From c58e860ff06a42478c5a55a2febaf205d2ec911f Mon Sep 17 00:00:00 2001
From: bernardhanna <bernard@matrixinternet.ie>
Date: Fri, 1 May 2026 09:49:27 +0100
Subject: [PATCH 1/2] fix(training): embed roadmap PDF in iframe again for
 clickable links

PDF.js canvas rendering dropped link annotations; use the native PDF
viewer in an iframe so roadmap URLs stay interactive.

Made-with: Cursor
---
 .../TrainingRoadmapPdfController.php          | 51 ---------------
 .../partials/roadmap-pdf-embed.blade.php      |  7 +-
 .../views/training/roadmap-pdfjs.blade.php    | 65 -------------------
 routes/web.php                                |  5 --
 4 files changed, 2 insertions(+), 126 deletions(-)
 delete mode 100644 app/Http/Controllers/TrainingRoadmapPdfController.php
 delete mode 100644 resources/views/training/roadmap-pdfjs.blade.php

diff --git a/app/Http/Controllers/TrainingRoadmapPdfController.php b/app/Http/Controllers/TrainingRoadmapPdfController.php
deleted file mode 100644
index 72899ccd0..000000000
--- a/app/Http/Controllers/TrainingRoadmapPdfController.php
+++ /dev/null
@@ -1,51 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Facades\Http;
-
-class TrainingRoadmapPdfController extends Controller
-{
-    /**
-     * Public roadmap PDF used by the Discover Digital Programme embed.
-     * Kept allowlisted here so the proxy cannot be abused as an open redirect.
-     */
-    private const ROADMAP_SOURCE = 'https://codeweek-resources.s3.eu-west-1.amazonaws.com/+discover-digital-toolkit/DDP_toolkit_roadmap.pdf';
-
-    /**
-     * Same-origin PDF bytes for PDF.js (avoids cross-origin fetch issues).
-     */
-    public function proxyPdf()
-    {
-        $bytes = Cache::remember(
-            'training_embedded_roadmap_pdf_v1',
-            3600,
-            function () {
-                $response = Http::timeout(120)->get(self::ROADMAP_SOURCE);
-
-                if (! $response->successful()) {
-                    abort(502, 'Unable to load roadmap PDF.');
-                }
-
-                return $response->body();
-            }
-        );
-
-        return response($bytes, 200, [
-            'Content-Type' => 'application/pdf',
-            'Content-Disposition' => 'inline; filename="DDP_toolkit_roadmap.pdf"',
-            'Cache-Control' => 'public, max-age=3600',
-        ]);
-    }
-
-    /**
-     * Minimal PDF.js viewer (no site chrome) for iframe embedding on training pages.
-     */
-    public function viewer()
-    {
-        return response()
-            ->view('training.roadmap-pdfjs')
-            ->header('X-Frame-Options', 'SAMEORIGIN');
-    }
-}
diff --git a/resources/views/training/partials/roadmap-pdf-embed.blade.php b/resources/views/training/partials/roadmap-pdf-embed.blade.php
index c037de629..e9d50e771 100644
--- a/resources/views/training/partials/roadmap-pdf-embed.blade.php
+++ b/resources/views/training/partials/roadmap-pdf-embed.blade.php
@@ -4,12 +4,9 @@
 @php
     // Strip any fragment from stored URL for the "open in new tab" link.
     $tabUrl = \Illuminate\Support\Str::before($url, '#');
-    // Same-origin PDF.js viewer for the allowlisted DDP roadmap (see TrainingRoadmapPdfController).
-    // Other URLs keep the direct PDF iframe with viewer chrome hints.
-    $ddpRoadmapBase = 'https://codeweek-resources.s3.eu-west-1.amazonaws.com/+discover-digital-toolkit/DDP_toolkit_roadmap.pdf';
-    $usePdfjsViewer = strtolower(rtrim($tabUrl, '/')) === strtolower(rtrim($ddpRoadmapBase, '/'));
+    // Native PDF in iframe keeps link annotations clickable (canvas PDF.js viewers do not).
     $fragment = '#toolbar=0&navpanes=0&scrollbar=1&view=FitH';
-    $embedSrc = $usePdfjsViewer ? route('training.roadmap_pdf_viewer') : $tabUrl.$fragment;
+    $embedSrc = $tabUrl.$fragment;
 @endphp
 <div class="w-full max-w-full my-6 rounded-xl overflow-hidden border border-slate-200 bg-slate-100 shadow-sm">
     <iframe
diff --git a/resources/views/training/roadmap-pdfjs.blade.php b/resources/views/training/roadmap-pdfjs.blade.php
deleted file mode 100644
index 54869ad6f..000000000
--- a/resources/views/training/roadmap-pdfjs.blade.php
+++ /dev/null
@@ -1,65 +0,0 @@
-<!DOCTYPE html>
-<html lang="{{ str_replace('_', '-', app()->getLocale()) }}">
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta name="robots" content="noindex, nofollow">
-    <title>{{ __('Roadmap') }}</title>
-    <style>
-        html, body { margin: 0; padding: 0; background: #f1f5f9; min-height: 100%; }
-        #pdf-scroll { max-width: 100%; padding: 8px; box-sizing: border-box; overflow-x: hidden; overflow-y: auto; }
-        #pdf-error { color: #b91c1c; padding: 1rem; font-family: system-ui, sans-serif; font-size: 0.9rem; }
-        canvas { display: block; max-width: 100%; height: auto !important; margin: 0 auto 1rem; border-radius: 6px; box-shadow: 0 1px 3px rgb(0 0 0 / 0.12); background: #fff; }
-    </style>
-</head>
-<body>
-    <div id="pdf-error" role="alert"></div>
-    <div id="pdf-scroll"></div>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
-    <script>
-        (async function () {
-            var pdfUrl = @json(url(route('training.embedded_pdf.roadmap')));
-            var pdfjsLib = window.pdfjsLib || window['pdfjs-dist/build/pdf'];
-            var container = document.getElementById('pdf-scroll');
-            var err = document.getElementById('pdf-error');
-
-            if (!pdfjsLib || typeof pdfjsLib.getDocument !== 'function') {
-                err.textContent = 'PDF viewer failed to load.';
-                return;
-            }
-
-            pdfjsLib.GlobalWorkerOptions.workerSrc = 'https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.worker.min.js';
-
-            try {
-                var pdf = await pdfjsLib.getDocument({ url: pdfUrl }).promise;
-
-                async function renderAll() {
-                    container.innerHTML = '';
-                    var cw = Math.max(200, container.clientWidth || window.innerWidth);
-                    for (var p = 1; p <= pdf.numPages; p++) {
-                        var page = await pdf.getPage(p);
-                        var base = page.getViewport({ scale: 1 });
-                        var scale = Math.min(2.2, Math.max(0.4, (cw - 16) / base.width));
-                        var viewport = page.getViewport({ scale: scale });
-                        var canvas = document.createElement('canvas');
-                        var ctx = canvas.getContext('2d', { alpha: false });
-                        canvas.width = viewport.width;
-                        canvas.height = viewport.height;
-                        await page.render({ canvasContext: ctx, viewport: viewport }).promise;
-                        container.appendChild(canvas);
-                    }
-                }
-
-                await renderAll();
-                var t;
-                window.addEventListener('resize', function () {
-                    clearTimeout(t);
-                    t = setTimeout(function () { renderAll(); }, 200);
-                });
-            } catch (e) {
-                err.textContent = (e && e.message) ? e.message : 'Could not open PDF.';
-            }
-        })();
-    </script>
-</body>
-</html>
diff --git a/routes/web.php b/routes/web.php
index b3de9d7c8..bcfdf2de8 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -63,7 +63,6 @@
 use App\Http\Controllers\CertificateBackendController;
 use App\Http\Controllers\ToolkitsController;
 use App\Http\Controllers\TrainingController;
-use App\Http\Controllers\TrainingRoadmapPdfController;
 use App\Http\Controllers\UnsubscribeController;
 use App\Http\Controllers\UserController;
 use App\Http\Controllers\VolunteerController;
@@ -341,10 +340,6 @@
 Route::get('/training-preview/{trainingResource}', [TrainingController::class, 'preview'])
     ->middleware('signed')
     ->name('training.preview');
-Route::get('/training/embedded-roadmap.pdf', [TrainingRoadmapPdfController::class, 'proxyPdf'])
-    ->name('training.embedded_pdf.roadmap');
-Route::get('/training/roadmap-pdf-viewer', [TrainingRoadmapPdfController::class, 'viewer'])
-    ->name('training.roadmap_pdf_viewer');
 Route::get('/training/{slug}', [TrainingController::class, 'show'])->name('training.dynamic.show');
 Route::post('/contact-submit', [ContactFormController::class, 'submit'])
     ->middleware('throttle:5,1') // 5 requests per minute per IP

From 0e88bca20d6cf543244bbc5f37a28cc133e121c1 Mon Sep 17 00:00:00 2001
From: bernardhanna <bernard@matrixinternet.ie>
Date: Fri, 1 May 2026 09:57:56 +0100
Subject: [PATCH 2/2] fix(training): standard PDF iframe URL and clarify PDF vs
 SVG for links

- Point iframe at plain PDF URL (no viewer hash) for native link behaviour
- Nova copy: recommend PDF for clickable roadmap links; SVG as static-only

Made-with: Cursor
---
 app/Nova/TrainingResource.php                          | 10 +++++-----
 .../training/partials/roadmap-pdf-embed.blade.php      |  7 +++----
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/app/Nova/TrainingResource.php b/app/Nova/TrainingResource.php
index d907c53b5..dc9a9ea50 100644
--- a/app/Nova/TrainingResource.php
+++ b/app/Nova/TrainingResource.php
@@ -157,12 +157,12 @@ public function fields(Request $request): array
 
             Select::make('Roadmap embed format', 'roadmap_embed_kind')
                 ->options([
-                    'pdf' => 'PDF (inline viewer)',
-                    'svg' => 'SVG (paste markup below)',
+                    'pdf' => 'PDF (recommended — keeps clickable links from the file)',
+                    'svg' => 'SVG (static graphic; exports usually do not preserve PDF links)',
                     'none' => 'None (remove placeholder output)',
                 ])
                 ->default('pdf')
-                ->help('Use [[embed_roadmap_pdf]] or [[embed_roadmap]] in Content where the roadmap should appear.'),
+                ->help('Put [[embed_roadmap_pdf]] or [[embed_roadmap]] in Content where the roadmap should appear. Use PDF when the roadmap must open real URLs from the document.'),
 
             Text::make('Roadmap PDF embed URL', 'roadmap_pdf_embed_url')
                 ->nullable()
@@ -174,7 +174,7 @@ public function fields(Request $request): array
                         $field->hide();
                     }
                 })
-                ->help('HTTPS URL to the roadmap PDF. Used when format is PDF.'),
+                ->help('HTTPS URL to the PDF. Shown in an iframe with the browser’s built-in PDF viewer so links inside the file stay active.'),
 
             Textarea::make('Roadmap SVG', 'roadmap_svg')
                 ->nullable()
@@ -186,7 +186,7 @@ public function fields(Request $request): array
                         $field->hide();
                     }
                 })
-                ->help('Full <svg>...</svg> markup from your design tool. Used when format is SVG.'),
+                ->help('Optional: paste full <svg>...</svg> only for a non-interactive graphic. For clickable resources, prefer PDF above.'),
 
             Text::make('Button text', 'button_text')->nullable(),
 
diff --git a/resources/views/training/partials/roadmap-pdf-embed.blade.php b/resources/views/training/partials/roadmap-pdf-embed.blade.php
index e9d50e771..496cac9f0 100644
--- a/resources/views/training/partials/roadmap-pdf-embed.blade.php
+++ b/resources/views/training/partials/roadmap-pdf-embed.blade.php
@@ -2,11 +2,10 @@
     'url',
 ])
 @php
-    // Strip any fragment from stored URL for the "open in new tab" link.
+    // Strip any fragment from stored URL for the "open in new tab" link and iframe src.
+    // Use the plain PDF URL in the iframe so the browser's native viewer keeps link annotations working.
     $tabUrl = \Illuminate\Support\Str::before($url, '#');
-    // Native PDF in iframe keeps link annotations clickable (canvas PDF.js viewers do not).
-    $fragment = '#toolbar=0&navpanes=0&scrollbar=1&view=FitH';
-    $embedSrc = $tabUrl.$fragment;
+    $embedSrc = $tabUrl;
 @endphp
 <div class="w-full max-w-full my-6 rounded-xl overflow-hidden border border-slate-200 bg-slate-100 shadow-sm">
     <iframe