fix: Major bug cleanup pass 1

toju-app/src/app/domains/plugins/domain/rules/plugin-local-file.rules.spec.ts

@@ -1,4 +1,8 @@
-import { describe, expect, it } from 'vitest';
+import {
+  describe,
+  expect,
+  it
+} from 'vitest';
 import {
   collectPluginReadRoots,
   fileUrlToPath,
@@ -15,18 +19,12 @@ describe('plugin-local-file.rules', () => {
     expect(collectPluginReadRoots(
       'file:///home/ludde/Desktop/TestPlugin/plugin-source.json',
       'file:///home/ludde/Desktop/TestPlugin/dist/main.js'
-    )).toEqual([
-      '/home/ludde/Desktop/TestPlugin',
-      '/home/ludde/Desktop/TestPlugin/dist'
-    ]);
+    )).toEqual(['/home/ludde/Desktop/TestPlugin', '/home/ludde/Desktop/TestPlugin/dist']);
   });
 
   it('treats directory file URLs as their own read roots', () => {
-    expect(collectPluginReadRoots('file:///home/ludde/Desktop/TestPlugin/')).toEqual([
-      '/home/ludde/Desktop/TestPlugin'
-    ]);
-    expect(collectPluginReadRoots('file:///home/ludde/Desktop/TestPlugin')).toEqual([
-      '/home/ludde/Desktop/TestPlugin'
-    ]);
+    expect(collectPluginReadRoots('file:///home/ludde/Desktop/TestPlugin/')).toEqual(['/home/ludde/Desktop/TestPlugin']);
+
+    expect(collectPluginReadRoots('file:///home/ludde/Desktop/TestPlugin')).toEqual(['/home/ludde/Desktop/TestPlugin']);
   });
 });

toju-app/src/app/domains/plugins/domain/rules/plugin-local-file.rules.ts

@@ -8,7 +8,8 @@ export function pluginFileParentDir(filePath: string): string {
 }
 
 export function pluginReadRootForFileUrl(fileUrl: string): string {
-  const filePath = fileUrlToPath(fileUrl).replace(/\\/g, '/').replace(/\/+$/, '');
+  const filePath = fileUrlToPath(fileUrl).replace(/\\/g, '/')
+    .replace(/\/+$/, '');
   const basename = filePath.split('/').pop() ?? '';
 
   if (fileUrl.endsWith('/') || !basename.includes('.')) {
@@ -18,7 +19,7 @@ export function pluginReadRootForFileUrl(fileUrl: string): string {
   return pluginFileParentDir(filePath);
 }
 
-export function collectPluginReadRoots(...fileUrls: Array<string | undefined>): string[] {
+export function collectPluginReadRoots(...fileUrls: (string | undefined)[]): string[] {
   const roots = new Set<string>();
 
   for (const fileUrl of fileUrls) {
@@ -34,7 +35,7 @@ export function collectPluginReadRoots(...fileUrls: Array<string | undefined>):
 
 export async function grantPluginReadRoots(
   api: Pick<ElectronApi, 'grantPluginReadRoot'> | null | undefined,
-  ...fileUrls: Array<string | undefined>
+  ...fileUrls: (string | undefined)[]
 ): Promise<void> {
   if (!api?.grantPluginReadRoot) {
     return;

toju-app/src/app/domains/plugins/domain/rules/plugin-source-url.rules.spec.ts

@@ -0,0 +1,16 @@
+import { isLocalDevPluginSourceUrl, isSecurePluginRemoteUrl } from './plugin-source-url.rules';
+
+describe('plugin source URL rules', () => {
+  it('treats localhost HTTP URLs as local dev plugin sources', () => {
+    expect(isLocalDevPluginSourceUrl('http://localhost:4200/plugins/e2e-plugin-source.json')).toBe(true);
+    expect(isLocalDevPluginSourceUrl('http://127.0.0.1:4200/plugins/e2e-plugin-source.json')).toBe(true);
+    expect(isLocalDevPluginSourceUrl('http://example.com/plugins.json')).toBe(false);
+    expect(isLocalDevPluginSourceUrl('https://localhost/plugins.json')).toBe(false);
+  });
+
+  it('accepts HTTPS and localhost HTTP as secure remote plugin URLs', () => {
+    expect(isSecurePluginRemoteUrl('https://plugins.example.test/index.json')).toBe(true);
+    expect(isSecurePluginRemoteUrl('http://localhost:4200/plugins/e2e-plugin-source.json')).toBe(true);
+    expect(isSecurePluginRemoteUrl('http://example.com/plugins.json')).toBe(false);
+  });
+});

toju-app/src/app/domains/plugins/domain/rules/plugin-source-url.rules.ts

@@ -0,0 +1,14 @@
+export function isLocalDevPluginSourceUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+
+    return parsed.protocol === 'http:'
+      && (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1');
+  } catch {
+    return false;
+  }
+}
+
+export function isSecurePluginRemoteUrl(url: string): boolean {
+  return url.startsWith('https://') || isLocalDevPluginSourceUrl(url);
+}