unpaismejor-document-signature (8.0.3)
Installation
pip install --index-url https://code.unpaismejor.org.do/api/packages/tryton-do/pypi/simple/ --extra-index-url https://pypi.org/simple unpaismejor-document-signatureAbout this package
Production electronic document signature workflows for Tryton
############################# Tryton Document Signature #############################
A native Tryton 8.0 module for electronic document signature workflows. It provides reusable PDF templates, signer roles, normalized document fields, multi-party requests, single-use bearer links, explicit consent, immutable SHA-256 audit chains, signed-document snapshots and final integrity hashes.
This module implements an electronic-signature evidence workflow. Whether a signature has a specific legal classification depends on the jurisdiction, identity assurance and certificate service used by the deployment. It must not be represented as a qualified digital signature without those controls.
Production configuration
Configure transactional SMTP in Tryton and add::
[document_signature]
base_url = https://erp.example.com/production
from = signatures@example.com
base_url must be the externally reachable HTTPS URL including the Tryton
database path. Signature links contain 256 bits of randomness, are stored only
as SHA-256 digests, expire, rotate on resend and are invalidated after use.
Operational requirements
- Serve Tryton behind a production WSGI server and TLS reverse proxy.
- Back up the database and attachment filestore as one consistent unit.
- Synchronize host time with authenticated NTP.
- Configure SPF, DKIM and DMARC for the sending domain.
- Restrict the manager and user groups following least privilege.
- Monitor failed HTTP requests and SMTP delivery failures at the proxy.
- Define retention and deletion policies with legal counsel. Audit evidence is immutable through the application and intentionally restricts deletion.
Public endpoints
The module exposes token-protected routes below the database URL:
/document-signature/<token>/view: secure signing interface./document-signature/<token>: signer context and normalized fields./document-signature/<token>/document: immutable source PDF./document-signature/<token>/sign: consent and value submission./document-signature/<token>/decline: refusal submission.
Security controls include strict PDF and image validation, size limits, single-use token hashing, expiry, role-bound fields, immutable values, a serialized SHA-256 evidence chain, PDF source/final hashes, CSP, no-referrer, no-store responses and transactional invitation delivery.