nodebb-plugin-pdf-secure 1.2.18 → 1.2.20

package/static/viewer-app.js

@@ -2,6 +2,10 @@
 (function () {
     'use strict';
 
+    // Security: Capture config early and delete from window immediately
+    const _cfg = window.PDF_SECURE_CONFIG ? Object.assign({}, window.PDF_SECURE_CONFIG) : null;
+    delete window.PDF_SECURE_CONFIG;
+
     // ============================================
     // CANVAS EXPORT PROTECTION
     // Block toDataURL/toBlob for PDF render canvas only
@@ -45,6 +49,9 @@
     let pathSegments = [];
     let drawRAF = null;
 
+    // Premium info (saved before config deletion for UI use)
+    let premiumInfo = null;
+
     // Annotation persistence - stores SVG innerHTML per page
     const annotationsStore = new Map();
     const annotationRotations = new Map(); // tracks rotation when annotations were saved
@@ -91,8 +98,7 @@
             firstPageRendered = true;
             // Notify parent that PDF is fully rendered (for queue system)
             if (window.parent && window.parent !== window) {
-                const config = window.PDF_SECURE_CONFIG || {};
-                window.parent.postMessage({ type: 'pdf-secure-ready', filename: config.filename }, window.location.origin);
+                window.parent.postMessage({ type: 'pdf-secure-ready', filename: (_cfg || {}).filename }, window.location.origin);
                 console.log('[PDF-Secure] First page rendered, notifying parent');
             }
         }
@@ -165,14 +171,106 @@
         return data.buffer;
     }
 
+    function showPremiumLockOverlay(totalPages) {
+        const viewerEl = document.getElementById('viewer');
+        if (!viewerEl) return;
+
+        const overlay = document.createElement('div');
+        overlay.id = 'premiumLockOverlay';
+        overlay.innerHTML = `
+            <div class="premium-lock-icon">
+                <svg viewBox="0 0 24 24" width="64" height="64" fill="#ffd700">
+                    <path d="M18 8h-1V6c0-2.76-2.24-5-5-5S7 3.24 7 6v2H6c-1.1 0-2 .9-2 2v10c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V10c0-1.1-.9-2-2-2zm-6 9c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2zm3.1-9H8.9V6c0-1.71 1.39-3.1 3.1-3.1s3.1 1.39 3.1 3.1v2z"/>
+                </svg>
+            </div>
+            <div class="premium-lock-pages">
+                ${totalPages - 1} sayfa daha kilitli
+            </div>
+            <div class="premium-lock-message">
+                Bu icerigi goruntulemeye devam etmek icin Premium uyelik gereklidir.
+            </div>
+            <a href="https://forumtest.ieu.app/premium" target="_blank" class="premium-lock-button">
+                Premium Satin Al
+            </a>
+            <div class="premium-lock-secondary">
+                Materyal yukleyerek de Premium olabilirsiniz!
+            </div>
+        `;
+
+        viewerEl.appendChild(overlay);
+    }
+
+    // ============================================
+    // PREMIUM INTEGRITY: Periodic Check (2s interval)
+    // Hides pages 2+, recreates overlay if removed, forces page 1
+    // ============================================
+    function startPeriodicCheck() {
+        setInterval(function () {
+            if (!premiumInfo || premiumInfo.isPremium) return;
+            // Hide all pages beyond page 1
+            var pages = document.querySelectorAll('#viewer .page');
+            pages.forEach(function (page, idx) {
+                if (idx > 0 && page.style.display !== 'none') {
+                    page.style.display = 'none';
+                }
+            });
+            // Ensure overlay exists
+            if (!document.getElementById('premiumLockOverlay')) {
+                showPremiumLockOverlay(premiumInfo.totalPages);
+            }
+            // Force page 1 if somehow on another page
+            if (pdfViewer && pdfViewer.currentPageNumber > 1) {
+                pdfViewer.currentPageNumber = 1;
+            }
+        }, 2000);
+    }
+
+    // ============================================
+    // PREMIUM INTEGRITY: MutationObserver Anti-Tampering
+    // Recreates overlay on removal, re-hides pages on style change
+    // ============================================
+    function setupAntiTampering() {
+        var viewerEl = document.getElementById('viewer');
+        if (!viewerEl) return;
+
+        // Observer 1: Watch for overlay removal (childList)
+        new MutationObserver(function (mutations) {
+            for (var i = 0; i < mutations.length; i++) {
+                var removed = mutations[i].removedNodes;
+                for (var j = 0; j < removed.length; j++) {
+                    if (removed[j].id === 'premiumLockOverlay') {
+                        showPremiumLockOverlay(premiumInfo.totalPages);
+                        return;
+                    }
+                }
+            }
+        }).observe(viewerEl, { childList: true });
+
+        // Observer 2: Watch for page visibility tampering (attributes)
+        new MutationObserver(function (mutations) {
+            for (var i = 0; i < mutations.length; i++) {
+                var m = mutations[i];
+                if (m.type === 'attributes' && m.attributeName === 'style') {
+                    var target = m.target;
+                    if (target.classList && target.classList.contains('page')) {
+                        var pageNum = parseInt(target.dataset.pageNumber || '0', 10);
+                        if (pageNum > 1 && target.style.display !== 'none') {
+                            target.style.display = 'none';
+                        }
+                    }
+                }
+            }
+        }).observe(viewerEl, { childList: true, subtree: true, attributes: true, attributeFilter: ['style'] });
+    }
+
     // Auto-load PDF if config is present (injected by NodeBB plugin)
     async function autoLoadSecurePDF() {
-        if (!window.PDF_SECURE_CONFIG || !window.PDF_SECURE_CONFIG.filename) {
+        if (!_cfg || !_cfg.filename) {
             console.log('[PDF-Secure] No config found, showing file picker');
             return;
         }
 
-        const config = window.PDF_SECURE_CONFIG;
+        const config = _cfg;
         console.log('[PDF-Secure] Auto-loading:', config.filename);
 
         // Show loading state
@@ -244,8 +342,8 @@
                     pdfBuffer = encodedBuffer;
                 }
 
-                // Send buffer to parent for caching
-                if (window.parent && window.parent !== window) {
+                // Send buffer to parent for caching (premium only - non-premium must not leak decoded buffer)
+                if (_cfg.isPremium !== false && window.parent && window.parent !== window) {
                     // Clone buffer for parent (we keep original)
                     const bufferCopy = pdfBuffer.slice(0);
                     window.parent.postMessage({
@@ -261,14 +359,21 @@
             // Step 4: Load into viewer
             await loadPDFFromBuffer(pdfBuffer);
 
+            // Premium Gate: Client-side page restriction for non-premium users
+            if (config.isPremium === false && pdfDoc && pdfDoc.numPages > 1) {
+                premiumInfo = Object.freeze({ isPremium: false, totalPages: pdfDoc.numPages });
+                showPremiumLockOverlay(pdfDoc.numPages);
+                startPeriodicCheck();
+                setupAntiTampering();
+            } else {
+                premiumInfo = Object.freeze({ isPremium: true, totalPages: pdfDoc ? pdfDoc.numPages : 1 });
+            }
+
             // Step 5: Moved to pagerendered event for proper timing
 
             // Step 6: Security - clear references to prevent extraction
             pdfBuffer = null;
 
-            // Security: Delete config containing sensitive data (nonce, key)
-            delete window.PDF_SECURE_CONFIG;
-
             // Security: Remove PDF.js globals to prevent console manipulation
             delete window.pdfjsLib;
             delete window.pdfjsViewer;
@@ -292,10 +397,9 @@
 
             // Notify parent of error (prevents 60s queue hang)
             if (window.parent && window.parent !== window) {
-                const config = window.PDF_SECURE_CONFIG || {};
                 window.parent.postMessage({
                     type: 'pdf-secure-ready',
-                    filename: config.filename,
+                    filename: (_cfg || {}).filename,
                     error: err.message
                 }, window.location.origin);
             }
@@ -325,10 +429,16 @@
         // Create placeholder thumbnails for all pages
         for (let i = 1; i <= pdfDoc.numPages; i++) {
             const thumb = document.createElement('div');
-            thumb.className = 'thumbnail' + (i === 1 ? ' active' : '');
+            const isLocked = premiumInfo && !premiumInfo.isPremium && premiumInfo.totalPages > 1 && i > 1;
+            thumb.className = 'thumbnail' + (i === 1 ? ' active' : '') + (isLocked ? ' locked' : '');
             thumb.dataset.page = i;
-            thumb.innerHTML = `<div class="thumbnailNum">${i}</div>`;
+            if (isLocked) {
+                thumb.innerHTML = `<div class="thumbnailNum">${i}</div><div class="thumbnail-lock">&#128274;</div>`;
+            } else {
+                thumb.innerHTML = `<div class="thumbnailNum">${i}</div>`;
+            }
             thumb.onclick = () => {
+                if (isLocked) return;
                 pdfViewer.currentPageNumber = i;
                 document.querySelectorAll('.thumbnail').forEach(t => t.classList.remove('active'));
                 thumb.classList.add('active');
@@ -339,7 +449,7 @@
         // Lazy render thumbnails with IntersectionObserver
         const thumbObserver = new IntersectionObserver((entries) => {
             entries.forEach(async (entry) => {
-                if (entry.isIntersecting && !entry.target.dataset.rendered) {
+                if (entry.isIntersecting && !entry.target.dataset.rendered && !entry.target.classList.contains('locked')) {
                     entry.target.dataset.rendered = 'true';
                     const pageNum = parseInt(entry.target.dataset.page);
                     const page = await pdfDoc.getPage(pageNum);
@@ -359,10 +469,31 @@
     // Events
     eventBus.on('pagesinit', () => {
         pdfViewer.currentScaleValue = 'page-width';
-        document.getElementById('pageCount').textContent = `/ ${pdfViewer.pagesCount}`;
+
+        // Premium Gate: Hide all pages beyond page 1 immediately
+        if (premiumInfo && !premiumInfo.isPremium && premiumInfo.totalPages > 1) {
+            for (let i = 1; i < pdfViewer.pagesCount; i++) {
+                const pageView = pdfViewer.getPageView(i); // 0-indexed
+                if (pageView && pageView.div) {
+                    pageView.div.style.display = 'none';
+                }
+            }
+        }
+
+        if (premiumInfo && !premiumInfo.isPremium && premiumInfo.totalPages > 1) {
+            document.getElementById('pageCount').textContent = `/ ${premiumInfo.totalPages}`;
+        } else {
+            document.getElementById('pageCount').textContent = `/ ${pdfViewer.pagesCount}`;
+        }
     });
 
     eventBus.on('pagechanging', (evt) => {
+        // Premium Gate: Block navigation beyond page 1 for non-premium users
+        if (premiumInfo && !premiumInfo.isPremium && premiumInfo.totalPages > 1 && evt.pageNumber > 1) {
+            // Force back to page 1
+            setTimeout(() => { pdfViewer.currentPageNumber = 1; }, 0);
+            return;
+        }
         document.getElementById('pageInput').value = evt.pageNumber;
         // Update active thumbnail
         document.querySelectorAll('.thumbnail').forEach(t => {
@@ -385,6 +516,15 @@
     });
 
     eventBus.on('pagerendered', (evt) => {
+        // Premium Gate: Hide pages beyond page 1 for non-premium users
+        if (premiumInfo && !premiumInfo.isPremium && premiumInfo.totalPages > 1 && evt.pageNumber > 1) {
+            const pageView = pdfViewer.getPageView(evt.pageNumber - 1);
+            if (pageView && pageView.div) {
+                pageView.div.style.display = 'none';
+            }
+            return;
+        }
+
         injectAnnotationLayer(evt.pageNumber);
 
         // Rotation is handled natively by PDF.js via pagesRotation
@@ -393,6 +533,11 @@
     // Page Navigation
     document.getElementById('pageInput').onchange = (e) => {
         const num = parseInt(e.target.value);
+        // Premium Gate: Block manual page input beyond page 1
+        if (premiumInfo && !premiumInfo.isPremium && premiumInfo.totalPages > 1 && num > 1) {
+            e.target.value = 1;
+            return;
+        }
         if (num >= 1 && num <= pdfViewer.pagesCount) {
             pdfViewer.currentPageNumber = num;
         }
@@ -525,6 +670,10 @@
             document.getElementById('sepiaBtn').classList.contains('active'));
         closeAllDropdowns();
     };
+    document.getElementById('overflowFullscreen').onclick = () => {
+        toggleFullscreen();
+        closeAllDropdowns();
+    };
 
     // Close dropdowns when clicking outside
     document.addEventListener('click', (e) => {
@@ -613,15 +762,18 @@
         highlightColor = c;
         if (currentTool === 'highlight') currentColor = c;
         document.getElementById('highlightWave').setAttribute('stroke', c);
+        document.getElementById('highlightColorIndicator').style.background = c;
     });
     setupColorPicker('drawColors', c => {
         drawColor = c;
         if (currentTool === 'pen') currentColor = c;
         document.getElementById('drawWave').setAttribute('stroke', c);
+        document.getElementById('drawColorIndicator').style.background = c;
     });
     setupColorPicker('shapeColors', c => {
         shapeColor = c;
         if (currentTool === 'shape') currentColor = c;
+        document.getElementById('shapeColorIndicator').style.background = c;
     });
 
     // Highlighter Thickness Slider
@@ -745,13 +897,9 @@
             e.preventDefault();
             draw(e);
         };
-        if (annotationMode) {
-            svg.addEventListener('touchstart', touchStartHandler, { passive: false, signal });
-            svg.addEventListener('touchmove', touchMoveHandler, { passive: false, signal });
-        } else {
-            svg.addEventListener('touchstart', touchStartHandler, { signal });
-            svg.addEventListener('touchmove', touchMoveHandler, { signal });
-        }
+        // Always use passive:false so preventDefault() works when a tool is later activated
+        svg.addEventListener('touchstart', touchStartHandler, { passive: false, signal });
+        svg.addEventListener('touchmove', touchMoveHandler, { passive: false, signal });
         svg.addEventListener('touchend', () => stopDraw(pageNum), { signal });
         svg.addEventListener('touchcancel', () => stopDraw(pageNum), { signal });
 
@@ -965,7 +1113,8 @@
         // Text tool - create/edit/drag text
         if (currentTool === 'text') {
             // Check if clicked on existing text element
-            const elementsUnderClick = document.elementsFromPoint(e.clientX, e.clientY);
+            // Use coords (touch-safe) instead of e.clientX which is undefined on TouchEvent
+            const elementsUnderClick = document.elementsFromPoint(coords.clientX, coords.clientY);
             const existingText = elementsUnderClick.find(el => el.tagName === 'text' && el.closest('.annotationLayer'));
 
             if (existingText) {
@@ -973,7 +1122,7 @@
                 startTextDrag(e, existingText, svg, scaleX, pageNum);
             } else {
                 // Create new text
-                showTextEditor(e.clientX, e.clientY, svg, x, y, scaleX, pageNum);
+                showTextEditor(coords.clientX, coords.clientY, svg, x, y, scaleX, pageNum);
             }
             return;
         }
@@ -1235,14 +1384,18 @@
         textEl.classList.add('dragging');
         hasDragged = false;
 
-        dragStartX = e.clientX;
-        dragStartY = e.clientY;
+        // Touch-safe coordinate extraction
+        const startCoords = getEventCoords(e);
+        dragStartX = startCoords.clientX;
+        dragStartY = startCoords.clientY;
         textOriginalX = parseFloat(textEl.getAttribute('x'));
         textOriginalY = parseFloat(textEl.getAttribute('y'));
 
-        function onMouseMove(ev) {
-            const dxScreen = ev.clientX - dragStartX;
-            const dyScreen = ev.clientY - dragStartY;
+        function onMove(ev) {
+            ev.preventDefault();
+            const moveCoords = getEventCoords(ev);
+            const dxScreen = moveCoords.clientX - dragStartX;
+            const dyScreen = moveCoords.clientY - dragStartY;
             // Convert screen delta to viewBox delta (rotation-aware)
             const vbDelta = screenDeltaToViewBox(svg, dxScreen, dyScreen, textEl);
 
@@ -1254,29 +1407,31 @@
             textEl.setAttribute('y', (textOriginalY + vbDelta.dy).toFixed(2));
         }
 
-        function onMouseUp(ev) {
-            document.removeEventListener('mousemove', onMouseMove);
-            document.removeEventListener('mouseup', onMouseUp);
+        function onEnd(ev) {
+            document.removeEventListener('mousemove', onMove);
+            document.removeEventListener('mouseup', onEnd);
+            document.removeEventListener('touchmove', onMove);
+            document.removeEventListener('touchend', onEnd);
             textEl.classList.remove('dragging');
 
             if (hasDragged) {
                 // Moved - save position
                 saveAnnotations(pageNum);
             } else {
-                // Not moved - short click = edit
-                const viewBoxWidth = parseFloat(svg.dataset.viewboxWidth);
-                const viewBoxHeight = parseFloat(svg.dataset.viewboxHeight);
+                // Not moved - short click/tap = edit
                 const svgX = parseFloat(textEl.getAttribute('x'));
                 const svgY = parseFloat(textEl.getAttribute('y'));
-                // Note: showTextEditor needs scaleX for font scaling logic, which we still have from arguments
-                showTextEditor(ev.clientX, ev.clientY, svg, svgX, svgY, scaleX, pageNum, textEl);
+                const endCoords = getEventCoords(ev);
+                showTextEditor(endCoords.clientX, endCoords.clientY, svg, svgX, svgY, scaleX, pageNum, textEl);
             }
 
             draggedText = null;
         }
 
-        document.addEventListener('mousemove', onMouseMove);
-        document.addEventListener('mouseup', onMouseUp);
+        document.addEventListener('mousemove', onMove);
+        document.addEventListener('mouseup', onEnd);
+        document.addEventListener('touchmove', onMove, { passive: false });
+        document.addEventListener('touchend', onEnd);
     }
 
     // Inline Text Editor