hosted UI login (Authorization Code + PKCE)
• Confidential app client with client secret
• Session-based auth; protected routes require sign-in
• Logout with Cognito redirect

Document upload

• Upload PDF, Word (.doc, .docx), and Excel (.xls, .xlsx)
• Automatic Office-to-PDF conversion (LibreOffice in Docker)
• Document name and category assignment
• Multiple signers in signing order
• Initial SHA-256 hash recorded on upload

Signature placement

• PDF.js viewer with zoom
• Drag-and-resize signature boxes per signer
• Fractional coordinates stored for reliable PDF burn-in
• Placement required before signing begins (PENDING_PLACEMENT)

Signing workflow

• Sequential multi-signer flow
• Signer enters first and last name
• Live signature preview (handwriting-style font)
• Signatures burned into PDF: name, verified Cognito email, verification ID link
• Versioned S3 storage (v1_unsigned, v2_signed_N, v3_final)
• SHA-256 hash updated after each signature
• Integrity check on document view; tamper detection blocks signing
• Audit log with timestamps, actions, and hash entries

Document viewing

• Inline PDF preview
• Download signed PDF
• Jump-to-signature and zoom on sign page
• Signature boxes hidden after signing

Notifications

• SMTP email to next signer when a step completes

Document tracking dashboard

• Home page document list grouped by category
• Collapsible category folders with counts
• Search, status filter, and sort
• Action-needed categories auto-expanded
• Links to upload, place signatures, and sign

Deployment

• Docker image with baked .env defaults
• Runtime override via docker -e
• ECR / EC2 production deployment (app.omdc.org.uk)
• Nginx reverse proxy and TLS (Certbot)