fix: download dashboard subscriptions same-origin

Author: Ryson-32

packages/ui/src/dashboard/subscription-dashboard-surface.test.ts

@@ -239,6 +239,12 @@ describe("SubscriptionDashboardSurface", () => {
       getItem: vi.fn(() => null),
       setItem: vi.fn(),
     });
+    vi.stubGlobal("window", {
+      location: {
+        href: "http://localhost/dashboard",
+        origin: "http://localhost",
+      },
+    });
   });
 
   afterEach(() => {
@@ -344,8 +350,11 @@ describe("SubscriptionDashboardSurface", () => {
     const fetchMock = vi.fn(async () => ({ ok: true, status: 200, blob: vi.fn(async () => blob) }));
     const createObjectURL = vi.fn(() => "blob:subboost-config");
     const revokeObjectURL = vi.fn();
+    class TestURL extends URL {}
+    TestURL.createObjectURL = createObjectURL;
+    TestURL.revokeObjectURL = revokeObjectURL;
     vi.stubGlobal("fetch", fetchMock);
-    vi.stubGlobal("URL", { createObjectURL, revokeObjectURL });
+    vi.stubGlobal("URL", TestURL);
 
     renderSurface(createAdapter(), { 0: [subscription], 1: false, 2: null, 3: null });
     await mocks.captures.buttons.find((props: any) => props.title === "下载订阅配置").onClick();
@@ -379,6 +388,29 @@ describe("SubscriptionDashboardSurface", () => {
     }));
   });
 
+  it("fetches cross-origin subscription links through the current origin for downloads", async () => {
+    const dom = stubDocumentActions();
+    const blob = new Blob(["mixed-port: 7890\n"], { type: "text/yaml" });
+    const fetchMock = vi.fn(async () => ({ ok: true, status: 200, blob: vi.fn(async () => blob) }));
+    vi.stubGlobal("fetch", fetchMock);
+    class TestURL extends URL {}
+    TestURL.createObjectURL = vi.fn(() => "blob:subboost-config");
+    TestURL.revokeObjectURL = vi.fn();
+    vi.stubGlobal("URL", TestURL);
+
+    renderSurface(createAdapter(), {
+      0: [{ ...subscription, subscriptionUrl: "https://ryan-ai.de/api/subscription/token-1?download=1" }],
+      1: false,
+      2: null,
+      3: null,
+    });
+    await mocks.captures.buttons.find((props: any) => props.title === "下载订阅配置").onClick();
+    await flushPromises();
+
+    expect(fetchMock).toHaveBeenCalledWith("http://localhost/api/subscription/token-1?download=1");
+    expect(dom.anchor.download).toBe("Primary.yaml");
+  });
+
   it("guards cancelled delete and in-flight refresh failures", async () => {
     const adapter = createAdapter({ refreshSubscription: vi.fn(async () => { throw new Error("refresh failed"); }) });
     renderSurface(adapter, { 0: [subscription], 1: false, 2: null, 3: "sub-1" });

packages/ui/src/dashboard/subscription-dashboard-surface.tsx

@@ -88,6 +88,16 @@ function triggerBrowserDownload(href: string, filename: string) {
   anchor.remove();
 }
 
+function buildSameOriginDownloadUrl(subscriptionUrl: string): string {
+  try {
+    const url = new URL(subscriptionUrl, window.location.href);
+    if (!url.pathname.includes("/api/subscription")) return subscriptionUrl;
+    return `${window.location.origin}${url.pathname}${url.search}`;
+  } catch {
+    return subscriptionUrl;
+  }
+}
+
 async function copyText(text: string): Promise<boolean> {
   try {
     if (navigator.clipboard?.writeText) {
@@ -207,7 +217,7 @@ export function SubscriptionDashboardSurface({ adapter }: Props) {
   const downloadSubscription = async (subscription: Subscription) => {
     const filename = buildYamlDownloadFilename(subscription.name);
     try {
-      const response = await fetch(subscription.subscriptionUrl);
+      const response = await fetch(buildSameOriginDownloadUrl(subscription.subscriptionUrl));
       if (!response.ok) throw new Error(`Download failed with status ${response.status}`);
       const blob = await response.blob();
       const objectUrl = URL.createObjectURL(blob);