fix(portal): preserve readable download filenames

www/tools/service-portal.test.mjs

@@ -16,6 +16,7 @@ import {
   portalDownloadErrorMessage,
   portalRoleForStreamId,
   protectedPortalResource,
+  recognizableDownloadFilename,
 } from '../src/utils/portal-download.mjs';
 import { applyRoleMappings, approvedMapping, summarizeMappings } from './portal-production.mjs';
 
@@ -60,12 +61,17 @@ test('portal downloads use only the validated role and an in-memory authorizatio
   assert.equal(portalRoleForStreamId('a'), 'management');
   assert.equal(portalRoleForStreamId('fixture-staff'), undefined);
   const origin = 'https://www.azinstitute4autism.com';
-  const staff = protectedPortalResource('/staff-resources/staff-guide.pdf', origin);
-  const management = protectedPortalResource('/management-resources/management-guide.pdf', origin);
+  const staff = protectedPortalResource('/staff-resources/' + 'a'.repeat(64) + '.pdf', origin, "Staff's Safety & Training: Résumé (2026)!");
+  const management = protectedPortalResource('/management-resources/' + 'b'.repeat(64) + '.docx', origin, 'Management – Policies / Q&A #1');
   assert.deepEqual(staff, {
-    role: 'staff', filename: 'staff-guide.pdf',
-    url: origin + '/staff-resources/staff-guide.pdf',
+    role: 'staff', filename: 'a'.repeat(64) + '.pdf',
+    downloadFilename: 'Staffs-Safety-and-Training-Resume-2026.pdf',
+    url: origin + '/staff-resources/' + 'a'.repeat(64) + '.pdf',
   });
+  assert.equal(management.downloadFilename, 'Management-Policies-Q-and-A-1.docx');
+  assert.equal(recognizableDownloadFilename('Client Check-In & Check-Out.xlsx', 'c'.repeat(64) + '.xlsx'), 'Client-Check-In-and-Check-Out.xlsx');
+  assert.equal(recognizableDownloadFilename('../../', 'd'.repeat(64) + '.pdf'), 'AIA-document.pdf');
+  assert.equal(recognizableDownloadFilename('No server extension', 'e'.repeat(64)), undefined);
   assert.equal(protectedPortalResource('/staff-resources/nested/file.pdf', origin), undefined);
   assert.equal(protectedPortalResource('/staff-resources/file.pdf?code=forbidden', origin), undefined);
   assert.equal(protectedPortalResource('https://other.invalid/staff-resources/file.pdf', origin), undefined);
@@ -75,7 +81,8 @@ test('portal downloads use only the validated role and an in-memory authorizatio
   const result = await fetchProtectedPortalResource(staff, { role: 'staff', code }, async (url, options) => {
     captured = { url, options };
     return new Response('synthetic document', {
-      headers: { 'content-disposition': 'attachment; filename="approved-name.pdf"' },
+      // nginx may expose the hash name; the approved label remains authoritative.
+      headers: { 'content-disposition': `attachment; filename="${staff.filename}"` },
     });
   });
   assert.equal(captured.url, staff.url);
@@ -86,7 +93,7 @@ test('portal downloads use only the validated role and an in-memory authorizatio
   assert.equal(captured.options.redirect, 'error');
   assert.equal(captured.options.referrerPolicy, 'no-referrer');
   assert.match(captured.options.headers.Authorization, /^Basic /);
-  assert.equal(result.filename, 'approved-name.pdf');
+  assert.equal(result.filename, 'Staffs-Safety-and-Training-Resume-2026.pdf');
   assert.equal(await result.blob.text(), 'synthetic document');
 
   for (const [resource, credential] of [