Fix: Tauri-Plugin-HTTP for Windows Auth Support (Major WIP)

src/lib/client.ts

@@ -10,25 +10,17 @@ function getServerUrl(): string {
 
 function gqlUrl(): string { return `${getServerUrl()}/api/graphql`; }
 
-export function thumbUrl(path: string): string {
+// Returns a clean absolute URL with no embedded credentials.
+export function plainThumbUrl(path: string): string {
   if (!path) return "";
   if (path.startsWith("http")) return path;
+  return `${getServerUrl()}${path}`;
+}
 
-  const base = getServerUrl();
-  const mode = store.settings.serverAuthMode;
-
-  if (mode === "BASIC_AUTH") {
-    const user = store.settings.serverAuthUser?.trim() ?? "";
-    const pass = store.settings.serverAuthPass?.trim() ?? "";
-    if (user && pass) {
-      const url      = new URL(`${base}${path}`);
-      url.username   = user;
-      url.password   = pass;
-      return url.toString();
-    }
-  }
-
-  return `${base}${path}`;
+// Same as plainThumbUrl — credentials are never embedded in URLs.
+// Auth users load images via getBlobUrl (imageCache.ts) instead.
+export function thumbUrl(path: string): string {
+  return plainThumbUrl(path);
 }
 
 interface GQLResponse<T> {

src/lib/imageCache.ts

@@ -0,0 +1,49 @@
+import { fetch as tauriFetch } from "@tauri-apps/plugin-http";
+import { store } from "../store/state.svelte";
+
+const cache = new Map<string, string>();
+const inflight = new Map<string, Promise<string>>();
+
+function getAuthHeaders(): Record<string, string> {
+  const mode = store.settings.serverAuthMode;
+  if (mode === "BASIC_AUTH") {
+    const user = store.settings.serverAuthUser?.trim() ?? "";
+    const pass = store.settings.serverAuthPass?.trim() ?? "";
+    if (user && pass) {
+      return { Authorization: `Basic ${btoa(`${user}:${pass}`)}` };
+    }
+  }
+  return {};
+}
+
+export async function getBlobUrl(url: string): Promise<string> {
+  if (!url) return "";
+
+  const cached = cache.get(url);
+  if (cached) return cached;
+
+  const existing = inflight.get(url);
+  if (existing) return existing;
+
+  const promise = tauriFetch(url, {
+    method: "GET",
+    headers: getAuthHeaders(),
+  })
+    .then(res => {
+      if (!res.ok) throw new Error(`${res.status}`);
+      return res.blob();
+    })
+    .then(blob => {
+      const blobUrl = URL.createObjectURL(blob);
+      cache.set(url, blobUrl);
+      inflight.delete(url);
+      return blobUrl;
+    })
+    .catch(err => {
+      inflight.delete(url);
+      throw err;
+    });
+
+  inflight.set(url, promise);
+  return promise;
+}