Authenticated security copies

Each native security filter can clone its verified authentication into an independently owned copy, so derived documents never share mutable authentication state

function CloneAuthenticated(
  CancellationToken: THPDFCancellationToken): THPDFHeadlessAES256Security;  // AES-256
function CloneAuthenticated(
  CancellationToken: THPDFCancellationToken): THPDFHeadlessLegacySecurity;  // RC4 legacy
function CloneAuthenticated(
  CancellationToken: THPDFCancellationToken): THPDFHeadlessR4Security;      // R4 filters

CloneAuthenticated is a new virtual method on THPDFHeadlessAES256Security overridden by the legacy and R4 filters; the R4 override deep-copies its filter array

Ownership and destruction

A clone owns its derived key material, permissions, encryption dictionary reference and file identifiers; destroying the clone clears that material with the same secure destruction lifetime as a password-authenticated instance

The clone carries its own cancellation token and lifetime; the source security object may be destroyed first

Admission

A clone is only created from library-verified authentication: the base document authenticated with the exact password, the derived revision re-verifies the encryption dictionary body and permanent identifier against the actual bytes, and the trailer must still reference the same encryption dictionary and identifiers

External bytes and explicit passwords stay on the real password-authentication path; a wrong or empty password never receives a cloned credential, and there is no general Boolean shortcut that reuses a loaded credential without verification

Windows transactions

Windows form-data transactions retain staged authentication per handle and compare the source object and password string for cache hits; a cache hit does not replace the derived document's encryption-dictionary and source-identity verification

Authentication-cache lifetime across source replacement and authenticated successor preparation after unsaved loaded-rich edits remain separate compatibility work; the released authentication-copy profile does not establish acceptance of those sequences

OpenAuthenticatedCopy · Native AES-256 security · Field lock signing