fix: start a malformed link at the start page; harden sign-in failures and the re-sign-in return page

[91jaeminjo]

Summary

A web link whose address can't be decoded opens the app's start page
instead of hanging on the splash screen. A storage failure while starting a
sign-in shows an error instead of a stuck spinner. A re-sign-in's return
page applies only to the server it was issued for. The pre-auth storage is
injected, so its failure paths are tested.

What changed

• Boot guard (75534599, refined in 77091307).
  • buildRouter computes the start location itself, with go_router's own
    rule plus a decode check, and passes overridePlatformDefaultLocation: true.
  • A start address whose path or query doesn't decode (#/room/%FF/x)
    starts at the config's initial route, with one warning that carries no
    part of the address. Before, go_router threw before any route ran and
    the splash never cleared, and a reload kept the bad hash.
  • After boot, a push with such an address (a same-tab hash change, an
    iOS deep link) is dropped by the framework's own observer, so it needs
    no guard. The buildRouter doc says why.
• Sign-in failures (2143a420, f353c110).
  • Everything in _authenticate that can throw sits inside its try:
    the pre-auth save, the inactivity-flag read, serverIdFromUrl.
  • A final catch covers Error as well. An Error is logged through
    describeFailure; anything else keeps error:.
  • The pre-auth state is cleared through clearBestEffort(). A failing
    store can't throw out of a catch block, and on web it can't drop a
    sign-in the IdP has already completed.
  • The callback's catch-all logs through describeFailure: a huge
    expires_in makes a RangeError that carries a value derived from the
    link.
• Injected PreAuthStateStorage (3851598a). It is an interface now,
  with LocalPreAuthStateStorage as the default through
  preAuthStateStorageProvider (not exported). ConnectFlow takes it, and
  AuthCallbackScreen reads it.
• ReturnTarget (3897587a, 0d3c1247, 77091307).
  • ConnectFlow takes a saved server's id and a path, built by
    HomeScreen from the known server. It saves the path only for a
    sign-in to that server, and keeps it across resets and retries.
  • isSafeReturnTo is public, also rejects a path or query that doesn't
    decode, and rejects /auth/callback. An unsafe target is dropped with a
    warning that carries no value. A stored one that no longer passes makes
    load clear the state.
  • The callback screen's own copy of the check was unreachable and is
    gone.
• Doc (0a5ab198). installUncaughtErrorLogging and
  runSoliplexShell say that PlatformDispatcher.onError records nothing
  on web (Implement PlatformDispatcher.onError for web flutter/flutter#100277).

Library consumers: buildRouter starts at the config's initial route
when the platform's start address can't be decoded.

Behaviour worth knowing

• A // path after the host still crashes, as on main. Flutter's web
  engine builds its first history URL from pathname without the origin.
  Recorded as a follow-up, with an index.html workaround and an upstream
  report.
• Going Back from the IdP can restore the "Finish signing in" spinner.
  That happens when Chrome uses its back/forward cache, so no page load
  runs. It doesn't loop, and Cancel works. main is the same.
• The return page is used only by the web callback. A native sign-in
  lands on the lobby, as before.

Tests

• Boot guard: a malformed path, a malformed query, and a route that
  Uri.parse rejects each start at the initial route, with a record that
  carries no part of the address. A valid deep link, a platform /, a
  callback boot and an unknown route behave as before.
• Sign-in failures: a failing save, isMarked, or clear (alone, after
  a failed save, after an IdP rejection, after a sign-in) ends at an error,
  or at Connected when the server was already added. A reset while a
  check fails stays reset. The Error and Exception arms log as
  intended.
• ReturnTarget: the target is saved only for its own server, kept
  across a reset and a retry, and dropped when unsafe, undecodable, or
  /auth/callback.
• HomeScreen: a saved server, an unknown server, and a saved address
  written differently.
• Storage: LocalPreAuthStateStorage.load returns null when the store
  can't be read or the state can't be cleared.
• Every new test was run failing first, or was shown to fail with its
  behaviour removed.

Test Plan

• The full suite passes (2878), with only the existing
  thread_view_state_test disposed-signal trace.
• flutter analyze reports no issues, dart format is clean,
  markdownlint is clean, and flutter build web succeeds.
• Every commit analyzes cleanly and passes test/core and
  test/modules/auth.
• Reviewed by seven reviewers (code, silent failures, comments, tests,
  types, simplification, security): no Critical or High findings. The
  approved findings are fixed in 77091307.
• Manual pass on web (Chrome), macOS and the iOS simulator against an
  afsoc-rag backend with Keycloak, with temporary logging and fault
  injection:
  • Web:
    • sign-in, with and without the index.html script;
    • the page-load clear;
    • a malformed start address on load, push and reload;
    • a malformed callback;
    • a re-sign-in returning to its room;
    • a returnTo=/auth/callback dropped;
    • an unknown server's ?url= ignored;
    • injected save, clear and load failures.
  • macOS: native sign-in, and an injected isMarked failure.
  • iOS: malformed deep links, warm and cold, are dropped; a saved
    server's link auto-connects; an unknown one is ignored.

🤖 Generated with Claude Code