From b92f3fbe2b1dd2e5975c01f17b1b847dc773cb30 Mon Sep 17 00:00:00 2001
From: ugurtafrali <tafraliugur@gmail.com>
Date: Tue, 3 Mar 2026 12:28:54 +0300
Subject: [PATCH] Fix API downloads ignoring ProxyDownload configuration

---
 internal/storage/FileServing_test.go                | 10 ++++++++++
 internal/storage/filesystem/s3filesystem/aws/Aws.go | 10 +++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/internal/storage/FileServing_test.go b/internal/storage/FileServing_test.go
index 13f53dea..1f6f2530 100644
--- a/internal/storage/FileServing_test.go
+++ b/internal/storage/FileServing_test.go
@@ -600,6 +600,16 @@ func TestServeFile(t *testing.T) {
 		} else {
 			test.ResponseBodyContains(t, w, "<a href=\"http")
 		}
+		r = httptest.NewRequest("GET", "/", nil)
+		w = httptest.NewRecorder()
+		file, result = GetFile("awsTest1234567890123")
+		test.IsEqualBool(t, result, true)
+		ServeFile(file, w, r, false, true, true)
+		if aws.IsMockApi {
+			test.ResponseBodyContains(t, w, "https://redirect.url")
+		} else {
+			test.ResponseBodyContains(t, w, "<a href=\"http")
+		}
 		testconfiguration.DisableS3()
 	}
 	newFile, err := createTestFile()
diff --git a/internal/storage/filesystem/s3filesystem/aws/Aws.go b/internal/storage/filesystem/s3filesystem/aws/Aws.go
index 01758390..60564bd7 100644
--- a/internal/storage/filesystem/s3filesystem/aws/Aws.go
+++ b/internal/storage/filesystem/s3filesystem/aws/Aws.go
@@ -148,12 +148,16 @@ func Stream(writer io.Writer, file models.File) error {
 // ServeFile either redirects the user to a pre-signed download url (default) or downloads the file and serves it as a proxy (depending
 // on configuration). Returns true if blocking operation (to set download status) or false if non-blocking.
 func ServeFile(w http.ResponseWriter, r *http.Request, file models.File, forceDownload, forceDecryption bool) (bool, error) {
-	if forceDecryption {
-		return true, serveDecryptedFile(w, file)
-	}
+	needsDecryption := forceDecryption && file.Encryption.IsEncrypted
 	if awsConfig.ProxyDownload {
+		if needsDecryption {
+			return true, serveDecryptedFile(w, file)
+		}
 		return true, proxyDownload(w, file, forceDownload)
 	}
+	if needsDecryption {
+		return true, serveDecryptedFile(w, file)
+	}
 	return false, redirectToDownload(w, r, file, forceDownload)
 }