htmlviewer-directediting: HTML rendering in Nextcloud iOS app

- htmlviewer: IEditor + Bridge + srcdoc iframe template + content controller
- text app: open() bridges text/html to htmlviewer template
- idempotent install.sh for re-deployment after app updates
- iPhone-tested 2026-09-11

patches/htmlviewer/DirectController.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 HtmlViewer / patch by Hermes Agent
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Streams the raw HTML file for the DirectEditing sandbox iframe.
+ * Authenticated via the user session (direct editing keeps a session).
+ */
+
+namespace OCA\HtmlViewer\Controller;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\DataDisplayResponse;
+use OCP\AppFramework\Http\NotFoundResponse;
+use OCP\Files\File;
+use OCP\Files\IRootFolder;
+use OCP\IRequest;
+use OCP\IUserSession;
+
+class DirectController extends Controller {
+
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		private IRootFolder $rootFolder,
+		private IUserSession $userSession,
+	) {
+		parent::__construct($appName, $request);
+	}
+
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	public function content(int $fileId) {
+		$user = $this->userSession->getUser();
+		if ($user === null) {
+			return new NotFoundResponse();
+		}
+
+		$userFolder = $this->rootFolder->getUserFolder($user->getUID());
+		$nodes = $userFolder->getById($fileId);
+		if (empty($nodes)) {
+			return new NotFoundResponse();
+		}
+		$file = array_shift($nodes);
+		if (!$file instanceof File) {
+			return new NotFoundResponse();
+		}
+
+		$response = new DataDisplayResponse($file->getContent());
+		$response->addHeader('Content-Type', 'text/html; charset=utf-8');
+		return $response;
+	}
+}