fix: vídeo no app Linux travava a janela; abrir no player do sistema (0.3.2)

O AppImage traz o WebKitGTK sem os plugins de mídia do GStreamer; criar um <video>
derrubava o processo da página. O app Linux não cria mais <video>/<audio>: oferece
"Abrir no player do sistema". Clicar no preview abre a visualização grande.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

crates/guara-core/src/external.rs

@@ -0,0 +1,110 @@
+//! Abre um arquivo achado no aplicativo padrão do sistema (player de vídeo, leitor
+//! de PDF, etc.). Usado quando o WebView do app não consegue reproduzir a mídia:
+//! o WebKitGTK empacotado no AppImage não traz os plugins de mídia do GStreamer e
+//! o processo da página morre ao criar um `<video>`.
+
+use crate::error::{Error, Result};
+use crate::fs::sanitize_name;
+use crate::types::Found;
+use std::path::{Path, PathBuf};
+
+/// Pasta temporária própria do usuário (nunca compartilhada).
+fn temp_dir() -> PathBuf {
+    let uid = crate::owner::invoking_user()
+        .map(|u| u.uid.to_string())
+        .unwrap_or_else(|| {
+            #[cfg(unix)]
+            {
+                // SAFETY: getuid não tem pré-condições.
+                unsafe { libc::getuid() }.to_string()
+            }
+            #[cfg(not(unix))]
+            {
+                "user".to_string()
+            }
+        });
+    std::env::temp_dir().join(format!("guara-abrir-{uid}"))
+}
+
+/// Remove cópias com mais de um dia.
+fn cleanup(dir: &Path) {
+    let Ok(rd) = std::fs::read_dir(dir) else {
+        return;
+    };
+    let limit = std::time::Duration::from_secs(24 * 3600);
+    for e in rd.flatten() {
+        if let Ok(age) = e
+            .metadata()
+            .and_then(|m| m.modified())
+            .and_then(|t| t.elapsed().map_err(std::io::Error::other))
+        {
+            if age > limit {
+                let _ = std::fs::remove_file(e.path());
+            }
+        }
+    }
+}
+
+/// Copia o arquivo achado para uma pasta temporária do usuário e o abre no aplicativo padrão.
+pub fn open_found(src: &dyn crate::source::Source, f: &Found) -> Result<PathBuf> {
+    const MAX: u64 = 8 * 1024 * 1024 * 1024;
+    if f.size > MAX {
+        return Err(Error::msg("Arquivo grande demais para abrir direto. Recupere-o e abra pelo seu gerenciador de arquivos."));
+    }
+    let dir = temp_dir();
+    crate::owner::create_dir_all_owned(&dir)?;
+    cleanup(&dir);
+    let path = dir.join(format!("{}-{}", f.id, sanitize_name(&f.name)));
+    let _ = std::fs::remove_file(&path);
+    crate::recover::write_file(src, f, &path)?;
+    open_path(&path)
+        .map_err(|e| Error::msg(format!("Não foi possível abrir {}: {e}", path.display())))?;
+    Ok(path)
+}
+
+/// Abre o caminho com o aplicativo padrão, na sessão do usuário real mesmo se formos root.
+pub fn open_path(path: &Path) -> std::io::Result<()> {
+    use std::process::{Command, Stdio};
+    #[cfg(target_os = "linux")]
+    let mut cmd = if let Some(u) = crate::owner::invoking_user() {
+        let mut c = Command::new("runuser");
+        c.args(["-u", &u.name, "--", "env"]);
+        for k in ["DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY"] {
+            if let Ok(v) = std::env::var(k) {
+                c.arg(format!("{k}={v}"));
+            }
+        }
+        c.arg(format!("XDG_RUNTIME_DIR=/run/user/{}", u.uid));
+        c.arg(format!(
+            "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{}/bus",
+            u.uid
+        ));
+        c.arg("xdg-open").arg(path);
+        c
+    } else {
+        let mut c = Command::new("xdg-open");
+        c.arg(path);
+        c
+    };
+    #[cfg(target_os = "macos")]
+    let mut cmd = {
+        let mut c = Command::new("open");
+        c.arg(path);
+        c
+    };
+    #[cfg(windows)]
+    let mut cmd = {
+        let mut c = Command::new("cmd");
+        c.args(["/C", "start", ""]).arg(path);
+        c
+    };
+    let mut child = cmd
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()?;
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+    Ok(())
+}

crates/guara-core/src/http.rs

@@ -0,0 +1,103 @@
+//! Rotas HTTP de mídia (`/file` com Range e `/thumb`) compartilhadas pelo modo `guara ui`.
+
+use crate::service::Engine;
+use tiny_http::{Header, Method, Request, Response, StatusCode};
+
+pub fn header(name: &str, value: &str) -> Header {
+    Header::from_bytes(name.as_bytes(), value.as_bytes()).unwrap()
+}
+
+/// O cabeçalho Host bate com um dos endereços esperados (defesa contra DNS rebinding)?
+pub fn host_ok(req: &Request, hosts: &[String]) -> bool {
+    req.headers()
+        .iter()
+        .any(|h| h.field.equiv("Host") && hosts.iter().any(|x| x == h.value.as_str()))
+}
+
+/// Responde `/file/<job>/<id>` (com Range) e `/thumb/<job>/<id>?s=NNN`.
+/// Devolve a requisição quando ela não é uma rota de mídia.
+pub fn handle_media(eng: &Engine, token: &str, req: Request) -> Option<Request> {
+    let full = req.url().to_string();
+    let (path, query) = full.split_once('?').unwrap_or((full.as_str(), ""));
+    let is_file = path.starts_with("/file/");
+    let is_thumb = path.starts_with("/thumb/");
+    if !(is_file || is_thumb) {
+        return Some(req);
+    }
+    if req.method() == &Method::Options {
+        let r = Response::empty(204)
+            .with_header(header("Access-Control-Allow-Origin", "*"))
+            .with_header(header("Access-Control-Allow-Headers", "Range"))
+            .with_header(header("Access-Control-Allow-Methods", "GET, OPTIONS"));
+        let _ = req.respond(r);
+        return None;
+    }
+    if req.method() != &Method::Get {
+        let _ = req.respond(Response::from_string("método não permitido").with_status_code(405));
+        return None;
+    }
+    if !query
+        .split('&')
+        .any(|kv| kv.strip_prefix("t=") == Some(token))
+    {
+        let _ = req.respond(Response::from_string("token inválido").with_status_code(401));
+        return None;
+    }
+    let mut it = path
+        .trim_start_matches("/file/")
+        .trim_start_matches("/thumb/")
+        .split('/');
+    let (job, id) = (
+        it.next().unwrap_or(""),
+        it.next().and_then(|s| s.parse::<u64>().ok()),
+    );
+    let Some(id) = id else {
+        let _ = req.respond(Response::from_string("id inválido").with_status_code(400));
+        return None;
+    };
+    if is_thumb {
+        let size = query
+            .split('&')
+            .find_map(|kv| kv.strip_prefix("s="))
+            .and_then(|v| v.parse::<u32>().ok())
+            .unwrap_or(256);
+        match eng.thumb(job, id, size) {
+            Ok(bytes) => {
+                let r = Response::from_data(bytes.as_ref().clone())
+                    .with_header(header("Content-Type", "image/jpeg"))
+                    .with_header(header("Cache-Control", "private, max-age=3600"))
+                    .with_header(header("Access-Control-Allow-Origin", "*"));
+                let _ = req.respond(r);
+            }
+            Err(code) => {
+                let _ = req.respond(
+                    Response::from_string("sem miniatura")
+                        .with_status_code(code)
+                        .with_header(header("Access-Control-Allow-Origin", "*")),
+                );
+            }
+        }
+        return None;
+    }
+    let range = req
+        .headers()
+        .iter()
+        .find(|h| h.field.equiv("Range"))
+        .map(|h| h.value.as_str().to_string());
+    match eng.file_slice(job, id, range.as_deref()) {
+        Ok(slice) => {
+            let (status, len) = (slice.status(), slice.len() as usize);
+            let headers: Vec<Header> = slice.headers().iter().map(|(k, v)| header(k, v)).collect();
+            let resp = Response::new(StatusCode(status), headers, slice.reader(), Some(len), None);
+            let _ = req.respond(resp);
+        }
+        Err(code) => {
+            let _ = req.respond(
+                Response::from_string("indisponível")
+                    .with_status_code(code)
+                    .with_header(header("Access-Control-Allow-Origin", "*")),
+            );
+        }
+    }
+    None
+}

crates/guara-core/src/lib.rs

@@ -7,8 +7,10 @@ pub mod carve;
 pub mod device;
 pub mod error;
 pub mod explorer;
+pub mod external;
 pub mod fs;
 pub mod hashing;
+pub mod http;
 pub mod image;
 pub mod meta;
 pub mod owner;

crates/guara-core/src/owner.rs

@@ -7,6 +7,7 @@ use std::path::{Path, PathBuf};
 
 #[derive(Debug, Clone)]
 pub struct User {
+    pub name: String,
     pub uid: u32,
     pub gid: u32,
     pub home: PathBuf,
@@ -41,6 +42,7 @@ pub fn lookup_user(passwd: &str, uid: Option<u32>, name: Option<&str>) -> Option
         };
         if uid == Some(fuid) || (uid.is_none() && name == Some(f[0])) {
             return Some(User {
+                name: f[0].to_string(),
                 uid: fuid,
                 gid: fgid,
                 home: PathBuf::from(f[5]),

crates/guara-core/src/service.rs

@@ -736,6 +736,15 @@ impl Engine {
             }
             "status" => self.status(&s("job")?)?,
             "facets" => self.facets(&s("job")?)?,
+            "open_external" => {
+                let id = p
+                    .get("id")
+                    .and_then(|v| v.as_u64())
+                    .ok_or_else(|| Error::msg("id ausente"))?;
+                let (f, src) = self.open_file(&s("job")?, id)?;
+                let path = crate::external::open_found(src.as_ref(), &f)?;
+                json!({ "path": path.to_string_lossy() })
+            }
             "export_csv" => {
                 let q: Option<Query> = p
                     .get("query")
@@ -1051,6 +1060,10 @@ impl FileSlice {
                 "sandbox; default-src 'none'".into(),
             ),
             ("Access-Control-Allow-Origin", "*".into()),
+            (
+                "Access-Control-Expose-Headers",
+                "Content-Range, Content-Length, Accept-Ranges".into(),
+            ),
             ("Content-Disposition", "inline".into()),
         ];
         if self.partial {