From d43cca984d19aa76b97c5f2e614badb42cda6621 Mon Sep 17 00:00:00 2001
From: Alex Mikhalev <alex@metacortex.engineer>
Date: Mon, 30 Mar 2026 01:43:12 +0200
Subject: [PATCH] fix(automata): correct URL validation logic in
 AutomataPath::from_remote()

The condition used `||` (OR) instead of `&&` (AND), causing De Morgan's law
to make the check always evaluate to true -- rejecting all URLs including
valid http:// and https:// ones. Also adds scheme-specific prefixes
(http:// and https://) instead of bare "http"/"https".

Fixes #139

Co-Authored-By: Terraphim AI <noreply@anthropic.com>
---
 crates/terraphim_automata/src/lib.rs | 44 +++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/crates/terraphim_automata/src/lib.rs b/crates/terraphim_automata/src/lib.rs
index 90740b849..618edc33c 100644
--- a/crates/terraphim_automata/src/lib.rs
+++ b/crates/terraphim_automata/src/lib.rs
@@ -246,7 +246,7 @@ impl Display for AutomataPath {
 impl AutomataPath {
     /// Create a new AutomataPath from a URL
     pub fn from_remote(url: &str) -> Result<Self> {
-        if !url.starts_with("http") || !url.starts_with("https") {
+        if !url.starts_with("http://") && !url.starts_with("https://") {
             return Err(TerraphimAutomataError::Dict(format!(
                 "Invalid URL scheme. Only `http` and `https` are supported right now. Got {}",
                 url
@@ -625,4 +625,46 @@ mod tests {
         let result = load_thesaurus_from_json(invalid_json);
         assert!(result.is_err());
     }
+
+    #[test]
+    fn test_from_remote_accepts_https() {
+        let result = AutomataPath::from_remote("https://example.com/thesaurus.json");
+        assert!(result.is_ok());
+        match result.unwrap() {
+            AutomataPath::Remote(url) => {
+                assert_eq!(url, "https://example.com/thesaurus.json");
+            }
+            AutomataPath::Local(_) => panic!("Expected Remote variant"),
+        }
+    }
+
+    #[test]
+    fn test_from_remote_accepts_http() {
+        let result = AutomataPath::from_remote("http://example.com/thesaurus.json");
+        assert!(result.is_ok());
+        match result.unwrap() {
+            AutomataPath::Remote(url) => {
+                assert_eq!(url, "http://example.com/thesaurus.json");
+            }
+            AutomataPath::Local(_) => panic!("Expected Remote variant"),
+        }
+    }
+
+    #[test]
+    fn test_from_remote_rejects_ftp() {
+        let result = AutomataPath::from_remote("ftp://example.com/thesaurus.json");
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_from_remote_rejects_file_path() {
+        let result = AutomataPath::from_remote("/tmp/thesaurus.json");
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_from_remote_rejects_empty() {
+        let result = AutomataPath::from_remote("");
+        assert!(result.is_err());
+    }
 }