Password protected posts offering files for download

I have a business website that uses wordpress and I have a page that’s password protected.

The content of the page (text) is safe. However, I want to have a link here for a file (.pdf) that I want no one else to be able to download unless they have entered the password (to access the passw protected page) and clicked on the link for the file download.

What is the best way of doing this?

Uploading the file to the server, and linking it within the password protected page means whoever gets inside, can just know the full URL of the location of the file on the server (and use that next time directly). I want them to have to login each time to be able to download the pdf file.

Some background on the page: I want everything on this page to be “secret” and accessible by password only. The text is safe because of the password but I need to also make all the files being offered safe as well and only be accessible once the password has been entered. Asides from this password, I have also used a robots file to add noindex, follow data to the page itself to hide it from being indexed.

Thanks.
Chris