Security

Authentication Token Storage

Access tokens are not stored in the SQLite database. Instead, they are stored using platform-native secure storage:

flowchart TB
    LoginSuccess["Login Success"]
    KeyringCheck{"System Keyring<br/>Available?"}
    OSCredential["Store in OS Credential Manager<br/>- Linux: libsecret/GNOME Keyring<br/>- macOS: Keychain<br/>- Windows: Credential Manager<br/>- Android: EncryptedSharedPrefs"]
    EncryptedFallback["Encrypted File Fallback<br/>(AES-256-GCM)"]

    LoginSuccess --> KeyringCheck
    KeyringCheck -->|"Yes"| OSCredential
    KeyringCheck -->|"No"| EncryptedFallback

Key Format:

jellytau::{server_id}::{user_id}::access_token

Rationale:

• Tokens in SQLite would be readable if the database file is accessed
• System keyrings provide OS-level encryption and access control
• Fallback ensures functionality on minimal systems without a keyring daemon

Secure Storage Module

Location: src-tauri/src/secure_storage/ (planned)

#![allow(unused)]
fn main() {
pub trait SecureStorage: Send + Sync {
    fn store(&self, key: &str, value: &str) -> Result<(), SecureStorageError>;
    fn retrieve(&self, key: &str) -> Result<Option<String>, SecureStorageError>;
    fn delete(&self, key: &str) -> Result<(), SecureStorageError>;
}

// Platform implementations
pub struct KeyringStorage;      // Uses keyring crate
pub struct EncryptedFileStorage; // AES-256-GCM fallback
}

Network Security

Webview Content Security Policy

app.security.csp in tauri.conf.json (TRACES: UR-012, UR-071 | DR-198). It was null — CSP disabled — which meant any script that reached the web layer inherited the full IPC surface. Tauri computes the header from this value when it serves the embedded HTML, injecting a nonce for SvelteKit's inline bootstrap script, so script-src needs no 'unsafe-inline'.

default-src 'self';
script-src  'self';
style-src   'self' 'unsafe-inline';
font-src    'self' data:;
img-src     'self' data: blob: asset: http://asset.localhost http: https:;
media-src   'self' blob: asset: http://asset.localhost http://127.0.0.1:* http: https:;
connect-src 'self' ipc: http://ipc.localhost http: https:;
worker-src  'self' blob:;
object-src 'none'; frame-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'

img-src/media-src/connect-src are deliberately permissive. The Jellyfin origin is typed in by the user at run time and is routinely plain http on a LAN, so it cannot be enumerated at build time. http: https: is a wide grant for data — but it still bars file:, filesystem: and scripting schemes, and it does not touch script-src, which is where an injected origin would actually hurt. A run-time policy naming the server exactly was considered and rejected: Tauri derives the header from immutable config at the moment it serves the HTML, so it would mean rebuilding the config and reloading the webview whenever the user adds or switches a server, to constrain a destination the user chooses anyway.

devCsp mirrors the policy with 'unsafe-inline' 'unsafe-eval' on script-src and ws:/wss: on connect-src, because the Vite dev server injects styles and code and drives HMR over a websocket. It applies only to tauri dev.

Asset protocol scope

app.security.assetProtocol.scope is $APPDATA/thumbnails/** — not the storage root. imageCache.ts is the only convertFileSrc caller left in the frontend: downloaded media moved to the loopback media server in DR-137, and downloaded audio is opened by MPV/ExoPlayer directly from its path. The old $APPDATA/** grant let the webview read the SQLite database and the encrypted-token fallback file alongside the thumbnails it actually needs.

If a new feature hands the webview a local file, widen this scope to that subdirectory specifically; a path outside it resolves to nothing and the webview reports NETWORK_NO_SOURCE (which is exactly how DR-134's failure presented).

Local Data Protection

Path Confinement and Input Binding

Two classes of defect, both of the same shape: a value that arrived from outside decided something it should not, at a site whose neighbours a few lines away already did it correctly.

Filesystem path confinement

Two mechanics worth remembering, because both are easy to get subtly wrong:

• Path::join neither folds .. nor keeps the base when handed an absolute path. Confinement therefore has to be checked after the join, not before.
• Sanitising is per path component. Whole-string sanitising would rewrite downloads/x.mp3 to downloads_x.mp3 and relocate every existing download.

The database keeps both the raw key and the resolved path, so lookups still match and pre-existing rows still resolve.

Query and URL construction

Caller-supplied values are bound or encoded, never interpolated (DR-212):

• The offline get_items item-type filter uses parameter placeholders rather than formatting IN ('a','b').
• build_get_items_endpoint encodes ParentId / IncludeItemTypes / SortBy / SortOrder. Encoding is per element and list separators stay unencoded, because Jellyfin splits these parameters on the comma.
• player_set_volume clamps at the command boundary — it previously accepted NaN and out-of-range floats even though every backend clamps internally.

Security Considerations

1. No Secrets in SQLite: The database contains only non-sensitive metadata
2. Token Isolation: Each user/server combination has a separate token entry
3. Logout Cleanup: Token deletion from secure storage on logout
4. No Token Logging: Tokens are never written to logs or debug output
5. IPC Security: Tauri's IPC uses structured commands, not arbitrary code execution
6. Webview Containment: A restrictive script-src keeps injected script off the IPC surface; the asset protocol is scoped to the thumbnail cache only (see above)