vboxes fix

frontend/src/api/messages.api.ts

@@ -69,8 +69,25 @@ export const messagesApi = {
   getAttachments: (id: string) =>
     apiClient.get<AttachmentResponse[]>(`/messages/${id}/attachments`).then((r) => r.data),
 
-  getAttachmentUrl: (messageId: string, attachmentId: string) =>
-    `/api/v1/messages/${messageId}/attachments/${attachmentId}/download`,
+  /**
+   * Scarica un allegato autenticato e lo salva localmente.
+   * Utilizza apiClient (con Bearer token) per evitare il 401 che si ottiene
+   * navigando direttamente verso l'URL con un <a href>.
+   */
+  downloadAttachment: async (messageId: string, attachmentId: string, filename: string): Promise<void> => {
+    const response = await apiClient.get(
+      `/messages/${messageId}/attachments/${attachmentId}/download`,
+      { responseType: 'blob' },
+    )
+    const blobUrl = window.URL.createObjectURL(new Blob([response.data]))
+    const anchor = document.createElement('a')
+    anchor.href = blobUrl
+    anchor.setAttribute('download', filename)
+    document.body.appendChild(anchor)
+    anchor.click()
+    anchor.remove()
+    window.URL.revokeObjectURL(blobUrl)
+  },
 
   getReceipts: (id: string) =>
     apiClient.get<MessageResponse[]>(`/messages/${id}/receipts`).then((r) => r.data),