feat: add dedicated watchlist download endpoint

README.md

@@ -172,9 +172,9 @@ Configuration is loaded from environment variables, and a local `.env` file is r
 
 `GET /api/public/users/{user_id}/watchlist` returns a versioned, agent-friendly JSON view of a
 user's complete watchlist. It includes status summaries, episode progress,
-added/completed/last-watched dates, and localized titles. Add `?download=1` to receive the same
-response as a `watchlist-{user_id}.json` attachment; the watchlist page's export action uses this
-URL.
+added/completed/last-watched dates, and localized titles.
+
+`GET /watchlist/export` downloads the current user's watchlist as `watchlist.json`.
 
 This endpoint is intentionally unauthenticated. A deployment that should keep watchlist and
 playback data private must restrict access to `/api/public/` at the network or reverse-proxy layer.

internal/watchlist/handler.go

@@ -24,6 +24,7 @@ func (h *WatchlistHandler) Register(r *gin.Engine) {
 	r.POST("/api/watchlist", h.HandleUpdateWatchlist)
 	r.DELETE("/api/watchlist/:id", h.HandleDeleteWatchlist)
 	r.DELETE("/api/continue-watching/:id", h.HandleDeleteContinueWatching)
+	r.GET("/watchlist/export", h.HandleDownloadWatchlist)
 	r.GET("/api/public/users/:userID/watchlist", h.HandleGetPublicWatchlist)
 	r.GET("/watchlist", h.HandleGetWatchlist)
 }
@@ -142,6 +143,28 @@ func (h *WatchlistHandler) HandleGetWatchlist(c *gin.Context) {
 	})
 }
 
+func (h *WatchlistHandler) HandleDownloadWatchlist(c *gin.Context) {
+	userID := server.CurrentUserID(c)
+
+	entries, err := h.svc.GetWatchlist(c.Request.Context(), userID)
+	if err != nil {
+		server.RespondError(
+			c,
+			http.StatusInternalServerError,
+			"watchlist_load_failed",
+			"watchlist",
+			"failed to load watchlist",
+			map[string]any{"user_id": userID},
+			err,
+		)
+		return
+	}
+
+	c.Header("Cache-Control", "no-store")
+	c.Header("Content-Disposition", `attachment; filename="watchlist.json"`)
+	c.JSON(http.StatusOK, newPublicWatchlist(userID, entries, time.Now().UTC()))
+}
+
 func (h *WatchlistHandler) HandleGetPublicWatchlist(c *gin.Context) {
 	userID := strings.TrimSpace(c.Param("userID"))
 	if userID == "" {

internal/watchlist/handler_test.go

@@ -151,6 +151,31 @@ func TestHandleGetPublicWatchlistReturnsMinimalJSON(t *testing.T) {
 	assertMinimalPublicWatchlistJSON(t, rec.Body.Bytes())
 }
 
+func TestHandleDownloadWatchlistReturnsAttachment(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	addedAt := time.Date(2026, time.June, 1, 12, 30, 0, 0, time.UTC)
+	completedAt := time.Date(2026, time.June, 20, 18, 45, 0, 0, time.UTC)
+	lastWatchedAt := time.Date(2026, time.June, 28, 20, 15, 0, 0, time.UTC)
+	svc := &fakeWatchlistService{watchlist: publicWatchlistRows(addedAt, completedAt, lastWatchedAt)}
+	router := newWatchlistTestRouter(svc)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/watchlist/export", nil)
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if got := rec.Header().Get("Content-Disposition"); got != `attachment; filename="watchlist.json"` {
+		t.Fatalf("Content-Disposition = %q, want watchlist.json attachment", got)
+	}
+	if got := rec.Header().Get("Content-Type"); !strings.HasPrefix(got, "application/json") {
+		t.Fatalf("Content-Type = %q, want application/json", got)
+	}
+	assertMinimalPublicWatchlistJSON(t, rec.Body.Bytes())
+}
+
 func publicWatchlistRows(addedAt time.Time, completedAt time.Time, lastWatchedAt time.Time) []domain.UserWatchListRow {
 	return []domain.UserWatchListRow{
 		{

templates/watchlist.gohtml

@@ -15,7 +15,7 @@
 	    </div>
 
 	    <div class="flex items-center gap-4">
-	      <a href="/api/public/users/{{.User.ID}}/watchlist?download=1" class="text-foreground-muted transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent" title="Export watchlist JSON" aria-label="Export watchlist JSON">
+	      <a href="/watchlist/export" download="watchlist.json" class="text-foreground-muted transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent" title="Export watchlist JSON" aria-label="Export watchlist JSON">
 	        <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
 	            <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/>
 	            <path d="M7 10l5 5 5-5"/>