models/tests: Transition validators and add MIME type support

- Changed `BeforeValidator` to `AfterValidator` in `_internal.py` to
  improve validation reliability and sequencing.
- Added support for `application/pem-certificate-chain` MIME type
  for PEM credentials to widen compatibility with certificate formats.
- Updated tests to ensure validation handles `pem-certificate-chain`
  MIME type for both certificates and private keys.
- Introduced `test_sign_payload_accepts_logo_tuple_sequence` to verify
  the logo field supports tuple sequences in payloads.

Assisted-by: Codex

Author: datalogics-kam

src/pdfrest/models/_internal.py

@@ -1065,7 +1065,7 @@ class PdfSignPayload(BaseModel):
             serialization_alias="pfx_credential_id",
         ),
         BeforeValidator(_ensure_list),
-        BeforeValidator(
+        AfterValidator(
             _allowed_mime_types(
                 "application/x-pkcs12",
                 "application/pkcs12",
@@ -1085,7 +1085,7 @@ class PdfSignPayload(BaseModel):
             serialization_alias="pfx_passphrase_id",
         ),
         BeforeValidator(_ensure_list),
-        BeforeValidator(
+        AfterValidator(
             _allowed_mime_types(
                 "text/plain",
                 "application/octet-stream",
@@ -1104,13 +1104,14 @@ class PdfSignPayload(BaseModel):
             serialization_alias="certificate_id",
         ),
         BeforeValidator(_ensure_list),
-        BeforeValidator(
+        AfterValidator(
             # DER cert/key uploads are frequently tagged as x509-ca-cert (or octet-stream
             # in some environments), so we intentionally keep this allowlist broad.
             _allowed_mime_types(
                 "application/pkix-cert",
                 "application/x-x509-ca-cert",
                 "application/x-pem-file",
+                "application/pem-certificate-chain",
                 "application/octet-stream",
                 error_msg="Certificate must be a .pem or .der file",
             )
@@ -1127,13 +1128,14 @@ class PdfSignPayload(BaseModel):
             serialization_alias="private_key_id",
         ),
         BeforeValidator(_ensure_list),
-        BeforeValidator(
+        AfterValidator(
             # Keep parity with provider/browser MIME detection for DER private keys.
             _allowed_mime_types(
                 "application/pkix-cert",
                 "application/x-x509-ca-cert",
                 "application/pkcs8",
                 "application/x-pem-file",
+                "application/pem-certificate-chain",
                 "application/octet-stream",
                 error_msg="Private key must be a .pem or .der file",
             )
@@ -1150,7 +1152,7 @@ class PdfSignPayload(BaseModel):
             serialization_alias="logo_id",
         ),
         BeforeValidator(_ensure_list),
-        BeforeValidator(
+        AfterValidator(
             _allowed_mime_types(
                 "image/jpeg",
                 "image/png",

tests/test_sign_pdf.py

@@ -444,3 +444,68 @@ def test_sign_payload_accepts_x509_ca_cert_mime_for_der_credentials() -> None:
     assert payload.private_key is not None
     assert payload.certificate[0].type == "application/x-x509-ca-cert"
     assert payload.private_key[0].type == "application/x-x509-ca-cert"
+
+
+def test_sign_payload_accepts_pem_certificate_chain_mime_for_pem_credentials() -> None:
+    input_pdf = make_pdf_file(str(PdfRestFileID.generate()))
+    certificate_file = PdfRestFile.model_validate(
+        build_file_info_payload(
+            str(PdfRestFileID.generate()),
+            "certificate.pem",
+            "application/pem-certificate-chain",
+        )
+    )
+    private_key_file = PdfRestFile.model_validate(
+        build_file_info_payload(
+            str(PdfRestFileID.generate()),
+            "private_key.pem",
+            "application/pem-certificate-chain",
+        )
+    )
+
+    payload = PdfSignPayload.model_validate(
+        {
+            "files": [input_pdf],
+            "signature_configuration": {
+                "type": "new",
+                "name": "sig",
+                "location": make_signature_location(),
+            },
+            "credentials": {
+                "certificate": certificate_file,
+                "private_key": private_key_file,
+            },
+        }
+    )
+
+    assert payload.certificate is not None
+    assert payload.private_key is not None
+    assert payload.certificate[0].type == "application/pem-certificate-chain"
+    assert payload.private_key[0].type == "application/pem-certificate-chain"
+
+
+def test_sign_payload_accepts_logo_tuple_sequence() -> None:
+    input_pdf = make_pdf_file(str(PdfRestFileID.generate()))
+    certificate_file = make_certificate_file(str(PdfRestFileID.generate()))
+    private_key_file = make_private_key_file(str(PdfRestFileID.generate()))
+    logo_file = make_logo_file(str(PdfRestFileID.generate()))
+
+    payload = PdfSignPayload.model_validate(
+        {
+            "files": [input_pdf],
+            "signature_configuration": {
+                "type": "new",
+                "name": "sig",
+                "location": make_signature_location(),
+            },
+            "credentials": {
+                "certificate": certificate_file,
+                "private_key": private_key_file,
+            },
+            "logo": (logo_file,),
+        }
+    )
+
+    assert payload.logo is not None
+    assert len(payload.logo) == 1
+    assert payload.logo[0].id == logo_file.id