Refactor NodeCG runtime preparation and update handling

- Updated paths and configurations in doctor.mjs and prepare-nodecg-runtime.mjs to use new build-config.mjs imports.
- Enhanced runtime installation checks and permissions validation.
- Introduced new update configuration management in update-config.ts, including loading and validating update settings.
- Implemented update service for managing update checks and downloads in update-service.ts.
- Replaced update-utils.ts with update-schema.ts for better structure and clarity in update handling.
- Added comprehensive tests for update download and settings management.
- Ensured secure handling of download URLs and improved error handling in update processes.

src/tests/app-paths.test.ts

@@ -5,9 +5,13 @@ import test from "node:test";
 import {
   getApplicationPaths,
   getDashboardUrl,
+  getDefaultUpdateConfigPath,
+  getManagedNodecgRuntimePath,
   getNodecgBaseUrl,
   getRootPath,
+  getSafeChildPath,
   getSourceNodecgRuntimePath,
+  getUpdateDownloadDirectory,
   getUserDataPath,
 } from "../main/app/paths";
 
@@ -18,6 +22,9 @@ test("app path helpers build deterministic development paths and URLs", () => {
   assert.equal(rootPath, path.resolve(compiledMainDir, "../.."));
   assert.equal(getSourceNodecgRuntimePath(rootPath), path.resolve(rootPath, "lib", "nodecg"));
   assert.equal(getUserDataPath("/app-data", "scoreko"), path.join("/app-data", "scoreko"));
+  assert.equal(getManagedNodecgRuntimePath("/app-data/scoreko"), path.join("/app-data/scoreko", "nodecg"));
+  assert.equal(getDefaultUpdateConfigPath(rootPath), path.join(rootPath, "static", "updates.json"));
+  assert.equal(getUpdateDownloadDirectory("/tmp"), path.join("/tmp", "scoreko-updates"));
   assert.equal(getNodecgBaseUrl("9090"), "http://127.0.0.1:9090");
   assert.equal(
     getDashboardUrl("9090", "scoreko-dev", "dashboard/main.html?standalone=true"),
@@ -45,3 +52,8 @@ test("getApplicationPaths keeps packaged root under Electron resources", () => {
   assert.equal(paths.userDataPath, path.join("/users/test/AppData/Roaming", "scoreko"));
   assert.equal(paths.nodecgBaseUrl, "http://127.0.0.1:9090");
 });
+
+test("getSafeChildPath rejects path traversal", () => {
+  assert.equal(getSafeChildPath("/tmp/scoreko-updates", "setup.exe"), path.resolve("/tmp/scoreko-updates/setup.exe"));
+  assert.throws(() => getSafeChildPath("/tmp/scoreko-updates", "../setup.exe"), /outside/);
+});