Button component : download via API request that requires a bearer token to be set for authentication.

[grodger]

Hi,

I want to use the button component to download a file from an API end-point (exposed through PostgREST). The API and functionality works, as long as I have set the http bearer token in the request, which is required. i.e.

curl "http://localhost:3001/rpc/document_retrieve?id_p=348822345600733184" \
  -H "Authorization: Bearer $TOKEN" \
  --output file.png

The $TOKEN is set correctly in the environment.

Here is the SQLPage code, but I am not sure how to set the bearer token to authenticate the request?

SELECT 'button' as component;
SELECT 
    'Download - ' ||  doc.name as title, 
    'http://localhost:3001/rpc/document_retrieve?id_p=' || doc.id::text as link,
    'download' as icon,
    doc.name as download,
    'nofollow' as rel
FROM api.documents doc        
WHERE  
    $filename IS NOT NULL AND doc.id = $filename::bigint LIMIT 1;

As a result I get this back, which is correct and what I would expect if there is no bearer token:
{"code":"42501","details":null,"hint":null,"message":"permission denied for schema public"}

Has anyone any suggestions, or have I missed something and the 'button' component supports this?
Or should I use another method?

Thanks in advance for your help.

Regards,
Grant

[lovasoa]

The button component's link parameter creates a client-side link (an <a> tag), which cannot directly include custom HTTP headers like an Authorization bearer token.

Are you connected to the same database from your postgrest server and from sqlpage ? If so, the easiest is probably to create a download page that contains only a download button which contains the entire file as a data url:

SELECT 'button' as component;
SELECT 
    'Download - ' ||  doc.name as title, 
    'data:' || doc.mime_type || ';base64,' || encode(doc.data::bytea, 'base64') as link,
    'download' as icon,
    doc.name as download,
    'nofollow' as rel
FROM api.documents doc        
WHERE  
    $filename IS NOT NULL AND doc.id = $filename::bigint LIMIT 1;

[grodger]

Thank-you @lovasoa ,

Thanks for the guidance, you suggestion worked and the 'data:' ... additions were what I needed to get it all working! (as I had previously tried this approach before exploring the url for the link approach).

Now I can download and display the content in the page now; works brilliantly.

SELECT 'button' as component
WHERE  
    $filename IS NOT NULL AND
    $authorised_to_write = 'true';

SELECT 
    'Download' as title, 
    'download' as icon,
    'green' as color,
    'data:' || doc.magic_type || ';base64,' || encode(doc.content::bytea, 'base64') as link,
    'ledgerflow_doc_' || doc.id::text || '_' || doc.name || '.' || doc.file_extension as download,
    'nofollow' as rel
FROM api.documents doc        
WHERE  
    $filename IS NOT NULL AND doc.id = $filename::bigint AND
    $authorised_to_write = 'true'
    LIMIT 1;

SELECT
    'html' AS component,
    CONCAT('<img src="data:', doc.magic_type, ';base64,', encode(doc.content::bytea, 'base64'), '" alt="Document Image">') AS html
FROM api.documents doc        
WHERE  
    $filename IS NOT NULL AND doc.id = $filename::bigint LIMIT 1;

Kind Regards,
Grant

[lovasoa]

To anyone stumbling upon this discussion: SQLPage v0.37 adds a new download component that helps in this exact case.

It's not yet released, but already testable on docker lovasoa/sqlpage:main.