From bbe18ee759a75161974c5cc03694639183d5aee8 Mon Sep 17 00:00:00 2001
From: Alex Emmet <111742636+Alex-Emmet@users.noreply.github.com>
Date: Sun, 15 Feb 2026 01:35:21 +0100
Subject: [PATCH] [Fix] Filedownloads

---
 src/server/api.rs | 47 +++++++++++++++++++++++++++++++++++++----------
 1 file changed, 37 insertions(+), 10 deletions(-)

diff --git a/src/server/api.rs b/src/server/api.rs
index bc240dc..f826e3e 100644
--- a/src/server/api.rs
+++ b/src/server/api.rs
@@ -1,21 +1,27 @@
 use crate::data::communication::{CommunicationType, CommunicationValue, DataTypes};
+use crate::get_public_key;
 use crate::server::omikron_manager::get_random_omikron;
 use crate::sql::sql;
 use crate::sql::user_online_tracker::get_iota_primary_omikron_connection;
-use crate::util::file_util::load_file;
-use crate::{get_public_key, log};
 use crate::{
     sql::sql::{get_by_user_id, get_omikron_by_id},
     util::crypto_helper::public_key_to_base64,
 };
 use actix_web::HttpResponse;
-use actix_web::body::BoxBody;
-use actix_web::http::StatusCode;
+use actix_web::http::{StatusCode, header};
 use base64::Engine as _;
 use json::JsonValue;
 use json::number::Number;
 
 pub async fn handle(path: &str, body_string: Option<String>) -> HttpResponse {
+    if path == "OPTIONS" {
+        return HttpResponse::Ok()
+            .insert_header(("Access-Control-Allow-Origin", "*"))
+            .insert_header(("Access-Control-Allow-Methods", "GET, POST, OPTIONS"))
+            .insert_header(("Access-Control-Allow-Headers", "*"))
+            .finish();
+    }
+
     let path_parts: Vec<&str> = path.split("/").filter(|s| !s.is_empty()).collect();
 
     let _body: Option<JsonValue> = if body_string.is_some() {
@@ -27,11 +33,28 @@ pub async fn handle(path: &str, body_string: Option<String>) -> HttpResponse {
     } else {
         None
     };
-    log!("Path parts: {:?}", path_parts);
+
     let (status, body_text) = match path_parts.as_slice() {
         ["api", "download", "iota_frontend"] => {
-            let file = load_file("downloads", "iota_frontend.zip");
-            (StatusCode::OK, file)
+            let file_path = "downloads/[iota_frontend].zip";
+
+            match std::fs::read(file_path) {
+                Ok(file_bytes) => {
+                    return HttpResponse::Ok()
+                        .insert_header(("Access-Control-Allow-Origin", "*"))
+                        .insert_header(("Content-Type", "application/zip"))
+                        .insert_header((
+                            "Content-Disposition",
+                            "attachment; filename=\"iota_frontend.zip\"",
+                        ))
+                        .body(file_bytes);
+                }
+                Err(_) => {
+                    return HttpResponse::NotFound()
+                        .insert_header(("Access-Control-Allow-Origin", "*"))
+                        .body("File not found");
+                }
+            }
         }
         ["api", "get", "omikron"] => {
             if let Ok(omikron_conn) = get_random_omikron().await {
@@ -205,9 +228,13 @@ pub async fn handle(path: &str, body_string: Option<String>) -> HttpResponse {
                 .to_string(),
         ),
     };
-    let body_bytes = body_text.to_string().into_bytes();
-    let body = BoxBody::new(body_bytes.clone());
-    HttpResponse::new(status).set_body(body)
+    let body_bytes = body_text.into_bytes();
+
+    HttpResponse::build(status)
+        .insert_header((header::ACCESS_CONTROL_ALLOW_ORIGIN, "*"))
+        .insert_header((header::ACCESS_CONTROL_ALLOW_HEADERS, "*"))
+        .insert_header((header::ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, OPTIONS"))
+        .body(body_bytes)
 }
 
 pub fn bad_request() -> (StatusCode, String) {