From db35727e8e247c7f0fccef9fc62dec8d15760622 Mon Sep 17 00:00:00 2001
From: bloodearnest <simon.davy@thedatalab.org>
Date: Tue, 5 Mar 2024 14:48:15 +0000
Subject: [PATCH 1/3] fix errant js comment formatting

---
 airlock/templates/file_browser/index.html | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/airlock/templates/file_browser/index.html b/airlock/templates/file_browser/index.html
index a33d7065..209cca42 100644
--- a/airlock/templates/file_browser/index.html
+++ b/airlock/templates/file_browser/index.html
@@ -208,19 +208,19 @@
   {% django_htmx_script %}
 
   <script type="text/javascript">
-      // keep the selected class up to date in the tree on the client side
+    // keep the selected class up to date in the tree on the client side
     function setTreeSelection(target, event) {
-          // target here is the hx-get link that has been clicked on
+      // target here is the hx-get link that has been clicked on
 
-          // remove class from currently selected node
+      // remove class from currently selected node
       document.querySelector('#tree .selected')?.classList.remove('selected');
 
-          // set current selected
+      // set current selected
       target.classList.add('selected');
-          // ensure parent details container is open, which means clicking on a directory will open containers.
+      // ensure parent details container is open, which means clicking on a directory will open containers.
       target.closest("details").open = true;
 
-          // if target link is a filegroup, ensure all child <details> are opened, to match server-side rendering of tree
+      // if target link is a filegroup, ensure all child <details> are opened, to match server-side rendering of tree
       if (target.classList.contains("filegroup")) {
         target.closest("li.tree").querySelectorAll("details").forEach((e) => e.open = true)
       }

From 52c6f9299c66d14c962ac9ff6bf9937871ea248e Mon Sep 17 00:00:00 2001
From: bloodearnest <simon.davy@thedatalab.org>
Date: Tue, 5 Mar 2024 15:52:10 +0000
Subject: [PATCH 2/3] Add views to serve file contents directly.

This has two main benefits:
 - we can use `src=url` for iframes and img tags
 - the browser can cache these urls
---
 airlock/api.py                            | 15 ++++++++++++
 airlock/file_browser_api.py               |  5 ++++
 airlock/settings.py                       |  2 ++
 airlock/templates/file_browser/index.html |  2 +-
 airlock/urls.py                           | 10 ++++++++
 airlock/views/__init__.py                 |  2 ++
 airlock/views/helpers.py                  | 14 ++++++++++-
 airlock/views/request.py                  | 19 +++++++++++++--
 airlock/views/workspace.py                | 19 +++++++++++++--
 tests/integration/views/test_helpers.py   | 16 +++++++++++++
 tests/integration/views/test_request.py   | 28 ++++++++++++++++++++++
 tests/integration/views/test_workspace.py | 26 +++++++++++++++++++-
 tests/unit/test_api.py                    | 29 +++++++++++++++++++++++
 tests/unit/test_file_browser_api.py       | 12 ++++++++++
 14 files changed, 192 insertions(+), 7 deletions(-)
 create mode 100644 tests/integration/views/test_helpers.py

diff --git a/airlock/api.py b/airlock/api.py
index d181df23..4d146a61 100644
--- a/airlock/api.py
+++ b/airlock/api.py
@@ -52,6 +52,9 @@ def get_id(self) -> str:
     def get_url(self, path: UrlPath = ROOT_PATH) -> str:
         """Get the url for the container object with path"""
 
+    def get_contents_url(self, path: UrlPath = ROOT_PATH) -> str:
+        """Get the url for the container object with path"""
+
 
 @dataclass
 class Workspace:
@@ -82,6 +85,12 @@ def get_url(self, relpath=ROOT_PATH):
             kwargs={"workspace_name": self.name, "path": relpath},
         )
 
+    def get_contents_url(self, relpath):
+        return reverse(
+            "workspace_contents",
+            kwargs={"workspace_name": self.name, "path": relpath},
+        )
+
     def abspath(self, relpath):
         """Get absolute path for file
 
@@ -159,6 +168,12 @@ def get_url(self, relpath=ROOT_PATH):
             },
         )
 
+    def get_contents_url(self, relpath):
+        return reverse(
+            "request_contents",
+            kwargs={"request_id": self.id, "path": relpath},
+        )
+
     def abspath(self, relpath):
         """Returns abspath to the file on disk.
 
diff --git a/airlock/file_browser_api.py b/airlock/file_browser_api.py
index c016bfb4..7fadf9a9 100644
--- a/airlock/file_browser_api.py
+++ b/airlock/file_browser_api.py
@@ -74,6 +74,11 @@ def url(self):
         suffix = "/" if self.is_directory() else ""
         return self.container.get_url(f"{self.relpath}{suffix}")
 
+    def contents_url(self):
+        if self.type != PathType.FILE:
+            raise Exception(f"contents_url called on non-file path {self.relpath}")
+        return self.container.get_contents_url(f"{self.relpath}")
+
     def siblings(self):
         if not self.relpath.parents:
             return []
diff --git a/airlock/settings.py b/airlock/settings.py
index 1f8dcb7b..a6338363 100644
--- a/airlock/settings.py
+++ b/airlock/settings.py
@@ -225,6 +225,8 @@ def run_connection_init_queries(*, connection, **kwargs):
 # Changing from the default allows us to share localhost port in developement
 SESSION_COOKIE_NAME = "airlock-sessionid"
 
+# Enable frames
+X_FRAME_OPTIONS = "SAMEORIGIN"
 
 # Serve files from static dirs directly. This removes the need to run collectstatic
 # https://whitenoise.readthedocs.io/en/latest/django.html#WHITENOISE_USE_FINDERS
diff --git a/airlock/templates/file_browser/index.html b/airlock/templates/file_browser/index.html
index 209cca42..62bc1e11 100644
--- a/airlock/templates/file_browser/index.html
+++ b/airlock/templates/file_browser/index.html
@@ -180,7 +180,7 @@
             <div class="content">
               {% if path_item.suffix == '.html' %}
                 <iframe
-                  srcdoc="{{ path_item.contents }}"
+                  src="{{ path_item.contents_url }}"
                   title="{{ path_item.relpath }}"
                   frameborder=0
                   height=1000
diff --git a/airlock/urls.py b/airlock/urls.py
index fca8e39f..1d152ef6 100644
--- a/airlock/urls.py
+++ b/airlock/urls.py
@@ -43,6 +43,11 @@
         airlock.views.workspace_view,
         name="workspace_view",
     ),
+    path(
+        "workspaces/content/<str:workspace_name>/<path:path>",
+        airlock.views.workspace_contents,
+        name="workspace_contents",
+    ),
     path(
         "workspaces/add-file-to-request/<str:workspace_name>",
         airlock.views.workspace_add_file_to_request,
@@ -65,6 +70,11 @@
         airlock.views.request_view,
         name="request_view",
     ),
+    path(
+        "requests/content/<str:request_id>/<path:path>",
+        airlock.views.request_contents,
+        name="request_contents",
+    ),
     path(
         "requests/release/<str:request_id>",
         airlock.views.request_release_files,
diff --git a/airlock/views/__init__.py b/airlock/views/__init__.py
index ebb77606..5017c4e7 100644
--- a/airlock/views/__init__.py
+++ b/airlock/views/__init__.py
@@ -1,6 +1,7 @@
 from .auth import login, logout
 from .index import index
 from .request import (
+    request_contents,
     request_index,
     request_reject,
     request_release_files,
@@ -9,6 +10,7 @@
 )
 from .workspace import (
     workspace_add_file_to_request,
+    workspace_contents,
     workspace_index,
     workspace_view,
 )
diff --git a/airlock/views/helpers.py b/airlock/views/helpers.py
index 5d01354e..a8579e29 100644
--- a/airlock/views/helpers.py
+++ b/airlock/views/helpers.py
@@ -1,5 +1,7 @@
+from email.utils import formatdate
+
 from django.core.exceptions import PermissionDenied
-from django.http import Http404
+from django.http import FileResponse, Http404
 
 from local_db.api import LocalDBProvider
 
@@ -36,3 +38,13 @@ def validate_release_request(user, request_id):
     validate_workspace(user, release_request.workspace)
 
     return release_request
+
+
+def serve_file(abspath):
+    stat = abspath.stat()
+    # use same ETag format as whitenoise
+    headers = {
+        "Last-Modified": formatdate(stat.st_mtime, usegmt=True),
+        "ETag": f'"{int(stat.st_mtime):x}-{stat.st_size:x}"',
+    }
+    return FileResponse(abspath.open("rb"), headers=headers)
diff --git a/airlock/views/request.py b/airlock/views/request.py
index 52503c93..247817ef 100644
--- a/airlock/views/request.py
+++ b/airlock/views/request.py
@@ -2,7 +2,7 @@
 from django.conf import settings
 from django.contrib import messages
 from django.core.exceptions import PermissionDenied
-from django.http import Http404
+from django.http import Http404, HttpResponseBadRequest
 from django.shortcuts import redirect
 from django.template.response import TemplateResponse
 from django.urls import reverse
@@ -12,7 +12,7 @@
 from airlock.file_browser_api import get_request_tree
 from local_db.api import LocalDBProvider
 
-from .helpers import validate_release_request
+from .helpers import serve_file, validate_release_request
 
 
 api = LocalDBProvider()
@@ -84,6 +84,21 @@ def request_view(request, request_id: str, path: str = ""):
     return TemplateResponse(request, "file_browser/index.html", context)
 
 
+@require_http_methods(["GET"])
+def request_contents(request, request_id: str, path: str):
+    release_request = validate_release_request(request.user, request_id)
+
+    try:
+        abspath = release_request.abspath(path)
+    except api.FileNotFound:
+        raise Http404()
+
+    if not abspath.is_file():
+        return HttpResponseBadRequest()
+
+    return serve_file(abspath)
+
+
 @require_http_methods(["POST"])
 def request_submit(request, request_id):
     release_request = validate_release_request(request.user, request_id)
diff --git a/airlock/views/workspace.py b/airlock/views/workspace.py
index 6cd23282..5db2489c 100644
--- a/airlock/views/workspace.py
+++ b/airlock/views/workspace.py
@@ -1,5 +1,5 @@
 from django.contrib import messages
-from django.http import Http404
+from django.http import Http404, HttpResponseBadRequest
 from django.shortcuts import redirect
 from django.template.response import TemplateResponse
 from django.urls import reverse
@@ -10,7 +10,7 @@
 from airlock.forms import AddFileForm
 from local_db.api import LocalDBProvider
 
-from .helpers import validate_workspace
+from .helpers import serve_file, validate_workspace
 
 
 api = LocalDBProvider()
@@ -67,6 +67,21 @@ def workspace_view(request, workspace_name: str, path: str = ""):
     )
 
 
+@require_http_methods(["GET"])
+def workspace_contents(request, workspace_name: str, path: str):
+    workspace = validate_workspace(request.user, workspace_name)
+
+    try:
+        abspath = workspace.abspath(path)
+    except api.FileNotFound:
+        raise Http404()
+
+    if not abspath.is_file():
+        return HttpResponseBadRequest()
+
+    return serve_file(abspath)
+
+
 @require_http_methods(["POST"])
 def workspace_add_file_to_request(request, workspace_name):
     workspace = validate_workspace(request.user, workspace_name)
diff --git a/tests/integration/views/test_helpers.py b/tests/integration/views/test_helpers.py
new file mode 100644
index 00000000..eb355f1b
--- /dev/null
+++ b/tests/integration/views/test_helpers.py
@@ -0,0 +1,16 @@
+import os
+
+from airlock.views import helpers
+
+
+def test_serve_file(tmp_path):
+    path = tmp_path / "test.txt"
+    path.write_text("hi")
+    time = 1709652904  # date this test was written
+    os.utime(path, (time, time))
+
+    response = helpers.serve_file(path)
+    assert response.headers["Last-Modified"] == "Tue, 05 Mar 2024 15:35:04 GMT"
+    assert response.headers["Etag"] == '"65e73ba8-2"'
+    assert response.headers["Content-Type"] == "text/plain"
+    assert response.headers["Content-Length"] == "2"
diff --git a/tests/integration/views/test_request.py b/tests/integration/views/test_request.py
index 06e1202c..5c477bcb 100644
--- a/tests/integration/views/test_request.py
+++ b/tests/integration/views/test_request.py
@@ -123,6 +123,34 @@ def test_request_view_redirects_to_file(client_with_permission):
     )
 
 
+def test_request_contents_file(client_with_permission):
+    release_request = factories.create_release_request("workspace", id="id")
+    factories.write_request_file(
+        release_request, "default", "file.txt", contents="test"
+    )
+    response = client_with_permission.get("/requests/content/id/default/file.txt")
+    assert response.status_code == 200
+    assert list(response.streaming_content) == [b"test"]
+
+
+def test_request_contents_dir(client_with_permission):
+    release_request = factories.create_release_request("workspace", id="id")
+    factories.write_request_file(
+        release_request, "default", "foo/file.txt", contents="test"
+    )
+    response = client_with_permission.get("/requests/content/id/default/foo")
+    assert response.status_code == 400
+
+
+def test_request_contents_not_exists(client_with_permission):
+    release_request = factories.create_release_request("workspace", id="id")
+    factories.write_request_file(
+        release_request, "default", "foo/file.txt", contents="test"
+    )
+    response = client_with_permission.get("/requests/content/id/default/notexists.txt")
+    assert response.status_code == 404
+
+
 def test_request_index_user_permitted_requests(client_with_user):
     permitted_client = client_with_user({"workspaces": ["test1"]})
     user = User.from_session(permitted_client.session)
diff --git a/tests/integration/views/test_workspace.py b/tests/integration/views/test_workspace.py
index d7fdd013..55435097 100644
--- a/tests/integration/views/test_workspace.py
+++ b/tests/integration/views/test_workspace.py
@@ -1,5 +1,6 @@
 import pytest
 from django.contrib import messages
+from django.shortcuts import reverse
 
 from airlock.users import User
 from tests import factories
@@ -58,7 +59,11 @@ def test_workspace_view_with_html_file(client_with_permission):
         "workspace", "file.html", "<html><body>foobar</body></html>"
     )
     response = client_with_permission.get("/workspaces/view/workspace/file.html")
-    assert "foobar" in response.rendered_content
+    url = reverse(
+        "workspace_contents",
+        kwargs={"workspace_name": "workspace", "path": "file.html"},
+    )
+    assert f'src="{url}"' in response.rendered_content
 
 
 def test_workspace_view_with_csv_file(client_with_permission):
@@ -126,6 +131,25 @@ def test_workspace_view_with_directory_no_permission(client_with_user):
     assert response.status_code == 403
 
 
+def test_workspace_contents_file(client_with_permission):
+    factories.write_workspace_file("workspace", "file.txt", "test")
+    response = client_with_permission.get("/workspaces/content/workspace/file.txt")
+    assert response.status_code == 200
+    assert list(response.streaming_content) == [b"test"]
+
+
+def test_workspace_contents_dir(client_with_permission):
+    factories.write_workspace_file("workspace", "foo/file.txt", "test")
+    response = client_with_permission.get("/workspaces/content/workspace/foo")
+    assert response.status_code == 400
+
+
+def test_workspace_contents_not_exists(client_with_permission):
+    factories.write_workspace_file("workspace", "file.txt", "test")
+    response = client_with_permission.get("/workspaces/content/workspace/notexists.txt")
+    assert response.status_code == 404
+
+
 def test_workspaces_index_no_user(client):
     response = client.get("/workspaces/")
     assert response.status_code == 302
diff --git a/tests/unit/test_api.py b/tests/unit/test_api.py
index 8e7dfc96..21f30ab7 100644
--- a/tests/unit/test_api.py
+++ b/tests/unit/test_api.py
@@ -3,6 +3,7 @@
 from unittest.mock import MagicMock
 
 import pytest
+from django.conf import settings
 
 import old_api
 from airlock.api import ProviderAPI, Status, UrlPath, Workspace
@@ -13,6 +14,34 @@
 pytestmark = pytest.mark.django_db
 
 
+def test_workspace_container():
+    workspace = factories.create_workspace("workspace")
+
+    assert workspace.root() == settings.WORKSPACE_DIR / "workspace"
+    assert workspace.get_id() == "workspace"
+    assert (
+        workspace.get_url("foo/bar.html") == "/workspaces/view/workspace/foo/bar.html"
+    )
+    assert (
+        workspace.get_contents_url("foo/bar.html")
+        == "/workspaces/content/workspace/foo/bar.html"
+    )
+
+
+def test_request_container():
+    release_request = factories.create_release_request("workspace", id="id")
+
+    assert release_request.root() == settings.REQUEST_DIR / "workspace/id"
+    assert release_request.get_id() == "id"
+    assert (
+        release_request.get_url("group/bar.html") == "/requests/view/id/group/bar.html"
+    )
+    assert (
+        release_request.get_contents_url("group/bar.html")
+        == "/requests/content/id/group/bar.html"
+    )
+
+
 @pytest.mark.parametrize(
     "user_workspaces,output_checker,expected",
     [
diff --git a/tests/unit/test_file_browser_api.py b/tests/unit/test_file_browser_api.py
index 01a76396..5623fb4d 100644
--- a/tests/unit/test_file_browser_api.py
+++ b/tests/unit/test_file_browser_api.py
@@ -161,6 +161,18 @@ def test_workspace_tree_urls(workspace, path, url):
     assert tree.get_path(path).url().endswith(url)
 
 
+def test_workspace_tree_content_urls(workspace):
+    tree = get_workspace_tree(workspace)
+    assert (
+        tree.get_path("some_dir/file_a.txt")
+        .contents_url()
+        .endswith("some_dir/file_a.txt")
+    )
+
+    with pytest.raises(Exception):
+        assert tree.get_path("some_dir").contents_url()
+
+
 @pytest.mark.parametrize(
     "path,url",
     [

From 31f00e3a804479e0c7becccf4b2fee567ad63b07 Mon Sep 17 00:00:00 2001
From: bloodearnest <simon.davy@thedatalab.org>
Date: Tue, 5 Mar 2024 16:28:13 +0000
Subject: [PATCH 3/3] Add support for images

This uses the contents urls added in previous commit to support
rendering images. It slightly formalises the concept of a display type,
and groups different files into a specific display type.

It also fixes the double scroll bars for the iframe, and a driveby table
style fix

Fixes #127
---
 airlock/file_browser_api.py               | 15 +++++++++
 airlock/templates/file_browser/index.html | 20 +++++++++---
 example-data/bennett.svg                  |  1 +
 justfile                                  |  2 ++
 tests/integration/views/test_workspace.py | 39 +++++++++++++++++++++++
 5 files changed, 73 insertions(+), 4 deletions(-)
 create mode 100644 example-data/bennett.svg

diff --git a/airlock/file_browser_api.py b/airlock/file_browser_api.py
index 7fadf9a9..ed822a5e 100644
--- a/airlock/file_browser_api.py
+++ b/airlock/file_browser_api.py
@@ -47,6 +47,18 @@ class PathNotFound(Exception):
     # but this allow it to be overridden.
     display_text: str = None
 
+    DISPLAY_TYPES = {
+        "html": "iframe",
+        "jpeg": "image",
+        "jpg": "image",
+        "png": "image",
+        "svg": "image",
+        "csv": "table",
+        "tsv": "table",
+        "txt": "preformatted",
+        "log": "preformatted",
+    }
+
     def __post_init__(self):
         # ensure is UrlPath
         self.relpath = UrlPath(self.relpath)
@@ -99,6 +111,9 @@ def suffix(self):
     def file_type(self):
         return self.suffix().lstrip(".")
 
+    def display_type(self):
+        return self.DISPLAY_TYPES.get(self.file_type(), "preformatted")
+
     def breadcrumbs(self):
         item = self
         crumbs = [item]
diff --git a/airlock/templates/file_browser/index.html b/airlock/templates/file_browser/index.html
index 62bc1e11..2510df27 100644
--- a/airlock/templates/file_browser/index.html
+++ b/airlock/templates/file_browser/index.html
@@ -55,6 +55,9 @@
     .content {
       width:100%;
       max-width: 100%;
+    }
+
+    .content-scroller {
       height: 75vh;
       overflow: scroll;
     }
@@ -62,6 +65,7 @@
     .datatable thead {
       position: sticky;
       top: 0;
+      text-align: left;
     }
 
 
@@ -178,7 +182,7 @@
           {% #card title=path_item.name container=True custom_button=add_button %}
 
             <div class="content">
-              {% if path_item.suffix == '.html' %}
+              {% if path_item.display_type == "iframe" %}
                 <iframe
                   src="{{ path_item.contents_url }}"
                   title="{{ path_item.relpath }}"
@@ -187,10 +191,18 @@
                   style="width: 100%;"
                 >
                 </iframe>
-              {% elif path_item.suffix == '.csv' %}
-                {% include "file_browser/csv.html" with contents=path_item.contents %}
+              {% elif path_item.display_type == "image" %}
+                <div class="content-scroller">
+                  <img src="{{ path_item.contents_url }}">
+                </div>
+              {% elif path_item.display_type == "table" %}
+                <div class="content-scroller">
+                  {% include "file_browser/csv.html" with contents=path_item.contents %}
+                </div>
               {% else %}
-            <pre>{{ path_item.contents }}</pre>
+                <div class="content-scroller">
+                <pre>{{ path_item.contents }}</pre>
+                </div>
               {% endif %}
             </div>
           {% /card %}
diff --git a/example-data/bennett.svg b/example-data/bennett.svg
new file mode 100644
index 00000000..ea1820ee
--- /dev/null
+++ b/example-data/bennett.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" fill-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2" clip-rule="evenodd" viewBox="0 0 500 500"><path fill="#40b5ff" fill-rule="nonzero" d="M161 418c36.5-12.5 101-15 103-56 1.6-32.9-50-40.1-79-55-24.6 8.4-53.9 14-93 14H67v72h29c26.3 0 46.5 10.3 65 25Z"/><path fill="#ff7cff" fill-rule="nonzero" d="M185 307c66.8-22.8 204-65 204-65s-138.3-34.9-207-53c-24 15-51.2 25-86 25H67v72h29c36.6 0 63.8 8 89 21Z"/><path fill="#ffd13a" fill-rule="nonzero" d="M182 189c29.4-18.3 83.3-32.2 80-68-3.3-36.5-63.8-36.8-111-45-18 17.6-35.1 32-55 32H67v71h24c38 0 66.8 3.6 91 10Z"/><path fill="#ffb700" fill-rule="nonzero" d="M151 76C183.4 44.4 266 0 266 0H67v71h29a314.95 314.95 0 0 1 55 5Z"/><path fill="#f20c51" fill-rule="nonzero" d="M433 179c3.3-11.7 6-24.4 6-38 0-33.5-8.8-62-25-84-69.8 0-152 0-152 64 0 58 89.5 58 171 58Z"/><path fill="#ff7c00" fill-rule="nonzero" d="M151 76c47.2 8.2 79.6 26 111 45 38.3-34 82.2-64 152-64-27.4-37.1-77.6-57-148.4-57-48.8 0-82.2 44.4-114.6 76Z"/><path fill="#5324b3" fill-rule="nonzero" d="M445 307c-80.1 0-178.3.1-181 55-2.7 53.3 91.3 62.3 173 62.3a153 153 0 0 0 16-71.3 135.01 135.01 0 0 0-8-46Z"/><path fill="#9b54e6" fill-rule="nonzero" d="M264 362c47-28.4 100.9-55 181-55a123.83 123.83 0 0 0-57-65c-104 0-136.2 42.2-203 65 29 14.9 52.7 35.3 79 55Z"/><path fill="#ff369c" fill-rule="nonzero" d="M182 189c68.7 18.1 100.4 53 206 53a116.03 116.03 0 0 0 45-63c-81.5 0-124.8-30-171-58-26.9 23.9-50.6 49.7-80 68Z"/><path fill="#17d7e6" fill-rule="nonzero" d="M161.3 418c-18.6 6.3-38 11-60.2 11H67v71h212s-78-50.3-117.8-82h.1Z"/><path fill="#5971f2" fill-rule="nonzero" d="M161 418c39.7 31.7 68.2 82 117 82 80.5 0 134.3-28.3 159-76-81.7 0-130.3-30-173-62-35.2 21.2-66.5 43.5-103 56Z"/></svg>
\ No newline at end of file
diff --git a/justfile b/justfile
index 4dc1ed82..a4fdb155 100644
--- a/justfile
+++ b/justfile
@@ -185,6 +185,8 @@ load-example-data: devenv
     curl -s https://jobs.opensafely.org/opensafely-internal/tpp-database-schema/outputs/85/download/ --output "$tmp"
     unzip -u "$tmp" -d "$workspace"
 
+    cp example-data/bennett.svg $workspace/output/sample.svg
+
     request_dir="${AIRLOCK_WORK_DIR%/}/${AIRLOCK_REQUEST_DIR%/}/example-workspace/test-request"
     mkdir -p $request_dir
     cp -a $workspace/output $request_dir
diff --git a/tests/integration/views/test_workspace.py b/tests/integration/views/test_workspace.py
index 55435097..687f7641 100644
--- a/tests/integration/views/test_workspace.py
+++ b/tests/integration/views/test_workspace.py
@@ -66,6 +66,45 @@ def test_workspace_view_with_html_file(client_with_permission):
     assert f'src="{url}"' in response.rendered_content
 
 
+def test_workspace_view_with_svg_file(client_with_permission):
+    TEST_SVG = """
+    <svg viewBox="0 0 240 80" xmlns="http://www.w3.org/2000/svg">
+    <style>
+        .small {
+        font: italic 13px sans-serif;
+        }
+        .heavy {
+        font: bold 30px sans-serif;
+        }
+
+        /* Note that the color of the text is set with the    *
+        * fill property, the color property is for HTML only */
+        .Rrrrr {
+        font: italic 40px serif;
+        fill: red;
+        }
+    </style>
+
+    <text x="20" y="35" class="small">My</text>
+    <text x="40" y="35" class="heavy">cat</text>
+    <text x="55" y="55" class="small">is</text>
+    <text x="65" y="55" class="Rrrrr">Grumpy!</text>
+    </svg>
+    """
+
+    factories.write_workspace_file(
+        "workspace",
+        "file.svg",
+        TEST_SVG,
+    )
+    response = client_with_permission.get("/workspaces/view/workspace/file.svg")
+    url = reverse(
+        "workspace_contents",
+        kwargs={"workspace_name": "workspace", "path": "file.svg"},
+    )
+    assert f'src="{url}"' in response.rendered_content
+
+
 def test_workspace_view_with_csv_file(client_with_permission):
     factories.write_workspace_file("workspace", "file.csv", "header1,header2\nFoo,Bar")
     response = client_with_permission.get("/workspaces/view/workspace/file.csv")