From e09b0561156fb374de6cb72e98ab26a73c7fb359 Mon Sep 17 00:00:00 2001
From: Pontoporeia <pontoporeia@happyngreen.fr>
Date: Mon, 27 Apr 2026 21:11:58 +0200
Subject: [PATCH] fix: iframe for PDF display, exclude cover files from public
 loop, no session on media requests

---
 TODO.md                      |  6 ++++++
 app/src/Dispatcher.php       |  7 ++++---
 app/templates/public/tfe.php | 11 ++++++++---
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/TODO.md b/TODO.md
index 637bc28..ff1e192 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,5 +1,11 @@
 # TODO
 
+## TFE Public Page — File Display
+
+- [x] Replace `<embed>` with `<iframe>` for PDF display (better cross-browser support)
+- [x] Exclude `cover` file_type from public files loop (covers are banners, not content)
+- [x] Move `App::boot()` in Dispatcher to after direct-response matching (no session on media requests)
+
 ## Dev / Debug Fixes
 
 - [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets/connection noise
diff --git a/app/src/Dispatcher.php b/app/src/Dispatcher.php
index 490b980..6b5dee1 100644
--- a/app/src/Dispatcher.php
+++ b/app/src/Dispatcher.php
@@ -48,9 +48,6 @@ class Dispatcher {
      * execute the action, and render the view.
      */
     public function dispatch(): void {
-        // Ensure session + CSRF token are initialised for all public requests
-        require_once APP_ROOT . '/src/App.php';
-        App::boot();
         // 1. Direct-response endpoints (render their own output)
         $direct = $this->matchDirect();
         if ($direct) {
@@ -58,6 +55,10 @@ class Dispatcher {
             return;
         }
 
+        // Ensure session + CSRF token are initialised for routed pages
+        require_once APP_ROOT . '/src/App.php';
+        App::boot();
+
         // 2. Routed pages (controller + view)
         $route = $this->matchRoute();
         if (!$route) {
diff --git a/app/templates/public/tfe.php b/app/templates/public/tfe.php
index 99cbe9f..ca85c53 100644
--- a/app/templates/public/tfe.php
+++ b/app/templates/public/tfe.php
@@ -290,13 +290,18 @@
             <?php elseif (!empty($data['files'])): ?>
                 <?php foreach ($data['files'] as $file): ?>
                     <?php
-                        $ext = strtolower(pathinfo($file['file_path'], PATHINFO_EXTENSION));
+                        $ext      = strtolower(pathinfo($file['file_path'], PATHINFO_EXTENSION));
+                        $fileType = $file['file_type'] ?? '';
                         if ($ext === 'vtt') continue;
+                        if ($fileType === 'cover') continue;
                     ?>
                     <figure>
                         <?php if ($ext === 'pdf'): ?>
-                            <embed src="/media?path=<?= urlencode($file['file_path']) ?>"
-                                   type="application/pdf" width="100%" height="700px">
+                            <iframe src="/media?path=<?= urlencode($file['file_path']) ?>"
+                                    width="100%" height="700px"
+                                    style="border:none"
+                                    title="<?= htmlspecialchars($file['original_name'] ?? basename($file['file_path'])) ?>">
+                            </iframe>
                             <p class="tfe-pdf-fallback">
                                 <a href="/media?path=<?= urlencode($file['file_path']) ?>&download=1">
                                     Télécharger le PDF