From d910e252a13a47365f872960b4a1e55f990c9826 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 20 Jul 2026 23:18:29 +0000
Subject: [PATCH] fix(downloads): clean up header merge logic

---
 admin/app/utils/downloads.ts | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/admin/app/utils/downloads.ts b/admin/app/utils/downloads.ts
index b7475f4..ae92b7b 100644
--- a/admin/app/utils/downloads.ts
+++ b/admin/app/utils/downloads.ts
@@ -52,12 +52,15 @@ export async function doResumableDownload({
     appendMode = true
   }
 
+  // Merge default headers with any caller-supplied headers (e.g. Creator Packs' Authorization)
+  const headers: Record<string, string> = { ...DOWNLOAD_HEADERS, ...requestHeaders }
+
   // Get file info with HEAD request first. Gated sources (Creator Packs) require
   // the auth header on the HEAD too, or the probe 401s before the GET is reached.
   const headResponse = await axios.head(url, {
     signal,
     timeout,
-    headers: requestHeaders,
+    headers, 
   })
 
   // Some upstream hosts (notably download.kiwix.org for .zim files) don't set a
@@ -101,18 +104,15 @@ export async function doResumableDownload({
     appendMode = false
   }
 
-  // Seed with any caller-supplied headers (e.g. Creator Packs' Authorization
-  // bearer) so every GET attempt below — including the range-restart retry —
-  // carries them. The Range header composes on top.
-  const headers: Record<string, string> = { ...requestHeaders }
+  // Add Range header if resuming
   if (supportsRangeRequests && startByte > 0) {
     headers.Range = `bytes=${startByte}-`
   }
 
-  const fetchStream = (hdrs: Record<string, string>) =>
+  const fetchStream = (headers: Record<string, string>) =>
     axios.get(url, {
       responseType: 'stream',
-      headers: { ...DOWNLOAD_HEADERS, ...hdrs },
+      headers,
       signal,
       timeout,
     })