2bc2cfac6fd521e3296806de8daa5c820f5cf533
After adding frame-src the preview iframe stopped showing the broken-file icon but went blank: it pointed at /api/v1/files/[id]/download, which presigns with the filename so S3 returns Content-Disposition: attachment — the browser downloaded the PDF instead of rendering it. Point the SignedPdfPreview iframe at the existing /preview endpoint, which presigns WITHOUT a filename (inline disposition) so the native PDF viewer renders. Also widen font-src to include https: so react-pdf/pdf.js can load its standard-font pack (LiberationSans*) — previously blocked by font-src 'self' data:, breaking the pdf.js-based viewers' glyphs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Description
No description provided
Languages
TypeScript
98.7%
HTML
1%
CSS
0.1%
Shell
0.1%