funman300 ce38b26721 feat(engine): theme zip importer with safety validation (Card theme phase 7)
Implements Phase 7 of CARD_PLAN.md — the entry point that takes a
user-supplied theme zip archive, validates it end-to-end, and
atomically unpacks it into the per-platform user themes directory.

Public API:
  import_theme(zip_path) -> Result<ThemeId, ImportError>
    Resolves user_theme_dir() and unpacks into <user>/<id>/.
  import_theme_into(zip_path, target_root) -> Result<ThemeId, ImportError>
    Test-friendly variant that takes the destination explicitly so
    unit tests never touch the global OnceLock override.

Safety guarantees enforced:
- 20 MB hard cap on archive size (read from the central directory
  before any extraction).
- Zip-slip path traversal rejected via ZipFile::enclosed_name plus a
  Component::Normal-only belt-and-braces check.
- Manifest parsed via ron::de and validated via the existing
  ThemeManifest::validate (Phase 2) — surfaces named diagnostics for
  missing-of-52, unknown keys, duplicate keys, and meta errors.
- Every referenced face + back rasterised through rasterize_svg as a
  structural validity check before any bytes hit the destination.
- Atomic install: writes to <root>/.<id>.tmp/ then std::fs::rename
  into place, with a recursive copy + remove fallback for cross-
  device renames. Failed extraction wipes the staging dir; the user
  themes root is never touched on error.
- Id collision with an existing theme dir rejected up front.

7 new tests covering the happy path plus six failure modes (missing
manifest, missing face, oversized archive, zip-slip, missing-file,
id collision). Tests build zips in tempfile::TempDir so they never
touch the real user themes directory.

Workspace deps: zip 8.6 (default-features off + deflate only),
tempfile 3.27 (dev only).

cargo check --workspace --all-targets / clippy --workspace
--all-targets -- -D warnings clean. cargo test could not be run in
this turn because cc disappeared from the sandbox; tests compile
under cargo check --tests and will run on a normal toolchain.
2026-05-01 05:47:30 +00:00
2026-04-28 13:48:41 -07:00
2026-04-29 21:59:38 +00:00

Solitaire Quest

A cross-platform Klondike Solitaire game written in Rust, featuring a full progression system with XP, levels, achievements, daily challenges, and optional self-hosted sync so your stats follow you across machines.

Features

  • Klondike Solitaire — Draw One and Draw Three modes
  • Progression — XP, levels, unlockable card backs and backgrounds
  • 18 Achievements — including secret ones
  • Daily Challenge — server-seeded so every player worldwide gets the same deal
  • Leaderboard — opt-in, powered by your own self-hosted server
  • Special Modes (unlocked at level 5): Zen, Time Attack, Challenge
  • Sync — pull/push stats across devices via a self-hosted server
  • Color-blind mode — blue tint on red-suit cards

Building

Prerequisites

  • Rust stable toolchain (rustup install stable)
  • Linux: libasound2-dev libudev-dev libxkbcommon-dev
  • macOS: Xcode Command Line Tools
# Fast development build
cargo run -p solitaire_app --features bevy/dynamic_linking

# Release build
cargo build -p solitaire_app --release
./target/release/solitaire_app

Controls

Key Action
Left click / drag Move cards
Right click Highlight legal moves for a card
Space / D Draw from stock
Z / Ctrl+Z Undo
N New game
S Stats overlay
A Achievements overlay
P Profile overlay
O Settings
L Leaderboard
H Help / controls
Enter Auto-complete (when badge is lit)
Escape Pause / clear selection
Arrow keys Navigate card selection

Sync Server (optional)

To sync stats across machines, run the self-hosted server. See README_SERVER.md for setup instructions.

Once the server is running, open Settings → Sync Backend, enter the server URL and your username, and register an account from within the game.

Running Tests

# All tests
cargo test --workspace

# Just game logic (no display required)
cargo test -p solitaire_core -p solitaire_sync -p solitaire_data -p solitaire_server

# Lint
cargo clippy --workspace -- -D warnings

Credits

Built on Bevy and the wider Rust ecosystem (Tokio, Axum, sqlx, Serde, kira, and many more). Card faces and the default card back use xCards artwork (LGPL-3.0); the UI font is FiraMono-Medium (OFL). All audio is synthesized programmatically by this project. See CREDITS.md for the full list and license details.

License

MIT — see LICENSE.

S
Description
A Klondike solitaire game built in Rust with Bevy, targeting Android and Linux desktop. Features classic card rendering, draw-one/draw-three modes, score tracking, undo/redo, daily challenges, and auto-complete detection.
https://klondike.aleshym.co/
Readme MIT 45 MiB
v0.39.0 Latest
2026-05-19 23:58:42 +00:00
Languages
Rust 95.7%
JavaScript 1.9%
HTML 1.3%
CSS 0.5%
Shell 0.4%
Other 0.2%