client, models: Simplify credential payload handling for PDF signing

- Refactored the credentials logic in `client.py` to remove redundant
  validation and mapping code.
- Added a `_normalize_credentials` model validator in `_internal.py` to
  handle credential normalization and enforce valid inputs.
- Updated test cases in `test_sign_pdf.py` to align with the new
  credentials structure, consolidating `pfx` and `certificate` data
  under a unified `credentials` field.

Assisted-by: Codex

Author: datalogics-kam

src/pdfrest/client.py

@@ -3091,8 +3091,8 @@ def sign_pdf(
         payload: dict[str, Any] = {
             "files": file,
             "signature_configuration": signature_configuration,
+            "credentials": credentials,
         }
-        payload.update(credentials)
 
         if logo is not None:
             payload["logo"] = logo
@@ -4507,8 +4507,8 @@ async def sign_pdf(
         payload: dict[str, Any] = {
             "files": file,
             "signature_configuration": signature_configuration,
+            "credentials": credentials,
         }
-        payload.update(credentials)
 
         if logo is not None:
             payload["logo"] = logo

src/pdfrest/models/_internal.py

@@ -1,9 +1,9 @@
 from __future__ import annotations
 
 import re
-from collections.abc import Callable, Sequence
+from collections.abc import Callable, Mapping, Sequence
 from pathlib import PurePath
-from typing import Annotated, Any, Generic, Literal, TypeVar
+from typing import Annotated, Any, Generic, Literal, TypeVar, cast
 
 from langcodes import tag_is_valid
 from pydantic import (
@@ -1157,6 +1157,31 @@ class PdfSignPayload(BaseModel):
         AfterValidator(_validate_output_prefix),
     ] = None
 
+    @model_validator(mode="before")
+    @classmethod
+    def _normalize_credentials(cls, data: Any) -> Any:
+        if not isinstance(data, Mapping):
+            return data
+
+        payload = cast(Mapping[object, Any], data)
+        credentials = payload.get("credentials")
+        if credentials is None:
+            return {str(key): value for key, value in payload.items()}
+        if not isinstance(credentials, Mapping):
+            msg = (
+                "credentials must be a mapping with either pfx/passphrase or "
+                "certificate/private_key."
+            )
+            raise TypeError(msg)
+
+        normalized: dict[str, Any] = {str(key): value for key, value in payload.items()}
+        credential_map = cast(Mapping[object, Any], credentials)
+        for raw_key, value in credential_map.items():
+            key = str(raw_key)
+            if key not in normalized:
+                normalized[key] = value
+        return normalized
+
     @model_validator(mode="after")
     def _validate_credentials(self) -> PdfSignPayload:
         has_pfx = self.pfx_credential is not None or self.pfx_passphrase is not None

tests/test_sign_pdf.py

@@ -73,8 +73,7 @@ def test_sign_pdf_with_pfx_credentials(monkeypatch: pytest.MonkeyPatch) -> None:
         {
             "files": [input_file],
             "signature_configuration": signature_configuration,
-            "pfx_credential": [pfx_file],
-            "pfx_passphrase": [passphrase_file],
+            "credentials": {"pfx": pfx_file, "passphrase": passphrase_file},
             "output": "signed-pdf",
         }
     ).model_dump(mode="json", by_alias=True, exclude_none=True, exclude_unset=True)
@@ -140,8 +139,10 @@ def test_sign_pdf_with_certificate_credentials_and_logo(
         {
             "files": [input_file],
             "signature_configuration": signature_configuration,
-            "certificate": [certificate_file],
-            "private_key": [private_key_file],
+            "credentials": {
+                "certificate": certificate_file,
+                "private_key": private_key_file,
+            },
             "logo": [logo_file],
         }
     ).model_dump(mode="json", by_alias=True, exclude_none=True, exclude_unset=True)