fix: prevent redirect for signed object urls

go/internal/handler/handler.go

@@ -447,7 +447,7 @@ func (h *Handler) RemoveMemberFromNetwork(w http.ResponseWriter, r *http.Request
 	w.WriteHeader(http.StatusNoContent)
 }
 
-// DownloadParticleMedia redirects to a fresh signed download URL for media/file particles
+// DownloadParticleMedia returns a fresh signed download URL for media/file particles
 func (h *Handler) DownloadParticleMedia(w http.ResponseWriter, r *http.Request) {
 	_, ok := middleware.EmailFromContext(r.Context())
 	if !ok {
@@ -459,33 +459,6 @@ func (h *Handler) DownloadParticleMedia(w http.ResponseWriter, r *http.Request)
 
 	objectID := r.PathValue("id")
 
-	// particleID := r.PathValue("id")
-	// if particleID == "" {
-	// 	http.Error(w, "object id is required", http.StatusBadRequest)
-	// 	return
-	// }
-
-	// p, err := h.particleSvc.GetByID(r.Context(), particleID, email)
-	// if err != nil {
-	// 	if errors.Is(err, particle.ErrNotFound) {
-	// 		http.Error(w, "particle not found", http.StatusNotFound)
-	// 		return
-	// 	}
-	// 	if errors.Is(err, particle.ErrAccessDenied) {
-	// 		http.Error(w, "access denied", http.StatusForbidden)
-	// 		return
-	// 	}
-	// 	slog.Error("failed to get particle for download", "error", err, "particle_id", particleID, "email", email)
-	// 	http.Error(w, "internal server error", http.StatusInternalServerError)
-	// 	return
-	// }
-	//
-	// objectID := extractObjectID(p)
-	// if objectID == "" {
-	// 	http.Error(w, "particle has no downloadable content", http.StatusBadRequest)
-	// 	return
-	// }
-
 	downloadURL, err := h.depotSvc.GetDownloadURL(r.Context(), objectID)
 	if err != nil {
 		slog.Error("failed to get download URL", "error", err, "object_id", objectID)
@@ -493,7 +466,8 @@ func (h *Handler) DownloadParticleMedia(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	http.Redirect(w, r, downloadURL, http.StatusFound)
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{"url": downloadURL})
 }
 
 // ============================================================================