fix(raster): keep local rasters in saved projects and under layer order

Three desktop-facing raster problems from issue #1463.

Rasters vanish from a reopened project. A local raster reaches the
control as a browser `File`, so nothing on the layer pointed at the file
it came from and restoring a project dropped it. The desktop host now
records the absolute path it read the bytes from
(`metadata.localFilePath`) and re-reads the file on project open through
a host-registered reader; the raster panel's own browse button routes
through the native file dialog so a panel-opened raster carries a path
too. Unchanged in the browser, which has no path: those rasters are
still dropped with a notice.

Rasters obscure the vectors above them. The deck.gl engine draws through
an overlay that, on desktop, is a separate canvas stacked over the map,
so layer order could not reach it. Rasters now default to the
`cog-tiler-wasm` engine, which decodes tiles in WebAssembly and feeds a
native MapLibre raster source/layer, so ordering is the map's own. The
store sync is engine-aware and records the real style layer id.

Trade-off: the WASM tiler renders from its own built-in colormaps, so
"Classify into discrete classes" and custom color ramps -- which work by
patching the deck.gl render pipeline -- do not apply while it is active.
The panel's Rendering engine selector still offers the GPU engine.

A data: URI image fails to load on desktop only. The Tauri CSP allowed
`data:` in `img-src` but not `connect-src`, and MapLibre fetches an image
source's URL rather than assigning it to an `<img>` -- so a KML/KMZ
ground overlay (or a deck.gl icon atlas) died with an opaque "Load
failed". The web CSP already carried `data:` for this reason; the desktop
one now matches.

Author: giswqs

apps/geolibre-desktop/src-tauri/tauri.conf.json

@@ -21,7 +21,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; connect-src 'self' blob: https: http://127.0.0.1:* http://localhost:* wss://collab.geolibre.app ws://127.0.0.1:* ws://localhost:*; img-src 'self' data: blob: https:; media-src 'self' blob: https:; style-src 'self' 'unsafe-inline'; script-src 'self' blob: 'unsafe-eval' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/ https://cdn.jsdelivr.net/pyodide/ https://accounts.google.com; child-src 'self' http://127.0.0.1:* http://localhost:* https://accounts.google.com https://www.google.com; frame-src 'self' http://127.0.0.1:* http://localhost:* https://accounts.google.com https://www.google.com; worker-src blob: 'self'",
+      "csp": "default-src 'self'; connect-src 'self' data: blob: https: http://127.0.0.1:* http://localhost:* wss://collab.geolibre.app ws://127.0.0.1:* ws://localhost:*; img-src 'self' data: blob: https:; media-src 'self' blob: https:; style-src 'self' 'unsafe-inline'; script-src 'self' blob: 'unsafe-eval' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/ https://cdn.jsdelivr.net/pyodide/ https://accounts.google.com; child-src 'self' http://127.0.0.1:* http://localhost:* https://accounts.google.com https://www.google.com; frame-src 'self' http://127.0.0.1:* http://localhost:* https://accounts.google.com https://www.google.com; worker-src blob: 'self'",
       "capabilities": ["default"]
     }
   },

apps/geolibre-desktop/src/components/layout/DesktopShell.tsx

@@ -26,6 +26,8 @@ import {
   restoreThreeDTilesLayers,
   restoreVectorLayers,
   setBookmarkLabels,
+  setLocalRasterFileReader,
+  setLocalRasterPicker,
   setNonTiledRasterHandler,
   setTerrainMeasureLabels,
   setViewStateLabels,
@@ -57,6 +59,8 @@ import {
   loadDroppedPhotoPaths,
   loadDroppedRasterFiles,
   loadDroppedRasterPaths,
+  pickLocalRasterFiles,
+  readRasterFileAtPath,
   isLoadedImageOverlay,
   isLoadedModel,
   loadDroppedVectorFiles,
@@ -931,6 +935,21 @@ export function DesktopShell({
     }
   }, []);
 
+  // Let the raster plugin reach the local filesystem on desktop: re-read a
+  // raster a saved project references by path, and open the native file dialog
+  // instead of the panel's own <input type="file"> (whose File carries no path,
+  // so the raster could never be restored). Both stay unregistered in the
+  // browser, where the plugin keeps its existing behavior. See issue #1463.
+  useEffect(() => {
+    if (!isTauri()) return;
+    setLocalRasterFileReader(readRasterFileAtPath);
+    setLocalRasterPicker(pickLocalRasterFiles);
+    return () => {
+      setLocalRasterFileReader(null);
+      setLocalRasterPicker(null);
+    };
+  }, []);
+
   // When a GeoTIFF fails to load because it is striped (not a tiled COG), offer
   // to convert it to a COG in the browser and load the result. Works for both a
   // local file and a remote URL (issue #916). The raster plugin detects the case
@@ -1241,7 +1260,12 @@ export function DesktopShell({
     if (!rasters.length) return 0;
     const appAPI = createAppAPI(mapControllerRef);
     for (const raster of rasters) {
-      await addRasterToMap(appAPI, raster.source, { name: raster.name });
+      // `path` is present only for a desktop pick/drop; it is what lets a saved
+      // project reload the raster instead of dropping it (issue #1463).
+      await addRasterToMap(appAPI, raster.source, {
+        name: raster.name,
+        ...(raster.path ? { localPath: raster.path } : {}),
+      });
     }
     return rasters.length;
   }, []);

apps/geolibre-desktop/src/lib/tauri-io.ts

@@ -2412,6 +2412,12 @@ export interface DroppedRaster {
    * manages its object URL, matching how the Add Raster panel loads local files.
    */
   source: File;
+  /**
+   * The absolute path the bytes were read from, when there is one (Tauri).
+   * Recorded on the layer so a saved project can reload the raster; absent for
+   * a browser drag-and-drop, which has no path.
+   */
+  path?: string;
 }
 
 function fileBaseName(path: string): string {
@@ -2439,11 +2445,54 @@ export async function loadDroppedRasterPaths(paths: string[]): Promise<DroppedRa
     rasters.push({
       name,
       source: new File([bytes], name, { type: "image/tiff" }),
+      path,
     });
   }
   return rasters;
 }
 
+/**
+ * Read one raster file off disk into a browser `File`, for reloading a raster a
+ * saved project references by path (issue #1463). Rejects when the file is
+ * gone; the caller then drops that layer with a notice.
+ *
+ * @param path - The absolute path recorded when the raster was first added.
+ * @returns The file, named after its basename.
+ */
+export async function readRasterFileAtPath(path: string): Promise<File> {
+  const bytes = await readFile(path);
+  return new File([bytes], fileBaseName(path), { type: "image/tiff" });
+}
+
+/**
+ * Open a native file dialog for raster files and read each pick, keeping the
+ * absolute path alongside the bytes. Used in place of the raster panel's own
+ * `<input type="file">`, whose `File` carries no path. Resolves to an empty
+ * array when the dialog is cancelled or the app is not running under Tauri.
+ *
+ * @returns The picked rasters, each with its file and path.
+ */
+export async function pickLocalRasterFiles(): Promise<{ file: File; path: string }[]> {
+  if (!isTauri()) return [];
+  const selected = await open({
+    multiple: true,
+    filters: [{ name: "Rasters", extensions: [...RASTER_DROP_EXTENSIONS] }],
+  });
+  if (!selected) return [];
+  const paths = (Array.isArray(selected) ? selected : [selected]).filter(isRasterFileName);
+  const picked: { file: File; path: string }[] = [];
+  for (const path of paths) {
+    // Read each pick independently so one unreadable file does not abandon the
+    // rest of the selection, matching pickImageFilesWithFallback.
+    try {
+      picked.push({ file: await readRasterFileAtPath(path), path });
+    } catch (error) {
+      console.warn(`Could not read the selected raster "${path}".`, error);
+    }
+  }
+  return picked;
+}
+
 /**
  * Open a multi-select image picker and read each pick into a browser `File`, so
  * the geotagged-photo importer reads EXIF and renders thumbnails the same way on

docker/nginx.conf

@@ -61,8 +61,7 @@ server {
         add_header Cache-Control "no-cache, must-revalidate" always;
         add_header X-Content-Type-Options "nosniff" always;
         add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-        # Closely mirrors the Tauri desktop CSP (the browser build additionally
-        # permits data: URIs in connect-src). 'unsafe-eval' is required by the
+        # Closely mirrors the Tauri desktop CSP. 'unsafe-eval' is required by the
         # @google/earthengine and maplibre-gl-geoagent bundles; connect-src
         # stays broad because users connect to arbitrary tile/WMS endpoints.
         # The http://localhost:* / http://127.0.0.1:* (and ws:// equivalents)
@@ -83,8 +82,11 @@ server {
         # mirror the change in the Tauri CSP in
         # apps/geolibre-desktop/src-tauri/tauri.conf.json as well --
         # wss://collab.geolibre.app is an example of a host duplicated in both.
-        # (The browser build intentionally adds data: to connect-src; that
-        # difference is documented in the "Closely mirrors" note above.)
+        # `data:` must stay in connect-src in BOTH CSPs: MapLibre fetches an
+        # image source's URL (it does not assign it to an <img>), so a data:
+        # URI image -- a KML/KMZ <GroundOverlay>, a deck.gl icon atlas -- is
+        # matched against connect-src, not img-src. Dropping it makes those
+        # layers fail to load with an opaque "Load failed" (issue #1463).
         # The Tauri CSP additionally allows http://127.0.0.1:* / http://localhost:*
         # in frame-src/child-src so the desktop app can embed its locally
         # launched JupyterLab server in the Notebook panel. That is desktop-only

packages/plugins/src/index.ts

@@ -189,9 +189,14 @@ export {
   closeRasterLayerPanel,
   openRasterLayerPanel,
   restoreRasterLayers,
+  setLocalRasterFileReader,
+  setLocalRasterPicker,
   setNonTiledRasterHandler,
   setRasterPixelInspect,
+  type LocalRasterFileReader,
+  type LocalRasterPicker,
   type NonTiledRasterRequest,
+  type PickedLocalRaster,
 } from "./plugins/maplibre-raster";
 export {
   RASTER_MAX_CLASSES,