修复采购附件同源 XSS（07-17-purchase-attachment-xss-hardening）

client/src/api/purchaseRequests.ts

@@ -1,4 +1,4 @@
-import { apiRequestData } from "./http";
+import { apiRequestBlob, apiRequestData } from "./http";
 import type { AttachmentGovernanceFields } from "../lib/attachmentGovernance";
 import type { PrecheckResponse, RiskFlag } from "./feeControl";
 
@@ -386,11 +386,12 @@ export async function deletePurchaseAttachment(purchaseRequestId: string, attach
   );
 }
 
-export async function issuePurchaseAttachmentSignedUrl(purchaseRequestId: string, attachmentId: string, reason?: string) {
-  return apiRequestData<{ signedUrl: string; expiresAt: string }>(
-    `/api/purchase-requests/${purchaseRequestId}/attachments/${attachmentId}/signed-url`,
+export async function downloadPurchaseAttachment(purchaseRequestId: string, attachmentId: string, reason?: string) {
+  return apiRequestBlob(
+    `/api/purchase-requests/${purchaseRequestId}/attachments/${attachmentId}/download`,
     {
       method: "POST",
+      headers: { "content-type": "application/json" },
       body: JSON.stringify(reason ? { reason } : {}),
     },
   );