From 5966a11f7e8450aac2fb4128abab5b7a9f9c107c Mon Sep 17 00:00:00 2001
From: AI Assistant <ai@architools.local>
Date: Tue, 24 Mar 2026 22:32:09 +0200
Subject: [PATCH] fix(rgi): download via user's eTerra browser session (not
 server-side)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Server credentials can list RGI applications and docs but can't download
files (confirmOnView returns false — only the current actor/deponent
has download permission).

Download now opens the eTerra URL directly in the user's browser,
which uses their existing eTerra session cookie. Flow:
1. Hidden iframe calls confirmOnView
2. After 500ms, opens downloadFile URL in new tab

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/app/(modules)/rgi-test/page.tsx | 31 ++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/src/app/(modules)/rgi-test/page.tsx b/src/app/(modules)/rgi-test/page.tsx
index 4edc431..7173a63 100644
--- a/src/app/(modules)/rgi-test/page.tsx
+++ b/src/app/(modules)/rgi-test/page.tsx
@@ -294,16 +294,33 @@ function IssuedDocsPanel({
               </div>
             </div>
           </div>
-          <Button size="sm" variant="outline" className="shrink-0 gap-1" asChild>
-            <a
-              href={`/api/eterra/rgi/download-doc?workspaceId=${doc.workspaceId || workspaceId}&applicationId=${doc.applicationId || applicationPk}&documentPk=${doc.documentPk}&documentTypeId=${doc.documentTypeId}`}
-              target="_blank"
-              rel="noopener noreferrer"
+          <div className="flex items-center gap-1 shrink-0">
+            <Button
+              size="sm"
+              variant="outline"
+              className="gap-1"
+              onClick={() => {
+                // Open eTerra directly — user's browser session has download permission
+                // First open confirmOnView, then download
+                const base = "https://eterra.ancpi.ro/eterra/api";
+                const wid = doc.workspaceId || workspaceId;
+                const appId = doc.applicationId || applicationPk;
+                const dpk = doc.documentPk;
+                // Open confirm in hidden iframe, then download
+                const iframe = document.createElement("iframe");
+                iframe.style.display = "none";
+                iframe.src = `${base}/rgi/appdetail/issueddocs/confirmOnView/${wid}/${appId}/${dpk}`;
+                document.body.appendChild(iframe);
+                setTimeout(() => {
+                  window.open(`${base}/rgi/appdetail/loadDocument/downloadFile/${wid}/${dpk}`, "_blank");
+                  iframe.remove();
+                }, 500);
+              }}
             >
               <Download className="h-3.5 w-3.5" />
               Descarca
-            </a>
-          </Button>
+            </Button>
+          </div>
         </div>
       ))}
     </div>