feat(hosted): wire the shell export button to the node export endpoint (#4562)

Author: sanity

crates/core/src/server/path_handlers.rs

@@ -2503,6 +2503,12 @@ mod tests {
             "access-key backup/restore controls missing"
         );
         assert!(hosted.contains("Export data"), "export control missing");
+        // The export button must be wired to the node export endpoint, not a
+        // placeholder. Pin the route so a refactor cannot silently revert it.
+        assert!(
+            hosted.contains("/v1/hosted/export"),
+            "export button is not wired to the export endpoint"
+        );
         // The access key is read from the shell-only token global; it is never
         // injected into the sandboxed iframe.
         assert!(

crates/core/src/server/path_handlers/assets/hosted_bar.js

@@ -54,8 +54,36 @@
     }
   });
   document.getElementById('fnexport').addEventListener('click', function () {
-    alert(
-      'Export your delegate data to your own Freenet peer.\n\nThis downloads an encrypted bundle you can import on your own node with: freenet secrets import\n\n(Coming soon.)',
-    );
+    var t =
+      typeof __freenet_user_token !== 'undefined' ? __freenet_user_token : null;
+    if (!t) {
+      setOk('No key on this connection');
+      return;
+    }
+    setOk('Preparing download...');
+    // Read the token from the shell-only global and send it in the header the
+    // export endpoint requires (never a query param, so it stays out of logs).
+    // fetch->blob->download because a plain navigation cannot set the header.
+    fetch('/v1/hosted/export', { headers: { 'X-Freenet-User-Token': t } })
+      .then(function (r) {
+        if (!r.ok) {
+          throw new Error('HTTP ' + r.status);
+        }
+        return r.blob();
+      })
+      .then(function (blob) {
+        var url = URL.createObjectURL(blob);
+        var a = document.createElement('a');
+        a.href = url;
+        a.download = 'freenet-data.fnsx';
+        document.body.appendChild(a);
+        a.click();
+        a.remove();
+        URL.revokeObjectURL(url);
+        setOk('Downloaded freenet-data.fnsx');
+      })
+      .catch(function (e) {
+        setOk('Export failed (' + e.message + ')');
+      });
   });
 })();