Gutschriften: signierte Links fuer Nachweise im Ticketsystem

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routes/takeoverCredits.js

@@ -2,6 +2,7 @@ import { Router } from 'express'
 import { config } from '../config.js'
 import { getSessionCustomerId, requireSession } from '../middleware/session.js'
 import { getDocument, listDocuments, Query } from '../services/appwriteAdmin.js'
+import { signFileLink } from '../services/signedLinks.js'
 import {
   answerQuestion,
   applyTakeoverCredit,
@@ -176,9 +177,21 @@ takeoverAdminRouter.get('/open-count', async (_req, res) => {
   }
 })
 
+// Nachweise bekommen einen signierten Link (15 min) auf den Team-Eingang: das Ticketsystem oeffnet sie ohne
+// Authorization-Header (routes/team/files.js). Bei jedem Oeffnen des Antrags neu signiert.
+function withSignedFileUrls(detail, now = Date.now()) {
+  const id = detail.request.id
+  const base = `${config.publicBaseUrl}/api/team/takeover-credits/${encodeURIComponent(id)}/files`
+  const files = detail.request.files.map((file) => {
+    const { exp, sig } = signFileLink({ kind: 'takeover', customerId: id, id: file.id, now })
+    return { ...file, url: `${base}/${encodeURIComponent(file.id)}?exp=${exp}&sig=${sig}` }
+  })
+  return { ...detail, request: { ...detail.request, files } }
+}
+
 takeoverAdminRouter.get('/:id', async (req, res) => {
   try {
-    return res.json(await getAdminDetail(req.params.id))
+    return res.json(withSignedFileUrls(await getAdminDetail(req.params.id)))
   } catch (err) {
     return sendError(res, err, 'Antrag konnte nicht geladen werden')
   }