Initial motionEye commit.

src/utils/download.ts

@@ -10,23 +10,32 @@ export const downloadMedia = async (
   cameraManager: CameraManager,
   media: ViewMedia,
 ): Promise<void> => {
-  const path = cameraManager.getMediaDownloadPath(media);
-  if (!path) {
+  const download = await cameraManager.getMediaDownloadPath(hass, media);
+  if (!download) {
     throw new FrigateCardError(localize('error.download_no_media'));
   }
 
-  let response: string | null | undefined;
-  try {
-    response = await homeAssistantSignPath(hass, path);
-  } catch (e) {
-    errorToConsole(e as Error);
+  let finalURL = download.endpoint;
+  if (download.sign) {
+    let response: string | null | undefined;
+    try {
+      response = await homeAssistantSignPath(hass, download.endpoint);
+    } catch (e) {
+      errorToConsole(e as Error);
+    }
+
+    if (!response) {
+      throw new FrigateCardError(localize('error.download_sign_failed'));
+    }
+    finalURL = response;
   }
 
-  if (!response) {
-    throw new FrigateCardError(localize('error.download_sign_failed'));
-  }
+  // The download attribute only works on the same origin.
+  // See: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#attributes
+  const isSameOrigin = new URL(finalURL).origin === window.location.origin;
 
   if (
+    !isSameOrigin ||
     navigator.userAgent.startsWith('Home Assistant/') ||
     navigator.userAgent.startsWith('HomeAssistant/')
   ) {
@@ -36,13 +45,13 @@ export const downloadMedia = async (
     // User-agents are specified here:
     //  - Android: https://github.com/home-assistant/android/blob/master/app/src/main/java/io/homeassistant/companion/android/webview/WebViewActivity.kt#L107
     //  - iOS: https://github.com/home-assistant/iOS/blob/master/Sources/Shared/API/HAAPI.swift#L75
-    window.open(response, '_blank');
+    window.open(finalURL, '_blank');
   } else {
     // Use the HTML5 download attribute to prevent a new window from
     // temporarily opening.
     const link = document.createElement('a');
-    link.setAttribute('download', '');
-    link.href = response;
+    link.setAttribute('download', 'download');
+    link.href = finalURL;
     link.click();
     link.remove();
   }