download sys_attachment by public

Good Morning Guys!

At the moment, i make a Widget and this is on a public site (no authication).

In this Widget i want to make downloading files from sys_attachment.

first of all, i used the url /sys_attchment?sys_id=<SYSID>, but if i am not logged in, i dont can download the file.

After this, i try to make a restapi.. but this doesnt have permission to the sys_attachments...

After this, i try with a base64.. but it doesnt work..

Here is my Code:
Server Script:

(function() {

    data.attachments = [];

    var recordSysId = 'd3b1461f1b345550d9d142e6bb4bcb14';

    var gr = new GlideRecord('sys_attachment');

    gr.addQuery('table_sys_id', recordSysId);

    gr.orderByDesc('sys_created_on');

    gr.query();

    var sa = new GlideSysAttachment();

    while (gr.next()) {

        var bytes = sa.getBytes(gr);   // Datei holen

        var base64 = GlideStringUtil.base64Encode(bytes);

        data.attachments.push({

            name: gr.file_name + '',

            sys_id: gr.sys_id + '',

            base64: base64

        });

    }

})();

Client Controller:

api.controller = function() {

    var c = this;

    c.attachments = c.data.attachments || [];

   $scope.download = function(att) {

        var byteChars = atob(att.base64);

        var byteNumbers = new Array(byteChars.length);

        for (var i = 0; i < byteChars.length; i++) {

            byteNumbers[i] = byteChars.charCodeAt(i);

        }

        var byteArray = new Uint8Array(byteNumbers);

        var blob = new Blob([byteArray], { type: att.mime });

        var url = URL.createObjectURL(blob);

        var a = document.createElement('a');

        a.href = url;

        a.download = att.name;

        a.click();

        URL.revokeObjectURL(url);

    };

};

on the site, i can see the files,

 

But, i doesn't can download it..

 

There any Ideas? i prefer a easy workaround.
Thanks and regards