Merge branch 'master' into bugfix/devexpress-pdf-not-displaying

Replaced the WASM client-side authentication service with a new
SSR (Server-Side Rendering) authentication service to resolve
issues in SSR mode caused by self-referencing HTTP requests and
the lack of `HttpContext`.

Added `IEnvelopeAuthService` interface and its implementation
`EnvelopeAuthService`, which directly accesses `HttpContext.User`
to validate user authentication and claims. Registered the service
in the DI container with a scoped lifetime.

Updated `EnvelopeReceiverPage.razor` to use the new SSR service
for authentication checks and logout logic. Changes to the page
were reverted due to a merge conflict, with a detailed plan
provided for re-application.

Improved logging for debugging authentication issues and outlined
a migration checklist, including testing, unit tests, and
documentation updates. These changes improve performance, ensure
SSR compatibility, and eliminate unnecessary HTTP requests.

AGENTS.md

@@ -0,0 +1,263 @@
+# EnvelopeGenerator - Agent Guide
+
+## Must Read First
+- **`COPILOT_CONTEXT.md`** - Architecture, coordinate systems, migration status
+- **`FORM_APPLICATION_CONTEXT.md`** - Legacy VB.NET features to migrate
+
+## Active Architecture (Post-Migration)
+
+**Frontend:** Blazor Auto (Server+WASM hybrid)
+- **WebUI** (Server): `@rendermode InteractiveServer` - PDF viewers requiring DevExpress backend
+- **WebUI.Client** (WASM): `@rendermode InteractiveWebAssembly` - Login, dashboards, business logic
+
+**Backend:** EnvelopeGenerator.API (ASP.NET Core 8.0)
+
+**Proxy:** YARP in WebUI routes `/api/*` → `localhost:8088` (API)
+
+### Deprecated Projects - DO NOT USE
+- `EnvelopeGenerator.ReceiverUI` - Pure WASM (migrated to WebUI)
+- `EnvelopeGenerator.Web` - Razor Pages (replaced by WebUI)
+- **VB.NET projects** (`Form`, `Service`, `BBTests`) - Legacy, read-only for reference
+
+## Development Commands
+
+### Run Both Projects (Required)
+```powershell
+# Terminal 1 - API Backend
+cd EnvelopeGenerator.API
+dotnet run
+
+# Terminal 2 - Blazor Frontend
+cd EnvelopeGenerator.WebUI\EnvelopeGenerator.WebUI
+dotnet run
+```
+
+**Critical:** Both must run simultaneously. WebUI proxy forwards `/api/*` to API.
+
+### Build
+```powershell
+dotnet build EnvelopeGenerator.sln
+```
+
+## Project Boundaries
+
+```
+EnvelopeGenerator.Domain/          # Entities (Envelope, Receiver, Document, etc.)
+EnvelopeGenerator.Application/     # MediatR CQRS (Commands, Queries, Handlers)
+EnvelopeGenerator.Infrastructure/  # EF Core, SQL executors, repositories
+EnvelopeGenerator.API/             # Controllers, endpoints
+EnvelopeGenerator.WebUI/           # Server-side Blazor components
+  ├─ Components/Pages/             # @rendermode InteractiveServer
+EnvelopeGenerator.WebUI.Client/    # Client-side WASM components
+  ├─ Pages/                        # @rendermode InteractiveWebAssembly
+  ├─ Services/                     # HTTP API clients
+  ├─ Models/                       # DTOs
+```
+
+## Route Structure (Critical)
+
+| Route | File Location | Render Mode | Purpose |
+|-------|--------------|-------------|---------|
+| `/` | `WebUI.Client/Pages/Index.razor` | WASM | Landing page |
+| `/sender/login` | `WebUI.Client/Pages/LoginSenderPage.razor` | WASM | Sender auth |
+| `/sender` | `WebUI.Client/Pages/EnvelopeSenderPage.razor` | WASM | Sender dashboard |
+| `/envelope/login/{key}` | `WebUI.Client/Pages/LoginReceiverPage.razor` | WASM | Receiver auth |
+| `/envelope/{key}` | `WebUI/Components/Pages/EnvelopeReceiverPage.razor` | **Server** | PDF viewer + signing |
+
+**Rule:** PDF viewers MUST use `@rendermode InteractiveServer` (DevExpress backend requirement). Everything else uses WASM.
+
+## Coordinate System (CRITICAL)
+
+**Database stores INCHES** (GdPicture14 native). Origin: top-left, Y-axis down.
+
+### Conversions
+```csharp
+// Database (INCHES) → PDF Points
+float points = inches * 72;
+
+// Database (INCHES) → DevExpress DX
+float dx = inches * 100;
+
+// PDF.js Pixels → Database (INCHES)
+float inches = (pixelX / canvasWidth) * pageWidthInches;
+```
+
+**A4 Page:** 8.27" wide × 11.69" tall = 595pt × 842pt
+
+**Signature Field Size:** 1.77" × 1.96" (FIXED, do not change)
+
+**Evidence:** See `COPILOT_CONTEXT.md` lines 158-185, `EnvelopeGenerator.Form/frmFieldEditor.vb`
+
+## API Architecture Quirks
+
+### Monolithic Endpoint (Avoid for UI)
+`POST /api/EnvelopeReceiver` - Creates envelope+document+receivers+fields atomically.
+- **Use case:** External API consumers
+- **Not suitable for:** Step-by-step UI workflow (no draft support, no partial updates)
+
+### Missing Granular Endpoints (Need to Create)
+```
+POST /api/Envelope/draft          # Create draft envelope
+PUT /api/Envelope/{id}            # Update metadata
+DELETE /api/Envelope/{id}         # Delete with reason
+POST /api/Envelope/{id}/document  # Upload PDF
+POST /api/Envelope/{id}/receivers # Add receiver
+POST /api/Envelope/{id}/signature-fields  # Place signature field
+POST /api/Envelope/{id}/send      # Send to receivers
+```
+
+See `FORM_APPLICATION_CONTEXT.md` for detailed workflow requirements.
+
+## Status Color Coding
+
+Form app uses DevExpress `CustomDrawCell`. WebUI needs CSS:
+
+```css
+.envelope-row.status-partly-signed { background-color: #81C784; } /* GREEN_300 */
+.envelope-row.status-queued,
+.envelope-row.status-sent { background-color: #FFB74D; } /* ORANGE_300 */
+.envelope-row.status-completed { background-color: #81C784; }
+.envelope-row.status-deleted,
+.envelope-row.status-rejected { background-color: #E57373; } /* RED_300 */
+```
+
+## Configuration
+
+### YARP Proxy (`WebUI/yarp.json`)
+Routes `/api/*`, `/swagger/*`, `/openapi/*`, `/scalar/*` → `https://localhost:8088`
+
+### PDF.js Settings (`WebUI/wwwroot/appsettings.json`)
+```json
+{
+  "PdfViewerOptions": {
+    "ThumbnailBaseScale": 0.75,
+    "ThumbnailEnableHiDPI": true,
+    "MainCanvasEnableHiDPI": true,
+    "ZoomStepPercentage": 5
+  }
+}
+```
+
+### API Config (`API/appsettings.json`)
+- `ConnectionStrings:Default` - SQL Server DB
+- `AllowedOrigins` - CORS (includes `http://localhost:5131`, `http://localhost:7192`)
+- `Cache:SignatureCacheExpiration` - Signature persistence timeout
+- `PSPDFKitLicenseKey` - **DEPRECATED** (use PDF.js instead)
+
+## Migration Status
+
+### Complete ✅
+- Receiver login/authentication
+- PDF viewing with PDF.js (HiDPI, zoom, thumbnails)
+- Signature capture (draw/type/image)
+- Signature caching (Redis/SQL)
+- Sender login
+
+### Missing (High Priority) ❌
+- Sender dashboard (`/sender`) - Empty stub
+- Envelope editor (`/sender/envelope/{id}`)
+- Signature field placement tool (PDF.js + draggable overlays)
+- Granular API endpoints (draft, receivers, fields)
+- Master-detail grids for receivers/history
+
+## Common Mistakes (DO NOT REPEAT)
+
+| Mistake | Why Wrong |
+|---------|-----------|
+| Using iText7 in receiver pages | GPL license issue. Use PDF.js overlays. |
+| Using PSPDFKit | Removed from architecture. Use PDF.js + DevExpress. |
+| `@rendermode InteractiveWebAssembly` on PDF viewers | DevExpress DxPdfViewer requires server-side rendering. |
+| Hardcoded quality in PDF.js | Use `appsettings.json` `PdfViewerOptions`. |
+| Coordinates in points/pixels for DB | Database uses INCHES. Convert before save. |
+| `BottomMarginBand` for signatures | Repeats on every page. Use `DetailBand`. |
+
+## Testing
+
+**No automated tests exist yet.**
+
+Manual testing workflow:
+1. Start API (`dotnet run` in `EnvelopeGenerator.API`)
+2. Start WebUI (`dotnet run` in `EnvelopeGenerator.WebUI\EnvelopeGenerator.WebUI`)
+3. Navigate to `https://localhost:5131` (or check console output for port)
+4. Test sender login at `/sender/login`
+5. Test receiver flow at `/envelope/login/{envelopeKey}`
+
+## Database
+
+**SQL Server** (DD_ECM)
+- Connection string in `API/appsettings.json`
+- EF Core migrations NOT used (manual SQL scripts)
+- Stored procedures: `PRSIG_*` prefix
+
+**Key Tables:**
+- `TBSIG_ENVELOPE` - Envelope metadata
+- `TBSIG_ENVELOPE_RECEIVER` - Receiver assignments
+- `TBSIG_DOC_RECEIVER_ELEMENT` - Signature fields (X, Y in INCHES)
+- `TBSIG_RECEIVER` - Receiver registry
+- `TBSIG_DOCUMENT` - PDF binary data
+- `TBSIG_ENVELOPE_HISTORY` - Audit trail
+
+## DevExpress
+
+**License:** Commercial (v25.2.3)
+**Components Used:**
+- `DxGrid` - Master-detail grids
+- `DxPdfViewer` - Server-side PDF rendering
+- `DxPopup` - Modal dialogs
+- `DxToolbar` - Action bars
+- `DxFormLayout` - Forms
+
+**Theme:** Blazing Berry (default)
+
+## JavaScript Interop
+
+**PDF Viewer:** `wwwroot/js/pdf-viewer.js`
+```javascript
+window.pdfViewer = {
+    initialize(canvasId, pdfDataUrl, dotNetRef),
+    renderPage(num),
+    renderSignatureButtons(signatures, pageNum, dotNetRef),
+    applySignature(signatureId, dataUrl, fullName, position, place),
+    zoomIn(), zoomOut(), dispose()
+}
+```
+
+**Signature Pad:** `wwwroot/js/receiver-signature.js`
+```javascript
+window.receiverSignature = {
+    initializeDrawPad(canvasId, dotNetRef),
+    getSignatureDataUrl(canvasId),
+    clearPad(canvasId)
+}
+```
+
+## Multi-Envelope Support
+
+Receivers can login to **multiple envelopes simultaneously** via per-envelope cookies:
+```
+AuthTokenSignFLOWReceiver.{envelopeKey}
+```
+
+Each envelope maintains independent authentication state.
+
+## External Dependencies
+
+**CDN:**
+- PDF.js 3.11.174: `https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js`
+
+**NuGet (WebUI.Client):**
+- `DevExpress.Blazor.*` 25.2.3
+- `SkiaSharp.*` 3.119.1 (WASM rendering)
+
+**External Services:**
+- LDAP/AD authentication (optional)
+- GTX Messaging (SMS 2FA)
+- Email dispatcher (signFlow)
+
+## Environment Variables
+
+None required. All config in `appsettings.json`.
+
+**Local dev ports:**
+- API: `https://localhost:8088`
+- WebUI: `https://localhost:5131` or `http://localhost:7192`

COPILOT_CONTEXT.md

@@ -1,72 +1,107 @@
 # EnvelopeGenerator — AI Context Reference
 
 ## Purpose
-Digital document signing system with **unified Blazor WASM frontend** for both Senders and Receivers. Senders create envelopes and place signature fields. Receivers view PDFs, sign documents, export stamped PDFs.
+Digital document signing system with **unified Blazor Auto (Server+WASM hybrid) frontend** for both Senders and Receivers. Senders create envelopes and place signature fields. Receivers view PDFs, sign documents, export stamped PDFs.
 
 **Primary Libraries:** DevExpress + PDF.js (PSPDFKit removed)
 
 ---
 
+## Migration Notice
+
+**EnvelopeGenerator.ReceiverUI ? EnvelopeGenerator.WebUI Migration**
+
+The project has been migrated from pure Blazor WebAssembly (`ReceiverUI`) to **Blazor Auto (Server+WASM hybrid)** architecture (`WebUI`) to resolve DevExpress `DxPdfViewer` compatibility issues.
+
+**Reason:** DevExpress `DxPdfViewer` requires backend server-side rendering services that are NOT available in pure WebAssembly projects.
+
+**New Structure:**
+- **WebUI** (Server project): Hosts server-side components, YARP proxy, DevExpress backend services
+- **WebUI.Client** (WASM project): Client-side components, business logic, services
+
+**Migration Details:** See `MIGRATION_CONTEXT.md`
+
+---
+
 ## Deployment Architecture
 
 **Two Presentation Projects (Both Required):**
 
 1. **EnvelopeGenerator.API** (ASP.NET Core Web API)
    - Runs independently (development & production)
-   - **YARP Reverse Proxy** configured via `yarp.json`
-   - Proxies requests to:
-     - `EnvelopeGenerator.ReceiverUI` (Blazor WASM)
-     - External Auth.API service
-   - Serves as single entry point for all requests
+   - Backend services for document management, authentication, signature endpoints
+   - Serves as API endpoint for WebUI
 
-2. **EnvelopeGenerator.ReceiverUI** (Blazor WebAssembly)
-   - Runs on separate host/port
-   - Accessed **only through API proxy** (not directly)
-   - Serves static files (HTML, JS, CSS, WASM)
+2. **EnvelopeGenerator.WebUI** (Blazor Auto - Server+WASM Hybrid)
+   - **Server Project (`EnvelopeGenerator.WebUI`):**
+     - **YARP Reverse Proxy** configured via `yarp.json`
+     - Proxies `/api/*` requests to `API:8088`
+     - Hosts server-side components (`@rendermode InteractiveServer`)
+     - DevExpress server-side services (DxPdfViewer backend)
+   - **Client Project (`EnvelopeGenerator.WebUI.Client`):**
+     - Client-side components (`@rendermode InteractiveWebAssembly`)
+     - Business logic services (AuthService, DocumentService, etc.)
+     - WASM runtime
 
 **Request Flow:**
 ```
-Client ? API:8088 (YARP Proxy) ? ReceiverUI:52936 (Blazor WASM)
-                                ? Auth.API:9090 (External Auth Service)
+Client ? WebUI:XXXX (Blazor Auto)
+            ?? Server-side Pages (DxPdfViewer)
+            ?? Client-side Pages (WASM)
+            ?? YARP Proxy: /api/* ? API:8088
 ```
 
-**Configuration:** `EnvelopeGenerator.API/yarp.json`
+**Configuration:** `EnvelopeGenerator.WebUI/yarp.json`
 
 ---
 
-## ReceiverUI Route Structure
+## WebUI Route Structure
 
 ### Root Route
-| Route | File | Purpose |
-|---|---|---|
-| `/` | `Index.razor` | Application entry point (landing page). | 
+| Route | File | Location | Render Mode |
+|---|---|---|---|
+| `/` | `Index.razor` | `WebUI.Client/Pages/` | `@rendermode InteractiveWebAssembly` |
 
 ### Sender Routes
-| Route | File | Purpose |
-|---|---|---|
-| `/sender/login` | `LoginSenderPage.razor` | Username/password authentication |
-| `/sender` | `EnvelopeSenderPage.razor` | Sender dashboard (envelope list) |
+| Route | File | Location | Render Mode |
+|---|---|---|---|
+| `/sender/login` | `LoginSenderPage.razor` | `WebUI.Client/Pages/` | `@rendermode InteractiveWebAssembly` |
+| `/sender` | `EnvelopeSenderPage.razor` | `WebUI.Client/Pages/` | `@rendermode InteractiveWebAssembly` |
 
-### Receiver Routes
-| Route | File | Purpose |
-|---|---|---|
-| `/envelope/login/{EnvelopeKey}` | `LoginReceiverPage.razor` | Access code authentication for specific envelope |
-| `/envelope/{EnvelopeKey}` | `EnvelopeReceiverPage.razor` | View & sign envelope (PDF.js viewer) |
+### Receiver Routes (PDF Viewers)
+| Route | File | Location | Render Mode |
+|---|---|---|---|
+| `/envelope/login/{EnvelopeKey}` | `LoginReceiverPage.razor` | `WebUI.Client/Pages/` | `@rendermode InteractiveWebAssembly` |
+| `/envelope/{EnvelopeKey}` | `EnvelopeReceiverPage.razor` | `WebUI/Components/Pages/` | `@rendermode InteractiveServer` |
+| `/envelope/DxPdfViewer` | `EnvelopeReceiverPage_DxPdfViewer.razor` | `WebUI/Components/Pages/` | `@rendermode InteractiveServer` |
+| `/envelope/{EnvelopeKey}/DxReportViewer` | `EnvelopeReceiverPage_DxReportViewer.razor` | `WebUI/Components/Pages/` | `@rendermode InteractiveServer` |
+| `/envelope/Embed` | `EnvelopeReceiverPage_embed.razor` | `WebUI/Components/Pages/` | `@rendermode InteractiveServer` |
 
 **Multi-Envelope Support:** Receivers can login to multiple envelopes simultaneously (per-envelope cookie authentication).
 
+**Render Mode Strategy:**
+- **Client-side Pages (WASM):** Login, Sender dashboard, Index (no DevExpress backend required)
+- **Server-side Pages (Server):** PDF viewers (DevExpress DxPdfViewer requires backend)
+
 ---
 
 ## Architecture Evolution
 
-### Old Architecture (Deprecated)
+### Old Architecture (Deprecated v1)
 - **Sender UI:** `EnvelopeGenerator.Web` (Razor Pages + PSPDFKit)
-- **Receiver UI:** `EnvelopeGenerator.ReceiverUI` (Blazor WASM + PDF.js)
+- **Receiver UI:** Separate project
 - **Backend:** `EnvelopeGenerator.API`
 
-### Current Architecture
-- **Unified Frontend:** `EnvelopeGenerator.ReceiverUI` (Blazor WASM) — **Both Senders & Receivers**
-- **Backend:** `EnvelopeGenerator.API` — **Both Senders & Receivers**
+### Intermediate Architecture (Deprecated v2)
+- **Unified Frontend:** `EnvelopeGenerator.ReceiverUI` (Pure Blazor WASM)
+- **Backend:** `EnvelopeGenerator.API`
+- **Issue:** DevExpress `DxPdfViewer` displayed blank screen (no backend services in WASM)
+
+### Current Architecture (Active)
+- **Frontend:** `EnvelopeGenerator.WebUI` (Blazor Auto - Server+WASM Hybrid)
+  - **WebUI** (Server): Server-side components, YARP proxy, DevExpress backend
+  - **WebUI.Client** (WASM): Client-side components, services, business logic
+- **Backend:** `EnvelopeGenerator.API`
 - **Libraries:** DevExpress + PDF.js
 - **PSPDFKit:** **REMOVED**
 
@@ -77,12 +112,14 @@ Client ? API:8088 (YARP Proxy) ? ReceiverUI:52936 (Blazor WASM)
 | Project | Target | Purpose |
 |---|---|---|
 | `EnvelopeGenerator.API` | net8.0 | ASP.NET Core Web API. Backend for **both Senders & Receivers**. Auth, PDF serving, signature endpoints. |
-| `EnvelopeGenerator.ReceiverUI` | net8.0 WASM | **Unified Blazor WebAssembly Frontend**. UI for **both Senders & Receivers**. YARP proxy to API. |
+| `EnvelopeGenerator.WebUI` | net8.0 | **Blazor Auto Server Project**. YARP proxy, server-side components, DevExpress backend services. |
+| `EnvelopeGenerator.WebUI.Client` | net8.0 WASM | **Blazor Auto Client Project**. Client-side components, services, business logic. |
+| `EnvelopeGenerator.ReceiverUI` | net8.0 WASM | **DEPRECATED.** Pure Blazor WASM (migrated to WebUI). |
 | `EnvelopeGenerator.Web` | net7/8/9 | **DEPRECATED.** Legacy Razor Pages (Sender UI). No longer used. |
 | `EnvelopeGenerator.Application` | multi | MediatR CQRS handlers. Business logic. |
 | `EnvelopeGenerator.Domain` | multi | Domain models, constants, interfaces. |
 | `EnvelopeGenerator.Infrastructure` | multi | EF Core repos, DB context. |
-| `EnvelopeGenerator.PdfEditor` | multi | iText7 utilities (NOT used in ReceiverUI). |
+| `EnvelopeGenerator.PdfEditor` | multi | iText7 utilities (NOT used in WebUI). |
 | `EnvelopeGenerator.DependencyInjection` | multi | DI registration helpers. |
 | **VB.NET projects** (Service/Form/BBTests) | net462 | **Legacy. Do NOT touch.** |
 
@@ -155,18 +192,31 @@ Client ? API:8088 (YARP Proxy) ? ReceiverUI:52936 (Blazor WASM)
 
 ## Key Files & Routes
 
-| File | Route/Purpose |
+### Client-Side Pages (WebUI.Client)
+| File | Route | Purpose |
+|---|---|---|
+| `WebUI.Client/Pages/Index.razor` | `/` | Application entry point (landing page). |
+| `WebUI.Client/Pages/EnvelopeSenderPage.razor` | `/sender` | Sender dashboard (envelope list). |
+| `WebUI.Client/Pages/LoginSenderPage.razor` | `/sender/login` | Sender username/password auth. |
+| `WebUI.Client/Pages/LoginReceiverPage.razor` | `/envelope/login/{EnvelopeKey}` | Receiver access code auth. |
+
+### Server-Side Pages (WebUI)
+| File | Route | Purpose |
+|---|---|---|
+| `WebUI/Components/Pages/EnvelopeReceiverPage.razor` | `/envelope/{key}` | Receiver PDF viewer & signing (PDF.js). |
+| `WebUI/Components/Pages/EnvelopeReceiverPage_DxPdfViewer.razor` | `/envelope/DxPdfViewer` | DevExpress PDF Viewer (test page). |
+| `WebUI/Components/Pages/EnvelopeReceiverPage_DxReportViewer.razor` | `/envelope/{key}/DxReportViewer` | DevExpress Report Viewer. |
+| `WebUI/Components/Pages/EnvelopeReceiverPage_embed.razor` | `/envelope/Embed` | Embedded PDF viewer (iframe). |
+
+### Services & Assets
+| File | Purpose |
 |---|---|
-| `ReceiverUI/Pages/Index.razor` | `/` — Application entry point (landing page). |
-| `ReceiverUI/Pages/EnvelopeSenderPage.razor` | `/sender` — Sender dashboard (envelope list). |
-| `ReceiverUI/Pages/EnvelopeReceiverPage.razor` | `/envelope/{key}` — Receiver PDF viewer & signing. |
-| `ReceiverUI/Pages/LoginSenderPage.razor` | `/sender/login` — Sender username/password auth. |
-| `ReceiverUI/Pages/LoginReceiverPage.razor` | `/envelope/login/{EnvelopeKey}` — Receiver access code auth. |
-| `ReceiverUI/wwwroot/js/pdf-viewer.js` | PDF.js wrapper (zoom, pagination, thumbnails). |
-| `ReceiverUI/wwwroot/js/receiver-signature.js` | Signature pad (draw/type/image). |
-| `ReceiverUI/wwwroot/css/envelope-viewer.css` | EnvelopeViewer styles. |
-| `ReceiverUI/Services/AuthService.cs` | Receiver + Sender authentication. |
-| `ReceiverUI/Services/SignatureCacheService.cs` | Signature caching (Redis/SQL). |
+| `WebUI.Client/Services/AuthService.cs` | Receiver + Sender authentication. |
+| `WebUI.Client/Services/SignatureCacheService.cs` | Signature caching (Redis/SQL). |
+| `WebUI.Client/Services/DocumentService.cs` | PDF document retrieval. |
+| `WebUI/wwwroot/js/pdf-viewer.js` | PDF.js wrapper (zoom, pagination, thumbnails). |
+| `WebUI/wwwroot/js/receiver-signature.js` | Signature pad (draw/type/image). |
+| `WebUI/wwwroot/css/envelope-viewer.css` | EnvelopeViewer styles. |
 | `API/Controllers/CacheController.cs` | Signature cache endpoints. |
 
 ---
@@ -203,8 +253,8 @@ Client ? API:8088 (YARP Proxy) ? ReceiverUI:52936 (Blazor WASM)
 ## EnvelopeReceiver — PDF.js Viewer & Signing
 
 **Route:** `/envelope/{EnvelopeKey}`  
-**Tech:** PDF.js 3.11.174 + Blazor WASM + configurable quality  
-**File:** `ReceiverUI/Pages/EnvelopeReceiverPage.razor`
+**Tech:** PDF.js 3.11.174 + Blazor Server (`@rendermode InteractiveServer`) + configurable quality  
+**File:** `WebUI/Components/Pages/EnvelopeReceiverPage.razor`
 
 ### Key Features
 1. HiDPI/Retina support (4x quality)
@@ -215,7 +265,7 @@ Client ? API:8088 (YARP Proxy) ? ReceiverUI:52936 (Blazor WASM)
 6. Responsive (desktop/mobile)
 
 ### Configuration
-**File:** `ReceiverUI/wwwroot/appsettings.json`
+**File:** `WebUI/wwwroot/appsettings.json`
 
 ```json
 {
@@ -229,7 +279,7 @@ Client ? API:8088 (YARP Proxy) ? ReceiverUI:52936 (Blazor WASM)
 ```
 
 ### JavaScript API
-**File:** `ReceiverUI/wwwroot/js/pdf-viewer.js`
+**File:** `WebUI/wwwroot/js/pdf-viewer.js`
 
 ```javascript
 window.pdfViewer = {
@@ -276,7 +326,7 @@ window.pdfViewer = {
    - Session state: `_capturedSignature` (lost on refresh)
 
 ### Data Model
-**File:** `ReceiverUI/Models/SignatureCaptureDto.cs`
+**File:** `WebUI.Client/Models/SignatureCaptureDto.cs`
 
 ```csharp
 public sealed record SignatureCaptureDto {
@@ -315,7 +365,7 @@ signature:91751687-8ae6-4777-bf5f-b8846085e62e:{envelopeKey}
 ```
 
 ### Service
-**File:** `ReceiverUI/Services/SignatureCacheService.cs`
+**File:** `WebUI.Client/Services/SignatureCacheService.cs`
 
 ```csharp
 public class SignatureCacheService {
@@ -332,11 +382,11 @@ public class SignatureCacheService {
 ## Sender Login
 
 **Route:** `/sender/login`  
-**File:** `ReceiverUI/Pages/LoginSenderPage.razor`  
+**File:** `WebUI.Client/Pages/LoginSenderPage.razor`  
 **Tech:** Bootstrap 5 + DevExpress Blazing Berry theme
 
 ### AuthService Extension
-**File:** `ReceiverUI/Services/AuthService.cs`
+**File:** `WebUI.Client/Services/AuthService.cs`
 
 ```csharp
 public enum SenderLoginResult { Success, InvalidCredentials, Error }
@@ -381,7 +431,7 @@ public async Task<SenderLoginResult> LoginSenderAsync(string username, string pa
 ## Receiver Login
 
 **Route:** `/envelope/login/{EnvelopeKey}`  
-**File:** `ReceiverUI/Pages/LoginReceiverPage.razor`
+**File:** `WebUI.Client/Pages/LoginReceiverPage.razor`
 
 **Multi-Envelope Support:** Cookies are stored per-envelope (e.g., `AuthTokenSignFLOWReceiver.{envelopeKey}`), allowing simultaneous authentication for multiple envelopes in the same browser session.
 
@@ -409,7 +459,7 @@ public async Task<EnvelopeLoginResult> LoginEnvelopeReceiverAsync(string key, st
 
 ---
 
-## NuGet Packages (ReceiverUI)
+## NuGet Packages (WebUI.Client)
 
 | Package | Version | Purpose |
 |---|---|---|
@@ -441,7 +491,8 @@ public async Task<EnvelopeLoginResult> LoginEnvelopeReceiverAsync(string key, st
 
 ### Deprecated Projects
 **DO NOT USE:**
-- `EnvelopeGenerator.Web` (Razor Pages) — Replaced by unified ReceiverUI
+- `EnvelopeGenerator.ReceiverUI` (Pure Blazor WASM) — Migrated to WebUI (DevExpress compatibility issue)
+- `EnvelopeGenerator.Web` (Razor Pages) — Replaced by unified WebUI
 - PSPDFKit — Removed, use PDF.js + DevExpress instead
 
 ### Legacy Projects (VB.NET)
@@ -476,14 +527,16 @@ Proves database uses INCHES natively.
 2. Prefer simplicity over complexity
 3. Use `appsettings.json` for configuration
 4. Keep consistent with existing design (Bootstrap 5 + Blazing Berry)
-5. **Unified frontend:** ReceiverUI serves both Senders and Receivers
+5. **Unified frontend:** WebUI serves both Senders and Receivers
+6. **Render mode:** Client-side (WASM) for login/dashboard, Server-side for PDF viewers
 
 ### When debugging:
 1. **Coordinates:** Always check unit system (inches/points/pixels)
 2. **Authentication:** Check cookie name/domain/SameSite
 3. **Cache:** Check Redis/SQL connection + key format
-4. **Frontend confusion:** Only use ReceiverUI (Web is deprecated)
+4. **Frontend confusion:** Only use WebUI (ReceiverUI/Web are deprecated)
+5. **Blank DxPdfViewer:** Ensure page has `@rendermode InteractiveServer`
 
 ---
 
-**Last Updated:** Session 19 (Razor file naming convention + Index route proxy)
+**Last Updated:** 2025-01-27 (ReceiverUI ? WebUI migration complete)

EnvelopeGenerator.Application/DependencyInjection.cs

@@ -51,8 +51,8 @@ public static class DependencyInjection
         services.Configure<TotpSmsParams>(config.GetSection(nameof(TotpSmsParams)));
 
         services.AddHttpClientService<GtxMessagingParams>(config.GetSection(nameof(GtxMessagingParams)));
-        services.TryAddSingleton<ISmsSender, GTXSmsSender>();
-        services.TryAddSingleton<IEnvelopeSmsHandler, EnvelopeSmsHandler>();
+        services.TryAddScoped<ISmsSender, GTXSmsSender>();          // Changed: Singleton → Scoped
+        services.TryAddScoped<IEnvelopeSmsHandler, EnvelopeSmsHandler>(); // Changed: Singleton → Scoped
         services.TryAddSingleton<IAuthenticator, Authenticator>();
         services.TryAddSingleton<QRCodeGenerator>();
 

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Data/Adjustment.cs

@@ -0,0 +1,44 @@
+namespace EnvelopeGenerator.Server.Client.Data {
+    public class Adjustment
+    {
+        public static Adjustment CreateBalanceForward(DateTime dt, int random)
+        {
+            var rnd = new DeterministicRandom(random);
+            Adjustment res = new Adjustment();
+            res.currentDateTime = dt;
+            res.currentDescription = "Balance Forward";
+            res.currentAmount = rnd.Random(10, 300) * 10;
+            return res;
+        }
+        public static Adjustment CreatePayment(DateTime dt, int random)
+        {
+            var rnd = new DeterministicRandom(random);
+            Adjustment res = new Adjustment();
+            res.currentDateTime = dt;
+            res.currentDescription = "Payment";
+            res.currentAmount = -rnd.Random(1, 40) * 10;
+            return res;
+        }
+        public static Adjustment CreateCharge(DateTime dt, int random)
+        {
+            var rnd = new DeterministicRandom(random);
+            Adjustment res = new Adjustment();
+            res.currentDateTime = dt;
+            res.currentDescription = rnd.GetRandomItem(bills);
+            res.currentAmount = rnd.Random(10, 50) * 10;
+            return res;
+        }
+
+        DateTime currentDateTime;
+        string currentDescription = "";
+        double currentAmount = 0;
+        static readonly string[] bills = new string[] { "Bill - Insurance", "Bill - Electricity", "Bill - Rent", "Bill - Phone", "Bill - Office Supplies" };
+        public DateTime Date { get { return currentDateTime; } }
+        public string Description { get { return currentDescription; } }
+        public double Amount { get { return currentAmount; } }
+
+        public Adjustment()
+        {
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Data/Customer.cs

@@ -0,0 +1,64 @@
+using DevExpress.DataAccess.Sql;
+using DevExpress.DataAccess.Sql.DataApi;
+
+namespace EnvelopeGenerator.Server.Client.Data {
+    public class Customer {
+        static List<Customer> currentCustomers = new List<Customer>();
+
+        public static List<Customer> Customers { get { return currentCustomers; } }
+        static Customer() {
+            try {
+                SqlDataSource ds = new SqlDataSource("NWindConnectionString");
+                SelectQuery query = SelectQueryFluentBuilder
+                    .AddTable("Customers")
+                    .SelectAllColumns()
+                    .Build("Customers");
+                ds.Queries.Add(query);
+                ds.RebuildResultSchema();
+                ds.Fill();
+                ITable src = ds.Result["Customers"];
+                foreach(var row in src) {
+                    currentCustomers.Add(new Customer() {
+                        CustomerID = row.GetValue<string>("CustomerID"),
+                        Address = row.GetValue<string>("Address"),
+                        CompanyName = row.GetValue<string>("CompanyName"),
+                        ContactName = row.GetValue<string>("ContactName"),
+                        ContactTitle = row.GetValue<string>("ContactTitle"),
+                        Country = row.GetValue<string>("Country"),
+                        City = row.GetValue<string>("City"),
+                        Fax = row.GetValue<string>("Fax"),
+                        Phone = row.GetValue<string>("Phone"),
+                        PostalCode = row.GetValue<string>("PostalCode"),
+                        Region = row.GetValue<string>("Region")
+                    });
+                }
+            } catch {
+                currentCustomers.Add(new Customer() { 
+                    Address = "Obere Str. 57",
+                    City = "Berlin",
+                    CompanyName = "Alfreds Futterkiste",
+                    ContactName = "Maria Anders",
+                    ContactTitle = "Sales Representative",
+                    Country = "Germany",
+                    CustomerID = "ALFKI",
+                    Fax = "030-0076545",
+                    Phone = "030-0074321",
+                    PostalCode = "12209"
+                });
+            }
+        }
+
+        public string CustomerID { get; set; }
+        public string CompanyName { get; set; }
+        public string ContactName { get; set; }
+        public string ContactTitle { get; set; }
+        public string Address { get; set; }
+        public string City { get; set; }
+        public string PostalCode { get; set; }
+        public string Region { get; set; }
+        public string Country { get; set; }
+        public string Phone { get; set; }
+        public string Fax { get; set; }
+
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Data/DataItem.cs

@@ -0,0 +1,71 @@
+namespace EnvelopeGenerator.Server.Client.Data {
+    public class DataItem {
+        static readonly string[] accountType = new string[] { "Energy", "Manufacturing", "Estate", "Food", "Services" };
+        public string CustomerID { get; set; }
+        public string CompanyName { get; set; }
+        public string ContactName { get; set; }
+        public string ContactTitle { get; set; }
+        public string Address { get; set; }
+        public string City { get; set; }
+        public string PostalCode { get; set; }
+        public string Region { get; set; }
+        public string Country { get; set; }
+        public string Phone { get; set; }
+        public string Fax { get; set; }
+        public string Email { get; set; }
+        public string Invoice { get; set; }
+        public string CustomerAccount { get; set; }
+        public string CustomerIdentifiers { get; set; }
+        public DateTime BillingDate { get; set; }
+        public DateTime BillingPeriodStart { get; set; }
+        public DateTime BillingPeriodEnd { get; set; }
+        public string Terms { get; set; }
+        public string TermsID { get; set; }
+        public Adjustment[] Adjustments { get; set; }
+
+        public DataItem(int i) {
+            var rnd = new DeterministicRandom(i);
+            Customer c = rnd.GetRandomItem(Customer.Customers);
+            CustomerID = c.CustomerID;
+            CompanyName = c.CompanyName;
+            ContactName = c.ContactName;
+            ContactTitle = c.ContactTitle;
+            Address = c.Address;
+            City = c.City;
+            PostalCode = c.PostalCode;
+            Region = c.Region;
+            Country = c.Country;
+            Phone = c.Phone;
+            Fax = c.Fax;
+            Email = ContactName.Split(' ')[0].Replace(' ', '.').ToLower() + "@" + CompanyName.Split(' ')[0].ToLower() + ".com";
+            Invoice = string.Format("{0}{1}-{2}", rnd.RandomChar, rnd.Random(100, 1000), rnd.Random(100, 1000));
+            CustomerAccount = rnd.GetRandomItem(accountType);
+            CustomerIdentifiers = string.Format("{0}-{1}", rnd.Random(1000, 10000), rnd.Random(10, 100));
+            BillingPeriodStart = rnd.RandomTime();
+            BillingPeriodEnd = rnd.RandomTime(BillingPeriodStart, 7 * 24, 30 * 24);
+            BillingDate = rnd.RandomTime(BillingPeriodEnd, 7 * 24, 30 * 24);
+            Term currentTerm = rnd.GetRandomItem(Term.Terms);
+            Terms = currentTerm.Name;
+
+            int adjustmentsCount = rnd.Random(6) + 4;
+            Adjustments = new Adjustment[adjustmentsCount];
+            int h = (int)((BillingPeriodEnd - BillingPeriodStart).TotalHours / adjustmentsCount);
+
+            Adjustments[0] = Adjustment.CreateBalanceForward(rnd.RandomTime(BillingPeriodStart, 0, h), rnd.Random(10000));
+
+            int[] items = rnd.RandomList(adjustmentsCount - 1, 2);
+
+            for(int j = 1; j < Adjustments.Length; j++) {
+                DateTime nextDate = rnd.RandomTime(BillingPeriodStart.AddHours(h * j), 0, h);
+                    switch(items[j - 1]) {
+                        case 0:
+                            Adjustments[j] = Adjustment.CreateCharge(nextDate, rnd.Random(10000));
+                            break;
+                        case 1:
+                            Adjustments[j] = Adjustment.CreatePayment(nextDate, rnd.Random(10000));
+                            break;
+                    }
+            }
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Data/DataItemList.cs

@@ -0,0 +1,70 @@
+using System.Collections;
+
+namespace EnvelopeGenerator.Server.Client.Data {
+    public class DataItemList : IList<DataItem>, IList {
+        readonly int rowCount;
+
+        public DataItem this[int index] { get { return new DataItem(index); } set { } }
+        public int Count { get { return rowCount; } }
+        public bool IsReadOnly { get { return false; } }
+        public bool IsFixedSize { get { return false; } }
+        public object SyncRoot { get { return true; } }
+        public bool IsSynchronized { get { return true; } }
+        object IList.this[int index] { get { return new DataItem(index); } set { } }
+
+        public DataItemList(int rowCount) {
+            this.rowCount = rowCount;
+        }
+        public IEnumerator<DataItem> GetEnumerator() {
+            throw new NotImplementedException();
+        }
+        public int Add(object value) {
+            throw new NotImplementedException();
+        }
+        public bool Contains(object value) {
+            throw new NotImplementedException();
+        }
+        public void Clear() {
+            throw new NotImplementedException();
+        }
+        public int IndexOf(object value) {
+            throw new NotImplementedException();
+        }
+        public void Insert(int index, object value) {
+            throw new NotImplementedException();
+        }
+        public void Remove(object value) {
+            throw new NotImplementedException();
+        }
+        public void RemoveAt(int index) {
+            throw new NotImplementedException();
+        }
+        public void CopyTo(Array array, int index) {
+            throw new NotImplementedException();
+        }
+        IEnumerator IEnumerable.GetEnumerator() {
+            throw new NotImplementedException();
+        }
+        public int IndexOf(DataItem item) {
+            throw new NotImplementedException();
+        }
+        public void Insert(int index, DataItem item) {
+            throw new NotImplementedException();
+        }
+        public void Add(DataItem item) {
+            throw new NotImplementedException();
+        }
+        public bool Contains(DataItem item) {
+            throw new NotImplementedException();
+        }
+        public void CopyTo(DataItem[] array, int arrayIndex) {
+            throw new NotImplementedException();
+        }
+        public bool Remove(DataItem item) {
+            throw new NotImplementedException();
+        }
+        void ICollection<DataItem>.CopyTo(DataItem[] array, int arrayIndex) {
+            CopyTo(array, arrayIndex);
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Data/DeterministicRandom.cs

@@ -0,0 +1,60 @@
+namespace EnvelopeGenerator.Server.Client.Data {
+    class DeterministicRandom {
+        const int randomCount = 10000;
+        static readonly int[] deterministicRandomNumbers;
+        static readonly DateTime time;
+        int rnd;
+        int Next {
+            get {
+                rnd = deterministicRandomNumbers[rnd % randomCount];
+                return rnd;
+            }
+        }
+        public char RandomChar {
+            get {
+                return (char)((int)'A' + Random(0, 26));
+            }
+        }
+        public int[] RandomList(int count, int to) {
+            int[] res = new int[count];
+            for(int i = 0; i < Math.Min(count, to); i++)
+                res[i] = i;
+            for(int i = to; i < count; i++)
+                res[i] = Random(to);
+
+            for(int i = 0; i < count; i++) {
+                int ind = Random(count);
+                int temp = res[ind];
+                res[ind] = res[i];
+                res[i] = temp;
+            }
+            return res;
+        }
+        public int Random(int to) {
+            return Random(0, to);
+        }
+        public int Random(int from, int to) {
+            return Next % Math.Max(1, to - from) + from;
+        }
+        public T GetRandomItem<T>(IList<T> list) {
+            return list[Next % list.Count];
+        }
+        public DateTime RandomTime() {
+            return RandomTime(time, 0, 30 * 24);
+        }
+        public DateTime RandomTime(DateTime from, int fromHours, int toHours) {
+            return from.AddHours(Next % (toHours - fromHours) + fromHours);
+        }
+
+        static DeterministicRandom() {
+            time = DateTime.Now.AddDays(-62);
+            Random currentRandom = new Random(randomCount);
+            deterministicRandomNumbers = new int[randomCount];
+            for(int i = 0; i < randomCount; i++)
+                deterministicRandomNumbers[i] = currentRandom.Next(randomCount);
+        }
+        public DeterministicRandom(int i) {
+            this.rnd = i + (i >> 10) + (i >> 20);
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Data/Term.cs

@@ -0,0 +1,15 @@
+namespace EnvelopeGenerator.Server.Client.Data {
+    public struct Term {
+        public static readonly Term[] Terms = new Term[] {
+            new Term("Payment seven days after invoice date" ),
+            new Term("Payment ten days after invoice date" ),
+            new Term("End of month" ),
+            new Term("21st of the month following invoice date" ),
+        };
+        readonly string currentName;
+        public string Name { get { return currentName; } }
+        public Term(string currentName) {
+            this.currentName = currentName;
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/EnvelopeGenerator.Server.Client.csproj

@@ -0,0 +1,37 @@
+<Project Sdk="Microsoft.NET.Sdk.BlazorWebAssembly">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <NoDefaultLaunchSettingsFile>true</NoDefaultLaunchSettingsFile>
+    <StaticWebAssetProjectMode>Default</StaticWebAssetProjectMode>
+    <WasmBuildNative>true</WasmBuildNative>
+    <InvariantGlobalization>false</InvariantGlobalization>
+    <BlazorWebAssemblyLoadAllGlobalizationData>true</BlazorWebAssemblyLoadAllGlobalizationData>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="DevExpress.Blazor.PdfViewer" Version="25.2.3" />
+    <PackageReference Include="DevExpress.Blazor.Reporting.JSBasedControls" Version="25.2.3" />
+    <PackageReference Include="DevExpress.Blazor.Reporting.Viewer" Version="25.2.3" />
+    <PackageReference Include="DevExpress.Drawing.Skia" Version="25.2.3" />
+    <PackageReference Include="HarfBuzzSharp.NativeAssets.WebAssembly" Version="8.3.1.2" />
+    <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.9" />
+    <PackageReference Include="SkiaSharp.NativeAssets.WebAssembly" Version="3.119.1" />
+    <PackageReference Include="SkiaSharp.Views.Blazor" Version="3.119.1" />
+    <NativeFileReference Include="$(HarfBuzzSharpStaticLibraryPath)\2.0.23\*.a" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="8.0.22" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="8.0.11" PrivateAssets="all" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Compile Update="PredefinedReports\Report.cs">
+      <SubType>XtraReport</SubType>
+    </Compile>
+  </ItemGroup>
+
+</Project>

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Layout/Header.razor

@@ -0,0 +1,21 @@
+<nav class="navbar header-navbar p-0">
+    <button class="navbar-toggler bg-primary d-block" @onclick="OnToggleClick">
+        <span class="navbar-toggler-icon"></span>
+    </button>
+    <div class="ms-3 fw-bold title pe-4">EnvelopeGenerator.ReceiverUI</div>
+</nav>
+
+@code {
+    [Parameter] public bool ToggleOn { get; set; }
+    [Parameter] public EventCallback<bool> ToggleOnChanged { get; set; }
+
+    async Task OnToggleClick() => await Toggle();
+
+    async Task Toggle(bool? value = null) {
+        var newValue = value ?? !ToggleOn;
+        if(ToggleOn != newValue) {
+            ToggleOn = newValue;
+            await ToggleOnChanged.InvokeAsync(ToggleOn);
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Layout/MainLayout.razor

@@ -0,0 +1,28 @@
+@using EnvelopeGenerator.Server.Client.Services;
+@inherits LayoutComponentBase
+
+<div class="page">
+<main>
+        <article class="content">
+            @Body
+        </article>
+    </main>
+    <footer class="receiver-footer">
+        <span>&copy; SignFlow 2023-2024 <a href="https://digitaldata.works" target="_blank" rel="noopener">Digital Data GmbH</a></span>
+        <span class="receiver-footer__sep">&#124;</span>
+        <a href="docs/privacy-policy.de-DE.html" target="_blank" rel="noopener">Datenschutz</a>
+    </footer>
+</div>
+
+@code {
+    [Inject] IHttpClientFactory HttpClientFactory { get; set; } = default!;
+    
+    List<string> RequiredFonts = new() {
+        "opensans.ttf"
+    };
+
+    protected async override Task OnInitializedAsync() {
+        await FontLoader.LoadFonts(HttpClientFactory, RequiredFonts);
+        await base.OnInitializedAsync();
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Layout/MainLayout.razor.css

@@ -0,0 +1,18 @@
+#blazor-error-ui {
+    background: lightyellow;
+    bottom: 0;
+    box-shadow: 0 -1px 2px rgba(0, 0, 0, 0.2);
+    display: none;
+    left: 0;
+    padding: 0.6rem 1.25rem 0.7rem 1.25rem;
+    position: fixed;
+    width: 100%;
+    z-index: 1000;
+}
+
+    #blazor-error-ui .dismiss {
+        cursor: pointer;
+        position: absolute;
+        right: 0.75rem;
+        top: 0.5rem;
+    }

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Layout/NavMenu.razor

@@ -0,0 +1,46 @@
+<div class="top-row ps-3 navbar navbar-dark">
+    <div class="container-fluid">
+        <a class="navbar-brand" href="">EnvelopeGenerator.ReceiverUI</a>
+        <button title="Navigation menu" class="navbar-toggler" @onclick="ToggleNavMenu">
+            <span class="navbar-toggler-icon"></span>
+        </button>
+    </div>
+</div>
+
+<div class="@NavMenuCssClass" @onclick="ToggleNavMenu">
+    <nav class="flex-column">
+        @*
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="" Match="NavLinkMatch.All">
+                <span class="oi oi-home" aria-hidden="true"></span> Home
+            </NavLink>
+        </div>
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="documentviewer">
+                <span class="oi oi-plus" aria-hidden="true"></span> Document Viewer (JS-Based)
+            </NavLink>
+        </div>
+        *@
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="receiver">
+                <span class="oi oi-plus" aria-hidden="true"></span> Empfänger-UI
+            </NavLink>
+        </div>
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="sender">
+                <span class="oi oi-plus" aria-hidden="true"></span> Umschlag-UI
+            </NavLink>
+        </div>
+    </nav>
+</div>
+
+@code {
+    private bool collapseNavMenu = true;
+
+    private string NavMenuCssClass => collapseNavMenu ? "collapse" : null;
+
+    private void ToggleNavMenu()
+    {
+        collapseNavMenu = !collapseNavMenu;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Models/AnnotationDto.cs

@@ -0,0 +1,32 @@
+namespace EnvelopeGenerator.Server.Client.Models;
+
+/// <summary>
+/// Represents a pre-assigned signature annotation position on a specific page.
+/// <br/><br/>
+/// <b>Coordinate unit (X, Y):</b> Inches (GdPicture14 native unit),
+/// origin at the <b>top-left</b> corner of the page, both axes increase downward/rightward.
+/// <br/><br/>
+/// <b>Conversion to DevExpress:</b> Multiply by 100 (DX uses 1/100 inch).
+/// Convert: <c>xDX = xInches * 100.0</c>
+/// <br/>
+/// <b>Conversion to PDF Points:</b> Multiply by 72 (1 inch = 72 points).
+/// Convert: <c>xPt = xInches * 72.0</c>
+/// <br/>
+/// <b>Y-axis for PDF (bottom-left origin):</b> Flip required for iText7.
+/// Convert: <c>yPt = (pageHeightInches - yInches - elemHeightInches) * 72.0</c>
+/// </summary>
+[Obsolete("Use SignatureDto with SignatureService.")]
+public record AnnotationDto
+{
+    /// <summary>Unique identifier of the annotation.</summary>
+    public long Id { get; init; }
+
+    /// <summary>1-based page number within the document.</summary>
+    public int Page { get; init; }
+
+    /// <summary>Horizontal position in INCHES from the left edge of the page.</summary>
+    public double X { get; init; }
+
+    /// <summary>Vertical position in INCHES from the top edge of the page.</summary>
+    public double Y { get; init; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Models/Constants/SenderAppType.cs

@@ -0,0 +1,8 @@
+namespace EnvelopeGenerator.Server.Client.Models.Constants
+{
+    public enum SenderAppType
+    {
+        LegacyFormApp = 0,
+        ReceiverUIBlazorApp = 1
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Models/Constants/UnitOfLength.cs

@@ -0,0 +1,65 @@
+namespace EnvelopeGenerator.Server.Client.Models.Constants;
+
+/// <summary>
+/// Represents the unit of measurement for coordinate values in signature positioning.
+/// Used for converting coordinates between different systems (GdPicture14, PDF.js, iText7).
+/// </summary>
+public enum UnitOfLength
+{
+    /// <summary>
+    /// Inch unit (1 inch = 25.4 mm).
+    /// This is the native unit used by GdPicture14 (EnvelopeGenerator.Form - Legacy VB.NET app).
+    /// Database stores all coordinates (X, Y, Width, Height) in INCHES.
+    /// </summary>
+    /// <remarks>
+    /// <b>Source:</b> GdPicture14.Annotations.AnnotationStickyNote uses INCHES natively.
+    /// <br/>
+    /// <b>Evidence:</b> VB.NET code directly assigns database values to annotation properties without conversion:
+    /// <code>
+    /// oAnnotation.Left = CSng(pElement.X)   ' Direct assignment → INCHES
+    /// oAnnotation.Top = CSng(pElement.Y)
+    /// </code>
+    /// <b>Standard Page Dimensions:</b>
+    /// <list type="bullet">
+    ///   <item>A4: 8.27" × 11.69" (210mm × 297mm)</item>
+    ///   <item>Letter: 8.5" × 11"</item>
+    /// </list>
+    /// </remarks>
+    Inch = 0,
+
+    /// <summary>
+    /// PDF Point unit (1 point = 1/72 inch).
+    /// This is the standard unit used by PDF specification and PDF.js viewer.
+    /// </summary>
+    /// <remarks>
+    /// <b>Definition:</b> According to PDF specification and Microsoft documentation:
+    /// <br/>
+    /// <i>"PDF pages are sized in point units. 1 pt == 1/72 inch"</i>
+    /// <br/><br/>
+    /// <b>Conversion Formula:</b>
+    /// <code>
+    /// points = inches * 72.0
+    /// inches = points / 72.0
+    /// </code>
+    /// <b>Important:</b> Point ≠ Pixel!
+    /// <list type="bullet">
+    ///   <item><b>Point (pt):</b> Device-independent unit (always 1/72 inch)</item>
+    ///   <item><b>Pixel (px):</b> Device-dependent unit (varies with screen DPI)</item>
+    ///   <item>At 72 DPI: 1 point = 1 pixel (coincidence)</item>
+    ///   <item>At 96 DPI: 1 point ≈ 1.33 pixels</item>
+    ///   <item>At 300 DPI: 1 point ≈ 4.17 pixels</item>
+    /// </list>
+    /// <b>Standard Page Dimensions (in points):</b>
+    /// <list type="bullet">
+    ///   <item>A4: 595 × 842 points (8.27" × 11.69" × 72)</item>
+    ///   <item>Letter: 612 × 792 points (8.5" × 11" × 72)</item>
+    /// </list>
+    /// <b>Usage in EnvelopeGenerator:</b>
+    /// <list type="bullet">
+    ///   <item>PDF.js viewer expects coordinates in points</item>
+    ///   <item>iText7 library uses points for PDF manipulation</item>
+    ///   <item>PSPDFKit (Web) uses points for annotation placement</item>
+    /// </list>
+    /// </remarks>
+    Point
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Models/EnvelopeReceiverDto.cs

@@ -0,0 +1,105 @@
+namespace EnvelopeGenerator.Server.Client.Models;
+
+/// <summary>
+/// Client-side model for the envelope receiver returned by
+/// <c>GET api/EnvelopeReceiver/{envelopeKey}</c>.
+/// </summary>
+public record EnvelopeReceiverDto
+{
+    public int EnvelopeId { get; init; }
+    public int ReceiverId { get; init; }
+    public int Sequence { get; init; }
+
+    public string? Name { get; init; }
+    public string? JobTitle { get; init; }
+    public string? CompanyName { get; init; }
+    public string? PrivateMessage { get; init; }
+
+    public DateTime AddedWhen { get; init; }
+    public DateTime? ChangedWhen { get; init; }
+    public bool HasPhoneNumber { get; init; }
+
+    public EnvelopeClientDto? Envelope { get; init; }
+    public ReceiverClientDto? Receiver { get; init; }
+}
+
+/// <summary>
+/// Client-side model for the envelope data embedded in <see cref="EnvelopeReceiverDto"/>.
+/// </summary>
+public record EnvelopeClientDto
+{
+    public int Id { get; init; }
+    public int UserId { get; init; }
+    public int Status { get; init; }
+    public string StatusName { get; init; } = string.Empty;
+    public string Uuid { get; init; } = string.Empty;
+    public string Title { get; init; } = string.Empty;
+    public string Message { get; init; } = string.Empty;
+    public DateTime AddedWhen { get; init; }
+    public DateTime? ChangedWhen { get; init; }
+    public string Language { get; init; } = "de-DE";
+    public int? EnvelopeTypeId { get; init; }
+    public string? EnvelopeTypeTitle { get; init; }
+    public int? ContractType { get; init; }
+    public int? CertificationType { get; init; }
+    public bool UseAccessCode { get; init; }
+    public bool TFAEnabled { get; init; }
+    public IEnumerable<DocumentClientDto>? Documents { get; init; }
+    public EnvelopeSenderDto? User { get; init; }
+}
+
+/// <summary>
+/// Sender (user) information embedded in <see cref="EnvelopeClientDto"/>.
+/// </summary>
+public record EnvelopeSenderDto
+{
+    public int Id { get; init; }
+    public string? Username { get; init; }
+    public string? FullName { get; init; }
+    public string? Email { get; init; }
+}
+
+/// <summary>
+/// Client-side model for a document embedded in <see cref="EnvelopeClientDto"/>.
+/// </summary>
+public record DocumentClientDto
+{
+    public int Id { get; init; }
+    public int EnvelopeId { get; init; }
+    public DateTime AddedWhen { get; init; }
+    public IEnumerable<SignatureClientDto>? Elements { get; init; }
+}
+
+/// <summary>
+/// Client-side model for a signature/annotation element embedded in <see cref="DocumentClientDto"/>.
+/// </summary>
+public record SignatureClientDto
+{
+    public int Id { get; init; }
+    public int DocumentId { get; init; }
+    public int ReceiverId { get; init; }
+    public int ElementType { get; init; }
+    public double X { get; init; }
+    public double Y { get; init; }
+    public double Width { get; init; }
+    public double Height { get; init; }
+    public int Page { get; init; }
+    public bool Required { get; init; }
+    public string? Tooltip { get; init; }
+    public bool ReadOnly { get; init; }
+    public int AnnotationIndex { get; init; }
+    public DateTime AddedWhen { get; init; }
+    public DateTime? ChangedWhen { get; init; }
+}
+
+/// <summary>
+/// Client-side model for the receiver data embedded in <see cref="EnvelopeReceiverDto"/>.
+/// </summary>
+public record ReceiverClientDto
+{
+    public int Id { get; init; }
+    public string? EmailAddress { get; init; }
+    public string? Signature { get; init; }
+    public DateTime AddedWhen { get; init; }
+    public DateTime? TfaRegDeadline { get; init; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Models/SignatureCaptureDto.cs

@@ -0,0 +1,62 @@
+namespace EnvelopeGenerator.Server.Client.Models;
+
+/// <summary>
+/// Represents a captured signature with metadata created by the receiver in the signature popup.
+/// This model holds the signature image (as base64 data URL) along with signer information
+/// used for rendering applied signatures on the PDF canvas.
+/// </summary>
+/// <remarks>
+/// <b>Used in:</b> EnvelopeViewer.razor signature popup workflow
+/// <br/>
+/// <b>Creation:</b> User draws/types/uploads signature and fills required fields
+/// <br/>
+/// <b>Storage:</b> Session-only (Blazor component state, lost on page refresh)
+/// <br/>
+/// <b>Rendering:</b> Applied signatures display: Image + Separator + Name/Position/Place/Date
+/// </remarks>
+public sealed record SignatureCaptureDto
+{
+    /// <summary>
+    /// Base64-encoded data URL of the signature image.
+    /// <br/>
+    /// <b>Format:</b> <c>data:image/png;base64,iVBORw0KG...</c>
+    /// <br/>
+    /// <b>Source:</b> Canvas.toDataURL() from signature pad (draw/text/image tabs)
+    /// <br/>
+    /// <b>Usage:</b> Set as <c>img.src</c> in applied signature overlay
+    /// </summary>
+    public required string DataUrl { get; init; }
+
+    /// <summary>
+    /// Full name of the signer (first and last name).
+    /// <br/>
+    /// <b>Required:</b> Yes (validated in popup)
+    /// <br/>
+    /// <b>Display:</b> Bold text in applied signature block
+    /// <br/>
+    /// <b>Example:</b> "Max Mustermann"
+    /// </summary>
+    public required string FullName { get; init; }
+
+    /// <summary>
+    /// Job title or position of the signer.
+    /// <br/>
+    /// <b>Required:</b> No (optional field)
+    /// <br/>
+    /// <b>Display:</b> Normal weight text between name and place/date
+    /// <br/>
+    /// <b>Example:</b> "Geschäftsführer" or empty string
+    /// </summary>
+    public string Position { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Location/place where the signature was created.
+    /// <br/>
+    /// <b>Required:</b> Yes (validated in popup)
+    /// <br/>
+    /// <b>Display:</b> Shown with current date in German format (dd.MM.yyyy)
+    /// <br/>
+    /// <b>Example:</b> "Berlin" ? rendered as "Berlin, 26.01.2025"
+    /// </summary>
+    public required string Place { get; init; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Models/SignatureDto.cs

@@ -0,0 +1,101 @@
+using EnvelopeGenerator.Server.Client.Models.Constants;
+
+namespace EnvelopeGenerator.Server.Client.Models;
+
+/// <summary>
+/// Represents a signature position on a PDF page.
+/// Coordinates stored in INCHES (GdPicture14 native unit).
+/// Origin: Top-left corner, X increases right, Y increases down.
+/// </summary>
+public class SignatureDto
+{
+    /// <summary>Unique identifier.</summary>
+    public int Id { get; init; }
+
+    private double _x;
+    private double _y;
+
+    /// <summary>Horizontal position in INCHES from left edge.</summary>
+    public double X 
+    { 
+        get => _x * Factor;
+        init => _x = value; 
+    }
+
+    /// <summary>Vertical position in INCHES from top edge.</summary>
+    public double Y 
+    { 
+        get => _y * Factor;
+        init => _y = value; 
+    }
+
+    /// <summary>1-based page number.</summary>
+    public int Page { get; init; }
+
+    /// <summary>Sender application type that created this signature.</summary>
+    public SenderAppType SenderAppType { get; init; }
+
+    private UnitOfLength _unitOfLength;
+
+    public SignatureDto Convert(UnitOfLength unitOfLength)
+    {
+        _unitOfLength = unitOfLength;
+        return this;
+    }
+
+    public double Factor
+    {
+        get
+        {
+            if (SenderAppType != SenderAppType.LegacyFormApp)
+            {
+                throw new NotImplementedException(
+                    $"SenderAppType '{SenderAppType}' is not yet implemented. " +
+                    $"Currently, only '{nameof(SenderAppType.LegacyFormApp)}' is supported. " +
+                    $"Future implementations will handle '{nameof(SenderAppType.ReceiverUIBlazorApp)}' and other types.");
+            }
+
+            // LegacyFormApp uses GdPicture14 with INCHES
+            return _unitOfLength switch
+            {
+                UnitOfLength.Inch => 1.0,   // No conversion needed: INCHES → INCHES
+                UnitOfLength.Point => 72.0, // INCHES → PDF Points: 1 inch = 72 points (PDF standard, NOT pixels!)
+                _ => throw new InvalidOperationException(
+                    $"Unknown UnitOfLength: {_unitOfLength}. Expected '{nameof(UnitOfLength.Inch)}' or '{nameof(UnitOfLength.Point)}'.")
+            };
+        }
+    }
+}
+
+public static class SignatureDtoExtensions
+{
+    /// <summary>
+    /// Converts all signatures in the collection to the specified unit of length.
+    /// </summary>
+    /// <typeparam name="T">Type of the collection (IEnumerable, List, etc.)</typeparam>
+    /// <param name="signatures">Collection of SignatureDto objects to convert.</param>
+    /// <param name="unitOfLength">Target unit of measurement (Inch or Point).</param>
+    /// <returns>The same collection with all signatures converted to the specified unit.</returns>
+    /// <exception cref="ArgumentNullException">Thrown when signatures collection is null.</exception>
+    /// <remarks>
+    /// <b>Usage:</b>
+    /// <code>
+    /// var signatures = await SignatureService.GetAsync(envelopeKey);
+    /// var convertedSignatures = signatures.ConvertAll(UnitOfLength.Point);
+    /// </code>
+    /// <b>Note:</b> This method modifies each SignatureDto object in place and returns the same collection.
+    /// </remarks>
+    public static T Convert<T>(this T signatures, UnitOfLength unitOfLength) 
+        where T : IEnumerable<SignatureDto>
+    {
+        if (signatures == null)
+            throw new ArgumentNullException(nameof(signatures));
+
+        foreach (var signature in signatures)
+        {
+            signature.Convert(unitOfLength);
+        }
+
+        return signatures;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Options/ApiOptions.cs

@@ -0,0 +1,10 @@
+namespace EnvelopeGenerator.Server.Client.Options;
+
+public class ApiOptions
+{
+    public const string SectionName = "Api";
+
+    public string BaseUrl { get; set; } = string.Empty;
+
+    public bool UsePredefinedReports { get; set; } = false;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Options/PdfViewerOptions.cs

@@ -0,0 +1,71 @@
+namespace EnvelopeGenerator.Server.Client.Options;
+
+public class PdfViewerOptions
+{
+    public const string SectionName = "PdfViewer";
+
+    /// <summary>
+    /// Base scale for thumbnail rendering (0.2 - 1.5 recommended)
+    /// Higher values = better quality but slower rendering
+    /// Default: 0.75
+    /// </summary>
+    public double ThumbnailBaseScale { get; set; } = 0.75;
+
+    /// <summary>
+    /// Enable HiDPI/Retina support for thumbnails
+    /// Default: true
+    /// </summary>
+    public bool ThumbnailEnableHiDPI { get; set; } = true;
+
+    /// <summary>
+    /// Maximum device pixel ratio multiplier for thumbnails (1.0 - 3.0)
+    /// Caps DPR to avoid excessive memory usage on 4K+ displays
+    /// Default: 2.0
+    /// </summary>
+    public double ThumbnailMaxDPR { get; set; } = 2.0;
+
+    /// <summary>
+    /// Enable HiDPI/Retina support for main PDF canvas
+    /// Default: true
+    /// </summary>
+    public bool MainCanvasEnableHiDPI { get; set; } = true;
+
+    /// <summary>
+    /// Maximum device pixel ratio multiplier for main canvas (1.0 - 3.0)
+    /// Default: 2.0
+    /// </summary>
+    public double MainCanvasMaxDPR { get; set; } = 2.0;
+
+    /// <summary>
+    /// Enable smooth zoom transition (fade effect)
+    /// Default: true
+    /// </summary>
+    public bool EnableSmoothZoom { get; set; } = true;
+
+    /// <summary>
+    /// Zoom transition duration in milliseconds (50 - 500)
+    /// Default: 150
+    /// </summary>
+    public int ZoomTransitionDuration { get; set; } = 150;
+
+    /// <summary>
+    /// Opacity during rendering (0.0 - 1.0)
+    /// Lower values = more visible fade effect
+    /// Default: 0.85
+    /// </summary>
+    public double RenderingOpacity { get; set; } = 0.85;
+
+    /// <summary>
+    /// Delay between thumbnail renders in milliseconds (10 - 200)
+    /// Higher values = less browser stress, slower initial load
+    /// Default: 50
+    /// </summary>
+    public int ThumbnailRenderDelay { get; set; } = 50;
+
+    /// <summary>
+    /// Zoom step percentage (1 - 50)
+    /// Controls how much zoom changes per click or scroll
+    /// Default: 5 (5% per step)
+    /// </summary>
+    public int ZoomStepPercentage { get; set; } = 5;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Pages/EnvelopeSenderPage.razor

@@ -0,0 +1,8 @@
+@page "/sender"
+@rendermode InteractiveWebAssembly
+
+<h3>EnvelopeSender</h3>
+
+@code {
+
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Pages/Index.razor

@@ -0,0 +1,72 @@
+@page "/"
+@rendermode InteractiveWebAssembly
+@inject IJSRuntime JS
+
+<link href="_content/DevExpress.Blazor.Themes/blazing-berry.bs5.min.css" rel="stylesheet" />
+
+<div class="home-page-wrapper">
+
+    <div class="home-hero-header">
+        <div class="home-hero-header__inner">
+            <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" fill="currentColor" class="home-hero-header__icon" viewBox="0 0 16 16">
+                <path d="M0 4a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2V4Zm2-1a1 1 0 0 0-1 1v.217l7 4.2 7-4.2V4a1 1 0 0 0-1-1H2Zm13 2.383-4.708 2.825L15 11.105V5.383Zm-.034 6.876-5.64-3.471L8 9.583l-1.326-.795-5.64 3.47A1 1 0 0 0 2 13h12a1 1 0 0 0 .966-.741ZM1 11.105l4.708-2.897L1 5.383v5.722Z"/>
+            </svg>
+            <div>
+                <h1 class="home-hero-header__title">SignFlow</h1>
+                <p class="home-hero-header__subtitle">Willkommen im eSign-Portal</p>
+            </div>
+        </div>
+    </div>
+
+    <div class="home-content">
+        <div class="home-card card shadow border-0">
+            <div class="card-body p-4 p-md-5">
+
+                <p class="text-muted mb-4" style="font-size: 0.92rem; line-height: 1.7; text-align: justify; text-align-last: left; min-height: calc(0.92rem * 1.7 * 9);">
+                    <span id="home-description"></span>
+                </p>
+
+                <div class="mt-4 pt-3 border-top">
+                    <div class="d-flex flex-wrap justify-content-center gap-3">
+                        <div class="home-feature-badge">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" fill="currentColor" class="me-1" viewBox="0 0 16 16">
+                                <path d="M8 1a2 2 0 0 1 2 2v4H6V3a2 2 0 0 1 2-2zm3 6V3a3 3 0 0 0-6 0v4a2 2 0 0 0-2 2v5a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2z"/>
+                            </svg>
+                            Sicherer Zugang
+                        </div>
+                        <div class="home-feature-badge">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" fill="currentColor" class="me-1" viewBox="0 0 16 16">
+                                <path d="M13.854 3.646a.5.5 0 0 1 0 .708l-7 7a.5.5 0 0 1-.708 0l-3.5-3.5a.5.5 0 1 1 .708-.708L6.5 10.293l6.646-6.647a.5.5 0 0 1 .708 0z"/>
+                            </svg>
+                            Digitale Unterschrift
+                        </div>
+                        <div class="home-feature-badge">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" fill="currentColor" class="me-1" viewBox="0 0 16 16">
+                                <path d="M.5 9.9a.5.5 0 0 1 .5.5v2.5a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-2.5a.5.5 0 0 1 1 0v2.5a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2v-2.5a.5.5 0 0 1 .5-.5z"/>
+                                <path d="M7.646 11.854a.5.5 0 0 0 .708 0l3-3a.5.5 0 0 0-.708-.708L8.5 10.293V1.5a.5.5 0 0 0-1 0v8.793L5.354 8.146a.5.5 0 1 0-.708.708l3 3z"/>
+                            </svg>
+                            PDF-Export
+                        </div>
+                    </div>
+                </div>
+
+            </div>
+        </div>
+    </div>
+
+</div>
+
+@code {
+    private const string HomePageDescription =
+        "Das digitale Unterschriftenportal ist eine Plattform, die entwickelt wurde, um Ihre Dokumente sicher zu unterschreiben und zu verwalten. " +
+        "Mit seiner benutzerfreundlichen Oberfläche können Sie Ihre Dokumente schnell hochladen, die Unterschriftsprozesse verfolgen und Ihre digitalen Unterschriftenanwendungen einfach durchführen. " +
+        "Dieses Portal beschleunigt Ihren Arbeitsablauf mit rechtlich gültigen Unterschriften und erhöht gleichzeitig die Sicherheit Ihrer Dokumente.";
+
+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (firstRender)
+        {
+            await JS.InvokeVoidAsync("receiverSignature.startTyped", "home-description", HomePageDescription, 15);
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Pages/LoginReceiverPage.razor

@@ -0,0 +1,173 @@
+@page "/envelope/login/{EnvelopeKey}"
+@rendermode InteractiveWebAssembly
+@using EnvelopeGenerator.Server.Client.Services
+@inject AuthService AuthService
+@inject NavigationManager Navigation
+
+<link href="_content/DevExpress.Blazor.Themes/blazing-berry.bs5.min.css" rel="stylesheet" />
+
+<div class="login-page-wrapper d-flex align-items-center justify-content-center min-vh-100">
+    <div class="login-card card shadow border-0" style="max-width: 440px; width: 100%;">
+
+        <div class="card-header text-white text-center py-4 border-0" style="background: linear-gradient(135deg, #2c3e50 0%, #3498db 100%); border-radius: calc(0.375rem - 1px) calc(0.375rem - 1px) 0 0;">
+            <div class="mb-2">
+                <svg xmlns="http://www.w3.org/2000/svg" width="40" height="40" fill="currentColor" viewBox="0 0 16 16">
+                    <path d="M8 1a2 2 0 0 1 2 2v4H6V3a2 2 0 0 1 2-2zm3 6V3a3 3 0 0 0-6 0v4a2 2 0 0 0-2 2v5a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2z" />
+                </svg>
+            </div>
+            <h5 class="mb-0 fw-semibold">Dokument öffnen</h5>
+            <p class="mb-0 mt-1 opacity-75" style="font-size: 0.85rem;">Sicherer Zugang mit Zugangscode</p>
+        </div>
+
+        <div class="card-body p-4">
+
+            <p class="text-muted mb-4" style="font-size: 0.875rem; line-height: 1.5;">
+                Bitte geben Sie den Zugangscode ein, den Sie per E-Mail erhalten haben, um das Dokument sicher zu öffnen.
+            </p>
+
+            @if (LoginResult == EnvelopeLoginResult.NotFound)
+            {
+                <div class="alert alert-warning d-flex align-items-start gap-2 py-2" role="alert">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="currentColor" class="flex-shrink-0 mt-1" viewBox="0 0 16 16">
+                        <path d="M8.982 1.566a1.13 1.13 0 0 0-1.96 0L.165 13.233c-.457.778.091 1.767.98 1.767h13.713c.889 0 1.438-.99.98-1.767L8.982 1.566zM8 5c.535 0 .954.462.9.995l-.35 3.507a.552.552 0 0 1-1.1 0L7.1 5.995A.905.905 0 0 1 8 5zm.002 6a1 1 0 1 1 0 2 1 1 0 0 1 0-2z" />
+                    </svg>
+                    <div>
+                        <strong>Dokument nicht gefunden.</strong><br />
+                        <span style="font-size:0.85rem;">Der angegebene Zugangscode konnte keinem Dokument zugeordnet werden. Bitte prüfen Sie den Link in Ihrer E-Mail.</span>
+                    </div>
+                </div>
+            }
+            else if (LoginResult == EnvelopeLoginResult.InvalidCode)
+            {
+                <div class="alert alert-danger d-flex align-items-start gap-2 py-2" role="alert">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="currentColor" class="flex-shrink-0 mt-1" viewBox="0 0 16 16">
+                        <path d="M16 8A8 8 0 1 1 0 8a8 8 0 0 1 16 0zM5.354 4.646a.5.5 0 1 0-.708.708L7.293 8l-2.647 2.646a.5.5 0 0 0 .708.708L8 8.707l2.646 2.647a.5.5 0 0 0 .708-.708L8.707 8l2.647-2.646a.5.5 0 0 0-.708-.708L8 7.293 5.354 4.646z" />
+                    </svg>
+                    <div>
+                        <strong>Ungültiger Zugangscode.</strong><br />
+                        <span style="font-size:0.85rem;">Der eingegebene Code ist falsch. Bitte versuchen Sie es erneut.</span>
+                    </div>
+                </div>
+            }
+            else if (LoginResult == EnvelopeLoginResult.Error)
+            {
+                <div class="alert alert-secondary d-flex align-items-start gap-2 py-2" role="alert">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="currentColor" class="flex-shrink-0 mt-1" viewBox="0 0 16 16">
+                        <path d="M8 15A7 7 0 1 1 8 1a7 7 0 0 1 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z" />
+                        <path d="M7.002 11a1 1 0 1 1 2 0 1 1 0 0 1-2 0zM7.1 4.995a.905.905 0 1 1 1.8 0l-.35 3.507a.552.552 0 0 1-1.1 0L7.1 4.995z" />
+                    </svg>
+                    <div>
+                        <strong>Serverfehler.</strong><br />
+                        <span style="font-size:0.85rem;">Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es später erneut.</span>
+                    </div>
+                </div>
+            }
+
+            <div class="mb-4">
+                <label class="form-label fw-medium" for="login-access-code">
+                    Zugangscode
+                    <span class="text-danger ms-1">*</span>
+                </label>
+                <div class="input-group">
+                    <span class="input-group-text bg-light border-end-0">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="#6c757d" viewBox="0 0 16 16">
+                            <path d="M3.5 11.5a3.5 3.5 0 1 1 3.163-5H14L15.5 8 14 9.5l-1-1-1 1-1-1-1 1-1-1-1.837 1.337A3.5 3.5 0 0 1 3.5 11.5zm0-1a2.5 2.5 0 1 0 0-5 2.5 2.5 0 0 0 0 5z" />
+                        </svg>
+                    </span>
+                    <input id="login-access-code"
+                           type="@(ShowCode ? "text" : "password")"
+                           class="form-control border-start-0 border-end-0 @(LoginResult == EnvelopeLoginResult.InvalidCode ? "is-invalid" : null)"
+                           placeholder="Zugangscode eingeben"
+                           @bind="AccessCode"
+                           @bind:event="oninput"
+                           @onkeydown="OnKeyDownAsync"
+                           disabled="@IsLoading"
+                           autocomplete="one-time-code" />
+                    <button type="button"
+                            class="btn btn-outline-secondary border-start-0"
+                            style="border-left: none;"
+                            tabindex="-1"
+                            @onclick="() => ShowCode = !ShowCode">
+                        @if (ShowCode)
+                        {
+                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">
+                                <path d="M13.359 11.238C15.06 9.72 16 8 16 8s-3-5.5-8-5.5a7.028 7.028 0 0 0-2.79.588l.77.771A5.944 5.944 0 0 1 8 3.5c2.12 0 3.879 1.168 5.168 2.457A13.134 13.134 0 0 1 14.828 8c-.058.087-.122.183-.195.288-.335.48-.83 1.12-1.465 1.755-.165.165-.337.328-.517.486l.708.709z" />
+                                <path d="M11.297 9.176a3.5 3.5 0 0 0-4.474-4.474l.823.823a2.5 2.5 0 0 1 2.829 2.829l.822.822zm-2.943 1.299.822.822a3.5 3.5 0 0 1-4.474-4.474l.823.823a2.5 2.5 0 0 0 2.829 2.829z" />
+                                <path d="M3.35 5.47c-.18.16-.353.322-.518.487A13.134 13.134 0 0 0 1.172 8l.195.288c.335.48.83 1.12 1.465 1.755C4.121 11.332 5.881 12.5 8 12.5c.716 0 1.39-.133 2.02-.36l.77.772A7.029 7.029 0 0 1 8 13.5C3 13.5 0 8 0 8s.939-1.721 2.641-3.238l.708.709z" />
+                                <path fill-rule="evenodd" d="M13.646 14.354l-12-12 .708-.708 12 12-.708.708z" />
+                            </svg>
+                        }
+                        else
+                        {
+                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">
+                                <path d="M16 8s-3-5.5-8-5.5S0 8 0 8s3 5.5 8 5.5S16 8 16 8zM1.173 8a13.133 13.133 0 0 1 1.66-2.043C4.12 4.668 5.88 3.5 8 3.5c2.12 0 3.879 1.168 5.168 2.457A13.133 13.133 0 0 1 14.828 8c-.058.087-.122.183-.195.288-.335.48-.83 1.12-1.465 1.755C11.879 11.332 10.119 12.5 8 12.5c-2.12 0-3.879-1.168-5.168-2.457A13.134 13.134 0 0 1 1.172 8z" />
+                                <path d="M8 5.5a2.5 2.5 0 1 0 0 5 2.5 2.5 0 0 0 0-5zM4.5 8a3.5 3.5 0 1 1 7 0 3.5 3.5 0 0 1-7 0z" />
+                            </svg>
+                        }
+                    </button>
+                </div>
+            </div>
+
+            <button class="btn btn-primary w-100 py-2 fw-medium"
+                    style="background: linear-gradient(135deg, #2c3e50 0%, #3498db 100%); border: none;"
+                    @onclick="SubmitAsync"
+                    disabled="@(IsLoading || string.IsNullOrWhiteSpace(AccessCode))">
+                @if (IsLoading)
+                {
+                    <span class="spinner-border spinner-border-sm me-2" role="status" aria-hidden="true"></span>
+                    <span>Überprüfen …</span>
+                }
+                else
+                {
+                    <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="me-2" viewBox="0 0 16 16">
+                        <path d="M8 1a2 2 0 0 1 2 2v4H6V3a2 2 0 0 1 2-2zm3 6V3a3 3 0 0 0-6 0v4a2 2 0 0 0-2 2v5a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2z" />
+                    </svg>
+                    <span>Dokument öffnen</span>
+                }
+            </button>
+
+        </div>
+
+        <div class="card-footer text-center text-muted py-3 border-0 bg-transparent" style="font-size: 0.78rem;">
+            Bei Problemen wenden Sie sich bitte an den Absender des Dokuments.
+        </div>
+
+    </div>
+</div>
+
+@code {
+    [Parameter] public string EnvelopeKey { get; set; } = string.Empty;
+
+    string AccessCode = string.Empty;
+    bool ShowCode;
+    bool IsLoading;
+    EnvelopeLoginResult? LoginResult;
+
+    async Task OnKeyDownAsync(Microsoft.AspNetCore.Components.Web.KeyboardEventArgs e)
+    {
+        if (e.Key == "Enter")
+            await SubmitAsync();
+    }
+
+    async Task SubmitAsync()
+    {
+        if (string.IsNullOrWhiteSpace(AccessCode) || IsLoading) return;
+
+        IsLoading = true;
+        LoginResult = null;
+        await InvokeAsync(StateHasChanged);
+
+        var result = await AuthService.LoginEnvelopeReceiverAsync(EnvelopeKey, AccessCode.Trim());
+
+        if (result == EnvelopeLoginResult.Success)
+        {
+            Navigation.NavigateTo($"/envelope/{Uri.EscapeDataString(EnvelopeKey)}", forceLoad: true);
+            return;
+        }
+
+        LoginResult = result;
+        IsLoading = false;
+        await InvokeAsync(StateHasChanged);
+    }
+}
+

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Pages/LoginSenderPage.razor

@@ -0,0 +1,172 @@
+@page "/sender/login"
+@rendermode InteractiveWebAssembly
+@using EnvelopeGenerator.Server.Client.Services
+@inject AuthService AuthService
+@inject NavigationManager Navigation
+
+<link href="_content/DevExpress.Blazor.Themes/blazing-berry.bs5.min.css" rel="stylesheet" />
+
+<div class="login-page-wrapper d-flex align-items-center justify-content-center min-vh-100">
+    <div class="login-card card shadow border-0" style="max-width: 440px; width: 100%;">
+
+        <div class="card-header text-white text-center py-4 border-0" style="background: linear-gradient(135deg, #2c3e50 0%, #3498db 100%); border-radius: calc(0.375rem - 1px) calc(0.375rem - 1px) 0 0;">
+            <div class="mb-2">
+                <svg xmlns="http://www.w3.org/2000/svg" width="40" height="40" fill="currentColor" viewBox="0 0 16 16">
+                    <path d="M11 6a3 3 0 1 1-6 0 3 3 0 0 1 6 0z"/>
+                    <path fill-rule="evenodd" d="M0 8a8 8 0 1 1 16 0A8 8 0 0 1 0 8zm8-7a7 7 0 0 0-5.468 11.37C3.242 11.226 4.805 10 8 10s4.757 1.225 5.468 2.37A7 7 0 0 0 8 1z"/>
+                </svg>
+            </div>
+            <h5 class="mb-0 fw-semibold">Sender Anmeldung</h5>
+            <p class="mb-0 mt-1 opacity-75" style="font-size: 0.85rem;">Sicherer Zugang zum Sender-Dashboard</p>
+        </div>
+
+        <div class="card-body p-4">
+
+            <p class="text-muted mb-4" style="font-size: 0.875rem; line-height: 1.5;">
+                Bitte melden Sie sich mit Ihren Zugangsdaten an, um auf das Sender-Dashboard zuzugreifen.
+            </p>
+
+            @if (LoginResult == SenderLoginResult.InvalidCredentials) {
+                <div class="alert alert-danger d-flex align-items-start gap-2 py-2" role="alert">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="currentColor" class="flex-shrink-0 mt-1" viewBox="0 0 16 16">
+                        <path d="M16 8A8 8 0 1 1 0 8a8 8 0 0 1 16 0zM5.354 4.646a.5.5 0 1 0-.708.708L7.293 8l-2.647 2.646a.5.5 0 0 0 .708.708L8 8.707l2.646 2.647a.5.5 0 0 0 .708-.708L8.707 8l2.647-2.646a.5.5 0 0 0-.708-.708L8 7.293 5.354 4.646z"/>
+                    </svg>
+                    <div>
+                        <strong>Ungültige Anmeldedaten.</strong><br />
+                        <span style="font-size:0.85rem;">Benutzername oder Passwort ist falsch. Bitte versuchen Sie es erneut.</span>
+                    </div>
+                </div>
+            } else if (LoginResult == SenderLoginResult.Error) {
+                <div class="alert alert-secondary d-flex align-items-start gap-2 py-2" role="alert">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="currentColor" class="flex-shrink-0 mt-1" viewBox="0 0 16 16">
+                        <path d="M8 15A7 7 0 1 1 8 1a7 7 0 0 1 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z"/>
+                        <path d="M7.002 11a1 1 0 1 1 2 0 1 1 0 0 1-2 0zM7.1 4.995a.905.905 0 1 1 1.8 0l-.35 3.507a.552.552 0 0 1-1.1 0L7.1 4.995z"/>
+                    </svg>
+                    <div>
+                        <strong>Serverfehler.</strong><br />
+                        <span style="font-size:0.85rem;">Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es später erneut.</span>
+                    </div>
+                </div>
+            }
+
+            <div class="mb-3">
+                <label class="form-label fw-medium" for="login-username">
+                    Benutzername
+                    <span class="text-danger ms-1">*</span>
+                </label>
+                <div class="input-group">
+                    <span class="input-group-text bg-light">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="#6c757d" viewBox="0 0 16 16">
+                            <path d="M3 14s-1 0-1-1 1-4 6-4 6 3 6 4-1 1-1 1H3Zm5-6a3 3 0 1 0 0-6 3 3 0 0 0 0 6Z"/>
+                        </svg>
+                    </span>
+                    <input id="login-username"
+                           type="text"
+                           class="form-control @(LoginResult == SenderLoginResult.InvalidCredentials ? "is-invalid" : null)"
+                           placeholder="Benutzername eingeben"
+                           @bind="Username"
+                           @bind:event="oninput"
+                           @onkeydown="OnKeyDownAsync"
+                           disabled="@IsLoading"
+                           autocomplete="username" />
+                </div>
+            </div>
+
+            <div class="mb-4">
+                <label class="form-label fw-medium" for="login-password">
+                    Passwort
+                    <span class="text-danger ms-1">*</span>
+                </label>
+                <div class="input-group">
+                    <span class="input-group-text bg-light border-end-0">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="#6c757d" viewBox="0 0 16 16">
+                            <path d="M8 1a2 2 0 0 1 2 2v4H6V3a2 2 0 0 1 2-2zm3 6V3a3 3 0 0 0-6 0v4a2 2 0 0 0-2 2v5a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2z"/>
+                        </svg>
+                    </span>
+                    <input id="login-password"
+                           type="@(ShowPassword ? "text" : "password")"
+                           class="form-control border-start-0 border-end-0 @(LoginResult == SenderLoginResult.InvalidCredentials ? "is-invalid" : null)"
+                           placeholder="Passwort eingeben"
+                           @bind="Password"
+                           @bind:event="oninput"
+                           @onkeydown="OnKeyDownAsync"
+                           disabled="@IsLoading"
+                           autocomplete="current-password" />
+                    <button type="button"
+                            class="btn btn-outline-secondary border-start-0"
+                            style="border-left: none;"
+                            tabindex="-1"
+                            @onclick="() => ShowPassword = !ShowPassword">
+                        @if (ShowPassword) {
+                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">
+                                <path d="M13.359 11.238C15.06 9.72 16 8 16 8s-3-5.5-8-5.5a7.028 7.028 0 0 0-2.79.588l.77.771A5.944 5.944 0 0 1 8 3.5c2.12 0 3.879 1.168 5.168 2.457A13.134 13.134 0 0 1 14.828 8c-.058.087-.122.183-.195.288-.335.48-.83 1.12-1.465 1.755-.165.165-.337.328-.517.486l.708.709z"/>
+                                <path d="M11.297 9.176a3.5 3.5 0 0 0-4.474-4.474l.823.823a2.5 2.5 0 0 1 2.829 2.829l.822.822zm-2.943 1.299.822.822a3.5 3.5 0 0 1-4.474-4.474l.823.823a2.5 2.5 0 0 0 2.829 2.829z"/>
+                                <path d="M3.35 5.47c-.18.16-.353.322-.518.487A13.134 13.134 0 0 0 1.172 8l.195.288c.335.48.83 1.12 1.465 1.755C4.121 11.332 5.881 12.5 8 12.5c.716 0 1.39-.133 2.02-.36l.77.772A7.029 7.029 0 0 1 8 13.5C3 13.5 0 8 0 8s.939-1.721 2.641-3.238l.708.709z"/>
+                                <path fill-rule="evenodd" d="M13.646 14.354l-12-12 .708-.708 12 12-.708.708z"/>
+                            </svg>
+                        } else {
+                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">
+                                <path d="M16 8s-3-5.5-8-5.5S0 8 0 8s3 5.5 8 5.5S16 8 16 8zM1.173 8a13.133 13.133 0 0 1 1.66-2.043C4.12 4.668 5.88 3.5 8 3.5c2.12 0 3.879 1.168 5.168 2.457A13.133 13.133 0 0 1 14.828 8c-.058.087-.122.183-.195.288-.335.48-.83 1.12-1.465 1.755C11.879 11.332 10.119 12.5 8 12.5c-2.12 0-3.879-1.168-5.168-2.457A13.134 13.134 0 0 1 1.172 8z"/>
+                                <path d="M8 5.5a2.5 2.5 0 1 0 0 5 2.5 2.5 0 0 0 0-5zM4.5 8a3.5 3.5 0 1 1 7 0 3.5 3.5 0 0 1-7 0z"/>
+                            </svg>
+                        }
+                    </button>
+                </div>
+            </div>
+
+            <button class="btn btn-primary w-100 py-2 fw-medium"
+                    style="background: linear-gradient(135deg, #2c3e50 0%, #3498db 100%); border: none;"
+                    @onclick="SubmitAsync"
+                    disabled="@(IsLoading || string.IsNullOrWhiteSpace(Username) || string.IsNullOrWhiteSpace(Password))">
+                @if (IsLoading) {
+                    <span class="spinner-border spinner-border-sm me-2" role="status" aria-hidden="true"></span>
+                    <span>Anmelden …</span>
+                } else {
+                    <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="me-2" viewBox="0 0 16 16">
+                        <path fill-rule="evenodd" d="M10 3.5a.5.5 0 0 0-.5-.5h-8a.5.5 0 0 0-.5.5v9a.5.5 0 0 0 .5.5h8a.5.5 0 0 0 .5-.5v-2a.5.5 0 0 1 1 0v2A1.5 1.5 0 0 1 9.5 14h-8A1.5 1.5 0 0 1 0 12.5v-9A1.5 1.5 0 0 1 1.5 2h8A1.5 1.5 0 0 1 11 3.5v2a.5.5 0 0 1-1 0v-2z"/>
+                        <path fill-rule="evenodd" d="M4.146 8.354a.5.5 0 0 1 0-.708l3-3a.5.5 0 1 1 .708.708L5.707 7.5H14.5a.5.5 0 0 1 0 1H5.707l2.147 2.146a.5.5 0 0 1-.708.708l-3-3z"/>
+                    </svg>
+                    <span>Anmelden</span>
+                }
+            </button>
+
+        </div>
+
+        <div class="card-footer text-center text-muted py-3 border-0 bg-transparent" style="font-size: 0.78rem;">
+            Bei Problemen wenden Sie sich bitte an den Administrator.
+        </div>
+
+    </div>
+</div>
+
+@code {
+    string Username = string.Empty;
+    string Password = string.Empty;
+    bool ShowPassword;
+    bool IsLoading;
+    SenderLoginResult? LoginResult;
+
+    async Task OnKeyDownAsync(Microsoft.AspNetCore.Components.Web.KeyboardEventArgs e) {
+        if (e.Key == "Enter")
+            await SubmitAsync();
+    }
+
+    async Task SubmitAsync() {
+        if (string.IsNullOrWhiteSpace(Username) || string.IsNullOrWhiteSpace(Password) || IsLoading) return;
+
+        IsLoading = true;
+        LoginResult = null;
+        await InvokeAsync(StateHasChanged);
+
+        var result = await AuthService.LoginSenderAsync(Username.Trim(), Password.Trim());
+
+        if (result == SenderLoginResult.Success) {
+            Navigation.NavigateTo("/sender", forceLoad: true);
+            return;
+        }
+
+        LoginResult = result;
+        IsLoading = false;
+        await InvokeAsync(StateHasChanged);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/PredefinedReports/Report.resx

@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <metadata name="objectDataSource1.TrayLocation" type="System.Drawing.Point, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+    <value>17, 17</value>
+  </metadata>
+</root>

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/PredefinedReports/ReportsFactory.cs

@@ -0,0 +1,14 @@
+using DevExpress.XtraReports.UI;
+
+namespace EnvelopeGenerator.Server.Client.PredefinedReports {
+    public static class ReportsFactory
+    {
+        public static readonly Dictionary<string, Func<XtraReport>> Reports = new() {
+            ["LargeDatasetReport"] = () => new PredefinedReports.Report()
+        };
+
+        public static XtraReport GetReport(string reportName) {
+            return Reports[reportName]();
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Program.cs

@@ -0,0 +1,60 @@
+using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
+using EnvelopeGenerator.Server.Client.Services;
+using EnvelopeGenerator.Server.Client.Options;
+using DevExpress.Blazor.Reporting;
+using DevExpress.XtraReports.Web.Extensions;
+using DevExpress.DataAccess.Web;
+using DevExpress.XtraReports.Services;
+
+var builder = WebAssemblyHostBuilder.CreateDefault(args);
+
+// Named HttpClient for API calls (both for services and DevExpress components)
+builder.Services.AddHttpClient("EnvelopeGenerator.Server", client =>
+{
+    client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress);
+});
+
+// Default HttpClient (DevExpress PdfViewer requires this)
+builder.Services.AddScoped(sp => new HttpClient 
+{ 
+    BaseAddress = new Uri(builder.HostEnvironment.BaseAddress) 
+});
+
+// Configuration Options
+builder.Services.Configure<PdfViewerOptions>(opts =>
+    builder.Configuration.GetSection(PdfViewerOptions.SectionName).Bind(opts));
+
+// Business Services
+builder.Services.AddScoped<DocumentService>();
+builder.Services.AddScoped<AuthService>();
+builder.Services.AddScoped<AnnotationService>();
+builder.Services.AddScoped<EnvelopeReceiverService>();
+builder.Services.AddScoped<SignatureService>();
+builder.Services.AddScoped<SignatureCacheService>();
+builder.Services.AddSingleton<AppVersionService>();
+
+// DevExpress WASM
+builder.Services.AddDevExpressWebAssemblyBlazorPdfViewer();
+builder.Services.AddDevExpressWebAssemblyBlazorReportViewer();
+
+builder.Services.AddDevExpressBlazorReportingWebAssembly(configure => {
+    configure.UseDevelopmentMode();
+});
+
+// Reporting Services
+builder.Services.AddScoped<IDataSourceWizardJsonConnectionStorage, CustomDataSourceWizardJsonDataConnectionStorage>();
+builder.Services.AddScoped<IJsonDataConnectionProviderFactory, CustomJsonDataConnectionProviderFactory>();
+builder.Services.AddScoped<IObjectDataSourceWizardTypeProvider, ObjectDataSourceWizardCustomTypeProvider>();
+
+DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(EnvelopeGenerator.Server.Client.Data.DataItemList));
+DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(EnvelopeGenerator.Server.Client.PredefinedReports.Report));
+
+builder.Services.AddSingleton<InMemoryReportStorageWebExtension>();
+builder.Services.AddSingleton<ReportStorageWebExtension>(sp => sp.GetRequiredService<InMemoryReportStorageWebExtension>());
+builder.Services.AddScoped<IReportProviderAsync, CustomReportProvider>();
+
+ReportStorageWebExtension.RegisterExtensionGlobal(new InMemoryReportStorageWebExtension());
+
+var host = builder.Build();
+await FontLoader.LoadFonts(host.Services.GetRequiredService<IHttpClientFactory>(), new List<string> { "opensans.ttf" });
+await host.RunAsync();

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Routes.razor

@@ -0,0 +1,6 @@
+<Router AppAssembly="typeof(Program).Assembly">
+    <Found Context="routeData">
+        <RouteView RouteData="routeData" DefaultLayout="typeof(Layout.MainLayout)" />
+        <FocusOnNavigate RouteData="routeData" Selector="h1" />
+    </Found>
+</Router>

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/AnnotationService.cs

@@ -0,0 +1,29 @@
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using EnvelopeGenerator.Server.Client.Models;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+/// <summary>
+/// Retrieves annotation positions from the API.
+/// Uses relative paths (/api/Annotation/{envelopeKey}).
+/// </summary>
+[Obsolete("Use SignatureService.")]
+public class AnnotationService(IHttpClientFactory httpClientFactory)
+{
+    private static readonly JsonSerializerOptions _jsonOptions = new(JsonSerializerDefaults.Web);
+
+    public async Task<IReadOnlyList<AnnotationDto>> GetAnnotationsAsync(string envelopeKey, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var url = $"/api/Annotation/{Uri.EscapeDataString(envelopeKey)}";
+        var response = await http.GetAsync(url, cancel);
+
+        if (!response.IsSuccessStatusCode)
+            return [];
+
+        var result = await response.Content.ReadFromJsonAsync<List<AnnotationDto>>(_jsonOptions, cancel);
+        return result ?? [];
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/AppVersionService.cs

@@ -0,0 +1,26 @@
+namespace EnvelopeGenerator.Server.Client.Services;
+
+/// <summary>
+/// Provides application version for cache busting static assets.
+/// Version is automatically incremented on each build via AssemblyVersion.
+/// </summary>
+public class AppVersionService
+{
+    /// <summary>
+    /// Current application version (e.g., "1.0.0.0")
+    /// </summary>
+    public string Version { get; }
+
+    public AppVersionService()
+    {
+        // Get version from assembly metadata
+        Version = typeof(AppVersionService).Assembly.GetName().Version?.ToString() ?? "1.0.0.0";
+    }
+
+    /// <summary>
+    /// Generates versioned URL for static assets (cache busting)
+    /// </summary>
+    /// <param name="path">Asset path (e.g., "css/envelope-viewer.css")</param>
+    /// <returns>Versioned URL (e.g., "css/envelope-viewer.css?v=1.0.0.0")</returns>
+    public string GetVersionedUrl(string path) => $"{path}?v={Version}";
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/AuthService.cs

@@ -0,0 +1,83 @@
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public enum EnvelopeLoginResult { Success, InvalidCode, NotFound, Error }
+
+public enum SenderLoginResult { Success, InvalidCredentials, Error }
+
+public class AuthService(IHttpClientFactory httpClientFactory)
+{
+
+    /// <summary>
+    /// Checks whether the current user holds a valid receiver token for the given envelope key.
+    /// Calls GET /api/auth/check/envelope/{envelopeKey}.
+    /// </summary>
+    public async Task<bool> CheckEnvelopeAccessAsync(string envelopeKey, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var response = await http.GetAsync($"/api/auth/check/envelope/{Uri.EscapeDataString(envelopeKey)}", cancel);
+        return response.StatusCode == HttpStatusCode.OK;
+    }
+
+    /// <summary>
+    /// Submits the access code for the given envelope key.
+    /// Calls POST /api/Auth/envelope-receiver/{key} with multipart/form-data.
+    /// On success the API sets an authentication cookie automatically.
+    /// </summary>
+    public async Task<EnvelopeLoginResult> LoginEnvelopeReceiverAsync(string envelopeKey, string accessCode, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var form = new MultipartFormDataContent();
+        form.Add(new StringContent(accessCode), "AccessCode");
+
+        var response = await http.PostAsync(
+            $"/api/Auth/envelope-receiver/{Uri.EscapeDataString(envelopeKey)}",
+            form, cancel);
+
+        return response.StatusCode switch
+        {
+            HttpStatusCode.OK => EnvelopeLoginResult.Success,
+            HttpStatusCode.Unauthorized => EnvelopeLoginResult.InvalidCode,
+            HttpStatusCode.NotFound => EnvelopeLoginResult.NotFound,
+            _ => EnvelopeLoginResult.Error
+        };
+    }
+
+    /// <summary>
+    /// Removes the per-envelope receiver cookie for the given envelope key.
+    /// Calls POST /api/auth/logout/envelope/{envelopeKey}.
+    /// </summary>
+    public async Task<bool> LogoutEnvelopeReceiverAsync(string envelopeKey, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var response = await http.PostAsync(
+            $"/api/auth/logout/envelope/{Uri.EscapeDataString(envelopeKey)}",
+            null, cancel);
+        return response.IsSuccessStatusCode;
+    }
+
+    /// <summary>
+    /// Authenticates a sender user with username and password.
+    /// Calls POST /api/auth?cookie=true with JSON body.
+    /// On success the API sets an authentication cookie automatically.
+    /// </summary>
+    public async Task<SenderLoginResult> LoginSenderAsync(string username, string password, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var requestBody = new { username, password };
+
+        var response = await http.PostAsJsonAsync(
+            $"/api/auth?cookie=true",
+            requestBody, cancel);
+
+        return response.StatusCode switch
+        {
+            HttpStatusCode.OK => SenderLoginResult.Success,
+            HttpStatusCode.Unauthorized => SenderLoginResult.InvalidCredentials,
+            _ => SenderLoginResult.Error
+        };
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/CustomDataSourceWizardJsonDataConnectionStorage.cs

@@ -0,0 +1,39 @@
+using DevExpress.DataAccess.Json;
+using DevExpress.DataAccess.Web;
+using DevExpress.DataAccess.Wizard.Services;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class CustomDataSourceWizardJsonDataConnectionStorage : IDataSourceWizardJsonConnectionStorage
+{
+    public static JsonDataConnection GetDefaultConnection() {
+        var uriJsonSource = new UriJsonSource() {
+            Uri = new Uri(@"https://raw.githubusercontent.com/DevExpress-Examples/DataSources/master/JSON/customers.json"),
+        };
+        return new JsonDataConnection(uriJsonSource) { StoreConnectionNameOnly = true, Name = "NWindProductsJson" };
+    }
+    public static List<JsonDataConnection> GetConnections() {
+        var connections = new List<JsonDataConnection> {
+            GetDefaultConnection()
+        };
+        return connections;
+    }
+
+    bool IJsonConnectionStorageService.CanSaveConnection => false;
+    bool IJsonConnectionStorageService.ContainsConnection(string connectionName) {
+        return GetConnections().Any(x => x.Name == connectionName);
+    }
+
+    IEnumerable<JsonDataConnection> IJsonConnectionStorageService.GetConnections() {
+        return GetConnections();
+    }
+
+    JsonDataConnection IJsonDataConnectionProviderService.GetJsonDataConnection(string name) {
+        var connection = GetConnections().FirstOrDefault(x => x.Name == name);
+        if(connection == null)
+            throw new InvalidOperationException();
+        return connection;
+    }
+
+    void IJsonConnectionStorageService.SaveConnection(string connectionName, JsonDataConnection connection, bool saveCredentials) { }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/CustomJsonDataConnectionProviderFactory.cs

@@ -0,0 +1,23 @@
+using DevExpress.DataAccess.Json;
+using DevExpress.DataAccess.Web;
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class CustomJsonDataConnectionProviderFactory : IJsonDataConnectionProviderFactory {
+    public IJsonDataConnectionProviderService Create() {
+        return new WebDocumentViewerJsonDataConnectionProvider(CustomDataSourceWizardJsonDataConnectionStorage.GetConnections());
+    }
+}
+
+public class WebDocumentViewerJsonDataConnectionProvider : IJsonDataConnectionProviderService
+{
+    readonly List<JsonDataConnection> jsonDataConnections;
+    public WebDocumentViewerJsonDataConnectionProvider(List<JsonDataConnection> jsonDataConnections) {
+        this.jsonDataConnections = jsonDataConnections;
+    }
+    public JsonDataConnection GetJsonDataConnection(string name) {
+        var connection = jsonDataConnections.FirstOrDefault(x => x.Name == name);
+        if(connection == null)
+            throw new InvalidOperationException();
+        return connection;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/CustomReportProvider.cs

@@ -0,0 +1,20 @@
+using DevExpress.XtraReports.UI;
+using DevExpress.XtraReports.Services;
+using EnvelopeGenerator.Server.Client.PredefinedReports;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class CustomReportProvider : IReportProviderAsync {
+    private readonly InMemoryReportStorageWebExtension reportStorage;
+
+    public CustomReportProvider(InMemoryReportStorageWebExtension reportStorage) {
+        this.reportStorage = reportStorage;
+    }
+
+    public Task<XtraReport> GetReportAsync(string id, ReportProviderContext context) {
+        if(reportStorage.TryGetReport(id, out var savedReport))
+            return Task.FromResult(savedReport);
+
+        return Task.FromResult(ReportsFactory.GetReport(id));
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/DocumentService.cs

@@ -0,0 +1,32 @@
+using System.Net;
+using System.Net.Http;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class DocumentService(IHttpClientFactory httpClientFactory)
+{
+
+    /// <summary>
+    /// Fetches the PDF bytes for the given envelope key from the API.
+    /// Throws HttpRequestException on failure with appropriate status code.
+    /// </summary>
+    /// <exception cref="HttpRequestException">Thrown when the API request fails.</exception>
+    public async Task<byte[]?> GetDocumentAsync(string envelopeKey, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var response = await http.GetAsync($"/api/Document/{Uri.EscapeDataString(envelopeKey)}", cancel);
+
+        if (!response.IsSuccessStatusCode)
+        {
+            var statusCode = (int)response.StatusCode;
+            var reasonPhrase = response.ReasonPhrase ?? "Unknown error";
+            throw new HttpRequestException(
+                $"Failed to load document. Status: {statusCode} ({reasonPhrase})",
+                null,
+                response.StatusCode);
+        }
+
+        var bytes = await response.Content.ReadAsByteArrayAsync(cancel);
+        return bytes;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/EnvelopeReceiverService.cs

@@ -0,0 +1,40 @@
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using EnvelopeGenerator.Server.Client.Models;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+/// <summary>
+/// Retrieves the <see cref="EnvelopeReceiverDto"/> for the authenticated receiver
+/// from <c>GET /api/EnvelopeReceiver/{envelopeKey}</c>.
+/// </summary>
+public class EnvelopeReceiverService(IHttpClientFactory httpClientFactory)
+{
+    private static readonly JsonSerializerOptions _jsonOptions = new(JsonSerializerDefaults.Web);
+
+    /// <summary>
+    /// Fetches the envelope receiver data for the given envelope key from the API.
+    /// Throws HttpRequestException on failure with appropriate status code.
+    /// </summary>
+    /// <exception cref="HttpRequestException">Thrown when the API request fails.</exception>
+    public async Task<EnvelopeReceiverDto?> GetAsync(string envelopeKey, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var url = $"/api/EnvelopeReceiver/{Uri.EscapeDataString(envelopeKey)}";
+        var response = await http.GetAsync(url, cancel);
+
+        if (!response.IsSuccessStatusCode)
+        {
+            var statusCode = (int)response.StatusCode;
+            var reasonPhrase = response.ReasonPhrase ?? "Unknown error";
+            throw new HttpRequestException(
+                $"Failed to load envelope receiver data. Status: {statusCode} ({reasonPhrase})",
+                null,
+                response.StatusCode);
+        }
+
+        return await response.Content.ReadFromJsonAsync<EnvelopeReceiverDto>(_jsonOptions, cancel);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/FontLoader.cs

@@ -0,0 +1,17 @@
+using DevExpress.Drawing;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public static class FontLoader 
+{
+    public static async Task LoadFonts(IHttpClientFactory httpClientFactory, List<string> fontNames) 
+    {
+        using var httpClient = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        
+        foreach (var fontName in fontNames) 
+        {
+            var fontBytes = await httpClient.GetByteArrayAsync($"/fonts/{fontName}");
+            DXFontRepository.Instance.AddFont(fontBytes);
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/InMemoryReportStorageWebExtension.cs

@@ -0,0 +1,83 @@
+using DevExpress.XtraReports.UI;
+using DevExpress.XtraReports.Web.Extensions;
+using EnvelopeGenerator.Server.Client.PredefinedReports;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class InMemoryReportStorageWebExtension : ReportStorageWebExtension
+{
+    private const string DefaultReportName = "LargeDatasetReport";
+    private static readonly Dictionary<string, byte[]> Reports = new(StringComparer.OrdinalIgnoreCase);
+
+    public override bool CanSetData(string url) => IsValidUrl(url);
+
+    public override byte[] GetData(string url)
+    {
+        url = NormalizeUrl(url);
+
+        if (Reports.TryGetValue(url, out var reportLayout))
+            return reportLayout;
+
+        if (ReportsFactory.Reports.TryGetValue(url, out var reportFactory))
+            return SaveReport(reportFactory());
+
+        throw new DevExpress.XtraReports.Web.ClientControls.FaultException($"Report '{url}' was not found.");
+    }
+
+    public override Dictionary<string, string> GetUrls()
+    {
+        var urls = ReportsFactory.Reports.Keys
+            .Concat(Reports.Keys)
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToDictionary(name => name, name => name, StringComparer.OrdinalIgnoreCase);
+
+        return urls;
+    }
+
+    public override bool IsValidUrl(string url)
+    {
+        return !string.IsNullOrWhiteSpace(url)
+            && url.IndexOfAny(Path.GetInvalidFileNameChars()) < 0;
+    }
+
+    public override void SetData(XtraReport report, string url)
+    {
+        url = NormalizeUrl(url);
+        Reports[url] = SaveReport(report);
+    }
+
+    public override string SetNewData(XtraReport report, string defaultUrl)
+    {
+        var url = NormalizeUrl(defaultUrl);
+        Reports[url] = SaveReport(report);
+        return url;
+    }
+
+    public bool TryGetReport(string url, out XtraReport report)
+    {
+        url = NormalizeUrl(url);
+
+        if (!Reports.ContainsKey(url))
+        {
+            report = null!;
+            return false;
+        }
+
+        using var stream = new MemoryStream(Reports[url]);
+        report = XtraReport.FromXmlStream(stream, true);
+        report.Name = url;
+        return true;
+    }
+
+    private static string NormalizeUrl(string url)
+    {
+        return string.IsNullOrWhiteSpace(url) ? DefaultReportName : url;
+    }
+
+    private static byte[] SaveReport(XtraReport report)
+    {
+        using var stream = new MemoryStream();
+        report.SaveLayoutToXml(stream);
+        return stream.ToArray();
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/ObjectDataSourceWizardCustomTypeProvider.cs

@@ -0,0 +1,9 @@
+using DevExpress.DataAccess.Web;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class ObjectDataSourceWizardCustomTypeProvider : IObjectDataSourceWizardTypeProvider {
+    public IEnumerable<Type> GetAvailableTypes(string context) {
+        return new[] { typeof(Data.DataItemList) };
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/SignatureCacheService.cs

@@ -0,0 +1,67 @@
+using System.Net.Http;
+using System.Net.Http.Json;
+using EnvelopeGenerator.Server.Client.Models;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+/// <summary>
+/// Client service for managing cached signatures via API.
+/// </summary>
+public class SignatureCacheService(IHttpClientFactory httpClientFactory)
+{
+
+    public async Task SaveSignatureAsync(
+        string envelopeKey,
+        SignatureCaptureDto signature,
+        CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var response = await http.PostAsJsonAsync(
+            $"/api/Cache/SignatureCapture/{Uri.EscapeDataString(envelopeKey)}",
+            signature,
+            cancel);
+
+        if (!response.IsSuccessStatusCode)
+        {
+            var error = await response.Content.ReadAsStringAsync(cancel);
+            throw new HttpRequestException($"Failed to cache signature: {response.StatusCode} - {error}");
+        }
+    }
+
+    public async Task<SignatureCaptureDto?> GetSignatureAsync(
+        string envelopeKey,
+        CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var response = await http.GetAsync(
+            $"/api/Cache/SignatureCapture/{Uri.EscapeDataString(envelopeKey)}",
+            cancel);
+
+        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+            return null;
+
+        if (!response.IsSuccessStatusCode)
+        {
+            var error = await response.Content.ReadAsStringAsync(cancel);
+            throw new HttpRequestException($"Failed to retrieve signature: {response.StatusCode} - {error}");
+        }
+
+        return await response.Content.ReadFromJsonAsync<SignatureCaptureDto>(cancellationToken: cancel);
+    }
+
+    public async Task DeleteSignatureAsync(
+        string envelopeKey,
+        CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var response = await http.DeleteAsync(
+            $"/api/Cache/SignatureCapture/{Uri.EscapeDataString(envelopeKey)}",
+            cancel);
+
+        if (!response.IsSuccessStatusCode)
+        {
+            var error = await response.Content.ReadAsStringAsync(cancel);
+            throw new HttpRequestException($"Failed to delete signature: {response.StatusCode} - {error}");
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/Services/SignatureService.cs

@@ -0,0 +1,24 @@
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using EnvelopeGenerator.Server.Client.Models;
+
+namespace EnvelopeGenerator.Server.Client.Services;
+
+public class SignatureService(IHttpClientFactory httpClientFactory)
+{
+    private static readonly JsonSerializerOptions _jsonOptions = new(JsonSerializerDefaults.Web);
+
+    public async Task<IReadOnlyList<SignatureDto>> GetAsync(string envelopeKey, CancellationToken cancel = default)
+    {
+        using var http = httpClientFactory.CreateClient("EnvelopeGenerator.Server");
+        var url = $"/api/Signature/{Uri.EscapeDataString(envelopeKey)}";
+        var response = await http.GetAsync(url, cancel);
+
+        if (!response.IsSuccessStatusCode)
+            throw new HttpRequestException($"Failed to retrieve signatures for envelope {envelopeKey}: {response.StatusCode} {response.ReasonPhrase}");
+
+        var result = await response.Content.ReadFromJsonAsync<List<SignatureDto>>(_jsonOptions, cancel);
+        return result ?? [];
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server.Client/_Imports.razor

@@ -0,0 +1,16 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using static Microsoft.AspNetCore.Components.Web.RenderMode
+@using Microsoft.AspNetCore.Components.Web.Virtualization
+@using Microsoft.AspNetCore.Components.WebAssembly.Http
+@using Microsoft.JSInterop
+@using EnvelopeGenerator.Server.Client
+@using EnvelopeGenerator.Server.Client.Services
+@using EnvelopeGenerator.Server.Client.Models
+@using EnvelopeGenerator.Server.Client.Options
+@using DevExpress.Blazor
+@using DevExpress.Blazor.PdfViewer
+@using DevExpress.Blazor.Reporting

EnvelopeGenerator.Server/EnvelopeGenerator.Server/AuthScheme.cs

@@ -0,0 +1,17 @@
+namespace EnvelopeGenerator.Server;
+
+/// <summary>
+/// Authentication scheme names for envelope generator.
+/// </summary>
+public static class AuthScheme
+{
+    /// <summary>
+    /// Scheme name used for per-envelope receiver JWT authentication.
+    /// </summary>
+    public const string Receiver = "EnvelopeGenerator.Server.ReceiverJWT";
+
+    /// <summary>
+    /// Scheme name used for per-envelope sender JWT authentication.
+    /// </summary>
+    public const string Sender = "EnvelopeGenerator.Server.SenderJWT";
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/App.razor

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <base href="/" />
+    <link rel="stylesheet" href="css/bootstrap/bootstrap.min.css" />
+    <link rel="stylesheet" href="css/app.css" />
+    <link rel="stylesheet" href="css/envelope-viewer.css" />
+    <link rel="stylesheet" href="EnvelopeGenerator.Server.styles.css" />
+    <HeadOutlet />
+</head>
+
+<body>
+    <Routes />
+    <script src="_content/DevExpress.Blazor.Resources/js/preload-script.js"></script>
+    <script src="js/typed.umd.js"></script>
+    <script src="js/receiver-signature.js?v=9"></script>
+    <script src="_framework/blazor.web.js"></script>
+</body>
+
+</html>

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/Pages/EnvelopeReceiverPage_DxPdfViewer.razor

@@ -0,0 +1,113 @@
+@page "/envelope/DxPdfViewer"
+@rendermode InteractiveServer
+@using System.IO
+@using System.Reflection
+@using DevExpress.Blazor.PdfViewer
+
+<link href="_content/DevExpress.Blazor.Themes/blazing-berry.bs5.min.css" rel="stylesheet" />
+
+<style>
+    .custom-drop-zone {
+        padding: 0 !important;
+        border-style: dashed;
+        border-width: 2px !important;
+        height: 230px;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
+        background-color: rgba(183, 183, 183, 0.1);
+    }
+
+        .custom-drop-zone.custom-drop-zone-hover {
+            border-style: solid;
+        }
+
+        .custom-drop-zone svg {
+            width: 42px;
+            height: 42px;
+        }
+
+        .custom-drop-zone > *:not(#overviewDemoSelectButton) {
+            pointer-events: none;
+        }
+
+    .pdf-viewer {
+        height: 800px !important;
+        min-height: 800px !important;
+    }
+
+    .pdf-viewer .dxbrv-surface-wrapper,
+    .pdf-viewer .dxbrv-document-surface {
+        height: 100% !important;
+        min-height: 750px !important;
+    }
+
+    .pdf-viewer .dxbrv-report-preview-content {
+        width: auto !important;
+        height: auto !important;
+        min-width: 200px !important;
+        min-height: 200px !important;
+    }
+</style>
+
+<div id="overviewDemoDropZone" class="card custom-drop-zone rounded-3 w-100 m-0">
+    <span class="drop-file-icon mb-3"></span>
+    <span class="drop-file-label">Drag and Drop File Here</span><span class="m-1">or</span>
+    <DxButton Id="overviewDemoSelectButton"
+              CssClass="m-1"
+              RenderStyle="ButtonRenderStyle.Primary"
+              Text="Select File" />
+</div>
+<DxFileInput @ref="fileInput"
+             AcceptedFileTypes="@ALLOWED_FILE_TYPES"
+             AllowedFileExtensions="@ALLOWED_FILE_TYPES"
+             CssClass="w-100"
+             ExternalDropZoneCssSelector="#overviewDemoDropZone"
+             ExternalDropZoneDragOverCssClass="custom-drop-zone-hover"
+             ExternalSelectButtonCssSelector="#overviewDemoSelectButton"
+             FilesUploading="OnFilesUploading"
+             MaxFileSize="2000000">
+</DxFileInput>
+
+@if (DocumentContent != null && DocumentContent.Length > 0)
+{
+    <div class="alert alert-success mt-3">
+        PDF loaded: @DocumentContent.Length bytes
+    </div>
+    <DxPdfViewer CssClass="w-100 pdf-viewer" DocumentContent="@DocumentContent" />
+}
+else
+{
+    <div class="alert alert-info mt-3">
+        Please upload a PDF file to view it.
+    </div>
+}
+
+@code {
+    readonly List<string> ALLOWED_FILE_TYPES = new List<string> { ".pdf" };
+    DxFileInput fileInput;
+    byte[] DocumentContent { get; set; }
+    protected override void OnInitialized()
+    {
+        Assembly assembly = Assembly.GetExecutingAssembly();
+        Stream stream = assembly.GetManifestResourceStream("EnvelopeGenerator.Server.Resources.Invoice.pdf");
+        if (stream != null)
+        {
+            using (stream)
+            using (var binaryReader = new BinaryReader(stream))
+                DocumentContent = binaryReader.ReadBytes((int)stream.Length);
+        }
+    }
+    protected async Task OnFilesUploading(FilesUploadingEventArgs args)
+    {
+        using (MemoryStream stream = new MemoryStream())
+        {
+            IFileInputSelectedFile file = args.Files[0];
+            await file.OpenReadStream(file.Size).CopyToAsync(stream);
+            DocumentContent = stream.ToArray();
+            await InvokeAsync(StateHasChanged);
+        }
+    }
+}
+

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/Pages/EnvelopeReceiverPage_DxReportViewer.razor

@@ -0,0 +1,50 @@
+@page "/envelope/{EnvelopeKey}/DxReportViewer"
+@rendermode InteractiveServer
+@using XtraReport = DevExpress.XtraReports.UI.XtraReport
+@using DevExpress.Blazor.Reporting
+@using Microsoft.Extensions.Options
+@using EnvelopeGenerator.Server.Client.Options
+@using EnvelopeGenerator.Server.Client.Services
+@inject InMemoryReportStorageWebExtension ReportStorage
+@inject DocumentService DocumentService
+@inject IOptions<ApiOptions> AppOptions
+
+<link href="_content/DevExpress.Blazor.Themes/blazing-berry.bs5.min.css" rel="stylesheet" />
+<link href="_content/DevExpress.Blazor.Reporting.Viewer/css/dx-blazor-reporting-components.bs5.css" rel="stylesheet" />
+
+
+@if (_report is not null) {
+    <DxReportViewer Report="_report" RootCssClasses="w-100 h-100" Zoom="1.3" />
+}
+
+@code {
+    [Parameter] public string EnvelopeKey { get; init; } = null!;
+
+    XtraReport? _report = null;
+
+    protected override async Task OnInitializedAsync() 
+    {
+        _report = await CreateReport();
+    }
+
+    async Task<XtraReport> CreateReport()
+    {
+        if (AppOptions.Value.UsePredefinedReports)
+        {
+            return Client.PredefinedReports.ReportsFactory.GetReport("LargeDatasetReport");
+        }
+        else
+        {
+
+            var pdfBytes = await DocumentService.GetDocumentAsync(EnvelopeKey);
+            if (pdfBytes is null || pdfBytes.Length == 0)
+                throw new InvalidOperationException($"No PDF bytes found for EnvelopeKey: {EnvelopeKey}");
+
+            var report = new XtraReport();
+            var detail = new DevExpress.XtraReports.UI.DetailBand();
+            report.Bands.Add(detail);
+            detail.Controls.Add(new DevExpress.XtraReports.UI.XRPdfContent { Source = pdfBytes, GenerateOwnPages = true });
+            return report;
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/Pages/EnvelopeReceiverPage_embed.razor

@@ -0,0 +1,124 @@
+@page "/envelope/Embed"
+@rendermode InteractiveServer
+@using System.IO
+@using DevExpress.Blazor
+@using System.Reflection
+
+<link href="_content/DevExpress.Blazor.Themes/blazing-berry.bs5.min.css" rel="stylesheet" />
+
+<style>
+    .custom-drop-zone {
+        padding: 0 !important;
+        border-style: dashed;
+        border-width: 2px !important;
+        height: 230px;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
+        background-color: rgba(183, 183, 183, 0.1);
+    }
+
+        .custom-drop-zone.custom-drop-zone-hover {
+            border-style: solid;
+        }
+
+        .custom-drop-zone svg {
+            width: 42px;
+            height: 42px;
+        }
+
+        .custom-drop-zone > *:not(#overviewDemoSelectButton) {
+            pointer-events: none;
+        }
+
+    .pdf-viewer {
+        height: 800px !important;
+        min-height: 800px !important;
+    }
+
+    .pdf-viewer .dxbrv-surface-wrapper,
+    .pdf-viewer .dxbrv-document-surface {
+        height: 100% !important;
+        min-height: 750px !important;
+    }
+
+    .pdf-viewer .dxbrv-report-preview-content {
+        width: auto !important;
+        height: auto !important;
+        min-width: 200px !important;
+        min-height: 200px !important;
+    }
+</style>
+
+<div id="overviewDemoDropZone" class="card custom-drop-zone rounded-3 w-100 m-0">
+    <span class="drop-file-icon mb-3"></span>
+    <span class="drop-file-label">Drag and Drop File Here</span><span class="m-1">or</span>
+    <DxButton Id="overviewDemoSelectButton"
+              CssClass="m-1"
+              RenderStyle="ButtonRenderStyle.Primary"
+              Text="Select File" />
+</div>
+<DxFileInput @ref="fileInput"
+             AcceptedFileTypes="@ALLOWED_FILE_TYPES"
+             AllowedFileExtensions="@ALLOWED_FILE_TYPES"
+             CssClass="w-100"
+             ExternalDropZoneCssSelector="#overviewDemoDropZone"
+             ExternalDropZoneDragOverCssClass="custom-drop-zone-hover"
+             ExternalSelectButtonCssSelector="#overviewDemoSelectButton"
+             FilesUploading="OnFilesUploading"
+             MaxFileSize="2000000">
+</DxFileInput>
+
+@if (DocumentContent != null && DocumentContent.Length > 0)
+{
+    <div class="alert alert-success mt-3">
+        PDF loaded: @DocumentContent.Length bytes
+    </div>
+    <embed src="@GetPdfDataUrl()" type="application/pdf" class="w-100 pdf-viewer" />
+}
+else
+{
+    <div class="alert alert-info mt-3">
+        Please upload a PDF file to view it.
+    </div>
+}
+
+@code {
+    readonly List<string> ALLOWED_FILE_TYPES = new List<string> { ".pdf" };
+    DxFileInput fileInput;
+    byte[] DocumentContent { get; set; }
+    
+    protected override void OnInitialized()
+    {
+        Assembly assembly = Assembly.GetExecutingAssembly();
+        Stream stream = assembly.GetManifestResourceStream("EnvelopeGenerator.Server.Resources.Invoice.pdf");
+        if (stream != null)
+        {
+            using (stream)
+            using (var binaryReader = new BinaryReader(stream))
+                DocumentContent = binaryReader.ReadBytes((int)stream.Length);
+        }
+    }
+    
+    protected async Task OnFilesUploading(FilesUploadingEventArgs args)
+    {
+        using (MemoryStream stream = new MemoryStream())
+        {
+            IFileInputSelectedFile file = args.Files[0];
+            await file.OpenReadStream(file.Size).CopyToAsync(stream);
+            DocumentContent = stream.ToArray();
+            await InvokeAsync(StateHasChanged);
+        }
+    }
+    
+    private string GetPdfDataUrl()
+    {
+        if (DocumentContent == null || DocumentContent.Length == 0)
+            return string.Empty;
+        
+        string base64 = Convert.ToBase64String(DocumentContent);
+        return $"data:application/pdf;base64,{base64}#toolbar=0&navpanes=0&scrollbar=1";
+    }
+}
+

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/Pages/Error.razor

@@ -0,0 +1,36 @@
+@page "/Error"
+@using System.Diagnostics
+
+<PageTitle>Error</PageTitle>
+
+<h1 class="text-danger">Error.</h1>
+<h2 class="text-danger">An error occurred while processing your request.</h2>
+
+@if (ShowRequestId)
+{
+    <p>
+        <strong>Request ID:</strong> <code>@RequestId</code>
+    </p>
+}
+
+<h3>Development Mode</h3>
+<p>
+    Swapping to <strong>Development</strong> environment will display more detailed information about the error that occurred.
+</p>
+<p>
+    <strong>The Development environment shouldn't be enabled for deployed applications.</strong>
+    It can result in displaying sensitive information from exceptions to end users.
+    For local debugging, enable the <strong>Development</strong> environment by setting the <strong>ASPNETCORE_ENVIRONMENT</strong> environment variable to <strong>Development</strong>
+    and restarting the app.
+</p>
+
+@code{
+    [CascadingParameter]
+    private HttpContext? HttpContext { get; set; }
+
+    private string? RequestId { get; set; }
+    private bool ShowRequestId => !string.IsNullOrEmpty(RequestId);
+
+    protected override void OnInitialized() =>
+        RequestId = Activity.Current?.Id ?? HttpContext?.TraceIdentifier;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/_Imports.razor

@@ -0,0 +1,12 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using static Microsoft.AspNetCore.Components.Web.RenderMode
+@using Microsoft.AspNetCore.Components.Web.Virtualization
+@using Microsoft.JSInterop
+@using EnvelopeGenerator.Server
+@using EnvelopeGenerator.Server.Client
+@using EnvelopeGenerator.Server.Components
+@using DevExpress.Blazor

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/AnnotationController.cs

@@ -0,0 +1,132 @@
+using DigitalData.Core.Abstraction.Application.DTO;
+using DigitalData.Core.Exceptions;
+using EnvelopeGenerator.Server.Extensions;
+using EnvelopeGenerator.Application.Common.Dto;
+using EnvelopeGenerator.Application.Common.Extensions;
+using EnvelopeGenerator.Application.Common.Interfaces.Services;
+using EnvelopeGenerator.Application.Common.Notifications.DocSigned;
+using EnvelopeGenerator.Application.Common.Notifications.RemoveSignature;
+using EnvelopeGenerator.Application.EnvelopeReceivers.Queries;
+using EnvelopeGenerator.Application.Histories.Queries;
+using EnvelopeGenerator.Domain.Constants;
+using MediatR;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Manages annotations and signature lifecycle for envelopes.
+/// </summary>
+[Authorize(Policy = AuthPolicy.Receiver)]
+[ApiController]
+[Route("api/[controller]")]
+public class AnnotationController : ControllerBase
+{
+    [Obsolete("Use MediatR")]
+    private readonly IEnvelopeHistoryService _historyService;
+
+    [Obsolete("Use MediatR")]
+    private readonly IEnvelopeReceiverService _envelopeReceiverService;
+
+    private readonly IMediator _mediator;
+
+    private readonly ILogger<AnnotationController> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of <see cref="AnnotationController"/>.
+    /// </summary>
+    [Obsolete("Use MediatR")]
+    public AnnotationController(
+        ILogger<AnnotationController> logger,
+        IEnvelopeHistoryService envelopeHistoryService,
+        IEnvelopeReceiverService envelopeReceiverService,
+        IMediator mediator)
+    {
+        _historyService = envelopeHistoryService;
+        _envelopeReceiverService = envelopeReceiverService;
+        _mediator = mediator;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Creates or updates annotations for the authenticated envelope receiver.
+    /// </summary>
+    /// <param name="psPdfKitAnnotation">Annotation payload.</param>
+    /// <param name="cancel">Cancellation token.</param>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpPost]
+    [Obsolete("PSPDF Kit will no longer be used.")]
+    public async Task<IActionResult> CreateOrUpdate([FromBody] PsPdfKitAnnotation? psPdfKitAnnotation = null, CancellationToken cancel = default)
+    {
+        var signature = User.ReceiverSignature();
+        var uuid = User.EnvelopeUuid();
+
+        var envelopeReceiver = await _mediator.ReadEnvelopeReceiverAsync(uuid, signature, cancel).ThrowIfNull(Exceptions.NotFound);
+
+        if (!envelopeReceiver.Envelope!.ReadOnly && psPdfKitAnnotation is null)
+            return BadRequest();
+
+        if (await _mediator.IsSignedAsync(uuid, signature, cancel))
+            return Problem(statusCode: StatusCodes.Status409Conflict);
+        else if (await _mediator.AnyHistoryAsync(uuid, new[] { EnvelopeStatus.EnvelopeRejected, EnvelopeStatus.DocumentRejected }, cancel))
+            return Problem(statusCode: StatusCodes.Status423Locked);
+
+        var envelopeReceiverDto = await _mediator.ReadEnvelopeReceiverAsync(uuid, signature, cancel);
+        var docSignedNotification = envelopeReceiverDto is not null
+            ? new DocSignedNotification { EnvelopeReceiver = envelopeReceiverDto, PsPdfKitAnnotation = psPdfKitAnnotation }
+            : throw new NotFoundException("Envelope receiver is not found.");
+
+        try
+        {
+            await _mediator.Publish(docSignedNotification, cancel);
+        }
+        catch (Exception)
+        {
+            await _mediator.Publish(new RemoveSignatureNotification()
+            {
+                EnvelopeId = docSignedNotification.EnvelopeReceiver.EnvelopeId,
+                ReceiverId = docSignedNotification.EnvelopeReceiver.ReceiverId
+            }, cancel);
+            throw;
+        }
+        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+
+        return Ok();
+    }
+
+    /// <summary>
+    /// Rejects the document for the current receiver.
+    /// </summary>
+    /// <param name="reason">Optional rejection reason.</param>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpPost("reject")]
+    [Obsolete("Use MediatR")]
+    public async Task<IActionResult> Reject([FromBody] string? reason = null)
+    {
+        var signature = User.ReceiverSignature();
+        var uuid = User.EnvelopeUuid();
+        var mail = User.ReceiverMail();
+
+        var envRcvRes = await _envelopeReceiverService.ReadByUuidSignatureAsync(uuid: uuid, signature: signature);
+
+        if (envRcvRes.IsFailed)
+        {
+            _logger.LogNotice(envRcvRes.Notices);
+            return Unauthorized("you are not authorized");
+        }
+
+        var histRes = await _historyService.RecordAsync(envRcvRes.Data.EnvelopeId, userReference: mail, EnvelopeStatus.DocumentRejected, comment: reason);
+        if (histRes.IsSuccess)
+        {
+            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+            return NoContent();
+        }
+
+        _logger.LogEnvelopeError(uuid: uuid, signature: signature, message: "Unexpected error happened in api/envelope/reject");
+        _logger.LogNotice(histRes.Notices);
+        return StatusCode(500, histRes.Messages);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/AuthController.cs

@@ -0,0 +1,117 @@
+using DigitalData.Auth.Claims;
+using EnvelopeGenerator.Server.Controllers.Interfaces;
+using EnvelopeGenerator.Server.Models;
+using EnvelopeGenerator.Domain.Constants;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Controller verantwortlich für die Benutzer-Authentifizierung, einschließlich Anmelden, Abmelden und Überprüfung des Authentifizierungsstatus.
+/// </summary>
+[Route("api/[controller]")]
+[ApiController]
+public partial class AuthController(IOptions<AuthTokenKeys> authTokenKeyOptions, IAuthorizationService authService) : ControllerBase, IAuthController
+{
+    private readonly AuthTokenKeys authTokenKeys = authTokenKeyOptions.Value;
+
+    /// <summary>
+    /// 
+    /// </summary>
+    public IAuthorizationService AuthService { get; } = authService;
+
+    /// <summary>
+    /// Entfernt das Authentifizierungs-Cookie des Benutzers (AuthCookie)
+    /// </summary>
+    /// <returns>
+    /// Gibt eine HTTP 200 oder 401.
+    /// </returns>
+    /// <remarks>
+    /// Sample request:
+    ///
+    ///     POST /api/auth/logout
+    ///
+    /// </remarks>
+    /// <response code="200">Erfolgreich gelöscht, wenn der Benutzer ein berechtigtes Cookie hat.</response>
+    /// <response code="401">Wenn es kein zugelassenes Cookie gibt, wird „nicht zugelassen“ zurückgegeben.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(void), StatusCodes.Status401Unauthorized)]
+    [Authorize(Policy = AuthPolicy.SenderOrReceiver)]
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout()
+    {
+        if (await this.IsUserInPolicyAsync(AuthPolicy.Sender))
+            Response.Cookies.Delete(authTokenKeys.Cookie);
+        else if (await this.IsUserInPolicyAsync(AuthPolicy.ReceiverOrReceiverTFA))
+            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+        else
+            return Unauthorized();
+
+        return Ok();
+    }
+
+    /// <summary>
+    /// Prüft, ob der Benutzer ein autorisiertes Token hat.
+    /// </summary>
+    /// <returns>Wenn ein autorisiertes Token vorhanden ist HTTP 200 asynchron 401</returns>
+    /// <remarks>
+    /// Sample request:
+    ///
+    ///     GET /api/auth
+    ///
+    /// </remarks>
+    /// <response code="200">Wenn es einen autorisierten Cookie gibt.</response>
+    /// <response code="401">Wenn kein Cookie vorhanden ist oder nicht autorisierte.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(void), StatusCodes.Status401Unauthorized)]
+    [HttpGet("check")]
+    [Authorize]
+    public IActionResult Check(string? role = null)
+        => role is not null && !User.IsInRole(role)
+            ? Unauthorized()
+            : Ok();
+
+    /// <summary>
+    /// Checks whether the caller holds a valid per-envelope receiver token for the given envelope key.
+    /// The request must carry a cookie named <c>AuthTokenSignFLOWReceiver.{envelopeKey}</c>.
+    /// </summary>
+    /// <param name="envelopeKey">The unique envelope key extracted from the route.</param>
+    /// <response code="200">Valid per-envelope token found.</response>
+    /// <response code="401">Token is missing, expired or invalid.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(void), StatusCodes.Status401Unauthorized)]
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpGet("check/envelope/{envelopeKey}")]
+    public IActionResult CheckEnvelopeReceiver([FromRoute] string envelopeKey) => Ok();
+
+    /// <summary>
+    /// Removes the per-envelope receiver cookie for the given envelope key.
+    /// </summary>
+    /// <param name="envelopeKey">The unique envelope key whose cookie should be deleted.</param>
+    /// <response code="200">Cookie successfully deleted.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [HttpPost("logout/envelope/{envelopeKey}")]
+    public IActionResult LogoutEnvelopeReceiver([FromRoute] string envelopeKey)
+    {
+        var cookieName = CookieNames.GetEnvelopeReceiverCookieName(authTokenKeys.Cookie, envelopeKey);
+        Response.Cookies.Delete(cookieName);
+        return Ok();
+    }
+
+    /// <summary>
+    /// Removes all per-envelope receiver cookies from the current request.
+    /// </summary>
+    /// <response code="200">All envelope receiver cookies successfully deleted.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [HttpPost("logout/envelope")]
+    public IActionResult LogoutAllEnvelopeReceivers()
+    {
+        foreach (var cookieName in Request.Cookies.Keys.Where(k => CookieNames.IsEnvelopeReceiverCookie(k, authTokenKeys.Cookie)))
+            Response.Cookies.Delete(cookieName);
+        return Ok();
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/CacheController.cs

@@ -0,0 +1,84 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Caching.Distributed;
+using Microsoft.Extensions.Options;
+using System.Text.Json;
+using EnvelopeGenerator.Server.Options;
+using EnvelopeGenerator.Domain.Constants;
+using EnvelopeGenerator.Server.Extensions;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Manages cached data for receivers using distributed cache.
+/// </summary>
+[ApiController]
+[Route("api/[controller]")]
+[Authorize(Policy = AuthPolicy.Receiver)]
+public class CacheController(
+    IDistributedCache cache,
+    IOptions<CacheOptions> cacheOptions) : ControllerBase
+{
+    private const string SignatureCacheKeyPrefix = "envelope-generator.receiver-ui.signature:";
+
+    /// <summary>
+    /// Stores a receiver's signature in cache for the specified envelope.
+    /// </summary>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpPost("SignatureCapture/{envelopeKey}")]
+    public async Task<IActionResult> SaveSignature(
+        [FromRoute] string envelopeKey,
+        [FromBody] SignatureCacheRequest request,
+        CancellationToken cancel)
+    {
+        var cacheKey = $"{SignatureCacheKeyPrefix}{User.ReceiverSignature()}";
+        var json = JsonSerializer.Serialize(request);
+        
+        var options = cacheOptions.Value.SignatureCacheExpiration.HasValue
+            ? new DistributedCacheEntryOptions { AbsoluteExpirationRelativeToNow = cacheOptions.Value.SignatureCacheExpiration.Value }
+            : null;
+
+        await cache.SetStringAsync(cacheKey, json, options ?? new DistributedCacheEntryOptions(), cancel);
+
+        return Ok();
+    }
+
+    /// <summary>
+    /// Retrieves a cached signature for the specified envelope.
+    /// </summary>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpGet("SignatureCapture/{envelopeKey}")]
+    public async Task<IActionResult> GetSignature([FromRoute] string envelopeKey, CancellationToken cancel)
+    {
+        var cacheKey = $"{SignatureCacheKeyPrefix}{User.ReceiverSignature()}";
+        var json = await cache.GetStringAsync(cacheKey, cancel);
+
+        if (json is null)
+            return NotFound();
+
+        var signature = JsonSerializer.Deserialize<SignatureCacheRequest>(json);
+        return Ok(signature);
+    }
+
+    /// <summary>
+    /// Deletes a cached signature for the specified envelope.
+    /// </summary>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpDelete("SignatureCapture/{envelopeKey}")]
+    public async Task<IActionResult> DeleteSignature([FromRoute] string envelopeKey, CancellationToken cancel)
+    {
+        var cacheKey = $"{SignatureCacheKeyPrefix}{User.ReceiverSignature()}";
+        await cache.RemoveAsync(cacheKey, cancel);
+
+        return Ok();
+    }
+}
+
+/// <summary>
+/// Request model for caching signature data.
+/// </summary>
+public sealed record SignatureCacheRequest(
+    string DataUrl,
+    string FullName,
+    string Place,
+    string? Position = null);

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/ConfigController.cs

@@ -0,0 +1,30 @@
+using EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Exposes configuration data required by the client applications.
+/// </summary>
+/// <remarks>
+/// Initializes a new instance of <see cref="ConfigController"/>.
+/// </remarks>
+[Route("api/[controller]")]
+[ApiController]
+[Authorize]
+public class ConfigController(IOptionsMonitor<AnnotationParams> annotationParamsOptions) : ControllerBase
+{
+    private readonly AnnotationParams _annotationParams = annotationParamsOptions.CurrentValue;
+
+    /// <summary>
+    /// Returns annotation configuration that was previously rendered by MVC.
+    /// </summary>
+    [HttpGet("Annotations")]
+    [Obsolete("PSPDF Kit will no longer be used.")]
+    public IActionResult GetAnnotationParams()
+    {
+        return Ok(_annotationParams.AnnotationJSObject);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/DocumentController.cs

@@ -0,0 +1,84 @@
+using DigitalData.Auth.Claims;
+using EnvelopeGenerator.Server.Controllers.Interfaces;
+using EnvelopeGenerator.Server.Extensions;
+using EnvelopeGenerator.Application.Documents.Queries;
+using EnvelopeGenerator.Domain.Constants;
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Provides access to envelope documents for authenticated receivers.
+/// </summary>
+/// <remarks>
+/// Initializes a new instance of the <see cref="DocumentController"/> class.
+/// </remarks>
+[ApiController]
+[Route("api/[controller]")]
+public class DocumentController(IMediator mediator, IAuthorizationService authService, ILogger<DocumentController> logger) : ControllerBase, IAuthController
+{
+    /// <summary>
+    /// 
+    /// </summary>
+    public IAuthorizationService AuthService => authService;
+
+    /// <summary>
+    /// Returns the document bytes receiver.
+    /// </summary>
+    /// <param name="query">Encoded envelope key.</param>
+    /// <param name="cancel">Cancellation token.</param>
+    [HttpGet]
+    [Authorize(Policy = AuthPolicy.SenderOrReceiver)]
+    public async Task<IActionResult> GetDocument(CancellationToken cancel, [FromQuery] ReadDocumentQuery? query = null)
+    {
+        // Sender: expects query with envelope key
+        if (await this.IsUserInPolicyAsync(AuthPolicy.Sender))
+        {
+            if (query is null)
+                return BadRequest("Missing document query.");
+
+            var senderDoc = await mediator.Send(query, cancel);
+            return senderDoc.ByteData is byte[] senderDocByte
+                ? File(senderDocByte, "application/octet-stream")
+                : NotFound("Document is empty.");
+        }
+
+        // Receiver: resolve envelope id from claims
+        if (await this.IsUserInPolicyAsync(AuthPolicy.Receiver))
+        {           
+            if (query is not null)
+                return BadRequest("Query parameters are not allowed for receiver role.");
+
+            var envelopeId = User.EnvelopeId();
+            var receiverDoc = await mediator.Send(new ReadDocumentQuery { EnvelopeId = envelopeId }, cancel);
+            return receiverDoc.ByteData is byte[] receiverDocByte
+                ? File(receiverDocByte, "application/octet-stream")
+                : NotFound("Document is empty.");
+        }
+
+        return Unauthorized();
+    }
+
+    /// <summary>
+    /// Gets the document for the specified envelope key.
+    /// </summary>
+    /// <param name="envelopeKey"></param>
+    /// <param name="cancel"></param>
+    /// <returns></returns>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpGet("{envelopeKey}")]
+    public async Task<IActionResult> GetDocumentOfReceiver(string envelopeKey, CancellationToken cancel)
+    {
+        int envelopeId = User.EnvelopeId();
+
+        var senderDoc = await mediator.Send(new ReadDocumentQuery() { EnvelopeId = envelopeId }, cancel);
+
+        if (senderDoc.ByteData is not byte[] senderDocByte)
+            return NotFound("Document is empty.");
+
+        Response.Headers.ContentDisposition = $"inline; filename=\"{envelopeKey}.pdf\"";
+        return File(senderDocByte, "application/pdf");
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/EmailTemplateController.cs

@@ -0,0 +1,69 @@
+using AutoMapper;
+using EnvelopeGenerator.Application.EmailTemplates.Commands;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using MediatR;
+using EnvelopeGenerator.Application.Common.Dto;
+using DigitalData.Core.Abstraction.Application.Repository;
+using EnvelopeGenerator.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+using EnvelopeGenerator.Domain.Constants;
+using EnvelopeGenerator.Application.EmailTemplates.Queries;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Controller for managing temp templates.
+/// Steuerung zur Verwaltung von E-Mail-Vorlagen.
+/// </summary>
+/// <remarks>
+/// Initialisiert eine neue Instanz der <see cref="EmailTemplateController"/>-Klasse.
+/// </remarks>
+/// <param name="mediator">
+/// Die Mediator-Instanz, die zum Senden von Befehlen und Abfragen verwendet wird.
+/// </param>
+[Route("api/[controller]")]
+[ApiController]
+[Authorize(Policy = AuthPolicy.Sender)]
+public class EmailTemplateController(IMediator mediator) : ControllerBase
+{
+    /// <summary>
+    /// Ruft E-Mail-Vorlagen basierend auf der angegebenen Abfrage ab.
+    /// Gibt alles zurück, wenn keine Id- oder Typ-Informationen eingegeben wurden.
+    /// </summary>
+    /// <param name="emailTemplate">Die Abfrageparameter zum Abrufen von E-Mail-Vorlagen.</param>
+    /// <param name="cancel"></param>
+    /// <returns>Gibt HTTP-Antwort zurück</returns>
+    /// <remarks>
+    /// Sample request:
+    /// GET /api/EmailTemplate?emailTemplateId=123
+    /// </remarks>
+    /// <response code="200">Wenn die E-Mail-Vorlagen erfolgreich abgerufen werden.</response>
+    /// <response code="400">Wenn die Abfrageparameter ungültig sind.</response>
+    /// <response code="401">Wenn der Benutzer nicht authentifiziert ist.</response>
+    /// <response code="404">Wenn die gesuchte Abfrage nicht gefunden wird.</response>
+    [HttpGet]
+    public async Task<IActionResult> Get([FromQuery] ReadEmailTemplateQuery emailTemplate, CancellationToken cancel)
+    {
+        var result = await mediator.Send(emailTemplate, cancel);
+        return Ok(result);
+    }
+
+    /// <summary>
+    /// Updates an temp template or resets it if no update command is provided.
+    /// Aktualisiert eine E-Mail-Vorlage oder setzt sie zurück, wenn kein Aktualisierungsbefehl angegeben ist.
+    /// </summary>
+    /// <param name="update"></param>
+    /// <param name="cancel"></param>
+    /// <returns></returns>
+    /// <response code="200">Wenn die E-Mail-Vorlage erfolgreich aktualisiert oder zurückgesetzt wird.</response>
+    /// <response code="400">Wenn die Abfrage ohne einen String gesendet wird.</response>
+    /// <response code="401">Wenn der Benutzer nicht authentifiziert ist.</response>
+    /// <response code="404">Wenn die gesuchte Abfrage nicht gefunden wird.</response>
+    [HttpPut]
+    public async Task<IActionResult> Update([FromBody] UpdateEmailTemplateCommand update, CancellationToken cancel)
+    {
+        await mediator.Send(update, cancel);
+        return Ok();
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/EnvelopeController.cs

@@ -0,0 +1,111 @@
+using EnvelopeGenerator.Server.Extensions;
+using EnvelopeGenerator.Application.Envelopes.Commands;
+using EnvelopeGenerator.Application.Envelopes.Queries;
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Newtonsoft.Json;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Dieser Controller stellt Endpunkte für die Verwaltung von Umschlägen bereit.
+/// </summary>
+/// <remarks>
+/// Die API ermöglicht das Abrufen und Verwalten von Umschlägen basierend auf Benutzerinformationen und Statusfiltern.
+/// 
+/// Mögliche Antworten:
+/// - 200 OK: Die Anfrage war erfolgreich, und die angeforderten Daten werden zurückgegeben.
+/// - 400 Bad Request: Die Anfrage war fehlerhaft oder unvollständig.
+/// - 401 Unauthorized: Der Benutzer ist nicht authentifiziert.
+/// - 403 Forbidden: Der Benutzer hat keine Berechtigung, auf die Ressource zuzugreifen.
+/// - 404 Not Found: Die angeforderte Ressource wurde nicht gefunden.
+/// - 500 Internal Server Error: Ein unerwarteter Fehler ist aufgetreten.
+/// </remarks>
+[Route("api/[controller]")]
+[ApiController]
+[Authorize]
+public class EnvelopeController : ControllerBase
+{
+    private readonly ILogger<EnvelopeController> _logger;
+    private readonly IMediator _mediator;
+
+    /// <summary>
+    /// Erstellt eine neue Instanz des EnvelopeControllers.
+    /// </summary>
+    /// <param name="logger">Der Logger, der für das Protokollieren von Informationen verwendet wird.</param>
+    /// <param name="mediator"></param>
+    public EnvelopeController(ILogger<EnvelopeController> logger, IMediator mediator)
+    {
+        _logger = logger;
+        _mediator = mediator;
+    }
+
+    /// <summary>
+    /// Ruft eine Liste von Umschlägen basierend auf dem Benutzer und den angegebenen Statusfiltern ab.
+    /// </summary>
+    /// <param name="envelope"></param>
+    /// <returns>Eine IActionResult-Instanz, die die abgerufenen Umschläge oder einen Fehlerstatus enthält.</returns>
+    /// <response code="200">Die Anfrage war erfolgreich, und die Umschläge werden zurückgegeben.</response>
+    /// <response code="400">Die Anfrage war fehlerhaft oder unvollständig.</response>
+    /// <response code="401">Der Benutzer ist nicht authentifiziert.</response>
+    /// <response code="403">Der Benutzer hat keine Berechtigung, auf die Ressource zuzugreifen.</response>
+    /// <response code="500">Ein unerwarteter Fehler ist aufgetreten.</response>
+    [Authorize(AuthenticationSchemes = AuthScheme.Sender)]
+    [HttpGet]
+    public async Task<IActionResult> GetAsync([FromQuery] ReadEnvelopeQuery envelope)
+    {
+        var result = await _mediator.Send(envelope.Authorize(User.GetId()));
+        return result.Any() ? Ok(result) : NotFound();
+    }
+
+    /// <summary>
+    /// Ruft das Ergebnis eines Dokuments basierend auf der ID ab.
+    /// </summary>
+    /// <param name="query"></param>
+    /// <param name="view">Gibt an, ob das Dokument inline angezeigt werden soll (true) oder als Download bereitgestellt wird (false).</param>
+    /// <returns>Eine IActionResult-Instanz, die das Dokument oder einen Fehlerstatus enthält.</returns>
+    /// <response code="200">Das Dokument wurde erfolgreich abgerufen.</response>
+    /// <response code="404">Das Dokument wurde nicht gefunden oder ist nicht verfügbar.</response>
+    /// <response code="500">Ein unerwarteter Fehler ist aufgetreten.</response>
+    [HttpGet("doc-result")]
+    public async Task<IActionResult> GetDocResultAsync([FromQuery] ReadEnvelopeQuery query, [FromQuery] bool view = false)
+    {
+        var envelopes = await _mediator.Send(query.Authorize(User.GetId()));
+        var envelope = envelopes.FirstOrDefault();
+
+        if (envelope is null)
+            return NotFound("Envelope not available.");
+        if (envelope.DocResult is null)
+            return NotFound("The document has not been fully signed or the result has not yet been released.");
+
+        if (view)
+        {
+            Response.Headers.Append("Content-Disposition", "inline; filename=\"" + envelope.Uuid + ".pdf\"");
+            return File(envelope.DocResult, "application/pdf");
+        }
+
+        return File(envelope.DocResult, "application/pdf", $"{envelope.Uuid}.pdf");
+    }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="command"></param>
+    /// <returns></returns>
+    [NonAction]
+    [Authorize]
+    [HttpPost]
+    public async Task<IActionResult> CreateAsync([FromBody] CreateEnvelopeCommand command)
+    {
+        var res = await _mediator.Send(command.WithAuth(User.GetId()));
+
+        if (res is null)
+        {
+            _logger.LogError("Failed to create envelope. Envelope details: {EnvelopeDetails}", JsonConvert.SerializeObject(command));
+            return StatusCode(StatusCodes.Status500InternalServerError);
+        }
+        else
+            return Ok(res);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/EnvelopeReceiverController.cs

@@ -0,0 +1,275 @@
+using AutoMapper;
+using EnvelopeGenerator.Application.EnvelopeReceivers.Commands;
+using EnvelopeGenerator.Application.EnvelopeReceivers.Queries;
+using EnvelopeGenerator.Application.Envelopes.Queries;
+using EnvelopeGenerator.Domain.Entities;
+using EnvelopeGenerator.Server.Models;
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Options;
+using System.Data;
+using EnvelopeGenerator.Application.Common.SQL;
+using EnvelopeGenerator.Application.Common.Dto.Receiver;
+using EnvelopeGenerator.Application.Common.Interfaces.SQLExecutor;
+using EnvelopeGenerator.Server.Extensions;
+using EnvelopeGenerator.Domain.Constants;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Controller für die Verwaltung von Umschlagempfängern.
+/// </summary>
+/// <remarks>
+/// Dieser Controller bietet Endpunkte für das Abrufen und Verwalten von Umschlagempfängerdaten.
+/// </remarks>
+[Route("api/[controller]")]
+[Authorize]
+[ApiController]
+public class EnvelopeReceiverController : ControllerBase
+{
+    private readonly ILogger<EnvelopeReceiverController> _logger;
+    private readonly IMediator _mediator;
+    private readonly IMapper _mapper;
+    private readonly IEnvelopeExecutor _envelopeExecutor;
+    private readonly IEnvelopeReceiverExecutor _erExecutor;
+    private readonly IDocumentExecutor _documentExecutor;
+    private readonly string _cnnStr;
+
+    /// <summary>
+    /// Konstruktor für den EnvelopeReceiverController.
+    /// </summary>
+    public EnvelopeReceiverController(ILogger<EnvelopeReceiverController> logger, IMediator mediator, IMapper mapper, IEnvelopeExecutor envelopeExecutor, IEnvelopeReceiverExecutor erExecutor, IDocumentExecutor documentExecutor, IOptions<ConnectionString> csOpt)
+    {
+        _logger = logger;
+        _mediator = mediator;
+        _mapper = mapper;
+        _envelopeExecutor = envelopeExecutor;
+        _erExecutor = erExecutor;
+        _documentExecutor = documentExecutor;
+        _cnnStr = csOpt.Value.Value;
+    }
+
+    /// <summary>
+    /// Ruft eine Liste von Umschlagempfängern basierend auf den angegebenen Abfrageparametern ab.
+    /// </summary>
+    /// <param name="envelopeReceiver">Die Abfrageparameter für die Filterung von Umschlagempfängern.</param>
+    /// <returns>Eine HTTP-Antwort mit der Liste der gefundenen Umschlagempfänger oder einem Fehlerstatus.</returns>
+    /// <remarks>
+    /// Dieser Endpunkt ermöglicht es, Umschlagempfänger basierend auf dem Benutzernamen und optionalen Statusfiltern abzurufen.
+    /// Wenn der Benutzername nicht ermittelt werden kann, wird ein Serverfehler zurückgegeben.
+    /// </remarks>
+    /// <response code="200">Die Liste der Umschlagempfänger wurde erfolgreich abgerufen.</response>
+    /// <response code="401">Wenn kein autorisierter Token vorhanden ist</response>
+    /// <response code="500">Ein unerwarteter Fehler ist aufgetreten.</response>
+    [Authorize]
+    [HttpGet]
+    public async Task<IActionResult> GetEnvelopeReceiver([FromQuery] ReadEnvelopeReceiverQuery envelopeReceiver)
+    {
+        envelopeReceiver = envelopeReceiver with { Username = User.GetUsername() };
+
+        var result = await _mediator.Send(envelopeReceiver);
+
+        return Ok(result);
+    }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="envelopeKey"></param>
+    /// <param name="cancel"></param>
+    /// <returns></returns>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpGet("{envelopeKey}")]
+    public async Task<IActionResult> GetEnvelopeReceiverOfReceiver([FromRoute] string envelopeKey, CancellationToken cancel)
+    {
+        var er = await _mediator.Send(new ReadEnvelopeReceiverQuery()
+        {
+            Key = envelopeKey
+        }, cancel);
+
+        return Ok(er.SingleOrDefault());
+    }
+
+    /// <summary>
+    /// Ruft den Namen des zuletzt verwendeten Empfängers basierend auf der angegebenen E-Mail-Adresse ab.
+    /// </summary>
+    /// <param name="receiver">Abfrage, bei der nur eine der Angaben ID, Signatur oder E-Mail-Adresse des Empfängers eingegeben werden muss.</param>
+    /// <returns>Eine HTTP-Antwort mit dem Namen des Empfängers oder einem Fehlerstatus.</returns>
+    /// <remarks>
+    /// Dieser Endpunkt ermöglicht es, den Namen des zuletzt verwendeten Empfängers basierend auf der E-Mail-Adresse abzurufen.
+    /// </remarks>
+    /// <response code="200">Der Name des Empfängers wurde erfolgreich abgerufen.</response>
+    /// <response code="401">Wenn kein autorisierter Token vorhanden ist</response>
+    /// <response code="404">Kein Empfänger gefunden.</response>
+    /// <response code="500">Ein unerwarteter Fehler ist aufgetreten.</response>
+    [Authorize]
+    [HttpGet("salute")]
+    public async Task<IActionResult> GetReceiverName([FromQuery] ReadReceiverNameQuery receiver)
+    {
+        var name = await _mediator.Send(receiver);
+        return name is null ? NotFound() : Ok(name);
+    }
+
+    /// <summary>
+    /// Datenübertragungsobjekt mit Informationen zu Umschlägen, Empfängern und Unterschriften.
+    /// </summary>
+    /// <param name="request"></param>
+    /// <param name="cancel"></param>
+    /// <returns>HTTP-Antwort</returns>
+    /// <remarks>
+    /// Sample request:
+    ///
+    ///     POST /api/envelope
+    ///     {
+    ///        "title": "Vertragsdokument",
+    ///        "message": "Bitte unterschreiben Sie dieses Dokument.",
+    ///        "document": {
+    ///            "dataAsBase64": "dGVzdC1iYXNlNjQtZGF0YQ=="  
+    ///        },
+    ///        "receivers": [
+    ///            {
+    ///                "emailAddress": "example@example.com",
+    ///                "signatures": [
+    ///                    {
+    ///                        "x": 100,
+    ///                        "y": 200,
+    ///                        "page": 1
+    ///                    }
+    ///                ],
+    ///                "name": "Max Mustermann",
+    ///                "phoneNumber": "+49123456789"
+    ///            }
+    ///        ],
+    ///        "tfaEnabled": false
+    ///     }
+    ///
+    /// </remarks>
+    /// <response code="202">Envelope-Erstellung und Sendeprozessbefehl erfolgreich</response>
+    /// <response code="400">Wenn ein Fehler im HTTP-Body auftritt</response>
+    /// <response code="401">Wenn kein autorisierter Token vorhanden ist</response>
+    /// <response code="500">Es handelt sich um einen unerwarteten Fehler. Die Protokolle sollten überprüft werden.</response>
+    [Authorize]
+    [HttpPost]
+    public async Task<IActionResult> CreateAsync([FromBody] CreateEnvelopeReceiverCommand request, CancellationToken cancel)
+    {
+        #region Create Envelope
+        var envelope = await _envelopeExecutor.CreateEnvelopeAsync(User.GetId(), request.Title, request.Message, request.TFAEnabled, cancel);
+        #endregion
+
+        #region Add receivers
+        List<EnvelopeReceiver> sentReceivers = new();
+        List<ReceiverGetOrCreateCommand> unsentReceivers = new();
+
+        foreach (var receiver in request.Receivers)
+        {
+            var envelopeReceiver = await _erExecutor.AddEnvelopeReceiverAsync(envelope.Uuid, receiver.EmailAddress, receiver.Salution, receiver.PhoneNumber, cancel);
+
+            if (envelopeReceiver is null)
+                unsentReceivers.Add(receiver);
+            else
+                sentReceivers.Add(envelopeReceiver);
+        }
+
+        var res = _mapper.Map<CreateEnvelopeReceiverResponse>(envelope);
+        res.UnsentReceivers = unsentReceivers;
+        res.SentReceiver = _mapper.Map<List<ReceiverDto>>(sentReceivers.Select(er => er.Receiver));
+        #endregion
+
+        #region Add document
+        var document = await _documentExecutor.CreateDocumentAsync(request.Document.DataAsBase64, envelope.Uuid, cancel);
+
+        if (document is null)
+            return StatusCode(StatusCodes.Status500InternalServerError, "Document creation is failed.");
+        #endregion
+
+        #region Add document element
+        // @DOC_ID, @RECEIVER_ID, @POSITION_X, @POSITION_Y, @PAGE
+        string sql = @"
+                DECLARE @OUT_SUCCESS bit;
+
+                EXEC [dbo].[PRSIG_API_ADD_DOC_RECEIVER_ELEM]
+                    {0},
+                    {1},
+                    {2},
+                    {3},
+                    {4},
+                    @OUT_SUCCESS OUTPUT;
+
+                SELECT @OUT_SUCCESS as [@OUT_SUCCESS];";
+
+        foreach (var rcv in res.SentReceiver)
+            foreach (var sign in request.Receivers.Where(r => r.EmailAddress == rcv.EmailAddress).FirstOrDefault()?.DocReceiverElements ?? Enumerable.Empty<Application.EnvelopeReceivers.Commands.DocReceiverElementCreateDto>())
+            {
+                using SqlConnection conn = new(_cnnStr);
+                conn.Open();
+
+                var formattedSQL = string.Format(sql, document.Id.ToSqlParam(), rcv.Id.ToSqlParam(), sign.X.ToSqlParam(), sign.Y.ToSqlParam(), sign.Page.ToSqlParam());
+
+                using SqlCommand cmd = new(formattedSQL, conn);
+                cmd.CommandType = CommandType.Text;
+
+                using SqlDataReader reader = cmd.ExecuteReader();
+                if (reader.Read())
+                {
+                    bool outSuccess = reader.GetBoolean(0);
+                }
+            }
+        #endregion
+
+        #region Create history
+        // ENV_UID, STATUS_ID, USER_ID,
+        string sql_hist = @"
+                USE [DD_ECM]
+
+                DECLARE @OUT_SUCCESS bit;
+
+                EXEC [dbo].[PRSIG_API_ADD_HISTORY_STATE]
+                    {0},
+                    {1},
+                    {2},
+                    @OUT_SUCCESS OUTPUT;
+
+                SELECT @OUT_SUCCESS as [@OUT_SUCCESS];";
+
+        using (SqlConnection conn = new(_cnnStr))
+        {
+            conn.Open();
+            var formattedSQL_hist = string.Format(sql_hist, envelope.Uuid.ToSqlParam(), 1003.ToSqlParam(), User.GetId().ToSqlParam());
+            using SqlCommand cmd = new(formattedSQL_hist, conn);
+            cmd.CommandType = CommandType.Text;
+
+            using SqlDataReader reader = cmd.ExecuteReader();
+            if (reader.Read())
+            {
+                bool outSuccess = reader.GetBoolean(0);
+            }
+        }
+        #endregion
+
+        return Ok(res);
+    }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="input"></param>
+    /// <returns></returns>
+    public static bool IsBase64String(string input)
+    {
+        if (string.IsNullOrWhiteSpace(input))
+            return false;
+
+        try
+        {
+            Convert.FromBase64String(input);
+            return true;
+        }
+        catch (FormatException)
+        {
+            return false;
+        }
+    }
+
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/EnvelopeTypeController.cs

@@ -0,0 +1,39 @@
+using MediatR;
+using EnvelopeGenerator.Application.EnvelopeTypes.Queries;
+using Microsoft.AspNetCore.Mvc;
+
+namespace EnvelopeGenerator.GeneratorAPI.Controllers;
+
+/// <summary>
+/// 
+/// </summary>
+[ApiExplorerSettings(IgnoreApi = true)]
+[Route("api/[controller]")]
+[ApiController]
+public class EnvelopeTypeController : ControllerBase
+{
+    private readonly ILogger<EnvelopeTypeController> _logger;
+    private readonly IMediator _mediator;
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="logger"></param>
+    /// <param name="mediator"></param>
+    public EnvelopeTypeController(ILogger<EnvelopeTypeController> logger, IMediator mediator)
+    {
+        _logger = logger;
+        _mediator = mediator;
+    }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <returns></returns>
+    [HttpGet]
+    public async Task<IActionResult> GetAllAsync()
+    {
+        var result = await _mediator.Send(new ReadEnvelopeTypesQuery());
+        return Ok(result);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/HistoryController.cs

@@ -0,0 +1,118 @@
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Caching.Memory;
+using EnvelopeGenerator.Application.Histories.Queries;
+using EnvelopeGenerator.Domain.Constants;
+using EnvelopeGenerator.Application.Common.Extensions;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Dieser Controller stellt Endpunkte für den Zugriff auf die Umschlaghistorie bereit.
+/// </summary>
+[Route("api/[controller]")]
+[ApiController]
+[Authorize]
+public class HistoryController : ControllerBase
+{
+    private readonly IMemoryCache _memoryCache;
+
+    private readonly IMediator _mediator;
+
+    /// <summary>
+    /// Konstruktor für den HistoryController.
+    /// </summary>
+    /// <param name="memoryCache"></param>
+    /// <param name="mediator"></param>
+    public HistoryController(IMemoryCache memoryCache, IMediator mediator)
+    {
+        _memoryCache = memoryCache;
+        _mediator = mediator;
+    }
+
+    /// <summary>
+    /// Gibt alle möglichen Verweise auf alle möglichen Include in einem Verlaufsdatensatz zurück. (z. B. DocumentSigned bezieht sich auf Receiver.)
+    /// Dies wird hinzugefügt, damit Client-Anwendungen sich selbst auf dem neuesten Stand halten können.
+    /// 1 - Sender:
+    /// Historische Datensätze über den Include der Empfänger. Diese haben Statuscodes, die mit 1* beginnen.
+    /// 2 - Receiver:
+    /// Historische Datensätze, die sich auf den Include des Absenders beziehen. Sie haben Statuscodes, die mit 2* beginnen.
+    /// 3 - System:
+    /// Historische Datensätze, die sich auf den allgemeinen Zustand des Umschlags beziehen. Diese haben Statuscodes, die mit 3* beginnen.
+    /// 4 - Unknown: 
+    /// Ein unbekannter Datensatz weist auf einen möglichen Mangel oder eine Unstimmigkeit im Aktualisierungsprozess der Anwendung hin.
+    /// </summary>
+    /// <returns></returns>
+    /// <response code="200"></response>
+    [HttpGet("related")]
+    [Authorize]
+    public IActionResult GetReferenceTypes(ReferenceType? referenceType = null)
+    {
+        return referenceType is null 
+            ? Ok(_memoryCache.GetEnumAsDictionary<ReferenceType>("gen.api", ReferenceType.Unknown))
+            : Ok(referenceType.ToString());
+    }
+
+    /// <summary>
+    /// Gibt alle möglichen Include in einem Verlaufsdatensatz zurück.
+    /// Dies wird hinzugefügt, damit Client-Anwendungen sich selbst auf dem neuesten Stand halten können.
+    /// 1003: EnvelopeQueued
+    /// 1006: EnvelopeCompletelySigned
+    /// 1007: EnvelopeReportCreated
+    /// 1008: EnvelopeArchived
+    /// 1009: EnvelopeDeleted
+    /// 10007: EnvelopeRejected
+    /// 10009: EnvelopeWithdrawn
+    /// 2001: AccessCodeRequested
+    /// 2002: AccessCodeCorrect
+    /// 2003: AccessCodeIncorrect
+    /// 2004: DocumentOpened
+    /// 2005: DocumentSigned
+    /// 2006: DocumentForwarded
+    /// 2007: DocumentRejected
+    /// 2008: EnvelopeShared
+    /// 2009: EnvelopeViewed
+    /// 3001: MessageInvitationSent (Wird von Trigger verwendet)
+    /// 3002: MessageAccessCodeSent
+    /// 3003: MessageConfirmationSent
+    /// 3004: MessageDeletionSent
+    /// 3005: MessageCompletionSent
+    /// </summary>
+    /// <param name="status">
+    /// Abfrageparameter, der angibt, auf welche Referenz sich der Include bezieht.
+    /// 1 - Sender: Historische Datensätze, die sich auf den Include des Absenders beziehen. Sie haben Statuscodes, die mit 1* beginnen.
+    /// 2 - Receiver: Historische Datensätze über den Include der Empfänger. Diese haben Statuscodes, die mit 2* beginnen.
+    /// 3 - System: Diese werden durch Datenbank-Trigger aktualisiert und sind in den Tabellen EnvelopeHistory und EmailOut zu finden.Sie arbeiten 
+    /// integriert mit der Anwendung EmailProfiler, um E-Mails zu versenden und haben die Codes, die mit 3* beginnen.
+    /// </param>
+    /// <returns>Gibt die HTTP-Antwort zurück.</returns>
+    /// <response code="200"></response>
+    [HttpGet("status")]
+    [Authorize]
+    public IActionResult GetEnvelopeStatus([FromQuery] EnvelopeStatus? status = null)
+    {
+        return status is null
+            ? Ok(_memoryCache.GetEnumAsDictionary<EnvelopeStatus>("gen.api", Status.NonHist, Status.RelatedToFormApp))
+            : Ok(status.ToString());
+    }
+
+    /// <summary>
+    /// Ruft die gesamte Umschlaghistorie basierend auf den angegebenen Abfrageparametern ab.
+    /// </summary>
+    /// <param name="historyQuery">Die Abfrageparameter, die die Filterkriterien für die Umschlaghistorie definieren.</param>
+    /// <param name="cancel"></param>
+    /// <returns>Eine Liste von Historieneinträgen, die den angegebenen Kriterien entsprechen, oder nur der letzte Eintrag.</returns>
+    /// <response code="200">Die Anfrage war erfolgreich, und die Umschlaghistorie wird zurückgegeben.</response>
+    /// <response code="400">Die Anfrage war ungültig oder unvollständig.</response>
+    /// <response code="401">Der Benutzer ist nicht authentifiziert.</response>
+    /// <response code="403">Der Benutzer hat keine Berechtigung, auf die Ressource zuzugreifen.</response>
+    /// <response code="500">Ein unerwarteter Fehler ist aufgetreten.</response>
+    [HttpGet]
+    [Authorize]
+    public async Task<IActionResult> GetAllAsync([FromQuery] ReadHistoryQuery historyQuery, CancellationToken cancel)
+    {
+        var history = await _mediator.Send(historyQuery, cancel).ThrowIfEmpty(Exceptions.NotFound);
+        return Ok((historyQuery.OnlyLast) ? history.MaxBy(h => h.AddedWhen) : history);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/Interfaces/IAuthController.cs

@@ -0,0 +1,38 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+
+namespace EnvelopeGenerator.Server.Controllers.Interfaces;
+
+/// <summary>
+/// 
+/// </summary>
+public interface IAuthController
+{
+    /// <summary>
+    /// 
+    /// </summary>
+    IAuthorizationService AuthService { get; }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    ClaimsPrincipal User { get; }
+}
+
+/// <summary>
+/// 
+/// </summary>
+public static class AuthControllerExtensions
+{
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="controller"></param>
+    /// <param name="policyName"></param>
+    /// <returns></returns>
+    public static async Task<bool> IsUserInPolicyAsync(this IAuthController controller, string policyName)
+    {
+        var result = await controller.AuthService.AuthorizeAsync(controller.User, policyName);
+        return result.Succeeded;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/LocalizationController.cs

@@ -0,0 +1,121 @@
+using DigitalData.Core.API;
+using EnvelopeGenerator.Application.Resources;
+using Microsoft.AspNetCore.Localization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Localization;
+using EnvelopeGenerator.Application.Resources;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Controller für die Verwaltung der Lokalisierung und Spracheinstellungen.
+/// </summary>
+[ApiExplorerSettings(IgnoreApi = true)]
+[Route("api/[controller]")]
+[ApiController]
+public class LocalizationController : ControllerBase
+{
+    private static readonly Guid L_KEY = Guid.NewGuid();
+
+    private readonly ILogger<LocalizationController> _logger;
+    private readonly IStringLocalizer<Resource> _mLocalizer;
+    private readonly IStringLocalizer<Resource> _localizer;
+    private readonly IMemoryCache _cache;
+
+    /// <summary>
+    /// Konstruktor für den <see cref="LocalizationController"/>.
+    /// </summary>
+    /// <param name="logger">Logger für die Protokollierung.</param>
+    /// <param name="localizer">Lokalisierungsdienst für Ressourcen.</param>
+    /// <param name="memoryCache">Speicher-Cache für die Zwischenspeicherung von Daten.</param>
+    /// <param name="_modelLocalizer">Lokalisierungsdienst für Modelle.</param>
+    public LocalizationController(
+        ILogger<LocalizationController> logger,
+        IStringLocalizer<Resource> localizer,
+        IMemoryCache memoryCache,
+        IStringLocalizer<Resource> _modelLocalizer)
+    {
+        _logger = logger;
+        _localizer = localizer;
+        _cache = memoryCache;
+        _mLocalizer = _modelLocalizer;
+    }
+
+    /// <summary>
+    /// Ruft alle lokalisierten Daten ab.
+    /// </summary>
+    /// <returns>Eine Liste aller lokalisierten Daten.</returns>
+    [HttpGet]
+    public IActionResult GetAll() => Ok(_cache.GetOrCreate(Language ?? string.Empty + L_KEY, _ => _mLocalizer.ToDictionary()));
+
+    /// <summary>
+    /// Ruft die aktuelle Sprache ab.
+    /// </summary>
+    /// <returns>Die aktuelle Sprache oder ein NotFound-Ergebnis, wenn keine Sprache gesetzt ist.</returns>
+    [HttpGet("lang")]
+    public IActionResult GetLanguage() => Language is null ? NotFound() : Ok(Language);
+
+    /// <summary>
+    /// Setzt die Sprache.
+    /// </summary>
+    /// <param name="language">Die zu setzende Sprache.</param>
+    /// <returns>Ein Ok-Ergebnis, wenn die Sprache erfolgreich gesetzt wurde, oder ein BadRequest-Ergebnis, wenn die Eingabe ungültig ist.</returns>
+    [HttpPost("lang")]
+    public IActionResult SetLanguage([FromQuery] string language)
+    {
+        if (string.IsNullOrEmpty(language))
+            return BadRequest();
+
+        Language = language;
+        return Ok();
+    }
+
+    /// <summary>
+    /// Löscht die aktuelle Sprache.
+    /// </summary>
+    /// <returns>Ein Ok-Ergebnis, wenn die Sprache erfolgreich gelöscht wurde.</returns>
+    [HttpDelete("lang")]
+    public IActionResult DeleteLanguage()
+    {
+        Language = null;
+        return Ok();
+    }
+
+    /// <summary>
+    /// Eigenschaft für die Verwaltung der aktuellen Sprache über Cookies.
+    /// </summary>
+    private string? Language
+    {
+        get
+        {
+            var cookieValue = Request.Cookies[CookieRequestCultureProvider.DefaultCookieName];
+
+            if (string.IsNullOrEmpty(cookieValue))
+                return null;
+
+            var culture = CookieRequestCultureProvider.ParseCookieValue(cookieValue)?.Cultures[0];
+            return culture?.Value ?? null;
+        }
+        set
+        {
+            if (value is null)
+                Response.Cookies.Delete(CookieRequestCultureProvider.DefaultCookieName);
+            else
+            {
+                var cookieOptions = new CookieOptions()
+                {
+                    Expires = DateTimeOffset.UtcNow.AddYears(1),
+                    Secure = false,
+                    SameSite = SameSiteMode.Strict,
+                    HttpOnly = true
+                };
+
+                Response.Cookies.Append(
+                    CookieRequestCultureProvider.DefaultCookieName,
+                    CookieRequestCultureProvider.MakeCookieValue(new RequestCulture(value)),
+                    cookieOptions);
+            }
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/ReadOnlyController.cs

@@ -0,0 +1,91 @@
+using DigitalData.Core.Abstraction.Application.DTO;
+using EnvelopeGenerator.Application.Common.Dto.EnvelopeReceiverReadOnly;
+using EnvelopeGenerator.Application.Common.Interfaces.Services;
+using EnvelopeGenerator.Domain.Constants;
+using EnvelopeGenerator.Server.Extensions;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Newtonsoft.Json;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Manages read-only envelope sharing flows.
+/// </summary>
+[Route("api/[controller]")]
+[ApiController]
+public class ReadOnlyController : ControllerBase
+{
+    private readonly ILogger<ReadOnlyController> _logger;
+    private readonly IEnvelopeReceiverReadOnlyService _readOnlyService;
+    private readonly IEnvelopeMailService _mailService;
+    private readonly IEnvelopeHistoryService _historyService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ReadOnlyController"/> class.
+    /// </summary>
+    public ReadOnlyController(ILogger<ReadOnlyController> logger, IEnvelopeReceiverReadOnlyService readOnlyService, IEnvelopeMailService mailService, IEnvelopeHistoryService historyService)
+    {
+        _logger = logger;
+        _readOnlyService = readOnlyService;
+        _mailService = mailService;
+        _historyService = historyService;
+    }
+
+    /// <summary>
+    /// Creates a new read-only receiver for the current envelope.
+    /// </summary>
+    /// <param name="createDto">Creation payload.</param>
+    [HttpPost]
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [Obsolete("Use MediatR")]
+    public async Task<IActionResult> CreateAsync([FromBody] EnvelopeReceiverReadOnlyCreateDto createDto)
+    {
+        var authReceiverMail = User.ReceiverMail();
+        if (authReceiverMail is null)
+        {
+            _logger.LogError("EmailAddress claim is not found in envelope-receiver-read-only creation process. Create DTO is:\n {dto}", JsonConvert.SerializeObject(createDto));
+            return Unauthorized();
+        }
+
+        var envelopeId = User.EnvelopeId();
+
+        createDto.AddedWho = authReceiverMail;
+        createDto.EnvelopeId = envelopeId;
+
+        var creationRes = await _readOnlyService.CreateAsync(createDto: createDto);
+
+        if (creationRes.IsFailed)
+        {
+            _logger.LogNotice(creationRes);
+            return StatusCode(StatusCodes.Status500InternalServerError);
+        }
+
+        var readRes = await _readOnlyService.ReadByIdAsync(creationRes.Data.Id);
+        if (readRes.IsFailed)
+        {
+            _logger.LogNotice(creationRes);
+            return StatusCode(StatusCodes.Status500InternalServerError);
+        }
+
+        var newReadOnly = readRes.Data;
+
+        return await _mailService.SendAsync(newReadOnly).ThenAsync<int, IActionResult>(SuccessAsync: async _ =>
+        {
+            var histRes = await _historyService.RecordAsync((int)createDto.EnvelopeId, createDto.AddedWho, EnvelopeStatus.EnvelopeShared);
+            if (histRes.IsFailed)
+            {
+                _logger.LogError("Although the envelope was sent as read-only, the EnvelopeShared history could not be saved. Create DTO:\n{createDto}", JsonConvert.SerializeObject(createDto));
+                _logger.LogNotice(histRes.Notices);
+            }
+
+            return Ok();
+        },
+
+        Fail: (msg, ntc) =>
+        {
+            _logger.LogNotice(ntc);
+            return StatusCode(StatusCodes.Status500InternalServerError);
+        });
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/ReceiverController.cs

@@ -0,0 +1,47 @@
+using MediatR;
+using EnvelopeGenerator.Application.Receivers.Queries;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace EnvelopeGenerator.GeneratorAPI.Controllers;
+
+/// <summary>
+/// Controller für die Verwaltung von Empfängern.
+/// </summary>
+/// <remarks>
+/// Dieser Controller bietet Endpunkte für das Abrufen von Empfängern basierend auf E-Mail-Adresse oder Signatur.
+/// </remarks>
+[Route("api/[controller]")]
+[ApiController]
+[Authorize]
+public class ReceiverController : ControllerBase
+{
+    private readonly IMediator _mediator;
+
+    /// <summary>
+    /// Initialisiert eine neue Instanz des <see cref="ReceiverController"/>-Controllers.
+    /// </summary>
+    /// <param name="mediator">Mediator für Anfragen.</param>
+    public ReceiverController(IMediator mediator)
+    {
+        _mediator = mediator;
+    }
+
+    /// <summary>
+    /// Ruft eine Liste von Empfängern ab, basierend auf den angegebenen Abfrageparametern.
+    /// </summary>
+    /// <param name="receiver">Die Abfrageparameter, einschließlich E-Mail-Adresse und Signatur.</param>
+    /// <returns>Eine Liste von Empfängern oder ein Fehlerstatus.</returns>
+    [HttpGet]
+    public async Task<IActionResult> Get([FromQuery] ReadReceiverQuery receiver)
+    {
+        if (!receiver.HasAnyCriteria)
+        {
+            var all = await _mediator.Send(new ReadReceiverQuery());
+            return Ok(all);
+        }
+
+        var result = await _mediator.Send(receiver);
+        return result is null ? NotFound() : Ok(result);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/SignatureController.cs

@@ -0,0 +1,57 @@
+using EnvelopeGenerator.Server.Extensions;
+using EnvelopeGenerator.Application.Common.Dto;
+using EnvelopeGenerator.Application.Common.Extensions;
+using EnvelopeGenerator.Application.Documents.Queries;
+using EnvelopeGenerator.Domain.Constants;
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// 
+/// </summary>
+[Authorize(Policy = AuthPolicy.Receiver)]
+[ApiController]
+[Route("api/[controller]")]
+public class SignatureController : ControllerBase
+{
+    private readonly IMediator _mediator;
+
+    /// <summary>
+    /// Initializes a new instance of <see cref="SignatureController"/>.
+    /// </summary>
+    public SignatureController(IMediator mediator)
+    {
+        _mediator = mediator;
+    }
+
+    //TODO: update to use signature query
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="envelopeKey"></param>
+    /// <param name="cancel"></param>
+    /// <returns></returns>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpGet("{envelopeKey}")]
+    public async Task<IActionResult> Get(string envelopeKey, CancellationToken cancel)
+    {
+        int envelopeId = User.EnvelopeId();
+
+        int receiverId = User.ReceiverId();
+
+        var doc = await _mediator.Send(new ReadDocumentQuery() { EnvelopeId = envelopeId }, cancel);
+
+        if (doc.Elements is not IEnumerable<DocReceiverElementDto> docSignatures)
+            return NotFound("Document is empty.");
+
+        var rcvSignatures = docSignatures.Where(s => s.ReceiverId == receiverId).ToList();
+
+        if (rcvSignatures is null)
+            return NotFound("No signatures found for the current receiver.");
+        else
+            return Ok(rcvSignatures);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Controllers/TfaRegistrationController.cs

@@ -0,0 +1,129 @@
+using DigitalData.Core.Abstraction.Application.DTO;
+using EnvelopeGenerator.Application.Common.Extensions;
+using EnvelopeGenerator.Application.Common.Interfaces.Services;
+using EnvelopeGenerator.Application.Resources;
+using EnvelopeGenerator.Domain.Constants;
+using EnvelopeGenerator.Server.Models;
+using Ganss.Xss;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Localization;
+using Microsoft.Extensions.Options;
+
+namespace EnvelopeGenerator.Server.Controllers;
+
+/// <summary>
+/// Exposes endpoints for registering and managing two-factor authentication for envelope receivers.
+/// </summary>
+[ApiController]
+[Route("api/tfa")]
+public class TfaRegistrationController : ControllerBase
+{
+    private readonly ILogger<TfaRegistrationController> _logger;
+    private readonly IEnvelopeReceiverService _envelopeReceiverService;
+    private readonly IAuthenticator _authenticator;
+    private readonly IReceiverService _receiverService;
+    private readonly TFARegParams _parameters;
+    private readonly IStringLocalizer<Resource> _localizer;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TfaRegistrationController"/> class.
+    /// </summary>
+    public TfaRegistrationController(
+        ILogger<TfaRegistrationController> logger,
+        IEnvelopeReceiverService envelopeReceiverService,
+        IAuthenticator authenticator,
+        IReceiverService receiverService,
+        IOptions<TFARegParams> tfaRegParamsOptions,
+        IStringLocalizer<Resource> localizer)
+    {
+        _logger = logger;
+        _envelopeReceiverService = envelopeReceiverService;
+        _authenticator = authenticator;
+        _receiverService = receiverService;
+        _parameters = tfaRegParamsOptions.Value;
+        _localizer = localizer;
+    }
+
+    /// <summary>
+    /// Generates registration metadata (QR code and deadline) for a receiver.
+    /// </summary>
+    /// <param name="envelopeReceiverId">Encoded envelope receiver id.</param>
+    [Authorize]
+    [HttpGet("{envelopeReceiverId}")]
+    public async Task<IActionResult> RegisterAsync(string envelopeReceiverId)
+    {
+        try
+        {
+            var (uuid, signature) = envelopeReceiverId.DecodeEnvelopeReceiverId();
+
+            if (uuid is null || signature is null)
+            {
+                _logger.LogEnvelopeError(uuid: uuid, signature: signature, message: _localizer.WrongEnvelopeReceiverId());
+                return Unauthorized(new { message = _localizer.WrongEnvelopeReceiverId() });
+            }
+
+            var secretResult = await _envelopeReceiverService.ReadWithSecretByUuidSignatureAsync(uuid: uuid, signature: signature);
+            if (secretResult.IsFailed)
+            {
+                _logger.LogNotice(secretResult.Notices);
+                return NotFound(new { message = _localizer.WrongEnvelopeReceiverId() });
+            }
+
+            var envelopeReceiver = secretResult.Data;
+
+            if (!envelopeReceiver.Envelope!.TFAEnabled)
+                return Unauthorized(new { message = _localizer.WrongAccessCode() });
+
+            var receiver = envelopeReceiver.Receiver;
+            receiver!.TotpSecretkey = _authenticator.GenerateTotpSecretKey();
+            await _receiverService.UpdateAsync(receiver);
+            var totpQr64 = _authenticator.GenerateTotpQrCode(userEmail: receiver.EmailAddress, secretKey: receiver.TotpSecretkey).ToBase64String();
+
+            if (receiver.TfaRegDeadline is null)
+            {
+                receiver.TfaRegDeadline = _parameters.Deadline;
+                await _receiverService.UpdateAsync(receiver);
+            }
+            else if (receiver.TfaRegDeadline <= DateTime.Now)
+            {
+                return StatusCode(StatusCodes.Status410Gone, new { message = _localizer.WrongAccessCode() });
+            }
+
+            return Ok(new
+            {
+                envelopeReceiver.EnvelopeId,
+                envelopeReceiver.Envelope!.Uuid,
+                envelopeReceiver.Receiver!.Signature,
+                receiver.TfaRegDeadline,
+                TotpQR64 = totpQr64
+            });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogEnvelopeError(envelopeReceiverId: envelopeReceiverId, exception: ex, message: _localizer.WrongEnvelopeReceiverId());
+            return StatusCode(StatusCodes.Status500InternalServerError, new { message = _localizer.UnexpectedError() });
+        }
+    }
+
+    /// <summary>
+    /// Logs out the envelope receiver from cookie authentication.
+    /// </summary>
+    [Authorize(Policy = AuthPolicy.Receiver)]
+    [HttpPost("auth/logout")]
+    public async Task<IActionResult> LogOutAsync()
+    {
+        try
+        {
+            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+            return Ok();
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "{message}", ex.Message);
+            return StatusCode(StatusCodes.Status500InternalServerError, new { message = _localizer.UnexpectedError() });
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Documentation/AuthProxyDocumentFilter.cs

@@ -0,0 +1,123 @@
+using EnvelopeGenerator.Server.Models;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+
+namespace EnvelopeGenerator.Server.Documentation;
+
+/// <summary>
+/// 
+/// </summary>
+public sealed class AuthProxyDocumentFilter : IDocumentFilter
+{
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="swaggerDoc"></param>
+    /// <param name="context"></param>
+    public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
+    {
+        AddLoginOperation(swaggerDoc, context);
+        AddEnvelopeReceiverLoginOperation(swaggerDoc, context);
+    }
+
+    private static void AddLoginOperation(OpenApiDocument swaggerDoc, DocumentFilterContext context)
+    {
+        const string path = "/api/auth";
+
+        var loginSchema = context.SchemaGenerator.GenerateSchema(typeof(Login), context.SchemaRepository);
+        var loginExample = new OpenApiObject
+        {
+            ["password"] = new OpenApiString(""),
+            ["username"] = new OpenApiString("")
+        };
+
+        var operation = new OpenApiOperation
+        {
+            Summary = "Proxy login (auth-hub)",
+            Description = "Proxies the request to the auth service. Add query parameter `cookie=true|false`.",
+            Tags = [new() { Name = "Auth" }],
+            Parameters =
+            {
+                new OpenApiParameter
+                {
+                    Name = "cookie",
+                    In = ParameterLocation.Query,
+                    Required = false,
+                    Schema = new OpenApiSchema { Type = "boolean", Default = new OpenApiBoolean(true) },
+                    Example = new OpenApiBoolean(true),
+                    Description = "If true, auth service sets the auth cookie."
+                }
+            },
+            RequestBody = new OpenApiRequestBody
+            {
+                Required = true,
+                Content =
+                {
+                    ["application/json"] = new OpenApiMediaType { Schema = loginSchema, Example = loginExample },
+                    ["multipart/form-data"] = new OpenApiMediaType { Schema = loginSchema, Example = loginExample }
+                }
+            },
+            Responses =
+            {
+                ["200"] = new OpenApiResponse { Description = "OK (proxied response)" },
+                ["401"] = new OpenApiResponse { Description = "Unauthorized" }
+            }
+        };
+
+        swaggerDoc.Paths[path] = new OpenApiPathItem
+        {
+            Operations =
+            {
+                [OperationType.Post] = operation
+            }
+        };
+    }
+
+    private static void AddEnvelopeReceiverLoginOperation(OpenApiDocument swaggerDoc, DocumentFilterContext context)
+    {
+        const string path = "/api/Auth/envelope-receiver/{key}";
+
+        var bodySchema = context.SchemaGenerator.GenerateSchema(typeof(EnvelopeReceiverLogin), context.SchemaRepository);
+
+        var operation = new OpenApiOperation
+        {
+            Summary = "Envelope receiver login (auth-hub proxy)",
+            Description = "Proxies the envelope receiver login to the auth service. " +
+                          "The `cookie` query parameter is always forwarded as `true` so the auth service sets the per-envelope cookie automatically.",
+            Tags = [new() { Name = "Auth" }],
+            Parameters =
+            {
+                new OpenApiParameter
+                {
+                    Name = "key",
+                    In = ParameterLocation.Path,
+                    Required = true,
+                    Schema = new OpenApiSchema { Type = "string" },
+                    Description = "The unique envelope receiver key."
+                }
+            },
+            RequestBody = new OpenApiRequestBody
+            {
+                Required = false,
+                Content =
+                {
+                    ["multipart/form-data"] = new OpenApiMediaType { Schema = bodySchema }
+                }
+            },
+            Responses =
+            {
+                ["200"] = new OpenApiResponse { Description = "OK – per-envelope cookie set by auth service." },
+                ["401"] = new OpenApiResponse { Description = "Unauthorized – invalid or missing access code." }
+            }
+        };
+
+        swaggerDoc.Paths[path] = new OpenApiPathItem
+        {
+            Operations =
+            {
+                [OperationType.Post] = operation
+            }
+        };
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/EnvelopeGenerator.Server.csproj

@@ -0,0 +1,61 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\EnvelopeGenerator.Server.Client\EnvelopeGenerator.Server.Client.csproj" />
+    <ProjectReference Include="..\..\EnvelopeGenerator.Application\EnvelopeGenerator.Application.csproj" />
+    <ProjectReference Include="..\..\EnvelopeGenerator.Domain\EnvelopeGenerator.Domain.csproj" />
+    <ProjectReference Include="..\..\EnvelopeGenerator.Infrastructure\EnvelopeGenerator.Infrastructure.csproj" />
+    <ProjectReference Include="..\..\EnvelopeGenerator.PdfEditor\EnvelopeGenerator.PdfEditor.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="8.0.22" />
+    <PackageReference Include="DevExpress.Blazor" Version="25.2.3" />
+    <PackageReference Include="DevExpress.Blazor.PdfViewer" Version="25.2.3" />
+    <PackageReference Include="DevExpress.Blazor.Reporting.Viewer" Version="25.2.3" />
+    
+    <!-- API Packages from EnvelopeGenerator.Server -->
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.11" />
+    <PackageReference Include="AspNetCore.Scalar" Version="1.1.8" />
+    <PackageReference Include="DigitalData.Auth.Claims" Version="1.0.3" />
+    <PackageReference Include="DigitalData.Auth.Client" Version="1.3.7" />
+    <PackageReference Include="DigitalData.Core.API" Version="2.2.1" />
+    <PackageReference Include="HtmlSanitizer" Version="9.0.892" />
+    <PackageReference Include="Microsoft.Extensions.Caching.SqlServer" Version="8.0.11" />
+    <PackageReference Include="itext" Version="8.0.5" />
+    <PackageReference Include="itext.bouncy-castle-adapter" Version="8.0.5" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="8.0.11" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.17" />
+    <PackageReference Include="Microsoft.Identity.Client" Version="4.82.1" />
+    <PackageReference Include="NLog" Version="5.2.5" />
+    <PackageReference Include="NLog.Web.AspNetCore" Version="5.3.0" />
+    <PackageReference Include="Scalar.AspNetCore" Version="2.2.1" />
+    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="8.1.1" />
+    <PackageReference Include="DigitalData.EmailProfilerDispatcher.Abstraction" Version="3.2.0" />
+    <PackageReference Include="System.DirectoryServices" Version="8.0.0" />
+    <PackageReference Include="System.DirectoryServices.AccountManagement" Version="8.0.1" />
+    <PackageReference Include="System.DirectoryServices.Protocols" Version="8.0.1" />
+    <PackageReference Include="Yarp.ReverseProxy" Version="2.3.0" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Update="wwwroot\docs\privacy-policy.en-US.html">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </Content>
+    <Content Update="wwwroot\docs\privacy-policy.fr-FR.html">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </Content>
+  </ItemGroup>
+
+  <ItemGroup>
+    <EmbeddedResource Include="Resources\Invoice.pdf" />
+  </ItemGroup>
+
+</Project>

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Extensions/ReceiverClaimExtensions.cs

@@ -0,0 +1,96 @@
+using DigitalData.Auth.Claims;
+using Microsoft.IdentityModel.JsonWebTokens;
+using System.Security.Claims;
+
+namespace EnvelopeGenerator.Server.Extensions;
+
+/// <summary>
+/// Provides helper methods for working with envelope-specific authentication claims.
+/// </summary>
+public static class ReceiverClaimExtensions
+{
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <param name="user"></param>
+    /// <param name="claimType"></param>
+    /// <returns></returns>
+    /// <exception cref="InvalidOperationException"></exception>
+    private static string GetRequiredClaimValue(this ClaimsPrincipal user, string claimType)
+    {
+        var value = user.FindFirstValue(claimType);
+        if (value is not null)
+        {
+            return value;
+        }
+
+        var identity = user.Identity;
+        var principalName = identity?.Name ?? "(anonymous)";
+        var authType = identity?.AuthenticationType ?? "(none)";
+        var availableClaims = string.Join(", ", user.Claims.Select(c => $"{c.Type}={c.Value}"));
+        var message = $"Required claim '{claimType}' is missing for user '{principalName}' (auth: {authType}). Available claims: [{availableClaims}].";
+        throw new InvalidOperationException(message);
+    }
+
+    private static string GetRequiredClaimValue(this ClaimsPrincipal user, params string[] claimTypes)
+    {
+        foreach (var claimType in claimTypes.Where(t => !string.IsNullOrWhiteSpace(t)).Distinct())
+        {
+            var value = user.FindFirstValue(claimType);
+            if (!string.IsNullOrWhiteSpace(value))
+                return value;
+        }
+
+        var identity = user.Identity;
+        var principalName = identity?.Name ?? "(anonymous)";
+        var authType = identity?.AuthenticationType ?? "(none)";
+        var availableClaims = string.Join(", ", user.Claims.Select(c => $"{c.Type}={c.Value}"));
+        var message = $"Required claim(s) '{string.Join("', '", claimTypes)}' are missing for user '{principalName}' (auth: {authType}). Available claims: [{availableClaims}].";
+        throw new InvalidOperationException(message);
+    }
+
+    /// <summary>
+    /// Gets the authenticated envelope UUID from the claims.
+    /// </summary>
+    public static string EnvelopeUuid(this ClaimsPrincipal user)
+        => user.GetRequiredClaimValue(EnvelopeClaimNames.EnvelopeUuid);
+
+    /// <summary>
+    /// Gets the authenticated receiver signature from the claims.
+    /// </summary>
+    public static string ReceiverSignature(this ClaimsPrincipal user)
+        => user.GetRequiredClaimValue(EnvelopeClaimNames.ReceiverSignature);
+
+    /// <summary>
+    /// Gets the authenticated receiver email address from the claims.
+    /// </summary>
+    public static string ReceiverMail(this ClaimsPrincipal user)
+        => user.GetRequiredClaimValue(JwtRegisteredClaimNames.Email);
+
+    /// <summary>
+    /// Gets the authenticated envelope identifier from the claims.
+    /// </summary>
+    public static int EnvelopeId(this ClaimsPrincipal user)
+    {
+        var envIdStr = user.GetRequiredClaimValue(EnvelopeClaimNames.EnvelopeId);
+        if (int.TryParse(envIdStr, out var envId))
+            return envId;
+        else
+            throw new InvalidOperationException($"Claim '{EnvelopeClaimNames.EnvelopeId}' is not a valid integer.");
+    }
+
+    /// <summary>
+    /// Gets the authenticated receiver identifier from the claims.
+    /// </summary>
+    /// <param name="user"></param>
+    /// <returns></returns>
+    /// <exception cref="InvalidOperationException"></exception>
+    public static int ReceiverId(this ClaimsPrincipal user)
+    {
+        var rcvIdStr = user.GetRequiredClaimValue(EnvelopeClaimNames.ReceiverId);
+        if (int.TryParse(rcvIdStr, out var rcvId))
+            return rcvId;
+        else
+            throw new InvalidOperationException($"Claim '{EnvelopeClaimNames.ReceiverId}' is not a valid integer.");
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Extensions/SenderClaimExtensions.cs

@@ -0,0 +1,95 @@
+using System.Security.Claims;
+
+namespace EnvelopeGenerator.Server.Extensions
+{
+    /// <summary>
+    /// Provides extension methods for extracting user information from a <see cref="ClaimsPrincipal"/>.
+    /// </summary>
+    public static class SenderClaimExtensions
+    {
+        private static string GetRequiredClaimOfSender(this ClaimsPrincipal user, string claimType)
+        {
+            var value = user.FindFirstValue(claimType);
+            if (value is not null)
+            {
+                return value;
+            }
+
+            var identity = user.Identity;
+            var principalName = identity?.Name ?? "(anonymous)";
+            var authType = identity?.AuthenticationType ?? "(none)";
+            var availableClaims = string.Join(", ", user.Claims.Select(c => $"{c.Type}={c.Value}"));
+            var message = $"Required claim '{claimType}' is missing for user '{principalName}' (auth: {authType}). Available claims: [{availableClaims}].";
+            throw new InvalidOperationException(message);
+        }
+
+        private static string GetRequiredClaimOfSender(this ClaimsPrincipal user, params string[] claimTypes)
+        {
+            string? value = null;
+
+            foreach (var claimType in claimTypes)
+            {
+                value = user.FindFirstValue(claimType);
+                if (value is not null)
+                    return value;
+            }
+
+            var identity = user.Identity;
+            var principalName = identity?.Name ?? "(anonymous)";
+            var authType = identity?.AuthenticationType ?? "(none)";
+            var availableClaims = string.Join(", ", user.Claims.Select(c => $"{c.Type}={c.Value}"));
+            var message = $"Required claim among [{string.Join(", ", claimTypes)}] is missing for user '{principalName}' (auth: {authType}). Available claims: [{availableClaims}].";
+            throw new InvalidOperationException(message);
+        }
+
+        /// <summary>
+        /// Retrieves the user's ID from the claims. Throws an exception if the ID is missing or invalid.
+        /// </summary>
+        /// <param name="user">The <see cref="ClaimsPrincipal"/> representing the user.</param>
+        /// <returns>The user's ID as an integer.</returns>
+        /// <exception cref="InvalidOperationException">Thrown if the user ID claim is missing or invalid.</exception>
+        public static int GetId(this ClaimsPrincipal user)
+        {
+            var idValue = user.GetRequiredClaimOfSender(ClaimTypes.NameIdentifier, "sub");
+
+            if (!int.TryParse(idValue, out var result))
+            {
+                throw new InvalidOperationException("User ID claim is missing or invalid. This may indicate a misconfigured or forged JWT token.");
+            }
+
+            return result;
+        }
+
+        /// <summary>
+        /// Retrieves the username from the claims.
+        /// </summary>
+        /// <param name="user">The <see cref="ClaimsPrincipal"/> representing the user.</param>
+        /// <returns>The username as a string.</returns>
+        public static string GetUsername(this ClaimsPrincipal user)
+            => user.GetRequiredClaimOfSender(ClaimTypes.Name);
+
+        /// <summary>
+        /// Retrieves the user's surname (last name) from the claims.
+        /// </summary>
+        /// <param name="user">The <see cref="ClaimsPrincipal"/> representing the user.</param>
+        /// <returns>The surname as a string.</returns>
+        public static string GetName(this ClaimsPrincipal user)
+            => user.GetRequiredClaimOfSender(ClaimTypes.Surname);
+
+        /// <summary>
+        /// Retrieves the user's given name (first name) from the claims.
+        /// </summary>
+        /// <param name="user">The <see cref="ClaimsPrincipal"/> representing the user.</param>
+        /// <returns>The given name as a string.</returns>
+        public static string GetPrename(this ClaimsPrincipal user)
+            => user.GetRequiredClaimOfSender(ClaimTypes.GivenName);
+
+        /// <summary>
+        /// Retrieves the user's email address from the claims.
+        /// </summary>
+        /// <param name="user">The <see cref="ClaimsPrincipal"/> representing the user.</param>
+        /// <returns>The email address as a string.</returns>
+        public static string GetEmail(this ClaimsPrincipal user)
+            => user.GetRequiredClaimOfSender(ClaimTypes.Email);
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Jenkinsfile

@@ -0,0 +1,10 @@
+pipeline {
+    agent any
+    stages {
+        stage('Build') {
+            steps {
+                sh 'dotnet build'
+            }
+        }
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Middleware/ExceptionHandlingMiddleware.cs

@@ -0,0 +1,84 @@
+namespace EnvelopeGenerator.Server.Middleware;
+
+using DigitalData.Core.Exceptions;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using System.Net;
+using System.Text.Json;
+
+/// <summary>
+/// Middleware for handling exceptions globally in the application.
+/// Captures exceptions thrown during the request pipeline execution,
+/// logs them, and returns an appropriate HTTP response with a JSON error message.
+/// </summary>
+public class ExceptionHandlingMiddleware
+{
+    private readonly RequestDelegate _next;
+    private readonly ILogger<ExceptionHandlingMiddleware> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ExceptionHandlingMiddleware"/> class.
+    /// </summary>
+    /// <param name="next">The next middleware in the request pipeline.</param>
+    /// <param name="logger">The logger instance for logging exceptions.</param>
+    public ExceptionHandlingMiddleware(RequestDelegate next, ILogger<ExceptionHandlingMiddleware> logger)
+    {
+        _next = next;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Invokes the middleware to handle the HTTP request.
+    /// </summary>
+    /// <param name="context">The HTTP context of the current request.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    public async Task InvokeAsync(HttpContext context)
+    {
+        try
+        {
+            await _next(context); // Continue down the pipeline
+        }
+        catch (Exception ex)
+        {
+            await HandleExceptionAsync(context, ex, _logger);
+        }
+    }
+
+    /// <summary>
+    /// Handles exceptions by logging them and writing an appropriate JSON response.
+    /// </summary>
+    /// <param name="context">The HTTP context of the current request.</param>
+    /// <param name="exception">The exception that occurred.</param>
+    /// <param name="logger">The logger instance for logging the exception.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    private static async Task HandleExceptionAsync(HttpContext context, Exception exception, ILogger logger)
+    {
+        context.Response.ContentType = "application/json";
+
+        string message;
+
+        switch (exception)
+        {
+            case BadRequestException badRequestEx:
+                context.Response.StatusCode = (int)HttpStatusCode.BadRequest;
+                message = badRequestEx.Message;
+                break;
+
+            case NotFoundException notFoundEx:
+                context.Response.StatusCode = (int)HttpStatusCode.NotFound;
+                message = notFoundEx.Message;
+                break;
+
+            default:
+                logger.LogError(exception, "Unhandled exception occurred.");
+                context.Response.StatusCode = (int)HttpStatusCode.InternalServerError;
+                message = "An unexpected error occurred.";
+                break;
+        }
+
+        await context.Response.WriteAsync(JsonSerializer.Serialize(new
+        {
+            message
+        }));
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/Auth.cs

@@ -0,0 +1,14 @@
+namespace EnvelopeGenerator.Server.Models;
+
+public record Auth(string? AccessCode = null, string? SmsCode = null, string? AuthenticatorCode = null, bool UserSelectSMS = default)
+{
+    public bool HasAccessCode => AccessCode is not null;
+
+    public bool HasSmsCode => SmsCode is not null;
+
+    public bool HasAuthenticatorCode => AuthenticatorCode is not null;
+
+    public bool HasMulti => new[] { HasAccessCode, HasSmsCode, HasAuthenticatorCode }.Count(state => state) > 1;
+
+    public bool HasNone => !(HasAccessCode || HasSmsCode || HasAuthenticatorCode);
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/AuthTokenKeys.cs

@@ -0,0 +1,28 @@
+namespace EnvelopeGenerator.Server.Models;
+
+/// <summary>
+/// Represents the keys and default values used for authentication token handling 
+/// within the Envelope Generator Server.
+/// </summary>
+public class AuthTokenKeys
+{
+    /// <summary>
+    /// Gets the name of the cookie used to store the authentication token.
+    /// </summary>
+    public string Cookie { get; init; } = "AuthToken";
+
+    /// <summary>
+    /// Gets the name of the query string parameter used to pass the authentication token.
+    /// </summary>
+    public string QueryString { get; init; } = "AuthToken";
+
+    /// <summary>
+    /// Gets the expected issuer value for the authentication token.
+    /// </summary>
+    public string Issuer { get; init; } = "auth.digitaldata.works";
+
+    /// <summary>
+    /// Gets the expected audience value for the authentication token.
+    /// </summary>
+    public string Audience { get; init; } = "sign-flow.digitaldata.works";
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/ConnectionString.cs

@@ -0,0 +1,12 @@
+namespace EnvelopeGenerator.Server.Models;
+
+/// <summary>
+/// Represents the database connection string for dependency injection.
+/// </summary>
+public class ConnectionString
+{
+    /// <summary>
+    /// The database connection string value.
+    /// </summary>
+    public string Value { get; set; } = string.Empty;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/ContactLink.cs

@@ -0,0 +1,60 @@
+namespace EnvelopeGenerator.Server.Models
+{
+    /// <summary>
+    /// Represents a hyperlink for contact purposes with various HTML attributes.
+    /// </summary>
+    public class ContactLink
+    {
+        /// <summary>
+        /// Gets or sets the label of the hyperlink.
+        /// </summary>
+        public string Label { get; init; } = "Contact";
+
+        /// <summary>
+        /// Gets or sets the URL that the hyperlink points to.
+        /// </summary>
+        public string Href { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Gets or sets the target where the hyperlink should open.
+        /// Commonly used values are "_blank", "_self", "_parent", "_top".
+        /// </summary>
+        public string Target { get; set; } = "_blank";
+
+        /// <summary>
+        /// Gets or sets the relationship of the linked URL as space-separated link types.
+        /// Examples include "nofollow", "noopener", "noreferrer".
+        /// </summary>
+        public string Rel { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Gets or sets the filename that should be downloaded when clicking the hyperlink.
+        /// This attribute will only have an effect if the href attribute is set.
+        /// </summary>
+        public string Download { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Gets or sets the language of the linked resource. Useful when linking to
+        /// content in another language.
+        /// </summary>
+        public string HrefLang { get; set; } = "en";
+
+        /// <summary>
+        /// Gets or sets the MIME type of the linked URL. Helps browsers to handle
+        /// the type correctly when the link is clicked.
+        /// </summary>
+        public string Type { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Gets or sets additional information about the hyperlink, typically viewed
+        /// as a tooltip when the mouse hovers over the link.
+        /// </summary>
+        public string Title { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Gets or sets an identifier for the hyperlink, unique within the HTML document.
+        /// </summary>
+        public string Id { get; set; } = string.Empty;
+    }
+
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/Culture.cs

@@ -0,0 +1,17 @@
+using System.Globalization;
+
+namespace EnvelopeGenerator.Server.Models;
+
+public class Culture
+{
+    private string _language = string.Empty;
+    public string Language { get => _language;
+        init {
+            _language = value;
+            Info = new(value);
+        } 
+    }
+    public string FIClass { get; init; } = string.Empty;
+
+    public CultureInfo? Info { get; init; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/Cultures.cs

@@ -0,0 +1,12 @@
+namespace EnvelopeGenerator.Server.Models;
+
+public class Cultures : List<Culture>
+{
+    public IEnumerable<string> Languages => this.Select(c => c.Language);
+
+    public IEnumerable<string> FIClasses => this.Select(c => c.FIClass);
+
+    public Culture Default => this.First();
+    
+    public Culture? this[string? language] => language is null ? null : this.Where(c => c.Language == language).FirstOrDefault();
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/CustomImages.cs

@@ -0,0 +1,6 @@
+namespace EnvelopeGenerator.Server.Models;
+
+public class CustomImages : Dictionary<string, Image>
+{
+    public new Image this[string key] => TryGetValue(key, out var img) && img is not null ? img : new();
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/EnvelopeReceiverLogin.cs

@@ -0,0 +1,7 @@
+namespace EnvelopeGenerator.Server.Models;
+
+/// <summary>
+/// Request body for the envelope-receiver login endpoint.
+/// </summary>
+/// <param name="AccessCode">The access code sent to the receiver.</param>
+public record EnvelopeReceiverLogin(string? AccessCode = null);

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/ErrorViewModel.cs

@@ -0,0 +1,10 @@
+namespace EnvelopeGenerator.Server.Models;
+
+public class ErrorViewModel
+{
+    public string Title { get; init; } = "404";
+
+    public string Subtitle { get; init; } = "Hmmm...";
+
+    public string Body { get; init; } = "It looks like one of the developers fell asleep";
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/Image.cs

@@ -0,0 +1,10 @@
+namespace EnvelopeGenerator.Server.Models;
+
+public class Image
+{
+    public string Src { get; init; } = string.Empty;
+
+    public Dictionary<string, string> Classes { get; init; } = new();
+
+    public string GetClassIn(string page) => Classes.TryGetValue(page, out var cls) && cls is not null ? cls : string.Empty;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/Login.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace EnvelopeGenerator.Server.Models;
+
+/// <summary>
+/// Repräsentiert ein Login-Modell mit erforderlichem Passwort und optionaler ID und Benutzername.
+/// </summary>
+/// <param name="Password">Das erforderliche Passwort für das Login.</param>
+/// <param name="UserId">Die optionale ID des Benutzers.</param>
+/// <param name="Username">Der optionale Benutzername.</param>
+public record Login([Required] string Password, int? UserId = null, string? Username = null)
+{
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/MainViewModel.cs

@@ -0,0 +1,6 @@
+namespace EnvelopeGenerator.Server.Models;
+
+public class MainViewModel
+{
+    public string? Title { get; init; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/PsPdfKitAnnotation/Annotation.cs

@@ -0,0 +1,93 @@
+using EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+using System.Text.Json.Serialization;
+
+namespace EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+
+public record Annotation : IAnnotation
+{
+    public required string Name { get; init; }
+
+    #region Bound Annotation
+    [JsonIgnore]
+    public string? HorBoundAnnotName { get; init; }
+
+    [JsonIgnore]
+    public string? VerBoundAnnotName { get; init; }
+    #endregion
+
+    #region Layout
+    [JsonIgnore]
+    public double? MarginLeft { get; set; }
+
+    [JsonIgnore]
+    public double MarginLeftRatio { get; init; } = 1;
+
+    [JsonIgnore]
+    public double? MarginTop { get; set; }
+
+    [JsonIgnore]
+    public double MarginTopRatio { get; init; } = 1;
+
+    public double? Width { get; set; }
+
+    [JsonIgnore]
+    public double WidthRatio { get; init; } = 1;
+
+    public double? Height { get; set; }
+
+    [JsonIgnore]
+    public double HeightRatio { get; init; } = 1;
+    #endregion
+
+    #region Position
+    public double Left => (MarginLeft ?? 0) + (HorBoundAnnot?.HorBoundary ?? 0);
+
+    public double Top => (MarginTop ?? 0) + (VerBoundAnnot?.VerBoundary ?? 0);
+    #endregion
+
+    #region Boundary
+    [JsonIgnore]
+    public double HorBoundary => Left + (Width ?? 0);
+
+    [JsonIgnore]
+    public double VerBoundary => Top + (Height ?? 0);
+    #endregion
+
+    #region BoundAnnot
+    [JsonIgnore]
+    public Annotation? HorBoundAnnot { get; set; }
+
+    [JsonIgnore]
+    public Annotation? VerBoundAnnot { get; set; }
+    #endregion
+
+    public Color? BackgroundColor { get; init; }
+
+    #region Border
+    public Color? BorderColor { get; init; }
+
+    public string? BorderStyle { get; init; }
+
+    public int? BorderWidth { get; set; }
+    #endregion
+
+    [JsonIgnore]
+    internal Annotation Default 
+    { 
+        set 
+        {
+            // To set null value, annotation must have null (0) value but null must has non-null value
+            if (MarginLeft == null && value.MarginLeft != null)
+                MarginLeft = value.MarginLeft * MarginLeftRatio;
+
+            if (MarginTop == null && value.MarginTop != null)
+                MarginTop = value.MarginTop * MarginTopRatio;
+
+            if (Width == null && value.Width != null)
+                Width = value.Width * WidthRatio;
+
+            if (Height == null && value.Height != null)
+                Height = value.Height * HeightRatio;
+        }
+    }
+};

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/PsPdfKitAnnotation/AnnotationParams.cs

@@ -0,0 +1,80 @@
+using EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+using System.Text.Json.Serialization;
+
+namespace EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+
+public class AnnotationParams
+{
+    public AnnotationParams()
+    {
+        _AnnotationJSObjectInitor = new(CreateAnnotationJSObject);
+    }
+
+    public Background? Background { get; init; }
+
+    #region Annotation
+    [JsonIgnore]
+    public Annotation? DefaultAnnotation { get; init; }
+
+    private readonly List<Annotation> _annots = new List<Annotation>();
+
+    public bool TryGet(string name, out Annotation annotation)
+    {
+#pragma warning disable CS8601 // Possible null reference assignment.
+        annotation = _annots.FirstOrDefault(a => a.Name == name);
+#pragma warning restore CS8601 // Possible null reference assignment.
+        return annotation is not null;
+    }
+
+    public required IEnumerable<Annotation> Annotations
+    {
+        get => _annots;
+        init
+        {
+            _annots = value.ToList();
+
+            if (DefaultAnnotation is not null)
+                foreach (var annot in _annots)
+                    annot.Default = DefaultAnnotation;
+
+            for (int i = 0; i < _annots.Count; i++)
+            {
+                #region set bound annotations
+                // horizontal
+                if (_annots[i].HorBoundAnnotName is string horBoundAnnotName)
+                    if (TryGet(horBoundAnnotName, out var horBoundAnnot))
+                        _annots[i].HorBoundAnnot = horBoundAnnot;
+                    else
+                        throw new InvalidOperationException($"{horBoundAnnotName} added as bound anotation. However, it is not defined.");
+
+                // vertical
+                if (_annots[i].VerBoundAnnotName is string verBoundAnnotName)
+                    if (TryGet(verBoundAnnotName, out var verBoundAnnot))
+                        _annots[i].VerBoundAnnot = verBoundAnnot;
+                    else
+                        throw new InvalidOperationException($"{verBoundAnnotName} added as bound anotation. However, it is not defined.");
+                #endregion
+            }
+        }
+    }
+    #endregion
+
+    #region AnnotationJSObject
+    private Dictionary<string, IAnnotation> CreateAnnotationJSObject()
+    {
+        var dict = _annots.ToDictionary(a => a.Name.ToLower(), a => a as IAnnotation);
+
+        if (Background is not null)
+        {
+            Background.Locate(_annots);
+            dict.Add(Background.Name.ToLower(), Background);
+        }            
+
+        return dict;
+    }
+
+    private readonly Lazy<Dictionary<string, IAnnotation>> _AnnotationJSObjectInitor;
+
+    public Dictionary<string, IAnnotation> AnnotationJSObject => _AnnotationJSObjectInitor.Value;
+    #endregion
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/PsPdfKitAnnotation/Background.cs

@@ -0,0 +1,58 @@
+using System.Text.Json.Serialization;
+
+namespace EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+
+/// <summary>
+/// The Background is an annotation for the PSPDF Kit. However, it has no function.
+/// It is only the first annotation as a background for other annotations.
+/// </summary>
+public record Background : IAnnotation
+{
+    [JsonIgnore]
+    public double Margin { get; init; }
+
+    public string Name { get; } = "Background";
+
+    public double? Width { get; set; }
+
+    public double? Height { get; set; }
+
+    public double Left { get; set; }
+
+    public double Top { get; set; }
+
+    public Color? BackgroundColor { get; init; }
+
+    #region Border
+    public Color? BorderColor { get; init; }
+
+    public string? BorderStyle { get; init; }
+
+    public int? BorderWidth { get; set; }
+    #endregion
+
+    public void Locate(IEnumerable<IAnnotation> annotations)
+    {
+        // set Top
+        if (annotations.MinBy(a => a.Top)?.Top is double minTop)
+            Top = minTop;
+
+        // set Left
+        if (annotations.MinBy(a => a.Left)?.Left is double minLeft)
+            Left = minLeft;
+
+        // set Width
+        if(annotations.MaxBy(a => a.GetRight())?.GetRight() is double maxRight)
+            Width = maxRight - Left;
+
+        // set Height
+        if (annotations.MaxBy(a => a.GetBottom())?.GetBottom() is double maxBottom)
+            Height = maxBottom - Top;
+
+        // add margins
+        Top -= Margin;
+        Left -= Margin;
+        Width += Margin * 2;
+        Height += Margin * 2;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/PsPdfKitAnnotation/Color.cs

@@ -0,0 +1,10 @@
+namespace EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+
+public record Color
+{
+    public int R { get; init; } = 0;
+
+    public int G { get; init; } = 0;
+
+    public int B { get; init; } = 0;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/PsPdfKitAnnotation/Extensions.cs

@@ -0,0 +1,8 @@
+namespace EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+
+public static class Extensions
+{
+    public static double GetRight(this IAnnotation annotation) => annotation.Left + annotation?.Width ?? 0;
+
+    public static double GetBottom(this IAnnotation annotation) => annotation.Top + annotation?.Height ?? 0;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/PsPdfKitAnnotation/IAnnotation.cs

@@ -0,0 +1,22 @@
+namespace EnvelopeGenerator.Server.Models.PsPdfKitAnnotation;
+
+public interface IAnnotation
+{
+    string Name { get; }
+
+    double? Width { get; }
+
+    double? Height { get; }
+
+    double Left { get; }
+
+    double Top { get; }
+
+    Color? BackgroundColor { get; }
+
+    Color? BorderColor { get; }
+
+    string? BorderStyle { get; }
+
+    int? BorderWidth { get; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Models/TFARegParams.cs

@@ -0,0 +1,17 @@
+namespace EnvelopeGenerator.Server.Models;
+
+/// <summary>
+/// Represents the parameters for two-factor authentication (2FA) registration.
+/// </summary>
+public class TFARegParams
+{
+    /// <summary>
+    /// The maximum allowed time for completing the registration process.
+    /// </summary>
+    public TimeSpan TimeLimit { get; init; } = new(0, 30, 0);
+
+    /// <summary>
+    /// The deadline for registration, calculated as the current time plus the <see cref="TimeLimit"/>.
+    /// </summary>
+    public DateTime Deadline => DateTime.Now.AddTicks(TimeLimit.Ticks);
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Options/CacheOptions.cs

@@ -0,0 +1,18 @@
+namespace EnvelopeGenerator.Server.Options;
+
+/// <summary>
+/// Configuration options for distributed caching.
+/// </summary>
+public sealed class CacheOptions
+{
+    /// <summary>
+    /// Configuration section name in appsettings.json.
+    /// </summary>
+    public const string SectionName = "Cache";
+
+    /// <summary>
+    /// Signature cache expiration time.
+    /// If null, signatures will not expire automatically.
+    /// </summary>
+    public TimeSpan? SignatureCacheExpiration { get; set; }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Program.cs

@@ -0,0 +1,398 @@
+using EnvelopeGenerator.Server.Components;
+using EnvelopeGenerator.Server.Models;
+using EnvelopeGenerator.Server.Options;
+using DevExpress.Blazor;
+using EnvelopeGenerator.Server.Client.Services;
+using DigitalData.Core.API;
+using DigitalData.Core.Application;
+using EnvelopeGenerator.Infrastructure;
+using EnvelopeGenerator.Domain.Constants;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Localization;
+using Microsoft.EntityFrameworkCore;
+using System.Globalization;
+using Scalar.AspNetCore;
+using Microsoft.OpenApi.Models;
+using DigitalData.UserManager.DependencyInjection;
+using EnvelopeGenerator.Application;
+using DigitalData.Auth.Client;
+using DigitalData.Core.Abstractions;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using DigitalData.Core.Abstractions.Security.Extensions;
+using NLog.Web;
+using NLog;
+using DigitalData.Auth.Claims;
+using EnvelopeGenerator.Server;
+
+var logger = LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger();
+logger.Info("EnvelopeGenerator.Server logging initialized!");
+
+try
+{
+    var builder = WebApplication.CreateBuilder(args);
+
+    // Load YARP configuration from yarp.json
+    builder.Configuration.AddJsonFile("yarp.json", optional: true, reloadOnChange: true);
+
+    builder.Logging.SetMinimumLevel(Microsoft.Extensions.Logging.LogLevel.Trace);
+
+    if (!builder.Environment.IsDevelopment())
+    {
+        builder.Logging.ClearProviders();
+        builder.Host.UseNLog();
+    }
+
+    var config = builder.Configuration;
+
+    var deferredProvider = new DeferredServiceProvider();
+
+    // Add Blazor services
+    builder.Services.AddRazorComponents()
+        .AddInteractiveServerComponents()
+        .AddInteractiveWebAssemblyComponents();
+
+    // Add API Controllers
+    builder.Services.AddControllers();
+    builder.Services.AddHttpClient();
+
+    // YARP Reverse Proxy (for forwarding auth requests to AuthHub)
+    builder.Services.AddReverseProxy()
+        .LoadFromConfig(builder.Configuration.GetSection("ReverseProxy"));
+
+    // HttpContextAccessor needed for SSR HttpClient configuration
+    builder.Services.AddHttpContextAccessor();
+
+    // Named HttpClient for internal API calls
+    builder.Services.AddHttpClient("EnvelopeGenerator.Server", (sp, client) =>
+    {
+        var httpContextAccessor = sp.GetRequiredService<IHttpContextAccessor>();
+        var request = httpContextAccessor.HttpContext?.Request;
+
+        if (request != null)
+        {
+            // Set base address to current host for SSR scenarios
+            client.BaseAddress = new Uri($"{request.Scheme}://{request.Host}");
+        }
+    });
+
+    // CORS Policy
+    var allowedOrigins = config.GetSection("AllowedOrigins").Get<string[]>() ??
+        throw new InvalidOperationException("AllowedOrigins section is missing in the configuration.");
+    builder.Services.AddCors(options =>
+    {
+        options.AddPolicy("AllowSpecificOriginsPolicy", builder =>
+        {
+            builder.WithOrigins(allowedOrigins)
+                   .SetIsOriginAllowedToAllowWildcardSubdomains()
+                   .AllowAnyMethod()
+                   .AllowAnyHeader()
+                   .AllowCredentials();
+        });
+    });
+
+    // Swagger/OpenAPI
+    builder.Services.AddEndpointsApiExplorer();
+    builder.Services.AddSwaggerGen(options =>
+    {
+        options.SwaggerDoc("v1", new OpenApiInfo
+        {
+            Version = "v1",
+            Title = "signFLOW Absender-API",
+            Description = "Eine API zur Verwaltung der Erstellung, des Versands und der Nachverfolgung von Umschlägen in der signFLOW-Anwendung.",
+            Contact = new OpenApiContact
+            {
+                Name = "Digital Data GmbH",
+                Url = new Uri("https://digitaldata.works/digitale-signatur#kontakt"),
+                Email = "info-flow@digitaldata.works"
+            },
+        });
+
+        options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
+        {
+            Name = "Authorization",
+            Type = SecuritySchemeType.Http,
+            Scheme = "bearer",
+            BearerFormat = "JWT",
+            In = ParameterLocation.Header,
+            Description = "JWT-Autorisierungs-Header unter Verwendung des Bearer-Schemas.",
+        });
+
+        options.AddSecurityRequirement(new OpenApiSecurityRequirement
+        {
+            {
+                new OpenApiSecurityScheme
+                {
+                    Reference = new OpenApiReference
+                    {
+                        Type = Microsoft.OpenApi.Models.ReferenceType.SecurityScheme,
+                        Id = "Bearer"
+                    }
+                },
+                Array.Empty<string>()
+            }
+        });
+
+        var xmlFiles = Directory.GetFiles(AppContext.BaseDirectory, "*.xml");
+        foreach (var xmlFile in xmlFiles)
+        {
+            options.IncludeXmlComments(xmlFile);
+        }
+    });
+
+    // Database Context
+    var useDbMigration = Environment.GetEnvironmentVariable("MIGRATION_TEST_MODE") == true.ToString() || config.GetValue<bool>("UseDbMigration");
+    var cnnStrName = useDbMigration ? "DbMigrationTest" : "Default";
+    var connStr = config.GetConnectionString(cnnStrName)
+        ?? throw new InvalidOperationException($"Connection string '{cnnStrName}' is missing in the application configuration.");
+
+    builder.Services.Configure<ConnectionString>(cs => cs.Value = connStr);
+
+    builder.Services.AddDbContext<EGDbContext>(options => options.UseSqlServer(connStr));
+
+    // Authentication - AuthHub
+    builder.Services.AddAuthHubClient(config.GetSection("AuthClientParams"));
+
+    var authTokenKeys = config.GetOrDefault<AuthTokenKeys>();
+
+    builder.Services.AddAuthentication(options =>
+    {
+        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
+    })
+        .AddJwtBearer(AuthScheme.Sender, opt =>
+        {
+            opt.TokenValidationParameters = new TokenValidationParameters
+            {
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) =>
+                {
+                    var clientParams = deferredProvider.GetOptions<ClientParams>();
+                    var publicKey = clientParams!.PublicKeys.Get(authTokenKeys.Issuer, authTokenKeys.Audience);
+                    return [publicKey.SecurityKey];
+                },
+                ValidateIssuer = true,
+                ValidIssuer = authTokenKeys.Issuer,
+                ValidateAudience = true,
+                ValidAudience = authTokenKeys.Audience,
+            };
+
+            opt.Events = new JwtBearerEvents
+            {
+                OnMessageReceived = context =>
+                {
+                    if (context.Token is null)
+                    {
+                        if (context.Request.Cookies.TryGetValue(authTokenKeys.Cookie, out var cookieToken) && cookieToken is not null)
+                            context.Token = cookieToken;
+                        else if (context.Request.Query.TryGetValue(authTokenKeys.QueryString, out var queryStrToken))
+                            context.Token = queryStrToken;
+                    }
+                    return Task.CompletedTask;
+                }
+            };
+        })
+        .AddJwtBearer(AuthScheme.Receiver, opt =>
+        {
+            opt.TokenValidationParameters = new TokenValidationParameters
+            {
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) =>
+                {
+                    var clientParams = deferredProvider.GetOptions<ClientParams>();
+                    var publicKey = clientParams!.PublicKeys.Get(authTokenKeys.Issuer, authTokenKeys.Audience);
+                    return [publicKey.SecurityKey];
+                },
+                ValidateIssuer = true,
+                ValidIssuer = authTokenKeys.Issuer,
+                ValidateAudience = true,
+                ValidAudience = authTokenKeys.Audience,
+            };
+
+            opt.Events = new JwtBearerEvents
+            {
+                OnMessageReceived = context =>
+                {
+                    var paths = context.Request.Path.Value?.Split('/', StringSplitOptions.RemoveEmptyEntries);
+                    var envelopeKey = paths?.LastOrDefault();
+
+                    if (envelopeKey is not null)
+                    {
+                        var cookieName = CookieNames.GetEnvelopeReceiverCookieName(authTokenKeys.Cookie, envelopeKey);
+                        if (context.Request.Cookies.TryGetValue(cookieName, out var cookieToken) && cookieToken is not null)
+                            context.Token = cookieToken;
+                    }
+
+                    return Task.CompletedTask;
+                },
+                OnTokenValidated = context =>
+                {
+                    var paths = context.Request.Path.Value?.Split('/', StringSplitOptions.RemoveEmptyEntries);
+                    var envelopeKey = paths?.LastOrDefault();
+
+                    var sub = context.Principal?.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value
+                           ?? context.Principal?.FindFirst("sub")?.Value;
+
+                    if (envelopeKey is null || sub != envelopeKey)
+                        context.Fail("Envelope key in the path does not match the token subject.");
+
+                    return Task.CompletedTask;
+                }
+            };
+        });
+
+    // Cookie Authentication
+    builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
+        .AddCookie(options =>
+        {
+            options.Cookie.HttpOnly = true;
+            options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
+            options.Cookie.SameSite = SameSiteMode.Strict;
+            options.LoginPath = "/api/auth/login";
+            options.LogoutPath = "/api/auth/logout";
+            options.SlidingExpiration = true;
+        });
+
+    // Authorization Policies
+    builder.Services.AddAuthorizationBuilder()
+        .AddPolicy(AuthPolicy.SenderOrReceiver, policy => policy.RequireRole(Role.Sender, Role.Receiver.Full))
+        .AddPolicy(AuthPolicy.Sender, policy => policy
+            .RequireRole(Role.Sender)
+            .AddAuthenticationSchemes(AuthScheme.Sender))
+        .AddPolicy(AuthPolicy.Receiver, policy => policy
+            .AddAuthenticationSchemes(AuthScheme.Receiver)
+            .RequireAuthenticatedUser()
+            .RequireRole(Role.Receiver.Full, "receiver"))
+        .AddPolicy(AuthPolicy.ReceiverTFA, policy => policy.RequireRole(Role.Receiver.TFA));
+
+    // User Manager
+#pragma warning disable CS0618
+    builder.Services.AddUserManager<EGDbContext>();
+#pragma warning restore CS0618
+
+    // LDAP Directory Search
+    builder.ConfigureBySection<DirectorySearchOptions>();
+    builder.Services.AddDirectorySearchService(config.GetSection("DirectorySearchOptions"));
+
+    // Localization
+    builder.Services.AddCookieBasedLocalizer();
+
+    // Cache options
+    builder.Services.Configure<CacheOptions>(config.GetSection(CacheOptions.SectionName));
+
+    // Distributed Cache - SQL Server
+    builder.Services.AddDistributedSqlServerCache(options =>
+    {
+        config.GetSection("Cache:SqlServer").Bind(options);
+        
+        if (string.IsNullOrWhiteSpace(options.ConnectionString))
+        {
+            options.ConnectionString = connStr;
+        }
+    });
+
+    // Envelope Generator Infrastructure & Application Services
+#pragma warning disable CS0618
+    builder.Services
+        .AddEnvelopeGeneratorInfrastructureServices(opt =>
+        {
+            opt.AddDbTriggerParams(config);
+            opt.AddDbContext((provider, options) =>
+            {
+                var logger = provider.GetRequiredService<ILogger<EGDbContext>>();
+                options.UseSqlServer(connStr)
+                        .LogTo(log => logger.LogInformation("{log}", log), Microsoft.Extensions.Logging.LogLevel.Trace)
+                        .EnableSensitiveDataLogging()
+                        .EnableDetailedErrors();
+            });
+            opt.AddSQLExecutor(executor => executor.ConnectionString = connStr);
+        })
+        .AddEnvelopeGeneratorServices(config);
+#pragma warning restore CS0618
+
+    // Business Services (Server specific)
+    builder.Services.AddScoped<DocumentService>();
+    builder.Services.AddScoped<AuthService>();
+    builder.Services.AddScoped<AnnotationService>();
+    builder.Services.AddScoped<EnvelopeReceiverService>();
+    builder.Services.AddScoped<SignatureService>();
+    builder.Services.AddScoped<SignatureCacheService>();
+    builder.Services.AddSingleton<AppVersionService>();
+
+    // SSR Authentication Service (for Envelope Receiver pages)
+    builder.Services.AddScoped<EnvelopeGenerator.Server.Services.IEnvelopeAuthService, EnvelopeGenerator.Server.Services.EnvelopeAuthService>();
+
+    // DevExpress Server-Side Services (CRITICAL for DxPdfViewer)
+    builder.Services.AddDevExpressBlazor();
+    builder.Services.AddDevExpressServerSideBlazorPdfViewer();
+
+    // Configuration Options
+    builder.Services.Configure<EnvelopeGenerator.Server.Client.Options.ApiOptions>(
+        builder.Configuration.GetSection("ApiOptions"));
+    builder.Services.Configure<EnvelopeGenerator.Server.Client.Options.PdfViewerOptions>(
+        builder.Configuration.GetSection("PdfViewerOptions"));
+
+    var app = builder.Build();
+
+    deferredProvider.Factory = () => app.Services;
+
+    // Exception handling middleware for API controllers
+    app.UseMiddleware<EnvelopeGenerator.Server.Middleware.ExceptionHandlingMiddleware>();
+
+    // Configure the HTTP request pipeline.
+    if (app.Environment.IsDevelopment())
+    {
+        app.UseWebAssemblyDebugging();
+        app.UseSwagger();
+        app.UseSwaggerUI();
+        app.MapScalarApiReference();
+    }
+    else
+    {
+        app.UseExceptionHandler("/Error", createScopeForErrors: true);
+        app.UseHsts();
+    }
+
+    // Set CORS policy
+    app.UseCors("AllowSpecificOriginsPolicy");
+
+    // Localization
+    string[] supportedCultureNames = ["de-DE", "en-US"];
+    IList<CultureInfo> list = [.. supportedCultureNames.Select(cn => new CultureInfo(cn))];
+    var cultureInfo = list.FirstOrDefault() ?? throw new InvalidOperationException("There is no supported culture.");
+    var requestLocalizationOptions = new RequestLocalizationOptions
+    {
+        SupportedCultures = list,
+        SupportedUICultures = list
+    };
+    requestLocalizationOptions.RequestCultureProviders.Add(new QueryStringRequestCultureProvider());
+    app.UseRequestLocalization(requestLocalizationOptions);
+
+    app.UseHttpsRedirection();
+
+    app.UseDefaultFiles();
+    app.UseStaticFiles();
+    app.UseAntiforgery();
+
+    app.UseAuthentication();
+    app.UseAuthorization();
+
+    // API Controllers (map before Blazor routing)
+    app.MapControllers();
+
+    // YARP Reverse Proxy - forwards unmatched requests to configured backends
+    app.MapReverseProxy();
+
+    // Blazor routing
+    app.MapRazorComponents<App>()
+        .AddInteractiveServerRenderMode()
+        .AddInteractiveWebAssemblyRenderMode()
+        .AddAdditionalAssemblies(typeof(EnvelopeGenerator.Server.Client._Imports).Assembly);
+
+    app.Run();
+}
+catch (Exception ex)
+{
+    logger.Error(ex, "Stopped program because of exception");
+    throw;
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Properties/launchSettings.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "iisSettings": {
+    "windowsAuthentication": false,
+    "anonymousAuthentication": true,
+    "iisExpress": {
+      "applicationUrl": "http://localhost:5131",
+      "sslPort": 8088
+    }
+  },
+  "profiles": {
+    "https (Blazor UI)": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "https://localhost:8088;http://localhost:5131",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      },
+      "inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}"
+    },
+    "https (Swagger API)": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "launchUrl": "swagger",
+      "applicationUrl": "https://localhost:8088;http://localhost:5131",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "http (Development)": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:5131",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "IIS Express": {
+      "commandName": "IISExpress",
+      "launchBrowser": true,
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Services/EnvelopeAuthService.cs

@@ -0,0 +1,91 @@
+using System.Security.Claims;
+
+namespace EnvelopeGenerator.Server.Services;
+
+/// <summary>
+/// Server-side authentication service for envelope receiver access validation.
+/// Uses HttpContext to check JWT claims and envelope key authorization.
+/// </summary>
+public class EnvelopeAuthService : IEnvelopeAuthService
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly ILogger<EnvelopeAuthService> _logger;
+
+    public EnvelopeAuthService(
+        IHttpContextAccessor httpContextAccessor,
+        ILogger<EnvelopeAuthService> logger)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public bool IsAuthenticated(string envelopeKey)
+    {
+        if (string.IsNullOrWhiteSpace(envelopeKey))
+        {
+            _logger.LogWarning("IsAuthenticated called with null or empty envelope key");
+            return false;
+        }
+
+        var context = _httpContextAccessor.HttpContext;
+        
+        // Check if user is authenticated
+        if (context?.User?.Identity?.IsAuthenticated != true)
+        {
+            _logger.LogDebug("User is not authenticated for envelope {EnvelopeKey}", envelopeKey);
+            return false;
+        }
+
+        // Get envelope key from claims
+        var sub = GetEnvelopeKeyFromClaims(context.User);
+
+        // Verify envelope key matches
+        var isValid = sub == envelopeKey;
+        
+        if (!isValid)
+        {
+            _logger.LogWarning(
+                "Envelope key mismatch: Expected {ExpectedKey}, Got {ActualKey}", 
+                envelopeKey, 
+                sub ?? "(null)");
+        }
+        else
+        {
+            _logger.LogDebug("User authenticated for envelope {EnvelopeKey}", envelopeKey);
+        }
+
+        return isValid;
+    }
+
+    /// <inheritdoc/>
+    public string? GetAuthenticatedEnvelopeKey()
+    {
+        var context = _httpContextAccessor.HttpContext;
+        
+        if (context?.User?.Identity?.IsAuthenticated != true)
+            return null;
+
+        return GetEnvelopeKeyFromClaims(context.User);
+    }
+
+    /// <inheritdoc/>
+    public ClaimsPrincipal? GetCurrentUser()
+    {
+        return _httpContextAccessor.HttpContext?.User;
+    }
+
+    private string? GetEnvelopeKeyFromClaims(ClaimsPrincipal user)
+    {
+        // Try NameIdentifier first (standard claim)
+        var sub = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        
+        // Fallback to "sub" claim (JWT standard)
+        if (string.IsNullOrWhiteSpace(sub))
+        {
+            sub = user.FindFirst("sub")?.Value;
+        }
+
+        return sub;
+    }
+}

EnvelopeGenerator.Server/EnvelopeGenerator.Server/Services/IEnvelopeAuthService.cs

@@ -0,0 +1,29 @@
+using System.Security.Claims;
+
+namespace EnvelopeGenerator.Server.Services;
+
+/// <summary>
+/// Service for handling envelope-specific authentication in SSR (Server-Side Rendering) context.
+/// </summary>
+public interface IEnvelopeAuthService
+{
+    /// <summary>
+    /// Checks if the current user is authenticated for the given envelope key.
+    /// Validates both that the user is authenticated AND that the envelope key matches their claims.
+    /// </summary>
+    /// <param name="envelopeKey">The envelope key to validate against user claims.</param>
+    /// <returns>True if user is authenticated and envelope key matches; otherwise false.</returns>
+    bool IsAuthenticated(string envelopeKey);
+
+    /// <summary>
+    /// Gets the authenticated envelope key from the current user's claims (NameIdentifier or "sub" claim).
+    /// </summary>
+    /// <returns>The envelope key if user is authenticated; otherwise null.</returns>
+    string? GetAuthenticatedEnvelopeKey();
+
+    /// <summary>
+    /// Gets the current HttpContext user principal.
+    /// </summary>
+    /// <returns>ClaimsPrincipal if available; otherwise null.</returns>
+    ClaimsPrincipal? GetCurrentUser();
+}