From 73d761e502713afad63d69af6b5379041809b9d9 Mon Sep 17 00:00:00 2001
From: Frost-Phoenix <hugo.pereira@rnl.tecnico.ulisboa.pt>
Date: Sat, 17 Oct 2026 19:59:38 +0100
Subject: [PATCH] fix(validation): open signed PDF by UUID instead of the
 owner's nodeId

Signed-off-by: oPeras1 <hugo.pereira@rnl.tecnico.ulisboa.pt>
---
 .../validation/DocumentValidationDetails.vue  |  3 +--
 .../validation/EnvelopeValidation.vue         |  7 +++---
 .../DocumentValidationDetails.spec.ts         | 25 +++++++++++++++----
 .../validation/EnvelopeValidation.spec.ts     | 25 +++++++++++++------
 src/tests/utils/viewer.spec.ts                | 20 +++++++++++++++
 src/utils/viewer.js                           |  9 +++++--
 src/views/Validation.vue                      |  3 +--
 7 files changed, 70 insertions(+), 22 deletions(-)

diff --git a/src/components/validation/DocumentValidationDetails.vue b/src/components/validation/DocumentValidationDetails.vue
index 295471abc9..664c291e99 100644
--- a/src/components/validation/DocumentValidationDetails.vue
+++ b/src/components/validation/DocumentValidationDetails.vue
@@ -137,14 +137,13 @@ const size = computed(() => {
 const documentStatus = computed(() => getStatusLabel(document.value.status))
 
 async function viewDocument() {
-	if (!document.value.uuid || !document.value.name || typeof document.value.nodeId !== 'number') {
+	if (!document.value.uuid || !document.value.name) {
 		return
 	}
 	const fileUrl = generateUrl('/apps/libresign/p/pdf/{uuid}', { uuid: document.value.uuid })
 	await openDocument({
 		fileUrl,
 		filename: document.value.name,
-		nodeId: document.value.nodeId,
 	})
 }
 
diff --git a/src/components/validation/EnvelopeValidation.vue b/src/components/validation/EnvelopeValidation.vue
index 35f0bce475..afe00e8515 100644
--- a/src/components/validation/EnvelopeValidation.vue
+++ b/src/components/validation/EnvelopeValidation.vue
@@ -65,7 +65,7 @@
 						<template #subname>
 							<strong>{{ t('libresign', 'Status:') }}</strong> {{ getFileStatusText(file) }}
 						</template>
-						<template v-if="!isTouchDevice && file.nodeId" #actions>
+						<template v-if="!isTouchDevice && file.uuid" #actions>
 							<NcActionButton @click.stop="viewFile(file)">
 								<template #icon>
 									<NcIconSvgWrapper :path="mdiEye" :size="20" />
@@ -74,7 +74,7 @@
 							</NcActionButton>
 						</template>
 						<template #extra-actions>
-							<NcButton v-if="isTouchDevice && file.nodeId" variant="tertiary" :aria-label="t('libresign', 'View PDF')" @click.stop="viewFile(file)">
+							<NcButton v-if="isTouchDevice && file.uuid" variant="tertiary" :aria-label="t('libresign', 'View PDF')" @click.stop="viewFile(file)">
 								<template #icon>
 									<NcIconSvgWrapper :path="mdiEye" :size="20" />
 								</template>
@@ -343,14 +343,13 @@ function getSignerProgressText(signer: EnvelopeSigner) {
 }
 
 function viewFile(file: EnvelopeFile) {
-	if (!file.uuid || !file.name || typeof file.nodeId !== 'number') {
+	if (!file.uuid || !file.name) {
 		return
 	}
 	const fileUrl = generateUrl('/apps/libresign/p/pdf/{uuid}', { uuid: file.uuid })
 	openDocument({
 		fileUrl,
 		filename: file.name,
-		nodeId: file.nodeId,
 	})
 }
 
diff --git a/src/tests/components/validation/DocumentValidationDetails.spec.ts b/src/tests/components/validation/DocumentValidationDetails.spec.ts
index da1b8030d4..f1caf6883f 100644
--- a/src/tests/components/validation/DocumentValidationDetails.spec.ts
+++ b/src/tests/components/validation/DocumentValidationDetails.spec.ts
@@ -398,7 +398,7 @@ describe('DocumentValidationDetails', () => {
 			expect(wrapper.vm.document.uuid).toBeUndefined()
 		})
 
-		it('calls openDocument with correct parameters', async () => {
+		it('opens the signed PDF by UUID without passing the owner nodeId', async () => {
 			wrapper = createWrapper({
 				document: {
 					uuid: 'doc-uuid-123',
@@ -410,9 +410,24 @@ describe('DocumentValidationDetails', () => {
 			await wrapper.vm.viewDocument()
 
 			expect(viewer.openDocument).toHaveBeenCalledWith({
-				fileUrl: expect.stringContaining('doc-uuid-123'),
+				fileUrl: '/apps/libresign/p/pdf/doc-uuid-123',
 				filename: 'Test.pdf',
-				nodeId: 456,
+			})
+		})
+
+		it('opens the document when the response has no nodeId', async () => {
+			wrapper = createWrapper({
+				document: {
+					uuid: 'no-node-id',
+					name: 'No nodeId.pdf',
+				},
+			})
+
+			await wrapper.vm.viewDocument()
+
+			expect(viewer.openDocument).toHaveBeenCalledWith({
+				fileUrl: '/apps/libresign/p/pdf/no-node-id',
+				filename: 'No nodeId.pdf',
 			})
 		})
 
@@ -451,8 +466,8 @@ describe('DocumentValidationDetails', () => {
 		it('does not open viewer without required viewer data', async () => {
 			wrapper = createWrapper({
 				document: {
-					uuid: 'missing-node-id',
-					name: 'Missing nodeId.pdf',
+					name: 'Missing uuid.pdf',
+					nodeId: 456,
 				},
 			})
 
diff --git a/src/tests/components/validation/EnvelopeValidation.spec.ts b/src/tests/components/validation/EnvelopeValidation.spec.ts
index 65faf8dea9..7e46b0d1c2 100644
--- a/src/tests/components/validation/EnvelopeValidation.spec.ts
+++ b/src/tests/components/validation/EnvelopeValidation.spec.ts
@@ -398,13 +398,12 @@ describe('EnvelopeValidation', () => {
 			})
 
 			expect(viewer.openDocument).toHaveBeenCalledWith({
-				fileUrl: expect.stringContaining('file-uuid-123'),
+				fileUrl: '/apps/libresign/p/pdf/file-uuid-123',
 				filename: 'Document.pdf',
-				nodeId: 456,
 			})
 		})
 
-		it('does not open viewer without nodeId', () => {
+		it('opens the file by UUID when it has no nodeId', () => {
 			wrapper = createWrapper()
 
 			wrapper.vm.viewFile({
@@ -412,6 +411,20 @@ describe('EnvelopeValidation', () => {
 				name: 'Document.pdf',
 			})
 
+			expect(viewer.openDocument).toHaveBeenCalledWith({
+				fileUrl: '/apps/libresign/p/pdf/file-uuid-123',
+				filename: 'Document.pdf',
+			})
+		})
+
+		it('does not open viewer without uuid', () => {
+			wrapper = createWrapper()
+
+			wrapper.vm.viewFile({
+				name: 'Document.pdf',
+				nodeId: 456,
+			})
+
 			expect(viewer.openDocument).not.toHaveBeenCalled()
 		})
 	})
@@ -584,8 +597,8 @@ describe('EnvelopeValidation', () => {
 			expect(typeof wrapper.vm.isTouchDevice).toBe('boolean')
 		})
 
-		it('renders actions slot when not touch device and file has nodeId', async () => {
-			const file: EnvelopeFile = { id: 1, nodeId: 123, status: '3', name: 'test.pdf' }
+		it('renders actions slot when not touch device and file has uuid', async () => {
+			const file: EnvelopeFile = { id: 1, uuid: 'test-uuid', nodeId: 123, status: '3', name: 'test.pdf' }
 			wrapper = createWrapper({
 				document: { files: [file] },
 			})
@@ -608,7 +621,6 @@ describe('EnvelopeValidation', () => {
 			expect(viewer.openDocument).toHaveBeenCalledWith({
 				fileUrl: '/apps/libresign/p/pdf/test-uuid',
 				filename: 'test.pdf',
-				nodeId: 123,
 			})
 		})
 
@@ -623,7 +635,6 @@ describe('EnvelopeValidation', () => {
 			expect(viewer.openDocument).toHaveBeenCalledWith({
 				fileUrl: '/apps/libresign/p/pdf/test-uuid',
 				filename: 'test.pdf',
-				nodeId: 123,
 			})
 		})
 	})
diff --git a/src/tests/utils/viewer.spec.ts b/src/tests/utils/viewer.spec.ts
index fb47daa90a..bd41c8ee87 100644
--- a/src/tests/utils/viewer.spec.ts
+++ b/src/tests/utils/viewer.spec.ts
@@ -113,4 +113,24 @@ describe('openDocument', () => {
 		expect(openedUrl).toContain('/apps/libresign/p/pdf/file-uuid')
 		expect(openedUrl).toMatch(/_t=\d+$/)
 	})
+
+	it('opens URL directly for authenticated users when no nodeId is given', () => {
+		const viewerOpen = vi.fn()
+		;(global as GlobalWithOCA).OCA = {
+			Viewer: {
+				open: viewerOpen,
+			},
+		}
+
+		openDocument({
+			fileUrl: '/apps/libresign/p/pdf/file-uuid',
+			filename: 'signed.pdf',
+		})
+
+		expect(viewerOpen).not.toHaveBeenCalled()
+		expect(openSpy).toHaveBeenCalledTimes(1)
+		const openedUrl = openSpy.mock.calls[0]?.[0]
+		expect(openedUrl).toContain('/apps/libresign/p/pdf/file-uuid')
+		expect(openedUrl).toMatch(/_t=\d+$/)
+	})
 })
diff --git a/src/utils/viewer.js b/src/utils/viewer.js
index ef6d5d419a..ecdf0d9393 100644
--- a/src/utils/viewer.js
+++ b/src/utils/viewer.js
@@ -31,15 +31,20 @@ const extractRelativePath = (url) => {
  * the public LibreSign PDF URL from loading. Fall back to a direct window open
  * in that case.
  *
+ * Without a node ID the Viewer is skipped as well: some Viewer handlers
+ * (e.g. Euro-Office/ONLYOFFICE) ignore `source` and resolve `fileid` in the
+ * current user's filesystem, so they must only receive a node the current
+ * user can access.
+ *
  * @param {object} options - Options for opening the document
  * @param {string} options.fileUrl - The URL of the file to open
  * @param {string} options.filename - The name of the file
- * @param {number} options.nodeId - The Nextcloud node ID
+ * @param {number} [options.nodeId] - The Nextcloud node ID, only when accessible by the current user
  * @param {string} [options.mime] - The MIME type (defaults to 'application/pdf')
  */
 export const openDocument = ({ fileUrl, filename, nodeId, mime = 'application/pdf' }) => {
 	const source = extractRelativePath(fileUrl)
-	const canUseViewer = OCA?.Viewer !== undefined && getCurrentUser() !== null
+	const canUseViewer = OCA?.Viewer !== undefined && getCurrentUser() !== null && typeof nodeId === 'number'
 
 	if (canUseViewer) {
 		const fileInfo = {
diff --git a/src/views/Validation.vue b/src/views/Validation.vue
index f8d4d10b0a..0c39cce1a7 100644
--- a/src/views/Validation.vue
+++ b/src/views/Validation.vue
@@ -584,14 +584,13 @@ function getIconValidityPath(signer: ValidationDisplaySigner) {
 }
 
 async function viewDocument() {
-	if (!document.value?.uuid || !document.value?.name || typeof document.value.nodeId !== 'number') {
+	if (!document.value?.uuid || !document.value?.name) {
 		return
 	}
 	const fileUrl = generateUrl('/apps/libresign/p/pdf/{uuid}', { uuid: document.value.uuid })
 	await openDocument({
 		fileUrl,
 		filename: document.value.name,
-		nodeId: document.value.nodeId,
 	})
 }