@@ -140,9 +140,11 @@ pub enum ConnStatus {
143−#[derive(Clone, Copy, PartialEq, Eq, Debug)]
143+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
144pub enum Page {
144pub enum Page {
145− Setup,
145+ /// The shell renders a spinner until `IdentityLoaded` arrives, so there is
146+ /// no distinct pre-identity page — conversations is the landing page.
146 Conversations,
148 Conversations,
148 AddContact,
150 AddContact,
@@ -162,6 +164,9 @@ pub struct Model {
162 token: Option<String>,
164 token: Option<String>,
163 conn: ConnStatus,
165 conn: ConnStatus,
164 poll_retries: u32,
166 poll_retries: u32,
167+ /// A poll request is in flight. Guards against stacking concurrent long-poll
168+ /// loops (every extra loop re-polls itself forever and never terminates).
165 flushing: bool,
170 flushing: bool,
166 page: Page,
171 page: Page,
167 active_peer: Option<String>,
172 active_peer: Option<String>,
@@ -183,8 +188,9 @@ impl Default for Model {
183 token: None,
188 token: None,
184 conn: ConnStatus::Offline,
189 conn: ConnStatus::Offline,
185 poll_retries: 0,
190 poll_retries: 0,
186 flushing: false,
192 flushing: false,
187− page: Page::Setup,
193+ page: Page::default(),
188 active_peer: None,
194 active_peer: None,
189 compose: String::new(),
195 compose: String::new(),
190 error: None,
196 error: None,
@@ -220,6 +226,30 @@ fn server_host(url: &str) -> String {
220 host.trim_end_matches('.').to_lowercase()
226 host.trim_end_matches('.').to_lowercase()
229+/// Validate and canonicalize a user-entered relay URL.
231+/// The shell hands us raw text-field contents, and `Http::post` panics on a URL
232+/// with no scheme — so a schemeless entry must be rejected here, in the core,
233+/// before it can ever reach an effect. Returns the normalized URL (lowercased
234+/// scheme, no trailing slash) or `None` if it isn't an absolute http(s) URL.
235+fn normalize_server_url(input: &str) -> Option<String> {
236+ let (scheme, rest) = input.trim().split_once("://")?;
237+ if !scheme.eq_ignore_ascii_case("http") && !scheme.eq_ignore_ascii_case("https") {
240+ let rest = rest.trim_end_matches('/');
241+ if rest.chars().any(char::is_whitespace) {
244+ // Require a non-empty authority: reject "http://", "http:///x", "http://:80".
245+ let authority = rest.split('/').next().unwrap_or("");
246+ let host = authority.split('@').next_back().unwrap_or(authority);
247+ if host.split(':').next().unwrap_or("").is_empty() {
250+ Some(format!("{}://{}", scheme.to_lowercase(), rest))
223fn json_bytes<T: Serialize>(value: &T) -> Vec<u8> {
253fn json_bytes<T: Serialize>(value: &T) -> Vec<u8> {
224 serde_json::to_vec(value).unwrap_or_default()
254 serde_json::to_vec(value).unwrap_or_default()
@@ -391,6 +421,11 @@ impl App for Skrepka {
393 Event::SetServerUrl(url) => {
423 Event::SetServerUrl(url) => {
424+ let Some(url) = normalize_server_url(&url) else {
425+ model.error = Some("server URL must start with http:// or https://".into());
394 model.settings.server_url = url;
429 model.settings.server_url = url;
395 model.token = None;
430 model.token = None;
396 model.conn = ConnStatus::Offline;
431 model.conn = ConnStatus::Offline;
@@ -484,7 +519,11 @@ impl App for Skrepka {
485 match Http::post(url).body_json(&body) {
520 match Http::post(url).body_json(&body) {
486 Ok(req) => req.build().then_send(Event::ChallengeResult).and(render()),
521 Ok(req) => req.build().then_send(Event::ChallengeResult).and(render()),
487− Err(_) => render(),
522+ Err(_) => {
523+ model.conn = ConnStatus::Offline;
524+ model.error = Some("could not build auth request".into());
525+ self.schedule_reconnect(model)
490 Event::ChallengeResult(Ok(mut resp)) => {
529 Event::ChallengeResult(Ok(mut resp)) => {
@@ -505,7 +544,11 @@ impl App for Skrepka {
506 match Http::post(url).body_json(&body) {
545 match Http::post(url).body_json(&body) {
507 Ok(req) => req.build().then_send(Event::VerifyResult),
546 Ok(req) => req.build().then_send(Event::VerifyResult),
508− Err(_) => render(),
547+ Err(_) => {
548+ model.conn = ConnStatus::Offline;
549+ model.error = Some("could not build auth request".into());
550+ self.schedule_reconnect(model)
511 Err(_) => {
554 Err(_) => {
@@ -543,6 +586,11 @@ impl App for Skrepka {
544 // ---------------- poll ----------------
587 // ---------------- poll ----------------
545 Event::Poll => {
588 Event::Poll => {
589+ // Exactly one poll loop at a time: each PollResult re-issues Poll,
590+ // so a second concurrent loop would double forever.
592+ return Command::done();
546 let Some(token) = model.token.clone() else {
594 let Some(token) = model.token.clone() else {
547 return Command::event(Event::Authenticate);
595 return Command::event(Event::Authenticate);
@@ -554,11 +602,18 @@ impl App for Skrepka {
554 .header("authorization", format!("Bearer {token}"))
602 .header("authorization", format!("Bearer {token}"))
555 .body_json(&body)
603 .body_json(&body)
606+ model.polling = true;
557− Ok(req) => req.build().then_send(Event::PollResult),
607+ req.build().then_send(Event::PollResult)
558− Err(_) => render(),
609+ Err(_) => {
610+ model.error = Some("could not build poll request".into());
611+ self.backoff_poll(model)
561 Event::PollResult(Ok(mut resp)) => {
615 Event::PollResult(Ok(mut resp)) => {
616+ model.polling = false;
562 let status = u16::from(resp.status());
617 let status = u16::from(resp.status());
563 if status == 401 {
618 if status == 401 {
564 model.token = None;
619 model.token = None;
@@ -576,15 +631,20 @@ impl App for Skrepka {
576 .and(Command::event(Event::Poll))
631 .and(Command::event(Event::Poll))
577 .and(render())
632 .and(render())
634+ Event::PollResult(Err(_)) => {
635+ model.polling = false;
579− Event::PollResult(Err(_)) => self.backoff_poll(model),
636+ self.backoff_poll(model)
581 // ---------------- outbox ----------------
639 // ---------------- outbox ----------------
582 Event::StartFlush => self.flush_next(model),
640 Event::StartFlush => self.flush_next(model),
583 Event::SendResult(Ok(resp)) => {
641 Event::SendResult(Ok(resp)) => {
642+ // The in-flight send is over; `flush_next` refuses to run while
643+ // this is set, so it must be cleared before *any* branch below.
644+ model.flushing = false;
584 let status = u16::from(resp.status());
645 let status = u16::from(resp.status());
585 if status == 401 {
646 if status == 401 {
586 model.token = None;
647 model.token = None;
587− model.flushing = false;
588 return Command::event(Event::Authenticate);
648 return Command::event(Event::Authenticate);
590 if (200..300).contains(&status) || status == 400 {
650 if (200..300).contains(&status) || status == 400 {
@@ -593,7 +653,6 @@ impl App for Skrepka {
593 return self.persist_outbox(model).and(self.flush_next(model));
653 return self.persist_outbox(model).and(self.flush_next(model));
595 // transient error — stop; will resume on next connect/poll.
655 // transient error — stop; will resume on next connect/poll.
596− model.flushing = false;
599 Event::SendResult(Err(_)) => {
658 Event::SendResult(Err(_)) => {
@@ -605,7 +664,6 @@ impl App for Skrepka {
606 fn view(&self, model: &Model) -> ViewModel {
665 fn view(&self, model: &Model) -> ViewModel {
607 let page = match model.page {
666 let page = match model.page {
608− Page::Setup => "setup",
609 Page::Conversations => "conversations",
667 Page::Conversations => "conversations",
610 Page::Chat => "chat",
668 Page::Chat => "chat",
611 Page::AddContact => "add_contact",
669 Page::AddContact => "add_contact",
@@ -817,7 +875,10 @@ impl Skrepka {
818 Ok(req) => req.build().then_send(Event::SendResult),
876 Ok(req) => req.build().then_send(Event::SendResult),
819 Err(_) => {
877 Err(_) => {
878+ // Not a dead loop: the next StartFlush (from a poll page or a
879+ // fresh send) retries the head of the outbox.
820 model.flushing = false;
880 model.flushing = false;
881+ model.error = Some("could not build send request".into());
@@ -950,10 +1011,11 @@ mod tests {
951 fn with_identity() -> Model {
1012 fn with_identity() -> Model {
952 let id = Identity::from_seed(&[3u8; 32]);
1013 let id = Identity::from_seed(&[3u8; 32]);
953− let mut m = Model::default();
1014+ Model {
954− m.secret_key = Some(id.secret_key.to_vec());
1015+ secret_key: Some(id.secret_key.to_vec()),
955− m.my_pubkey = id.public_key_hex();
1016+ my_pubkey: id.public_key_hex(),
956− m
1017+ ..Default::default()
959 fn peer_hex(seed: u8) -> String {
1021 fn peer_hex(seed: u8) -> String {
@@ -1058,6 +1120,112 @@ mod tests {
1058 assert!(vm.contacts.iter().any(|c| c.pubkey == peer && c.blocked));
1120 assert!(vm.contacts.iter().any(|c| c.pubkey == peer && c.blocked));
1124+ fn normalize_server_url_requires_an_http_scheme() {
1126+ normalize_server_url(" https://Relay.Example.com/ "),
1127+ Some("https://Relay.Example.com".to_string())
1130+ normalize_server_url("HTTP://localhost:8080///"),
1131+ Some("http://localhost:8080".to_string())
1133+ // The cases that used to panic Http::post or produce a dead URL.
1134+ assert_eq!(normalize_server_url("relay.example.com"), None);
1135+ assert_eq!(normalize_server_url("localhost:8080"), None);
1136+ assert_eq!(normalize_server_url("ftp://relay.example.com"), None);
1137+ assert_eq!(normalize_server_url("http://"), None);
1138+ assert_eq!(normalize_server_url("http://:8080"), None);
1139+ assert_eq!(normalize_server_url("https://relay example.com"), None);
1140+ assert_eq!(normalize_server_url(""), None);
1144+ fn set_server_url_rejects_schemeless_and_keeps_the_old_url() {
1146+ let mut m = with_identity();
1147+ let original = m.settings.server_url.clone();
1149+ let _ = app.update(Event::SetServerUrl("relay.example.com".into()), &mut m);
1150+ assert_eq!(m.settings.server_url, original, "bad URL must not persist");
1151+ assert!(m.error.is_some());
1153+ let _ = app.update(
1154+ Event::SetServerUrl(" https://relay.example.com/ ".into()),
1157+ assert_eq!(m.settings.server_url, "https://relay.example.com");
1158+ assert!(m.error.is_none());
1159+ assert!(m.token.is_none());
1160+ assert_eq!(m.conn, ConnStatus::Offline);
1163+ /// The regression that stalled the outbox: `flushing` stayed `true` forever
1164+ /// after the first successful send, so nothing was ever sent again.
1166+ fn send_result_ok_clears_flushing() {
1168+ let mut m = with_identity();
1169+ m.token = Some("t".into());
1171+ m.outbox.push_back(OutboxItem {
1172+ recipient: peer_hex(9),
1173+ envelope_json: "{}".into(),
1176+ let resp = crux_http::testing::ResponseBuilder::ok().body(Vec::new()).build();
1177+ let _ = app.update(Event::SendResult(Ok(resp)), &mut m);
1179+ assert!(!m.flushing, "flushing must be cleared on the success path");
1180+ assert!(m.outbox.is_empty(), "the sent item is dropped from the outbox");
1184+ fn flush_next_resumes_after_a_successful_send() {
1186+ let mut m = with_identity();
1187+ m.token = Some("t".into());
1189+ m.outbox.push_back(OutboxItem {
1190+ recipient: peer_hex(9),
1191+ envelope_json: "{}".into(),
1194+ // First send goes out and marks the model as flushing.
1195+ let _ = app.update(Event::StartFlush, &mut m);
1196+ assert!(m.flushing);
1198+ // Its success must both drop the item and let the *next* one go out.
1199+ let resp = crux_http::testing::ResponseBuilder::ok().body(Vec::new()).build();
1200+ let _ = app.update(Event::SendResult(Ok(resp)), &mut m);
1201+ assert_eq!(m.outbox.len(), 1);
1202+ assert!(m.flushing, "the second item is now in flight");
1206+ fn poll_is_a_noop_while_a_poll_is_already_in_flight() {
1208+ let mut m = with_identity();
1209+ m.token = Some("t".into());
1211+ let _ = app.update(Event::Poll, &mut m);
1212+ assert!(m.polling, "the first Poll issues a request");
1214+ // A second Poll (e.g. from a re-auth) must not stack another loop.
1215+ let _ = app.update(Event::Poll, &mut m);
1216+ assert!(m.polling);
1218+ // Both success and failure release the guard so the loop can continue.
1219+ let resp = crux_http::testing::ResponseBuilder::ok().body(Vec::new()).build();
1220+ let _ = app.update(Event::PollResult(Ok(resp)), &mut m);
1221+ assert!(!m.polling);
1223+ let _ = app.update(Event::Poll, &mut m);
1224+ assert!(m.polling);
1225+ let _ = app.update(Event::PollResult(Err(crux_http::HttpError::Timeout)), &mut m);
1226+ assert!(!m.polling);
1062 fn view_exposes_identity_and_ob() {
1230 fn view_exposes_identity_and_ob() {
1063 let app = Skrepka;
1231 let app = Skrepka;