fix: desktop — commandes Tauri bloquées par l'ACL et crash heap à l'ouverture (BUG-104, BUG-105)

desktop/src/jumplist.rs

@@ -10,48 +10,23 @@ use log::{info, warn};
 
 #[cfg(target_os = "windows")]
 mod imp {
-    use super::*;
-    use std::os::windows::ffi::OsStrExt;
-    use windows::core::{Interface, HSTRING, PCWSTR};
-    use windows::Win32::Foundation::PROPERTYKEY;
-    use windows::Win32::System::Com::{
-        CoCreateInstance, CoInitializeEx, CLSCTX_INPROC_SERVER, COINIT_APARTMENTTHREADED,
-    };
-    use windows::Win32::System::Com::StructuredStorage::PROPVARIANT;
-    use windows::Win32::System::Variant::VT_LPWSTR;
-    use windows::Win32::UI::Shell::{
-        ICustomDestinationList, IShellLinkW, SetCurrentProcessExplicitAppUserModelID,
-        DestinationList, EnumerableObjectCollection, ShellLink,
-    };
-    use windows::Win32::UI::Shell::Common::IObjectCollection;
-    use windows::Win32::UI::Shell::PropertiesSystem::IPropertyStore;
+use super::*;
+use std::os::windows::ffi::OsStrExt;
+use windows::core::{Interface, HSTRING, PCWSTR};
+use windows::Win32::System::Com::{
+    CoCreateInstance, CoInitializeEx, CLSCTX_INPROC_SERVER, COINIT_APARTMENTTHREADED,
+};
+use windows::Win32::UI::Shell::{
+    ICustomDestinationList, IShellLinkW, SetCurrentProcessExplicitAppUserModelID,
+    DestinationList, EnumerableObjectCollection, ShellLink,
+};
+use windows::Win32::UI::Shell::Common::IObjectCollection;
 
-    const APP_ID: &str = "com.obsigate.desktop";
+const APP_ID: &str = "com.obsigate.desktop";
 
-    // PKEY_Title (System.Title): {F29F85E0-4FF9-1068-AB91-08002B27B3D9}, pid 2
-    const PKEY_TITLE: PROPERTYKEY = PROPERTYKEY {
-        fmtid: windows::core::GUID::from_u128(0xF29F85E0_4FF9_1068_AB91_08002B27B3D9),
-        pid: 2,
-    };
-
-    fn wide_null_terminated(s: &str) -> Vec<u16> {
-        std::ffi::OsStr::new(s).encode_wide().chain(std::iter::once(0)).collect()
-    }
-
-    /// Set the jump-list display title via the shell link's property store.
-    fn set_link_title(link: &IShellLinkW, title: &str) -> windows::core::Result<()> {
-        let store: IPropertyStore = link.cast()?;
-        let mut wide = wide_null_terminated(title);
-        let mut pv: PROPVARIANT = unsafe { std::mem::zeroed() };
-        unsafe {
-            let inner = &mut *pv.Anonymous.Anonymous;
-            inner.vt = VT_LPWSTR;
-            inner.Anonymous.pwszVal = windows::core::PWSTR(wide.as_mut_ptr());
-            store.SetValue(&PKEY_TITLE, &pv)?;
-            store.Commit()?;
-        }
-        Ok(())
-    }
+fn wide_null_terminated(s: &str) -> Vec<u16> {
+    std::ffi::OsStr::new(s).encode_wide().chain(std::iter::once(0)).collect()
+}
 
     /// Build one shell link for a vault. `arg` is the command-line argument the
     /// app expects to open that vault (see file associations / single-instance).
@@ -70,9 +45,10 @@ mod imp {
             }
             link.SetDescription(&HSTRING::from(name))?;
         }
-        // Title (display name) is best-effort — a missing title only means the
-        // jump-list entry falls back to the executable name.
-        let _ = set_link_title(&link, name);
+        // Title (display name): the raw PROPVARIANT setter that used to live
+        // here corrupted the process heap (STATUS_HEAP_CORRUPTION c0000374 —
+        // the shell property store freed our Rust-allocated VT_LPWSTR buffer).
+        // SetDescription below already gives jump-list entries their label.
         Ok(link)
     }
 

desktop/src/main.rs

@@ -1122,4 +1122,65 @@ mod tests {
         let dbg = format!("{:?}", d);
         assert!(dbg.contains("x"));
     }
+
+    /// Guardrail ACL : toute commande Tauri invoquée par le frontend doit
+    /// figurer dans desktop/permissions/commands.toml. La page servie par le
+    /// backend (http://127.0.0.1) est une origine *remote* pour Tauri v2 :
+    /// sans cette entrée, la commande est rejetée « not allowed by ACL » et
+    /// desktop.js:invoke() avale l'erreur → bouton silencieusement mort
+    /// (bouton « Choisir mon dossier » du wizard, BUG-104).
+    #[test]
+    fn test_frontend_invokes_are_acl_allowed() {
+        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+        let perms = fs::read_to_string(dir.join("permissions/commands.toml"))
+            .expect("desktop/permissions/commands.toml manquant");
+        let main_src = fs::read_to_string(dir.join("src/main.rs")).unwrap();
+
+        // Commandes déclarées dans le manifeste de permissions.
+        let allow_list = perms
+            .split("commands.allow")
+            .nth(1)
+            .and_then(|s| s.split(']').next())
+            .unwrap_or("");
+        let allowed: Vec<String> = allow_list
+            .split('"')
+            .skip(1)
+            .step_by(2)
+            .map(|s| s.to_string())
+            .collect();
+        assert!(!allowed.is_empty(), "commands.allow vide dans commands.toml");
+
+        // Chaque permission doit correspondre à une commande réellement
+        // enregistrée (faute de frappe → permission morte).
+        for cmd in &allowed {
+            assert!(
+                main_src.contains(&format!("fn {cmd}(")),
+                "permission allow pour la commande inconnue {cmd}"
+            );
+        }
+
+        // Toute commande invoke('…') du frontend doit être autorisée.
+        let js_dir = dir.join("../frontend/js");
+        let mut seen = 0usize;
+        for entry in fs::read_dir(&js_dir).unwrap() {
+            let path = entry.unwrap().path();
+            if path.extension().and_then(|e| e.to_str()) != Some("js") { continue; }
+            let src = fs::read_to_string(&path).unwrap();
+            let mut rest = src.as_str();
+            while let Some(pos) = rest.find("invoke('") {
+                rest = &rest[pos + "invoke('".len()..];
+                let name: String = rest.chars().take_while(|c| c.is_ascii_alphanumeric() || *c == '_').collect();
+                if !name.is_empty() {
+                    seen += 1;
+                    assert!(
+                        allowed.contains(&name),
+                        "commande {name} invoquée par {} absente de permissions/commands.toml",
+                        path.file_name().unwrap().to_string_lossy()
+                    );
+                }
+                rest = &rest[rest.find('\'').map(|i| i + 1).unwrap_or(rest.len())..];
+            }
+        }
+        assert!(seen > 0, "aucun invoke('…') trouvé dans frontend/js");
+    }
 }