From 183fcc5fabcdf5cc648d86a543fcede0ae5be834 Mon Sep 17 00:00:00 2001
From: Andreas Stefl <stefl.andreas@gmail.com>
Date: Sun, 16 Aug 2026 08:45:14 +0200
Subject: [PATCH 1/3] Render PDFs with odrcore, and hide the buttons a document
 cannot use

PDFs were the one format pushed off odrcore on purpose: `translate` refused
them and `documentLoadingError` handed the file to WKWebView, which drew it
with the system viewer. Nothing in the app reached inside that - no search,
no fit to the screen, and the tool bar sat above a page it knew nothing
about. odrcore has rendered PDFs itself since 6.2, so the guard is gone and a
pdf goes down the same path as a document: `isPdfFile` joins the guard, and
the branch that has no `Document` behind it - the one a csv already took -
translates the decoded file. `.unknown` keeps the combined view, which for a
pdf is every page.

Images, media and fonts stay with the system. odrcore translates them too,
but only into an `<img>` or a `<video>` the web view decodes anyway, and its
own table says the page it writes for a psd or a wmf paints nothing.

Search is not on yet: odrcore writes the `odr` object into what it renders as
a document or as text, and `pdf_file.cpp` does not call
`write_document_script`. So the button is now driven by the page rather than
by the format - `didFinish` asks whether `odr.search` is there. A pdf picks
the button up on its own the day odrcore writes the script for it, with no
change here. `testPdfPageCarriesItsText` holds the other half of that: the
text is in the page, so there will be something to walk.

The button goes rather than greys out, like the pencil beside it. Both are
filtered out of the bar together with the 10pt gap behind them, or what stays
drifts off the trailing edge - hence the two new spacer outlets. `canEdit`
and `canSearch` replace `showEditButton`, and `EXTENSION_WHITELIST` is now
`systemRenderedExtensions`, which is what it always was: the other side of
odrcore's format table, not something derived from it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UNugiHVRHVc1CGHgVGW7Dz
---
 CHANGELOG.md                                  |  12 +++
 OpenDocumentReader.xcodeproj/project.pbxproj  |   4 +
 OpenDocumentReader/CoreWrapper.swift          |  20 ++---
 .../DocumentViewController.swift              |  80 +++++++++++++-----
 OpenDocumentReader/Main.storyboard            |   2 +
 .../OpenDocumentReaderTests.swift             |  51 +++++++++++
 .../fixtures/make-fixtures.py                 |  49 +++++++++++
 OpenDocumentReaderTests/test.pdf              | Bin 0 -> 839 bytes
 fastlane/metadata/en-US/changelogs/1.41.txt   |   2 +
 9 files changed, 189 insertions(+), 31 deletions(-)
 create mode 100644 OpenDocumentReaderTests/test.pdf
 create mode 100644 fastlane/metadata/en-US/changelogs/1.41.txt

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e0b144..7be39b3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,18 @@ open: **a second build under the same version goes under the already cut
 heading, not back under `Unreleased`.** Date the heading and add its compare link
 once the version tag exists.
 
+## [Unreleased]
+
+### Changed
+
+- PDFs are rendered by odrcore, like every other document, instead of being
+  handed to the web view. Their text is in the page rather than behind the
+  system viewer, so they will be searchable as soon as odrcore writes the
+  search script for a pdf page as it does for a document.
+- The search button leaves the tool bar when the document on screen cannot be
+  searched, rather than sitting there greyed out - the same as the edit button.
+  Whether a page can be searched is asked of the page itself.
+
 ## [1.40]
 
 ### Changed
diff --git a/OpenDocumentReader.xcodeproj/project.pbxproj b/OpenDocumentReader.xcodeproj/project.pbxproj
index 8ee56b2..b0f6abe 100644
--- a/OpenDocumentReader.xcodeproj/project.pbxproj
+++ b/OpenDocumentReader.xcodeproj/project.pbxproj
@@ -29,6 +29,7 @@
 		E2A17B1000000000000000B0 /* test.ods in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1200000000000000B2 /* test.ods */; };
 		E2A17B1100000000000000B1 /* test.odp in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1300000000000000B3 /* test.odp */; };
 		E2A17B1400000000000000B4 /* test.csv in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1500000000000000B5 /* test.csv */; };
+		E2A17B1600000000000000B6 /* test.pdf in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1700000000000000B7 /* test.pdf */; };
 		E2A17B2000000000000000C0 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E2A17B2200000000000000C2 /* CoreFoundation.framework */; };
 		E2A17B2100000000000000C1 /* CFNetwork.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E2A17B2300000000000000C3 /* CFNetwork.framework */; };
 		FB494C85E264BD924C1EA54E /* OdrCore in Frameworks */ = {isa = PBXBuildFile; productRef = E381918B979121CD165C966A /* OdrCore */; };
@@ -65,6 +66,7 @@
 		E2A17B1200000000000000B2 /* test.ods */ = {isa = PBXFileReference; lastKnownFileType = file; path = test.ods; sourceTree = "<group>"; };
 		E2A17B1300000000000000B3 /* test.odp */ = {isa = PBXFileReference; lastKnownFileType = file; path = test.odp; sourceTree = "<group>"; };
 		E2A17B1500000000000000B5 /* test.csv */ = {isa = PBXFileReference; lastKnownFileType = text; path = test.csv; sourceTree = "<group>"; };
+		E2A17B1700000000000000B7 /* test.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = test.pdf; sourceTree = "<group>"; };
 		E2A17B2200000000000000C2 /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = System/Library/Frameworks/CoreFoundation.framework; sourceTree = SDKROOT; };
 		E2A17B2300000000000000C3 /* CFNetwork.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CFNetwork.framework; path = System/Library/Frameworks/CFNetwork.framework; sourceTree = SDKROOT; };
 /* End PBXFileReference section */
@@ -163,6 +165,7 @@
 				E2A17B1200000000000000B2 /* test.ods */,
 				E2A17B1300000000000000B3 /* test.odp */,
 				E2A17B1500000000000000B5 /* test.csv */,
+				E2A17B1700000000000000B7 /* test.pdf */,
 				E22B252E2557F0E2001D0C52 /* OpenDocumentReaderTests.swift */,
 				E2A17B0300000000000000A3 /* PageTabBarTests.swift */,
 				E22B25302557F0E2001D0C52 /* Info.plist */,
@@ -353,6 +356,7 @@
 				E2A17B1000000000000000B0 /* test.ods in Resources */,
 				E2A17B1100000000000000B1 /* test.odp in Resources */,
 				E2A17B1400000000000000B4 /* test.csv in Resources */,
+				E2A17B1600000000000000B6 /* test.pdf in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/OpenDocumentReader/CoreWrapper.swift b/OpenDocumentReader/CoreWrapper.swift
index 331c06f..42f6d3c 100644
--- a/OpenDocumentReader/CoreWrapper.swift
+++ b/OpenDocumentReader/CoreWrapper.swift
@@ -7,7 +7,7 @@ let CoreWrapperErrorDomain = "app.opendocument.CoreWrapperErrorDomain"
 @objc enum CoreWrapperError: Int {
     case unknown = 1
     case wrongPassword = 2
-    /// Not a document odrcore can translate. PDFs land here on purpose.
+    /// Not something odrcore renders for us — see the guard in `translate`.
     case unsupportedFileType = 3
 }
 
@@ -107,11 +107,6 @@ private func isCsv(_ file: DecodedFile) -> Bool { file.fileType == .commaSeparat
         guard !fileTypes.isEmpty else {
             throw coreWrapperError(.unsupportedFileType, "odrcore does not recognise this file type")
         }
-        // PDFs are handed to WKWebView instead, which renders them natively
-        guard !fileTypes.contains(NSNumber(value: FileType.portableDocumentFormat.rawValue)) else {
-            throw coreWrapperError(
-                .unsupportedFileType, "PDF is rendered by the web view, not by odrcore")
-        }
 
         var file = try DecodedFile.decode(path: inputPath)
         if file.isPasswordEncrypted {
@@ -124,8 +119,11 @@ private func isCsv(_ file: DecodedFile) -> Bool { file.fileType == .commaSeparat
             }
         }
 
-        guard file.isDocumentFile || isCsv(file) else {
-            throw coreWrapperError(.unsupportedFileType, "not a document file")
+        // odrcore also translates images, media and fonts, but only into an
+        // `<img>` or a `<video>` the web view decodes anyway. Those go to the
+        // system instead, through the fallback in `DocumentViewController`.
+        guard file.isDocumentFile || file.isPdfFile || isCsv(file) else {
+            throw coreWrapperError(.unsupportedFileType, "not a document, a pdf or a csv")
         }
 
         // the same answers OpenDocument.droid gives odrcore, so a document is
@@ -161,8 +159,10 @@ private func isCsv(_ file: DecodedFile) -> Bool { file.fileType == .commaSeparat
             service = try HtmlTranslator.translate(
                 document: document, cachePath: cachePath, config: config)
         } else {
-            // not `.spreadsheet`, though a csv is one: that asks for a tab per
-            // sheet, and a csv's single sheet is called "csv"
+            // a csv and a pdf have no document behind them to open or to edit.
+            // `.unknown` keeps the combined view for both; not `.spreadsheet`,
+            // though a csv is one, because that asks for a tab per sheet and a
+            // csv's single sheet is called "csv"
             documentType = .unknown
             openedDocument = nil
             service = try HtmlTranslator.translate(
diff --git a/OpenDocumentReader/DocumentViewController.swift b/OpenDocumentReader/DocumentViewController.swift
index 8921c36..995e560 100644
--- a/OpenDocumentReader/DocumentViewController.swift
+++ b/OpenDocumentReader/DocumentViewController.swift
@@ -32,7 +32,10 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
         }
     }
 
-    private let EXTENSION_WHITELIST = [
+    /// The fallback for what odrcore does not render: what WKWebView and the
+    /// system decoders can show on their own. Not derived from odrcore's format
+    /// table — this is the other side of it.
+    private let systemRenderedExtensions = [
         "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "rtf", "rtfd.zip", "csv", "txt", "jpg", "jpeg", "png",
         "gif", "svg", "pages", "pages.zip", "numbers", "numbers.zip", "key", "key.zip", "mp3", "mp4", "flv", "mkv",
         "3gp", "aac", "bmp", "css", "htm", "html", "js", "json", "mpeg", "oga", "ogv", "sh", "tif", "tiff", "weba",
@@ -52,12 +55,27 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
     @IBOutlet weak var barButtonItem: UIBarButtonItem!
     @IBOutlet weak var searchButton: UIBarButtonItem!
     @IBOutlet weak var editButton: UIBarButtonItem!
+    /// The gaps behind those two. A button that leaves the bar takes its gap
+    /// with it, or what stays drifts off the trailing edge.
+    @IBOutlet weak var editButtonSpacer: UIBarButtonItem!
+    @IBOutlet weak var searchButtonSpacer: UIBarButtonItem!
 
-    /// The bar as the storyboard has it, and the same without the edit button.
-    /// Taken before anything is removed, since that is the only moment both are
-    /// there to be read.
+    /// The bar as the storyboard has it, taken before anything is removed, since
+    /// that is the only moment every button is there to be read.
     private lazy var toolBarItems: [UIBarButtonItem] = toolBar.items ?? []
-    private lazy var toolBarItemsWithoutEdit: [UIBarButtonItem] = toolBarItems.filter { $0 !== editButton }
+
+    /// Whether the document on screen can be edited and searched. Neither button
+    /// stays in the bar when it cannot be used.
+    private var canEdit = false { didSet { updateToolBar() } }
+    private var canSearch = false {
+        didSet {
+            updateToolBar()
+
+            if !canSearch {
+                hideSearchBar()
+            }
+        }
+    }
 
     /// What OpenDocument.droid gets from `loadWithOverviewMode`, which iOS has
     /// no setting for: a page wider than the screen is zoomed out until it fits
@@ -160,8 +178,8 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
         barButtonItem.accessibilityLabel = NSLocalizedString("back_to_documents", comment: "")
         editButton.accessibilityLabel = NSLocalizedString("menu_edit", comment: "")
 
-        // nothing is editable until a document says so
-        showEditButton(false)
+        // nothing is editable or searchable until a page says so
+        updateToolBar()
 
         setUpHouseAd()
     }
@@ -208,6 +226,10 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
         documentLoadingError(doc, error: DocumentError.pageNotServed)
     }
 
+    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+        updateSearchButton()
+    }
+
     override func traitCollectionDidChange(_ previousTraitCollection: UITraitCollection?) {
         super.traitCollectionDidChange(previousTraitCollection)
 
@@ -395,14 +417,33 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
         editDocument()
     }
 
-    /// In the bar for the documents that can be edited, and only while they are
-    /// not being edited already. Every other document keeps the room for itself.
-    private func showEditButton(_ show: Bool) {
-        toolBar.items = show ? toolBarItems : toolBarItemsWithoutEdit
+    private func updateToolBar() {
+        toolBar.items = toolBarItems.filter { item in
+            if item === editButton || item === editButtonSpacer {
+                return canEdit
+            }
+            if item === searchButton || item === searchButtonSpacer {
+                return canSearch
+            }
+
+            return true
+        }
     }
 
+    /// Offered for the documents that can be edited, and only while they are not
+    /// being edited already.
     private func updateEditButton() {
-        showEditButton((document?.isEditable ?? false) && !(document?.edit ?? false))
+        canEdit = (document?.isEditable ?? false) && !(document?.edit ?? false)
+    }
+
+    /// Asked of the page rather than guessed from the format: odrcore writes the
+    /// `odr` object into what it renders as a document or as text, and into
+    /// nothing else — a pdf picks the button up on its own once it does.
+    private func updateSearchButton() {
+        webview.evaluateJavaScript("typeof odr === 'object' && typeof odr.search === 'function'") {
+            [weak self] available, _ in
+            self?.canSearch = available as? Bool ?? false
+        }
     }
 
     @IBAction func searchButton(_ sender: UIBarButtonItem) {
@@ -678,12 +719,12 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
         let fileType = doc.fileURL.pathExtension.lowercased()
 
         let fileName = doc.fileURL.absoluteString.lowercased()
-        if EXTENSION_WHITELIST.contains(where: fileName.hasSuffix) {
+        if systemRenderedExtensions.contains(where: fileName.hasSuffix) {
             // not odrcore's to render, but the web view knows the format
             self.webview.loadFileURL(doc.fileURL, allowingReadAccessTo: doc.fileURL)
 
-            searchButton.isEnabled = false
-            showEditButton(false)
+            canEdit = false
+            canSearch = false
 
             AnalyticsManager.shared.report(
                 "load_success",
@@ -712,12 +753,9 @@ class DocumentViewController: UIViewController, DocumentDelegate, UISearchBarDel
         progressBar.isHidden = false
         progressBar.observedProgress = doc.loadProgress
 
-        // only what odrcore translated is searchable, and a later parse — after
-        // a password, say — may well get there
-        searchButton.isEnabled = true
-
-        // whether this one can be edited is not known until it is parsed
-        showEditButton(false)
+        // neither is known until the page it produces is loaded
+        canEdit = false
+        canSearch = false
     }
 
     func documentLoadingCompleted(_ doc: Document) {
diff --git a/OpenDocumentReader/Main.storyboard b/OpenDocumentReader/Main.storyboard
index 850dd95..9b589da 100644
--- a/OpenDocumentReader/Main.storyboard
+++ b/OpenDocumentReader/Main.storyboard
@@ -107,11 +107,13 @@
                         <outlet property="bannerSlotHeight" destination="eXE-Ks-sQc" id="yQ1-l7-wiV"/>
                         <outlet property="barButtonItem" destination="yhO-7V-lbn" id="ach-z7-H9P"/>
                         <outlet property="editButton" destination="Ed1-tP-enc" id="Ed3-tP-enc"/>
+                        <outlet property="editButtonSpacer" destination="Ed4-tP-enc" id="Ed5-tP-enc"/>
                         <outlet property="menuButton" destination="Vsd-IL-ujz" id="GoN-tp-egn"/>
                         <outlet property="pageTabBar" destination="sIx-zo-9kG" id="pCn-x0-Z01"/>
                         <outlet property="progressBar" destination="ePk-bQ-fV8" id="nz6-qw-ouf"/>
                         <outlet property="searchBar" destination="A5V-8n-dvk" id="AIb-1s-JO6"/>
                         <outlet property="searchButton" destination="fGi-i7-iOR" id="77J-cW-TAe"/>
+                        <outlet property="searchButtonSpacer" destination="Di6-gg-JT6" id="Di7-gg-JT6"/>
                         <outlet property="toolBar" destination="N1x-QM-Qks" id="db4-aA-GH6"/>
                         <outlet property="webview" destination="VF5-Do-xh9" id="25W-hb-tHy"/>
                     </connections>
diff --git a/OpenDocumentReaderTests/OpenDocumentReaderTests.swift b/OpenDocumentReaderTests/OpenDocumentReaderTests.swift
index eb5c483..5bb2a36 100644
--- a/OpenDocumentReaderTests/OpenDocumentReaderTests.swift
+++ b/OpenDocumentReaderTests/OpenDocumentReaderTests.swift
@@ -93,6 +93,57 @@ class OpenDocumentReaderTests: XCTestCase {
         XCTAssertEqual(wrapper.pageNames, ["document"])
     }
 
+    /// odrcore renders these now; they used to be handed to the web view.
+    func testPdfIsTranslated() throws {
+        let wrapper = CoreWrapper()
+        let url = try copyFixture(ofType: "pdf")
+
+        try wrapper.translate(
+            url.path, cache: temporaryDirectory, into: temporaryDirectory, with: nil, editable: false)
+
+        XCTAssertEqual(wrapper.pageNames, ["document"])
+    }
+
+    /// Its text has to reach the page, or there is nothing for search to walk.
+    func testPdfPageCarriesItsText() throws {
+        let wrapper = CoreWrapper()
+        let url = try copyFixture(ofType: "pdf")
+
+        try wrapper.translate(
+            url.path, cache: temporaryDirectory, into: temporaryDirectory, with: nil, editable: false)
+
+        let (data, _) = try fetch(try XCTUnwrap(wrapper.pageURLs.first))
+        let html = try XCTUnwrap(String(data: data, encoding: .utf8))
+
+        XCTAssertTrue(html.contains("First"), html)
+        XCTAssertTrue(html.contains("Second"), html)
+    }
+
+    func testPdfIsNotEditable() throws {
+        let wrapper = CoreWrapper()
+        let url = try copyFixture(ofType: "pdf")
+
+        try wrapper.translate(
+            url.path, cache: temporaryDirectory, into: temporaryDirectory, with: nil, editable: true)
+
+        XCTAssertFalse(wrapper.isEditable)
+    }
+
+    /// A png is one of the formats odrcore translates but we leave to the system.
+    func testImageIsLeftToTheSystem() throws {
+        let wrapper = CoreWrapper()
+
+        let image = URL(fileURLWithPath: temporaryDirectory).appendingPathComponent("test.png")
+        try Data([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]).write(to: image)
+
+        XCTAssertThrowsError(
+            try wrapper.translate(
+                image.path, cache: temporaryDirectory, into: temporaryDirectory, with: nil, editable: false)
+        ) { error in
+            XCTAssertEqual((error as NSError).code, CoreWrapperError.unsupportedFileType.rawValue)
+        }
+    }
+
     /// And it has no document behind it, so the menu must not offer to edit one.
     func testCsvIsNotEditable() throws {
         let wrapper = CoreWrapper()
diff --git a/OpenDocumentReaderTests/fixtures/make-fixtures.py b/OpenDocumentReaderTests/fixtures/make-fixtures.py
index 8e09181..7621f08 100644
--- a/OpenDocumentReaderTests/fixtures/make-fixtures.py
+++ b/OpenDocumentReaderTests/fixtures/make-fixtures.py
@@ -81,6 +81,51 @@ def presentation(slides: list[str]) -> str:
     return content(f"  <office:presentation>\n{pages}\n  </office:presentation>")
 
 
+def pdf(pages: list[str]) -> bytes:
+    """A page per string, each showing it in Helvetica.
+
+    Assembled by hand rather than with a library, because the trailer carries the
+    byte offset of every object and nothing else about the file is hard.
+    """
+    font = 3
+    # 1 catalog, 2 pages, 3 font, then a page and its content stream each
+    page_numbers = [4 + 2 * index for index in range(len(pages))]
+
+    kids = " ".join(f"{number} 0 R" for number in page_numbers)
+    bodies = [
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        f"<< /Type /Pages /Kids [{kids}] /Count {len(pages)} >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+    ]
+
+    for number, text in zip(page_numbers, pages):
+        stream = f"BT /F1 24 Tf 72 700 Td ({text}) Tj ET"
+        bodies.append(
+            f"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842]"
+            f" /Resources << /Font << /F1 {font} 0 R >> >>"
+            f" /Contents {number + 1} 0 R >>"
+        )
+        bodies.append(f"<< /Length {len(stream)} >>\nstream\n{stream}\nendstream")
+
+    out = bytearray(b"%PDF-1.4\n")
+    offsets = []
+    for number, body in enumerate(bodies, start=1):
+        offsets.append(len(out))
+        out += f"{number} 0 obj\n{body}\nendobj\n".encode("latin-1")
+
+    startxref = len(out)
+    out += f"xref\n0 {len(bodies) + 1}\n".encode("latin-1")
+    out += b"0000000000 65535 f \n"
+    for offset in offsets:
+        out += f"{offset:010d} 00000 n \n".encode("latin-1")
+    out += (
+        f"trailer\n<< /Size {len(bodies) + 1} /Root 1 0 R >>\n"
+        f"startxref\n{startxref}\n%%EOF\n"
+    ).encode("latin-1")
+
+    return bytes(out)
+
+
 def write(path: Path, mimetype: str, content_xml: str) -> None:
     with zipfile.ZipFile(path, "w", zipfile.ZIP_DEFLATED) as package:
         # first and uncompressed, or the package is only recognised by sniffing
@@ -107,6 +152,10 @@ def main() -> None:
         presentation(["Intro", "Outro"]),
     )
 
+    path = here.parent / "test.pdf"
+    path.write_bytes(pdf(["First", "Second"]))
+    print(f"wrote {path}")
+
 
 if __name__ == "__main__":
     main()
diff --git a/OpenDocumentReaderTests/test.pdf b/OpenDocumentReaderTests/test.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..2daf1277299ae7fc52c05d040ee6ddf0a51aae49
GIT binary patch
literal 839
zcmcIj&riZI6u$Sbcoz~q=+<rBMnX8CEGB9sup9AE*aJs!HEl8IUvFPwf)EogF3YmM
ze*J#Dww=*!amB9_#vueXTd`gbg7V`HA-IuNuGJEPkzAsI$N|RC?=x&F0@C>Bf*mfn
zuPX!7#KTkiK07Y8X{@6-ERWBY7s^3`$!2D~JelAS45Y!`%pI=Z(bjW$#6l|PCdjfz
zFG!w)N33c&P+ORW4llX_@+5Mu#%R<=&s{i5?N$5_2XaSY>2>BC>(~s4eYI@?ja&5x
zY?k%~;*{JOt5LqPLFrgIL<y7&$RfzX5XuTJidq|c3FQigC2{TH`^HkwTGri8P-Fiq
zQ+ASx#;tmrDf>gF3C>kh{Tgbkalt~!S@``xDnu+`0f$-_{46wwn#j*;JaUJXo+BLZ
zp4VdT!kple&~5EWO+-h!R?B*g+TVjo{fUsfbE1?5x*-1i8!NT-c~YLTPG|U3urFQ1
B+I|24

literal 0
HcmV?d00001

diff --git a/fastlane/metadata/en-US/changelogs/1.41.txt b/fastlane/metadata/en-US/changelogs/1.41.txt
new file mode 100644
index 0000000..db64c34
--- /dev/null
+++ b/fastlane/metadata/en-US/changelogs/1.41.txt
@@ -0,0 +1,2 @@
+- PDFs are drawn by the app's own engine, so they fit the screen and behave like every other document
+- The search and edit buttons are there only for documents that can be searched or edited

From efe1bd774fc89eec88d9d08e82a14abb17666e5c Mon Sep 17 00:00:00 2001
From: Andreas Stefl <stefl.andreas@gmail.com>
Date: Sun, 16 Aug 2026 08:51:33 +0200
Subject: [PATCH 2/3] Cover the encrypted pdf path

odrcore reads the standard security handler, so an encrypted pdf takes the
prompt the ODF formats already had - `isPasswordEncrypted` is true, and a
missing or wrong password comes back as `wrongPassword`, which is what
`Document.parse` turns into the alert rather than the error page. Verified
against AES-256 (`V 5`, `R 6`), what a pdf written today is locked with.

The fixture is qpdf's, because AES is not in the standard library and R6
derives its key with it. `make-fixtures.py` calls out to it and says so if it
is missing; everything else it writes is still by hand.

`copyFixture` takes a name now, since the fixtures are no longer all `test`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UNugiHVRHVc1CGHgVGW7Dz
---
 CHANGELOG.md                                  |   3 +-
 OpenDocumentReader.xcodeproj/project.pbxproj  |   4 ++
 .../OpenDocumentReaderTests.swift             |  35 ++++++++++++++++--
 .../fixtures/make-fixtures.py                 |  34 +++++++++++++++++
 OpenDocumentReaderTests/test-encrypted.pdf    | Bin 0 -> 1670 bytes
 5 files changed, 72 insertions(+), 4 deletions(-)
 create mode 100644 OpenDocumentReaderTests/test-encrypted.pdf

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7be39b3..dc67fd1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,7 +23,8 @@ once the version tag exists.
 - PDFs are rendered by odrcore, like every other document, instead of being
   handed to the web view. Their text is in the page rather than behind the
   system viewer, so they will be searchable as soon as odrcore writes the
-  search script for a pdf page as it does for a document.
+  search script for a pdf page as it does for a document. A password protected
+  one is asked for its password by the same prompt the other formats use.
 - The search button leaves the tool bar when the document on screen cannot be
   searched, rather than sitting there greyed out - the same as the edit button.
   Whether a page can be searched is asked of the page itself.
diff --git a/OpenDocumentReader.xcodeproj/project.pbxproj b/OpenDocumentReader.xcodeproj/project.pbxproj
index b0f6abe..bb657a4 100644
--- a/OpenDocumentReader.xcodeproj/project.pbxproj
+++ b/OpenDocumentReader.xcodeproj/project.pbxproj
@@ -30,6 +30,7 @@
 		E2A17B1100000000000000B1 /* test.odp in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1300000000000000B3 /* test.odp */; };
 		E2A17B1400000000000000B4 /* test.csv in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1500000000000000B5 /* test.csv */; };
 		E2A17B1600000000000000B6 /* test.pdf in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1700000000000000B7 /* test.pdf */; };
+		E2A17B1800000000000000B8 /* test-encrypted.pdf in Resources */ = {isa = PBXBuildFile; fileRef = E2A17B1900000000000000B9 /* test-encrypted.pdf */; };
 		E2A17B2000000000000000C0 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E2A17B2200000000000000C2 /* CoreFoundation.framework */; };
 		E2A17B2100000000000000C1 /* CFNetwork.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E2A17B2300000000000000C3 /* CFNetwork.framework */; };
 		FB494C85E264BD924C1EA54E /* OdrCore in Frameworks */ = {isa = PBXBuildFile; productRef = E381918B979121CD165C966A /* OdrCore */; };
@@ -67,6 +68,7 @@
 		E2A17B1300000000000000B3 /* test.odp */ = {isa = PBXFileReference; lastKnownFileType = file; path = test.odp; sourceTree = "<group>"; };
 		E2A17B1500000000000000B5 /* test.csv */ = {isa = PBXFileReference; lastKnownFileType = text; path = test.csv; sourceTree = "<group>"; };
 		E2A17B1700000000000000B7 /* test.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = test.pdf; sourceTree = "<group>"; };
+		E2A17B1900000000000000B9 /* test-encrypted.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = "test-encrypted.pdf"; sourceTree = "<group>"; };
 		E2A17B2200000000000000C2 /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = System/Library/Frameworks/CoreFoundation.framework; sourceTree = SDKROOT; };
 		E2A17B2300000000000000C3 /* CFNetwork.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CFNetwork.framework; path = System/Library/Frameworks/CFNetwork.framework; sourceTree = SDKROOT; };
 /* End PBXFileReference section */
@@ -166,6 +168,7 @@
 				E2A17B1300000000000000B3 /* test.odp */,
 				E2A17B1500000000000000B5 /* test.csv */,
 				E2A17B1700000000000000B7 /* test.pdf */,
+				E2A17B1900000000000000B9 /* test-encrypted.pdf */,
 				E22B252E2557F0E2001D0C52 /* OpenDocumentReaderTests.swift */,
 				E2A17B0300000000000000A3 /* PageTabBarTests.swift */,
 				E22B25302557F0E2001D0C52 /* Info.plist */,
@@ -357,6 +360,7 @@
 				E2A17B1100000000000000B1 /* test.odp in Resources */,
 				E2A17B1400000000000000B4 /* test.csv in Resources */,
 				E2A17B1600000000000000B6 /* test.pdf in Resources */,
+				E2A17B1800000000000000B8 /* test-encrypted.pdf in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/OpenDocumentReaderTests/OpenDocumentReaderTests.swift b/OpenDocumentReaderTests/OpenDocumentReaderTests.swift
index 5bb2a36..b5e9721 100644
--- a/OpenDocumentReaderTests/OpenDocumentReaderTests.swift
+++ b/OpenDocumentReaderTests/OpenDocumentReaderTests.swift
@@ -21,18 +21,18 @@ class OpenDocumentReaderTests: XCTestCase {
 
     /// Out of the read-only test bundle, and away from the temporary directory
     /// translating uses for its cache and output.
-    private func copyFixture(ofType pathExtension: String) throws -> URL {
+    private func copyFixture(ofType pathExtension: String, named name: String = "test") throws -> URL {
         let documentsURL = try FileManager.default.url(
             for: .documentDirectory,
             in: .userDomainMask,
             appropriateFor: nil,
             create: false)
 
-        let url = documentsURL.appendingPathComponent("test." + pathExtension)
+        let url = documentsURL.appendingPathComponent(name + "." + pathExtension)
         try? FileManager.default.removeItem(at: url)
 
         let bundlePath = try XCTUnwrap(
-            Bundle(for: Self.self).path(forResource: "test", ofType: pathExtension))
+            Bundle(for: Self.self).path(forResource: name, ofType: pathExtension))
         try FileManager.default.copyItem(at: URL(fileURLWithPath: bundlePath), to: url)
 
         return url
@@ -119,6 +119,35 @@ class OpenDocumentReaderTests: XCTestCase {
         XCTAssertTrue(html.contains("Second"), html)
     }
 
+    /// `wrongPassword` rather than `unsupportedFileType`, because that is what
+    /// `Document.parse` turns into the prompt instead of the error page.
+    func testEncryptedPdfAsksForItsPassword() throws {
+        let wrapper = CoreWrapper()
+        let url = try copyFixture(ofType: "pdf", named: "test-encrypted")
+
+        for password in [nil, "wrong"] {
+            XCTAssertThrowsError(
+                try wrapper.translate(
+                    url.path, cache: temporaryDirectory, into: temporaryDirectory, with: password, editable: false)
+            ) { error in
+                XCTAssertEqual((error as NSError).code, CoreWrapperError.wrongPassword.rawValue)
+            }
+        }
+    }
+
+    func testEncryptedPdfOpensWithItsPassword() throws {
+        let wrapper = CoreWrapper()
+        let url = try copyFixture(ofType: "pdf", named: "test-encrypted")
+
+        try wrapper.translate(
+            url.path, cache: temporaryDirectory, into: temporaryDirectory, with: "secret", editable: false)
+
+        XCTAssertEqual(wrapper.pageNames, ["document"])
+
+        let (data, _) = try fetch(try XCTUnwrap(wrapper.pageURLs.first))
+        XCTAssertTrue(try XCTUnwrap(String(data: data, encoding: .utf8)).contains("First"))
+    }
+
     func testPdfIsNotEditable() throws {
         let wrapper = CoreWrapper()
         let url = try copyFixture(ofType: "pdf")
diff --git a/OpenDocumentReaderTests/fixtures/make-fixtures.py b/OpenDocumentReaderTests/fixtures/make-fixtures.py
index 7621f08..99e46dd 100644
--- a/OpenDocumentReaderTests/fixtures/make-fixtures.py
+++ b/OpenDocumentReaderTests/fixtures/make-fixtures.py
@@ -8,9 +8,15 @@
     python3 OpenDocumentReaderTests/fixtures/make-fixtures.py
 """
 
+import shutil
+import subprocess
 import zipfile
 from pathlib import Path
 
+# what test-encrypted.pdf is locked with
+USER_PASSWORD = "secret"
+OWNER_PASSWORD = "owner"
+
 NAMESPACES = " ".join(
     [
         'xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0"',
@@ -126,6 +132,30 @@ def pdf(pages: list[str]) -> bytes:
     return bytes(out)
 
 
+def encrypt_pdf(source: Path, target: Path) -> None:
+    """AES-256, the standard security handler odrcore reads as `V 5`, `R 6`.
+
+    Through qpdf rather than by hand: AES is not in the standard library, and
+    R6 derives its key with it. Needs `brew install qpdf` to rerun.
+    """
+    if shutil.which("qpdf") is None:
+        raise SystemExit("qpdf not found; it writes the encrypted pdf fixture")
+
+    subprocess.run(
+        [
+            "qpdf",
+            "--encrypt",
+            f"--user-password={USER_PASSWORD}",
+            f"--owner-password={OWNER_PASSWORD}",
+            "--bits=256",
+            "--",
+            str(source),
+            str(target),
+        ],
+        check=True,
+    )
+
+
 def write(path: Path, mimetype: str, content_xml: str) -> None:
     with zipfile.ZipFile(path, "w", zipfile.ZIP_DEFLATED) as package:
         # first and uncompressed, or the package is only recognised by sniffing
@@ -156,6 +186,10 @@ def main() -> None:
     path.write_bytes(pdf(["First", "Second"]))
     print(f"wrote {path}")
 
+    encrypted = here.parent / "test-encrypted.pdf"
+    encrypt_pdf(path, encrypted)
+    print(f"wrote {encrypted}")
+
 
 if __name__ == "__main__":
     main()
diff --git a/OpenDocumentReaderTests/test-encrypted.pdf b/OpenDocumentReaderTests/test-encrypted.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..b9106ffebe5de7856798eda524f6ad61dd49be8f
GIT binary patch
literal 1670
zcmcgtOK4nG7_J}+gA1VxH-#RA2rim?-j8MsHklbMrcB7#fRupeo<}k=nF)7pLK;PA
zs0$Zvr7MMkuf3q+!euw5s0cMEK0&3Tpr8fYivPLIWJ0pgmG@rGJ@-HV|NZa(PRuu2
zC&;9#O?-6o^4~RrFdF2~)#`PWH8;!9A9e@*AxfX88Z*smGh>HgF%;<pWgxnbb1rOz
z9@1!fIz8FET@FJ;0doOmPoG~4D4VsV?G2XUxEA_8sY=Hqm9vBOehC8EQ(Zqq=Mbwz
zd9^N$Anu}$0TR;~pbtiuLnJDh>`d@oJ2Th>EDX0W0%=YWV9nbC7)Qn}gyCSlaA0k6
zwKaf~YD18$fOZ|a>q9bNp99IfL;6)E_P^*)u8#E2h5mB6f+Pngy1g<K@b1|%G=dxW
z%IINP1iM=M;M&_?fBV=ok8gi`^wU45zqq~i8++m2tlix{_SNY-k9_{Xg=d%IC-0p6
z@cO2^|C{Ge{t$27Jia~m*%QBich8ZX7hioDlDCVro5mEUkrk;zsu*TZhTcXfyUwDl
zv!0h#38WyBQ8FvGaV}HXMkxQ;m!p3?^y8Jdv{--T;+O9pyGk!zxOV-~sb8<WPo{Pz
zAKbZd`=vKy<EM+aewn&-<Mr%~t=Il~_`M_FU%v0HJ6Dgpm7gaM`J(q(G25ytp;P+Z
z-Kq6*rMZ!6Cu<B`do4g0%(l)zgETvf3}w4!Gdk*mQ6f5}?R#7JJr*h?%G#(NrHO%X
zY@!NWQSK<$B*#%}DWr8g2Ihm8xxt<Un&+BxZYUO!gkZHbl30&p?p-j}8mbMD2>~GN
zX)q!}C$^z=qm?Yznpi3+7mQMo6U>5;T1w9;wM;5X2-U)>D4n;IDDCp-zy?n#OAU=q
zKxNH`Vig+2P!fr<0&7Qt*C7I2&I8AaX-jP4Ux4<>I^}9Btto);D#jmYQQbu;uni<q
z<}mS$Tc(W>xuPs5(o!3g(8eiEl-H6IERDdFu@Hl>4wO;uX|5y7siE9pEr|)rVv|cx
z9ZSBS1>dQGz&HyKIai(&kjybr#2AJ(Y$M?iY(;5KnN^ap$OE=Uhg?f#r2?2mm?`5z
z-7G?^VPtA}??O@tCQw9sGy<)eF4W(n5e9SUAPuI{K^mhl)(-G-0ps}qP3Xh2V8<ao
zrOlXD7Pi}i*^oxu!eCIMH1=Ucce+~v8I+xFpmTM?T@KNK+R#x33a$~Uoy8cEp&%*K
k|IPtpw%K>Z`Lz=M2}uLQZ&=!*tfEI4leLM7X1i7U2d~iK@Bjb+

literal 0
HcmV?d00001


From c598e4f4d4077740497bc03db1607e4ab7aac586 Mon Sep 17 00:00:00 2001
From: Andreas Stefl <stefl.andreas@gmail.com>
Date: Sun, 16 Aug 2026 08:58:52 +0200
Subject: [PATCH 3/3] Trim the changelog entries

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UNugiHVRHVc1CGHgVGW7Dz
---
 CHANGELOG.md | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc67fd1..7489b99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,14 +20,12 @@ once the version tag exists.
 
 ### Changed
 
-- PDFs are rendered by odrcore, like every other document, instead of being
-  handed to the web view. Their text is in the page rather than behind the
-  system viewer, so they will be searchable as soon as odrcore writes the
-  search script for a pdf page as it does for a document. A password protected
-  one is asked for its password by the same prompt the other formats use.
-- The search button leaves the tool bar when the document on screen cannot be
-  searched, rather than sitting there greyed out - the same as the edit button.
-  Whether a page can be searched is asked of the page itself.
+- PDFs are rendered by odrcore instead of being handed to the web view, and a
+  password protected one takes the prompt the other formats use. Their text is
+  in the page, so they become searchable once odrcore writes the search script
+  for a pdf page as it does for a document.
+- The search button leaves the tool bar when the page cannot be searched,
+  rather than greying out - the same as the edit button.
 
 ## [1.40]