Handle large notes and add direct export

Author: Marc Schlaeppi

source/app/blueprints/pages/case/templates/case_notes_v2.html

@@ -87,7 +87,7 @@ <h4 class="page-title mb-0" id="currentNoteTitle"></h4>
 										<i class="fa-brands fa-markdown mr-2"></i>
 									</span>
 								</button>
-								<button type="button" class="btn bg-transparent btn-xs" onclick="download_note();return false;" title="Download as MD">
+								<button type="button" class="btn bg-transparent btn-xs" onclick="download_note();return false;" title="Export note as Markdown" aria-label="Export note as Markdown">
 									<span class="btn-label">
 										<i class="fa-solid fa-download mr-2"></i>
 									</span>

source/app/blueprints/rest/case/case_notes_routes.py

@@ -16,10 +16,14 @@
 #  along with this program; if not, write to the Free Software Foundation,
 #  Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
+import io
+
 from marshmallow import ValidationError
 from datetime import datetime
 from flask import Blueprint
 from flask import request
+from flask import send_file
+from werkzeug.utils import secure_filename
 
 from app.db import db
 from app import app
@@ -62,6 +66,14 @@
 case_notes_rest_blueprint = Blueprint('case_notes_rest', __name__)
 
 
+def _note_export_filename(title, note_id):
+    safe_title = secure_filename(title or '')
+    if safe_title.lower().endswith('.md'):
+        safe_title = safe_title[:-3]
+    safe_title = safe_title[:120].rstrip('._-') or f'note-{note_id}'
+    return f'{safe_title}.md'
+
+
 @case_notes_rest_blueprint.route('/case/notes/<int:cur_id>', methods=['GET'])
 @endpoint_deprecated('GET', '/api/v2/cases/{case_identifier}/notes/{identifier}')
 @ac_requires_case_identifier(CaseAccessLevel.read_only, CaseAccessLevel.full_access)
@@ -112,6 +124,28 @@ def case_note_detail(cur_id, caseid):
         return response_error(msg="Data error", data=e.messages)
 
 
+@case_notes_rest_blueprint.route('/case/notes/<int:cur_id>/export', methods=['GET'])
+@ac_requires_case_identifier(CaseAccessLevel.read_only, CaseAccessLevel.full_access)
+@ac_api_requires()
+def case_note_export(cur_id, caseid):
+    note = get_note(cur_id)
+    if not note or note.note_case_id != caseid:
+        return response_error(msg="Invalid note ID")
+
+    content = (note.note_content or '').encode('utf-8')
+    response = send_file(
+        io.BytesIO(content),
+        mimetype='text/markdown; charset=utf-8',
+        as_attachment=True,
+        download_name=_note_export_filename(note.note_title, note.note_id),
+        max_age=0,
+    )
+    response.cache_control.no_store = True
+    response.cache_control.private = True
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    return response
+
+
 @case_notes_rest_blueprint.route('/case/notes/delete/<int:cur_id>', methods=['POST'])
 @endpoint_deprecated('DELETE', '/api/v2/cases/{case_identifier}/notes/{identifier}')
 @ac_requires_case_identifier(CaseAccessLevel.full_access)

tests/tests_rest_notes.py

@@ -131,6 +131,50 @@ def test_get_note_should_return_404_when_case_does_not_exist(self):
         response = self._subject.get(f'/api/v2/cases/{_IDENTIFIER_FOR_NONEXISTENT_OBJECT}/notes/{identifier}')
         self.assertEqual(404, response.status_code)
 
+    def test_export_note_should_return_original_markdown_as_attachment(self):
+        case_identifier = self._subject.create_dummy_case()
+        directory = self._subject.create(
+            f'/api/v2/cases/{case_identifier}/notes-directories',
+            {'name': 'directory_name'}
+        ).json()
+        markdown = '# Findings\n\nExact note content.\n'
+        note = self._subject.create(
+            f'/api/v2/cases/{case_identifier}/notes',
+            {
+                'directory_id': directory['id'],
+                'note_title': 'SecureDocs.ps1',
+                'note_content': markdown,
+            }
+        ).json()
+
+        response = self._subject.get(
+            f'/case/notes/{note["note_id"]}/export',
+            query_parameters={'cid': case_identifier}
+        )
+
+        self.assertEqual(200, response.status_code)
+        self.assertEqual(markdown.encode('utf-8'), response.content)
+        self.assertIn('attachment', response.headers['Content-Disposition'])
+        self.assertIn('SecureDocs.ps1.md', response.headers['Content-Disposition'])
+        self.assertTrue(response.headers['Content-Type'].startswith('text/markdown'))
+        self.assertEqual('nosniff', response.headers['X-Content-Type-Options'])
+
+    def test_export_note_should_deny_user_without_case_access(self):
+        case_identifier = self._subject.create_dummy_case()
+        directory = self._subject.create(
+            f'/api/v2/cases/{case_identifier}/notes-directories',
+            {'name': 'directory_name'}
+        ).json()
+        note = self._subject.create(
+            f'/api/v2/cases/{case_identifier}/notes',
+            {'directory_id': directory['id']}
+        ).json()
+        user = self._subject.create_dummy_user()
+
+        response = user.get(f'/case/notes/{note["note_id"]}/export?cid={case_identifier}')
+
+        self.assertEqual(403, response.status_code)
+
     def test_update_note_should_return_200(self):
         case_identifier = self._subject.create_dummy_case()
         response = self._subject.create(f'/api/v2/cases/{case_identifier}/notes-directories',

ui/src/lib/large_document.js

@@ -0,0 +1,22 @@
+export const LARGE_DOCUMENT_MAX_CHARS = 1_000_000;
+export const LARGE_DOCUMENT_MAX_LINE_CHARS = 100_000;
+
+export function getLargeDocumentReason(markdown) {
+    const content = typeof markdown === 'string' ? markdown : '';
+    if (content.length > LARGE_DOCUMENT_MAX_CHARS) {
+        return 'document-size';
+    }
+
+    let lineLength = 0;
+    for (let index = 0; index < content.length; index += 1) {
+        if (content.charCodeAt(index) === 10) {
+            lineLength = 0;
+            continue;
+        }
+        lineLength += 1;
+        if (lineLength > LARGE_DOCUMENT_MAX_LINE_CHARS) {
+            return 'line-length';
+        }
+    }
+    return null;
+}

ui/src/lib/milkdown_overrides.css

@@ -474,6 +474,30 @@
     box-shadow: none;
 }
 
+.iris-view-toggle button:disabled {
+    cursor: not-allowed;
+    opacity: 0.45;
+}
+
+.iris-view-toggle button:disabled:hover {
+    background: transparent;
+    color: #5f6368;
+}
+
+.iris-source-only-status {
+    display: inline-flex;
+    align-items: center;
+    margin-left: 10px;
+    color: #5f6368;
+    font-size: 11px;
+    font-weight: 600;
+    line-height: 1;
+}
+
+.iris-split-shell[data-theme="dark"] .iris-source-only-status {
+    color: #8b92a9;
+}
+
 /* ---- 10. View-mode pane visibility overrides ------------------------------ */
 .iris-split.view-source > .iris-split-pane.iris-split-preview,
 .iris-split.view-preview > .iris-split-pane.iris-split-source {

ui/src/pages/case.notes.js

@@ -916,18 +916,20 @@ async function load_directories() {
         });
 }
 
-function download_note() {
-    // Use the content of whichever editor is currently active (ACE or Milkdown)
-    let content = get_active_note_markdown();
-    let filename = $('#currentNoteTitle').text() + '.md';
-    let blob = new Blob([content], {type: 'text/plain'});
-    let url = window.URL.createObjectURL(blob);
-
-    // Create a link to the file and click it to download it
+function download_note(noteId) {
+    const activeNoteId = $('#currentNoteIDLabel').data('note_id');
+    const targetNoteId = noteId || activeNoteId;
+    if (!targetNoteId) {
+        return false;
+    }
+
     let link = document.createElement('a');
-    link.href = url;
-    link.download = filename;
+    link.href = `/case/notes/${encodeURIComponent(targetNoteId)}/export${case_param()}`;
+    link.hidden = true;
+    document.body.appendChild(link);
     link.click();
+    link.remove();
+    return false;
 }
 
 function add_note(directory_id) {
@@ -1345,6 +1347,14 @@ function createDirectoryListItem(directory, directoryMap) {
                     copy_object_link_md('notes',note.id);
                 }));
 
+                menu.append($('<a></a>').addClass('dropdown-item').attr('href', '#')
+                    .append($('<i></i>').addClass('fa-solid fa-download mr-2'))
+                    .append(document.createTextNode('Export note'))
+                    .on('click', function (e) {
+                        e.preventDefault();
+                        download_note(note.id);
+                    }));
+
                 menu.append($('<a></a>').addClass('dropdown-item').attr('href', '#').text('Move').on('click', function (e) {
                     e.preventDefault();
                     move_item(note.id, 'note');