`[Architecture] Lobstr module uses module-level singleton for pending callbacks — concurrent signing requests corrupt each other`

[cybermax4200]

Why this matters now

With useProofStatus (Issue 4), automatic re-authentication on 401 (via refreshAuthToken), and Lobstr wallet connect all potentially triggering openLobstrForSigning from different code paths, the chance of concurrent calls is real. A second openLobstrForSigning call silently clobbers _pendingResolve / _pendingReject, causing the first caller to never settle and the second to receive the first caller's signed XDR if Lobstr routes the callback to the wrong context.

Problem / What

src/services/lobstr.ts uses module-level mutable singletons:

let _pendingResolve: CallbackResolve | null = null;
let _pendingReject:  CallbackReject  | null = null;

cancelLobstrCallback is called at the top of openLobstrForSigning, which means a second signing request silently cancels the first. The cancel rejection is swallowed by the first caller with no signal.

The correct design is a keyed pending-call registry (a Map<string, {resolve, reject, timer}>) where each call gets a unique correlation ID, and resolveLobstrCallback routes the callback to the correct entry by matching a correlation_id query param that was embedded in the SEP-7 URI's callback URL.

Key Challenges

• The SEP-7 callback URL must embed a correlation ID that Lobstr echoes back in the deep-link. The ecotask://lobstr/callback?xdr=<XDR>&id=<correlationId> format is the minimal change to buildSep7TxUri and parseLobstrCallbackUrl.
• The resolveLobstrCallback function in RootNavigator parses the URL — it must extract the correlation ID and route to the correct pending entry.
• All existing callers pass the Lobstr callback URL opaquely and don't need to know about correlation IDs.
• The timeout from Issue 3 should be stored per-entry in the registry.
• lobstr.test.ts must test the concurrent-call scenario.

Acceptance Criteria

• Two simultaneous openLobstrForSigning calls each receive their own {resolve, reject, timer} entry keyed by a unique correlation ID.
• The second call does NOT cancel the first.
• resolveLobstrCallback routes to the correct entry using the id query param.
• Calling cancelLobstrCallback without an ID cancels all pending entries (for clean teardown on logout/disconnect).
• Test: two concurrent signing promises each settle independently with the correct XDR.

Relevant files / functions

• src/services/lobstr.ts — openLobstrForSigning, resolveLobstrCallback, cancelLobstrCallback, buildSep7TxUri, parseLobstrCallbackUrl
• src/navigation/RootNavigator.tsx — handleUrl
• src/__tests__/lobstr.test.ts

Out of scope

• Changing the Lobstr deep-link scheme registration (AndroidManifest / Info.plist).
• UI for managing multiple pending signing requests.

[Devadakene]

I am experienced enough to implement this issue having worked on similar issues in the past. Please assign

[Santia2004]

Hi! I would like to work on this issue. I have solid experience with TypeScript/JavaScript, backend architectures, and Soroban/Stellar integrations, and I have recently contributed clean, merged implementations across campaign repositories. Please feel free to assign it to me. Thanks!

[playmaker410]

i would love to take this on. I have hands on experience with Rust, Soroban, Cairo, and TypeScript, and I am confident I can deliver a solid solution within 24 hours

[ABEEGOLD]

I'd like to work on this issue.

I reviewed the architecture concern and agree that the current module-level singleton approach creates a race condition whenever multiple signing flows are active. My plan is to replace the global _pendingResolve / _pendingReject state with a correlation-ID-based pending request registry, allowing multiple Lobstr signing sessions to coexist safely.

Implementation plan:

• Introduce a Map<correlationId, { resolve, reject, timer }> registry in lobstr.ts.

• Generate a unique correlation ID for every openLobstrForSigning() call.

• Extend the SEP-7 callback URL to include the correlation ID and ensure it is preserved through the Lobstr redirect flow.

• Update parseLobstrCallbackUrl() and resolveLobstrCallback() to route responses to the correct pending request.

• Keep timeout handling per request instead of globally.

• Preserve existing caller APIs so no consumer changes are required.

• Add teardown support where cancelLobstrCallback() without an ID clears all pending requests.

• Add comprehensive tests covering:

  • Concurrent signing requests.
  • Correct callback routing.
  • Timeout behavior.
  • Global cancellation.
  • Verification that each promise resolves with its own XDR.

I'll validate the implementation by reproducing the concurrent-request scenario described in the issue and ensuring both signing promises settle independently and correctly.

Estimated delivery: 8 hours after assignment.

[grantfox-oss]

🦊 GrantFox — @playmaker410 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #130)
2. Your PR will be reviewed by the ecotask-network maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@playmaker410's PR #140 was approved and merged by @cybermax4200.

🏆 @playmaker410: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (850 total points). Track your full progress on GrantFox.

👏 Great work, @playmaker410! Keep contributing to ecotask-network.