Check this simple implementation:

You store the information of the download in a file. The filename is the download session id. The file content is the real path of the file to be downloaded.

Use these three functions to manage the life cycle of the download sessions:

    /* Gets the download file path related to a download sid */
      function getDownloadFilePath(downloadSid, callback) {
    // Get the download session file name
       var dlSessionFileName = path.join(DL_SESSION_FOLDER, downloadSid + 
        '.download');

    // Check if the download session exists
    if (!fs.existsSync(dlSessionFileName)) return callback(new 
    Error('Download does not exist'));

    // Get the file path
    fs.readFile(dlSessionFileName, function(err, data) {
      if (err) return callback(err);

    // Return the file path
     callback(null, data);
    });
   }

   /* Deletes a download session */
    function deleteDownload(downloadSid, callback) {
     // Get the download session file name
    var dlSessionFileName = path.join(DL_SESSION_FOLDER, downloadSid + '.download');

  // Check if the download session exists
  if (!fs.existsSync(dlSessionFileName)) return callback(new Error('Download does not exist'));

  // Delete the download session
  fs.unlink(dlSessionFileName, function(err) {
    if (err) return callback(err);

    // Return success (no error)
    callback();
  });
}

Use createDownload() to create download sessions wherever you need to. It returns the download sid, then you can use it to build your download URL like: http://your.server.com/download?sid=.

Finally you can add a simple handler to your /download route:

app.get('/download', function(req, res, next) {
  // Get the download sid
  var downloadSid = req.query.sid;

  // Get the download file path
  getDownloadFilePath(downloadSid, function(err, path) {
    if (err) return res.end('Error');

    // Read and send the file here...

    // Finally, delete the download session to invalidate the link
    deleteDownload(downloadSid, function(err) {
      // ...
    });
  });
});

With this method, you don't have to create/move/delete big download files, which could cause slow responses and unnecessary resource consumption.