Use an authenticated fetch for credentialed browser downloads

When an admin-only file download requires a bearer credential that a normal attachment link will not attach, use an authenticated fetch, convert the successful response to a Blob, and trigger the download through a temporary object URL. Validate that the request URL remains same-origin before sending credentials, derive the filename only from validated response metadata or a trusted fallback, and revoke the object URL after use.

This browser pattern does not replace server-side authorization, safe attachment headers, content validation, or filename validation. Verify the live response headers and complete browser flow before treating an implementation as integrated.