tests/models: Support x509-ca-cert MIME type for DER credentials

- Added a test to validate the handling of `application/x-x509-ca-cert` MIME
  type for DER certificate and private key uploads in `PdfSignPayload`.
- Updated `_internal.py` to allow `application/x-x509-ca-cert` and other
  relevant MIME types for DER credentials to maintain compatibility with
  provider/browser file type detection.

Assisted-by: Codex

Author: datalogics-kam

src/pdfrest/models/_internal.py

@@ -1105,6 +1105,8 @@ class PdfSignPayload(BaseModel):
         ),
         BeforeValidator(_ensure_list),
         BeforeValidator(
+            # DER cert/key uploads are frequently tagged as x509-ca-cert (or octet-stream
+            # in some environments), so we intentionally keep this allowlist broad.
             _allowed_mime_types(
                 "application/pkix-cert",
                 "application/x-x509-ca-cert",
@@ -1126,7 +1128,10 @@ class PdfSignPayload(BaseModel):
         ),
         BeforeValidator(_ensure_list),
         BeforeValidator(
+            # Keep parity with provider/browser MIME detection for DER private keys.
             _allowed_mime_types(
+                "application/pkix-cert",
+                "application/x-x509-ca-cert",
                 "application/pkcs8",
                 "application/x-pem-file",
                 "application/octet-stream",

tests/test_sign_pdf.py

@@ -338,3 +338,41 @@ def test_sign_payload_allows_existing_without_location() -> None:
         }
     )
     assert payload.signature_configuration.type == "existing"
+
+
+def test_sign_payload_accepts_x509_ca_cert_mime_for_der_credentials() -> None:
+    input_pdf = make_pdf_file(str(PdfRestFileID.generate()))
+    certificate_file = PdfRestFile.model_validate(
+        build_file_info_payload(
+            str(PdfRestFileID.generate()),
+            "certificate.der",
+            "application/x-x509-ca-cert",
+        )
+    )
+    private_key_file = PdfRestFile.model_validate(
+        build_file_info_payload(
+            str(PdfRestFileID.generate()),
+            "private_key.der",
+            "application/x-x509-ca-cert",
+        )
+    )
+
+    payload = PdfSignPayload.model_validate(
+        {
+            "files": [input_pdf],
+            "signature_configuration": {
+                "type": "new",
+                "name": "sig",
+                "location": make_signature_location(),
+            },
+            "credentials": {
+                "certificate": certificate_file,
+                "private_key": private_key_file,
+            },
+        }
+    )
+
+    assert payload.certificate is not None
+    assert payload.private_key is not None
+    assert payload.certificate[0].type == "application/x-x509-ca-cert"
+    assert payload.private_key[0].type == "application/x-x509-ca-cert"