more fixes

resources/js/components/artwork/ArtworkActions.jsx

@@ -5,8 +5,6 @@ export default function ArtworkActions({ artwork, canonicalUrl, mobilePriority =
   const [favorited, setFavorited] = useState(Boolean(artwork?.viewer?.is_favorited))
   const [reporting, setReporting] = useState(false)
   const [downloading, setDownloading] = useState(false)
-  // Fallback URL used only if the API call fails entirely
-  const fallbackUrl = artwork?.thumbs?.xl?.url || artwork?.thumbs?.lg?.url || artwork?.file?.url || '#'
   const shareUrl = canonicalUrl || artwork?.canonical_url || (typeof window !== 'undefined' ? window.location.href : '#')
   const csrfToken = typeof document !== 'undefined'
     ? document.querySelector('meta[name="csrf-token"]')?.getAttribute('content')
@@ -30,37 +28,20 @@ export default function ArtworkActions({ artwork, canonicalUrl, mobilePriority =
     }).catch(() => {})
   }, [artwork?.id]) // eslint-disable-line react-hooks/exhaustive-deps
 
-  /**
-   * Async download handler:
-   * 1. POST /api/art/{id}/download  → records the event, returns { url, filename }
-   * 2. Programmatically clicks a hidden <a download="filename"> to trigger the save dialog
-   * 3. Falls back to the pre-resolved fallbackUrl if the API is unreachable
-   */
+  // Download through the secure Laravel route so original files are never exposed directly.
   const handleDownload = async (e) => {
     e.preventDefault()
     if (downloading || !artwork?.id) return
     setDownloading(true)
     try {
-      const res = await fetch(`/api/art/${artwork.id}/download`, {
-        method: 'POST',
-        headers: { 'X-CSRF-TOKEN': csrfToken || '', 'Content-Type': 'application/json' },
-        credentials: 'same-origin',
-      })
-      const data = res.ok ? await res.json() : null
-      const url      = data?.url      || fallbackUrl
-      const filename = data?.filename || ''
-
-      // Trigger browser save-dialog with the correct filename
       const a = document.createElement('a')
-      a.href = url
-      a.download = filename
+      a.href = `/download/artwork/${artwork.id}`
       a.rel = 'noopener noreferrer'
       document.body.appendChild(a)
       a.click()
       document.body.removeChild(a)
     } catch {
-      // API unreachable — open the best available URL directly
-      window.open(fallbackUrl, '_blank', 'noopener,noreferrer')
+      window.open(`/download/artwork/${artwork.id}`, '_blank', 'noopener,noreferrer')
     } finally {
       setDownloading(false)
     }