[PUI] How to download attachments and reports

[SchrodingersGat]

Related issues:

• [React] API Image Functionality #5696
• [FR] Preview for attachment files #5048

The new user interface will be driven entirely by the API. Thus, downloading files (like attachments, reports, etc) no longer relies on session cookies.

so, how do we provide "file download" for the user? Note that any media files served / hosted by InvenTree require user authentication (e.g. via auth token).

So, we need a way to fetch the file and present to the user for download, via the web client.

Many of the ways I have found are very clunky, requiring first downloading the file to browser RAM, and then making a hidden button and "clicking" the button (in software). Or, similar tricks using hidden web forms.

Surely there is a better way? Any suggestions how we can cleanly do this via the API, without any of these hacks tricks?

[wolflu05]

Also related #5531

[matmair]

I do not really see why it is not working with basic links; I will investigate tonight.
If required I think we should change the backend for this so we can just link to a download endpoint instead of having to work around in the frontend with it.
Maybe this is a solution?

[SchrodingersGat]

@matmair as far as I can tell, it is because the browser does not have a session cookie. Have a look at the request headers when you download a file in the current UI, vs the react UI.

Here is the request to do a "simple download" of the file in the new UI, which only has login via token auth - no browser session auth:

This is the same reason that I have been working on this PR for images

One option I have considered:

1. At login, request a "session cookie" from the server
2. Save the cookie to the session
3. Any "media file links" can then be downloaded without any extra issues

[SchrodingersGat]

If required I think we should change the backend for this so we can just link to a download endpoint instead of having to work around in the frontend with it.

I would prefer this too - the required changes to the frontend would be prohibitive

[matmair]

I think adding a session token should be a (somewhat) easy feat. I got images working in #5545 without it but touching this up will be necessary for reports anyway.

[SchrodingersGat]

I think adding a session token should be a (somewhat) easy feat.

I hope so! I have not yet found any good examples of this

[matmair]

I have done something similar in the past - we need to argument the token endpoint to instantiate a session/log the user in and set the session token in the response. I will tackle it once #5582 is done; that is getting to the finishing line