fix: iOS download — skip redundant blob fetch, go straight to token URL

On iOS, downloadAttachment was fetching the entire file via rawFetch
(blob), then fetching a token, then opening Browser.open to download
AGAIN. The first fetch was wasted and the second relay could fail.

Now iOS skips the blob fetch entirely — gets a token and opens the
URL in SFSafariViewController directly. Single download, no waste.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: IM.codes

web/src/api.ts

@@ -917,6 +917,20 @@ export async function uploadFile(
 }
 
 export async function downloadAttachment(serverId: string, attachmentId: string): Promise<void> {
+  // Native (iOS): skip blob fetch — WKWebView can't trigger downloads from blob URLs.
+  // Get a one-time token and open in system browser which handles save natively.
+  const isNative = !!(globalThis as Record<string, unknown>).Capacitor;
+  if (isNative) {
+    const tokenRes = await apiFetch(`/api/server/${serverId}/uploads/${attachmentId}/download-token`, { method: 'POST' });
+    const downloadToken = (tokenRes as { token: string }).token;
+    const baseUrl = _baseUrl || window.location.origin;
+    const downloadUrl = `${baseUrl}/api/server/${serverId}/uploads/${attachmentId}/download?token=${downloadToken}`;
+    const { Browser } = await import('@capacitor/browser');
+    await Browser.open({ url: downloadUrl });
+    return;
+  }
+
+  // Desktop: fetch blob and trigger <a download>
   const res = await rawFetch(`/api/server/${serverId}/uploads/${attachmentId}/download`);
   if (!res.ok) {
     const body = await res.text().catch(() => '');
@@ -926,7 +940,6 @@ export async function downloadAttachment(serverId: string, attachmentId: string)
   const disposition = res.headers.get('Content-Disposition');
   let filename = attachmentId;
   if (disposition) {
-    // Prefer filename* (RFC 5987) for non-ASCII names
     const starMatch = disposition.match(/filename\*\s*=\s*UTF-8''([^\s;]+)/i);
     if (starMatch) {
       try { filename = decodeURIComponent(starMatch[1]); } catch { /* keep default */ }
@@ -935,27 +948,14 @@ export async function downloadAttachment(serverId: string, attachmentId: string)
       if (plainMatch) filename = plainMatch[1];
     }
   }
-  // Trigger download — WKWebView (iOS Capacitor) ignores <a download>,
-  // so on native platforms get a one-time download token and open the URL
-  // in the system browser. No extra native plugins needed.
-  const isNative = !!(globalThis as Record<string, unknown>).Capacitor;
-  if (isNative) {
-    const tokenRes = await apiFetch(`/api/server/${serverId}/uploads/${attachmentId}/download-token`, { method: 'POST' });
-    const downloadToken = (tokenRes as { token: string }).token;
-    const baseUrl = _baseUrl || window.location.origin;
-    const downloadUrl = `${baseUrl}/api/server/${serverId}/uploads/${attachmentId}/download?token=${downloadToken}`;
-    const { Browser } = await import('@capacitor/browser');
-    await Browser.open({ url: downloadUrl });
-  } else {
-    const url = URL.createObjectURL(blob);
-    const a = document.createElement('a');
-    a.href = url;
-    a.download = filename;
-    document.body.appendChild(a);
-    a.click();
-    document.body.removeChild(a);
-    URL.revokeObjectURL(url);
-  }
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = filename;
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+  URL.revokeObjectURL(url);
 }
 
 export async function previewAttachment(serverId: string, attachmentId: string): Promise<void> {