fix: serve pdf via direct secure link to bypass brave shield

Backend/app/api/v1/endpoints/notes.py

@@ -335,7 +335,6 @@ async def get_pdf_content(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user)
 ):
-    """Serve the raw PDF binary data for the viewer."""
     result = await db.execute(
         select(PDFData).where(PDFData.id == pdf_id, PDFData.user_id == current_user.id)
     )
@@ -344,8 +343,16 @@ async def get_pdf_content(
     if not pdf:
         raise HTTPException(status_code=404, detail="Note not found")
 
-    # Return raw bytes with PDF mime type so browser/frontend can render it
-    return Response(content=pdf.pdf_blob, media_type="application/pdf")
+    # FIX: Add 'Content-Disposition: inline' to tell browser to render it
+    headers = {
+        "Content-Disposition": f"inline; filename={pdf.filename}"
+    }
+    
+    return Response(
+        content=pdf.pdf_blob, 
+        media_type="application/pdf",
+        headers=headers
+    )
 
 
 # -------------------------

Frontend/src/pages/note.tsx

@@ -1,6 +1,7 @@
 import ReactMarkdown from "react-markdown";
 import remarkGfm from "remark-gfm";
 import React, { useEffect, useState, useRef, useCallback } from "react";
+import { getNoteContentUrl } from "../api/notesService";
 import {
   Upload,
   Menu,
@@ -186,18 +187,12 @@ const Notes: React.FC = () => {
   const handleNoteSelect = async (note: Note) => {
     if (editingNoteId === note.id) return;
     setCurrentNote(note);
-    setPdfUrl(null);
     setMessages([]);
     setSessionId(null);
     setIsChatOpen(true);
 
-    try {
-      const blob = await fetchNoteBlob(note.id);
-      const url = URL.createObjectURL(blob);
-      setPdfUrl(url);
-    } catch (error) {
-      console.error("Failed to load PDF", error);
-    }
+    const secureUrl = getNoteContentUrl(note.id);
+    setPdfUrl(secureUrl);
 
     try {
       const existingSessions = await fetchSessions(note.id);