aboutsummaryrefslogtreecommitdiffstats
path: root/internal/notify/service.go
AgeCommit message (Collapse)AuthorFilesLines
28 hoursfix(notify): route icon-like content images to the app-icon slotDanilo M.1-1/+10
Clients like kitty, mail and opencode send their icon through the content-image hint, so it drew as a large balloon preview. A theme-name source, an SVG, or a raster small on both sides now fills the app-icon slot instead; a larger raster (a screenshot) stays the preview. An app_icon already present keeps the slot.
28 hoursfix(notify): cap image dimensions and rank icon_data lastDanilo M.1-5/+12
A notification is untrusted input. RawImage.PNG computed stride*(Height-1)+Width*Channels in int, so Width=Height=2^31-1 with RowStride=0 wrapped the length expression negative, slipped past the guard, and reached image.NewRGBA, which panics. The D-Bus call path has no recover, so one malformed Notify killed the daemon. Cap Width/Height at 1<<16 before any multiplication and compute the required byte count in int64. image-data, image-path and the deprecated icon_data were read as one tier, with icon_data ahead of image-path, inverting the spec's order. Split the deprecated key into IconDataFromHints and apply tier 1 (image-data/image_data), then image-path, then icon_data. Raw handling is unchanged: encode, hold pendingImage, WriteImage after Add, SetImage.
28 hourstest(notify): cover image-data materialisationDanilo M.1-0/+2
TestNotifyMaterialisesImageData drives a 2x2 RGBA image-data hint through Notify and asserts the PNG is written under the image directory for the returned id, decodes to the right bounds, and is carried on the re-published Popup.Image. The encode-error path now logs instead of dropping the failure silently, matching the WriteImage branch.
28 hoursfeat(notify): materialise notification imagesDanilo M.1-3/+24
Notify resolves app_icon and image-path theme names, decodes image-data to a PNG under the image directory, and re-publishes the entry with its image path. The daemon advertises body-images, and removeImage refuses to touch a path outside its own directory so a client's screenshot file is never deleted.
28 hoursfix(notify): cover expiry cleanup and harden the image-removal guardDanilo M.1-3/+4
Split the dismiss test so expiry is exercised on its own: Expire removes the image without deleting the inert entry, and nothing asserted it. removeImage now requires filepath.Dir(filepath.Clean(path)) to equal the image directory, so a path carrying .. cannot reach a sibling daemon file such as queue.json. The previous prefix test accepted it. Not exploitable until Task 4 populates Popup.Image from a client hint, which is exactly why the guard is fixed now.
28 hoursfeat(notify): add the image field and its cleanupDanilo M.1-1/+15
Popup gains image, and the store calls an injected removeImage when an entry is dismissed, evicted, replaced or expired, so a daemon-written PNG does not outlive its balloon. The service decides what is daemon-owned; the store only names the path. NewStore now takes the callback as a third parameter, so the service wires its removeImage in (unlinking only under ImagesDir) and the existing call sites pass nil.
32 hoursfix: delete the timer entry on natural expiryDanilo M.1-2/+14
32 hoursfeat: add the D-Bus service and the daemonDanilo M.1-0/+134
Notify assigns an id and publishes; a replaces_id or stack tag reuses the id. CloseNotification closes with reason 3. The daemon claims org.freedesktop.Notifications and exits non-zero if it cannot, which is what happens while dunst still holds it.