Private
Public Access
ksmithandClaude Sonnet 5
73020fa39f
Extends the existing fetch-and-bypass-Content-Disposition pattern already used for text/markdown previews: the PDF's bytes are fetched into a Blob and handed to the browser's native viewer via a blob: URL, which carries no HTTP headers of its own. That sidesteps Content-Disposition: attachment the same way a script-initiated fetch() already does for text, without needing an <iframe>/<embed> to navigate to the real file URL directly (which would respect that header and force a download) -- and without the backend allowlist endpoint this issue's original scoping assumed would be necessary. MIME type is forced to application/pdf explicitly rather than trusted from the upload, since getPreviewKind gates on the .pdf extension alone (matching its existing behavior for .md/.txt), so a mislabeled file still renders instead of downloading or erroring. Object URLs are revoked on unmount/file-change to avoid leaking memory. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>