Harden Sift filing and security checks

[c0remusic]

What changed

• make filing, trash, restore, purge, and migration updates transactional
• compensate filesystem moves when database writes fail and surface rollback failures
• require generated audio fixtures and run Rust tests in CI
• restrict the Tauri asset protocol to database-known files and remove unsafe script CSP directives
• add regression tests and a Tauri security-policy check

Why

The previous implementation could leave filesystem and SQLite state out of sync after partial failures. Tests could also pass while audio fixtures were missing, and the asset protocol exposed the full filesystem.

Impact

Filing and bin operations now fail safely, migrations cannot advance their version marker after a partial schema change, CI exercises the audio fixtures, and local media access is granted only for known tracks.

Validation

• cargo test --manifest-path src-tauri/Cargo.toml: 129 tests passed
• npx tsc --noEmit
• npm run build
• npm run check:tauri-security
• git diff --check

Existing debt

cargo clippy --all-targets -- -D warnings still reports six pre-existing warnings outside the changed lines. The repository also has pre-existing global rustfmt drift.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dj-assistant	Ready	Preview, Comment	Jul 13, 2026 8:37am