[feat] call AssetBrowserModal for whitelisted widgets

tests-ui/tests/platform/assets/utils/assetMetadataUtils.test.ts

@@ -3,7 +3,9 @@ import { describe, expect, it } from 'vitest'
 import type { AssetItem } from '@/platform/assets/schemas/assetSchema'
 import {
   getAssetBaseModel,
-  getAssetDescription
+  getAssetDescription,
+  getAssetFilename,
+  validateAssetFilename
 } from '@/platform/assets/utils/assetMetadataUtils'
 
 describe('assetMetadataUtils', () => {
@@ -62,4 +64,50 @@ describe('assetMetadataUtils', () => {
       expect(getAssetBaseModel(mockAsset)).toBeNull()
     })
   })
+
+  describe('getAssetFilename', () => {
+    it('should return trimmed filename when present', () => {
+      const asset = {
+        ...mockAsset,
+        user_metadata: { filename: ' checkpoints/model.safetensors ' }
+      }
+      expect(getAssetFilename(asset)).toBe('checkpoints/model.safetensors')
+    })
+
+    it('should return null when filename is empty string', () => {
+      const asset = {
+        ...mockAsset,
+        user_metadata: { filename: '   ' }
+      }
+      expect(getAssetFilename(asset)).toBeNull()
+    })
+
+    it('should return null when no metadata', () => {
+      expect(getAssetFilename(mockAsset)).toBeNull()
+    })
+  })
+
+  describe('validateAssetFilename', () => {
+    it('should accept valid filenames', () => {
+      expect(validateAssetFilename('model.safetensors')).toBe(true)
+      expect(validateAssetFilename('checkpoints/model.safetensors')).toBe(true)
+      expect(validateAssetFilename('loras/style/anime.safetensors')).toBe(true)
+    })
+
+    it('should reject directory traversal attempts', () => {
+      expect(validateAssetFilename('../../../etc/passwd')).toBe(false)
+      expect(validateAssetFilename('models/../../../secret.txt')).toBe(false)
+    })
+
+    it('should reject dangerous characters', () => {
+      expect(validateAssetFilename('model<script>.safetensors')).toBe(false)
+      expect(validateAssetFilename('model|pipe.safetensors')).toBe(false)
+      expect(validateAssetFilename('model*wildcard.safetensors')).toBe(false)
+    })
+
+    it('should reject empty or whitespace-only strings', () => {
+      expect(validateAssetFilename('')).toBe(false)
+      expect(validateAssetFilename('   ')).toBe(false)
+    })
+  })
 })