Improve authentication reliability with timeouts and local validation

Author: davidwei

CLAUDE.md

@@ -23,123 +23,4 @@
 - **Testing**: Group related tests, use descriptive test names, mock external dependencies
 - **File Editing**: Use eed (Enhanced Ed) for all file modifications - NEVER use Edit/MultiEdit tools
 
-## Tool Usage Policy - Critical Understanding
-
-### Why Edit/MultiEdit are BANNED
-Edit and MultiEdit waste massive amounts of tokens and time due to fundamental design flaws for AI workflows:
-
-**Problem 1: Forced Read Tax**
-- Edit requires you to Read entire files before modification, even when Grep already told you the exact line
-- Example: Change one line in a 500-line file = Read 500 lines + Edit = thousands of wasted tokens
-- eed: Direct modification without reading = minimal tokens
-
-**Problem 2: The Try-Fail-Retry Loop**
-- Edit fails on multiple matches → you retry with MultiEdit → wasted round trip
-- This happens on almost every file with common patterns
-- eed: Express intent clearly with patterns (s/old/new/ or s/old/new/g) - works first try
-
-**Real Cost Comparison** (modifying 5 files):
-- Edit path: 5 Reads (10k tokens) + 2-3 failures + 7-10 tool calls = ~12 interactions
-- eed path: 5 eed commands (500 tokens) + 0 failures = 5 interactions
-- **20x efficiency gain with eed**
-
-### REQUIRED TOOL: eed (Enhanced Ed)
-Use eed for ALL file modifications. Fallback to sed/awk only if eed unavailable.
-
-## Enhanced Ed (eed) Usage Guidelines
-
-### Why eed Exists - The Real Story
-eed is not "just another editor" - it's a safety wrapper around ed that fixes the sharp edges:
-
-**What eed Does for You Automatically**:
-1. **Smart operation ordering**: Converts `1a ... 5a ... 6a` to `6a→5a→1a` to prevent line number drift
-2. **Auto-completion**: Adds missing `w` and `q` commands so you never lose changes
-3. **Atomic commits**: Every edit is committed immediately with clear history
-4. **Safe rollback**: `eed --undo` when things go wrong
-
-**Raw ed problems eed solves**:
-- Line numbers shift after insertions/deletions → eed reorders operations
-- Forgot to save → eed auto-saves
-- Made a mistake → eed provides undo
-- Need to track changes → eed commits everything
-
-
-### Why Use eed
-- **Atomic commits**: Every edit is automatically committed, making it safe to experiment
-- **Easy rollback**: `eed --undo` instantly reverts the last change
-- **Precision editing**: When you know line numbers, no need to re-read entire files
-- **Consistent workflow**: Every edit follows the same pattern with clear commit messages
-
-### Learning Experience & First Steps
-**Start with `eed --help`** - Don't be like me and jump in directly. Understanding the tool first saves debugging time later.
-
-**AI vs Human editing**: As AI, we need non-interactive, atomic edits. We can't use mouse, big screens, or make multiple changes before saving like humans. Each eed command must be complete and correct in one shot.
-
-**From beginner to proficient**: My eed journey this session: started bold but clumsy → got comfortable with basic patterns → became overconfident with complex edits → made silly mistakes when tired → learned that consistency beats cleverness.
-
-
-### Quick Start - Your First eed Commands
-
-**Basic syntax (commit every change)**:
-```bash
-eed -m 'what you are doing' /path/to/file <<'EOF'
-# ed commands here
-w
-q
-EOF
-```
-
-**Most common operations**:
-```bash
-# 1. Simple substitution (first occurrence)
-/pattern/s/old/new/
-
-# 2. Global substitution (all occurrences)
-s/old/new/g
-
-# 3. Substitute in specific pattern context
-/function_name/s/old/new/
-
-# 4. Delete lines matching pattern
-/pattern_to_delete/d
-
-# 5. Append after matching line
-/pattern/a
-new line content here
-.
-
-# 6. Change (replace) matching line
-/pattern/c
-replacement line
-.
-```
-
-**When grep finds what you need**:
-```bash
-# grep tells you: "lib/foo.dart:42: some old code"
-# Don't Read the file! Just:
-eed -m 'fix the thing' lib/foo.dart <<'EOF'
-/old code/s/old/new/
-w
-q
-EOF
-```
-
-### Practical eed Tips
-
-**Pattern-based editing** (avoid line number dependency):
-- `/function_name/,/^}/d` - Delete entire function
-- `/import.*flutter/a` - Add after import section
-- `s/old_pattern/new_pattern/g` - Global replace
-
-**Common scenarios**:
-- Single-line fix: Use `/pattern/s/old/new/`
-- Multiple files: Run parallel eed commands (no Read needed!)
-- Uncertain change: Make the edit, test, `eed --undo` if wrong
-
-**Error recovery**:
-- Wrong edit → `eed --undo` immediately
-- Complex edit → Break into multiple simple eed commands
-- Preview first → Read the file ONLY if you need to understand context
-
 **Key insight**: With eed, you express *intent* (what to change and where), not *exact text* (like Edit requires). This makes it robust and efficient

lib/dio_client.dart

@@ -19,8 +19,9 @@ class DioClient {
 
       _dio = Dio(); // Create Dio instance if not already created
       _dio!.options.baseUrl = AppConfig.apiBaseUrl;
-      _dio!.options.connectTimeout = const Duration(seconds: 20);
-      _dio!.options.receiveTimeout = const Duration(seconds: 25);
+      // Increase timeouts for better web performance and token validation
+      _dio!.options.connectTimeout = const Duration(seconds: 30);
+      _dio!.options.receiveTimeout = const Duration(seconds: 35);
       // _dio!.options.sendTimeout = const Duration(seconds: 20);
 
       _dio!.interceptors.add(LogInterceptor(requestBody: true, responseBody: true)); // Add logging interceptor

lib/providers/auth_provider.dart

@@ -2,6 +2,7 @@ import 'package:flutter/material.dart';
 import 'package:happy_notes/services/account_service.dart';
 import 'package:happy_notes/screens/account/user_session.dart';
 import 'package:happy_notes/dependency_injection.dart';
+import 'package:happy_notes/services/seq_logger.dart';
 
 class AuthProvider with ChangeNotifier {
   final AccountService _accountService = locator<AccountService>();
@@ -31,17 +32,41 @@ class AuthProvider with ChangeNotifier {
       final storedToken = await _accountService.getToken();
 
       if (storedToken != null && storedToken.isNotEmpty) {
-        // Validate token
-        if (await _accountService.isValidToken()) {
+        // Validate token with timeout and fallback
+        bool isValid = false;
+        
+        try {
+          // Add timeout to token validation to prevent hanging
+          isValid = await _accountService.isValidToken()
+              .timeout(const Duration(seconds: 10));
+        } catch (e) {
+          // If validation times out or fails, try local validation first
+          SeqLogger.info('Token validation timeout/error, falling back to local validation: $e');
+          try {
+            isValid = await _accountService.isValidTokenLocally();
+          } catch (localError) {
+            SeqLogger.severe('Local token validation failed: $localError');
+            isValid = false;
+          }
+        }
+
+        if (isValid) {
           _token = storedToken;
-          // Ensure session is populated
-          await _accountService.setUserSession(token: _token);
+          // Ensure session is populated - do this in background if it times out
+          try {
+            await _accountService.setUserSession(token: _token)
+                .timeout(const Duration(seconds: 8));
+          } catch (sessionError) {
+            SeqLogger.info('Session setup timeout, continuing with stored token: $sessionError');
+            // Continue anyway - user can still use the app
+          }
         } else {
           _token = null; // Token is invalid or expired
           await _accountService.logout(); // Clear any stale session data
         }
       }
     } catch (e) {
+      SeqLogger.severe('Failed to initialize authentication: $e');
       _error = 'Failed to initialize authentication: ${e.toString()}';
       _token = null;
     } finally {
@@ -117,4 +142,12 @@ class AuthProvider with ChangeNotifier {
 
   /// Get current user email from session
   String? get currentUserEmail => UserSession().email;
+
+  /// Retry authentication initialization
+  /// Useful when network conditions improve or user manually retries
+  Future<void> retryAuth() async {
+    _isInitialized = false;
+    _error = null;
+    await initAuth();
+  }
 }

lib/screens/initial_page.dart

@@ -20,7 +20,42 @@ class InitialPageState extends State<InitialPage> {
           // Show loading while AuthProvider is initializing
           if (!authProvider.isInitialized || authProvider.isLoading) {
             return const Center(
-              child: CircularProgressIndicator(),
+              child: Column(
+                mainAxisAlignment: MainAxisAlignment.center,
+                children: [
+                  CircularProgressIndicator(),
+                  SizedBox(height: 16),
+                  Text('Validating session...'),
+                ],
+              ),
+            );
+          }
+
+          // Show error if there's an authentication error
+          if (authProvider.error != null) {
+            return Center(
+              child: Column(
+                mainAxisAlignment: MainAxisAlignment.center,
+                children: [
+                  const Icon(Icons.error_outline, size: 48, color: Colors.red),
+                  const SizedBox(height: 16),
+                  const Text('Authentication Error'),
+                  const SizedBox(height: 8),
+                  Text(
+                    authProvider.error!,
+                    style: const TextStyle(fontSize: 12),
+                    textAlign: TextAlign.center,
+                  ),
+                  const SizedBox(height: 16),
+                  ElevatedButton(
+                    onPressed: () {
+                      // Retry authentication
+                      authProvider.retryAuth();
+                    },
+                    child: const Text('Retry'),
+                  ),
+                ],
+              ),
             );
           }
 

lib/services/account_service.dart

@@ -50,9 +50,18 @@ class AccountService {
   }
 
   Future<dynamic> _refreshToken() async {
-    var apiResponse = (await _accountApi.refreshToken()).data;
-    if (apiResponse['successful']) {
-      _storeToken(apiResponse['data']['token']);
+    try {
+      var apiResponse = (await _accountApi.refreshToken()).data;
+      if (apiResponse['successful']) {
+        await _storeToken(apiResponse['data']['token']);
+        _logger.i('Token refreshed successfully');
+      } else {
+        _logger.e('Token refresh failed: ${apiResponse['message'] ?? 'Unknown error'}');
+        throw ApiException(apiResponse);
+      }
+    } catch (e) {
+      _logger.e('Token refresh error: ${e.toString()}');
+      rethrow;
     }
   }
 
@@ -89,14 +98,20 @@ class AccountService {
     final prefs = await SharedPreferences.getInstance();
     final token = prefs.getString(_tokenKey);
     if (token != null && token != '') {
-      var remainingTime = await _tokenUtils.getTokenRemainingTime(token);
-      if (remainingTime.inDays <= 30) {
-        try {
-          //we deliberately don't use await here to avoid blocking the getToken operation
-          _refreshToken();
-        } catch (e) {
-          // eat the exception
+      try {
+        var remainingTime = await _tokenUtils.getTokenRemainingTime(token);
+        if (remainingTime.inDays <= 30) {
+          try {
+            // Add timeout to refresh token operation
+            await _refreshToken().timeout(const Duration(seconds: 15));
+          } catch (e) {
+            _logger.e('Token refresh failed or timed out: ${e.toString()}');
+            // Continue with existing token if refresh fails
+          }
         }
+      } catch (e) {
+        _logger.e('Error checking token expiration: ${e.toString()}');
+        // Continue with existing token if expiration check fails
       }
     }
     return token;
@@ -117,6 +132,26 @@ class AccountService {
     return false;
   }
 
+  /// Local token validation that doesn't require network calls
+  /// Used as fallback when network validation times out
+  Future<bool> isValidTokenLocally() async {
+    if (await _isSameEnv()) {
+      final token = await getToken();
+      if (token != null && token != '') {
+        try {
+          // Only check token structure and expiration locally
+          final remainingTime = await _tokenUtils.getTokenRemainingTime(token);
+          // Give more buffer time for local validation (5 minutes instead of 1 second)
+          return remainingTime.inMinutes >= 5;
+        } catch (e) {
+          _logger.e('Local token validation error: ${e.toString()}');
+          return false;
+        }
+      }
+    }
+    return false;
+  }
+
   // if env changes, even the token is valid, we still need to ask user to log in
   Future<bool> _isSameEnv() async {
     final prefs = await SharedPreferences.getInstance();