mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-06-15 17:25:26 -04:00
nubs
1a0e1c5d69
PDF uploads are stored as markdown wrappers with pdf_source or pdf_form_source markers so the editor can preserve extracted text, form fields, and annotations. The library exposed that internal wrapper: auto-created PDF documents used the hashed storage filename as the title, and row/facet language reported markdown instead of pdf.
Derive chat-upload PDF titles from the original upload name, derive document-library display language from the PDF source marker for rows, filters, and facets, and keep markdown wrappers excluded from the markdown facet when they represent PDFs.
The expanded library card already renders PDF-backed documents through /api/document/{id}/render-pdf. Allow only that inline PDF preview endpoint to be framed by same-origin app pages while leaving normal routes on X-Frame-Options: DENY and frame-ancestors none.
Also tighten the existing PDF marker regression assertion so it matches the actual historical corruption signature instead of contradicting the preserved [Page 1 text]: marker.
Fixes #2468
37 lines
1.0 KiB
Python
37 lines
1.0 KiB
Python
from fastapi import FastAPI
|
|
from fastapi.responses import Response
|
|
from fastapi.testclient import TestClient
|
|
|
|
from core.middleware import SecurityHeadersMiddleware
|
|
|
|
|
|
def _client():
|
|
app = FastAPI()
|
|
app.add_middleware(SecurityHeadersMiddleware)
|
|
|
|
@app.get("/plain")
|
|
async def plain():
|
|
return {"ok": True}
|
|
|
|
@app.get("/api/document/{doc_id}/render-pdf")
|
|
async def render_pdf(doc_id: str):
|
|
return Response(b"%PDF-1.4\n", media_type="application/pdf")
|
|
|
|
return TestClient(app)
|
|
|
|
|
|
def test_default_routes_remain_unframeable():
|
|
response = _client().get("/plain")
|
|
|
|
assert response.headers["X-Frame-Options"] == "DENY"
|
|
assert "frame-ancestors 'none'" in response.headers["Content-Security-Policy"]
|
|
|
|
|
|
def test_document_pdf_preview_can_be_framed_by_same_origin():
|
|
response = _client().get("/api/document/doc-123/render-pdf")
|
|
|
|
assert response.headers["X-Frame-Options"] == "SAMEORIGIN"
|
|
assert response.headers["Content-Security-Policy"] == (
|
|
"default-src 'none'; frame-ancestors 'self'"
|
|
)
|