Merge pull request #206 from appdevforall/feat/ADFA-4708-pdfjs-rootfs-module

ADFA-4708: serve Mozilla pdf.js from nginx for in-WebView PDF viewing

Author: luisguzman-adfa

.gitignore

@@ -7,3 +7,6 @@
 # OS
 .DS_Store
 Thumbs.db
+
+# pdf.js prebuilt dist (fetched at build time, not vendored) — ADFA-4708
+static/pdfjs/dist/

iiab-android

@@ -606,6 +606,36 @@ mkdir -p /library/www/html/k2go-docs
 /usr/local/bin/pdsm restart nginx
 ok "K2Go docs module scaffold installed (hidden until docs are added)."
 
+#-----------------------------
+# pdf.js viewer (ADFA-4708) — static module.
+# Serve Mozilla pdf.js so the portal WebView can render PDFs inline/offline. The prebuilt
+# dist is produced by static/pdfjs/fetch-pdfjs.sh (run at build time); here we install the
+# nginx conf and deploy the dist to the web root. Unlike k2go-docs this is always present.
+#-----------------------------
+log "Installing pdf.js viewer static module..."
+cp "${K2GO_OPT_DIR}/static/pdfjs/pdfjs-nginx.conf" "/etc/nginx/conf.d/pdfjs-nginx.conf"
+mkdir -p /library/www/html/pdfjs
+# Produce the pinned pdf.js dist at build time (this is what actually downloads it).
+# dist/ is gitignored, so on a clean build it is absent and must be fetched here; if a
+# dist was pre-provided (e.g. vendored/cached) the fetch is skipped. Needs network +
+# curl/unzip in the build environment. pdf.js release cadence ~monthly (semver; majors
+# can break) -> the version is PINNED in fetch-pdfjs.sh; bump it deliberately, mainly on
+# a pdf.js security advisory, not on every release.
+if [ ! -d "${K2GO_OPT_DIR}/static/pdfjs/dist/web" ]; then
+  log "Fetching pinned pdf.js dist (build-time)..."
+  if ! bash "${K2GO_OPT_DIR}/static/pdfjs/fetch-pdfjs.sh"; then
+    warn "pdf.js fetch failed; viewer will 404 until the dist is provided."
+  fi
+fi
+if [ -d "${K2GO_OPT_DIR}/static/pdfjs/dist/web" ]; then
+  cp -a "${K2GO_OPT_DIR}/static/pdfjs/dist/." /library/www/html/pdfjs/
+  ok "pdf.js dist deployed."
+else
+  warn "pdf.js dist not found; viewer will 404 until deployed."
+fi
+/usr/local/bin/pdsm restart nginx
+ok "pdf.js viewer module installed."
+
 # Install demo content
 if [ "$ENABLE_DEMO_CONTENTS" -eq 1 ]; then
   install_demo_contents

static/pdfjs/README.md

@@ -0,0 +1,24 @@
+# pdf.js viewer (ADFA-4708) — in-WebView PDF viewing
+
+The Android System WebView has no built-in PDF viewer, so a PDF served by the box would
+otherwise be ignored (or downloaded). This module serves Mozilla **pdf.js** from the local
+nginx so the portal WebView can render PDFs inline and offline.
+
+## How it works
+- Served at `http://localhost:8085/pdfjs/` (see `pdfjs-nginx.conf`).
+- The app routes an internal-host PDF to `…/pdfjs/web/viewer.html?file=<encoded pdf url>`
+  (see `PdfPolicy` / `PdfViewerUrl` in the controller app). Same origin as the box's PDFs,
+  so there is no CORS / mixed-content problem and it works with no internet.
+- pdf.js is pure JavaScript (Apache-2.0) — the same dist serves ARM 32- and 64-bit.
+
+## Assets (dist)
+The prebuilt pdf.js distribution is fetched at rootfs-build time, not vendored in git:
+
+    PDFJS_VERSION=4.10.38 ./fetch-pdfjs.sh   # writes ./dist (web/ + build/)
+
+Pin `PDFJS_VERSION` (and optionally `PDFJS_SHA256`) to the release we ship. The extracted
+`dist/` is deployed to `/library/www/html/pdfjs/` so `/pdfjs/web/viewer.html` resolves.
+
+## Build / rootfs
+The `iiab-android` setup script installs `pdfjs-nginx.conf` into the :8085 server and
+deploys the dist to the web root (same mechanism as the other static modules). All editions.

static/pdfjs/fetch-pdfjs.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Fetch a pinned Mozilla pdf.js prebuilt distribution into ./dist for deployment.
+# pdf.js is pure JS (Apache-2.0) -> no 32/64-bit concern; the same dist serves every ABI.
+# Run at rootfs-build time on a networked host; the extracted dist is then deployed to
+# /library/www/html/pdfjs (see the iiab-android setup script).
+set -euo pipefail
+
+# Pinned pdf.js version. pdf.js ships a stable dist ~monthly and uses semver, so a MAJOR
+# bump can break the viewer API. Keep this pinned and bump it DELIBERATELY — primarily when
+# a pdf.js security advisory lands (it has had RCE CVEs), not on every release. Also confirm
+# the pin runs on the oldest Android System WebView we target (app minSdk = 24 / Android 7;
+# recent pdf.js majors need a modern Chromium WebView). Use the newest STABLE that is still
+# compatible — never a nightly/beta.
+# TODO(Luis): confirm the version to ship (marker below is a placeholder, not verified).
+PDFJS_VERSION="${PDFJS_VERSION:-4.10.38}"
+# Optional integrity check: set PDFJS_SHA256 to the expected zip checksum to enforce it.
+PDFJS_SHA256="${PDFJS_SHA256:-}"
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+DIST_DIR="${HERE}/dist"
+ZIP_URL="https://github.com/mozilla/pdf.js/releases/download/v${PDFJS_VERSION}/pdfjs-${PDFJS_VERSION}-dist.zip"
+TMP_ZIP="$(mktemp -t pdfjs-XXXXXX.zip)"
+trap 'rm -f "$TMP_ZIP"' EXIT
+
+echo "Fetching pdf.js v${PDFJS_VERSION} ..."
+curl -fSL "$ZIP_URL" -o "$TMP_ZIP"
+
+if [ -n "$PDFJS_SHA256" ]; then
+  echo "${PDFJS_SHA256}  ${TMP_ZIP}" | sha256sum -c -
+fi
+
+rm -rf "$DIST_DIR"
+mkdir -p "$DIST_DIR"
+unzip -q "$TMP_ZIP" -d "$DIST_DIR"
+# Sanity: the viewer the app points to must exist.
+test -f "${DIST_DIR}/web/viewer.html" || { echo "ERROR: web/viewer.html missing from dist"; exit 1; }
+echo "pdf.js dist ready at ${DIST_DIR} (web/viewer.html present)."

static/pdfjs/pdfjs-nginx.conf

@@ -0,0 +1,12 @@
+# Mozilla pdf.js viewer (ADFA-4708) — static assets served directly by nginx on :8085.
+# Enables viewing PDFs INSIDE the portal WebView (which has no built-in PDF viewer):
+# the app routes a PDF to http://localhost:8085/pdfjs/web/viewer.html?file=<pdf url>.
+# Same origin as the box's own PDFs, so it works fully offline (no CORS / mixed-content).
+#
+# Unlike k2go-docs this is infrastructure that is ALWAYS present (not hidden-until-content):
+# the viewer must resolve for the feature to work. The dist ships web/ and build/ at the root.
+location ^~ /pdfjs/ {
+    alias /library/www/html/pdfjs/;
+    autoindex off;
+    index web/viewer.html;
+}