refactor: move DM attachment decrypt+save to vector-core

Add decrypt_and_save_attachment to vector-core crypto — handles DM
file decryption (AES-GCM), content dedup, collision resolution, and
atomic write to get_download_dir(). MLS path (MDK MIP-04) stays in
src-tauri. CLI/SDK can now download and decrypt file attachments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JSKitty

crates/vector-core/src/crypto/mod.rs

@@ -461,6 +461,50 @@ pub fn resolve_unique_filename(dir: &std::path::Path, name: &str) -> std::path::
     }
 }
 
+/// Decrypt a DM file attachment and save to the download directory.
+///
+/// Uses AES-GCM decryption with the key/nonce from the attachment metadata.
+/// Saves with atomic write (temp file + rename). Returns (path, content_hash).
+/// If an identical file already exists (same name + size + hash), reuses it.
+pub fn decrypt_and_save_attachment(
+    encrypted_data: &[u8],
+    key: &str,
+    nonce: &str,
+    name: &str,
+    extension: &str,
+) -> Result<(std::path::PathBuf, String), String> {
+    let decrypted = decrypt_data(encrypted_data, key, nonce)?;
+    let file_hash = sha256_hex(&decrypted);
+
+    let dir = crate::db::get_download_dir();
+    std::fs::create_dir_all(&dir).map_err(|e| format!("Failed to create directory: {}", e))?;
+
+    let target_name = if name.is_empty() {
+        format!("{}.{}", file_hash, extension)
+    } else {
+        name.to_string()
+    };
+
+    // Content dedup: reuse if same name + size + hash
+    let candidate = dir.join(&target_name);
+    let already_exists = candidate.exists()
+        && std::fs::metadata(&candidate).map(|m| m.len() == decrypted.len() as u64).unwrap_or(false)
+        && std::fs::read(&candidate).map(|b| sha256_hex(&b) == file_hash).unwrap_or(false);
+
+    if already_exists {
+        return Ok((candidate, file_hash));
+    }
+
+    let file_path = resolve_unique_filename(&dir, &target_name);
+
+    // Atomic write: temp file then rename
+    let tmp_path = dir.join(format!(".{}.{}.tmp", file_hash, extension));
+    std::fs::write(&tmp_path, &decrypted).map_err(|e| format!("Failed to write file: {}", e))?;
+    std::fs::rename(&tmp_path, &file_path).map_err(|e| format!("Failed to rename file: {}", e))?;
+
+    Ok((file_path, file_hash))
+}
+
 /// Format bytes into human-readable format (KB, MB, GB).
 pub fn format_bytes(bytes: u64) -> String {
     const KB: f64 = 1024.0;

src-tauri/src/commands/attachments.rs

@@ -11,7 +11,7 @@ use tokio::sync::Mutex;
 use tauri::{AppHandle, Emitter, Manager, Runtime};
 
 use crate::{STATE, TAURI_APP, ChatType, Attachment};
-use crate::{util, crypto, net, db, mls};
+use crate::{util, net, db, mls};
 use crate::util::hex_string_to_bytes;
 
 /// Global set of attachment IDs currently being downloaded.
@@ -108,62 +108,36 @@ pub(crate) fn resolve_unique_filename(dir: &std::path::Path, name: &str) -> std:
 ///
 /// Returns (path, content_hash) if successful, or an error message if unsuccessful
 pub async fn decrypt_and_save_attachment<R: Runtime>(
-    handle: &AppHandle<R>,
+    _handle: &AppHandle<R>,
     encrypted_data: &[u8],
     attachment: &Attachment
 ) -> Result<(std::path::PathBuf, String), String> {
-    // Decrypt the attachment using the appropriate method
-    let decrypted_data = if let Some(ref group_id) = attachment.group_id {
-        // MLS attachment - use MDK's MIP-04 decryption
-        decrypt_mls_attachment(encrypted_data, attachment, group_id).await?
-    } else {
-        // DM attachment - use explicit key/nonce with AES-GCM
-        crypto::decrypt_data(encrypted_data, &attachment.key, &attachment.nonce)
-            .map_err(|e| e.to_string())?
-    };
+    if let Some(ref group_id) = attachment.group_id {
+        // MLS attachment — MDK's MIP-04 decryption (stays in src-tauri)
+        let decrypted_data = decrypt_mls_attachment(encrypted_data, attachment, group_id).await?;
+        let file_hash = util::calculate_file_hash(&decrypted_data);
 
-    // Calculate the hash of the decrypted file
-    let file_hash = util::calculate_file_hash(&decrypted_data);
+        let dir = vector_core::db::get_download_dir();
+        std::fs::create_dir_all(&dir).map_err(|e| format!("Failed to create directory: {}", e))?;
 
-    // Choose the appropriate base directory based on platform
-    let base_directory = if cfg!(target_os = "ios") {
-        tauri::path::BaseDirectory::Document
-    } else {
-        tauri::path::BaseDirectory::Download
-    };
-
-    // Resolve the directory path using the determined base directory
-    let dir = handle.path().resolve("vector", base_directory).unwrap();
-
-    // Use human-readable filename if available, otherwise fall back to hash-based
-    let target_name = if attachment.name.is_empty() {
-        format!("{}.{}", file_hash, attachment.extension)
+        let target_name = if attachment.name.is_empty() {
+            format!("{}.{}", file_hash, attachment.extension)
+        } else {
+            attachment.name.clone()
+        };
+
+        let file_path = resolve_unique_filename(&dir, &target_name);
+        let tmp_path = dir.join(format!(".{}.{}.tmp", file_hash, attachment.extension));
+        std::fs::write(&tmp_path, &decrypted_data).map_err(|e| format!("Failed to write file: {}", e))?;
+        std::fs::rename(&tmp_path, &file_path).map_err(|e| format!("Failed to rename file: {}", e))?;
+        Ok((file_path, file_hash))
     } else {
-        attachment.name.clone()
-    };
-
-    // Create the vector directory if it doesn't exist
-    std::fs::create_dir_all(&dir).map_err(|e| format!("Failed to create directory: {}", e))?;
-
-    // If file with same name + same size + same hash already exists, reuse it (content dedup)
-    let candidate = dir.join(&target_name);
-    let already_exists = candidate.exists()
-        && std::fs::metadata(&candidate).map(|m| m.len() == decrypted_data.len() as u64).unwrap_or(false)
-        && std::fs::read(&candidate).map(|b| util::calculate_file_hash(&b) == file_hash).unwrap_or(false);
-
-    if already_exists {
-        return Ok((candidate, file_hash));
+        // DM attachment — delegates to vector-core
+        vector_core::crypto::decrypt_and_save_attachment(
+            encrypted_data, &attachment.key, &attachment.nonce,
+            &attachment.name, &attachment.extension,
+        )
     }
-
-    let file_path = resolve_unique_filename(&dir, &target_name);
-
-    // Atomic write: write to temp file then rename, so the file is never 0 bytes
-    // (prevents corrupted state if another thread reads concurrently on macOS APFS)
-    let tmp_path = dir.join(format!(".{}.{}.tmp", file_hash, attachment.extension));
-    std::fs::write(&tmp_path, &decrypted_data).map_err(|e| format!("Failed to write file: {}", e))?;
-    std::fs::rename(&tmp_path, &file_path).map_err(|e| format!("Failed to rename file: {}", e))?;
-
-    Ok((file_path, file_hash))
 }
 
 /// Decrypt an MLS attachment using MDK's MIP-04 decryption

src-tauri/src/crypto.rs

@@ -17,7 +17,7 @@ use zeroize::Zeroize;
 
 // Re-export from vector-core
 pub use vector_core::crypto::{
-    decrypt_data, looks_encrypted, is_encryption_enabled,
+    looks_encrypted, is_encryption_enabled,
     maybe_encrypt, maybe_decrypt,
 };