Fighter90/career-ops-ui v1.169.0

on GitHub

[1.169.0] — 2026-08-13

Added (LOW) — inline PDF preview (D-5). GET /api/output/pdfs/:name forced Content-Disposition: attachment, so even the #/cv "Open" link downloaded the file instead of showing it — the docs stress "review it before sending it anywhere".

Added

• ?inline=1 on GET /api/output/pdfs/:name serves the SAME sanitized file with Content-Disposition: inline, so the browser renders it in a new tab for a review-before-send 👁 Preview. The default (no param) stays a download (attachment). No new route/surface; the same path-name guards apply.
• The #/cv generated-PDF list's first button is now 👁 Preview (opens ?inline=1) next to the unchanged ⬇ Download. cv.openPdf reworded "Open" → "Preview" ×17.

Notes

• No CSP/SSRF change — same sanitizePathName gate; inline only affects the disposition header on the user's own generated PDF (served application/pdf). One existing i18n key reworded ×17 (no new keys; snapshot 1219).
• Tests: tests/output-pdfs.test.mjs (+3: inline header, default-attachment, path guards under ?inline=1). Suite: 2432 (+3).