fix(audio): establish canonical local-audio resource policy

CHANGELOG.md

@@ -7,6 +7,15 @@
 - Display the analyzed song tempo (BPM) as a badge in the rehearsal workspace.
 - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함.
 
+### Fixed
+
+- Enforce one canonical local-audio resource policy across native local-file/YouTube bootstrap intake, the desktop bridge, Python request preflight, temporal decoding, and stem separation so oversized, overlong, malformed, wrong-rate, or non-finite input fails before bootstrap storage or expensive analysis/model work.
+- Preflight source-container duration, sample rate, and channel count from the already-open audio handle before temporal, stem, or bass-transcription decoders resample, downmix, or truncate it; successful metadata probes rewind the handle and malformed probes fail closed.
+- Bound the admitted canonical decoded mono buffer to 317,520,000 bytes as well as the existing 39,690,000-sample ceiling, so decoder dtype expansion cannot stay within the sample count while exceeding the explicit in-memory audio budget.
+- Fail closed on malformed known YouTube duration metadata before `download=True`; Boolean, non-numeric, non-finite, zero, negative, and non-canonical numeric-subtype duration evidence can no longer authorize a media download through Python numeric coercion or subclass semantics.
+- Align YouTube download admission with that same 100 MiB encoded-byte ceiling: abort in-flight with yt-dlp `max_filesize` and a progress hook, reject announced oversize before `download=True`, delete owned `.part` / `.ytdl` / `-Frag*` siblings from that import directory on abort, reject a completed path that resolves outside the current import cache before post-download validation, cleanup, or success, and delete owned post-download artifacts that still exceed the policy. A 60 MiB import that the old 50 MB check rejected is now accepted; a file one byte over 100 MiB is not.
+- Bound native stored-score PDF reads to the 25 MiB product limit before heap allocation and revalidate PDF magic on the same opened descriptor, preventing an attached score that later grows from bypassing the local resource boundary.
+
 ## [0.1.3] - 2026-04-29
 
 ### Fixed

apps/desktop/core/Cargo.toml

@@ -7,7 +7,7 @@ publish = false
 
 [lib]
 name = "bandscope_desktop_core"
-path = "src/lib.rs"
+path = "src/root.rs"
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(coverage)'] }

apps/desktop/core/src/audio_resource.rs

@@ -0,0 +1,22 @@
+/// Maximum encoded local-audio file size accepted by the desktop bootstrap boundary.
+pub const MAX_LOCAL_AUDIO_FILE_BYTES: u64 = 100 * 1024 * 1024;
+
+const LOCAL_AUDIO_READ_ERROR: &str = "Could not read the selected audio file.";
+const LOCAL_AUDIO_TOO_LARGE_ERROR: &str =
+    "Selected audio file exceeds the 100 MiB analysis limit.";
+
+/// Validate a native local-audio file length before storing bootstrap metadata.
+///
+/// The caller must obtain this length from the native filesystem descriptor or
+/// metadata boundary rather than from renderer-controlled JSON. The function
+/// intentionally returns only bounded product messages and never includes a
+/// local path or payload content.
+pub fn validate_local_audio_file_size(file_size_bytes: u64) -> Result<u64, String> {
+    if file_size_bytes == 0 {
+        return Err(LOCAL_AUDIO_READ_ERROR.to_string());
+    }
+    if file_size_bytes > MAX_LOCAL_AUDIO_FILE_BYTES {
+        return Err(LOCAL_AUDIO_TOO_LARGE_ERROR.to_string());
+    }
+    Ok(file_size_bytes)
+}

apps/desktop/core/src/root.rs

@@ -0,0 +1,15 @@
+//! Pure, GUI-independent logic for the BandScope desktop application.
+//!
+//! The historical desktop-core implementation remains in `lib.rs` as the
+//! compatibility module while bounded resource boundaries are isolated in
+//! auditable modules. Public symbols are re-exported so downstream callers keep
+//! the same crate-root API.
+
+#[path = "lib.rs"]
+mod runtime_core;
+mod audio_resource;
+mod score_pdf;
+
+pub use audio_resource::{validate_local_audio_file_size, MAX_LOCAL_AUDIO_FILE_BYTES};
+pub use runtime_core::*;
+pub use score_pdf::read_validated_score_pdf;

apps/desktop/core/src/score_pdf.rs

@@ -0,0 +1,82 @@
+use crate::{MAX_SCORE_PDF_BYTES, PDF_MAGIC};
+use std::{fs::File, io::Read, path::Path};
+
+const SCORE_READ_ERROR: &str = "Could not read the score PDF.";
+const SCORE_TOO_LARGE_ERROR: &str = "Score PDF is too large (exceeds 25MB limit).";
+const SCORE_INVALID_PDF_ERROR: &str = "Stored score is not a valid PDF.";
+
+fn read_validated_pdf_stream(
+    reader: &mut impl Read,
+    expected_len: u64,
+) -> Result<Vec<u8>, String> {
+    if expected_len > MAX_SCORE_PDF_BYTES {
+        return Err(SCORE_TOO_LARGE_ERROR.to_string());
+    }
+
+    // MAX_SCORE_PDF_BYTES is 25 MiB, which fits every supported Rust `usize`.
+    let mut bytes = vec![0_u8; expected_len as usize];
+    reader
+        .read_exact(&mut bytes)
+        .map_err(|_| SCORE_READ_ERROR.to_string())?;
+
+    let mut growth_probe = [0_u8; 1];
+    if reader
+        .read(&mut growth_probe)
+        .map_err(|_| SCORE_READ_ERROR.to_string())?
+        != 0
+    {
+        return Err(SCORE_TOO_LARGE_ERROR.to_string());
+    }
+
+    if !bytes.starts_with(PDF_MAGIC) {
+        return Err(SCORE_INVALID_PDF_ERROR.to_string());
+    }
+
+    Ok(bytes)
+}
+
+/// Read one already-authorized stored score without allocating beyond the PDF limit.
+///
+/// The caller remains responsible for path authority and containment. This helper
+/// opens that resolved path once, snapshots the descriptor length, allocates only
+/// that bounded size, reads exactly that many bytes, and then probes one additional
+/// byte on the same descriptor. A file that was already oversized is rejected
+/// before heap allocation; a file that grows after metadata inspection is rejected
+/// by the one-byte probe without extending the heap buffer beyond the product cap.
+/// Errors intentionally omit the local path and file content.
+pub fn read_validated_score_pdf(path: &Path) -> Result<Vec<u8>, String> {
+    let mut file = File::open(path).map_err(|_| SCORE_READ_ERROR.to_string())?;
+    let metadata = file
+        .metadata()
+        .map_err(|_| SCORE_READ_ERROR.to_string())?;
+    if !metadata.is_file() {
+        return Err(SCORE_READ_ERROR.to_string());
+    }
+    read_validated_pdf_stream(&mut file, metadata.len())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    #[test]
+    fn stream_rejects_growth_after_the_metadata_length_snapshot() {
+        let mut reader = Cursor::new(b"%PDF-extra".to_vec());
+
+        let error = read_validated_pdf_stream(&mut reader, PDF_MAGIC.len() as u64)
+            .expect_err("bytes beyond the metadata snapshot must fail closed");
+
+        assert_eq!(error, SCORE_TOO_LARGE_ERROR);
+    }
+
+    #[test]
+    fn stream_rejects_truncation_after_the_metadata_length_snapshot() {
+        let mut reader = Cursor::new(PDF_MAGIC.to_vec());
+
+        let error = read_validated_pdf_stream(&mut reader, (PDF_MAGIC.len() + 1) as u64)
+            .expect_err("truncation after the metadata snapshot must fail closed");
+
+        assert_eq!(error, SCORE_READ_ERROR);
+    }
+}

apps/desktop/core/tests/audio_resource_policy.rs

@@ -0,0 +1,25 @@
+use bandscope_desktop_core::{validate_local_audio_file_size, MAX_LOCAL_AUDIO_FILE_BYTES};
+
+#[test]
+fn local_audio_size_policy_accepts_the_exact_native_bootstrap_ceiling() {
+    assert_eq!(
+        validate_local_audio_file_size(MAX_LOCAL_AUDIO_FILE_BYTES),
+        Ok(MAX_LOCAL_AUDIO_FILE_BYTES)
+    );
+}
+
+#[test]
+fn local_audio_size_policy_rejects_an_empty_native_bootstrap_source() {
+    assert_eq!(
+        validate_local_audio_file_size(0),
+        Err("Could not read the selected audio file.".to_string())
+    );
+}
+
+#[test]
+fn local_audio_size_policy_rejects_a_native_source_above_the_canonical_ceiling() {
+    assert_eq!(
+        validate_local_audio_file_size(MAX_LOCAL_AUDIO_FILE_BYTES + 1),
+        Err("Selected audio file exceeds the 100 MiB analysis limit.".to_string())
+    );
+}

apps/desktop/core/tests/score_pdf_read.rs

@@ -0,0 +1,91 @@
+use bandscope_desktop_core::{read_validated_score_pdf, MAX_SCORE_PDF_BYTES};
+use std::io::Write;
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+fn unique_test_dir(name: &str) -> PathBuf {
+    let suffix = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("system clock should be after epoch")
+        .as_nanos();
+    std::env::temp_dir().join(format!("bandscope-{name}-{suffix}"))
+}
+
+#[test]
+fn score_pdf_read_returns_only_valid_bounded_pdf_bytes() {
+    let root = unique_test_dir("score-read-valid");
+    std::fs::create_dir_all(&root).expect("test directory should be created");
+    let path = root.join("score.pdf");
+    let expected = b"%PDF-1.7\nvalidated body";
+    std::fs::write(&path, expected).expect("valid PDF fixture should be written");
+
+    let actual = read_validated_score_pdf(&path).expect("valid stored PDF should be readable");
+
+    assert_eq!(actual, expected);
+    let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn score_pdf_read_rejects_empty_short_and_wrong_magic_content() {
+    let root = unique_test_dir("score-read-invalid");
+    std::fs::create_dir_all(&root).expect("test directory should be created");
+
+    for (name, content) in [
+        ("empty.pdf", b"".as_slice()),
+        ("short.pdf", b"%PD".as_slice()),
+        ("wrong.pdf", b"PK\x03\x04 not a PDF".as_slice()),
+    ] {
+        let path = root.join(name);
+        std::fs::write(&path, content).expect("invalid PDF fixture should be written");
+        let error = read_validated_score_pdf(&path).expect_err("invalid PDF must fail closed");
+        assert!(
+            error == "Could not read the score PDF." || error == "Stored score is not a valid PDF.",
+            "unexpected payload-safe error: {error}"
+        );
+        assert!(!error.contains(root.to_string_lossy().as_ref()));
+    }
+
+    let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn score_pdf_read_rejects_oversized_sparse_file_before_heap_allocation() {
+    let root = unique_test_dir("score-read-oversized");
+    std::fs::create_dir_all(&root).expect("test directory should be created");
+    let path = root.join("oversized.pdf");
+    let mut file = std::fs::File::create(&path).expect("oversized PDF fixture should be created");
+    file.write_all(b"%PDF-")
+        .expect("PDF magic should be written before extending sparse file");
+    file.set_len(MAX_SCORE_PDF_BYTES + 1)
+        .expect("sparse PDF fixture should exceed the product limit");
+    drop(file);
+
+    let error = read_validated_score_pdf(&path).expect_err("oversized PDF must fail closed");
+
+    assert_eq!(error, "Score PDF is too large (exceeds 25MB limit).");
+    let _ = std::fs::remove_dir_all(root);
+}
+
+#[cfg(unix)]
+#[test]
+fn score_pdf_read_rejects_non_file_descriptor() {
+    let root = unique_test_dir("score-read-directory");
+    std::fs::create_dir_all(&root).expect("test directory should be created");
+
+    let error = read_validated_score_pdf(&root).expect_err("directory must fail closed");
+
+    assert_eq!(error, "Could not read the score PDF.");
+    assert!(!error.contains(root.to_string_lossy().as_ref()));
+    let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn score_pdf_read_rejects_missing_file_without_exposing_path() {
+    let root = unique_test_dir("score-read-missing");
+    let path = root.join("private-score.pdf");
+
+    let error = read_validated_score_pdf(&path).expect_err("missing PDF must fail closed");
+
+    assert_eq!(error, "Could not read the score PDF.");
+    assert!(!error.contains("private-score.pdf"));
+}

apps/desktop/src-tauri/src/main.rs

@@ -155,9 +155,10 @@ fn normalize_local_audio_source(path: &Path) -> Result<LocalAudioSourcePayload,
     }
     let metadata = std::fs::metadata(&canonical)
         .map_err(|_| "Could not read the selected audio file.".to_string())?;
-    if !metadata.is_file() || metadata.len() == 0 {
+    if !metadata.is_file() {
         return Err("Could not read the selected audio file.".into());
     }
+    let file_size_bytes = validate_local_audio_file_size(metadata.len())?;
     let file_name = canonical
         .file_name()
         .and_then(|value| value.to_str())
@@ -167,7 +168,7 @@ fn normalize_local_audio_source(path: &Path) -> Result<LocalAudioSourcePayload,
         source_path: canonical.to_string_lossy().into_owned(),
         file_name: file_name.to_string(),
         extension,
-        file_size_bytes: metadata.len(),
+        file_size_bytes,
     })
 }
 
@@ -712,6 +713,7 @@ async fn import_youtube_url(
     if parsed.get("ok").and_then(|v| v.as_bool()) == Some(true) {
         if let Some(metadata) = parsed.get("metadata") {
             let source = youtube_source_from_metadata(metadata, &cache_root)?;
+            validate_local_audio_file_size(source.file_size_bytes)?;
 
             let summary = ProjectBootstrapSummaryPayload {
                 project_id,
@@ -826,7 +828,9 @@ fn attach_score_pdf(
 /// Security Notes: no path crosses the IPC boundary. Both ids are validated
 /// against strict allowlist shapes, the path is rebuilt locally, and the
 /// canonicalize-plus-prefix guard in `resolve_existing_score_pdf` rejects any
-/// escape from the app-owned scores root.
+/// escape from the app-owned scores root. The resolved file is then read
+/// through the bounded core helper so growth after attachment cannot trigger
+/// an allocation beyond the 25 MiB product limit.
 #[tauri::command]
 fn read_score_pdf(
     project_id: String,
@@ -838,7 +842,7 @@ fn read_score_pdf(
     }
     let scores_root = scores_root_for_project(&app, &project_id)?;
     let path = resolve_existing_score_pdf(&scores_root, &score_id)?;
-    std::fs::read(path).map_err(|_| "Could not read the score PDF.".to_string())
+    read_validated_score_pdf(&path)
 }
 
 /// Security Notes: same id validation and traversal guard as `read_score_pdf`;

apps/desktop/src/lib/analysis.resource-policy.test.ts

@@ -0,0 +1,58 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { importYoutubeUrl, selectLocalAudioSource } from "./analysis";
+
+type TauriWindow = Window & {
+  __TAURI_INTERNALS__?: unknown;
+  __TAURI_INVOKE__?: unknown;
+};
+
+const tauriWindow = window as TauriWindow;
+const INVALID_RESOURCE_POLICY_MESSAGE =
+  "Selected audio file metadata violates the analysis resource policy.";
+
+function fractionalBootstrap(projectId: string) {
+  return {
+    projectId,
+    sourceMode: "reference",
+    projectRoot: `/tmp/bandscope/projects/${projectId}`,
+    cacheRoot: `/tmp/bandscope/cache/${projectId}`,
+    tempRoot: `/tmp/bandscope/temp/${projectId}`,
+    source: {
+      sourcePath: `/tmp/bandscope/${projectId}/input.wav`,
+      fileName: "input.wav",
+      extension: "wav",
+      fileSizeBytes: 1.5
+    }
+  };
+}
+
+describe("analysis encoded-byte policy parity", () => {
+  beforeEach(() => {
+    delete tauriWindow.__TAURI_INTERNALS__;
+    delete tauriWindow.__TAURI_INVOKE__;
+  });
+
+  it("rejects fractional local-file metadata before project state", async () => {
+    tauriWindow.__TAURI_INVOKE__ = vi.fn().mockResolvedValue(fractionalBootstrap("local-project"));
+
+    await expect(selectLocalAudioSource()).resolves.toEqual({
+      ok: false,
+      error: {
+        code: "invalid_request",
+        message: INVALID_RESOURCE_POLICY_MESSAGE
+      }
+    });
+  });
+
+  it("rejects fractional imported-file metadata before project state", async () => {
+    tauriWindow.__TAURI_INVOKE__ = vi.fn().mockResolvedValue(fractionalBootstrap("youtube-project"));
+
+    await expect(importYoutubeUrl("https://youtu.be/4ozX4yFUC34")).resolves.toEqual({
+      ok: false,
+      error: {
+        code: "invalid_request",
+        message: INVALID_RESOURCE_POLICY_MESSAGE
+      }
+    });
+  });
+});