Chandler Copeland ebc47ae954 feat(07-01): create GET /api/documents/[id]/download agent download route ...

- Streams signed PDF via short-lived agent-download JWT (adt query param)
- Returns 401 for missing/expired token, 403 for ID mismatch or path traversal
- Returns 404 for unsigned documents or missing files on disk
- Path traversal guard: absPath.startsWith(UPLOADS_DIR) before readFile
- Token/route ID cross-check: documentId !== id returns 403
- new Uint8Array(fileBuffer) for Next.js 16 TypeScript strict mode compatibility

2026-03-21 10:34:43 -06:00

.planning

docs(07-audit-trail-and-download): create phase 7 plan

2026-03-21 10:30:05 -06:00

teressa-copeland-homes

feat(07-01): create GET /api/documents/[id]/download agent download route

2026-03-21 10:34:43 -06:00

Description

No description provided

19 MiB

Languages

TypeScript 97.5%

Shell 1.6%

Dockerfile 0.4%

JavaScript 0.3%

CSS 0.2%