From 491ba9fdeb4897318b211b9536ce2e230e0e079c Mon Sep 17 00:00:00 2001
From: sovITxyz <git@sovit.xyz>
Date: Fri, 17 Jul 2026 19:56:10 -0600
Subject: [PATCH] fix: Blossom upload fails over across all servers before
 giving up
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A single server's error (a 4xx throttle/whitelist quirk or a 5xx) no
longer aborts the upload — the client now tries every mirror in turn and
only reports failure when all four fail. Observed in a post-deploy smoke
where one server 500'd and another 400'd while a third accepted the same
request cleanly; the previous 4xx-abort would have stopped early.
---
 public/js/blossom.js | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/public/js/blossom.js b/public/js/blossom.js
index 93f38ea..f041b1a 100644
--- a/public/js/blossom.js
+++ b/public/js/blossom.js
@@ -8,7 +8,8 @@
 // with NbreadSigner -> PUT the raw bytes to the PRIMARY server's /upload ->
 // validate the returned descriptor (https URL + sha match) -> best-effort
 // mirror the URL (BUD-04, no re-upload) to the remaining servers. On a
-// network/5xx/429/timeout failure the next server is promoted to primary.
+// any per-server failure the next server is promoted to primary, so the
+// whole mirror set is tried before an upload is reported as failed.
 //
 // Load order (classic <script> includes, no modules):
 //   vendor/nostr-crypto.js -> signer stack -> blossom.js -> editor-toolbar.js
@@ -294,17 +295,14 @@
           },
           function (err) {
             lastErr = err;
-            // 4xx (except 429) is an auth/permission problem — surface it.
-            if (
-              err &&
-              typeof err.status === "number" &&
-              err.status >= 400 &&
-              err.status < 500 &&
-              err.status !== 429
-            ) {
-              throw err;
-            }
-            // network error / 5xx / 429 / timeout: promote the next server.
+            // Advance to the next server on ANY failure. Different public
+            // Blossom servers have different upload policies, rate limits,
+            // and transient errors (a 4xx from one — throttle, whitelist,
+            // size/type quirk — or a 5xx/network blip must not abort the
+            // others), so we exhaust the whole mirror set before giving up.
+            // Only when every server has failed does attempt() reject with
+            // the last error. Client-side validateFile already caps size and
+            // type, so this can't loop on an oversized/unsupported blob.
             return attempt(i + 1);
           },
         );