From 9f7b573d0117af281abd4cf5cec2d92eeeed0368 Mon Sep 17 00:00:00 2001
From: Pierre De Lancre <pierre@chaosmith.systems>
Date: Fri, 2 Oct 2026 02:41:12 +0300
Subject: [PATCH] =?UTF-8?q?matrix:=20authed=20v1=20media=20download=20?=
 =?UTF-8?q?=E2=80=94=20homeserver=20has=20unauthenticated=20media=20disabl?=
 =?UTF-8?q?ed=20(MSC3916)=20(Pierre=20De=20Lancre)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/matrix.zig | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/matrix.zig b/src/matrix.zig
index de4979b..d534667 100644
--- a/src/matrix.zig
+++ b/src/matrix.zig
@@ -120,7 +120,9 @@ pub fn downloadFile(alloc: std.mem.Allocator, io: Io, token: []const u8, mxc: []
     const slash = std.mem.indexOfScalar(u8, rest, '/') orelse return error.BadMxc;
     const server = rest[0..slash];
     const media_id = rest[slash + 1 ..];
-    const url = try std.fmt.allocPrint(alloc, "{s}/_matrix/media/v3/download/{s}/{s}?allow_redirect=true", .{ HOMESERVER, server, media_id });
+    // MSC3916: homeserver has unauthenticated media disabled — use the
+    // authed client v1 endpoint (v3 download returns M_FORBIDDEN).
+    const url = try std.fmt.allocPrint(alloc, "{s}/_matrix/client/v1/media/download/{s}/{s}", .{ HOMESERVER, server, media_id });
     defer alloc.free(url);
     const resp = try httpRaw(alloc, io, "GET", url, token, "", null);
     // Error responses are small JSON with errcode — detect and report.