fix: http-lp forwarding - a download the agent finished reading reaches the browser whole; the session closing on its end of stream cut off what was still queued (up to 32 MB), so browsers restarted big downloads

internal/server/forward.go

@@ -129,20 +129,39 @@ func (m *forwardManager) bridgeHTTP(rule ForwardRule, conn net.Conn) {
 		}
 	}()
 
+	// write passes one message on; false: the stream is over.
+	write := func(out proto.OutMessage) bool {
+		if out.Exit {
+			return false
+		}
+		if out.Data != "" {
+			b, err := base64.StdEncoding.DecodeString(out.Data)
+			if err != nil {
+				return false
+			}
+			if _, err := conn.Write(b); err != nil {
+				return false
+			}
+		}
+		return true
+	}
 	for {
 		select {
-		case <-sess.Done():
-			return
 		case out, ok := <-sess.Out():
-			if !ok || out.Exit {
+			if !ok || !write(out) {
 				return
 			}
-			if out.Data != "" {
-				b, err := base64.StdEncoding.DecodeString(out.Data)
-				if err != nil {
-					return
-				}
-				if _, err := conn.Write(b); err != nil {
+		case <-sess.Done():
+			// The agent's end of stream closes the session at once, while
+			// what it sent before may still be queued (a download read
+			// faster than the browser takes it): that goes out first.
+			for {
+				select {
+				case out := <-sess.Out():
+					if !write(out) {
+						return
+					}
+				default:
 					return
 				}
 			}