From 29aa9f97ba2dcbbcf88f57629a91cdbf556d34fd Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Sun, 8 Nov 2026 12:04:18 -0500
Subject: [PATCH] review: withhold every permission bit the mark source check
 reads

---
 crates/engine/src/tests.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 5a34eb9cdd..a38d946a50 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -10264,7 +10264,9 @@ fn restricted_pdf_mark_sources_are_refused() {
         replace: false,
         file: Some(MarkFile { name: "src.pdf".into(), bytes, page: 0 }),
     };
-    for withheld in [0b1_0000, 0b100_0000_0000] {
+    // Copying pages needs both bits cleared: copying (bit 5) and assembly (bit 11), and the
+    // second case clears bit 4 as well, which the source check reads too.
+    for withheld in [0b1_0000, 0b100_0000_1000] {
         let err = s.apply(id, mark(protected("", "owner", -1 ^ withheld))).unwrap_err();
         assert_eq!(err, EditError::Source("src.pdf: its security settings don't allow copying pages".into()));
     }