From ed7ab61b90aac95da132e74468cf19ef7f0f8a46 Mon Sep 17 00:00:00 2001
From: Luca <102960244+Luca-Timo@users.noreply.github.com>
Date: Sat, 30 May 2026 03:51:02 +0200
Subject: [PATCH] fix(admin-ui): backup download button hits API path, not SPA
 route
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`BackupHistory.jsx` opened `/admin/backup/download/<id>` via window.open,
which goes to the React SPA's router — no matching route, so it
rendered the "Page Not Found" screen.

The actual download endpoint lives at `/api/admin/backup/download/:id`
on the backend (adminBackup.js:685). Cookie-based admin auth already
supports the implicit cookie sent by window.open, so the URL prefix
was the only thing missing.

Predates today's backup-hardening work — the bug has existed since
this download button shipped. Surfaced now because Ralf finally has a
completed backup to try downloading after the Stage A inline-dump
guard started working.
---
 frontend/src/components/admin/BackupHistory.jsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/components/admin/BackupHistory.jsx b/frontend/src/components/admin/BackupHistory.jsx
index ad317d24..07611789 100644
--- a/frontend/src/components/admin/BackupHistory.jsx
+++ b/frontend/src/components/admin/BackupHistory.jsx
@@ -236,7 +236,7 @@ export const BackupHistory = () => {
                             </button>
                             {backup.manifest_path && (
                               <button
-                                onClick={() => window.open(`/admin/backup/download/${backup.id}`, '_blank')}
+                                onClick={() => window.open(`/api/admin/backup/download/${backup.id}`, '_blank')}
                                 className="text-neutral-400 hover:text-neutral-600 dark:hover:text-neutral-300"
                                 title={t('backup.actions.download')}
                               >