Documents and signatures

Anvil creates documents from templates – receipts, delivery notes, confirmations –, has them signed on a tablet with a pen or finger, stores the PDF with the record and deletes it when its retention ends (ADR 0015).

1. An action creates the draft from a template and the data of the record: Creating documents.
2. The handover locks the device of the employee to the document: Handover mode.
3. The person signs; the PDF is stored with the record and the audit log gets its hashes: Signing.
4. The template reacts in the same transaction, e.g. with a write-back to another system.
5. The document is deleted when its retention has ended: Retention.

Setup

1. Write a template class and its view: Templates, Writing the view.

2. Register it and set the name or logo of the documents:

   app/Config/Anvil.php

   public array $documentTemplates = [\App\Documents\IssueReceipt::class];
   public string $documentBrand    = 'Muster AG';
   public ?string $documentLogo    = ROOTPATH . 'public/img/logo.png';

3. Register Access::pages() in the panel – it contains the signing page (/admin/handover) and the page Retention of documents.

4. Show the documents on the detail page of the owner resource:

   public function detailComponents(): array
   {
       return ['documents' => new \Anvil\Documents\Ui\DocumentsComponent($this)];
   }

5. Add an action that creates the draft and starts the handover, see Creating documents.

6. Give the permission of the template (default documents.manage) to the roles of the employees who hand over.

7. Schedule php spark anvil:tick every minute (retention).

Run the migrations of Anvil to create anvil_documents and anvil_document_retention.

Statuses

Status	Meaning
draft	created, can be handed over, signed or voided
signed	signed; read only, PDF stored
final	completed without signature (templates without signature)
void	discarded draft, with a reason
purged	retention ended; PDF and personal data deleted, hashes kept

Security in short

• The signature is bound to the content the signer saw (SHA-256).
• Signed documents are read only; a changed PDF no longer matches its recorded hash.
• The signing device is locked to the signing page until the employee enters their password.
• PDFs are files of the owner record and follow its permissions.
• The audit log holds hashes, never content or names.

Details: Security.