feat(edit): fail-closed validation before Edit PDF publish (#34) - #54
Open
nonamexishere wants to merge 2 commits into
Open
feat(edit): fail-closed validation before Edit PDF publish (#34)#54nonamexishere wants to merge 2 commits into
nonamexishere wants to merge 2 commits into
Conversation
Validate staged Edit PDF output before the destination rename so a truncated or structurally wrong file cannot replace the user's dest. qpdf --check errors are fatal; warnings are recorded and do not block. Fixes McanKul#34.
nonamexishere
force-pushed
the
feat/34-validate-edit-output
branch
from
August 24, 2026 13:49
660d77d to
ae51a6e
Compare
Re-check cancel after qpdf --check and before publish so a mid-gate Cancel returns CANCELLED, deletes staging, and does not replace dest. Production --check registers on the job handle like overlay qpdf.
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a fail-closed publish gate for Edit PDF (#34). After qpdf writes the dest-sibling temp file, and before the atomic rename onto the chosen destination, OffPDF now:
qpdf --check(exit 2 = fatal, exit 3 = warning recorded and does not block, exit 0 = clean)/Rotate,/UserUnitA failed gate returns
INVALID_OUTPUT, deletes the staging file, and leaves the original and any existing destination untouched. The gate isvalidate_staged_pdfso later annotation / form / redaction work can reuse it.Packaged Save uses the same bundled qpdf binary as overlay (
resolve_qpdf(app)).Why
Epic #12’s definition of done calls for output validation before any existing-content mutation ships. Today a damaged overlay result could still replace the destination.
Validation
npm run typechecknpm test(179)cargo check --manifest-path src-tauri/Cargo.tomlcargo test --manifest-path src-tauri/Cargo.toml --lib(109)Privacy Checklist