halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(app): a one-word address is refused at once; this machine's is reached over HTTP

Browse source 
An address of one word (`todo`) was read as https://todo/ and looked for,
the person waiting up to 15 s for no instance to answer. A host is now a
domain of two labels or more, an IP address or localhost; anything else is
"This isn't an address." as it is typed. localhost and loopback addresses
typed without a scheme are reached over HTTP, as a server running on the
same machine has no certificate; HTTPS where typed (the developer's
review, 9 Nov 2026).

Whats-New: An address of a single word is now refused at once, rather than looked for.
Whats-New-De: Eine Adresse aus nur einem Wort wird jetzt sofort abgelehnt, statt danach zu suchen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-09 23:15:27 +01:00
commit f7341922e5
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 74 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

35
packages/halkyon_app/lib/src/instance/instance.dart
View file

@ -11,22 +11,32 @@ final class const Instance._(
) with Equatable {
/// The instance at [address] as a person types it or a build names it:
/// `learn.example.org`, with `https://` or without, with a port or a path
/// or not; null for an address that can't be one.
/// or not; null for an address that can't be one. Its host is a domain of
/// two labels or more, an IP address, or `localhost`: a single word
/// (`todo`) is refused as typed rather than looked for, as no instance on
/// the internet has one. Without a scheme it is HTTPS, but on this
/// machine, where a server running has no certificate: HTTP (the
/// developer's review, 9 Nov 2026).
static Instance? parse(String address) {
var text = address.trim();
if (text.isEmpty || text.contains(RegExp(r'\s'))) {
return null;
}
if (!text.contains('://')) {
final typedScheme = text.contains('://');
if (!typedScheme) {
text = 'https://$text';
}
final url = Uri.tryParse(text);
var url = Uri.tryParse(text);
if (url == null ||
!(url.isScheme('https') || url.isScheme('http')) ||
url.host.isEmpty ||
url.userInfo.isNotEmpty) {
url.userInfo.isNotEmpty ||
!_isHost(url.host)) {
return null;
}
if (!typedScheme && _isThisMachine(url.host)) {
url = url.replace(scheme: 'http');
}
final path = url.path.endsWith('/') ? url.path : '${url.path}/';
return Instance._(
Uri(
@ -43,10 +53,19 @@ final class const Instance._(
/// `::1`), which never leaves it. Plain HTTP anywhere else would let
/// anyone on the way read and change it: the proofs that sign in, the
/// keys' wrappings, every request a session carries (ADR 0017).
bool get isSecure =>
url.isScheme('https') ||
url.host == 'localhost' ||
(InternetAddress.tryParse(url.host)?.isLoopback ?? false);
bool get isSecure => url.isScheme('https') || _isThisMachine(url.host);
/// Whether [host] is this machine: `localhost`, `127.0.0.0/8` or `::1`.
static bool _isThisMachine(String host) =>
host.toLowerCase() == 'localhost' ||
(InternetAddress.tryParse(host)?.isLoopback ?? false);
/// Whether [host] can be an instance's: an IP address, `localhost`, or a
/// domain of two labels or more, none empty.
static bool _isHost(String host) =>
InternetAddress.tryParse(host) != null ||
host.toLowerCase() == 'localhost' ||
(host.contains('.') && !host.split('.').any((label) => label.isEmpty));
/// How people know it: its host, with the port if it has one
/// (`learn.halkyon.eu`, `localhost:8080`).