download wf update

src/routes/download.ts

@@ -2,7 +2,7 @@ import { lstat } from "node:fs/promises";
 import { hasValidAuth, renderPasswordForm } from "../auth";
 import { notFound } from "../http";
 import { log } from "../log";
-import { contentDisposition, downloadFileName, fileIdFromKey, KEY_PATTERN, secretMatches } from "../security";
+import { contentDisposition, downloadFileName, keyFromPath, secretMatches, shouldInline } from "../security";
 import { isExpired, type Storage } from "../storage";
 
 export async function handleDownload(
@@ -11,8 +11,7 @@ export async function handleDownload(
   rawKey: string,
   secret: string,
 ): Promise<Response> {
-  if (!KEY_PATTERN.test(rawKey)) return notFound();
-  const id = fileIdFromKey(rawKey);
+  const id = keyFromPath(rawKey);
   if (!id) return notFound();
 
   const meta = await storage.readMetadata(id);
@@ -22,11 +21,11 @@ export async function handleDownload(
     log("info", `download rejected id=${id} expired`);
     return notFound();
   }
-  if (!secretMatches(meta.downloadKeyHash, rawKey)) return notFound();
+  if (!secretMatches(meta.downloadKeyHash, id)) return notFound();
 
-  if (meta.passwordHash && !hasValidAuth(req, secret, rawKey)) {
+  if (meta.passwordHash && !hasValidAuth(req, secret, id)) {
     const url = new URL(req.url);
-    return renderPasswordForm(rawKey, meta.originalName, url.searchParams.has("e"));
+    return renderPasswordForm(id, meta.originalName, url.searchParams.has("e"));
   }
 
   const filePath = storage.filePath(id);
@@ -41,7 +40,12 @@ export async function handleDownload(
   const headers = new Headers({
     "content-type": meta.mimeType || "application/octet-stream",
     "content-length": String(fileStat.size),
-    "content-disposition": contentDisposition(downloadFileName(rawKey, meta.originalName)),
+    "content-disposition": contentDisposition(
+      downloadFileName(id, meta.originalName),
+      new URL(req.url).searchParams.get("dl") === "1" || !shouldInline(meta.mimeType)
+        ? "attachment"
+        : "inline",
+    ),
     "cache-control": "private, no-store",
     "x-content-type-options": "nosniff",
     "referrer-policy": "no-referrer",

src/routes/upload.ts

@@ -89,15 +89,17 @@ export async function handleUpload(
       expiresAt: new Date(Date.now() + ttlMs).toISOString(),
     });
 
-    const url = publicBaseUrl ? `${publicBaseUrl}/${key}` : `/${key}`;
+    const downloadName = downloadFileName(key, originalName);
+    const url = publicBaseUrl ? `${publicBaseUrl}/${downloadName}` : `/${downloadName}`;
     log("info", `upload ok id=${id} size=${size} name=${JSON.stringify(originalName)}`);
     return json({
       id,
       key,
       url,
       originalName,
-      downloadName: downloadFileName(key, originalName),
+      downloadName,
       size,
+      mimeType: mime,
       protected: !!passwordHash,
     });
   } catch (err) {