From 5ce31821c2444015de15ca381854aa2624f88831 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 14:36:57 +0400
Subject: [PATCH 1/9] DP-45698

---
 .../MassMediaDownloadController.php           | 78 ++++++++++++-------
 .../src/ExistingSite/MediaDownloadTest.php    | 10 ++-
 2 files changed, 55 insertions(+), 33 deletions(-)

diff --git a/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php b/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
index 083cf313ae..3a6ae9a620 100644
--- a/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
+++ b/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
@@ -3,12 +3,14 @@
 namespace Drupal\mass_media\Controller;
 
 use Drupal\Core\Controller\ControllerBase;
-use Drupal\Core\Render\RenderContext;
-use Drupal\Core\Render\Renderer;
-use Drupal\Core\Routing\TrustedRedirectResponse;
+use Drupal\Core\StreamWrapper\StreamWrapperManagerInterface;
 use Drupal\media\MediaInterface;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -17,25 +19,25 @@
 class MassMediaDownloadController extends ControllerBase {
 
   /**
-   * Renderer service object.
+   * Request stack.
    *
-   * @var \Drupal\Core\Render\Renderer
+   * @var \Symfony\Component\HttpFoundation\RequestStack
    */
-  private $renderer;
+  private $requestStack;
 
   /**
-   * Request stack.
+   * The stream wrapper manager.
    *
-   * @var \Symfony\Component\HttpFoundation\RequestStack
+   * @var \Drupal\Core\StreamWrapper\StreamWrapperManagerInterface
    */
-  private $requestStack;
+  private StreamWrapperManagerInterface $streamWrapperManager;
 
   /**
    * {@inheritdoc}
    */
-  public function __construct(RequestStack $request_stack, Renderer $renderer) {
+  public function __construct(RequestStack $request_stack, StreamWrapperManagerInterface $stream_wrapper_manager) {
     $this->requestStack = $request_stack;
-    $this->renderer = $renderer;
+    $this->streamWrapperManager = $stream_wrapper_manager;
   }
 
   /**
@@ -44,7 +46,7 @@ public function __construct(RequestStack $request_stack, Renderer $renderer) {
   public static function create(ContainerInterface $container) {
     return new static(
       $container->get('request_stack'),
-      $container->get('renderer')
+      $container->get('stream_wrapper_manager')
     );
   }
 
@@ -54,8 +56,8 @@ public static function create(ContainerInterface $container) {
    * @param \Drupal\media\MediaInterface $media
    *   A valid media object.
    *
-   * @return \Drupal\Core\Routing\TrustedRedirectResponse
-   *   TrustedRedirectResponse object.
+   * @return \Drupal\mass_media\Response\CacheableBinaryFileResponse
+   *   File response that supports Drupal cache metadata.
    *
    * @throws \Exception
    * @throws NotFoundHttpException
@@ -71,8 +73,10 @@ public function download(MediaInterface $media) {
       throw new \Exception("No source field configured for the {$bundle} media type.");
     }
 
+    $request_query = $this->requestStack->getCurrentRequest()->query;
+
     // If a delta was provided, use that.
-    $delta = $this->requestStack->getCurrentRequest()->query->get('delta');
+    $delta = $request_query->get('delta');
 
     // Get the ID of the requested file by its field delta.
     if (is_numeric($delta)) {
@@ -102,23 +106,37 @@ public function download(MediaInterface $media) {
     }
 
     $uri = $file->getFileUri();
+    $scheme = $this->streamWrapperManager->getScheme($uri);
 
-    // Catches stray metadata not handled properly by file_create_url().
-    // @see https://www.drupal.org/project/drupal/issues/2867355
-    $context = new RenderContext();
-    $uri = $this->renderer->executeInRenderContext($context, function () use ($uri) {
-      return \Drupal::service('file_url_generator')->generateAbsoluteString($uri);
-    });
-
-    // Returns a 301 Moved Permanently redirect response.
-    $response = new TrustedRedirectResponse($uri, 301);
-    // Adds cache metadata.
-    $response->getCacheableMetadata()->addCacheContexts(['url.site']);
-    $response->addCacheableDependency($media);
-    $response->addCacheableDependency($file);
-    if (!$context->isEmpty()) {
-      $response->addCacheableDependency($context->pop());
+    // Or item does not exist on disk.
+    if (!$this->streamWrapperManager->isValidScheme($scheme) || !file_exists($uri)) {
+      throw new NotFoundHttpException("The file {$uri} does not exist.");
+    }
+
+    // Let other modules provide headers and controls access to the file.
+    $headers = $this->moduleHandler()->invokeAll('file_download', [$uri]);
+    foreach ($headers as $result) {
+      if ($result == -1) {
+        throw new AccessDeniedHttpException();
+      }
     }
+
+    $response = new BinaryFileResponse($uri, Response::HTTP_OK, $headers, $scheme !== 'private');
+
+    if (empty($headers['Content-Disposition'])) {
+      if ($request_query->has(ResponseHeaderBag::DISPOSITION_INLINE)) {
+        $disposition = ResponseHeaderBag::DISPOSITION_INLINE;
+      }
+      else {
+        $disposition = ResponseHeaderBag::DISPOSITION_ATTACHMENT;
+      }
+      $response->setContentDisposition($disposition, $file->getFilename());
+    }
+
+    if (!$response->headers->has('Content-Type')) {
+      $response->headers->set('Content-Type', $file->getMimeType() ?: 'application/octet-stream');
+    }
+
     return $response;
   }
 
diff --git a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
index f558dffd03..b596dc5811 100644
--- a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
+++ b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
@@ -17,7 +17,7 @@ class MediaDownloadTest extends MassExistingSiteBase {
   use MediaCreationTrait;
 
   /**
-   * Ensure that a request to media/$ID/download redirects to the file.
+   * Ensure that a request to media/$ID/download serves the file.
    */
   public function testMediaDownload() {
     // Create a file to upload.
@@ -45,8 +45,12 @@ public function testMediaDownload() {
     ]);
 
     $this->visit($media->toUrl()->toString() . '/download');
-    $this->assertEquals(\Drupal::service('file_url_generator')->generateAbsoluteString($file->getFileUri()), $this->getSession()->getCurrentUrl());
-    $this->assertEquals('text/plain', $this->getSession()->getResponseHeader('Content-Type'), 'url.site cache context is added to the response.');
+    $expected_path = $media->toUrl()->toString() . '/download';
+    $this->assertStringContainsString($expected_path, $this->getSession()->getCurrentUrl());
+
+    $content_type = $this->getSession()->getResponseHeader('Content-Type');
+    $this->assertNotEmpty($content_type);
+    $this->assertStringContainsString('text/plain', $content_type);
   }
 
 }

From 87be126461c8928500c574282a4a0c026a726f87 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 14:38:33 +0400
Subject: [PATCH 2/9] DP-45698

---
 composer.json |  1 +
 composer.lock | 47 ++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 12d6d45cad..6dedc4da45 100644
--- a/composer.json
+++ b/composer.json
@@ -221,6 +221,7 @@
         "drupal/m4032404": "^2.0",
         "drupal/mailchimp_transactional": "^1",
         "drupal/maxlength": "^2",
+        "drupal/media_alias_display": "^2.1",
         "drupal/media_entity_download": "^2.4",
         "drupal/memcache": "^2",
         "drupal/metatag": "^1",
diff --git a/composer.lock b/composer.lock
index 601f504466..14f934734c 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "3f791d1dfd24854dc206a86423d9fdcd",
+    "content-hash": "f2402926570f53c193435f1faab2d821",
     "packages": [
         {
             "name": "akamai-open/edgegrid-auth",
@@ -8245,6 +8245,51 @@
                 "issues": "https://www.drupal.org/project/issues/maxlength"
             }
         },
+        {
+            "name": "drupal/media_alias_display",
+            "version": "2.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://git.drupalcode.org/project/media_alias_display.git",
+                "reference": "2.1.1"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://ftp.drupal.org/files/projects/media_alias_display-2.1.1.zip",
+                "reference": "2.1.1",
+                "shasum": "49a027c8e7e8373e6c3125e0072edd9ec7e9996a"
+            },
+            "require": {
+                "drupal/core": "^10.3 || ^11"
+            },
+            "type": "drupal-module",
+            "extra": {
+                "drupal": {
+                    "version": "2.1.1",
+                    "datestamp": "1746041397",
+                    "security-coverage": {
+                        "status": "covered",
+                        "message": "Covered by Drupal's security advisory policy"
+                    }
+                }
+            },
+            "notification-url": "https://packages.drupal.org/8/downloads",
+            "license": [
+                "GPL-2.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Stephen Mustgrave",
+                    "homepage": "https://www.drupal.org/user/3252890",
+                    "email": "smustgrave@gmail.com"
+                }
+            ],
+            "description": "Display file in the browser with the URL alias vs file path.",
+            "homepage": "https://www.drupal.org/project/media_alias_display",
+            "support": {
+                "source": "https://git.drupalcode.org/project/media_alias_display"
+            }
+        },
         {
             "name": "drupal/media_entity_download",
             "version": "2.4.0",

From 482a0ae7fc31896217835e1c6f97de100582a711 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 14:47:51 +0400
Subject: [PATCH 3/9] DP-45698

---
 .../MassMediaDownloadController.php           | 68 +++++++++++++++++--
 1 file changed, 64 insertions(+), 4 deletions(-)

diff --git a/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php b/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
index 3a6ae9a620..cb31abf9ac 100644
--- a/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
+++ b/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
@@ -3,8 +3,11 @@
 namespace Drupal\mass_media\Controller;
 
 use Drupal\Core\Controller\ControllerBase;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\File\FileSystemInterface;
 use Drupal\Core\StreamWrapper\StreamWrapperManagerInterface;
 use Drupal\media\MediaInterface;
+use Drupal\stage_file_proxy\DownloadManagerInterface;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
@@ -32,12 +35,35 @@ class MassMediaDownloadController extends ControllerBase {
    */
   private StreamWrapperManagerInterface $streamWrapperManager;
 
+  /**
+   * Drupal filesystem service.
+   *
+   * @var \Drupal\Core\File\FileSystemInterface
+   */
+  private FileSystemInterface $fileSystem;
+
+  /**
+   * Stage File Proxy download manager.
+   *
+   * @var \Drupal\stage_file_proxy\DownloadManagerInterface
+   */
+  private DownloadManagerInterface $stageFileProxyDownloadManager;
+
   /**
    * {@inheritdoc}
    */
-  public function __construct(RequestStack $request_stack, StreamWrapperManagerInterface $stream_wrapper_manager) {
+  public function __construct(
+    RequestStack $request_stack,
+    StreamWrapperManagerInterface $stream_wrapper_manager,
+    FileSystemInterface $file_system,
+    DownloadManagerInterface $stage_file_proxy_download_manager,
+    ConfigFactoryInterface $config_factory,
+  ) {
     $this->requestStack = $request_stack;
     $this->streamWrapperManager = $stream_wrapper_manager;
+    $this->fileSystem = $file_system;
+    $this->stageFileProxyDownloadManager = $stage_file_proxy_download_manager;
+    $this->configFactory = $config_factory;
   }
 
   /**
@@ -46,7 +72,10 @@ public function __construct(RequestStack $request_stack, StreamWrapperManagerInt
   public static function create(ContainerInterface $container) {
     return new static(
       $container->get('request_stack'),
-      $container->get('stream_wrapper_manager')
+      $container->get('stream_wrapper_manager'),
+      $container->get('file_system'),
+      $container->get('stage_file_proxy.download_manager'),
+      $container->get('config.factory')
     );
   }
 
@@ -108,8 +137,39 @@ public function download(MediaInterface $media) {
     $uri = $file->getFileUri();
     $scheme = $this->streamWrapperManager->getScheme($uri);
 
-    // Or item does not exist on disk.
-    if (!$this->streamWrapperManager->isValidScheme($scheme) || !file_exists($uri)) {
+    // If the file doesn't exist locally on non-production environments,
+    // try fetching it from the configured Stage File Proxy origin.
+    if (!$this->streamWrapperManager->isValidScheme($scheme)) {
+      throw new NotFoundHttpException("The file {$uri} does not exist.");
+    }
+
+    if (!file_exists($uri)) {
+      // Stage File Proxy is intended for public assets; private files should
+      // remain non-public and must not be fetched from origin.
+      if ($scheme === 'public') {
+        $stageConfig = $this->configFactory->get('stage_file_proxy.settings');
+        $origin = (string) $stageConfig->get('origin');
+        $originHost = (string) parse_url($origin, PHP_URL_HOST);
+        $requestHost = $this->requestStack->getCurrentRequest()->getHost();
+
+        // Only fetch when we are not on mass.gov production host.
+        if (!empty($originHost) && strcasecmp($requestHost, $originHost) !== 0) {
+          $originDir = trim((string) ($stageConfig->get('origin_dir') ?? 'files'));
+          $relativePath = str_replace('public://', '', $uri);
+          $options = ['verify' => (bool) $stageConfig->get('verify')];
+
+          $this->stageFileProxyDownloadManager->fetch(
+            $origin,
+            $originDir,
+            $relativePath,
+            $options
+          );
+        }
+      }
+    }
+
+    // Still missing on disk: return 404.
+    if (!file_exists($uri)) {
       throw new NotFoundHttpException("The file {$uri} does not exist.");
     }
 

From 77ff8749847a68d97cc0220b2f53e3fedda11998 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 14:56:51 +0400
Subject: [PATCH 4/9] DP-45698

---
 .../MassMediaDownloadController.php           |  4 +-
 .../src/ExistingSite/MediaDownloadTest.php    | 55 +++++++++++++++++++
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php b/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
index cb31abf9ac..2d98ef22cf 100644
--- a/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
+++ b/docroot/modules/custom/mass_media/src/Controller/MassMediaDownloadController.php
@@ -85,8 +85,8 @@ public static function create(ContainerInterface $container) {
    * @param \Drupal\media\MediaInterface $media
    *   A valid media object.
    *
-   * @return \Drupal\mass_media\Response\CacheableBinaryFileResponse
-   *   File response that supports Drupal cache metadata.
+   * @return \Symfony\Component\HttpFoundation\BinaryFileResponse
+   *   File response that serves the media bytes directly.
    *
    * @throws \Exception
    * @throws NotFoundHttpException
diff --git a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
index b596dc5811..532856a022 100644
--- a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
+++ b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
@@ -53,4 +53,59 @@ public function testMediaDownload() {
     $this->assertStringContainsString('text/plain', $content_type);
   }
 
+  /**
+   * If the underlying media file is replaced, /download should serve
+   * the new bytes (not a stale cached response).
+   */
+  public function testMediaDownloadServesUpdatedFileAfterReplacement() {
+    // v1 file.
+    $destination1 = 'public://llama-download-v1.txt';
+    file_put_contents($destination1, 'Version 1');
+    $file1 = File::create([
+      'uri' => $destination1,
+    ]);
+    $file1->setPermanent();
+    $file1->save();
+
+    // v2 file.
+    $destination2 = 'public://llama-download-v2.txt';
+    file_put_contents($destination2, 'Version 2');
+    $file2 = File::create([
+      'uri' => $destination2,
+    ]);
+    $file2->setPermanent();
+    $file2->save();
+
+    // Create a published document media entity pointing to v1.
+    $media = $this->createMedia([
+      'title' => 'Llama Download Cache',
+      'bundle' => 'document',
+      'field_upload_file' => [
+        'target_id' => $file1->id(),
+      ],
+      'status' => 1,
+      'moderation_state' => MassModeration::PUBLISHED,
+    ]);
+
+    $download_path = ltrim($media->toUrl()->toString() . '/download', '/');
+
+    // First request should return v1 bytes.
+    $content_v1 = $this->drupalGet($download_path);
+    $this->assertStringContainsString('Version 1', $content_v1);
+
+    // Replace the file reference and create a new revision while staying
+    // published. The controller should serve the new file bytes and Drupal
+    // cache should not keep serving the old response body.
+    $media->set('field_upload_file', [
+      'target_id' => $file2->id(),
+    ]);
+    $media->setNewRevision();
+    $media->set('moderation_state', MassModeration::PUBLISHED);
+    $media->save();
+
+    $content_v2 = $this->drupalGet($download_path);
+    $this->assertStringContainsString('Version 2', $content_v2);
+    $this->assertStringNotContainsString('Version 1', $content_v2);
+  }
+
 }

From 810c8ca71416e04560e903bc9cac72a1146b67a4 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 15:07:04 +0400
Subject: [PATCH 5/9] DP-45698

---
 .../mass_media/tests/src/ExistingSite/MediaDownloadTest.php     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
index 532856a022..a82c711e2d 100644
--- a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
+++ b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
@@ -54,6 +54,8 @@ public function testMediaDownload() {
   }
 
   /**
+   * Test file replacement.
+   *
    * If the underlying media file is replaced, /download should serve
    * the new bytes (not a stale cached response).
    */

From 04f00756f81b7fb2c48922dbd95d6bd3e5fedf47 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 15:07:50 +0400
Subject: [PATCH 6/9] DP-45698

---
 changelogs/DP-45698.yml | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 changelogs/DP-45698.yml

diff --git a/changelogs/DP-45698.yml b/changelogs/DP-45698.yml
new file mode 100644
index 0000000000..fb53dc71cb
--- /dev/null
+++ b/changelogs/DP-45698.yml
@@ -0,0 +1,41 @@
+#
+# Write your changelog entry here. Every pull request must have a changelog yml file.
+#
+# Change types:
+# #############################################################################
+# You can use one of the following types:
+#  - Added: For new features.
+#  - Changed: For changes to existing functionality.
+#  - Deprecated: For soon-to-be removed features.
+#  - Removed: For removed features.
+#  - Fixed: For any bug fixes.
+#  - Security: In case of vulnerabilities.
+#
+# Format
+# #############################################################################
+# The format is crucial. Please follow the examples below. For reference, the requirements are:
+#  - All 3 parts are required and you must include "Type", "description" and "issue".
+#  - "Type" must be left aligned and followed by a colon.
+#  - "description" must be indented with 2 spaces followed by a colon
+#  - "issue" must be indented with 4 spaces followed by a colon.
+#  - "issue" is for the Jira ticket number only e.g. DP-1234
+#  - No extra spaces, indents, or blank lines are allowed.
+#
+# Example:
+# #############################################################################
+# Fixed:
+#  - description: Fixes scrolling on edit pages in Safari.
+#    issue: DP-13314
+#
+# You may add more than 1 description & issue for each type using the following format:
+# Changed:
+#  - description: Automating the release branch.
+#    issue: DP-10166
+#  - description: Second change item that needs a description.
+#    issue: DP-19875
+#  - description: Third change item that needs a description along with an issue.
+#    issue: DP-19843
+#
+Changed:
+  - description: Serve media download links as binary instead of redirect.
+    issue: DP-45698

From 498b35678a7ecda1a007700d88174265c4390362 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Wed, 25 Mar 2026 16:17:34 +0400
Subject: [PATCH 7/9] DP-45698

---
 .../src/ExistingSite/MediaDownloadTest.php    | 76 +++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
index a82c711e2d..cd5f10f8b6 100644
--- a/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
+++ b/docroot/modules/custom/mass_media/tests/src/ExistingSite/MediaDownloadTest.php
@@ -110,4 +110,80 @@ public function testMediaDownloadServesUpdatedFileAfterReplacement() {
     $this->assertStringNotContainsString('Version 1', $content_v2);
   }
 
+  /**
+   * Unpublished documents move their file to private storage.
+   *
+   * Anonymous users must not be able to download those bytes.
+   */
+  public function testMediaDownloadPrivateFileDeniedForUnpublishedDocument(): void {
+    $destination = 'public://llama-download-private-unpublished.txt';
+    file_put_contents($destination, 'UNPUBLISHED PRIVATE BYTES');
+    $file = File::create([
+      'uri' => $destination,
+    ]);
+    $file->setPermanent();
+    $file->save();
+
+    // Create an unpublished document; mass_media_presave should move the
+    // uploaded file to private://.
+    $media = $this->createMedia([
+      'title' => 'Unpublished document download',
+      'bundle' => 'document',
+      'field_upload_file' => [
+        'target_id' => $file->id(),
+      ],
+      'status' => 0,
+      'moderation_state' => 'unpublished',
+    ]);
+
+    $unpublished_file = File::load($media->field_upload_file->target_id);
+    $this->assertNotNull($unpublished_file);
+    $this->assertEquals('private', \Drupal\Core\StreamWrapper\StreamWrapperManager::getScheme($unpublished_file->getFileUri()));
+
+    $this->visit($media->toUrl()->toString() . '/download');
+
+    $this->assertNotEquals(200, $this->getSession()->getStatusCode());
+    $this->assertStringNotContainsString('UNPUBLISHED PRIVATE BYTES', $this->getSession()->getPage()->getContent());
+  }
+
+  /**
+   * Restricted documents should be viewable only by their owner.
+   *
+   * Anonymous users must not be able to download private files for those
+   * documents.
+   */
+  public function testMediaDownloadPrivateFileDeniedForRestrictedDocument(): void {
+    // Login as author so we can create a restricted media owned by them.
+    $admin = $this->createUser();
+    $admin->addRole('administrator');
+    $admin->activate();
+    $admin->save();
+    $this->drupalLogin($admin);
+
+    $destination = 'private://llama-download-private-restricted.txt';
+    file_put_contents($destination, 'RESTRICTED PRIVATE BYTES');
+    $file = File::create([
+      'uri' => $destination,
+    ]);
+    $file->setPermanent();
+    $file->save();
+
+    $media = $this->createMedia([
+      'title' => 'Restricted document download',
+      'bundle' => 'document',
+      'field_upload_file' => [
+        'target_id' => $file->id(),
+      ],
+      'status' => 1,
+      'moderation_state' => 'restricted',
+    ]);
+
+    $this->drupalLogout();
+
+    $this->visit($media->toUrl()->toString() . '/download');
+
+    $this->assertNotEquals(200, $this->getSession()->getStatusCode());
+    $this->assertStringNotContainsString('RESTRICTED PRIVATE BYTES', $this->getSession()->getPage()->getContent());
+  }
+
 }

From 01a7942c66b3c4346b6ac5d091b92ebd6615708b Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Thu, 26 Mar 2026 13:59:17 +0400
Subject: [PATCH 8/9] DP-45698

---
 composer.json |  1 -
 composer.lock | 47 +----------------------------------------------
 2 files changed, 1 insertion(+), 47 deletions(-)

diff --git a/composer.json b/composer.json
index 6dedc4da45..12d6d45cad 100644
--- a/composer.json
+++ b/composer.json
@@ -221,7 +221,6 @@
         "drupal/m4032404": "^2.0",
         "drupal/mailchimp_transactional": "^1",
         "drupal/maxlength": "^2",
-        "drupal/media_alias_display": "^2.1",
         "drupal/media_entity_download": "^2.4",
         "drupal/memcache": "^2",
         "drupal/metatag": "^1",
diff --git a/composer.lock b/composer.lock
index 14f934734c..601f504466 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "f2402926570f53c193435f1faab2d821",
+    "content-hash": "3f791d1dfd24854dc206a86423d9fdcd",
     "packages": [
         {
             "name": "akamai-open/edgegrid-auth",
@@ -8245,51 +8245,6 @@
                 "issues": "https://www.drupal.org/project/issues/maxlength"
             }
         },
-        {
-            "name": "drupal/media_alias_display",
-            "version": "2.1.1",
-            "source": {
-                "type": "git",
-                "url": "https://git.drupalcode.org/project/media_alias_display.git",
-                "reference": "2.1.1"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://ftp.drupal.org/files/projects/media_alias_display-2.1.1.zip",
-                "reference": "2.1.1",
-                "shasum": "49a027c8e7e8373e6c3125e0072edd9ec7e9996a"
-            },
-            "require": {
-                "drupal/core": "^10.3 || ^11"
-            },
-            "type": "drupal-module",
-            "extra": {
-                "drupal": {
-                    "version": "2.1.1",
-                    "datestamp": "1746041397",
-                    "security-coverage": {
-                        "status": "covered",
-                        "message": "Covered by Drupal's security advisory policy"
-                    }
-                }
-            },
-            "notification-url": "https://packages.drupal.org/8/downloads",
-            "license": [
-                "GPL-2.0-or-later"
-            ],
-            "authors": [
-                {
-                    "name": "Stephen Mustgrave",
-                    "homepage": "https://www.drupal.org/user/3252890",
-                    "email": "smustgrave@gmail.com"
-                }
-            ],
-            "description": "Display file in the browser with the URL alias vs file path.",
-            "homepage": "https://www.drupal.org/project/media_alias_display",
-            "support": {
-                "source": "https://git.drupalcode.org/project/media_alias_display"
-            }
-        },
         {
             "name": "drupal/media_entity_download",
             "version": "2.4.0",

From 5d7f67b01502316ef9f901feb3084b63af4d7ec3 Mon Sep 17 00:00:00 2001
From: Arthur Baghdasaryan <arthur.baghdasar@gmail.com>
Date: Thu, 26 Mar 2026 14:10:32 +0400
Subject: [PATCH 9/9] DP-45698

---
 docroot/robots.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docroot/robots.txt b/docroot/robots.txt
index 77a55b3567..80851a6099 100644
--- a/docroot/robots.txt
+++ b/docroot/robots.txt
@@ -56,6 +56,9 @@ Disallow: /media/*
 Disallow: /taxonomy/term/*
 Disallow: /node/*
 Disallow: /doc/courts-dwnld-*
+# Legacy/raw document file URLs.
+Disallow: /files/documents/
+Disallow: /sites/default/files/documents/
 # Paths (no clean URLs)
 Disallow: /index.php/admin/
 Disallow: /index.php/comment/reply/