Signature capture and PDF stamping

<?php

namespace App\Signing;

use InvalidArgumentException;
use setasign\Fpdi\Fpdi;

final class SignatureStamper
{
    private const MAX_BYTES = 200_000;
    private const PNG_MAGIC = "\x89PNG\r\n\x1a\n";

    /** Turn a canvas.toDataURL('image/png') string into verified PNG bytes. */
    public static function decode(string $dataUrl): string
    {
        if (! preg_match('#^data:image/png;base64,([A-Za-z0-9+/=]+)$#', $dataUrl, $m)) {
            throw new InvalidArgumentException('Signature must be a PNG data URL.');
        }
        $bytes = base64_decode($m[1], true);

        if ($bytes === false || strlen($bytes) > self::MAX_BYTES || ! str_starts_with($bytes, self::PNG_MAGIC)) {
            throw new InvalidArgumentException('Signature image is invalid or too large.');
        }

        return $bytes;
    }

    /**
     * Copy every page of $pdfPath and draw the signature on $page.
     * $xPct / $yPct are the top-left corner as a percentage of the page, so the
     * placement survives different paper sizes. Returns the new PDF bytes.
     */
    public function stamp(string $pdfPath, string $png, int $page, float $xPct, float $yPct, float $widthMm = 40): string
    {
        $tmp = tempnam(sys_get_temp_dir(), 'sig').'.png';
        file_put_contents($tmp, $png);

        try {
            $pdf = new Fpdi();
            $pages = $pdf->setSourceFile($pdfPath);

            if ($page < 1 || $page > $pages) {
                throw new InvalidArgumentException("Page {$page} is outside 1-{$pages}.");
            }

            for ($i = 1; $i <= $pages; $i++) {
                $tpl = $pdf->importPage($i);
                $size = $pdf->getTemplateSize($tpl);
                $pdf->AddPage($size['orientation'], [$size['width'], $size['height']]);
                $pdf->useTemplate($tpl);

                if ($i === $page) {
                    $pdf->Image($tmp, $xPct / 100 * $size['width'], $yPct / 100 * $size['height'], $widthMm);
                }
            }

            return $pdf->Output('S');
        } finally {
            @unlink($tmp);
        }
    }
}