From b7d33345a1dd630f6eeb7224cec6d2e2d43041a9 Mon Sep 17 00:00:00 2001
From: Ogulcan Gurcaglar <ogulcan@zeropath.com>
Date: Tue, 8 Sep 2026 11:20:20 +0300
Subject: [PATCH] feat(routes): add invoice download by filename

---
 routes/invoiceDownload.ts | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 routes/invoiceDownload.ts

diff --git a/routes/invoiceDownload.ts b/routes/invoiceDownload.ts
new file mode 100644
index 00000000000..341f6cdc884
--- /dev/null
+++ b/routes/invoiceDownload.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import { type Request, type Response, type NextFunction } from 'express'
+import path from 'path'
+import fs from 'fs'
+
+const INVOICE_ROOT = path.resolve('ftp/invoices')
+
+// Serves a previously generated invoice PDF back to the customer.
+module.exports = function invoiceDownload () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const file = req.params.file
+    fs.readFile(path.join(INVOICE_ROOT, file), (error, data) => {
+      if (error != null) {
+        next(error)
+        return
+      }
+      res.type('application/pdf').send(data)
+    })
+  }
+}