feat(f6.8): harden offline field flow and act documents

api-v3/src/inspection-reports/inspection-reports.controller.ts

@@ -28,6 +28,7 @@ import {
 } from './inspection-report-workflow.service';
 import { InspectionReportsService } from './inspection-reports.service';
 import { InspectionReportWordService } from './inspection-report-word.service';
+import { InspectionActPdfService } from './inspection-act-pdf.service';
 
 @Controller('inspection-reports')
 export class InspectionReportsController {
@@ -148,3 +149,24 @@ export class InspectionActReportController {
     return this.reports.generate(actId, principal, request);
   }
 }
+
+@Controller('inspection-acts/:actId/pdf')
+export class InspectionActPdfController {
+  constructor(private readonly pdf: InspectionActPdfService) {}
+
+  @Get()
+  @RequirePermissions('inspection_acts.read')
+  async content(
+    @Param('actId', new ParseUUIDPipe({ version: '4' })) actId: string,
+    @Res() response: Response,
+  ) {
+    await this.pdf.ensure(actId);
+    const content = await this.pdf.content(actId);
+    response.setHeader('Content-Type', content.mimeType);
+    response.setHeader('Content-Length', String(content.buffer.length));
+    response.setHeader('Content-Disposition', `inline; filename="${content.originalName.replaceAll('"', '')}"`);
+    response.setHeader('Cache-Control', 'private, no-store');
+    response.setHeader('X-Content-Type-Options', 'nosniff');
+    return response.send(content.buffer);
+  }
+}