CODEX revised with following function: 1. GDS building, 2. different user group with different authority.

tests/gds-download-static.test.js

@@ -0,0 +1,32 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const root = path.resolve(__dirname, '..');
+const serverPy = fs.readFileSync(path.join(root, 'backend', 'server.py'), 'utf8');
+const canvasHtml = fs.readFileSync(path.join(root, 'frontend', 'canvas.html'), 'utf8');
+
+assert(
+  serverPy.includes('EXPORT_ROOT'),
+  'server should build GDS exports into a temporary export root'
+);
+assert(
+  serverPy.includes("@app.route('/api/exports/<export_id>/<filename>'"),
+  'server should expose an authenticated export download route'
+);
+assert(
+  serverPy.includes('download_url'),
+  'Build GDS response should include download_url'
+);
+assert(
+  serverPy.includes('cleanup_expired_exports'),
+  'server should clean exports older than the retention period'
+);
+assert(
+  canvasHtml.includes('download_url'),
+  'frontend should read download_url from Build GDS response'
+);
+assert(
+  canvasHtml.includes('document.createElement') && canvasHtml.includes('.download'),
+  'frontend should trigger a browser download for generated GDS'
+);