Add standalone desktop workflow

internal/api/handlers_sources.go

@@ -3,7 +3,6 @@ package api
 import (
 	"errors"
 	"net/http"
-	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -11,20 +10,19 @@ import (
 )
 
 func (s *Server) handleSources(w http.ResponseWriter, r *http.Request) {
-	relPath, err := normalizeSourcePath(r.URL.Query().Get("path"))
+	absPath, err := normalizeSourcePathQuery(r.URL.Query().Get("path"))
 	if err != nil {
 		jsonErr(w, http.StatusBadRequest, err.Error())
 		return
 	}
-
-	absPath := s.deps.MediaPath
-	if relPath != "" {
-		absPath = filepath.Join(absPath, relPath)
+	if absPath == "" {
+		jsonOK(w, map[string]any{"path": "", "items": []map[string]string{}})
+		return
 	}
 
 	entries, err := os.ReadDir(absPath)
 	if err != nil {
-		jsonOK(w, map[string]any{"path": relPath, "items": []map[string]string{}})
+		jsonOK(w, map[string]any{"path": absPath, "items": []map[string]string{}})
 		return
 	}
 
@@ -38,13 +36,10 @@ func (s *Server) handleSources(w http.ResponseWriter, r *http.Request) {
 		if !e.IsDir() || strings.HasPrefix(e.Name(), ".") {
 			continue
 		}
-		childPath := e.Name()
-		if relPath != "" {
-			childPath = filepath.Join(relPath, childPath)
-		}
+		childPath := filepath.Join(absPath, e.Name())
 		items = append(items, item{
 			Name: e.Name(),
-			Path: filepath.ToSlash(childPath),
+			Path: childPath,
 		})
 	}
 
@@ -53,26 +48,18 @@ func (s *Server) handleSources(w http.ResponseWriter, r *http.Request) {
 	})
 
 	jsonOK(w, map[string]any{
-		"path":  relPath,
+		"path":  absPath,
 		"items": items,
 	})
 }
 
-func normalizeSourcePath(raw string) (string, error) {
-	raw, _ = url.QueryUnescape(raw)
+func normalizeSourcePathQuery(raw string) (string, error) {
 	raw = strings.TrimSpace(raw)
-	raw = filepath.ToSlash(raw)
-	raw = strings.TrimPrefix(raw, "/")
 	if raw == "" || raw == "." {
 		return "", nil
 	}
-
 	clean := filepath.Clean(raw)
-	clean = filepath.ToSlash(clean)
-	if clean == "." {
-		return "", nil
-	}
-	if clean == ".." || strings.HasPrefix(clean, "../") {
+	if !filepath.IsAbs(clean) {
 		return "", errors.New("invalid source path")
 	}
 	return clean, nil