tauri-app: 8a review fixes

- fetchBlob cache keyed by (did, cid), not just cid.
  Security: future per-DID access control on getBlob would
  otherwise leak the first responder's bytes to subsequent
  viewers.
- EmbedImage: pass did to releaseBlob, release previous cid
  on cid change (no leaked URLs).
- ComposeBox: releaseBlob called with both did and cid.
- pds-server: rename test
  get_blob_after_upload_with_different_did ->
  get_blob_returns_404_for_cross_did_cid_lookup. The
  docstring was misleading — the test only verifies the
  (did,cid) PK on the PDS row, not auth. The renamed name
  matches what the test actually checks.
- vitest: update releaseBlob call sites to the new
  (did, cid) signature.

crates/tauri-app/src/lib/components/ComposeBox.svelte

@@ -1,12 +1,41 @@
 <script lang="ts">
-  import { createPost, type Post } from "../api/client";
+  import {
+    createPost,
+    fetchBlob,
+    pickAndUploadImage,
+    makeImagesEmbed,
+    showError,
+    releaseBlob,
+    session,
+    type Post,
+  } from "../api/client";
 
   const MAX = 160;
   let { onPosted }: { onPosted?: () => void } = $props();
   let text: string = $state("");
   let isPosting: boolean = $state(false);
+  let isAttaching: boolean = $state(false);
   let status: { kind: "ok" | "err" | "info"; msg: string } | null = $state(null);
 
+  // Currently logged-in user. We need the DID for `fetchBlob` (the
+  // PDS endpoint keys blobs by `(did, cid)`), so the compose box
+  // subscribes to the session store rather than taking a prop.
+  let did: string = $state("");
+  $effect(() => {
+    const u = $session;
+    did = u?.did ?? "";
+  });
+
+  // The currently-attached image. `null` = no attachment. We hold
+  // the blob reference + a local object URL for the preview so the
+  // user sees the image before they post.
+  let attachment: {
+    cid: string;
+    mimeType: string;
+    size: number;
+    previewUrl: string;
+  } | null = $state(null);
+
   let remaining = $derived(MAX - text.length);
   let counterClass = $derived(
     remaining < 0 ? "counter counter--err" :
@@ -20,17 +49,66 @@
     }
   }
 
+  function fmtBytes(n: number): string {
+    if (n < 1024) return `${n} B`;
+    if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KiB`;
+    return `${(n / (1024 * 1024)).toFixed(2)} MiB`;
+  }
+
+  async function attach() {
+    if (isAttaching || attachment) return;
+    if (!did) {
+      status = { kind: "err", msg: "> log in first" };
+      return;
+    }
+    isAttaching = true;
+    status = { kind: "info", msg: "> picking…" };
+    try {
+      const blob = await pickAndUploadImage();
+      if (!blob) {
+        // User cancelled — restore the previous status rather than
+        // leaving the "picking…" message on screen.
+        status = null;
+        return;
+      }
+      // Fetch the bytes back from the PDS so we can render the
+      // preview. `fetchBlob` caches by CID, so re-rendering the
+      // preview after a re-attach is cheap.
+      const previewUrl = await fetchBlob(did, blob.cid);
+      attachment = { ...blob, previewUrl };
+      status = { kind: "info", msg: `> attached (${fmtBytes(blob.size)})` };
+    } catch (e) {
+      status = { kind: "err", msg: `> ${String(e)}` };
+    } finally {
+      isAttaching = false;
+    }
+  }
+
+  function removeAttachment() {
+    if (attachment) {
+      // Revoke the object URL. `fetchBlob` may have evicted the
+      // cache entry for a different reason, so tolerate a no-op.
+      // The user can re-attach — the next fetch will allocate a
+      // fresh URL.
+      releaseBlob(did, attachment.cid);
+      attachment = null;
+    }
+  }
+
   async function post() {
     if (!text.trim() || remaining < 0 || isPosting) return;
     isPosting = true;
     status = { kind: "info", msg: "> posting…" };
     try {
-      const r: Post = await createPost(text);
+      const embed = attachment ? makeImagesEmbed(attachment) : null;
+      const r: Post = await createPost(text, embed);
       status = { kind: "ok", msg: `> ok (cid: ${(r as any).cid?.slice?.(0, 8) ?? "?"}…)` };
       text = "";
+      removeAttachment();
       onPosted?.();
     } catch (e) {
       status = { kind: "err", msg: `> ${String(e)}` };
+      showError(`post failed: ${e}`);
     } finally {
       isPosting = false;
     }
@@ -53,9 +131,39 @@
       maxlength="500"
     ></textarea>
   </div>
+  {#if attachment}
+    <div class="compose__attach">
+      <img
+        class="compose__preview"
+        src={attachment.previewUrl}
+        alt="attachment preview"
+      />
+      <div class="compose__attach-meta">
+        <span class="compose__attach-cid" title={attachment.cid}>cid: {attachment.cid.slice(0, 10)}…</span>
+        <span class="compose__attach-mime">{attachment.mimeType}</span>
+        <span class="compose__attach-size">{fmtBytes(attachment.size)}</span>
+      </div>
+      <button
+        type="button"
+        class="compose__attach-remove"
+        onclick={removeAttachment}
+        disabled={isPosting}
+        title="remove attachment"
+      >×</button>
+    </div>
+  {/if}
   <div class="compose__foot">
     <span class="hint">⌘↵ to post</span>
     <div class="actions">
+      <button
+        type="button"
+        class="btn btn--ghost"
+        onclick={attach}
+        disabled={isAttaching || !!attachment || isPosting}
+        title={attachment ? "image already attached" : "attach image"}
+      >
+        {isAttaching ? "picking…" : "📎"}
+      </button>
       <button class="btn btn--ghost" onclick={() => (text = "")} disabled={!text || isPosting}>draft</button>
       <button class="btn btn--primary" onclick={post} disabled={!text.trim() || remaining < 0 || isPosting}>
         {isPosting ? "posting…" : "post"}
@@ -114,6 +222,51 @@
     padding: 0;
   }
   textarea::placeholder { color: var(--text-dim); }
+  .compose__attach {
+    display: flex;
+    align-items: center;
+    gap: var(--s-3);
+    padding: var(--s-3) var(--s-4);
+    background: var(--bg-deep);
+    border-top: 1px dashed var(--line);
+  }
+  .compose__preview {
+    width: 64px;
+    height: 64px;
+    object-fit: cover;
+    border-radius: var(--r-sm);
+    border: 1px solid var(--line-2);
+    background: var(--bg);
+  }
+  .compose__attach-meta {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    flex: 1;
+    font-family: var(--font-mono);
+    font-size: var(--fs-50);
+    color: var(--text-dim);
+  }
+  .compose__attach-cid { color: var(--cid-fg); }
+  .compose__attach-mime,
+  .compose__attach-size { font-variant-numeric: tabular-nums; }
+  .compose__attach-remove {
+    background: transparent;
+    border: 1px solid var(--line-2);
+    color: var(--text-dim);
+    font-family: var(--font-mono);
+    font-size: var(--fs-100);
+    width: 28px;
+    height: 28px;
+    border-radius: var(--r-sm);
+    cursor: pointer;
+    line-height: 1;
+  }
+  .compose__attach-remove:hover:not(:disabled) {
+    color: var(--red);
+    border-color: var(--red);
+  }
+  .compose__attach-remove:disabled { opacity: 0.4; cursor: not-allowed; }
   .compose__foot {
     display: flex;
     align-items: center;
@@ -146,4 +299,4 @@
   .status--ok { color: var(--green); }
   .status--err { color: var(--red); }
   .status--info { color: var(--orange); }
-</style>
+</style>

crates/tauri-app/src/lib/components/EmbedImage.svelte

@@ -81,8 +81,8 @@
     // cache bounded to the visible images. The browser will
     // free the underlying blob either way when the WebView
     // navigates; this is just hygiene.
-    if (currentCid) {
-      releaseBlob(currentCid);
+    if (currentCid && did) {
+      releaseBlob(did, currentCid);
       currentCid = null;
     }
     objectUrl = null;