# Issue Description

> This fix resolves the fundamental infrastructure issues that were preventing the workflow PDF display feature from functioning properly.

- Skill: `tools-only/issue-description` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tools-only/issue-description`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/issue-description/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-29
- Page: https://skillmd.com/skills/tools-only/issue-description

---

# WORKFLOW_PDF_IFRAME_CSP_FIX

**Fixed in version:** 0.230.001

## Issue Description

The workflow feature encountered two critical issues preventing PDF iframe display:

1. **CSP Frame-Ancestors Violation**: The main application's Content Security Policy had `frame-ancestors 'none'` which blocked ALL iframe embedding, including same-origin iframes needed for PDF display in the workflow.

2. **Backend Blob Name Error**: The `serve_workflow_pdf_content` function was directly accessing `raw_doc['blob_name']` which doesn't exist in the document structure, causing a `'blob_name'` KeyError.

## Root Cause Analysis

### CSP Issue
- **Problem**: Main CSP configuration in `config.py` set `frame-ancestors 'none'`
- **Impact**: Prevented PDF iframe embedding even from same origin
- **Error**: `Refused to frame 'https://127.0.0.1:5000/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"`

### Blob Name Issue  
- **Problem**: Direct access to non-existent `raw_doc['blob_name']` field
- **Impact**: Backend error preventing PDF serving: `Error serving workflow PDF: 'blob_name'`
- **Root Cause**: Document structure from database doesn't contain a `blob_name` field; blob name must be constructed from workspace type and file metadata

## Technical Solution

### 1. CSP Frame-Ancestors Fix
**File**: `config.py`

**Before**:
```python
"frame-ancestors 'none'; "
```

**After**:
```python
"frame-ancestors 'self'; "
```

**Impact**: Allows iframe embedding from same origin while maintaining security.

### 2. Blob Name Generation Fix
**File**: `route_enhanced_citations.py`

**Before** (problematic approach):
```python
# Direct access to non-existent field
scope = raw_doc.get('scope', 'personal') 
blob_name = raw_doc['blob_name']  # KeyError!
```

**After** (proper approach):
```python
# Use existing workspace detection and blob name generation
workspace_type, container_name = determine_workspace_type_and_container(raw_doc)
blob_name = get_blob_name(raw_doc, workspace_type)
```

### 3. Enhanced Debug Logging
Added comprehensive logging to track workspace detection:
```python
debug_print(f"Using workspace_type: {workspace_type}, container: {container_name}, blob_name: {blob_name}")
```

## Code Changes Summary

### Files Modified
1. **config.py**: Updated main CSP to allow same-origin iframe embedding
2. **route_enhanced_citations.py**: Fixed blob name generation in `serve_workflow_pdf_content`

### Functions Enhanced
- `serve_workflow_pdf_content()`: Now uses proper workspace detection and blob name generation

## Testing Validation

### Test Coverage
- ✅ Main CSP allows iframe embedding for same origin
- ✅ Workflow PDF function uses proper workspace detection  
- ✅ Blob name generation works correctly for all workspace types
- ✅ Enhanced debug logging provides troubleshooting details
- ✅ Version updated to track fix implementation

### Test Results
All 4/4 tests passed, confirming complete fix implementation.

## User Experience Impact

### Before Fix
- **PDF Display**: Failed with CSP violations and backend errors
- **Error Messages**: Cryptic blob_name errors in logs
- **Functionality**: Workflow PDF viewing completely broken

### After Fix  
- **PDF Display**: Works seamlessly in iframe without CSP violations
- **Error Handling**: Proper workspace detection prevents blob name errors
- **Functionality**: Complete workflow PDF viewing capability restored

## Security Considerations

### CSP Update Impact
- **Security Level**: Maintained (only allows same-origin framing)
- **Attack Vector**: No increase in risk (iframe embedding limited to same domain)
- **Best Practice**: Follows iframe security standards for single-page applications

### Blob Storage Access
- **Authentication**: Unchanged (still uses existing user authentication)
- **Authorization**: Unchanged (workspace permissions still enforced)
- **Data Access**: Proper workspace boundary enforcement maintained

## Deployment Notes

### Immediate Benefits
- Workflow PDF iframe display works without errors
- Proper error handling and debugging capabilities
- Consistent blob storage access patterns across the application

### Compatibility
- **Backward Compatible**: No breaking changes to existing functionality
- **Forward Compatible**: Uses established patterns from other parts of the application
- **Cross-Platform**: Works consistently across all deployment environments

## Related Components

### Dependencies
- Enhanced citations system
- Blob storage client infrastructure
- Workspace management system
- Document metadata structure

### Integration Points  
- Document APIs for metadata retrieval
- Blob storage for PDF content serving
- CSP security framework
- Workflow frontend templates

## Monitoring and Validation

### Success Indicators
- PDF iframe displays without CSP errors
- Backend logs show successful workspace detection
- No blob_name KeyError exceptions
- Workflow functionality operates smoothly

### Troubleshooting
- Check browser console for CSP violations (should be none)
- Verify backend logs show workspace detection details
- Confirm blob name generation follows expected patterns
- Validate iframe embedding works across different document types

This fix resolves the fundamental infrastructure issues that were preventing the workflow PDF display feature from functioning properly.