asset:// 协议与文件作用域

    #[cfg(feature = "protocol-asset")]
    if !registered_scheme_protocols.contains(&"asset".into()) {
      let asset_scope = app_manager
        .state
        .get::<crate::Scopes>()
        .asset_protocol
        .clone();
      let protocol = crate::protocol::asset::get(asset_scope, window_origin.clone());
      pending.register_uri_scheme_protocol("asset", move |webview_id, request, responder| {
        protocol(webview_id, request, UriSchemeResponder(responder))
      });
    }

 "GET hello": "error TypeError: Load failed",
 "HEAD hello": "error TypeError: Load failed",
 "range 0-4": "error TypeError: Load failed",
...
 "outside scope": "error TypeError: Load failed",
...
 "img": "error"

  Object.defineProperty(window.__TAURI_INTERNALS__, 'convertFileSrc', {
    value: function (filePath, protocol = 'asset') {
      const path = encodeURIComponent(filePath)
      return osName === 'windows' || osName === 'android'
        ? `${protocolScheme}://${protocol}.localhost/${path}`
        : `${protocol}://localhost/${path}`
    }
  })

 "convertFileSrc": "asset://localhost/%2FUsers%2Fhal%2Fbuild%2Fui-ecosystem%2Fexp-tauri%2Fwv-asset%2Ffiles%2Fhello.txt",
...
Rust convert_file_src: asset://localhost/%2FUsers%2Fhal%2Fbuild%2Fui-ecosystem%2Fexp-tauri%2Fwv-asset%2Ffiles%2Fhello.txt

  // skip leading `/`
  let path = request.uri().path().as_bytes();
  let path =
    percent_encoding::percent_decode(path.strip_prefix(b"/").unwrap_or(path)).decode_utf8_lossy();

  let mut resp = Response::builder().header("Access-Control-Allow-Origin", window_origin);

  let safe_path = match SafePathBuf::new(path.as_ref().into()) {
    Ok(path) => path,
    Err(e) => {
      log::error!("asset protocol path \"{path}\" is not valid: {e}");
      return resp.status(403).body(Vec::new().into()).map_err(Into::into);
    }
  };

  if !scope.is_allowed(&safe_path) {
    log::error!("asset protocol not configured to allow the path: {path}");
    return resp.status(403).body(Vec::new().into()).map_err(Into::into);
  }

  // Separate block for easier error handling
  let mut file = match File::open(&safe_path).await {
    Ok(file) => file,
    Err(e) => {
      // ...
      return if e.kind() == std::io::ErrorKind::NotFound {
        log::error!("File does not exist at path: {path}");
        return resp.status(404).body(Vec::new().into()).map_err(Into::into);
      } else if e.kind() == std::io::ErrorKind::PermissionDenied {
        log::error!("Missing OS permission to access path \"{path}\": {e}");
        return resp.status(403).body(Vec::new().into()).map_err(Into::into);
      } else {
        Err(e.into())
      };
    }
  };

  pub fn is_allowed<P: AsRef<Path>>(&self, path: P) -> bool {
    let path = try_resolve_symlink_and_canonicalize(path);

    if let Ok(path) = path {
      let path: PathBuf = path.components().collect();
      let forbidden = self
        .inner
        .forbidden_patterns
        .lock()
        .unwrap()
        .iter()
        .any(|p| p.matches_path_with(&path, self.inner.match_options));

      if forbidden {
        false
      } else {
        self
          .inner
          .allowed_patterns
          .lock()
          .unwrap()
          .iter()
          .any(|p| p.matches_path_with(&path, self.inner.match_options))
      }
    } else {
      false
    }
  }

allowed patterns: [
    "~/exp-tauri/wv-asset/files/**",
    "~/exp-tauri/wv-asset/outside2.txt",
]
forbidden patterns: ["~/exp-tauri/wv-asset/files/secret.txt"]

 "GET hello": "200 content-type=text/plain content-length=12 body=12B \"hello asset\\\\n\"",
 "HEAD hello": "200 content-type=text/plain content-length=12 body=0B \"\"",
 "range 0-4": "206 content-type=text/plain content-length=5 content-range=bytes 0-4/12 body=5B \"hello\"",
 "range big 0-": "206 content-type=application/octet-stream content-length=1024000 content-range=bytes 0-1023999/3000000 body=1024000B ...",
 "GET big": "200 content-type=application/octet-stream content-length=3000000 body=3000000B ...",
 "range multi": "206 content-type=multipart/byteranges; boundary=526cbcf725a13a3ca6bf433a5a2b60bf871d8e3438e0701fa6518e8120 content-length=312 body=312B \"\\\\r\\\\n--526cbcf725a1\"",
 "range unsatisfiable": "error TypeError: Load failed",
 "range unsatisfiable no-cors": "resolved type=opaque status=0",
 "outside scope": "403 content-length=0 body=0B \"\"",
 "denied secret": "403 content-length=0 body=0B \"\"",
 "dotfile": "403 content-length=0 body=0B \"\"",
 "sub dir": "200 content-type=text/plain content-length=2 body=2B \"x\\\\n\"",
 "missing": "404 content-length=0 body=0B \"\"",
 "dotdot": "403 content-length=0 body=0B \"\"",
 "runtime allow_file": "200 content-type=text/plain content-length=9 body=9B \"outside2\\\\n\"",
 "img": "loaded 32x32"

      /// The Maximum bytes we send in one range
      const MAX_LEN: u64 = 1000 * 1024;

      // single-part range header
      if ranges.len() == 1 {
        let &(start, mut end) = ranges.first().unwrap();

        // check if a range is not satisfiable
        //
        // this should be already taken care of by the range parsing library
        // but checking here again for extra assurance
        if start >= len || end >= len || end < start {
          return not_satisfiable();
        }

        // adjust end byte for MAX_LEN
        end = start + (end - start).min(len - start).min(MAX_LEN - 1);

      let not_satisfiable = || {
        Response::builder()
          .status(StatusCode::RANGE_NOT_SATISFIABLE)
          .header(CONTENT_RANGE, format!("bytes */{len}"))
          .body(vec![].into())
          .map_err(Into::into)
      };

 "range big 0-": "206 content-type=application/octet-stream content-length=1024000 content-range=bytes 0-1023999/3000000 body=1024000B ...",