add pdf viewer

backend/app/Controllers/ElementController.php

@@ -18,10 +18,14 @@ use App\Exceptions\NotFoundException;
 use App\Shared\Files\FileUploader;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
 
 class ElementController
 {
+    private const PDF_FOLDERS = ['short', 'long'];
+
     public function __construct(
         private GetElement $getElement,
         private CreateChildElement $createChildElement,
@@ -64,6 +68,39 @@ class ElementController
         ], 200);
     }
 
+    public function showPdf(
+        string $folder,
+        string $fileName,
+    ): Response|JsonResponse {
+        if (!$this->isAllowedPdfFolder($folder)) {
+            return new JsonResponse([
+                'error' => 'PDF not found',
+            ], 404);
+        }
+
+        if (!preg_match('/^[A-Za-z0-9._-]+\.pdf$/', $fileName)) {
+            return new JsonResponse([
+                'error' => 'PDF not found',
+            ], 404);
+        }
+
+        $path = "element-pdfs/$folder/$fileName";
+        if (!Storage::disk('public')->exists($path)) {
+            return new JsonResponse([
+                'error' => 'PDF not found',
+            ], 404);
+        }
+
+        return new Response(
+            Storage::disk('public')->get($path),
+            200,
+            [
+                'Content-Type' => 'application/pdf',
+                'Content-Disposition' => "inline; filename=\"$fileName\"",
+            ],
+        );
+    }
+
     public function createChild(Request $request, ?int $parentId): JsonResponse
     {
         try {
@@ -372,4 +409,9 @@ class ElementController
 
         return $path;
     }
+
+    private function isAllowedPdfFolder(string $folder): bool
+    {
+        return in_array($folder, self::PDF_FOLDERS, true);
+    }
 }

backend/routes/api.php

@@ -12,6 +12,10 @@ Route::get('/me', [AuthController::class, 'me'])
     ->middleware(AuthMiddleware::class);
 Route::get('/sets', [SetController::class, 'index']);
 Route::get('/elements/{id}', [ElementController::class, 'show']);
+Route::get('/element-pdfs/{folder}/{fileName}', [
+    ElementController::class,
+    'showPdf',
+]);
 Route::post('/elements/{parentId}/children', [
     ElementController::class,
     'createChild',