fix(delete): accept only known recordings disposals from the renderer

Any value but "trash" took the permanent-delete path, so a malformed one
removed recordings for good. Also fixes a grammar slip in the media-library
docs.

Author: marcgabe15

electron/ipc/nativeBridge.deleteProject.test.ts

@@ -0,0 +1,62 @@
+// Deleting a project takes the recordings disposal from the renderer, and every value but
+// "trash" would remove files for good, so the bridge accepts only the known ones.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { NativeBridgeResponse } from "../../src/native/contracts";
+import { type NativeBridgeContext, registerNativeBridgeHandlers } from "./nativeBridge";
+
+const electron = vi.hoisted(() => ({ handle: vi.fn() }));
+vi.mock("electron", () => ({
+	app: { getAppPath: () => "", isPackaged: false },
+	ipcMain: { handle: electron.handle, removeHandler: vi.fn() },
+	shell: {},
+}));
+vi.mock("../native-bridge/services/compositorViewService", () => ({
+	CompositorViewService: class {},
+}));
+
+const service = vi.hoisted(() => ({
+	deleteProject: vi.fn(async () => ({ success: true })),
+}));
+vi.mock("../native-bridge/services/aiEditionService", () => ({
+	AiEditionService: class {
+		deleteProject = service.deleteProject;
+	},
+}));
+
+let invoke: (payload: unknown) => Promise<NativeBridgeResponse>;
+
+beforeEach(() => {
+	electron.handle.mockClear();
+	service.deleteProject.mockClear();
+	registerNativeBridgeHandlers({
+		getPlatform: () => "linux",
+		getAiEditionDocuments: () => ({}),
+		getAiEditionLlmConfig: () => ({}),
+	} as unknown as NativeBridgeContext);
+	const handler = electron.handle.mock.calls[0]?.[1] as (
+		event: unknown,
+		request: unknown,
+	) => Promise<NativeBridgeResponse>;
+	invoke = (payload) =>
+		handler(
+			{ sender: {} },
+			{ domain: "aiEdition", action: "document.delete", payload, requestId: "r" },
+		);
+});
+
+describe("native bridge project delete", () => {
+	it.each(["Trash", "delete", null, 1])("rejects recordings=%s as a bad request", async (value) => {
+		const response = await invoke({ projectId: "p", recordings: value });
+
+		expect(response.ok ? undefined : response.error?.code).toBe("INVALID_REQUEST");
+		expect(service.deleteProject).not.toHaveBeenCalled();
+	});
+
+	it.each([undefined, "keep", "trash", "permanent"])("passes recordings=%s on", async (value) => {
+		const response = await invoke({ projectId: "p", recordings: value });
+
+		expect(response.ok).toBe(true);
+		expect(service.deleteProject).toHaveBeenCalledWith("p", value);
+	});
+});

electron/ipc/nativeBridge.ts

@@ -573,14 +573,26 @@ export function registerNativeBridgeHandlers(context: NativeBridgeContext) {
 								requestId,
 								await aiEditionService.save(request.payload.document),
 							);
-						case "document.delete":
+						// Renderer input: anything but "trash" would take the permanent path.
+						case "document.delete": {
+							const disposal: unknown = request.payload.recordings;
+							if (
+								disposal !== undefined &&
+								disposal !== "keep" &&
+								disposal !== "trash" &&
+								disposal !== "permanent"
+							) {
+								return createErrorResponse(
+									requestId,
+									"INVALID_REQUEST",
+									"Invalid recordings disposal.",
+								);
+							}
 							return createSuccessResponse(
 								requestId,
-								await aiEditionService.deleteProject(
-									request.payload.projectId,
-									request.payload.recordings,
-								),
+								await aiEditionService.deleteProject(request.payload.projectId, disposal),
 							);
+						}
 						case "document.recordings":
 							return createSuccessResponse(
 								requestId,

website/docs/media-library.md

@@ -52,4 +52,4 @@ The **Format** control in the **Composition** facet sets the shape of the frame;
 
 **Open project** lists your recent `.openscreen` files with a search box, keyboard navigation, and a **Browse files…** escape hatch. You can also drop a `.openscreen` file onto the empty editor.
 
-The trash icon on a project's row deletes the project after a confirm. Its recordings are kept unless you switch on **Also move its recordings to the Trash** (**Recycle Bin** on Windows): that sends the takes in OpenScreen's recordings folder to the system Trash, except any another project still uses, which the row names. If the Trash refuses, as it can on some Linux setups and drives, OpenScreen asks before deleting them permanently.
+The trash icon on a project's row deletes the project after a confirm. Its recordings are kept unless you switch on **Also move its recordings to the Trash** (**Recycle Bin** on Windows): that sends the takes in OpenScreen's recordings folder to the system Trash, except any that another project still uses, which the row names. If the Trash refuses, as it can on some Linux setups and drives, OpenScreen asks before deleting them permanently.