Commit f2e89c094937c86ace1a3078d7d48d6056a5d933 | snowbound

author	clover caruso <git@paperclover.net> 2026-10-15 07:57:52-07:00
committer	clover caruso <git@paperclover.net> 2026-10-15 08:34:53-07:00
log	f2e89c094937c86ace1a3078d7d48d6056a5d933
tree	449faa43d4ad8adc7486317ba2bacd222c891e38
parent	1acd26a738c5504b6ce961d8065e7149b3035241
signature	Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU (~clover)

fix(live): a refused guest hears its code was wrong before the relay hangs up

When a code's owner judged a wrong guess before the guest did, its "failed" verdict made the relay close the guest's outbox, which threw away the owner's hello still queued for it. The guest saw its line break instead of a wrong secret, dialled the room again and guessed a second time, so one mistyped code spent two of the tries before a burn and two of the address's failures a minute. A guest could then read the next wrong code as expired, or be locked out early. The relay now writes what is queued before hanging up, and drops it only for a peer too slow to take it or a write that failed.

Fixes #150

Assisted-by: claude-opus-5.5

2 files changed, 23 insertions(+), 12 deletions(-)

crates
- relay
  - src
    server.rs
  - tests
    relay.rs

crates/relay/src/server.rs+16-11

 @@ -935,13 +935,13 @@ impl Outbox {
         }
     }
-    /// Everything queued, waiting up to `wait` for something; none once closed.
+    /// Everything queued, waiting up to `wait` for something; none once closed and empty.
     fn take(&self, wait: Duration) -> Option<Vec<u8>> {
         let mut queue = self.queue.lock().unwrap();
         if queue.frames.is_empty() && !queue.closed {
             queue = self.ready.wait_timeout(queue, wait).unwrap().0;
         }
-        if queue.closed {
+        if queue.closed && queue.frames.is_empty() {
             return None;
         }
         queue.bytes = 0;
 @@ -956,7 +956,7 @@ impl Outbox {
         }
         if queue.bytes + frame.len() > self.most {
             drop(queue);
-            self.close();
+            self.abort();
             return;
         }
         queue.bytes += frame.len();
 @@ -964,14 +964,19 @@ impl Outbox {
         self.ready.notify_one();
     }
+    /// Hangs up after writing what is queued, which tells a refused guest its code was wrong.
     fn close(&self) {
-        let mut queue = self.queue.lock().unwrap();
+        self.queue.lock().unwrap().closed = true;
-        *queue = Queue {
+        self.ready.notify_one();
+    }
+    /// Hangs up now, dropping what is queued.
+    fn abort(&self) {
+        *self.queue.lock().unwrap() = Queue {
             closed: true,
             ..Queue::default()
         };
         self.ready.notify_one();
-        drop(queue);
         if let Some(stream) = &self.stream {
             let _ = stream.shutdown(Shutdown::Both);
         }
 @@ -983,13 +988,14 @@ impl Outbox {
             let frame = {
                 let mut queue = self.queue.lock().unwrap();
                 loop {
-                    if queue.closed {
-                        return;
-                    }
                     if let Some(frame) = queue.frames.pop_front() {
                         queue.bytes -= frame.len();
                         break frame;
                     }
+                    if queue.closed {
+                        drop(queue);
+                        return self.abort();
+                    }
                     queue = self.ready.wait(queue).unwrap();
                 }
             };
 @@ -997,8 +1003,7 @@ impl Outbox {
                 return;
             };
             if stream.write_all(&frame).is_err() {
-                self.close();
+                return self.abort();
-                return;
             }
         }
     }

crates/relay/tests/relay.rs+7-1

 @@ -275,7 +275,8 @@ fn an_unknown_code_or_room_is_refused() {
     assert_eq!(status(relay.join("/v1/room/")), "HTTP/1.1 404 Not Found");
 }
-/// Five wrong codes burn a code: it admits no one new, and its owner hears so.
+/// Five wrong codes burn a code: it admits no one new, and its owner hears so. A wrong guess
+/// still hears what the owner said before refusing it.
 #[test]
 fn wrong_codes_burn_a_code() {
     let relay = Relay::start(&["--failures-per-minute", "100"]);
 @@ -285,7 +286,12 @@ fn wrong_codes_burn_a_code() {
         let mut guess = relay.join(&path).unwrap();
         assert_eq!(guess.text(), format!("welcome {slot} 1"));
         assert_eq!(owner.text(), format!("joined {slot}"));
+        owner.send_to(slot, b"hello");
         owner.say(&format!("failed {slot}"));
+        assert_eq!(
+            guess.hear(),
+            Message::Binary([&1u32.to_be_bytes()[..], b"hello"].concat())
+        );
         assert!(guess.closed(Duration::from_secs(5)));
         assert_eq!(owner.text(), format!("left {slot}"));
     }