Use Praxa from SwiftUI

​

Prerequisites

• an authenticated application backend that owns the Praxa credential;
• a reviewed mobile session mechanism and an app-facing bounded API contract;
• a simulator or emulator plus at least one physical-device test plan;
• synthetic data and a persisted local request identifier for lifecycle recovery;
• an acceptance assertion that proves the SwiftUI app uses only its backend and recovers one request across cancellation and activation.

​

1. Define app-facing models

import Foundation

struct TaskSubmission: Encodable {
    let task: String
    let requestId: String
}

struct TaskRun: Decodable {
    let runId: String
    let status: String
}

​

2. Implement the client

import Foundation

enum TaskClientError: Error {
    case invalidResponse
    case http(Int)
}

struct PraxaBackendClient {
    let applicationOrigin: URL
    let session: URLSession
    let applicationToken: @Sendable () async throws -> String

    func submitTask(
        text: String,
        requestId: UUID
    ) async throws -> TaskRun {
        let url = applicationOrigin.appending(path: "api/tasks")
        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.timeoutInterval = 30
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
        request.setValue(
            "Bearer \(try await applicationToken())",
            forHTTPHeaderField: "Authorization"
        )
        request.httpBody = try JSONEncoder().encode(
            TaskSubmission(task: text, requestId: requestId.uuidString.lowercased())
        )

        let (data, response) = try await session.data(for: request)
        guard let http = response as? HTTPURLResponse else {
            throw TaskClientError.invalidResponse
        }
        guard (200..<300).contains(http.statusCode) else {
            throw TaskClientError.http(http.statusCode)
        }
        return try JSONDecoder().decode(TaskRun.self, from: data)
    }
}

​

3. Preserve retry identity in the view model

@MainActor
final class TaskViewModel: ObservableObject {
    @Published var state: State = .idle
    private var pendingRequestId: UUID?

    func submit(text: String, client: PraxaBackendClient) async {
        let requestId = pendingRequestId ?? UUID()
        pendingRequestId = requestId
        state = .sending
        do {
            let run = try await client.submitTask(text: text, requestId: requestId)
            state = .admitted(run)
        } catch is CancellationError {
            state = .unknown(requestId)
        } catch {
            state = .failed(customerSafeMessage(for: error), requestId)
        }
    }
}

​

4. Test with URLProtocol

• requests target only your application origin;
• application auth is present and Praxa credentials are absent;
• JSON contains only task and request ID;
• retry reuses the same UUID;
• 401, 409, 429, timeout, and invalid JSON map to distinct states;
• cancellation preserves an unknown/reconciliation state.

​

5. Verify on a device

1. Sign into a staging application account.
2. Submit disposable work.
3. Background the app during admission or polling.
4. Restore the app and reconcile using saved request/run identity.
5. Confirm the Praxa key is absent from the archived app and network logs.
6. Revoke the backend test key after the test.

​

Troubleshooting

​

Best practices

• Use URLSession with HTTPS and explicit timeout/cancellation.
• Keep only application session material in Keychain when required.
• Never log task text or tokens through print, OSLog, crash, or analytics defaults.
• Make loading, unknown, admitted, running, failed, and completed states explicit.
• Test App Transport Security and real-device lifecycle behavior.

​

Optimize for production

• Debounce repeated UI actions while preserving the same logical request ID.
• Return small app-facing projections and paginate history instead of copying upstream payloads.
• Reconcile on foreground with one bounded read rather than restarting the operation.
• Measure device-to-backend latency, resume success, duplicate prevention, payload size, and energy impact.

​

Cleanup and next steps

1. Revoke disposable backend credentials and test application sessions.
2. Delete synthetic server records and clear test-only secure-storage entries.
3. Remove captured screenshots, logs, and crash reports containing synthetic payloads.
4. Record physical-device, background, and recovery checks separately from unit tests.

​

Frequently asked questions

​

What proves this tutorial works?

​

Can a browser, mobile app, or model prompt hold the credential?

​

How should an ambiguous mutation be retried?

​

What should we monitor after release?