randy
eca8519152
?download=... on GET /api/gpx/file now requires login, same as upload/move/delete/create-folder -- plain viewing (no ?download) stays public. Added ?download=original alongside the existing GeoJSON export, serving the untouched, as-uploaded file directly via send_file -- the file name link still downloads GeoJSON, a new button next to delete downloads the original. Since both are real <a href> links (so right-click/middle-click still work), a logged-out click can't just be left as a plain navigation -- it would land on a raw JSON error page instead of being sent to log in. _download (gpx.js) fetches instead, reuses the existing redirectIfUnauthorized 401 check, and only then turns the response into a blob and clicks a throwaway <a download> to trigger the save. Verified in a real browser: an anonymous click on either download correctly redirects through /login to the real OAuth login page instead of showing raw JSON.