wallpaper-engine-dsh 1.0.0 → 1.0.3

package/lib/core.js

@@ -17,7 +17,7 @@
 
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, resolve, normalize, basename, sep } from 'node:path';
+import { join, resolve, normalize, relative, basename, sep } from 'node:path';
 
 /** Steam appid for Wallpaper Engine. */
 export const WE_APPID = '431960';
@@ -542,6 +542,18 @@ export function mimeFor(absPath) {
   }[ext] || 'application/octet-stream';
 }
 
+/**
+ * A filesystem-relative path (`bin\index.html`, `我的 壁纸.html`) as URL path
+ * segments (`bin/index.html`, `%E6%88%91…`). Each segment is encoded
+ * separately so `/` stays a separator and spaces/unicode survive the round
+ * trip through the route's decodeURIComponent.
+ * @param {string} fsPath
+ * @returns {string}
+ */
+export function toUrlPath(fsPath) {
+  return String(fsPath).split(/[\\/]/).filter(Boolean).map(encodeURIComponent).join('/');
+}
+
 // ── 6. Inventory assembly (pure; the host wires it to HTTP) ──────────────────
 
 /**
@@ -587,12 +599,22 @@ export async function buildInventoryFrom(discovery = {}, io = {}) {
     const previewToken = hasPreview
       ? mint({ abs: p.previewAbs, rootDir: null, key: `${p.id}:preview` })
       : null;
+    // Web wallpapers are addressed AT their entry file (`…/media/<token>/index.html`):
+    // the document URL then mirrors the on-disk layout of the project, so the
+    // wallpaper's own relative references (scripts, styles, images, fetches)
+    // resolve exactly where Wallpaper Engine itself would resolve them. A bare
+    // token URL would strand `app.js` at `…/media/app.js` — one directory too
+    // high, a 404, and a blank wallpaper. Videos keep the bare form: browsers
+    // never resolve relative URLs against a <video> src.
+    const mediaSuffix = p.type === 'web' && mediaToken
+      ? '/' + toUrlPath(relative(p.dir, p.fileAbs))
+      : '';
     wallpapers.push({
       id: p.id,
       title: p.title,
       type: p.type,
       playable: hasMedia && Boolean(mediaToken),
-      media: hasMedia && mediaToken ? `${base}/media/${mediaToken}` : null,
+      media: hasMedia && mediaToken ? `${base}/media/${mediaToken}${mediaSuffix}` : null,
       // The preview stays in the payload even though stills are never
       // selected: it is the decode-failure fallback for playable entries.
       preview: hasPreview && previewToken ? `${base}/preview/${previewToken}` : null,
@@ -624,8 +646,10 @@ export async function buildInventoryFrom(discovery = {}, io = {}) {
       order: playlist.order,
       delay: playlist.delay,
       wallpaperIds: ids,
+      // ids only ever contains playable entries (the filter above), so
+      // every resolved item is portable by construction.
       total: ids.length,
-      portableCount: ids.filter((id) => playableIds.has(id)).length,
+      portableCount: ids.length,
       unresolvedCount: Math.max(0, playlist.items.length - ids.length),
     };
   });

package/lib/index.js

@@ -27,6 +27,10 @@
  *   - The browser half renders web wallpapers in a sandboxed iframe
  *     (`sandbox="allow-scripts"`, no allow-same-origin), so third-party
  *     wallpaper JS gets an opaque origin and cannot touch DSH storage/APIs.
+ *     That opaque origin also makes the wallpaper's own fetch()/XHR for its
+ *     sub-assets cross-origin, so media/preview responses carry
+ *     `Access-Control-Allow-Origin: *` — the unguessable token stays the
+ *     only capability, and the surface is loopback-only.
  *   - Everything is loopback same-origin; `X-Content-Type-Options: nosniff`
  *     on every media response.
  *
@@ -132,13 +136,22 @@ export function createRouteRegistrar(webServer, opts = {}) {
     return token;
   };
   const remintAll = () => { tokens.clear(); tokenByKey.clear(); };
+  // Web-wallpaper media URLs carry the entry file's path after the token
+  // (`…/media/<token>/index.html`) — the token is the FIRST path segment,
+  // never the last. Extract it structurally so pruning cannot mistake
+  // `index.html` for the token and kill a live wallpaper on a TTL rebuild.
+  const tokenUrlRe = new RegExp(`^${BASE}/(media|preview)/([^/?#]+)`);
+  const tokenOfUrl = (url) => {
+    const m = tokenUrlRe.exec(String(url));
+    return m ? m[2] : null;
+  };
   const pruneTokens = (payload) => {
     const live = new Set();
     for (const w of payload.wallpapers) {
       for (const url of [w.media, w.preview]) {
         if (!url) continue;
-        const token = url.slice(url.lastIndexOf('/') + 1);
-        live.add(token);
+        const token = tokenOfUrl(url);
+        if (token) live.add(token);
       }
     }
     for (const token of [...tokens.keys()]) {
@@ -212,13 +225,28 @@ export function createRouteRegistrar(webServer, opts = {}) {
     res.end(req.method === 'HEAD' ? undefined : text);
   }
 
+  /** Bodyless status answer (404/405-style); indistinguishable per reason. */
+  function sendEmpty(res, status) {
+    res.statusCode = status;
+    res.setHeader('Content-Length', '0');
+    res.end();
+  }
+
+  /** Preflight answer for the media/preview surface (see serveFile re CORS). */
+  function sendCorsPreflight(res) {
+    res.statusCode = 204;
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', '*');
+    res.setHeader('Access-Control-Max-Age', '86400');
+    res.end();
+  }
+
   /** Stream one file with Range support (video seeking) and HEAD handling. */
   function serveFile(absPath, req, res) {
     fsp.stat(absPath).then((st) => {
       if (!st.isFile()) {
-        res.statusCode = 404;
-        res.setHeader('Content-Length', '0');
-        res.end();
+        sendEmpty(res, 404);
         return;
       }
       const mime = core.mimeFor(absPath);
@@ -226,20 +254,25 @@ export function createRouteRegistrar(webServer, opts = {}) {
       res.setHeader('Accept-Ranges', 'bytes');
       res.setHeader('Cache-Control', 'no-store');
       res.setHeader('X-Content-Type-Options', 'nosniff');
+      // Web wallpapers render in a sandboxed iframe (opaque origin), so their
+      // own fetch()/XHR for sub-assets is CROSS-origin from the browser's
+      // point of view and would be blocked without an explicit allow. The
+      // unguessable token remains the only capability — wildcard origin
+      // grants nothing beyond what a known URL already grants.
+      res.setHeader('Access-Control-Allow-Origin', '*');
       if (mime === 'text/html' || mime === 'image/svg+xml') {
         // Script-capable documents (web wallpapers, SVG previews) get a
-        // sandboxed CSP even on direct top-level navigation, so they can
-        // never execute against the DSH origin. The client's iframe sandbox
-        // already covers embedding; this is the server-side backstop.
-        res.setHeader('Content-Security-Policy', 'sandbox');
+        // sandbox CSP even on direct top-level navigation, so they can
+        // never execute against the DSH origin. `allow-scripts` keeps the
+        // wallpaper itself functional — inside the sandbox the origin is
+        // opaque either way, so the isolation goal is unchanged.
+        res.setHeader('Content-Security-Policy', 'sandbox allow-scripts');
       }
 
       const range = core.parseRangeHeader(req.headers.range, st.size);
       if (range && range.error) {
-        res.statusCode = 416;
         res.setHeader('Content-Range', `bytes */${st.size}`);
-        res.setHeader('Content-Length', '0');
-        res.end();
+        sendEmpty(res, 416);
         return;
       }
       const head = req.method === 'HEAD';
@@ -271,9 +304,7 @@ export function createRouteRegistrar(webServer, opts = {}) {
       });
       stream.pipe(res);
     }).catch(() => {
-      res.statusCode = 404;
-      res.setHeader('Content-Length', '0');
-      res.end();
+      sendEmpty(res, 404);
     });
   }
 
@@ -334,8 +365,9 @@ export function createRouteRegistrar(webServer, opts = {}) {
       kind: 'prefix',
       path: `${BASE}/${seg}`,
       handler: (req, res) => {
+        if (req.method === 'OPTIONS') { sendCorsPreflight(res); return; }
         if (req.method !== 'GET' && req.method !== 'HEAD') {
-          res.setHeader('Allow', 'GET, HEAD');
+          res.setHeader('Allow', 'GET, HEAD, OPTIONS');
           sendJson(req, res, 405, { error: 'method not allowed' });
           return;
         }
@@ -356,45 +388,50 @@ export function createRouteRegistrar(webServer, opts = {}) {
         }
         const entry = tokens.get(token);
         if (!entry) {
-          res.statusCode = 404;
-          res.setHeader('Content-Length', '0');
-          res.end();
+          sendEmpty(res, 404);
           return;
         }
         let abs = entry.abs;
         if (slash >= 0) {
-          // Sub-asset of a bundled web wallpaper: must stay inside its dir.
-          if (seg !== 'media' || !entry.rootDir) {
-            res.statusCode = 404;
-            res.setHeader('Content-Length', '0');
-            res.end();
-            return;
-          }
           let rel;
           try { rel = decodeURIComponent(rest.slice(slash + 1)); } catch {
             sendJson(req, res, 400, { error: 'bad path' });
             return;
           }
-          // Backslash parts are never legitimate in a URL path here; on win32
-          // `..\evil` would slip past a `/`-only split (the isInsideDir
-          // backstop still catches it — this is defense in depth).
-          if (!rel || rel.split('/').some((part) => part === '..' || part === '' || part.includes('\\'))) {
-            sendJson(req, res, 403, { error: 'forbidden' });
-            return;
-          }
-          abs = join(entry.rootDir, ...rel.split('/'));
-          if (!core.isInsideDir(entry.rootDir, abs)) {
-            sendJson(req, res, 403, { error: 'forbidden' });
-            return;
+          if (rel === '') {
+            // Directory form (`…/media/<token>/`): the entry document itself,
+            // exactly like the bare-token URL — abs already points at it, so
+            // fall through to the shared symlink backstop below. Preview
+            // tokens have no directory form.
+            if (seg !== 'media') {
+              sendEmpty(res, 404);
+              return;
+            }
+          } else {
+            // Sub-asset of a bundled web wallpaper: must stay inside its dir.
+            if (seg !== 'media' || !entry.rootDir) {
+              sendEmpty(res, 404);
+              return;
+            }
+            // Backslash parts are never legitimate in a URL path here; on
+            // win32 `..\evil` would slip past a `/`-only split (the
+            // isInsideDir backstop still catches it — defense in depth).
+            if (rel.split('/').some((part) => part === '..' || part === '' || part.includes('\\'))) {
+              sendJson(req, res, 403, { error: 'forbidden' });
+              return;
+            }
+            abs = join(entry.rootDir, ...rel.split('/'));
+            if (!core.isInsideDir(entry.rootDir, abs)) {
+              sendJson(req, res, 403, { error: 'forbidden' });
+              return;
+            }
           }
         }
         // Symlink backstop: serve only what realpath still keeps inside the
         // entry's real root (404 — indistinguishable from a vanished file).
         realPathWithin(entry, abs).then((real) => {
           if (!real) {
-            res.statusCode = 404;
-            res.setHeader('Content-Length', '0');
-            res.end();
+            sendEmpty(res, 404);
             return;
           }
           serveFile(real, req, res);
@@ -411,6 +448,7 @@ export function createRouteRegistrar(webServer, opts = {}) {
     for (const d of disposers) { try { d(); } catch { /* ignore */ } }
     disposers.length = 0;
     remintAll();
+    realRootCache.clear();
     cache = null;
     discoveryCache = null;
   };

package/lib/types/index.d.ts

@@ -47,6 +47,29 @@ export interface HostContext {
   };
 }
 
+/** webServer-like registry consumed by createRouteRegistrar. */
+export interface WebServerRegistry {
+  register(route: {
+    kind: 'exact' | 'prefix';
+    path: string;
+    handler(req: unknown, res: unknown): void | Promise<void>;
+  }): () => void;
+}
+
+/**
+ * Register all HTTP routes on a webServer-like registry; returns a disposer.
+ * Exported so integration tests can drive the surface against a fixture
+ * discovery without a live Steam install.
+ */
+export function createRouteRegistrar(
+  webServer: WebServerRegistry,
+  opts?: {
+    discover?: () => Promise<{ installDir: string | null; libraryRoots: string[] }>;
+    inventoryTtlMs?: number;
+    discoveryTtlMs?: number;
+  },
+): () => void;
+
 export declare const inject: string[];
 export declare function apply(ctx: HostContext): () => void;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wallpaper-engine-dsh",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "Wallpaper Engine library as the DSH web GUI background — video/web/still wallpapers, rotation lists, search, resource monitor, bilingual UI.",
   "type": "module",
   "main": "lib/index.js",