fix(desktop): allow PDF previews from connected environments

[Gigioxx]

PDF previews in the desktop sidebar showed the filename but stayed blank. The desktop CSP only allowed app-origin and Cloudflare frames, so it blocked signed document URLs from connected environments before the PDF viewer could load.

Allow HTTP and HTTPS frames, matching the existing image and video policy for user-configured environments. This is one production line and an assertion in the existing CSP test. HTML previews retain their iframe and response sandboxes; script sources stay restricted.

Verified the failure before editing in Electron 43.4.1 on Linux using the actual desktop CSP and a synthetic PDF served from a separate origin. The same fixture renders after the change. Also uploaded, sent, and opened the PDF in the isolated web app: the signed attachment response is 200 application/pdf and the content is visible. The physical MacBook-to-WSL connection was not exercised.

Six protocol tests, desktop typecheck, targeted lint, and formatting pass. The new assertion fails on the old policy.

Before	After

Screenshots show the isolated Electron reproduction, not a full app window. No private documents are included.

Model: GPT-6. Harness: Codex.

Note

Allow http: and https: in desktop CSP frame-src for PDF previews

Updates makeDesktopContentSecurityPolicy to use 'self', http:, and https: scheme sources instead of 'self' plus the Cloudflare challenges host. This permits frames loaded from connected environments, enabling PDF previews. Test assertions in the Electron protocol suite updated to match.

• Risk: broadening frame-src to all HTTP/HTTPS origins relaxes the desktop renderer CSP; any page that embeds untrusted frame URLs now has fewer restrictions.

^{Macroscope summarized 85dbe83.}

Summary by CodeRabbit

• Bug Fixes
  • Improved desktop app compatibility with embedded content by allowing frames served over HTTP and HTTPS.
  • Frames loaded from the desktop application itself remain supported under the existing security policy.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The production desktop CSP default is broadened from a host-restricted frame policy to all HTTP/HTTPS origins, enabling connected-environment PDF previews but relaxing a security boundary for every desktop protocol response. This product-default and security-sensitive behavior change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 70fafd73-3180-4d32-82a1-f653ae8b6541

📥 Commits

Reviewing files that changed from the base of the PR and between 357b8d5 and 85dbe83.

📒 Files selected for processing (2)

• apps/desktop/src/electron/ElectronProtocol.test.ts
• apps/desktop/src/electron/ElectronProtocol.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The desktop Content Security Policy now allows self, HTTP, and HTTPS frame sources. A test verifies the generated frame-src directive.

Changes

Desktop CSP

Layer / File(s)	Summary
Frame source policy and validation apps/desktop/src/electron/ElectronProtocol.ts, apps/desktop/src/electron/ElectronProtocol.test.ts	The CSP frame-src directive allows self, http:, and https:. The test verifies these sources.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 85dbe

Desktop PDF previews can now load HTTP and HTTPS signed-document frames while the remaining CSP restrictions are unchanged. The targeted policy behavior is covered, with no current merge-blocking risk identified.

Suggested reviewers: juliusmarminge, bil0000

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the desktop PDF preview fix and matches the main CSP change.
Description check	✅ Passed	The description explains what changed, why it changed, test coverage, verification limits, and UI evidence. It covers the required template sections, although the checklist items remain unchecked.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}