#252 Support safe attachment downloads and a persistent Downloads view

[Anonymous]

Originally created by: kristofferR

Status (2026-11-08)

• Done in [#342] (v2.0.7): the allowlist for documents, text data and archives (is_attachment_filename in src-tauri/src/download.rs), with macro-capable Office formats and scriptable markup kept out.
• Remaining: the persistent download history, the Downloads view (Open, Show in Finder/folder, Clear), Open on the completion toast, and opaque download IDs. [#444] builds on this.

Problem

Chatpane's native download policy currently accepts Messenger media extensions only. Messenger also carries ordinary user-requested documents and archives such as PDF, DOCX, XLSX, PPTX, TXT, ZIP, and EPUB. Those legitimate attachments are refused.

Chatpane also remembers recent downloads only briefly for the Show in Finder/Show in folder action. There is no user-visible history, direct Open action, or Clear action.

Goal

Support deliberate downloads of safe Messenger attachments and make completed downloads easy to find, without weakening Chatpane's executable and remote-origin protections.

Scope

• Add a conservative allowlist for common documents, text/data formats, and archives.
• Continue blocking executables, installers, scripts, disk images, packages, shortcut formats, and ambiguous/no-extension payloads.
• Require a user-initiated Messenger attachment/download action. A remote page must not gain a generic arbitrary-URL downloader.
• Preserve Ask every time and Downloads folder behavior, filename sanitization, collision handling, session-authenticated WebView downloads, and failure reporting.
• Persist a bounded native download history containing only the local path, display filename, and completion time.
• Validate history entries on load and before every action; prune missing, expired, or out-of-policy paths.
• Add a Downloads view with Open, Show in Finder/Show in folder, and Clear history.
• Let the completion toast expose both Open and Reveal where the platform supports them.
• Never pass a filesystem path through the Facebook page. Page actions use an authenticated opaque download ID resolved natively.

Verification

• Allow representative PDF, Office, text, and archive attachments from Messenger.
• Refuse EXE, MSI, DMG, PKG, DEB, RPM, AppImage, shell/PowerShell/JavaScript, JAR, and renamed dangerous cases.
• Cover path traversal, duplicate names, moved/deleted files, stale IDs, bounded history, Ask mode, and multi-window completion.
• Manual Open/Reveal checks on all three platforms.

Ref [#177], [#219], and [#89].