Bound native media preview capabilities and source range reads

apps/desktop/tests/media-access.test.mjs

@@ -0,0 +1,20 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { nativePreviewToken } from "../src/media-access.ts";
+
+test("native preview accepts only opaque grants, never paths or destinations", () => {
+  const token = "a123456789abcdef0123456789abcdef";
+  assert.equal(nativePreviewToken(token), token);
+  for (const value of [
+    "C:/Users/karl/photo.jpg",
+    "/home/user/video.mp4",
+    "https://example.com/media",
+    "../" + token,
+    token + "?file=secret",
+    "%2f" + token,
+    "",
+    token.toUpperCase(),
+  ]) {
+    assert.throws(() => nativePreviewToken(value), /preview access/);
+  }
+});

apps/desktop/tests/media-display.test.mjs

@@ -6,10 +6,23 @@ import {
   sourceLabel,
   matchLabel,
   PreviewRevision,
+  previewSelectionKey,
 } from "../src/media-display.ts";
 import { LatestLane } from "../src/search-state.ts";
 const settle = () => new Promise((resolve) => setImmediate(resolve));
 
+test("indexed content refresh invalidates a decoded preview at the same path", () => {
+  const revision = new PreviewRevision();
+  const source = { kind: "timestamp_ms", number: 1200 };
+  const first = revision.select(previewSelectionKey("recording.mp4", source, 1));
+  const repeated = revision.select(previewSelectionKey("recording.mp4", source, 1));
+  assert.equal(repeated.changed, false);
+  const refreshed = revision.select(previewSelectionKey("recording.mp4", source, 2));
+  assert.equal(refreshed.changed, true);
+  assert.equal(revision.accepts(first.revision), false);
+  assert.equal(revision.accepts(refreshed.revision), true);
+});
+
 test("millisecond seeks preserve fractions and readable minute labels", () => {
   assert.equal(timestampLabel(125450), "2:05");
   assert.equal(timestampLabel(3600000), "60:00");