Fix self-signed certificate rejection on iOS (#206) - #209
Merged
Conversation
taylorcox75
added a commit
that referenced
this pull request
Aug 5, 2026
…ev-client bundle ID, and lint/hooks cleanup (#215) * Fix self-signed certificate rejection on iOS (#206) (#209) * Clarify self-signed cert toggle label as untrusted * Update remaining locales for untrusted self-signed cert wording * Fix functional gaps and remove dead code Wires up Automatic Torrent Management toggling and adds Pause Downloads/Uploads to the Transfer tab — both were fully implemented but never reachable from any screen. Also fixes tracker edits to use the atomic editTracker endpoint instead of remove-then-add (which could permanently lose a tracker if the add step failed), restores the missing confirmation toast when disconnecting a server from Settings, fixes the About screen's React Native version never falling back to "N/A", and removes the unreachable Copy Hash action along with its orphaned translation strings. * Redesign toast positioning to avoid blocking header controls Toasts previously anchored near the top by default, directly over the nav-bar band where each screen's own controls live — most visibly the Search tab's Add button, which a toast would sit on top of after every add-torrent action, blocking the next tap until it cleared. Only the torrents list screen had opted in to a header-aware override. Toasts now anchor near the bottom instead, clearing the tab bar by default. This removes the entire class of collision at once rather than requiring each screen to opt in, so the per-screen top-offset override is no longer needed and has been removed. * Clean up lint warnings: unused code and loose types Removes unused imports, variables, and vestigial state across the app and services layer, drops try/catch wrappers that only rethrew, attaches `cause` to a couple of rethrown errors for easier debugging, and replaces `any` in test mocks with proper types (ReturnType casts, ReactTestInstance, etc). No behavior change — internal cleanup only. * Fix hooks correctness warnings from the newer lint rules Reorders several data-loading functions to be declared before the effects that call them (was relying on hoisting order rather than normal declaration order), converts Animated.Value/PanResponder refs created via useRef(...).current to useState so they're not read during render, and reviews every exhaustive-deps warning individually — adding genuinely missing dependencies where safe, and documenting why a handful are deliberately excluded (non-memoized loaders, or values whose object identity churns without their content changing). A residual set of warnings — mostly "pass a stable handler into a render-time helper function" and "sync local state when a modal opens" — are left as-is: they're real patterns used consistently across this codebase, not bugs, and this project doesn't build with the React Compiler, so restructuring them now would trade real risk for no runtime benefit. * Give the dev-client build a distinct bundle ID Setting APP_VARIANT=development via eas.json's development profile env block switches app.config.js to com.taylorcox75.expogo for that build, so it can install side-by-side with the App Store build on device instead of overwriting it. * Fix unreadable dialog button text in dark mode Filled primary/error buttons colored their label with `colors.surface`, which is near-white in light mode but near-black in dark mode — so the delete confirmation's "Torrent Only" / "With Files" buttons, and the same pattern in InputModal, LogViewer and the category editor, rendered dark text on a saturated fill. Adds an `onAccent` color (white in every palette) for text sitting on a filled accent background, and uses it at those four sites. The key is additive, so saved custom themes keep working and simply inherit the default. It's intentionally not exposed in the color picker — on-accent text has one correct value. Also reverts two changes from the previous commit that traded real risk for a silenced warning: the render-time nav-readiness ref in _layout.tsx (the async cold-launch URL handler can resolve before passive effects flush, and that path has regressed repeatedly), and loadServers' added showToast/t dependencies (they feed a useFocusEffect, so an unstable identity there risks a reload loop). Both now carry documented suppressions instead. * Move toast notifications back to the top The bottom position let the keyboard cover a toast on the server add/edit sheets. Anchoring near the top again avoids that, restoring the header-offset override for the torrents list screen so its search/add controls stay clear, and narrowing the toast's side margins slightly. * Update README screenshots and fix changelog entry Replace the old appstore/appstore-ipad PNG screenshots with new JPGs, lay out the top two README images side by side, and rewrite the v3.8.35 changelog entry to match what actually shipped. * README
Merged
taylorcox75
added a commit
that referenced
this pull request
Aug 5, 2026
* Fix self-signed certificate rejection on iOS (#206) (#209) * Clarify self-signed cert toggle label as untrusted * Update remaining locales for untrusted self-signed cert wording * Fix functional gaps and remove dead code Wires up Automatic Torrent Management toggling and adds Pause Downloads/Uploads to the Transfer tab — both were fully implemented but never reachable from any screen. Also fixes tracker edits to use the atomic editTracker endpoint instead of remove-then-add (which could permanently lose a tracker if the add step failed), restores the missing confirmation toast when disconnecting a server from Settings, fixes the About screen's React Native version never falling back to "N/A", and removes the unreachable Copy Hash action along with its orphaned translation strings. * Redesign toast positioning to avoid blocking header controls Toasts previously anchored near the top by default, directly over the nav-bar band where each screen's own controls live — most visibly the Search tab's Add button, which a toast would sit on top of after every add-torrent action, blocking the next tap until it cleared. Only the torrents list screen had opted in to a header-aware override. Toasts now anchor near the bottom instead, clearing the tab bar by default. This removes the entire class of collision at once rather than requiring each screen to opt in, so the per-screen top-offset override is no longer needed and has been removed. * Clean up lint warnings: unused code and loose types Removes unused imports, variables, and vestigial state across the app and services layer, drops try/catch wrappers that only rethrew, attaches `cause` to a couple of rethrown errors for easier debugging, and replaces `any` in test mocks with proper types (ReturnType casts, ReactTestInstance, etc). No behavior change — internal cleanup only. * Fix hooks correctness warnings from the newer lint rules Reorders several data-loading functions to be declared before the effects that call them (was relying on hoisting order rather than normal declaration order), converts Animated.Value/PanResponder refs created via useRef(...).current to useState so they're not read during render, and reviews every exhaustive-deps warning individually — adding genuinely missing dependencies where safe, and documenting why a handful are deliberately excluded (non-memoized loaders, or values whose object identity churns without their content changing). A residual set of warnings — mostly "pass a stable handler into a render-time helper function" and "sync local state when a modal opens" — are left as-is: they're real patterns used consistently across this codebase, not bugs, and this project doesn't build with the React Compiler, so restructuring them now would trade real risk for no runtime benefit. * Give the dev-client build a distinct bundle ID Setting APP_VARIANT=development via eas.json's development profile env block switches app.config.js to com.taylorcox75.expogo for that build, so it can install side-by-side with the App Store build on device instead of overwriting it. * Fix unreadable dialog button text in dark mode Filled primary/error buttons colored their label with `colors.surface`, which is near-white in light mode but near-black in dark mode — so the delete confirmation's "Torrent Only" / "With Files" buttons, and the same pattern in InputModal, LogViewer and the category editor, rendered dark text on a saturated fill. Adds an `onAccent` color (white in every palette) for text sitting on a filled accent background, and uses it at those four sites. The key is additive, so saved custom themes keep working and simply inherit the default. It's intentionally not exposed in the color picker — on-accent text has one correct value. Also reverts two changes from the previous commit that traded real risk for a silenced warning: the render-time nav-readiness ref in _layout.tsx (the async cold-launch URL handler can resolve before passive effects flush, and that path has regressed repeatedly), and loadServers' added showToast/t dependencies (they feed a useFocusEffect, so an unstable identity there risks a reload loop). Both now carry documented suppressions instead. * Move toast notifications back to the top The bottom position let the keyboard cover a toast on the server add/edit sheets. Anchoring near the top again avoids that, restoring the header-offset override for the torrents list screen so its search/add controls stay clear, and narrowing the toast's side margins slightly. * Update README screenshots and fix changelog entry Replace the old appstore/appstore-ipad PNG screenshots with new JPGs, lay out the top two README images side by side, and rewrite the v3.8.35 changelog entry to match what actually shipped. * README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RCTHTTPRequestHandlernever implements the TLS challenge delegate method, so a self-signed certificate is silently rejected even after the user manually installs and fully trusts it on-device — Safari accepts it, the app doesn't.modules/insecure-cert-allowlist) that fills in the missing delegate via an Obj-C category onRCTHTTPRequestHandler, accepting the TLS handshake only for hosts explicitly opted in (ServerConfig.allowInsecureCert). Every other host and every non-server-trust challenge (Basic Auth, client cert) falls through to default handling unchanged.Test plan
npx tsc --noEmit— cleannpm test— full suite passing, including i18n locale parity across all 6 localesnpm run lint— 0 errorsnpm run xcodeto compile)Fixes #206