feat: require explicit downloads for received files

[SamOkampo]

Summary

Changes the receiver experience so files received in memory are not downloaded automatically.

Each received file now remains available until the receiver explicitly chooses to download it.

New receiver flow

• Received files appear in an ordered “Received files” list
• Each file has its own Blob URL
• Files show “Ready to download”
• Downloads require an explicit mouse or keyboard action
• Double download activation is prevented
• Downloading one file does not invalidate the others
• Only the downloaded file’s Blob URL is revoked
• “Transfer another file” preserves pending downloads

Multiple files

The previous implementation retained only one active Blob URL.

The new implementation:

• preserves multiple received files;
• preserves reception order;
• keeps independent download actions;
• does not revoke an earlier file when another one arrives;
• releases all pending Blob URLs during definitive session cleanup.

Delivery semantics preserved

The receiver still:

1. receives all bytes;
2. validates the completed file;
3. sends transfer-ack;
4. updates the interface.

The sender does not wait for the receiver to click Download.

No changes were made to:

• WebRTC
• Socket.IO signaling
• AES-GCM
• transfer-finished
• transfer-ack
• recovery
• ICE/TURN
• chunks
• buffers
• backpressure
• production timeouts
• server
• Service Worker

Direct-to-disk behavior

Browsers using direct-to-disk mode preserve the existing behavior.

No Blob URL or extra download button is created when the file has already been saved directly to disk.

Cleanup

Pending Blob URLs are released on:

• full reset;
• definitive disconnection;
• session replacement;
• normal page exit.

The bfcache behavior is preserved:

• pagehide persisted=true keeps downloads available;
• pagehide persisted=false releases them.

Analytics

Adds:

receiver_download_clicked

Only these properties are permitted:

• flow_version
• file_count_bucket: one | multiple

No file names, sizes, MIME values, Blob URLs, room codes or internal identifiers are collected.

Validation

• npm ci
• npm audit: 0 vulnerabilities
• npm test: 313/313
• npm run test:syntax
• npm run test:e2e
• git diff --check
• visual checks at 390px and 1280px
• zero-byte file
• multiple received files
• long file names
• ES/EN
• keyboard navigation

Remaining validation

Physical testing is still required on:

• Chrome desktop
• Chrome Android
• Safari iPhone

The main remaining risk is memory pressure when several large files remain pending in mobile memory.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing