@stamhoofd/backend 2.137.3 → 2.137.5

package/src/services/EmailPreviewService.test.ts

@@ -0,0 +1,300 @@
+import { I18n } from '@stamhoofd/backend-i18n/I18n';
+import type { Member, Organization, RegistrationPeriod, User } from '@stamhoofd/models';
+import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
+import { EmailContent, EmailStatus, Replacement } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { Country } from '@stamhoofd/types/Country';
+import { Language } from '@stamhoofd/types/Language';
+import { EmailPreviewService } from './EmailPreviewService.js';
+
+describe('EmailPreviewService', () => {
+    let period: RegistrationPeriod;
+    let organization: Organization;
+    let user: User;
+    let member: Member;
+
+    beforeAll(async () => {
+        TestUtils.setPermanentEnvironment('userMode', 'platform');
+
+        period = await new RegistrationPeriodFactory({
+            startDate: new Date(2023, 0, 1),
+            endDate: new Date(2023, 11, 31),
+        }).create();
+
+        organization = await new OrganizationFactory({ period }).create();
+
+        user = await new UserFactory({ organization }).create();
+        member = await new MemberFactory({ organization, user }).create();
+    });
+
+    afterEach(async () => {
+        await Email.delete();
+    });
+
+    /**
+     * A sent email that is visible in the member portal.
+     */
+    const createSentEmail = async (data: { html: string; text?: string; subject?: string } & Partial<Email>) => {
+        const email = new Email();
+        email.subject = data.subject ?? 'Test subject';
+        email.status = EmailStatus.Sent;
+        email.html = data.html;
+        email.text = data.text ?? 'Test text';
+        email.json = {};
+        email.language = data.language ?? null;
+        email.translations = data.translations ?? new Map();
+        email.organizationId = organization.id;
+        email.showInMemberPortal = true;
+        email.sentAt = new Date();
+        await email.save();
+        return email;
+    };
+
+    const createRecipient = async (email: Email, data: Partial<EmailRecipient> & { memberId: string }) => {
+        const recipient = new EmailRecipient();
+        recipient.emailId = email.id;
+        recipient.memberId = data.memberId;
+        recipient.userId = data.userId ?? null;
+        recipient.email = data.email ?? null;
+        recipient.firstName = data.firstName ?? 'Test';
+        recipient.lastName = data.lastName ?? 'Test';
+        recipient.language = data.language ?? null;
+        recipient.replacements = data.replacements ?? [];
+        recipient.sentAt = new Date();
+        await recipient.save();
+        return recipient;
+    };
+
+    describe('getStructureForUser', () => {
+        test('strips the sensitive replacements that were stored for another recipient', async () => {
+            // The signInUrl of another user is a login link: it may never end up in the structure
+            // that is returned to this user.
+            const secret = 'private-signin-token-67890';
+            const otherUser = await new UserFactory({ organization }).create();
+
+            const email = await createSentEmail({
+                subject: 'Privacy boundary',
+                // The token has to be used in the content, otherwise removeUnusedReplacements
+                // drops it and the leak would not be observable
+                html: '<p>Sign in here: {{signInUrl}}</p>',
+                text: 'Sign in here: {{signInUrl}}',
+            });
+
+            // A recipient of the same member, but belonging to a different user
+            await createRecipient(email, {
+                memberId: member.id,
+                userId: otherUser.id,
+                email: otherUser.email,
+                replacements: [
+                    Replacement.create({
+                        token: 'signInUrl',
+                        value: 'https://example.com/login?token=' + secret,
+                    }),
+                ],
+            });
+
+            const structure = await EmailPreviewService.getStructureForUser(email, user, [member.id]);
+
+            expect(structure.recipients).toHaveLength(1);
+            const recipient = structure.recipients[0];
+
+            // The stored replacements of the other user are gone
+            expect(JSON.stringify(recipient.replacements)).not.toContain(secret);
+
+            // ...and replaced by a sign in url generated for the user that is viewing the email
+            const signInUrl = recipient.replacements.find(r => r.token === 'signInUrl');
+            expect(signInUrl).toBeDefined();
+            expect(signInUrl!.value).toContain(encodeURIComponent(user.email));
+        });
+
+        test('renders the replacements in the language of the recipient, not in the ambient locale', async () => {
+            TestUtils.setEnvironment('locales', { BE: [Language.Dutch, Language.French] });
+
+            // The web greeting is looked up in shared/locales/dist/locales/digit/fr-BE.json,
+            // hardcoded on purpose so we don't verify $t with the same $t machinery we're testing
+            const frenchGreeting = 'Bonjour,';
+
+            const email = await createSentEmail({
+                subject: 'Nederlands onderwerp',
+                html: '<p>{{greeting}} Nederlandse inhoud</p>',
+                text: '{{greeting}} Nederlandse tekst',
+                language: Language.Dutch,
+                translations: new Map([
+                    [Language.French, EmailContent.create({
+                        subject: 'Sujet français',
+                        html: '<p>{{greeting}} Contenu français</p>',
+                        text: 'Texte français',
+                    })],
+                ]),
+            });
+
+            await createRecipient(email, {
+                memberId: member.id,
+                userId: user.id,
+                email: user.email,
+                language: Language.French,
+            });
+
+            // The caller is viewing in Dutch, the recipient received the email in French
+            const structure = await I18n.runWithLocale(
+                new I18n(Language.Dutch, Country.Belgium),
+                async () => await EmailPreviewService.getStructureForUser(email, user, [member.id]),
+            );
+
+            expect(structure.recipients).toHaveLength(1);
+            const recipient = structure.recipients[0];
+
+            expect(recipient.language).toBe(Language.French);
+            expect(recipient.replacements.find(r => r.token === 'greeting')?.value).toBe(frenchGreeting);
+            expect(structure.getSubjectFor(recipient)).toBe('Sujet français');
+            expect(structure.getHtmlFor(recipient)).toBe(`<p>${frenchGreeting} Contenu français</p>`);
+        });
+
+        test('merges the recipients of different members when their replacements are equal', async () => {
+            const secondMember = await new MemberFactory({ organization, user }).create();
+
+            const email = await createSentEmail({
+                subject: 'Equal content',
+                html: '<p>Hello {{memberFirstName}}</p>',
+            });
+
+            for (const memberId of [member.id, secondMember.id]) {
+                await createRecipient(email, {
+                    memberId,
+                    userId: user.id,
+                    email: user.email,
+                    replacements: [
+                        Replacement.create({ token: 'memberFirstName', value: 'Same name' }),
+                    ],
+                });
+            }
+
+            const structure = await EmailPreviewService.getStructureForUser(email, user, [member.id, secondMember.id]);
+
+            expect(structure.recipients).toHaveLength(1);
+            expect(structure.recipients[0].replacements.find(r => r.token === 'memberFirstName')?.value).toBe('Same name');
+        });
+
+        test('keeps the recipients of different members separate when their replacements differ', async () => {
+            const secondMember = await new MemberFactory({ organization, user }).create();
+
+            const email = await createSentEmail({
+                subject: 'Different content',
+                html: '<p>Hello {{memberFirstName}}</p>',
+            });
+
+            await createRecipient(email, {
+                memberId: member.id,
+                userId: user.id,
+                email: user.email,
+                replacements: [Replacement.create({ token: 'memberFirstName', value: 'Alice' })],
+            });
+
+            await createRecipient(email, {
+                memberId: secondMember.id,
+                userId: user.id,
+                email: user.email,
+                replacements: [Replacement.create({ token: 'memberFirstName', value: 'Bob' })],
+            });
+
+            const structure = await EmailPreviewService.getStructureForUser(email, user, [member.id, secondMember.id]);
+
+            expect(structure.recipients).toHaveLength(2);
+            const names = structure.recipients.map(r => r.replacements.find(rr => rr.token === 'memberFirstName')?.value);
+            expect(names).toIncludeSameMembers(['Alice', 'Bob']);
+        });
+    });
+
+    describe('getPreviewStructure', () => {
+        test('returns an example recipient for every language of a translated email', async () => {
+            TestUtils.setEnvironment('locales', { BE: [Language.Dutch, Language.French] });
+
+            const email = await createSentEmail({
+                subject: 'Nederlands onderwerp',
+                html: '<p>{{greeting}} Nederlandse inhoud</p>',
+                language: Language.Dutch,
+                translations: new Map([
+                    [Language.French, EmailContent.create({
+                        subject: 'Sujet français',
+                        html: '<p>{{greeting}} Contenu français</p>',
+                        text: 'Texte français',
+                    })],
+                ]),
+            });
+
+            const preview = await EmailPreviewService.getPreviewStructure(email, { allLanguages: true });
+
+            expect(preview.exampleRecipient).not.toBeNull();
+            expect([...preview.exampleRecipients.keys()]).toIncludeSameMembers([Language.Dutch, Language.French]);
+            expect(preview.exampleRecipients.get(Language.French)!.language).toBe(Language.French);
+            expect(preview.exampleRecipients.get(Language.Dutch)!.language).toBe(Language.Dutch);
+
+            // The replacements are regenerated per language, so the greeting differs
+            const dutchGreeting = preview.exampleRecipients.get(Language.Dutch)!.replacements.find(r => r.token === 'greeting')?.value;
+            const frenchGreeting = preview.exampleRecipients.get(Language.French)!.replacements.find(r => r.token === 'greeting')?.value;
+            expect(typeof dutchGreeting).toBe('string');
+            expect(typeof frenchGreeting).toBe('string');
+            expect(frenchGreeting).not.toBe(dutchGreeting);
+        });
+
+        test('returns no per-language example recipients for an email with a single language', async () => {
+            TestUtils.setEnvironment('locales', { BE: [Language.Dutch, Language.French] });
+
+            const email = await createSentEmail({
+                subject: 'Nederlands onderwerp',
+                html: '<p>{{greeting}} Nederlandse inhoud</p>',
+                language: Language.Dutch,
+            });
+
+            const preview = await EmailPreviewService.getPreviewStructure(email, { allLanguages: true });
+
+            expect(preview.exampleRecipient).not.toBeNull();
+            expect(preview.exampleRecipients.size).toBe(0);
+        });
+
+        test('the allLanguages option is not read: the example recipients only depend on the languages of the email', async () => {
+            TestUtils.setEnvironment('locales', { BE: [Language.Dutch, Language.French] });
+
+            const email = await createSentEmail({
+                subject: 'Nederlands onderwerp',
+                html: '<p>{{greeting}} Nederlandse inhoud</p>',
+                language: Language.Dutch,
+                translations: new Map([
+                    [Language.French, EmailContent.create({
+                        subject: 'Sujet français',
+                        html: '<p>{{greeting}} Contenu français</p>',
+                        text: 'Texte français',
+                    })],
+                ]),
+            });
+
+            const withOption = await EmailPreviewService.getPreviewStructure(email, { allLanguages: true });
+            const withoutOption = await EmailPreviewService.getPreviewStructure(email);
+
+            expect([...withOption.exampleRecipients.keys()]).toIncludeSameMembers([Language.Dutch, Language.French]);
+            expect([...withoutOption.exampleRecipients.keys()]).toIncludeSameMembers([Language.Dutch, Language.French]);
+        });
+
+        test('uses a stored recipient as the example recipient when the email has one', async () => {
+            const email = await createSentEmail({
+                subject: 'With a recipient',
+                html: '<p>Hello {{memberFirstName}}</p>',
+            });
+
+            await createRecipient(email, {
+                memberId: member.id,
+                userId: user.id,
+                email: user.email,
+                firstName: 'Stored',
+                lastName: 'Recipient',
+                replacements: [Replacement.create({ token: 'memberFirstName', value: 'Stored' })],
+            });
+
+            const preview = await EmailPreviewService.getPreviewStructure(email, { allLanguages: true });
+
+            expect(preview.exampleRecipient).not.toBeNull();
+            expect(preview.exampleRecipient!.firstName).toBe('Stored');
+            expect(preview.exampleRecipient!.replacements.find(r => r.token === 'memberFirstName')?.value).toBe('Stored');
+        });
+    });
+});

package/src/services/EmailPreviewService.ts

@@ -0,0 +1,239 @@
+import { I18n } from '@stamhoofd/backend-i18n/I18n';
+import type { Email } from '@stamhoofd/models';
+import { EmailRecipient, Organization, User } from '@stamhoofd/models';
+import { fillRecipientReplacements, mergeReplacementsIfEqual, removeUnusedReplacements, runWithRecipientLocale, stripRecipientReplacementsForWebDisplay, stripSensitiveRecipientReplacements } from '@stamhoofd/models/helpers/EmailBuilder.js';
+import type { BaseOrganization, EmailRecipient as EmailRecipientStruct, Replacement, User as UserStruct } from '@stamhoofd/structures';
+import { EmailPreview, EmailRecipientFilter, EmailWithRecipients, getExampleRecipient } from '@stamhoofd/structures';
+import { ExampleReplacements } from '@stamhoofd/structures/email/exampleReplacements.js';
+import type { Language } from '@stamhoofd/types/Language';
+
+/**
+ * Builds the read-only structures of an email: the preview an administrator sees while composing or
+ * browsing emails, and the version of a sent email a user sees in the member portal.
+ */
+export class EmailPreviewService {
+    /**
+     * @param options.allLanguages Also fill exampleRecipients: the same recipient with its
+     * replacements generated in each supported language. Only use this for detail endpoints,
+     * it repeats the replacement queries for every language.
+     */
+    static async getPreviewStructure(email: Email, options: { allLanguages?: boolean } = {}) {
+        const emailRecipient = await EmailRecipient.select()
+            .where('emailId', email.id)
+            .where('email', '!=', null)
+            .first(false);
+
+        let baseRow: EmailRecipientStruct | undefined;
+
+        if (emailRecipient) {
+            baseRow = await emailRecipient.getStructure();
+        }
+
+        if (!baseRow) {
+            baseRow = getExampleRecipient();
+        }
+
+        const organization = email.organizationId ? (await Organization.getByID(email.organizationId))! : null;
+        const allowedLanguages = email.getLanguages();
+
+        const fillRow = async (row: EmailRecipientStruct) => {
+            const virtualRecipient = row.getRecipient();
+
+            await fillRecipientReplacements(virtualRecipient, {
+                organization,
+                from: email.getFromAddress(),
+                replyTo: null,
+                forPreview: true,
+                forceRefresh: !email.sentAt,
+                allowedLanguages,
+            });
+            row.replacements = virtualRecipient.replacements;
+            return row;
+        };
+
+        const recipientRow = await fillRow(baseRow.clone());
+
+        // The same recipient in every supported language: the replacements are regenerated in
+        // each language (the recipient's own language is ignored), so the composer can show
+        // example values in the language that is being edited
+        const exampleRecipients = new Map<Language, EmailRecipientStruct>();
+        if (allowedLanguages && allowedLanguages.length > 1) {
+            // The same country the recipient locale will resolve to (see getRecipientI18n)
+            const country = organization?.address?.country ?? $getCountry();
+            for (const language of allowedLanguages) {
+                const i18n = new I18n(language, country);
+                await I18n.runWithLocale(i18n, async () => {
+                    const clone = baseRow.clone();
+                    clone.language = language;
+
+                    if (baseRow.language !== language) {
+                        // Todo: this can be improved
+                        // Replace all replacements with defaults
+                        for (const replacement of clone.replacements) {
+                            const example: Replacement | undefined = ExampleReplacements.all[replacement.token];
+                            if (example) {
+                                replacement.html = example.html;
+                                replacement.value = example.value;
+                            }
+                        }
+
+                        clone.replacements = clone.replacements.filter(r => !['organizationName'].includes(r.token));
+                    }
+
+                    const rr = await fillRow(clone);
+                    exampleRecipients.set(language, rr);
+                });
+            }
+        }
+
+        let user: UserStruct | null = null;
+        if (email.userId) {
+            const u = await User.getByID(email.userId);
+            if (u) {
+                user = u.getStructure();
+            }
+        }
+
+        let organizationStruct: BaseOrganization | null = null;
+        if (organization) {
+            organizationStruct = organization.getBaseStructure();
+        }
+
+        return EmailPreview.create({
+            ...email,
+            user,
+            organization: organizationStruct,
+            exampleRecipient: recipientRow,
+            exampleRecipients,
+        });
+    }
+
+    /**
+     * Whether the email has content in this language (strict: the default content only counts
+     * for its own language, see getEmailContentForLanguage)
+     */
+    private static hasContentForLanguage(email: Email, language: Language): boolean {
+        return language === email.language || email.translations.has(language);
+    }
+
+    /**
+     * @param options.language The language the caller is viewing in (from the request headers).
+     * Recipients are returned in this language when the email has content for it, otherwise in
+     * the language they received the email in.
+     */
+    static async getStructureForUser(email: Email, user: User, memberIds: string[], options: { language?: Language | null } = {}) {
+        const emailRecipients = await EmailRecipient.select()
+            .where('emailId', email.id)
+            .where('memberId', memberIds)
+            .fetch();
+        const organization = email.organizationId ? (await Organization.getByID(email.organizationId))! : null;
+
+        const recipientsMap: Map<string, EmailRecipient> = new Map();
+        for (const memberId of memberIds) {
+            const preferred = emailRecipients.find(e => e.memberId === memberId && (e.userId === user.id || e.email === user.email));
+            if (preferred) {
+                recipientsMap.set(preferred.duplicateOfRecipientId ?? preferred.id, preferred);
+                continue;
+            }
+
+            const byMember = emailRecipients.find(e => e.memberId === memberId && e.userId === null && e.email === null);
+            if (byMember) {
+                recipientsMap.set(byMember.duplicateOfRecipientId ?? byMember.id, byMember);
+                continue;
+            }
+            const anyData = emailRecipients.find(e => e.memberId === memberId);
+            if (anyData) {
+                recipientsMap.set(anyData.duplicateOfRecipientId ?? anyData.id, anyData);
+                continue;
+            }
+        }
+
+        // Remove duplicates that are marked as the same recipient
+        const cleanedRecipients: EmailRecipient[] = [...recipientsMap.values()];
+        const structures = await EmailRecipient.getStructures(cleanedRecipients);
+
+        for (const struct of structures) {
+            if (!(struct.userId === user.id || struct.email === user.email) && !((struct.userId === null && struct.email === null))) {
+                stripSensitiveRecipientReplacements(struct, {
+                    organization,
+                    willFill: true,
+                });
+            }
+
+            struct.firstName = user.firstName;
+            struct.lastName = user.lastName;
+            struct.email = user.email;
+            struct.userId = user.id;
+
+            // Show the email in the language the caller is viewing in, but only when the email
+            // has content for it: otherwise keep the language the recipient received it in
+            // (better correct content in the wrong language than wrong content in the right language)
+            if (options.language && this.hasContentForLanguage(email, options.language)) {
+                struct.language = options.language;
+            }
+
+            // We always refresh the data when we display it on the web (so everything is up to date)
+            // The replacements are regenerated in struct.language, so they match the displayed content
+            await fillRecipientReplacements(struct, {
+                organization,
+                from: email.getFromAddress(),
+                replyTo: null,
+                forPreview: false,
+                forceRefresh: true,
+                allowedLanguages: email.getLanguages(),
+            });
+            runWithRecipientLocale(struct, organization, () => {
+                stripRecipientReplacementsForWebDisplay(struct, {
+                    organization,
+                });
+            });
+            if (email.html) {
+                struct.replacements = removeUnusedReplacements(email.getCombinedHtml(), struct.replacements);
+            }
+        }
+
+        // Loop structures and remove if they have exactly the same content
+        // We do this here, because it is possible the user didn't receive any emails, so
+        // the merging at time of sending the emails didn't happen (uniqueness happened on email)
+        const uniqueStructures: EmailRecipientStruct[] = [];
+        for (const struct of structures) {
+            let found = false;
+            for (const unique of uniqueStructures) {
+                const merged = mergeReplacementsIfEqual(unique.replacements, struct.replacements);
+                if (merged !== false) {
+                    unique.replacements = merged;
+                    found = true;
+                    break;
+                }
+            }
+
+            if (!found) {
+                uniqueStructures.push(struct);
+            }
+        }
+
+        let organizationStruct: BaseOrganization | null = null;
+        if (organization) {
+            organizationStruct = organization.getBaseStructure();
+        }
+
+        return EmailWithRecipients.create({
+            ...email,
+            organization: organizationStruct,
+            recipients: uniqueStructures,
+
+            // Remove private-like data
+            softBouncesCount: 0,
+            failedCount: 0,
+            emailErrors: null,
+            recipientsErrors: null,
+            succeededCount: 1,
+            emailRecipientsCount: 1,
+            hardBouncesCount: 0,
+            spamComplaintsCount: 0,
+            recipientFilter: EmailRecipientFilter.create({}),
+            membersCount: 1,
+            otherRecipientsCount: 0,
+        });
+    }
+}

package/src/services/FileSignService.test.ts

@@ -0,0 +1,85 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import { File } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+
+import { FileSignService } from './FileSignService.js';
+
+describe('FileSignService', () => {
+    let originalClient: S3Client;
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('SPACES_BUCKET', 'test-bucket');
+        TestUtils.setEnvironment('SPACES_ENDPOINT', 'test.digitaloceanspaces.com');
+
+        originalClient = FileSignService.s3;
+        FileSignService.s3 = new S3Client({
+            forcePathStyle: false,
+            endpoint: 'https://test.digitaloceanspaces.com',
+            credentials: {
+                accessKeyId: 'test-key',
+                secretAccessKey: 'test-secret',
+            },
+            region: 'eu-west-1',
+        });
+    });
+
+    afterEach(() => {
+        FileSignService.s3 = originalClient;
+    });
+
+    const buildFile = (data: { path: string; contentType?: string | null }) => {
+        return new File({
+            id: '1c9ab9e6-1234-4c5e-9f1a-000000000000',
+            server: 'https://test-bucket.test.digitaloceanspaces.com',
+            path: data.path,
+            size: 100,
+            isPrivate: true,
+            contentType: data.contentType ?? null,
+        });
+    };
+
+    const getSignedQuery = async (file: File) => {
+        const signed = await FileSignService.withSignedUrl(file);
+        expect(signed?.signedUrl).toBeDefined();
+        return new URL(signed!.signedUrl!).searchParams;
+    };
+
+    test('A signed url never renders a file type a browser could execute', async () => {
+        const query = await getSignedQuery(buildFile({ path: 'users/1/abc/report.docx', contentType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document' }));
+
+        expect(query.get('response-content-disposition')).toBe('attachment');
+
+        // The response headers are part of what is signed, so they can't be stripped from the url
+        expect(query.get('X-Amz-SignedHeaders')).toBeDefined();
+        expect(query.get('X-Amz-Signature')).toBeTruthy();
+    });
+
+    test('A signed url renders file types a browser cannot execute', async () => {
+        const pdf = await getSignedQuery(buildFile({ path: 'users/1/abc/invoice.pdf', contentType: 'application/pdf' }));
+        expect(pdf.get('response-content-disposition')).toBe('inline');
+
+        const image = await getSignedQuery(buildFile({ path: 'users/1/abc/photo.jpg', contentType: 'image/jpeg' }));
+        expect(image.get('response-content-disposition')).toBe('inline');
+    });
+
+    test('It downloads files that were uploaded before we validated content types', async () => {
+        // These were stored with a content type chosen by the uploader, and with an extension derived from it
+        const svg = await getSignedQuery(buildFile({ path: 'users/1/abc/evil.svg', contentType: 'image/svg+xml' }));
+        expect(svg.get('response-content-disposition')).toBe('attachment');
+
+        const html = await getSignedQuery(buildFile({ path: 'users/1/abc/evil', contentType: 'text/html' }));
+        expect(html.get('response-content-disposition')).toBe('attachment');
+
+        // Both the extension and the content type have to be safe
+        const disguised = await getSignedQuery(buildFile({ path: 'users/1/abc/evil.pdf', contentType: 'text/html' }));
+        expect(disguised.get('response-content-disposition')).toBe('attachment');
+    });
+
+    test('It uses the path when a file has no content type, like the images we generate', async () => {
+        const image = await getSignedQuery(buildFile({ path: 'users/1/abc/def.png', contentType: null }));
+        expect(image.get('response-content-disposition')).toBe('inline');
+
+        const unknown = await getSignedQuery(buildFile({ path: 'users/1/abc/def', contentType: null }));
+        expect(unknown.get('response-content-disposition')).toBe('attachment');
+    });
+});

package/src/services/FileSignService.ts

@@ -4,7 +4,7 @@ import {
 } from '@aws-sdk/s3-request-presigner';
 import type { DecodedRequest, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { File } from '@stamhoofd/structures';
+import { File, supportedFileTypes } from '@stamhoofd/structures';
 import chalk from 'chalk';
 import * as jose from 'jose';
 
@@ -103,6 +103,27 @@ export class FileSignService {
         };
     }
 
+    /**
+     * Files uploaded before we validated content types can have any content type, so we decide here - and not
+     * from the stored object - whether a browser may render a file. Note that this only protects private
+     * files: public files are served straight from the file server, without a signed url.
+     */
+    static getContentDisposition(file: File): 'inline' | 'attachment' {
+        // The path is generated by us and always ends with the extension the file was stored with, so it says
+        // more about how the file server will serve this file than the content type does. Files we generate
+        // ourselves (like the images of the Image model) don't even have a content type.
+        if (!supportedFileTypes.resolveUpload({ filename: file.path })?.canRenderInline) {
+            return 'attachment';
+        }
+
+        // When a file also carries a content type, both have to be safe
+        if (file.contentType && !supportedFileTypes.resolveUpload({ contentType: file.contentType })?.canRenderInline) {
+            return 'attachment';
+        }
+
+        return 'inline';
+    }
+
     static async withSignedUrl(file: File, duration = 60 * 60) {
         if (file.signedUrl) {
             console.error('Warning: file already signed');
@@ -112,6 +133,7 @@ export class FileSignService {
             const command = new GetObjectCommand({
                 Bucket: STAMHOOFD.SPACES_BUCKET,
                 Key: file.path,
+                ResponseContentDisposition: this.getContentDisposition(file),
             });
             const url = await getSignedUrl(this.s3, command, { expiresIn: duration });