From 7e54a26aac2f99b3c7d75816d34cd3899039425e Mon Sep 17 00:00:00 2001
From: Jay <jay@wisehodl.dev>
Date: Sun, 9 Aug 2026 18:58:13 -0400
Subject: [PATCH] security: do not silence Connect() errors; read values and
 use under the same lock.

Ignoring Connect() errors can sometimes cause double-registration.
Reading values under one lock and using them under another allows for values to change in the gap between them.
---
 embassy.go | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/embassy.go b/embassy.go
index 5cb9cb6..2ece61d 100644
--- a/embassy.go
+++ b/embassy.go
@@ -143,17 +143,18 @@ func (e *Embassy) Dispatch(url string) error {
 		return fmt.Errorf("invalid url: %w", err)
 	}
 
-	e.mu.RLock()
+	e.mu.Lock()
 	_, exists := e.envoys[url]
 	if exists {
-		e.mu.RUnlock()
+		e.mu.Unlock()
 		return fmt.Errorf("already dispatched: %s", url)
 	}
-	e.mu.RUnlock()
 
-	e.mu.Lock()
-
-	e.pool.Connect(url)
+	err = e.pool.Connect(url)
+	if err != nil {
+		e.mu.Unlock()
+		return err
+	}
 
 	terminate := func() { e.dismiss(url) }
 	send := func(data []byte) error { return e.send(url, data) }