Skip to content

feat: file viewer#87

Merged
tractorss merged 9 commits into
mainfrom
feat/file-viewer
May 30, 2026
Merged

feat: file viewer#87
tractorss merged 9 commits into
mainfrom
feat/file-viewer

Conversation

@kemuru

@kemuru kemuru commented May 1, 2026

Copy link
Copy Markdown
Contributor

after confirmed, this package needs NPM deployment to version 3.8.0

then 5 frontends were updated to use this newer version: scout, gtcr, kleros-v2, escrow-v2, curate-v2

added a dark mode style too, especially useful for pngs background so it looks better depending on the theme of the app.

security, what was done:

  • Block unsafe URLs in FileViewer — only http(s):, blob:, and safe data: URIs render; javascript:, vbscript:, file:, and script-y data: MIMEs (html, svg, xml/xhtml) show a fallback instead. Closes an XSS vector on the new "open in new tab" link.
  • Add a NoRendererFallback with a download link for file types doc-viewer can't preview (.json, .zip, …) instead of doc-viewer's blank default.
  • Storybook stories covering every blocked scheme + the no-renderer case.

PR-Codex overview

This PR primarily introduces a new FileViewer component that supports rendering various file types, including SVG and Markdown, while enhancing security against potential script execution vulnerabilities.

Detailed summary

  • Added FileViewer component in src/lib/file-viewer.
  • Introduced SvgDocRenderer for SVG files.
  • Introduced MarkdownDocRenderer for Markdown files.
  • Updated package.json to version 3.8.0 and added new dependencies.
  • Added new theme variable --klerosUIComponentsImageCheckerColor in theme.css.
  • Updated storybook stories for FileViewer.

The following files were skipped due to too many changes: yarn.lock

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Summary by CodeRabbit

  • New Features

    • Enhanced File Viewer: safer URL handling with explicit fallbacks for blocked/unsupported schemes, improved PDF rendering, and ability to configure the PDF worker.
    • Markdown and plain-text files now render as styled, readable documents.
  • Documentation / Examples

    • Expanded Storybook with many File Viewer scenarios demonstrating blocked schemes and varied data URLs.
  • Chores

    • Library version bumped to 3.8.0.
    • .gitignore updated to ignore generated package tarballs (*.tgz).

@netlify

netlify Bot commented May 1, 2026

Copy link
Copy Markdown

Deploy Preview for kleros-v2-ui-storybook ready!

Name Link
🔨 Latest commit 1f54562
🔍 Latest deploy log https://app.netlify.com/projects/kleros-v2-ui-storybook/deploys/6a0c28cdf7e423000830b8ff
😎 Deploy Preview https://deploy-preview-87--kleros-v2-ui-storybook.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@coderabbitai

coderabbitai Bot commented May 1, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Adds a FileViewer component with URL safety checks, PDF.js worker setup and override, a Markdown renderer, runtime dependency additions and version bump, expanded Storybook stories covering blocked/unsupported inputs, and re-exports FileViewer and configurePdfWorker from the library barrel.

Changes

FileViewer feature + runtime deps

Layer / File(s) Summary
Dependencies & repo ignore
package.json, .gitignore
Bump package version 3.7.03.8.0; add runtime dependencies @cyntler/react-doc-viewer and react-markdown; add .gitignore rule to ignore *.tgz.
URL safety checks & fallbacks
src/lib/file-viewer/index.tsx
Add isSafeUrl(raw: string) that allowlists schemes and rejects unsafe data: MIME types; introduce UnsupportedUrlMessage and NoRendererFallback UI for blocked/unsupported inputs.
PDF.js worker boot/config
src/lib/file-viewer/index.tsx
At module init read globalThis.pdfjsLib to build and set a version-pinned GlobalWorkerOptions.workerSrc; export configurePdfWorker(src: string) to override worker URL globally.
Viewer wiring & config merging
src/lib/file-viewer/index.tsx
Default-export FileViewer with props { url, fileName?, config?, className? }; memoize documents, append local MarkdownDocRenderer to pluginRenderers, shallow-merge caller config over defaults while ensuring noRenderer.overrideComponent falls back to NoRendererFallback, and conditionally render DocViewer or unsupported message.
Markdown renderer plugin
src/lib/file-viewer/markdown-viewer.tsx
Add MarkdownDocRenderer (default export) for md and text/plain; decode ArrayBuffer/data: base64 or percent-encoded payloads into UTF‑8 text and render via react-markdown. Exposes fileTypes = ["md","text/plain"] and weight = 1.
Barrel export & Storybook coverage
src/lib/index.ts, src/stories/file-viewer.stories.tsx
Re-export default as FileViewer and configurePdfWorker from ../lib/file-viewer; expand stories with PDF/image examples and many blocked/unsupported url variants (javascript:, vbscript:, file://, various data: MIME cases, unsupported file type example).
sequenceDiagram
  participant Storybook as rgba(135,206,235,0.5)
  participant FileViewer as rgba(144,238,144,0.5)
  participant DocViewer as rgba(255,182,193,0.5)
  participant GlobalPdfJs as rgba(255,228,181,0.5)

  Storybook->>FileViewer: render(url, fileName?, config?)
  FileViewer->>FileViewer: isSafeUrl(url)
  alt safe
    FileViewer->>GlobalPdfJs: ensure/set workerSrc (module init or configurePdfWorker)
    FileViewer->>DocViewer: provide docs, pluginRenderers (incl. Markdown)
    DocViewer-->>FileViewer: rendered UI
  else blocked/unsupported
    FileViewer-->>Storybook: render UnsupportedUrlMessage / NoRendererFallback
  end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

I’m a rabbit with a tiny quill,
I hopped and wired the viewer still.
I guard the links and tune the thread,
Markdown blooms and PDFs are fed.
🐰✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title 'feat: file viewer' is concise and directly summarizes the main change (adding a new FileViewer component), though it could be more specific about the scope.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/file-viewer

Comment @coderabbitai help to get the list of available commands and usage tips.

@kemuru
kemuru requested a review from tractorss May 1, 2026 19:14

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1


ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6ef2e95a-52e0-4a1a-a4af-09ac37cc1090

📥 Commits

Reviewing files that changed from the base of the PR and between 407e2f3 and c1f2124.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (7)
  • .gitignore
  • package.json
  • src/lib/file-viewer/index.tsx
  • src/lib/file-viewer/markdown-viewer.tsx
  • src/lib/file-viewer/styles.css
  • src/lib/index.ts
  • src/stories/file-viewer.stories.tsx

Comment thread src/lib/file-viewer/markdown-viewer.tsx Outdated
@kemuru
kemuru marked this pull request as draft May 1, 2026 19:20
Comment thread src/lib/file-viewer/index.tsx Outdated
Comment thread src/lib/file-viewer/index.tsx Outdated
Comment thread src/lib/file-viewer/index.tsx Outdated
Comment thread src/lib/file-viewer/styles.css Outdated
Comment thread .gitignore

@tractorss tractorss left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looking good, left a couple of comments 🙌

coderabbitai[bot]
coderabbitai Bot previously approved these changes May 11, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/file-viewer/markdown-viewer.tsx`:
- Around line 21-27: The data: URI handling in markdown-viewer.tsx currently
always attempts base64 decode; change the logic in the block handling
fileData.startsWith("data:") to inspect the metadata portion (the part before
the first comma) for the ";base64" parameter and only call
decodeBase64Utf8(payload) when that parameter is present; otherwise call
decodeURIComponent(payload). Locate the parsing near the
fileData.startsWith("data:") check and update the branch that assigns to text so
it checks the metadata string (from start of the data: header up to the comma)
for ";base64" before choosing between decodeBase64Utf8 and decodeURIComponent.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d3139612-82a4-41db-916a-06e69c59d261

📥 Commits

Reviewing files that changed from the base of the PR and between c1f2124 and c1d83a4.

📒 Files selected for processing (4)
  • .gitignore
  • src/lib/file-viewer/index.tsx
  • src/lib/file-viewer/markdown-viewer.tsx
  • src/stories/file-viewer.stories.tsx
✅ Files skipped from review due to trivial changes (2)
  • .gitignore
  • src/stories/file-viewer.stories.tsx
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/lib/file-viewer/index.tsx

Comment thread src/lib/file-viewer/markdown-viewer.tsx
@kemuru
kemuru requested a review from tractorss May 13, 2026 01:38
@kemuru
kemuru marked this pull request as ready for review May 13, 2026 01:38

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/file-viewer/markdown-viewer.tsx`:
- Around line 32-36: The current catch block sets text = "" on decode failures
which hides all content; instead, on error keep a lossy-but-visible fallback by
assigning the raw payload (or the raw base64 string) to text so the viewer can
display or allow download; update the catch to set text = payload (using the
existing variables isBase64, payload and the decode helpers
decodeBase64Utf8/decodeURIComponent) and optionally annotate or attempt a
best-effort fallback display rather than clearing text.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7e766754-895b-408e-b861-b08847679393

📥 Commits

Reviewing files that changed from the base of the PR and between e2990a4 and 0fc501c.

📒 Files selected for processing (1)
  • src/lib/file-viewer/markdown-viewer.tsx

Comment thread src/lib/file-viewer/markdown-viewer.tsx
coderabbitai[bot]
coderabbitai Bot previously approved these changes May 13, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes May 13, 2026

@tractorss tractorss left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

left few more comments

Comment thread src/lib/file-viewer/file-viewer.css Outdated
Comment thread src/lib/file-viewer/index.tsx Outdated
Comment thread src/lib/file-viewer/index.tsx Outdated
Comment thread src/lib/file-viewer/index.tsx
Comment thread src/lib/file-viewer/markdown-viewer.tsx Outdated
@kemuru
kemuru requested a review from tractorss May 19, 2026 09:09
@sonarqubecloud

Copy link
Copy Markdown

@tractorss tractorss left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tractorss
tractorss merged commit b5d2b6c into main May 30, 2026
8 checks passed
@tractorss
tractorss deleted the feat/file-viewer branch May 30, 2026 09:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants