mirror of
https://github.com/block/buzz.git
synced 2026-11-03 07:51:22 +00:00
5bbdd5c63b
A receipt-less buzz://join claim first discovers the relay's join policy through the webview fetch path, which had no deadline, no body cap, and no way to cancel. A relay whose /api/join-policy blackholed, trickled, or streamed an oversized body left onboarding on "Accepting your invite…" forever, and cancelling did not stop the download. The webview branch of getJoinPolicy now matches the native fetch_join_policy bounds: one 15 s deadline covers the headers and the whole body, and the body is capped at 4 MiB while it streams (a larger declared Content-Length fails up front). A timeout surfaces as "The community's join policy took too long to load.", which the claiming stage shows with Retry. getJoinPolicy takes an optional AbortSignal, and useClaimInvite aborts the pending lookup when its transaction is cancelled, replaced, or unmounted. The existing transaction fence still drops any late settlement. The useClaimInvite jsdom suite gains a journey with a suspended /api/join-policy: no error at 14.999 s, a retryable timeout at 15 s with zero claims, then a retry that claims once against a policy-free relay. The single cancel test becomes a cancel/reopen table. Each row asserts the lookup's signal is aborted and that a late policy response neither claims nor moves the cleared or replacement transaction. A getJoinPolicy test rejects both a streamed and a declared body over 4 MiB. Removing the abort, the fence, the timer, or the cap each fails its test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>