MMD
baa32a2652
Downloads require an Authorization header, which <iframe>/<img> cannot
send. The previous blob: workaround broke under download managers (IDM
hooks blob URLs, fails to resolve them, and leaves a 0-byte file) and in
Chrome's mobile emulation, which has no inline PDF plugin.
Backend:
- preview_token.py: HMAC-signed token bound to one (quote, kind, file)
with a 5-minute TTL, keyed off an existing secret
- GET /quotes/{id}/preview-url/{kind}/{attachment} mints the URL
- the two file GET routes accept a Bearer session OR the signed ?t= token
(they leave the global auth dep, so the other six file routes now carry
it explicitly — nothing is open by omission)
Frontend:
- api.files.previewUrl() replaces the blob helper
- shared FilePreviewModal + useFilePreview; FileList and the dashboard
quote card both use it
- PDFs render with the browser's native viewer on desktop and pdf.js on
canvas where no inline viewer exists (mobile); pdf.js is fed the bytes
in memory so no PDF URL is exposed for a download manager to intercept
- removed the per-attachment download buttons on the dashboard card and
the modal header
Ops:
- nginx: explicit MIME types (.mjs as text/javascript) — a module worker
served as octet-stream is refused and crashed the page
- frontend service bypasses the nginx entrypoint, whose apk manifest call
hangs when the package mirror is unreachable (502s)
49 lines
1.3 KiB
JSON
49 lines
1.3 KiB
JSON
{
|
|
"name": "procurement-ui-v2",
|
|
"private": true,
|
|
"version": "0.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"lint": "oxlint",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@hookform/resolvers": "3.10",
|
|
"@openpanel/web": "^1.0.1",
|
|
"@radix-ui/react-checkbox": "^1.3.11",
|
|
"@radix-ui/react-dialog": "^1.1.23",
|
|
"@radix-ui/react-label": "^2.1.15",
|
|
"@radix-ui/react-select": "^2.3.7",
|
|
"@radix-ui/react-slot": "^1.3.3",
|
|
"@sentry/react": "^10.0.0",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@tanstack/react-query": "^5.101.4",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^1.30.0",
|
|
"pdfjs-dist": "^4.10.38",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"react-hook-form": "^7.85.0",
|
|
"react-router-dom": "^7.18.2",
|
|
"sonner": "^2.0.8",
|
|
"tailwind-merge": "^3.6.0",
|
|
"tailwindcss": "^4.3.3",
|
|
"zod": "3.25",
|
|
"zustand": "^5.0.14"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^24.13.3",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.4",
|
|
"oxlint": "^1.75.0",
|
|
"typescript": "~6.0.2",
|
|
"vite": "^8.2.0"
|
|
}
|
|
}
|