fix(documents): RFC 5987 Content-Disposition so NFD filenames stop crashing inline view (#964)

* fix(documents): RFC 5987 Content-Disposition so NFD filenames stop crashing inline view

macOS/iOS uploads carry NFD-decomposed filenames (base letter + combining
diaeresis U+0308, char code 776). undici Headers require ByteString values
(every code unit <= 0xFF), so splicing the raw filename into the
Content-Disposition header threw while building the response and the
inline document route 500ed. 122 prod documents across 35 companies hit
this; last crash 2026-07-09T16:17.

Add lib/api/content-disposition.ts emitting the RFC 6266 dual form:
an ASCII quoted fallback (NFC-normalize, then replace anything outside
printable ASCII plus quote and backslash with _) and
filename*=UTF-8''<percent-encoded> per RFC 5987 (encodeURIComponent on
the NFC name, additionally escaping ! ' ( ) * which it leaves bare).

Use it in the inline document route and in the two latent same-shape
sites that embed raw employee names in payslip PDF headers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(api): sanitize lone surrogates before percent-encoding Content-Disposition (CodeRabbit)

Unpaired UTF-16 surrogates survive normalize('NFC') and make encodeURIComponent throw a URIError, so replace them with U+FFFD via String.prototype.toWellFormed() before encoding so the helper always returns a valid header value.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/documents/[id]/inline/__tests__/route.test.ts

@@ -0,0 +1,108 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import {
+  parseJsonResponse,
+  createMockRouteParams,
+  createQueuedMockSupabase,
+} from '@/tests/helpers'
+
+const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+const downloadMock = vi.fn()
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => ({
+    storage: {
+      from: () => ({ download: downloadMock }),
+    },
+  }),
+}))
+
+import { GET } from '../route'
+import { NextResponse } from 'next/server'
+
+const mockUser = { id: 'user-1', email: 'test@test.se' }
+
+// NFD filename as macOS/iOS uploads produce them: o + combining diaeresis
+// U+0308 (char code 776). This is the exact shape that made the raw header
+// build throw in prod (undici Headers require code units <= 0xFF).
+const NFD_FILE_NAME = 'kvitto fo\u0308rvaring.pdf'
+
+function makeDoc(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'doc-1',
+    company_id: 'company-1',
+    file_name: NFD_FILE_NAME,
+    mime_type: 'application/pdf',
+    storage_path: 'documents/user-1/doc-1.pdf',
+    ...overrides,
+  }
+}
+
+function makeReq() {
+  return new Request('http://localhost/api/documents/doc-1/inline')
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  requireAuthMock.mockResolvedValue({ user: mockUser, supabase: mockSupabase, error: null })
+  downloadMock.mockResolvedValue({ data: new Blob(['%PDF-1.4']), error: null })
+})
+
+describe('GET /api/documents/[id]/inline', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: mockSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await GET(makeReq(), createMockRouteParams({ id: 'doc-1' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(401)
+  })
+
+  it('returns 404 when the document is not found', async () => {
+    enqueue({ data: null, error: { message: 'not found' } }) // doc lookup
+    const res = await GET(makeReq(), createMockRouteParams({ id: 'doc-1' }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(404)
+    expect(body.error).toBe('Document not found')
+  })
+
+  it('returns 404 when the user is not a member of the document company', async () => {
+    enqueue({ data: makeDoc(), error: null }) // doc lookup
+    enqueue({ data: null, error: null }) // membership lookup
+    const res = await GET(makeReq(), createMockRouteParams({ id: 'doc-1' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(404)
+  })
+
+  it('returns 500 when the storage download fails', async () => {
+    enqueue({ data: makeDoc(), error: null })
+    enqueue({ data: { company_id: 'company-1' }, error: null })
+    downloadMock.mockResolvedValue({ data: null, error: { message: 'boom' } })
+    const res = await GET(makeReq(), createMockRouteParams({ id: 'doc-1' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(500)
+  })
+
+  it('streams the file with an RFC 5987 Content-Disposition for an NFD filename', async () => {
+    enqueue({ data: makeDoc(), error: null })
+    enqueue({ data: { company_id: 'company-1' }, error: null })
+
+    const res = await GET(makeReq(), createMockRouteParams({ id: 'doc-1' }))
+
+    expect(res.status).toBe(200)
+    const disposition = res.headers.get('Content-Disposition') ?? ''
+    expect(disposition).toContain('inline')
+    // Extended form carries the NFC-composed UTF-8 percent-encoded name.
+    expect(disposition).toContain(`filename*=UTF-8''kvitto%20f%C3%B6rvaring.pdf`)
+    // ASCII fallback replaces the non-ASCII character.
+    expect(disposition).toContain('filename="kvitto f_rvaring.pdf"')
+    expect(res.headers.get('Content-Type')).toBe('application/pdf')
+  })
+})

app/api/documents/[id]/inline/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { requireAuth } from '@/lib/auth/require-auth'
 import { createServiceClient } from '@/lib/supabase/server'
+import { contentDisposition } from '@/lib/api/content-disposition'
 
 /**
  * GET /api/documents/:id/inline
@@ -87,13 +88,14 @@ export async function GET(
     )
   }
 
-  const safeFileName = doc.file_name.replace(/[\r\n"]/g, '_')
-
   return new NextResponse(blob, {
     status: 200,
     headers: {
       'Content-Type': resolveContentType(doc.file_name, doc.mime_type),
-      'Content-Disposition': `inline; filename="${safeFileName}"`,
+      // RFC 5987 dual form: NFD filenames from macOS/iOS uploads contain
+      // combining marks (> 0xFF), which undici Headers reject as non-
+      // ByteString values; splicing the raw name here 500ed the route.
+      'Content-Disposition': contentDisposition('inline', doc.file_name),
       'Cache-Control': 'private, max-age=300',
       // Block MIME sniffing: Content-Type is derived from DB metadata
       // (with extension fallback for legacy rows), never from response

app/api/payslip/[token]/pdf/route.ts

@@ -4,6 +4,7 @@ import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
 import { resolvePayslipToken, isValidPayslipTokenFormat } from '@/lib/salary/payslips/links'
 import { buildPayslipData, payslipFileName } from '@/lib/salary/payslips/build-payslip-data'
 import { PayslipPDF } from '@/lib/salary/pdf/payslip-template'
+import { contentDisposition } from '@/lib/api/content-disposition'
 
 // In-memory rate limiting per token (pattern from /api/calendar/feed).
 const rateLimitMap = new Map<string, { count: number; resetAt: number }>()
@@ -118,7 +119,10 @@ export async function GET(
   return new Response(buffer as unknown as BodyInit, {
     headers: {
       'Content-Type': 'application/pdf',
-      'Content-Disposition': `attachment; filename="${fileName}"`,
+      // RFC 5987 dual form: employee names with non-Latin-1 characters
+      // (e.g. NFD combining marks) would otherwise make undici reject
+      // the header value and crash the response.
+      'Content-Disposition': contentDisposition('attachment', fileName),
       'Cache-Control': 'no-store',
     },
   })

app/api/salary/runs/[id]/payslips/[employeeId]/pdf/route.ts

@@ -5,6 +5,7 @@ import { getCompanyDisplayName } from '@/lib/company/context'
 import { renderToBuffer } from '@react-pdf/renderer'
 import { PayslipPDF } from '@/lib/salary/pdf/payslip-template'
 import { buildPayslipData, payslipFileName } from '@/lib/salary/payslips/build-payslip-data'
+import { contentDisposition } from '@/lib/api/content-disposition'
 
 ensureInitialized()
 
@@ -81,7 +82,10 @@ export const GET = withRouteContext<{ params: Promise<{ id: string; employeeId:
     return new Response(buffer as unknown as BodyInit, {
       headers: {
         'Content-Type': 'application/pdf',
-        'Content-Disposition': `inline; filename="${fileName}"`,
+        // RFC 5987 dual form: employee names with non-Latin-1 characters
+        // (e.g. NFD combining marks) would otherwise make undici reject
+        // the header value and crash the response.
+        'Content-Disposition': contentDisposition('inline', fileName),
       },
     })
   },