nodebb-plugin-pdf-secure 1.2.25 → 1.2.26

package/lib/controllers.js

@@ -45,12 +45,8 @@ Controllers.servePdfBinary = async function (req, res) {
 	}
 
 	try {
-		let pdfBuffer;
-		if (data.isPremium) {
-			pdfBuffer = await pdfHandler.getFullPdf(data.file);
-		} else {
-			pdfBuffer = await pdfHandler.getSinglePagePdf(data.file);
-		}
+		// Always send full PDF - page restriction is handled client-side
+		const pdfBuffer = await pdfHandler.getFullPdf(data.file);
 
 		// Apply partial XOR encryption with dynamic key from nonce
 		const encodedBuffer = partialXorEncode(pdfBuffer, data.xorKey);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-pdf-secure",
-  "version": "1.2.25",
+  "version": "1.2.26",
   "description": "Secure PDF viewer plugin for NodeBB - prevents downloading, enables canvas-only rendering with Premium group support",
   "main": "library.js",
   "repository": {

package/static/viewer.html

@@ -2262,7 +2262,7 @@
             }
 
             function resetOverlayCSS(overlay) {
-                if (!isOverlayTampered(overlay)) return; // Skip if already correct (prevents observer loop)
+                if (!isOverlayTampered(overlay)) return;
                 overlay.style.cssText = 'position:absolute;top:0;left:0;right:0;bottom:0;display:flex;z-index:15;opacity:1;visibility:visible;pointer-events:auto;';
             }
 
@@ -2271,15 +2271,12 @@
                 pages.forEach(function (page) {
                     var pageNum = parseInt(page.dataset.pageNumber || '0', 10);
                     if (pageNum > 1) {
-                        // Ensure page is visible (undo any old display:none)
                         if (page.style.display === 'none') {
                             page.style.display = '';
                         }
                         injectPageLock(page);
-                        // CSS integrity: reset overlay styles in case of tampering
                         var existing = page.querySelector('.page-lock-overlay');
                         if (existing) resetOverlayCSS(existing);
-                        // Ensure blur class is present
                         if (!page.classList.contains('page-locked-blur')) {
                             page.classList.add('page-locked-blur');
                         }
@@ -2326,13 +2323,11 @@
                     for (var i = 0; i < mutations.length; i++) {
                         var target = mutations[i].target;
                         if (!target || !target.classList) continue;
-                        // Overlay CSS tampered - reset only if values actually differ
                         if (target.classList.contains('page-lock-overlay')) {
                             if (isOverlayTampered(target)) {
                                 resetOverlayCSS(target);
                             }
                         }
-                        // Blur class removed from locked page - re-add it
                         if (target.classList.contains('page') && !target.classList.contains('page-locked-blur')) {
                             var pageNum = parseInt(target.dataset.pageNumber || '0', 10);
                             if (pageNum > 1) {
@@ -2343,6 +2338,47 @@
                 }).observe(viewerEl, { subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
             }
 
+            // ============================================
+            // LITE MODE: Hide all tools except fullscreen and zoom
+            // Lite users can view full PDF but cannot use annotations,
+            // sidebar, rotate, sepia, overflow menu, etc.
+            // ============================================
+            function applyLiteMode() {
+                // Hide sidebar button
+                var sidebarBtn = document.getElementById('sidebarBtn');
+                if (sidebarBtn) sidebarBtn.style.display = 'none';
+
+                // Close sidebar if open
+                var sidebarEl = document.getElementById('sidebar');
+                if (sidebarEl) sidebarEl.classList.remove('open');
+
+                // Hide entire annotation tools group (highlight, draw, eraser, select, undo/redo, text, shapes)
+                var annotationGroup = document.querySelector('#toolbar > .toolbarGroup:nth-child(3)');
+                if (annotationGroup) annotationGroup.style.display = 'none';
+
+                // In the zoom/utility group, hide everything except zoomIn and zoomOut
+                var keepIds = new Set(['zoomIn', 'zoomOut']);
+                var utilityGroup = document.querySelector('#toolbar > .toolbarGroup:nth-child(5)');
+                if (utilityGroup) {
+                    Array.from(utilityGroup.children).forEach(function (child) {
+                        if (!keepIds.has(child.id)) {
+                            child.style.display = 'none';
+                        }
+                    });
+                }
+
+                // Hide bottom toolbar annotation tools (mobile), keep only fullscreen button
+                var bottomToolbarInner = document.getElementById('bottomToolbarInner');
+                if (bottomToolbarInner) bottomToolbarInner.style.display = 'none';
+
+                // Hide all top-level separators between groups
+                document.querySelectorAll('#toolbar > .separator').forEach(function (sep) {
+                    sep.style.display = 'none';
+                });
+
+                console.log('[PDF-Secure] Lite mode applied - restricted toolbar');
+            }
+
             // Auto-load PDF if config is present (injected by NodeBB plugin)
             async function autoLoadSecurePDF() {
                 if (!_cfg || !_cfg.filename) {
@@ -2423,7 +2459,7 @@
                         }
 
                         // Send buffer to parent for caching (premium only - non-premium must not leak decoded buffer)
-                        if (_cfg.isPremium !== false && window.parent && window.parent !== window) {
+                        if ((_cfg.isPremium !== false || _cfg.isLite) && window.parent && window.parent !== window) {
                             // Clone buffer for parent (we keep original)
                             const bufferCopy = pdfBuffer.slice(0);
                             window.parent.postMessage({
@@ -2439,8 +2475,8 @@
                     // Step 4: Load into viewer
                     await loadPDFFromBuffer(pdfBuffer);
 
-                    // Premium Gate: Client-side page restriction for non-premium users
-                    if (config.isPremium === false && pdfDoc && pdfDoc.numPages > 1) {
+                    // Premium Gate: Client-side page restriction for non-premium, non-lite users
+                    if (config.isPremium === false && !config.isLite && pdfDoc && pdfDoc.numPages > 1) {
                         premiumInfo = Object.freeze({ isPremium: false, totalPages: pdfDoc.numPages });
                         applyPageLocks();
                         startPeriodicCheck();
@@ -2449,6 +2485,11 @@
                         premiumInfo = Object.freeze({ isPremium: true, totalPages: pdfDoc ? pdfDoc.numPages : 1 });
                     }
 
+                    // Lite Mode: Full PDF access but restricted toolbar
+                    if (config.isLite) {
+                        applyLiteMode();
+                    }
+
                     // Step 5: Moved to pagerendered event for proper timing
 
                     // Step 6: Security - clear references to prevent extraction