# FileBrowser v2 Download Debugging — Session Notes

## Problem
FileBrowser v2.63.18 UI: Download button fails silently. Files visible in browser but cannot be downloaded.

## Diagnostic Steps Run

1. **Verified server is running** — filebrowser process alive, Caddy healthy
2. **Tested API login** — JWT token returned correctly, decodes to valid user payload with `download: true` permission
3. **Tested download API** — all endpoints return HTTP 200 but `Content-Type: text/html` (login page HTML), not the file binary:
   - `/api/download?paths=...`
   - `/api/v2/files/download?path=...`
   - `/api/dl?...`
4. **Confirmed direct to port 8081** (bypassing Caddy) — same behavior
5. **JWT Bearer token valid** — decodes correctly, but API still returns HTML
6. **Browser navigation to `/files/kantor`** — works, file list renders, can navigate folders
7. **Double-click file** — does NOT open/download (v2 behavior change)
8. **SPA routing** — filebrowser v2 is a SPA; `/files/` is client-side route

## Root Cause
FileBrowser v2.x changed its API architecture. The JWT token-based download via REST API no longer works the same way. The frontend JS makes WebSocket or internal SPA API calls that aren't accessible from plain curl.

## Fix Applied
Node.js download server on port 8082 (`/home/ubuntu/dl_server.js`) serving `/home/ubuntu` as a plain HTTP file server.

**Access**: `https://hermesedi.duckdns.org/kantor/FILENAME` via the `:80` Caddy catchall (already configured to serve `/home/ubuntu`).

## Key Diagnostic Commands

```bash
# Test filebrowser is responding
curl -s -o /dev/null -w "%{http_code}" https://hermesedi.duckdns.org/

# Test login returns JWT
TOKEN=$(curl -s -X POST https://hermesedi.duckdns.org/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}')
echo "$TOKEN" | cut -d'.' -f2 | base64 -d | python3 -m json.tool

# Decode JWT to check permissions
echo "$TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | python3 -m json.tool

# Test filebrowser API download (returns HTML = bug confirmed)
curl -s -I \
  "https://hermesedi.duckdns.org/api/download?paths=%2Fhome%2Fubuntu%2Ffile.txt" \
  -H "Authorization: Bearer $TOKEN" | grep content-type

# Test direct download server
curl -s -o /dev/null -w "%{http_code}" "http://localhost:8082/kantor/FILENAME.docx"
```

## Prevention
When installing filebrowser in future, check version. If v2.x, verify download functionality immediately after setup. If bug present, consider downgrading to v1.x or using workaround download server.