fix: harden pdf.js worker copy and drop ineffective CSP directive

Author: Oct4Pie

public/index.html

@@ -14,7 +14,8 @@
       All file processing happens client-side; the only outbound traffic is
       Google Fonts (CSS + woff2/ttf) used for the UI and the PDF generator.
     -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob:; connect-src 'self' https://fonts.gstatic.com; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" />
+    <!-- frame-ancestors is intentionally omitted; browsers ignore it in <meta> CSP. -->
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob:; connect-src 'self' https://fonts.gstatic.com; worker-src 'self' blob:; base-uri 'self'; form-action 'self'" />
     <!-- Google Fonts -->
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

scripts/copy-pdf-worker.js

@@ -1,26 +1,54 @@
 // Copies the pdf.js worker into public/ at build/dev time so the app can serve
 // it from its own origin instead of pulling it from a CDN at runtime.
+//
+// pdfjs-dist's layout has shifted across major versions, so we discover
+// whatever pdf.worker.* file exists rather than hardcoding one name.
 const fs = require('fs');
 const path = require('path');
 
-const candidates = [
-  'pdf.worker.min.mjs',
-  'pdf.worker.mjs',
-  'pdf.worker.min.js',
-  'pdf.worker.js',
+const root = path.join(__dirname, '..');
+const searchDirs = [
+  path.join(root, 'node_modules', 'pdfjs-dist', 'build'),
+  path.join(root, 'node_modules', 'pdfjs-dist', 'legacy', 'build'),
 ];
 
-const fromDir = path.join(__dirname, '..', 'node_modules', 'pdfjs-dist', 'build');
-const toDir = path.join(__dirname, '..', 'public');
+// Higher = better. We prefer the minified .mjs, then any .mjs, then .min.js,
+// then .js. Only files starting with `pdf.worker` are considered.
+function score(name) {
+  if (!name.startsWith('pdf.worker')) return -1;
+  if (name.endsWith('.min.mjs')) return 4;
+  if (name.endsWith('.mjs')) return 3;
+  if (name.endsWith('.min.js')) return 2;
+  if (name.endsWith('.js')) return 1;
+  return 0;
+}
+
+let best = null;
+for (const dir of searchDirs) {
+  if (!fs.existsSync(dir)) continue;
+  for (const name of fs.readdirSync(dir)) {
+    const s = score(name);
+    if (s <= 0) continue;
+    if (!best || s > best.score) {
+      best = { dir, name, score: s };
+    }
+  }
+}
 
-const found = candidates.find((name) => fs.existsSync(path.join(fromDir, name)));
-if (!found) {
-  console.error('[copy-pdf-worker] no pdf.worker.* found in', fromDir);
+if (!best) {
+  console.error(
+    '[copy-pdf-worker] could not find pdf.worker.* in any of:\n  ' +
+      searchDirs.join('\n  ') +
+      '\nIs pdfjs-dist installed?'
+  );
   process.exit(1);
 }
 
-const src = path.join(fromDir, found);
-const dst = path.join(toDir, found);
-fs.mkdirSync(toDir, { recursive: true });
+const dstDir = path.join(root, 'public');
+// Always write to a deterministic name; runtime references this exact path.
+const dstName = 'pdf.worker.mjs';
+const src = path.join(best.dir, best.name);
+const dst = path.join(dstDir, dstName);
+fs.mkdirSync(dstDir, { recursive: true });
 fs.copyFileSync(src, dst);
-console.log(`[copy-pdf-worker] ${src} -> ${dst}`);
+console.log(`[copy-pdf-worker] ${path.relative(root, src)} -> ${path.relative(root, dst)}`);

src/hooks/usePdfHandler.js

@@ -12,9 +12,7 @@ import { extractAndMergeColors } from '../utils/colorExtractor';
 
 // Use the worker copied to public/ at build time (see scripts/copy-pdf-worker.js)
 // so the app doesn't depend on a third-party CDN at runtime.
-const WORKER_BASENAME = 'pdf.worker.min.mjs';
-const WORKER_PUBLIC_PATH = `${process.env.PUBLIC_URL || ''}/${WORKER_BASENAME}`;
-pdfjsLib.GlobalWorkerOptions.workerSrc = WORKER_PUBLIC_PATH;
+pdfjsLib.GlobalWorkerOptions.workerSrc = `${process.env.PUBLIC_URL || ''}/pdf.worker.mjs`;
 
 // Maximum file size allowed (25MB)
 const MAX_FILE_SIZE = 25 * 1024 * 1024;