Prevent retry after failed Google Sign-In init

ehsan6sha · ehsan6sha · commit f97211bf0778 · 2026-07-22T12:57:47.000-04:00
Add a poisoned-init guard to GoogleSignInBootstrap: track failed initialization attempts with _attemptFailed, surface a clear StateError advising a page reload, and clear in-flight futures to avoid hanging clients. Transient failures still allow retries, but web-specific failures that leave the plugin half-initialized are now treated as non-retryable in-session. Reset logic for tests was updated. Also warm the Google SDK earlier for Sheets: call _warmGoogleIfSheets on screen init and when re-enabling the contact form (and check _contactFormEnabled), so existing Sheets-configured sites or re-enabled forms prime the SDK. A unit test was added to cover the poisoned-plugin scenario.
diff --git a/lib/core/services/google_signin_bootstrap.dart b/lib/core/services/google_signin_bootstrap.dart
@@ -32,6 +32,7 @@ class GoogleSignInBootstrap {
   GoogleSignInBootstrap._();
 
   static bool _done = false;
+  static bool _attemptFailed = false;
   static Future<void>? _inFlight;
   static String? _usedClientId;
   static String? _usedServerClientId;
@@ -80,19 +81,35 @@ class GoogleSignInBootstrap {
         serverClientId: serverClientId,
       );
     } on StateError catch (e) {
-      // The double-init guard is the only StateError `initialize()` raises, so
-      // arriving here means the singleton is already configured — by a code
-      // path this class does not know about, or by the previous run of a hot
+      if (_attemptFailed) {
+        // We have already watched an initialize() fail, so this is not a
+        // healthy "someone else got here first". The web plugin raises its
+        // double-init flag BEFORE awaiting the GIS script, so an attempt that
+        // fails at that await leaves the plugin permanently half-initialized:
+        // it rejects every retry with this same StateError while the future
+        // its other methods await never completes. Reporting success here
+        // would hand the caller a client that hangs instead of answering.
+        // Nothing in-process can clear that state — only a fresh page can.
+        _inFlight = null;
+        throw StateError(
+          'Google Sign-In could not finish initializing and cannot be retried '
+          'in this session. Please reload the page and try again. ($e)',
+        );
+      }
+      // Otherwise the singleton is simply already configured — by a code path
+      // this class does not know about, or by the previous run of a hot
       // restart, which resets Dart state but not the GIS SDK already loaded
-      // into the page. Either way it is initialized, which is all the caller
-      // asked for. Note this is deliberately matched by TYPE, not by message:
-      // the wording of that error changes between plugin versions.
+      // into the page. Either way it is initialized, which is what the caller
+      // asked for. Matched by TYPE, not by message: the wording of that error
+      // changes between plugin versions.
       debugPrint('GoogleSignInBootstrap: initialize() reports an existing '
           'initialization; continuing. ($e)');
     } catch (e) {
       // Something transient — e.g. the GIS script failed to load. Drop the
       // cached future so the next caller retries instead of inheriting the
-      // failure forever.
+      // failure forever, but remember that an attempt failed: on web a retry
+      // can only ever hit the poisoned-plugin case handled above.
+      _attemptFailed = true;
       _inFlight = null;
       rethrow;
     }
@@ -105,6 +122,7 @@ class GoogleSignInBootstrap {
   @visibleForTesting
   static void resetForTest() {
     _done = false;
+    _attemptFailed = false;
     _inFlight = null;
     _usedClientId = null;
     _usedServerClientId = null;
diff --git a/lib/features/websites/screens/generate_website_screen.dart b/lib/features/websites/screens/generate_website_screen.dart
@@ -327,6 +327,10 @@ class _GenerateWebsiteScreenState extends State<GenerateWebsiteScreen> {
             ))
         .toList();
 
+    // An existing Sheets form reaches Publish without ever touching the
+    // channel selector, so warm from the incoming configuration too.
+    _warmGoogleIfSheets();
+
     // Languages: keep only known options, cap at 3, default to English.
     final knownLangs = websiteLanguageAutonyms.keys.toSet();
     final initLangs = (widget.initialLanguages ?? const <String>[])
@@ -360,11 +364,13 @@ class _GenerateWebsiteScreenState extends State<GenerateWebsiteScreen> {
     setState(() => _pricing = pricing);
   }
 
-  /// Load the Google Sign-In SDK as soon as the user picks the channel that
-  /// will need it, rather than inside the Publish handler. Failures are
-  /// ignored: this is a head start, and Publish still initializes on demand.
+  /// Load the Google Sign-In SDK as soon as we know it will be needed, rather
+  /// than inside the Publish handler. Called from every path that can land on
+  /// the Sheets channel — picking it, re-enabling a form that remembers it,
+  /// and opening a website already configured with it. Failures are ignored:
+  /// this is a head start, and Publish still initializes on demand.
   void _warmGoogleIfSheets() {
-    if (_channel != ContactFormChannel.sheets) return;
+    if (!_contactFormEnabled || _channel != ContactFormChannel.sheets) return;
     unawaited(AuthService.instance.ensureGoogleInitialized().catchError(
       (Object e) => debugPrint('Google Sign-In warm-up failed: $e'),
     ));
@@ -889,16 +895,21 @@ class _GenerateWebsiteScreenState extends State<GenerateWebsiteScreen> {
               ),
               Switch(
                 value: _contactFormEnabled,
-                onChanged: (v) => setState(() {
-                  _contactFormEnabled = v;
-                  if (v && _fields.isEmpty) _fields.add(_ContactFieldRow());
-                  // Default the message header to the website name, but only
-                  // when the creator hasn't typed one — so it stays editable
-                  // and clearable.
-                  if (v && _titleController.text.trim().isEmpty) {
-                    _titleController.text = _nameController.text.trim();
-                  }
-                }),
+                onChanged: (v) {
+                  setState(() {
+                    _contactFormEnabled = v;
+                    if (v && _fields.isEmpty) _fields.add(_ContactFieldRow());
+                    // Default the message header to the website name, but only
+                    // when the creator hasn't typed one — so it stays editable
+                    // and clearable.
+                    if (v && _titleController.text.trim().isEmpty) {
+                      _titleController.text = _nameController.text.trim();
+                    }
+                  });
+                  // Re-enabling a form that remembers Sheets never fires the
+                  // channel selector, so warm from here too.
+                  _warmGoogleIfSheets();
+                },
               ),
             ],
           ),
diff --git a/lib/web/screens/web_generate_website_screen.dart b/lib/web/screens/web_generate_website_screen.dart
@@ -235,6 +235,9 @@ class _WebGenerateWebsiteScreenState extends State<WebGenerateWebsiteScreen> {
     WebWebsiteService.instance.fetchPricing().then((p) {
       if (mounted && p != null) setState(() => _pricing = p);
     });
+    // An existing Sheets form reaches Publish without ever touching the
+    // channel selector, so warm from the incoming configuration too.
+    _warmGoogleIfSheets();
   }
 
   @override
@@ -288,13 +291,16 @@ class _WebGenerateWebsiteScreenState extends State<WebGenerateWebsiteScreen> {
     return null;
   }
 
-  /// Load the Google Sign-In SDK as soon as the user picks the channel that
-  /// will need it. On web this matters beyond speed: `authorizeScopes` opens a
-  /// popup, and a browser only permits that while the click that led to it is
-  /// still "recent" (a few seconds) — long enough for a cached SDK, not always
-  /// for a cold one. Failures are ignored; Publish still initializes on demand.
+  /// Load the Google Sign-In SDK as soon as we know it will be needed. On web
+  /// this matters beyond speed: `authorizeScopes` opens a popup, and a browser
+  /// only permits that while the click that led to it is still "recent" (a few
+  /// seconds) — long enough for a cached SDK, not always for a cold one.
+  /// Called from every path that can land on the Sheets channel: picking it,
+  /// re-enabling a form that remembers it, and opening a website already
+  /// configured with it. Failures are ignored; Publish still initializes on
+  /// demand.
   void _warmGoogleIfSheets() {
-    if (_channel != ContactFormChannel.sheets) return;
+    if (!_contactFormEnabled || _channel != ContactFormChannel.sheets) return;
     unawaited(AuthService.instance.ensureGoogleInitialized().catchError(
       (Object e) => debugPrint('Google Sign-In warm-up failed: $e'),
     ));
@@ -787,14 +793,20 @@ class _WebGenerateWebsiteScreenState extends State<WebGenerateWebsiteScreen> {
               style: TextStyle(fontSize: 11),
             ),
             value: _contactFormEnabled,
-            onChanged: (v) => setState(() {
-              _contactFormEnabled = v;
-              // Default the message header to the website name, but only when
-              // the creator hasn't typed one — keeps it editable and clearable.
-              if (v && _titleController.text.trim().isEmpty) {
-                _titleController.text = _nameController.text.trim();
-              }
-            }),
+            onChanged: (v) {
+              setState(() {
+                _contactFormEnabled = v;
+                // Default the message header to the website name, but only
+                // when the creator hasn't typed one — keeps it editable and
+                // clearable.
+                if (v && _titleController.text.trim().isEmpty) {
+                  _titleController.text = _nameController.text.trim();
+                }
+              });
+              // Re-enabling a form that remembers Sheets never fires the
+              // channel selector, so warm from here too.
+              _warmGoogleIfSheets();
+            },
           ),
           if (_contactFormEnabled) ...[
             const SizedBox(height: 8),
diff --git a/test/unit/core/services/google_signin_bootstrap_test.dart b/test/unit/core/services/google_signin_bootstrap_test.dart
@@ -137,6 +137,32 @@ void main() {
     expect(GoogleSignInBootstrap.isInitialized, isTrue);
   });
 
+  test(
+      'a web plugin poisoned by a failed first init is reported, not reported '
+      'as success', () async {
+    // google_sign_in_web raises its double-init flag BEFORE awaiting the GIS
+    // script, so an attempt that fails at that await leaves the plugin
+    // permanently rejecting retries while never finishing initialization.
+    // Treating that rejection as "already initialized" would hand callers a
+    // client that hangs.
+    fake.failWith = Exception('GIS script failed to load');
+
+    await expectLater(
+      GoogleSignInBootstrap.ensureInitialized(clientId: 'web-client'),
+      throwsA(isA<Exception>()),
+    );
+
+    await expectLater(
+      GoogleSignInBootstrap.ensureInitialized(clientId: 'web-client'),
+      throwsA(isA<StateError>().having(
+        (StateError e) => e.message,
+        'message',
+        contains('reload'),
+      )),
+    );
+    expect(GoogleSignInBootstrap.isInitialized, isFalse);
+  });
+
   test('a transient failure is surfaced and leaves a retry possible', () async {
     // A native-style plugin, so the retry below exercises a genuine second
     // initialization rather than the already-initialized branch.
