Office-document previews through a Gotenberg converter #461
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "office-document-preview"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Word, ODF, Excel and PowerPoint attachments (
.doc .docx .odt .rtf .xls .xlsx .ods .ppt .pptx .odp) open as a PDF preview instead of downloading. The backend converts them with a Gotenberg converter that runs as its own ZAD component; the browser's PDF viewer renders the result. Reasoning in WDR-0015, security indocs/security.md#office-document-previews, component setup indocs/deployment.md("Service:converter").What changes
GET /api/mm/file/{id}/pdf/{name}?account_id=: fetches through the existing token-scoped proxy (streamed, stops above 20 MB), converts, returnsapplication/pdfinline andno-store. Converter answers map to 413/415/422/503/504; 20/min per user.WAGGLE_DOCUMENT_CONVERTER_URLswitches it on./api/auth/methen carriesdocument_preview: true; without it, file cards download as before.file-text-on-file-text,table,display).OfficePreviewModalfetches the PDF, shows "Voorbeeld maken...", frames it as ablob:URL, and on failure shows the reason with a download. Converted PDFs stay in tab memory (50 MB cap, cleared on logout and session expiry), so reopening does not convert again.frame-src 'self' blob:in nginx and in the backend middleware.productionCsp.test.tsnow requires it.document.<ext>. The real name only travels as the PDF Title: for a blob URL that is the only thing Chrome's viewer titles itself after.ZAD_CONVERTER_ENABLEDistrue.compose.dev.yaml:converterservice under theconverterprofile, pinnedgotenberg/gotenberg:8.37.0@sha256:f29984bd...(manifest-list digest checked against Docker Hub). fake-mm serves minimal.docx,.odtand.xlsxfixtures, so the whole chain can be checked locally.Before this reaches users
The merge releases (Unreleased entry), but the feature stays off until these three one-off steps (also in
docs/deployment.md, "Service:converter"):converterin ZAD: port 3000, nopublish-on-web, requests 50m/256Mi, limits 1 CPU/1Gi, env vars from the table. It has to exist first: an upsert adds a missing component without these settings.zad alias add -c backend 'WAGGLE_DOCUMENT_CONVERTER_URL=http://${DEPLOYMENT_NAME}-converter:3000'. ZAD names a component's Service<deployment>-<component>and gives every podDEPLOYMENT_NAME(verified in RIG-Cluster and zad-cli v0.12.0 source, not yet against the live platform: an unknown variable answers 422 on save).ZAD_CONVERTER_ENABLED=true. From then on both deploy jobs (production and staging) send the converter along with backend and frontend.The converter image is pinned in
CONVERTER_IMAGEin both deploy jobs and incompose.dev.yaml; a Renovate group ("document converter") moves all three together, and the release after that merge rolls it out. The step that builds the component list was run locally with the variable unset,falseandtrue.Measured (local, Gotenberg 8.37.0, 1 CPU / 1 GiB)
.docx2.1 s, then 0.3 to 1.2 s for all ten formats..docxconverts to a PDF of garbage (200), not an error.blob:PDF in an iframe underobject-src 'none'.Test plan
test_mm_file_pdf_preview.py,test_document_preview.py,/meflag tests; coverage ofdocument_preview.pyandmm_avatar.py100%.test_mm_unread_api.py("mattermost not linked", an FK violation) under load 5 on mybee; the same file passes on its own. Not touched here, worth watching in CI.vue-tsc, eslint, build..docxpreview in 0.8 to 1.9 s, reopening makes no second request,.odt/.xlsx/.docxreturn a PDF through the route, an image gets 415. Loading and error states checked in light and dark.Noticed, not changed
img-srchas noblob:, while the backend CSP allows it for the composer's image thumbnail before upload. If that thumbnail is meant to work in production, nginx blocks it.--libreoffice-allow-listfor LibreOffice's outbound fetches. An allow-list that matches nothing might close egress at the application level while ZAD cannot; not tested, so not set.Office attachments (.doc .docx .odt .rtf .xls .xlsx .ods .ppt .pptx .odp) open as a preview instead of downloading. The backend fetches the file through the token-scoped proxy, converts it to PDF with a Gotenberg converter and returns it inline and no-store; the browser's PDF viewer renders it, as for PDF attachments. - GET /api/mm/file/{id}/pdf/{name}: streams at most 20 MB from Mattermost, maps converter answers to 413/415/422/503/504, 20/min per user. The upload is named document.<ext>; the real name only travels as the PDF Title, which the viewer shows for a blob URL. - The converter is optional (WAGGLE_DOCUMENT_CONVERTER_URL). /me announces it as document_preview; without it cards download. - The modal fetches the PDF and frames it as a blob URL, so a slow or failed conversion ends in a message. That takes frame-src blob: in both CSPs. The blob stays in tab memory (50 MB cap, cleared on logout), so reopening does not convert again. - compose.dev.yaml gets a converter service (profile), fake-mm serves minimal docx/odt/xlsx fixtures for a local end-to-end check. - WDR-0015, security.md and deployment.md cover the component, its flags and what it may reach.2f43a62acd63bb4b0ae9View command line instructions
Manual merge helper
Use this merge commit message when completing the merge manually.
Checkout
From your project repository, check out a new branch and test the changes.