Issue Description

WORKFLOW_PDF_IFRAME_CSP_FIX

Fixed in version: 0.230.001

Issue Description

The workflow feature encountered two critical issues preventing PDF iframe display:

1. CSP Frame-Ancestors Violation: The main application's Content Security Policy had frame-ancestors 'none' which blocked ALL iframe embedding, including same-origin iframes needed for PDF display in the workflow.

2. Backend Blob Name Error: The serve_workflow_pdf_content function was directly accessing raw_doc['blob_name'] which doesn't exist in the document structure, causing a 'blob_name' KeyError.

Root Cause Analysis

CSP Issue

• Problem: Main CSP configuration in config.py set frame-ancestors 'none'
• Impact: Prevented PDF iframe embedding even from same origin
• Error: Refused to frame 'https://127.0.0.1:5000/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"

Blob Name Issue

• Problem: Direct access to non-existent raw_doc['blob_name'] field
• Impact: Backend error preventing PDF serving: Error serving workflow PDF: 'blob_name'
• Root Cause: Document structure from database doesn't contain a blob_name field; blob name must be constructed from workspace type and file metadata

Technical Solution

1. CSP Frame-Ancestors Fix

File: config.py

Before:

"frame-ancestors 'none'; "

After:

"frame-ancestors 'self'; "

Impact: Allows iframe embedding from same origin while maintaining security.

2. Blob Name Generation Fix

File: route_enhanced_citations.py

Before (problematic approach):

# Direct access to non-existent field
scope = raw_doc.get('scope', 'personal') 
blob_name = raw_doc['blob_name']  # KeyError!

After (proper approach):

# Use existing workspace detection and blob name generation
workspace_type, container_name = determine_workspace_type_and_container(raw_doc)
blob_name = get_blob_name(raw_doc, workspace_type)

3. Enhanced Debug Logging

Added comprehensive logging to track workspace detection:

debug_print(f"Using workspace_type: {workspace_type}, container: {container_name}, blob_name: {blob_name}")

Code Changes Summary

Files Modified

1. config.py: Updated main CSP to allow same-origin iframe embedding
2. route_enhanced_citations.py: Fixed blob name generation in serve_workflow_pdf_content

Functions Enhanced

• serve_workflow_pdf_content(): Now uses proper workspace detection and blob name generation

Testing Validation

Test Coverage

• ✅ Main CSP allows iframe embedding for same origin
• ✅ Workflow PDF function uses proper workspace detection
• ✅ Blob name generation works correctly for all workspace types
• ✅ Enhanced debug logging provides troubleshooting details
• ✅ Version updated to track fix implementation

Test Results

All 4/4 tests passed, confirming complete fix implementation.

User Experience Impact

Before Fix

• PDF Display: Failed with CSP violations and backend errors
• Error Messages: Cryptic blob_name errors in logs
• Functionality: Workflow PDF viewing completely broken

After Fix

• PDF Display: Works seamlessly in iframe without CSP violations
• Error Handling: Proper workspace detection prevents blob name errors
• Functionality: Complete workflow PDF viewing capability restored

Security Considerations

CSP Update Impact

• Security Level: Maintained (only allows same-origin framing)
• Attack Vector: No increase in risk (iframe embedding limited to same domain)
• Best Practice: Follows iframe security standards for single-page applications

Blob Storage Access

• Authentication: Unchanged (still uses existing user authentication)
• Authorization: Unchanged (workspace permissions still enforced)
• Data Access: Proper workspace boundary enforcement maintained

Deployment Notes

Immediate Benefits

• Workflow PDF iframe display works without errors
• Proper error handling and debugging capabilities
• Consistent blob storage access patterns across the application

Compatibility

• Backward Compatible: No breaking changes to existing functionality
• Forward Compatible: Uses established patterns from other parts of the application
• Cross-Platform: Works consistently across all deployment environments

Related Components

Dependencies

• Enhanced citations system
• Blob storage client infrastructure
• Workspace management system
• Document metadata structure

Integration Points

• Document APIs for metadata retrieval
• Blob storage for PDF content serving
• CSP security framework
• Workflow frontend templates

Monitoring and Validation

Success Indicators

• PDF iframe displays without CSP errors
• Backend logs show successful workspace detection
• No blob_name KeyError exceptions
• Workflow functionality operates smoothly

Troubleshooting

• Check browser console for CSP violations (should be none)
• Verify backend logs show workspace detection details
• Confirm blob name generation follows expected patterns
• Validate iframe embedding works across different document types

This fix resolves the fundamental infrastructure issues that were preventing the workflow PDF display feature from functioning properly.