Serve asset downloads via backend instead of redirecting to storage.

The download endpoint now streams object bytes from storage on the same API URL so clients never get redirected to MinIO/internal hosts, while preserving public/private access checks.

Made-with: Cursor

internal/http/api_test.go

@@ -41,6 +41,11 @@ func (fakeSigner) PutObject(_ context.Context, _ string, _ string, _ io.Reader,
 	return nil
 }
 
+func (fakeSigner) GetObject(_ context.Context, objectKey string) (io.ReadCloser, string, int64, error) {
+	payload := []byte("fake-download:" + objectKey)
+	return io.NopCloser(bytes.NewReader(payload)), "application/octet-stream", int64(len(payload)), nil
+}
+
 func mustJSON(t *testing.T, value interface{}) []byte {
 	t.Helper()
 	b, err := json.Marshal(value)
@@ -314,7 +319,6 @@ func TestAssetLifecycleAndVisibility(t *testing.T) {
 	server := newTestServer(adminPubB64)
 	defer server.Close()
 	client := server.Client()
-	client.CheckRedirect = func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }
 
 	adminToken := loginUser(t, client, server.URL, adminPubB64, adminPriv)
 
@@ -418,12 +422,17 @@ func TestAssetLifecycleAndVisibility(t *testing.T) {
 	if err != nil {
 		t.Fatalf("download public request failed: %v", err)
 	}
-	if downloadPublicResp.StatusCode != http.StatusFound {
-		t.Fatalf("expected public asset redirect status, got %d", downloadPublicResp.StatusCode)
+	defer downloadPublicResp.Body.Close()
+	if downloadPublicResp.StatusCode != http.StatusOK {
+		t.Fatalf("expected public asset stream status, got %d", downloadPublicResp.StatusCode)
 	}
-	expectedLocation := fmt.Sprintf("http://files.local/download/%s/%s.%s", user1PubB64, "abcdef1234", "glb")
-	if downloadPublicResp.Header.Get("Location") != expectedLocation {
-		t.Fatalf("unexpected redirect location: %s", downloadPublicResp.Header.Get("Location"))
+	body, err := io.ReadAll(downloadPublicResp.Body)
+	if err != nil {
+		t.Fatalf("read public download body: %v", err)
+	}
+	expectedBody := fmt.Sprintf("fake-download:%s/%s.%s", user1PubB64, "abcdef1234", "glb")
+	if string(body) != expectedBody {
+		t.Fatalf("unexpected download body: %q", string(body))
 	}
 
 	patchResp, patchData := patchJSON(t, client, server.URL+"/v1/assets/"+assetID, map[string]interface{}{