Improve handling of backup CDN read credentials

ts/textsecure/WebAPI.ts

@@ -1350,7 +1350,7 @@ export type GetBackupCredentialsResponseType = z.infer<
 
 export type GetBackupCDNCredentialsOptionsType = Readonly<{
   headers: BackupPresentationHeadersType;
-  cdn: number;
+  cdnNumber: number;
 }>;
 
 export const getBackupCDNCredentialsResponseSchema = z.object({
@@ -3645,7 +3645,7 @@ export function initialize({
 
     async function getBackupCDNCredentials({
       headers,
-      cdn,
+      cdnNumber,
     }: GetBackupCDNCredentialsOptionsType) {
       return _ajax({
         host: 'chatService',
@@ -3655,7 +3655,7 @@ export function initialize({
         accessKey: undefined,
         groupSendToken: undefined,
         headers,
-        urlParameters: `?cdn=${cdn}`,
+        urlParameters: `?cdn=${cdnNumber}`,
         responseType: 'json',
         zodSchema: getBackupCDNCredentialsResponseSchema,
       });

ts/textsecure/downloadAttachment.ts

@@ -51,6 +51,7 @@ import { IV_LENGTH, MAC_LENGTH } from '../types/Crypto';
 import { BackupCredentialType } from '../types/backups';
 import { getValue } from '../RemoteConfig';
 import { parseIntOrThrow } from '../util/parseIntOrThrow';
+import { HTTPError } from './Errors';
 
 const log = createLogger('downloadAttachment');
 
@@ -223,17 +224,26 @@ export async function downloadAttachment(
     const backupDir = await backupsService.api.getBackupDir();
     const mediaDir = await backupsService.api.getMediaDir();
 
-    const downloadStream = await server.getAttachmentFromBackupTier({
-      mediaId: mediaId.string,
-      backupDir,
-      mediaDir,
-      headers: cdnCredentials.headers,
-      cdnNumber,
-      options: {
-        ...options,
-        downloadOffset,
-      },
-    });
+    let downloadStream: Readable;
+    try {
+      downloadStream = await server.getAttachmentFromBackupTier({
+        mediaId: mediaId.string,
+        backupDir,
+        mediaDir,
+        headers: cdnCredentials.headers,
+        cdnNumber,
+        options: {
+          ...options,
+          downloadOffset,
+        },
+      });
+    } catch (error) {
+      if (error instanceof HTTPError && error.code === 401) {
+        window.Signal.Services.backups.credentials.onCdnCredentialError();
+      }
+      throw error;
+    }
+
     downloadResult = await downloadToDisk({
       downloadStream,
       downloadPath,