fix: proxy PDFs through /api/pdf-proxy to bypass CORS

World Bank PDF server blocks cross-origin requests, preventing
Mozilla's hosted PDF.js from loading them. Now PDFs are proxied
through our own API endpoint, and the browser's built-in PDF
viewer renders them via iframe.

app/api/pdf-proxy/route.js

@@ -0,0 +1,49 @@
+import { NextResponse } from 'next/server';
+
+/**
+ * GET /api/pdf-proxy?url=<encoded_pdf_url>
+ * Proxies a PDF from an external URL to bypass CORS restrictions.
+ * Returns the PDF with correct Content-Type so PDF.js can render it.
+ */
+export async function GET(request) {
+    const { searchParams } = new URL(request.url);
+    const pdfUrl = searchParams.get('url');
+
+    if (!pdfUrl) {
+        return NextResponse.json({ error: 'Missing url parameter' }, { status: 400 });
+    }
+
+    try {
+        const res = await fetch(pdfUrl, {
+            headers: {
+                'User-Agent': 'Mozilla/5.0 (compatible; AnnotationTool/1.0)',
+            },
+            signal: AbortSignal.timeout(30000), // 30s timeout
+        });
+
+        if (!res.ok) {
+            return NextResponse.json(
+                { error: `PDF fetch failed: HTTP ${res.status}` },
+                { status: res.status }
+            );
+        }
+
+        const pdfBuffer = await res.arrayBuffer();
+
+        return new Response(pdfBuffer, {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/pdf',
+                'Content-Length': pdfBuffer.byteLength.toString(),
+                'Cache-Control': 'public, max-age=86400', // cache 24h
+                'Access-Control-Allow-Origin': '*',
+            },
+        });
+    } catch (error) {
+        console.error('PDF proxy error:', error);
+        return NextResponse.json(
+            { error: 'Failed to proxy PDF: ' + error.message },
+            { status: 500 }
+        );
+    }
+}

app/components/PdfViewer.js

@@ -23,9 +23,9 @@ export default function PdfViewer({ pdfUrl, pageNumber }) {
     // PDF pages in our data are 0-indexed; PDF.js viewer expects 1-indexed pages
     const viewerPage = (pageNumber ?? 0) + 1;
 
-    // Use Mozilla's hosted PDF.js viewer — supports #page=N for direct page navigation.
-    // This avoids X-Frame-Options restrictions from the source server.
-    const pdfJsViewerUrl = `https://mozilla.github.io/pdf.js/web/viewer.html?file=${encodeURIComponent(pdfUrl)}#page=${viewerPage}`;
+    // Proxy the PDF through our own API to bypass CORS restrictions.
+    // Then use the browser's built-in PDF viewer via <object> tag.
+    const proxyUrl = `/api/pdf-proxy?url=${encodeURIComponent(pdfUrl)}#page=${viewerPage}`;
 
     return (
         <div className="pdf-container">
@@ -47,7 +47,7 @@ export default function PdfViewer({ pdfUrl, pageNumber }) {
             )}
             <iframe
                 key={`pdf-${pdfUrl}-page-${viewerPage}`}
-                src={pdfJsViewerUrl}
+                src={proxyUrl}
                 className="pdf-frame"
                 title={`PDF Page ${viewerPage}`}
                 allow="fullscreen"