fix: resolve per-torrent qb save paths

tests/test_resources.py

@@ -40,6 +40,7 @@ class ResourceTests(unittest.TestCase):
                 "hash": decoded.info_hash_v2_hex,
                 "name": "v2.bin",
                 "state": "stoppedUP",
+                "save_path": "/downloads",
             },
             [{
                 "index": 0,
@@ -91,6 +92,7 @@ class ResourceTests(unittest.TestCase):
                 "hash": decoded.info_hash_v1_hex,
                 "name": "resource",
                 "state": "stoppedUP",
+                "save_path": "/downloads/nested",
             },
             [
                 {
@@ -106,6 +108,7 @@ class ResourceTests(unittest.TestCase):
             observed,
         )
         summary = normalized.summary
+        self.assertEqual(normalized.save_path.as_posix(), "/downloads/nested")
         self.assertEqual(
             summary.runtime_state, resource_pb2.TORRENT_RUNTIME_STATE_STOPPED
         )
@@ -139,6 +142,7 @@ class ResourceTests(unittest.TestCase):
                 "hash": torrent_hash,
                 "name": "with-padding",
                 "state": "stalledUP",
+                "save_path": "/downloads",
             },
             [
                 {
@@ -169,7 +173,7 @@ class ResourceTests(unittest.TestCase):
         metainfo = encode({b"info": info})
         torrent = {
             "hash": hashlib.sha1(encode(info)).hexdigest(),
-            "name": "renamed", "state": "uploading",
+            "name": "renamed", "state": "uploading", "save_path": "/downloads",
         }
         renamed = normalize_resource(torrent, [{
             "index": 0, "name": "renamed.txt", "size": 3,
@@ -182,6 +186,23 @@ class ResourceTests(unittest.TestCase):
                 "progress": 1.0, "priority": 1,
             }], metainfo)
 
+    def test_missing_or_out_of_shape_save_path_is_rejected(self):
+        info = {
+            b"length": 3, b"name": b"a.txt", b"piece length": 16384,
+            b"pieces": b"x" * 20,
+        }
+        metainfo = encode({b"info": info})
+        torrent = {
+            "hash": hashlib.sha1(encode(info)).hexdigest(),
+            "name": "a.txt", "state": "uploading", "save_path": "relative",
+        }
+        with self.assertRaisesRegex(ResourceError, "save path is unsafe"):
+            normalize_resource(torrent, [{
+                "index": 0, "name": "a.txt", "size": 3,
+                "completed": 3, "priority": 1,
+            }], metainfo)
+
+
     def test_noncanonical_bencode_is_rejected(self):
         with self.assertRaisesRegex(BencodeError, "unsorted"):
             decode_metainfo(b"d4:infod1:b1:x1:a1:yee")