Always make a copy of a file.

If decryption is not required, copy the file anyway so the logic
around removing the "decrypted" version of the file can still exist.

This allows us to serve the "undecrypted" file back to the client even
if we're secure-deleting the "decrypted" file here.

I believe this fixes #30

src/reporting.js

@@ -258,11 +258,10 @@ async function generateReport(console, httpUrl, matrixFile, filePath, tempDir, s
         return reportCache[reportHash];
     }
 
-    // By default, the file is considered decrypted
-    let decryptedFilePath = filePath;
+    // Always make a decryptedFile on disk
+    let decryptedFilePath = path.join(tempDir, 'unsafeDownloadedDecryptedFile');
 
     if (matrixFile && matrixFile.key) {
-        decryptedFilePath = path.join(tempDir, 'unsafeDownloadedDecryptedFile');
         console.info(`Decrypting ${filePath}, writing to ${decryptedFilePath}`);
 
         try {
@@ -271,6 +270,13 @@ async function generateReport(console, httpUrl, matrixFile, filePath, tempDir, s
             console.error(err);
             throw new ClientError(400, 'Failed to decrypt file', 'MCS_MEDIA_FAILED_TO_DECRYPT');
         }
+    } else {
+        try {
+            fs.copyFileSync(filePath, decryptedFilePath);
+        } catch (err) {
+            console.error(err);
+            throw new ClientError(400, 'Failed to copy file for decryption', 'MCS_MEDIA_FAILED_TO_DECRYPT');
+        }
     }
 
     const cmd = script + ' ' + decryptedFilePath;