Bound native media preview capabilities and source range reads

apps/desktop/tests/media-access.test.mjs

@@ -0,0 +1,20 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { nativePreviewToken } from "../src/media-access.ts";
+
+test("native preview accepts only opaque grants, never paths or destinations", () => {
+  const token = "a123456789abcdef0123456789abcdef";
+  assert.equal(nativePreviewToken(token), token);
+  for (const value of [
+    "C:/Users/karl/photo.jpg",
+    "/home/user/video.mp4",
+    "https://example.com/media",
+    "../" + token,
+    token + "?file=secret",
+    "%2f" + token,
+    "",
+    token.toUpperCase(),
+  ]) {
+    assert.throws(() => nativePreviewToken(value), /preview access/);
+  }
+});