From c75bd776d689349106259224f7365f5512b441c8 Mon Sep 17 00:00:00 2001
From: Adron Hall <adronhall@gmail.com>
Date: Wed, 16 Sep 2026 14:07:41 -0700
Subject: [PATCH] feat(blog): reach the blog from the app via a themed Custom
 Tab
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The blog at /blog is server-rendered and the API exposes no listing or post
endpoint, so there is nothing to render in-app and scraping HTML is not an
option. Reaching it is therefore a routing decision, not a data-layer one — no
DTOs, no Room, no repository.

- The Account hub's menu gains a Blog row that opens the blog in a Custom Tab
  coloured from the live MaterialTheme colour scheme, which InterlinedListTheme
  has already resolved from the user's System/Light/Dark setting, so the tab
  follows that setting with no extra plumbing. The row carries an "opens outside
  the app" affordance instead of the forward arrow the in-app rows use;
  AccountMenuRow gained an optional trailing icon for that, defaulted to the
  existing arrow so every other row is unchanged. onOpenBlog is defaulted on
  both ProfileRoute and ProfileScreen, so existing call sites and tests compile
  untouched.
- Falls back to a plain ACTION_VIEW intent when no Custom Tabs provider is
  installed, and to a no-op (not a crash) when nothing can open a web URL.
- Deep links: only the app's own interlinedlist://blog[/<slug>] scheme is
  claimed. The https://interlinedlist.com/blog URLs are deliberately NOT
  claimed — with no in-app renderer, intercepting a browser-bound link only to
  hand it straight back to a browser is worse than letting the browser have it,
  and the no-Custom-Tabs fallback would resolve back into this activity. The
  parser still normalises the web form so the claim can be switched on later.
- androidx.browser added through gradle/libs.versions.toml.

Tests: 20 new JVM unit tests covering the entry point URL, deep-link parsing
(including the /blogroll prefix trap, look-alike hosts, traversal segments and
garbage input), and all three launch outcomes; plus a case in the existing
Account hub Compose test asserting the Blog row sits in the menu and routes out.

Closes #88
---
 app/build.gradle.kts                          |   4 +
 app/src/main/AndroidManifest.xml              |  19 +++
 .../interlinedlist/android/MainActivity.kt    |  26 ++++
 .../android/blog/BlogLauncher.kt              |  91 ++++++++++++++
 .../interlinedlist/android/blog/BlogLink.kt   | 100 +++++++++++++++
 .../navigation/InterlinedListNavHost.kt       |  10 ++
 .../android/blog/BlogLauncherTest.kt          |  77 ++++++++++++
 .../android/blog/BlogLinkTest.kt              | 115 ++++++++++++++++++
 .../feature/profile/ui/ProfileScreenTest.kt   |  16 +++
 .../profile/ui/profile/ProfileScreen.kt       |  33 ++++-
 gradle/libs.versions.toml                     |   3 +
 11 files changed, 491 insertions(+), 3 deletions(-)
 create mode 100644 app/src/main/java/com/interlinedlist/android/blog/BlogLauncher.kt
 create mode 100644 app/src/main/java/com/interlinedlist/android/blog/BlogLink.kt
 create mode 100644 app/src/test/java/com/interlinedlist/android/blog/BlogLauncherTest.kt
 create mode 100644 app/src/test/java/com/interlinedlist/android/blog/BlogLinkTest.kt

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index c48e04c..b97375b 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -82,6 +82,9 @@ dependencies {
     implementation(libs.androidx.lifecycle.runtime.compose)
     implementation(libs.androidx.core.splashscreen)
     implementation(libs.kotlinx.coroutines.android)
+    // Custom Tabs: the blog is server-rendered with no public JSON endpoint, so it is
+    // read in a themed Custom Tab rather than in-app.
+    implementation(libs.androidx.browser)
 
     // DI
     implementation(libs.hilt.android)
@@ -95,6 +98,7 @@ dependencies {
 
     // Test
     testImplementation(libs.junit)
+    testImplementation(libs.truth)
     androidTestImplementation(libs.androidx.test.ext.junit)
     androidTestImplementation(libs.androidx.test.espresso.core)
     androidTestImplementation(platform(libs.androidx.compose.bom))
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 03d93a3..0a6f3db 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -55,6 +55,25 @@
                 <data android:scheme="interlinedlist" android:host="verify-email-change" />
                 <data android:scheme="interlinedlist" android:host="undo-email-change" />
             </intent-filter>
+
+            <!--
+                Blog links.
+
+                Only the app's OWN scheme is registered here. The public
+                https://interlinedlist.com/blog URLs are deliberately NOT claimed: the
+                blog is server-rendered and exposes no listing/post API, so the app has
+                nothing to render in-app and can only hand the URL to a browser. Claiming
+                a browser-bound link just to bounce it back out is a worse experience than
+                letting the browser have it — and the no-Custom-Tabs fallback (a plain
+                ACTION_VIEW) would resolve straight back into this activity. Revisit if a
+                real in-app renderer ever lands (see issue #87).
+            -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="interlinedlist" android:host="blog" />
+            </intent-filter>
         </activity>
 
         <!--
diff --git a/app/src/main/java/com/interlinedlist/android/MainActivity.kt b/app/src/main/java/com/interlinedlist/android/MainActivity.kt
index 3a58463..981ceec 100644
--- a/app/src/main/java/com/interlinedlist/android/MainActivity.kt
+++ b/app/src/main/java/com/interlinedlist/android/MainActivity.kt
@@ -5,9 +5,17 @@ import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
 import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalContext
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.interlinedlist.android.blog.BlogLauncher
+import com.interlinedlist.android.blog.BlogLink
 import com.interlinedlist.android.core.datastore.SessionStore
 import com.interlinedlist.android.core.datastore.ThemeMode
 import com.interlinedlist.android.core.datastore.ThemeSettingsStore
@@ -40,6 +48,11 @@ class MainActivity : ComponentActivity() {
         // the VIEW intent's data. Both endpoints behind it are unauthenticated, so the
         // route resolves regardless of whether a session exists.
         val emailChangeRoute = AuthRoutes.routeForEmailChangeLink(intent?.dataString)
+        // A tapped `interlinedlist://blog/...` link resolves to a public web URL rather
+        // than an in-app route: the blog is server-rendered and has no JSON feed, so it
+        // opens in a themed Custom Tab. The app deliberately does not claim the https
+        // blog URLs — see BlogLink.
+        val blogUrl = BlogLink.webUrlFor(intent?.dataString)
         enableEdgeToEdge()
         setContent {
             val themeMode by themeSettingsStore.themeMode.collectAsStateWithLifecycle()
@@ -49,6 +62,19 @@ class MainActivity : ComponentActivity() {
                 ThemeMode.SYSTEM -> isSystemInDarkTheme()
             }
             InterlinedListTheme(darkTheme = darkTheme) {
+                if (blogUrl != null) {
+                    // Opened once per launch, not once per composition, so a rotation
+                    // does not re-open the tab over the app.
+                    val context = LocalContext.current
+                    val colorScheme = MaterialTheme.colorScheme
+                    var opened by rememberSaveable { mutableStateOf(false) }
+                    LaunchedEffect(blogUrl) {
+                        if (!opened) {
+                            opened = true
+                            BlogLauncher.open(context, blogUrl, colorScheme)
+                        }
+                    }
+                }
                 InterlinedListNavHost(
                     startLoggedIn = startLoggedIn,
                     notificationRoute = notificationRoute,
diff --git a/app/src/main/java/com/interlinedlist/android/blog/BlogLauncher.kt b/app/src/main/java/com/interlinedlist/android/blog/BlogLauncher.kt
new file mode 100644
index 0000000..538d62c
--- /dev/null
+++ b/app/src/main/java/com/interlinedlist/android/blog/BlogLauncher.kt
@@ -0,0 +1,91 @@
+package com.interlinedlist.android.blog
+
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import androidx.browser.customtabs.CustomTabColorSchemeParams
+import androidx.browser.customtabs.CustomTabsIntent
+import androidx.compose.material3.ColorScheme
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.luminance
+import androidx.compose.ui.graphics.toArgb
+
+/** How a blog URL ended up being opened — or that it could not be. */
+enum class BlogLaunchResult {
+    /** Opened in a Custom Tab, themed from the app's colour scheme. */
+    CUSTOM_TAB,
+
+    /** No Custom Tabs-capable browser; opened in whatever browser handles the URL. */
+    BROWSER,
+
+    /** Nothing on the device can open a web URL. Nothing happened, nothing crashed. */
+    UNAVAILABLE,
+}
+
+/**
+ * Opens a blog URL in a Custom Tab themed to match the app.
+ *
+ * A Custom Tab is the honest ceiling for the blog today: it is server-rendered with no
+ * public JSON endpoint (see [BlogLink]), so the alternative would be scraping HTML.
+ * The tab is coloured from the live [ColorScheme], which `InterlinedListTheme` has
+ * already resolved from the user's System/Light/Dark setting, so the tab follows that
+ * setting without any extra plumbing.
+ *
+ * Custom Tabs are not guaranteed to exist: the fallback is a plain `ACTION_VIEW`
+ * intent, and if even that finds no handler the call is a no-op rather than a crash.
+ */
+object BlogLauncher {
+
+    /**
+     * Opens [url] and reports how. Never throws: a device with no browser at all
+     * yields [BlogLaunchResult.UNAVAILABLE].
+     */
+    fun open(context: Context, url: String, colorScheme: ColorScheme): BlogLaunchResult {
+        val uri = Uri.parse(url)
+        return launchWithFallback(
+            customTab = { customTabsIntent(colorScheme).launchUrl(context, uri) },
+            browser = { context.startActivity(Intent(Intent.ACTION_VIEW, uri)) },
+        )
+    }
+
+    /**
+     * The launch chain, free of Android types so it can be unit tested: try the Custom
+     * Tab, fall back to the browser, and swallow a failure of both.
+     *
+     * Both lambdas throw when nothing on the device can handle the intent
+     * (`ActivityNotFoundException`), which is a perfectly ordinary device
+     * configuration — so neither failure may escape.
+     */
+    internal fun launchWithFallback(customTab: () -> Unit, browser: () -> Unit): BlogLaunchResult {
+        if (runCatching(customTab).isSuccess) return BlogLaunchResult.CUSTOM_TAB
+        if (runCatching(browser).isSuccess) return BlogLaunchResult.BROWSER
+        return BlogLaunchResult.UNAVAILABLE
+    }
+
+    /**
+     * True when [surface] is a dark-theme surface. The app theme's own surface colour
+     * is the single source of truth for light/dark here, so the tab matches whatever
+     * the user chose without the setting having to be threaded down to every call site.
+     */
+    internal fun isDarkSurface(surface: Color): Boolean = surface.luminance() < 0.5f
+
+    private fun customTabsIntent(colorScheme: ColorScheme): CustomTabsIntent {
+        val colors = CustomTabColorSchemeParams.Builder()
+            .setToolbarColor(colorScheme.surface.toArgb())
+            .setSecondaryToolbarColor(colorScheme.surfaceVariant.toArgb())
+            .setNavigationBarColor(colorScheme.surface.toArgb())
+            .build()
+        return CustomTabsIntent.Builder()
+            .setShowTitle(true)
+            .setUrlBarHidingEnabled(true)
+            .setColorScheme(
+                if (isDarkSurface(colorScheme.surface)) {
+                    CustomTabsIntent.COLOR_SCHEME_DARK
+                } else {
+                    CustomTabsIntent.COLOR_SCHEME_LIGHT
+                },
+            )
+            .setDefaultColorSchemeParams(colors)
+            .build()
+    }
+}
diff --git a/app/src/main/java/com/interlinedlist/android/blog/BlogLink.kt b/app/src/main/java/com/interlinedlist/android/blog/BlogLink.kt
new file mode 100644
index 0000000..c6151a6
--- /dev/null
+++ b/app/src/main/java/com/interlinedlist/android/blog/BlogLink.kt
@@ -0,0 +1,100 @@
+package com.interlinedlist.android.blog
+
+import java.net.URI
+
+/**
+ * Blog URLs, and the rules for turning a tapped link into one.
+ *
+ * The blog at `https://interlinedlist.com/blog` is **server-rendered** and the API
+ * exposes no public listing or post endpoint (see issue #87), so this app has nothing
+ * to render in-app: every blog destination resolves to a web URL that is handed to a
+ * Custom Tab. That makes this object the whole "data layer" for the blog — deliberately.
+ *
+ * Kept as plain JVM code (no `android.net.Uri`) so the matching rules are covered by
+ * fast unit tests, matching the `EmailChangeLink` precedent in `:feature:auth`.
+ *
+ * ## Which links the app claims
+ *
+ * The manifest registers **only** the app's own `interlinedlist://blog…` scheme. The
+ * `https://interlinedlist.com/blog…` web URLs are deliberately *not* claimed: with no
+ * in-app renderer, claiming them would intercept a browser-bound link only to hand it
+ * straight back to a browser — losing the user's own browser session and, when no
+ * Custom Tabs provider exists, resolving the plain `ACTION_VIEW` fallback back into
+ * this very activity. [webUrlFor] still recognises the web form so in-app call sites
+ * may pass either shape, and so the claim can be switched on in the manifest without
+ * touching these rules if a real in-app renderer ever lands.
+ */
+object BlogLink {
+
+    /** Host of the public site; also matched with a `www.` prefix. */
+    const val WEB_HOST = "interlinedlist.com"
+
+    /** Custom scheme the app registers for its own blog links. */
+    const val APP_SCHEME = "interlinedlist"
+
+    /** First path segment (web) / authority (custom scheme) identifying the blog. */
+    const val BLOG_SEGMENT = "blog"
+
+    /** Canonical URL of the blog index — the Account hub's Blog entry point. */
+    const val INDEX_URL = "https://$WEB_HOST/$BLOG_SEGMENT"
+
+    private val WEB_SCHEMES = setOf("https", "http")
+
+    /** Canonical URL of a single post, by slug. */
+    fun postUrl(slug: String): String = "$INDEX_URL/${slug.trim('/')}"
+
+    /**
+     * Resolves [uri] to the canonical blog URL it names, or null when it is not a blog
+     * link at all.
+     *
+     * Recognised shapes (scheme/host case-insensitive; trailing slash, query and
+     * fragment tolerated and dropped):
+     * - `interlinedlist://blog` and `interlinedlist://blog/<slug>`
+     * - `https://interlinedlist.com/blog` and `https://interlinedlist.com/blog/<slug>`
+     *
+     * Anything else — a foreign or look-alike host, a `/blogroll`-style prefix trap, a
+     * `..` traversal segment, or a string that is not a URI at all — yields null rather
+     * than an exception or a URL we would then open in a browser.
+     */
+    fun webUrlFor(uri: String?): String? {
+        val trimmed = uri?.trim().orEmpty()
+        if (trimmed.isEmpty()) return null
+        val parsed = runCatching { URI(trimmed) }.getOrNull() ?: return null
+
+        val segments = parsed.blogPathSegments() ?: return null
+        // Percent-encoding is preserved verbatim: the raw path is already a valid URL
+        // component, and re-encoding it here would corrupt non-ASCII slugs.
+        return if (segments.isEmpty()) INDEX_URL else "$INDEX_URL/${segments.joinToString("/")}"
+    }
+
+    /**
+     * The post path under `/blog` (empty for the index itself), or null when this URI
+     * is not a blog link.
+     */
+    private fun URI.blogPathSegments(): List<String>? {
+        val scheme = scheme?.lowercase() ?: return null
+        val segments = when {
+            scheme in WEB_SCHEMES -> {
+                val host = host?.lowercase()?.removePrefix("www.") ?: return null
+                if (host != WEB_HOST) return null
+                val path = rawPath.orEmpty().trim('/').splitPath()
+                if (path.firstOrNull()?.lowercase() != BLOG_SEGMENT) return null
+                path.drop(1)
+            }
+            scheme == APP_SCHEME -> {
+                // `interlinedlist://blog/<slug>` — "blog" sits in the authority.
+                if (host?.lowercase() != BLOG_SEGMENT) return null
+                rawPath.orEmpty().trim('/').splitPath()
+            }
+            else -> return null
+        }
+        // A relative segment would silently point the browser somewhere other than the
+        // blog, so refuse rather than normalise.
+        if (segments.any { it == "." || it == ".." }) return null
+        return segments
+    }
+
+    /** Splits an already-trimmed path, dropping the empty parts left by `//`. */
+    private fun String.splitPath(): List<String> =
+        if (isEmpty()) emptyList() else split('/').filter { it.isNotEmpty() }
+}
diff --git a/app/src/main/java/com/interlinedlist/android/navigation/InterlinedListNavHost.kt b/app/src/main/java/com/interlinedlist/android/navigation/InterlinedListNavHost.kt
index 4d805dc..eeaa42c 100644
--- a/app/src/main/java/com/interlinedlist/android/navigation/InterlinedListNavHost.kt
+++ b/app/src/main/java/com/interlinedlist/android/navigation/InterlinedListNavHost.kt
@@ -10,6 +10,7 @@ import androidx.compose.material.icons.filled.Description
 import androidx.compose.material.icons.filled.Forum
 import androidx.compose.material.icons.filled.MailOutline
 import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.NavigationBar
 import androidx.compose.material3.NavigationBarItem
 import androidx.compose.material3.Scaffold
@@ -32,6 +33,8 @@ import androidx.navigation.compose.rememberNavController
 import androidx.navigation.navArgument
 import androidx.navigation.navDeepLink
 import androidx.navigation.navigation
+import com.interlinedlist.android.blog.BlogLauncher
+import com.interlinedlist.android.blog.BlogLink
 import com.interlinedlist.android.feature.auth.nav.AuthRoutes
 import com.interlinedlist.android.feature.auth.nav.authGraph
 import com.interlinedlist.android.feature.directmessages.navigation.DirectMessagesDestinations
@@ -501,6 +504,8 @@ private fun MainShell(
                 // Sign-out reuses the existing auth-backed logout; the profile
                 // module intentionally owns no session state.
                 val logoutViewModel: HomeViewModel = hiltViewModel()
+                val accountContext = LocalContext.current
+                val colorScheme = MaterialTheme.colorScheme
                 ProfileRoute(
                     onEditProfile = { tabNav.navigate(Routes.PROFILE_EDIT) },
                     onSearchUsers = { tabNav.navigate(Routes.USER_SEARCH) },
@@ -515,6 +520,11 @@ private fun MainShell(
                     onOpenBlockedMuted = { tabNav.navigate(Routes.ACCOUNT_BLOCKED_MUTED) },
                     onOpenAccountSettings = { tabNav.navigate(Routes.ACCOUNT_SETTINGS) },
                     onOpenSettings = { tabNav.navigate(Routes.SETTINGS) },
+                    // Leaves the app rather than navigating: the blog is server-rendered
+                    // with no listing API, so it opens in a themed Custom Tab.
+                    onOpenBlog = {
+                        BlogLauncher.open(accountContext, BlogLink.INDEX_URL, colorScheme)
+                    },
                     onSignOut = { logoutViewModel.logout(onLoggedOut) },
                 )
             }
diff --git a/app/src/test/java/com/interlinedlist/android/blog/BlogLauncherTest.kt b/app/src/test/java/com/interlinedlist/android/blog/BlogLauncherTest.kt
new file mode 100644
index 0000000..3cbbf0b
--- /dev/null
+++ b/app/src/test/java/com/interlinedlist/android/blog/BlogLauncherTest.kt
@@ -0,0 +1,77 @@
+package com.interlinedlist.android.blog
+
+import androidx.compose.ui.graphics.Color
+import com.google.common.truth.Truth.assertThat
+import com.interlinedlist.android.core.designsystem.theme.ILSurfaceDark
+import com.interlinedlist.android.core.designsystem.theme.ILSurfaceLight
+import org.junit.Test
+
+/**
+ * The launch chain is Custom Tab → plain browser → give up. All three outcomes are
+ * reachable on a real device: a Custom Tabs-capable browser is not guaranteed to be
+ * installed, and on a locked-down or browser-less device *nothing* can handle an
+ * `https` VIEW intent. Neither case may crash the app, so the decision logic is kept
+ * free of Android types and pinned here.
+ */
+class BlogLauncherTest {
+
+    @Test
+    fun `a working custom tab is used and the browser is never touched`() {
+        var browserAttempts = 0
+
+        val result = BlogLauncher.launchWithFallback(
+            customTab = { /* succeeds */ },
+            browser = { browserAttempts++ },
+        )
+
+        assertThat(result).isEqualTo(BlogLaunchResult.CUSTOM_TAB)
+        assertThat(browserAttempts).isEqualTo(0)
+    }
+
+    @Test
+    fun `no custom tabs provider falls back to a plain browser intent`() {
+        var browserAttempts = 0
+
+        val result = BlogLauncher.launchWithFallback(
+            customTab = { throw IllegalStateException("no activity found to handle the intent") },
+            browser = { browserAttempts++ },
+        )
+
+        assertThat(result).isEqualTo(BlogLaunchResult.BROWSER)
+        assertThat(browserAttempts).isEqualTo(1)
+    }
+
+    @Test
+    fun `no browser installed at all reports failure instead of crashing`() {
+        val result = BlogLauncher.launchWithFallback(
+            customTab = { throw IllegalStateException("no activity found to handle the intent") },
+            browser = { throw IllegalStateException("no activity found to handle the intent") },
+        )
+
+        assertThat(result).isEqualTo(BlogLaunchResult.UNAVAILABLE)
+    }
+
+    @Test
+    fun `a security exception from the browser is contained too`() {
+        val result = BlogLauncher.launchWithFallback(
+            customTab = { throw SecurityException("permission denial") },
+            browser = { throw SecurityException("permission denial") },
+        )
+
+        assertThat(result).isEqualTo(BlogLaunchResult.UNAVAILABLE)
+    }
+
+    // ---- the tab follows the user's appearance setting ----------------------
+
+    @Test
+    fun `the app's dark surface selects the dark tab scheme`() {
+        assertThat(BlogLauncher.isDarkSurface(ILSurfaceDark)).isTrue()
+        assertThat(BlogLauncher.isDarkSurface(Color.Black)).isTrue()
+    }
+
+    @Test
+    fun `the app's light surface selects the light tab scheme`() {
+        assertThat(BlogLauncher.isDarkSurface(ILSurfaceLight)).isFalse()
+        assertThat(BlogLauncher.isDarkSurface(Color.White)).isFalse()
+    }
+}
diff --git a/app/src/test/java/com/interlinedlist/android/blog/BlogLinkTest.kt b/app/src/test/java/com/interlinedlist/android/blog/BlogLinkTest.kt
new file mode 100644
index 0000000..1d014e7
--- /dev/null
+++ b/app/src/test/java/com/interlinedlist/android/blog/BlogLinkTest.kt
@@ -0,0 +1,115 @@
+package com.interlinedlist.android.blog
+
+import com.google.common.truth.Truth.assertThat
+import org.junit.Test
+
+/**
+ * The blog is server-rendered and has no public JSON listing endpoint, so every blog
+ * destination in this app is ultimately "a web URL we hand to a Custom Tab". These
+ * tests pin down both halves of that:
+ *
+ * - the Account-hub **entry point** resolves to the canonical blog index URL, and
+ * - a tapped **deep link** resolves to the canonical URL of the post it names, while
+ *   anything that is not a blog link resolves to null.
+ *
+ * The "must not match" cases matter as much as the happy paths: whatever comes back
+ * from here is handed to a browser, so a look-alike host or a `/blogroll`-style prefix
+ * trap has to come back as null rather than as a URL we would then open.
+ */
+class BlogLinkTest {
+
+    // ---- entry point --------------------------------------------------------
+
+    @Test
+    fun `the entry point routes to the canonical blog index`() {
+        assertThat(BlogLink.INDEX_URL).isEqualTo("https://interlinedlist.com/blog")
+    }
+
+    @Test
+    fun `postUrl builds a canonical post URL from a slug`() {
+        assertThat(BlogLink.postUrl("hello-world"))
+            .isEqualTo("https://interlinedlist.com/blog/hello-world")
+    }
+
+    // ---- deep links the app owns -------------------------------------------
+
+    @Test
+    fun `the custom-scheme blog link resolves to the index`() {
+        assertThat(BlogLink.webUrlFor("interlinedlist://blog"))
+            .isEqualTo("https://interlinedlist.com/blog")
+    }
+
+    @Test
+    fun `the custom-scheme post link resolves to that post`() {
+        assertThat(BlogLink.webUrlFor("interlinedlist://blog/hello-world"))
+            .isEqualTo("https://interlinedlist.com/blog/hello-world")
+    }
+
+    @Test
+    fun `a shared web post link is normalised to its canonical URL`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/blog/hello-world"))
+            .isEqualTo("https://interlinedlist.com/blog/hello-world")
+    }
+
+    @Test
+    fun `a nested post path is preserved`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/blog/2026/hello-world"))
+            .isEqualTo("https://interlinedlist.com/blog/2026/hello-world")
+    }
+
+    // ---- tolerated variations ----------------------------------------------
+
+    @Test
+    fun `tolerates a www host, mixed case, a trailing slash, query and fragment`() {
+        assertThat(
+            BlogLink.webUrlFor("  https://WWW.InterlinedList.com/blog/hello-world/?utm_source=x#top  "),
+        ).isEqualTo("https://interlinedlist.com/blog/hello-world")
+    }
+
+    @Test
+    fun `the bare web blog path resolves to the index`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/blog/"))
+            .isEqualTo("https://interlinedlist.com/blog")
+    }
+
+    @Test
+    fun `a percent-encoded slug is passed through unchanged`() {
+        assertThat(BlogLink.webUrlFor("interlinedlist://blog/caf%C3%A9-notes"))
+            .isEqualTo("https://interlinedlist.com/blog/caf%C3%A9-notes")
+    }
+
+    // ---- links the app does not own must not resolve ------------------------
+
+    @Test
+    fun `a non-blog link does not resolve`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/lists/shared/xyz")).isNull()
+        assertThat(BlogLink.webUrlFor("interlinedlist://lists/abc")).isNull()
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/")).isNull()
+    }
+
+    @Test
+    fun `a path that merely starts with blog does not resolve`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/blogroll")).isNull()
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/blog-archive/post")).isNull()
+    }
+
+    @Test
+    fun `a look-alike or foreign host does not resolve`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com.evil.example/blog/post")).isNull()
+        assertThat(BlogLink.webUrlFor("https://evil.example/blog/post")).isNull()
+    }
+
+    @Test
+    fun `a traversal segment does not resolve`() {
+        assertThat(BlogLink.webUrlFor("https://interlinedlist.com/blog/../admin")).isNull()
+        assertThat(BlogLink.webUrlFor("interlinedlist://blog/./x")).isNull()
+    }
+
+    @Test
+    fun `garbage input returns null instead of throwing`() {
+        assertThat(BlogLink.webUrlFor("not a uri at all")).isNull()
+        assertThat(BlogLink.webUrlFor("blog")).isNull()
+        assertThat(BlogLink.webUrlFor("")).isNull()
+        assertThat(BlogLink.webUrlFor(null)).isNull()
+    }
+}
diff --git a/feature/profile/src/androidTest/kotlin/com/interlinedlist/android/feature/profile/ui/ProfileScreenTest.kt b/feature/profile/src/androidTest/kotlin/com/interlinedlist/android/feature/profile/ui/ProfileScreenTest.kt
index 25b6239..aaa4bee 100644
--- a/feature/profile/src/androidTest/kotlin/com/interlinedlist/android/feature/profile/ui/ProfileScreenTest.kt
+++ b/feature/profile/src/androidTest/kotlin/com/interlinedlist/android/feature/profile/ui/ProfileScreenTest.kt
@@ -47,6 +47,7 @@ class ProfileScreenTest {
         onOpenFollowers: () -> Unit = {},
         onOpenFollowing: () -> Unit = {},
         onOpenRequests: () -> Unit = {},
+        onOpenBlog: () -> Unit = {},
         onSignOut: () -> Unit = {},
     ) {
         composeRule.setContent {
@@ -64,6 +65,7 @@ class ProfileScreenTest {
                     onOpenSessions = {},
                     onOpenConnectedAccounts = {},
                     onOpenAccountSettings = {},
+                    onOpenBlog = onOpenBlog,
                     onSignOut = onSignOut,
                     onRetry = {},
                 )
@@ -131,6 +133,20 @@ class ProfileScreenTest {
         assert(signOut)
     }
 
+    @Test
+    fun profile_blogRow_isInTheMenuAndRoutesOut() {
+        var blog = false
+        stubbedProfileScreen(
+            state = ProfileUiState(user = sampleUser(), isLoading = false),
+            onOpenBlog = { blog = true },
+        )
+
+        // Sits in the Account menu alongside the in-app rows, not as a footer.
+        composeRule.onNodeWithTag(AccountMenuTestTags.BLOG).assertIsDisplayed().performClick()
+
+        assert(blog)
+    }
+
     @Test
     fun profile_showsProgress_whileLoadingWithNoCache() {
         stubbedProfileScreen(ProfileUiState(user = null, isLoading = true))
diff --git a/feature/profile/src/main/kotlin/com/interlinedlist/android/feature/profile/ui/profile/ProfileScreen.kt b/feature/profile/src/main/kotlin/com/interlinedlist/android/feature/profile/ui/profile/ProfileScreen.kt
index 77c2e73..9380141 100644
--- a/feature/profile/src/main/kotlin/com/interlinedlist/android/feature/profile/ui/profile/ProfileScreen.kt
+++ b/feature/profile/src/main/kotlin/com/interlinedlist/android/feature/profile/ui/profile/ProfileScreen.kt
@@ -15,6 +15,8 @@ import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowForward
 import androidx.compose.material.icons.automirrored.filled.Logout
+import androidx.compose.material.icons.automirrored.filled.MenuBook
+import androidx.compose.material.icons.automirrored.filled.OpenInNew
 import androidx.compose.material.icons.filled.Block
 import androidx.compose.material.icons.filled.Business
 import androidx.compose.material.icons.filled.Devices
@@ -64,6 +66,7 @@ object AccountMenuTestTags {
     const val BLOCKED_MUTED = "accountMenuBlockedMuted"
     const val ACCOUNT_SETTINGS = "accountMenuAccountSettings"
     const val SETTINGS = "accountMenuSettings"
+    const val BLOG = "accountMenuBlog"
 }
 
 /**
@@ -88,6 +91,8 @@ object AccountMenuTestTags {
  * @param onOpenBlockedMuted navigate to the "Blocked & muted" screen (within this module).
  * @param onOpenAccountSettings navigate to the Account settings screen (within this module).
  * @param onOpenSettings navigate to the Settings (preferences) screen (within this module).
+ * @param onOpenBlog open the public blog. NOT an in-app destination: the blog is
+ *   server-rendered with no listing API, so the app opens it in a themed Custom Tab.
  * @param onSignOut invoked after the caller performs sign-out; the profile module does
  *   not own session state, so the app wires this to the auth logout + navigation.
  */
@@ -110,6 +115,8 @@ fun ProfileRoute(
     onOpenBlockedMuted: () -> Unit = {},
     // Defaulted likewise; wire this to the `settings` route for the preferences screen.
     onOpenSettings: () -> Unit = {},
+    // Defaulted likewise; the app wires this to its Custom Tab launcher.
+    onOpenBlog: () -> Unit = {},
     modifier: Modifier = Modifier,
     viewModel: ProfileViewModel = hiltViewModel(),
 ) {
@@ -131,6 +138,7 @@ fun ProfileRoute(
         onOpenBlockedMuted = onOpenBlockedMuted,
         onOpenAccountSettings = onOpenAccountSettings,
         onOpenSettings = onOpenSettings,
+        onOpenBlog = onOpenBlog,
         onSignOut = onSignOut,
         onRetry = viewModel::refresh,
         modifier = modifier,
@@ -157,6 +165,7 @@ fun ProfileScreen(
     onRetry: () -> Unit,
     onOpenBlockedMuted: () -> Unit = {},
     onOpenSettings: () -> Unit = {},
+    onOpenBlog: () -> Unit = {},
     modifier: Modifier = Modifier,
 ) {
     Scaffold(
@@ -271,6 +280,17 @@ fun ProfileScreen(
                     onClick = onSearchUsers,
                     tag = AccountMenuTestTags.SEARCH_USERS,
                 )
+                // Leaves the app: the blog is server-rendered with no listing API, so
+                // it opens in a Custom Tab. Flagged with the "opens outside" affordance
+                // instead of the forward arrow the in-app rows carry.
+                AccountMenuRow(
+                    icon = Icons.AutoMirrored.Filled.MenuBook,
+                    label = "Blog",
+                    onClick = onOpenBlog,
+                    tag = AccountMenuTestTags.BLOG,
+                    trailingIcon = Icons.AutoMirrored.Filled.OpenInNew,
+                    trailingContentDescription = "Opens in a browser",
+                )
                 AccountMenuRow(
                     icon = Icons.AutoMirrored.Filled.Logout,
                     label = "Sign out",
@@ -307,13 +327,20 @@ fun ProfileScreen(
     }
 }
 
-/** A single tappable row in the Account hub's menu. */
+/**
+ * A single tappable row in the Account hub's menu.
+ *
+ * [trailingIcon] defaults to the forward arrow used by rows that navigate within the
+ * app; rows that leave the app pass the "opens outside" affordance instead.
+ */
 @Composable
 private fun AccountMenuRow(
     icon: ImageVector,
     label: String,
     onClick: () -> Unit,
     tag: String,
+    trailingIcon: ImageVector = Icons.AutoMirrored.Filled.ArrowForward,
+    trailingContentDescription: String? = null,
 ) {
     Row(
         modifier = Modifier
@@ -332,8 +359,8 @@ private fun AccountMenuRow(
             modifier = Modifier.weight(1f),
         )
         Icon(
-            Icons.AutoMirrored.Filled.ArrowForward,
-            contentDescription = null,
+            trailingIcon,
+            contentDescription = trailingContentDescription,
             tint = MaterialTheme.colorScheme.onSurfaceVariant,
         )
     }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index f749b4e..114ca3b 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -9,6 +9,8 @@ coreKtx = "1.13.1"
 lifecycle = "2.8.7"
 activityCompose = "1.9.3"
 splashscreen = "1.0.1"
+# Custom Tabs — used to open the server-rendered blog themed to match the app.
+browser = "1.8.0"
 
 # Compose
 composeBom = "2024.10.01"
@@ -55,6 +57,7 @@ androidx-lifecycle-viewmodel-compose = { group = "androidx.lifecycle", name = "l
 androidx-lifecycle-runtime-compose = { group = "androidx.lifecycle", name = "lifecycle-runtime-compose", version.ref = "lifecycle" }
 androidx-activity-compose = { group = "androidx.activity", name = "activity-compose", version.ref = "activityCompose" }
 androidx-core-splashscreen = { group = "androidx.core", name = "core-splashscreen", version.ref = "splashscreen" }
+androidx-browser = { group = "androidx.browser", name = "browser", version.ref = "browser" }
 
 # Compose (versions come from the BOM)
 androidx-compose-bom = { group = "androidx.compose", name = "compose-bom", version.ref = "composeBom" }