feat: accept passwords for encrypted OOXML files

Draft
PA
2mo ago
+426-38

Problem

Callers who know the password for an encrypted OOXML document cannot convert it through anydoc's bindings or CLI.

Solution

Decrypt encrypted OOXML before detecting and parsing its inner format. Expose optional passwords in the Node, Python, and wasm bindings, plus --password and ANYDOC_PASSWORD in the CLI. Existing calls and encrypted-error behavior remain unchanged when no valid password is supplied.

Closes #102

Validation

  • cargo fmt --all --check
  • cargo clippy --workspace --all-targets --all-features -- -D warnings
  • cargo test --locked
  • Node native build and 15 tests
  • Python release wheel build and 10 tests
  • wasm behavior covered in its binding test suite; target build runs in CI

Delivery

No configuration or deployment changes are required.

Changes were made with Codex in T3 Code using openai/gpt-5.6-sol.

Summary by cubic

Adds password support for encrypted OOXML (DOCX/XLSX/PPTX) so callers can convert when they know the password. Previously these files always returned an 'encrypted' error; now they convert with a correct password, and still return 'encrypted' with no or wrong password. Implements #102.

  • Node: optional password added to toMarkdown(path, password?), toMarkdownBytes(bytes, format?, password?), and toDocument(bytes, format?, password?). CLI adds --password and ANYDOC_PASSWORD in @firecrawl/anydoc. Types updated.
  • Python: optional password kwarg added to to_markdown, to_markdown_bytes, and to_document.
  • wasm: third optional password arg added to toMarkdownBytes and toDocument.
  • Rust: new to_markdown_with_password, to_markdown_bytes_with_password, and to_document_with_password. Existing signatures are unchanged.
  • Adds office-crypto to decrypt before format detection; the decrypted content decides the format.

Review notes

  • Core logic is prepare_input in src/lib.rs: if OLE-encrypted OOXML is detected and a password is provided, decrypt with office-crypto, then detect the inner format and proceed; otherwise return Encrypted.
  • Check CLI and binding tests for success and error cases, and that env-based password handling works.
  • No breaking changes: existing calls and error behavior are unchanged when no password is supplied. To convert protected files, pass the optional password or use the CLI flag/env var.