Address response bodies by response id instead of a filesystem path

The body commands took a path from the client, so a token holder could
read any file the process could. They now take a response id and resolve
the location themselves, and the UI never sees a path at all: the desktop
host asks the backend where the file is, and the bridge fetches
/responses/:id/body.

Ephemeral responses (GraphQL introspection) never reach the database, so
resolution falls back to the path send writes them to.

apps/yaak-client/lib/responseBody.ts

@@ -5,6 +5,12 @@ import { candidateJsonPayloadsFromSseText, computeSseSummary } from "@yaakapp-in
 import { rpc } from "./rpc";
 import { platform } from "@yaakapp-internal/platform";
 
+/**
+ * Reading a response body means naming the response, never the file it lives
+ * in: the backend resolves an id against its own records, so nothing the UI
+ * says can point a read somewhere else.
+ */
+
 export async function getResponseBodyText({
   response,
   filter,
@@ -13,7 +19,7 @@ export async function getResponseBodyText({
   filter: string | null;
 }): Promise<string | null> {
   const result = await rpc<FilterResponse>("cmd_http_response_body", {
-    response,
+    responseId: response.id,
     filter,
   });
 
@@ -27,10 +33,9 @@ export async function getResponseBodyText({
 export async function getResponseBodyEventSource(
   response: HttpResponse,
 ): Promise<ServerSentEvent[]> {
-  if (!response.bodyPath) return [];
   try {
     const events = await rpc<ServerSentEvent[]>("cmd_get_sse_events", {
-      filePath: response.bodyPath,
+      responseId: response.id,
     });
     if (events.length > 0) {
       return events;
@@ -39,8 +44,9 @@ export async function getResponseBodyEventSource(
     // Fall back to raw JSON frame parsing for non-standard SSE-like responses.
   }
 
-  const bytes = await platform.files.readFile(response.bodyPath);
-  const text = new TextDecoder("utf-8").decode(bytes);
+  const text = await getResponseBodyDecoded(response);
+  if (text == null) return [];
+
   return candidateJsonPayloadsFromSseText(text).map((data, index) => ({
     data,
     eventType: "",
@@ -53,16 +59,19 @@ export async function getResponseBodySseSummary(
   response: HttpResponse,
   resultKeyPath: string,
 ): Promise<SseSummary> {
-  if (!response.bodyPath) return { fragmentCount: 0, summary: "" };
+  const text = await getResponseBodyDecoded(response);
+  if (text == null) return { fragmentCount: 0, summary: "" };
 
-  const bytes = await platform.files.readFile(response.bodyPath);
-  const text = new TextDecoder("utf-8").decode(bytes);
   return computeSseSummary(text, resultKeyPath);
 }
 
 export async function getResponseBodyBytes(
   response: HttpResponse,
 ): Promise<Uint8Array<ArrayBuffer> | null> {
-  if (!response.bodyPath) return null;
-  return platform.files.readFile(response.bodyPath);
+  return platform.files.readResponseBody(response.id);
+}
+
+async function getResponseBodyDecoded(response: HttpResponse): Promise<string | null> {
+  const bytes = await getResponseBodyBytes(response);
+  return bytes == null ? null : new TextDecoder("utf-8").decode(bytes);
 }