fix: improve library import reliability, supported raster formats, duplicate detection, and browser-safe normalization

src-tauri/src/library.rs

@@ -1,6 +1,7 @@
 use base64::{engine::general_purpose, Engine as _};
-use image::GenericImageView;
+use image::{GenericImageView, ImageFormat};
 use serde::{Deserialize, Serialize};
+use std::io::Cursor;
 use std::sync::Mutex;
 use tauri::{AppHandle, Manager};
 use uuid::Uuid;
@@ -46,6 +47,7 @@ pub async fn library_add_item(app: AppHandle, url: String, source_url: Option<St
     let client = reqwest::Client::builder()
         .timeout(std::time::Duration::from_secs(DOWNLOAD_TIMEOUT_SECS))
         .redirect(reqwest::redirect::Policy::limited(5))
+        .user_agent("LumaRef/1.0 (+https://huggingface.co/asdf98/musealpha)")
         .build()
         .map_err(|e| format!("HTTP client error: {e}"))?;
 
@@ -68,15 +70,16 @@ pub async fn library_add_item(app: AppHandle, url: String, source_url: Option<St
 #[tauri::command]
 pub fn library_import_local(app: AppHandle, path: String, title: Option<String>) -> Result<LibraryItem, String> {
     if path.trim().is_empty() { return Err("Path cannot be empty".to_string()); }
-    if path.contains("..") { return Err("Path traversal is not allowed".to_string()); }
-    let metadata = std::fs::metadata(&path).map_err(|e| format!("Cannot access file: {e}"))?;
+    let path_buf = std::path::PathBuf::from(&path);
+    let canonical = path_buf.canonicalize().map_err(|e| format!("Cannot access file: {e}"))?;
+    let metadata = std::fs::metadata(&canonical).map_err(|e| format!("Cannot access file: {e}"))?;
     if !metadata.is_file() { return Err("Path is not a file".to_string()); }
     if metadata.len() > MAX_IMAGE_SIZE as u64 {
         return Err(format!("Image file is too large ({:.1} MB). Maximum allowed is {:.0} MB", metadata.len() as f64 / (1024.0 * 1024.0), MAX_IMAGE_SIZE as f64 / (1024.0 * 1024.0)));
     }
-    let bytes = std::fs::read(&path).map_err(|e| format!("Cannot read file: {e}"))?;
-    let fallback_title = std::path::Path::new(&path).file_stem().and_then(|s| s.to_str()).map(|s| s.to_string());
-    import_bytes(&app, &bytes, &format!("file://{path}"), None, title.or(fallback_title))
+    let bytes = std::fs::read(&canonical).map_err(|e| format!("Cannot read file: {e}"))?;
+    let fallback_title = canonical.file_stem().and_then(|s| s.to_str()).map(|s| s.to_string());
+    import_bytes(&app, &bytes, &format!("file://{}", canonical.to_string_lossy()), None, title.or(fallback_title))
 }
 
 #[tauri::command]
@@ -100,11 +103,50 @@ fn decode_data_url_bytes(data_url: &str) -> Result<Vec<u8>, String> {
 fn clean_title(title: Option<String>) -> String {
     let t = title.unwrap_or_else(|| "Untitled reference".to_string()).trim().to_string();
     let t = if t.is_empty() { "Untitled reference".to_string() } else { t };
-    t.chars().take(MAX_TITLE_LEN).collect()
+    t.chars().filter(|c| !c.is_control()).take(MAX_TITLE_LEN).collect()
+}
+
+fn ensure_library_loaded(app: &AppHandle) -> Result<(), String> {
+    let loaded: Vec<LibraryItem> = crate::persistence::load_json(app, "library.json").unwrap_or_default();
+    let state = app.state::<LibraryState>();
+    let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
+    if items.is_empty() && !loaded.is_empty() { *items = loaded; }
+    Ok(())
+}
+
+fn browser_safe_data(bytes: &[u8], url: &str, img: &image::DynamicImage) -> Result<(Vec<u8>, &'static str), String> {
+    let guessed = image::guess_format(bytes).ok();
+    match guessed {
+        Some(ImageFormat::Png) => Ok((bytes.to_vec(), "image/png")),
+        Some(ImageFormat::Jpeg) => Ok((bytes.to_vec(), "image/jpeg")),
+        Some(ImageFormat::Gif) => Ok((bytes.to_vec(), "image/gif")),
+        Some(ImageFormat::WebP) => Ok((bytes.to_vec(), "image/webp")),
+        Some(ImageFormat::Bmp) => Ok((bytes.to_vec(), "image/bmp")),
+        Some(ImageFormat::Ico) => Ok((bytes.to_vec(), "image/x-icon")),
+        Some(ImageFormat::Tiff) => {
+            let mut out = Vec::new();
+            img.write_to(&mut Cursor::new(&mut out), ImageFormat::Png).map_err(|e| format!("PNG conversion failed: {e}"))?;
+            Ok((out, "image/png"))
+        }
+        _ => {
+            let lower = url.to_lowercase();
+            if lower.ends_with(".png") { Ok((bytes.to_vec(), "image/png")) }
+            else if lower.ends_with(".jpg") || lower.ends_with(".jpeg") { Ok((bytes.to_vec(), "image/jpeg")) }
+            else if lower.ends_with(".gif") { Ok((bytes.to_vec(), "image/gif")) }
+            else if lower.ends_with(".webp") { Ok((bytes.to_vec(), "image/webp")) }
+            else if lower.ends_with(".bmp") { Ok((bytes.to_vec(), "image/bmp")) }
+            else {
+                let mut out = Vec::new();
+                img.write_to(&mut Cursor::new(&mut out), ImageFormat::Png).map_err(|e| format!("PNG conversion failed: {e}"))?;
+                Ok((out, "image/png"))
+            }
+        }
+    }
 }
 
 fn import_bytes(app: &AppHandle, bytes: &[u8], url: &str, source_url: Option<String>, title: Option<String>) -> Result<LibraryItem, String> {
     if bytes.is_empty() { return Err("Image data is empty".to_string()); }
+    ensure_library_loaded(app)?;
     let hash = blake3::hash(bytes).to_hex().to_string();
     {
         let state = app.state::<LibraryState>();
@@ -112,20 +154,20 @@ fn import_bytes(app: &AppHandle, bytes: &[u8], url: &str, source_url: Option<Str
         if let Some(existing) = items.iter().find(|i| i.hash == hash) { return Ok(existing.clone()); }
         if items.len() >= MAX_LIBRARY_ITEMS { return Err(format!("Library is full ({MAX_LIBRARY_ITEMS} items). Please remove some items before adding new ones.")); }
     }
-    let img = image::load_from_memory(bytes).map_err(|e| format!("Unsupported image format: {e}"))?;
+    let img = image::load_from_memory(bytes).map_err(|e| format!("Unsupported raster image format: {e}. Supported: PNG, JPEG, WebP, GIF, BMP, ICO, TIFF."))?;
     let (width, height) = img.dimensions();
     if width == 0 || height == 0 { return Err("Image has invalid dimensions".to_string()); }
     if width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION {
         return Err(format!("Image dimensions too large ({width}x{height}). Maximum is {MAX_IMAGE_DIMENSION}px in either dimension."));
     }
     let colors = extract_palette(&img, 6);
-    let mime = detect_mime(bytes, url);
+    let (stored_bytes, mime) = browser_safe_data(bytes, url, &img)?;
     let item = LibraryItem {
         id: Uuid::new_v4().to_string(),
         url: url.to_string(),
         source_url: source_url.unwrap_or_default(),
         title: clean_title(title),
-        data_url: format!("data:{mime};base64,{}", general_purpose::STANDARD.encode(bytes)),
+        data_url: format!("data:{mime};base64,{}", general_purpose::STANDARD.encode(stored_bytes)),
         hash,
         width,
         height,
@@ -136,27 +178,28 @@ fn import_bytes(app: &AppHandle, bytes: &[u8], url: &str, source_url: Option<Str
     let state = app.state::<LibraryState>();
     let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
     items.push(item.clone());
+    items.sort_by(|a, b| b.created_at.cmp(&a.created_at));
     crate::persistence::save_json(app, "library.json", &*items)?;
     Ok(item)
 }
 
 #[tauri::command]
 pub fn library_update_metadata(app: AppHandle, id: String, title: Option<String>, tags: Option<Vec<String>>) -> Result<LibraryItem, String> {
+    ensure_library_loaded(&app)?;
     let state = app.state::<LibraryState>();
     let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
     let item = items.iter_mut().find(|i| i.id == id).ok_or("Item not found")?;
     if let Some(t) = title {
         let t = t.trim();
-        if !t.is_empty() { item.title = t.chars().take(MAX_TITLE_LEN).collect(); }
+        if !t.is_empty() { item.title = t.chars().filter(|c| !c.is_control()).take(MAX_TITLE_LEN).collect(); }
     }
     if let Some(t) = tags {
         if t.len() > 50 { return Err("Too many tags (maximum 50)".to_string()); }
         let mut clean = Vec::new();
         for tag in t {
-            let tag = tag.trim();
+            let tag = tag.trim().to_lowercase();
             if tag.is_empty() { continue; }
             if tag.len() > 100 { return Err("Tag too long (maximum 100 characters)".to_string()); }
-            let tag = tag.to_string();
             if !clean.contains(&tag) { clean.push(tag); }
         }
         item.tags = clean;
@@ -168,6 +211,7 @@ pub fn library_update_metadata(app: AppHandle, id: String, title: Option<String>
 
 #[tauri::command]
 pub fn library_remove_tag(app: AppHandle, id: String, tag: String) -> Result<LibraryItem, String> {
+    ensure_library_loaded(&app)?;
     let state = app.state::<LibraryState>();
     let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
     let item = items.iter_mut().find(|i| i.id == id).ok_or("Item not found")?;
@@ -182,7 +226,8 @@ pub fn library_load(app: AppHandle) -> Result<Vec<LibraryItem>, String> {
     let loaded: Vec<LibraryItem> = crate::persistence::load_json(&app, "library.json")?;
     let state = app.state::<LibraryState>();
     let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
-    if items.is_empty() && !loaded.is_empty() { *items = loaded; }
+    if items.is_empty() || loaded.len() != items.len() { *items = loaded; }
+    items.sort_by(|a, b| b.created_at.cmp(&a.created_at));
     Ok(items.clone())
 }
 
@@ -199,6 +244,7 @@ pub fn library_search(app: AppHandle, query: String) -> Result<Vec<LibraryItem>,
 
 #[tauri::command]
 pub fn library_remove_item(app: AppHandle, id: String) -> Result<(), String> {
+    ensure_library_loaded(&app)?;
     let state = app.state::<LibraryState>();
     let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
     let before = items.len();
@@ -209,35 +255,20 @@ pub fn library_remove_item(app: AppHandle, id: String) -> Result<(), String> {
 
 #[tauri::command]
 pub fn library_add_tag(app: AppHandle, id: String, tag: String) -> Result<LibraryItem, String> {
-    let tag = tag.trim().to_string();
+    ensure_library_loaded(&app)?;
+    let tag = tag.trim().to_lowercase();
     if tag.is_empty() { return Err("Tag cannot be empty".to_string()); }
     if tag.len() > 100 { return Err("Tag too long (maximum 100 characters)".to_string()); }
     let state = app.state::<LibraryState>();
     let mut items = state.items.lock().map_err(|_| "library lock poisoned".to_string())?;
     let item = items.iter_mut().find(|i| i.id == id).ok_or("Item not found")?;
     if item.tags.len() >= 50 && !item.tags.contains(&tag) { return Err("Too many tags (maximum 50 per item)".to_string()); }
-    if !item.tags.contains(&tag) { item.tags.push(tag); }
+    if !item.tags.contains(&tag) { item.tags.push(tag); item.tags.sort(); }
     let result = item.clone();
     crate::persistence::save_json(&app, "library.json", &*items)?;
     Ok(result)
 }
 
-fn detect_mime(bytes: &[u8], url: &str) -> &'static str {
-    if bytes.len() >= 12 {
-        if bytes[0..4] == [0x89,0x50,0x4E,0x47] { return "image/png"; }
-        if bytes[0..3] == [0xFF,0xD8,0xFF] { return "image/jpeg"; }
-        if bytes[0..4] == [0x47,0x49,0x46,0x38] { return "image/gif"; }
-        if bytes[0..4] == [0x52,0x49,0x46,0x46] && bytes[8..12] == [0x57,0x45,0x42,0x50] { return "image/webp"; }
-        if bytes[0..2] == [0x42,0x4D] { return "image/bmp"; }
-    }
-    let lower = url.to_lowercase();
-    if lower.ends_with(".png") { "image/png" }
-    else if lower.ends_with(".webp") { "image/webp" }
-    else if lower.ends_with(".gif") { "image/gif" }
-    else if lower.ends_with(".bmp") { "image/bmp" }
-    else { "image/jpeg" }
-}
-
 fn extract_palette(img: &image::DynamicImage, count: usize) -> Vec<String> {
     let thumb = img.thumbnail(120,120).to_rgb8();
     let mut pixels: Vec<[u8;3]> = thumb.pixels().filter_map(|p| { let [r,g,b]=[p[0],p[1],p[2]]; if r.max(g).max(b) < 12 { None } else { Some([r,g,b]) } }).collect();