From dc8fbf4290fd0fd8bfca1165b736679fbd672a32 Mon Sep 17 00:00:00 2001
From: Cole Kennedy <cole@testifysec.com>
Date: Thu, 3 Sep 2026 12:05:11 -0500
Subject: [PATCH] auth: accept access token via ?token= for browser download
 links

---
 internal/auth/middleware.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/internal/auth/middleware.go b/internal/auth/middleware.go
index 4a7d1be..beedff6 100644
--- a/internal/auth/middleware.go
+++ b/internal/auth/middleware.go
@@ -28,6 +28,12 @@ func Middleware(jwtService *JWTService) func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			// Get the Authorization header
 			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				// Browser download links cannot set headers; accept the token as a query parameter.
+				if t := r.URL.Query().Get("token"); t != "" {
+					authHeader = "Bearer " + t
+				}
+			}
 			if authHeader == "" {
 				http.Error(w, "Authorization header required", http.StatusUnauthorized)
 				return