Merge remote-tracking branch 'origin/develop' into fix/auth-session-and-login

A skipped or failed post-login account save only wrote a log entry, so
the user believed the account was saved. Both save paths (loginMutation
PIN guard and PendingAccountSaveModal catch) now show an error toast.

app/_layout.tsx

@@ -11,6 +11,7 @@ import { Image } from "expo-image";
 import { DarkTheme, ThemeProvider } from "expo-router/react-navigation";
 import { Platform } from "react-native";
 import { GlobalModal } from "@/components/GlobalModal";
+import { PendingAccountSaveModal } from "@/components/PendingAccountSaveModal";
 import { enableTVMenuKeyInterception } from "@/hooks/useTVBackHandler";
 import i18n from "@/i18n";
 import { DownloadProvider } from "@/providers/DownloadProvider";
@@ -551,6 +552,7 @@ function Layout() {
                                   closeButton
                                 />
                                 {!Platform.isTV && <GlobalModal />}
+                                {!Platform.isTV && <PendingAccountSaveModal />}
                               </ThemeProvider>
                             </IntroSheetProvider>
                           </BottomSheetModalProvider>

components/PendingAccountSaveModal.tsx

@@ -0,0 +1,52 @@
+import { useAtom, useAtomValue } from "jotai";
+import type React from "react";
+import { useEffect } from "react";
+import { useTranslation } from "react-i18next";
+import { Platform } from "react-native";
+import { toast } from "sonner-native";
+import { SaveAccountModal } from "@/components/SaveAccountModal";
+import {
+  pendingAccountSaveAtom,
+  useJellyfin,
+  userAtom,
+} from "@/providers/JellyfinProvider";
+import { writeErrorLog } from "@/utils/log";
+
+/**
+ * Post-login save-account prompt. Login flows (password or Quick Connect)
+ * only flag the intent via pendingAccountSaveAtom; the protection picker
+ * shows here, AFTER the session is authorized — the login screen itself
+ * unmounts as soon as the user is set, so it can't host the modal.
+ */
+export const PendingAccountSaveModal: React.FC = () => {
+  const [pending, setPending] = useAtom(pendingAccountSaveAtom);
+  const user = useAtomValue(userAtom);
+  const { saveCurrentAccount } = useJellyfin();
+  const { t } = useTranslation();
+
+  // A logout before answering drops the intent — it must not resurface on
+  // the next (possibly different) login.
+  useEffect(() => {
+    if (!user && pending) setPending(null);
+  }, [user, pending, setPending]);
+
+  if (Platform.isTV) return null;
+
+  return (
+    <SaveAccountModal
+      visible={!!pending && !!user}
+      username={user?.Name ?? ""}
+      onClose={() => setPending(null)}
+      onSave={(securityType, pinCode) => {
+        const serverName = pending?.serverName;
+        setPending(null);
+        saveCurrentAccount({ securityType, pinCode, serverName }).catch(
+          (error) => {
+            writeErrorLog(`Failed to save account: ${error?.message ?? error}`);
+            toast.error(t("save_account.not_saved"));
+          },
+        );
+      }}
+    />
+  );
+};

components/home/Home.tsx

@@ -39,7 +39,11 @@ import { useRefreshLibraryOnFocus } from "@/hooks/useRefreshLibraryOnFocus";
 import { useInvalidatePlaybackProgressCache } from "@/hooks/useRevalidatePlaybackProgressCache";
 import { useDownload } from "@/providers/DownloadProvider";
 import { useIntroSheet } from "@/providers/IntroSheetProvider";
-import { apiAtom, userAtom } from "@/providers/JellyfinProvider";
+import {
+  apiAtom,
+  pendingAccountSaveAtom,
+  userAtom,
+} from "@/providers/JellyfinProvider";
 import { SortByOption, SortOrderOption } from "@/utils/atoms/filters";
 import { useSettings } from "@/utils/atoms/settings";
 import { eventBus } from "@/utils/eventBus";
@@ -89,6 +93,9 @@ const HomeMobile = () => {
   const invalidateCache = useInvalidatePlaybackProgressCache();
   const [loadedSections, setLoadedSections] = useState<Set<string>>(new Set());
   const { showIntro } = useIntroSheet();
+  // Gate the intro so it can't steal presentation from the post-login
+  // save-account sheet (both are BottomSheetModals): wait until no save is pending.
+  const pendingAccountSave = useAtomValue(pendingAccountSaveAtom);
 
   // Fallback refresh for newly added content when returning to the home screen
   // (primary path is the LibraryChanged WebSocket event).
@@ -97,7 +104,9 @@ const HomeMobile = () => {
   // Show intro modal on first launch
   useEffect(() => {
     const hasShownIntro = storage.getBoolean("hasShownIntro");
-    if (!hasShownIntro) {
+    // Defer while the save-account sheet is up; this effect re-runs and schedules
+    // the intro once the sheet is dismissed (pendingAccountSaveAtom cleared).
+    if (!hasShownIntro && !pendingAccountSave) {
       const timer = setTimeout(() => {
         showIntro();
       }, 1000);
@@ -106,7 +115,7 @@ const HomeMobile = () => {
         clearTimeout(timer);
       };
     }
-  }, [showIntro]);
+  }, [showIntro, pendingAccountSave]);
 
   useEffect(() => {
     if (isConnected && !prevIsConnected.current) {

components/login/Login.tsx

@@ -3,7 +3,7 @@ import type { PublicSystemInfo } from "@jellyfin/sdk/lib/generated-client";
 import { Image } from "expo-image";
 import { useLocalSearchParams, useNavigation } from "expo-router";
 import { t } from "i18next";
-import { useAtomValue } from "jotai";
+import { useAtomValue, useSetAtom } from "jotai";
 import { useCallback, useEffect, useState } from "react";
 import {
   Alert,
@@ -21,13 +21,14 @@ import { Input } from "@/components/common/Input";
 import { Text } from "@/components/common/Text";
 import JellyfinServerDiscovery from "@/components/JellyfinServerDiscovery";
 import { PreviousServersList } from "@/components/PreviousServersList";
-import { SaveAccountModal } from "@/components/SaveAccountModal";
 import { Colors } from "@/constants/Colors";
-import { apiAtom, useJellyfin } from "@/providers/JellyfinProvider";
+import {
-import type {
+  apiAtom,
-  AccountSecurityType,
+  pendingAccountSaveAtom,
-  SavedServer,
+  useJellyfin,
-} from "@/utils/secureCredentials";
+  userAtom,
+} from "@/providers/JellyfinProvider";
+import type { SavedServer } from "@/utils/secureCredentials";
 
 const CredentialsSchema = z.object({
   username: z.string().min(1, t("login.username_required")),
@@ -35,6 +36,7 @@ const CredentialsSchema = z.object({
 
 export const Login: React.FC = () => {
   const api = useAtomValue(apiAtom);
+  const user = useAtomValue(userAtom);
   const navigation = useNavigation();
   const params = useLocalSearchParams();
   const {
@@ -45,6 +47,7 @@ export const Login: React.FC = () => {
     loginWithSavedCredential,
     loginWithPassword,
   } = useJellyfin();
+  const setPendingAccountSave = useSetAtom(pendingAccountSaveAtom);
 
   const {
     apiUrl: _apiUrl,
@@ -64,13 +67,24 @@ export const Login: React.FC = () => {
     password: _password || "",
   });
 
-  // Save account state
+  // Save account state — only the intent lives here; the protection picker is
+  // the global PendingAccountSaveModal, shown after the login succeeds.
   const [saveAccount, setSaveAccount] = useState(false);
-  const [showSaveModal, setShowSaveModal] = useState(false);
+
-  const [pendingLogin, setPendingLogin] = useState<{
+  // Tracks an in-flight Quick Connect attempt (code issued, provider polling).
-    username: string;
+  const [quickConnectActive, setQuickConnectActive] = useState(false);
-    password: string;
+
-  } | null>(null);
+  // A Quick Connect login with "save account" on flags the post-login save:
+  // the protection picker shows globally once the session exists (this screen
+  // unmounts on login, so it can't host the modal).
+  useEffect(() => {
+    if (user) {
+      if (quickConnectActive && saveAccount) {
+        setPendingAccountSave({ serverName });
+      }
+      setQuickConnectActive(false);
+    }
+  }, [user]);
 
   // Handle URL params for server connection
   useEffect(() => {
@@ -117,29 +131,22 @@ export const Login: React.FC = () => {
     const result = CredentialsSchema.safeParse(credentials);
     if (!result.success) return;
 
-    if (saveAccount) {
+    const ok = await performLogin(credentials.username, credentials.password);
-      setPendingLogin({
+    // The protection picker shows AFTER a successful login (global modal) —
-        username: credentials.username,
+    // never for a failed one.
-        password: credentials.password,
+    if (ok && saveAccount) {
-      });
+      setPendingAccountSave({ serverName });
-      setShowSaveModal(true);
-    } else {
-      await performLogin(credentials.username, credentials.password);
     }
   };
 
   const performLogin = async (
     username: string,
     password: string,
-    options?: {
+  ): Promise<boolean> => {
-      saveAccount?: boolean;
-      securityType?: AccountSecurityType;
-      pinCode?: string;
-    },
-  ) => {
     setLoading(true);
     try {
-      await login(username, password, serverName, options);
+      await login(username, password, serverName);
+      return true;
     } catch (error) {
       if (error instanceof Error) {
         Alert.alert(t("login.connection_failed"), error.message);
@@ -149,23 +156,9 @@ export const Login: React.FC = () => {
           t("login.an_unexpected_error_occurred"),
         );
       }
+      return false;
     } finally {
       setLoading(false);
-      setPendingLogin(null);
-    }
-  };
-
-  const handleSaveAccountConfirm = async (
-    securityType: AccountSecurityType,
-    pinCode?: string,
-  ) => {
-    setShowSaveModal(false);
-    if (pendingLogin) {
-      await performLogin(pendingLogin.username, pendingLogin.password, {
-        saveAccount: true,
-        securityType,
-        pinCode,
-      });
     }
   };
 
@@ -259,6 +252,7 @@ export const Login: React.FC = () => {
     try {
       const code = await initiateQuickConnect();
       if (code) {
+        setQuickConnectActive(true);
         Alert.alert(
           t("login.quick_connect"),
           t("login.enter_code_to_login", { code: code }),
@@ -443,16 +437,6 @@ export const Login: React.FC = () => {
           </View>
         )}
       </KeyboardAvoidingView>
-
-      <SaveAccountModal
-        visible={showSaveModal}
-        onClose={() => {
-          setShowSaveModal(false);
-          setPendingLogin(null);
-        }}
-        onSave={handleSaveAccountConfirm}
-        username={pendingLogin?.username || credentials.username}
-      />
     </SafeAreaView>
   );
 };

providers/JellyfinProvider.tsx

@@ -15,12 +15,14 @@ import {
   useContext,
   useEffect,
   useMemo,
+  useRef,
   useState,
 } from "react";
 import { useTranslation } from "react-i18next";
 import { AppState, Platform } from "react-native";
 import { getDeviceNameSync } from "react-native-device-info";
 import uuid from "react-native-uuid";
+import { toast } from "sonner-native";
 import useRouter from "@/hooks/useAppRouter";
 import { useInterval } from "@/hooks/useInterval";
 import { JellyseerrApi, useJellyseerr } from "@/hooks/useJellyseerr";
@@ -91,6 +93,12 @@ export const apiAtom = atom<Api | null>(initialApi);
 export const userAtom = atom<UserDto | null>(initialUser);
 export const wsAtom = atom<WebSocket | null>(null);
 export const cacheVersionAtom = atom<number>(0);
+// Set by a login flow that wants the account saved: the protection picker
+// shows AFTER the session is authorized (the login screen unmounts on
+// success, so the modal lives at the root — see PendingAccountSaveModal).
+export const pendingAccountSaveAtom = atom<{ serverName?: string } | null>(
+  null,
+);
 
 interface LoginOptions {
   saveAccount?: boolean;
@@ -108,6 +116,11 @@ interface JellyfinContextValue {
     serverName?: string,
     options?: LoginOptions,
   ) => Promise<void>;
+  saveCurrentAccount: (options?: {
+    securityType?: AccountSecurityType;
+    pinCode?: string;
+    serverName?: string;
+  }) => Promise<void>;
   logout: () => Promise<void>;
   initiateQuickConnect: () => Promise<string | undefined>;
   stopQuickConnectPolling: () => void;
@@ -165,6 +178,69 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
   const { clearAllJellyseerData, setJellyseerrUser } = useJellyseerr();
   const queryClient = useQueryClient();
 
+  // --- Session-expiry handling ----------------------------------------------
+  // When the server revokes the token (e.g. the device/session is deleted), a
+  // 401 can surface from any authenticated request. Without central handling
+  // the dead token stays in storage, so every reload re-fires authed calls →
+  // 401 spam + uncaught rejections, and the app lingers in a half-authenticated
+  // state. A single response interceptor on the authenticated api clears the
+  // session on the first 401 so the app drops cleanly to the login screen.
+  const sessionExpiredRef = useRef(false);
+
+  // Shared teardown for manual logout AND forced session expiry — keeping it
+  // in one place prevents the two paths from drifting (a 401 expiry must wipe
+  // plugin settings / Jellyseerr state too, or the next login on the same
+  // device inherits the previous user's data).
+  // Saved credentials are kept so the user can quick-login again.
+  const clearSessionState = useCallback(async () => {
+    // All synchronous teardown first: if the async Jellyseerr cleanup below
+    // fails or resolves late (user may already be re-authenticating), the
+    // session/cache state is already gone.
+    storage.remove("token");
+    storage.remove("user");
+    storage.remove("REACT_QUERY_OFFLINE_CACHE");
+    clearTVDiscoverySafely();
+    setUser(null);
+    setApi(null);
+    setPluginSettings(undefined);
+    queryClient.clear();
+
+    try {
+      await clearAllJellyseerData();
+    } catch (e) {
+      writeErrorLog(
+        `Failed to clear Jellyseerr data: ${e instanceof Error ? e.message : e}`,
+      );
+    }
+  }, [setUser, setApi, setPluginSettings, clearAllJellyseerData, queryClient]);
+
+  const handleSessionExpired = useCallback(() => {
+    if (sessionExpiredRef.current) return; // run once per session
+    sessionExpiredRef.current = true;
+    clearSessionState().catch((e) =>
+      writeErrorLog(`Session-expiry cleanup failed: ${e?.message ?? e}`),
+    );
+  }, [clearSessionState]);
+
+  useEffect(() => {
+    // Only guard an authenticated session. A pre-auth api (login screen) keeps
+    // its own handling — a wrong-password 401 is not a session expiry.
+    if (!api?.accessToken) return;
+    sessionExpiredRef.current = false; // re-arm for this fresh session
+    const interceptorId = api.axiosInstance.interceptors.response.use(
+      (response) => response,
+      (error) => {
+        if (error?.response?.status === 401) {
+          handleSessionExpired();
+        }
+        return Promise.reject(error);
+      },
+    );
+    return () => {
+      api.axiosInstance.interceptors.response.eject(interceptorId);
+    };
+  }, [api, handleSessionExpired]);
+
   const headers = useMemo(() => {
     if (!deviceId) return {};
     return {
@@ -307,6 +383,40 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     },
   });
 
+  // Persist the CURRENT session to secure storage — used by the post-login
+  // save-account modal (the protection picker shows AFTER a successful
+  // login, for both the password and Quick Connect flows).
+  const saveCurrentAccount = useCallback(
+    async (options?: {
+      securityType?: AccountSecurityType;
+      pinCode?: string;
+      serverName?: string;
+    }) => {
+      const token = storage.getString("token");
+      if (!api?.basePath || !user?.Id || !user.Name || !token) return;
+      const securityType = options?.securityType || "none";
+      let pinHash: string | undefined;
+      if (securityType === "pin") {
+        // Never persist a "pin" credential without its hash — it would be
+        // impossible to unlock.
+        if (!options?.pinCode) throw new Error("PIN code is required");
+        pinHash = await hashPIN(options.pinCode);
+      }
+      await saveAccountCredential({
+        serverUrl: api.basePath,
+        serverName: options?.serverName || "",
+        token,
+        userId: user.Id,
+        username: user.Name,
+        savedAt: Date.now(),
+        securityType,
+        pinHash,
+        primaryImageTag: user.PrimaryImageTag ?? undefined,
+      });
+    },
+    [api?.basePath, user],
+  );
+
   const loginMutation = useMutation({
     mutationFn: async ({
       username,
@@ -338,18 +448,25 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
             if (securityType === "pin" && options.pinCode) {
               pinHash = await hashPIN(options.pinCode);
             }
-
+            if (securityType === "pin" && !pinHash) {
-            await saveAccountCredential({
+              // Never persist a "pin" credential without its hash — it would be
-              serverUrl: api.basePath,
+              // impossible to unlock. Skip the save rather than failing a login
-              serverName: serverName || "",
+              // that already succeeded, and tell the user it didn't happen.
-              token: auth.data.AccessToken,
+              writeErrorLog("Account save skipped: PIN required but missing");
-              userId: auth.data.User.Id || "",
+              toast.error(t("save_account.not_saved"));
-              username,
+            } else {
-              savedAt: Date.now(),
+              await saveAccountCredential({
-              securityType,
+                serverUrl: api.basePath,
-              pinHash,
+                serverName: serverName || "",
-              primaryImageTag: auth.data.User.PrimaryImageTag ?? undefined,
+                token: auth.data.AccessToken,
-            });
+                userId: auth.data.User.Id || "",
+                username,
+                savedAt: Date.now(),
+                securityType,
+                pinHash,
+                primaryImageTag: auth.data.User.PrimaryImageTag ?? undefined,
+              });
+            }
           }
 
           const recentPluginSettings = await refreshStreamyfinPluginSettings();
@@ -409,19 +526,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
           writeErrorLog("Failed to delete expo push token for device"),
         );
 
-      storage.remove("token");
+      await clearSessionState();
-      storage.remove("user");
-      clearTVDiscoverySafely();
-      setUser(null);
-      setApi(null);
-      setPluginSettings(undefined);
-      await clearAllJellyseerData();
-
-      // Clear React Query cache to prevent data from previous account lingering
-      queryClient.clear();
-      storage.remove("REACT_QUERY_OFFLINE_CACHE");
-
-      // Note: We keep saved credentials for quick switching back
     },
     onError: (error) => {
       console.error("Logout failed:", error);
@@ -509,7 +614,9 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
       }
     },
     onError: (error) => {
-      console.error("Quick login failed:", error);
+      // Expected, handled case (e.g. revoked token → "Session Expired", or
+      // server unreachable): the UI surfaces the message, so warn, don't error.
+      console.warn("Quick login failed:", error);
     },
   });
 
@@ -620,54 +727,66 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
             setUser(storedUser);
           }
 
-          // Dismiss splash screen with cached data immediately,
+          // Validate the token and refresh user data in the background. Do NOT
-          // fetch fresh user data in the background
+          // await this: the Jellyfin SDK axios instance has no timeout, so when
-          setInitialLoaded(true);
+          // offline this call hangs for the full OS TCP timeout (75-120s) and
+          // blocks splash dismissal. The cached storedUser (set above) is enough
+          // to render; on success we just refresh it.
+          getUserApi(apiInstance)
+            .getCurrentUser()
+            .then(async (response) => {
+              // The response can resolve long after startup (no axios timeout).
+              // If the session changed meanwhile (logout, account switch), drop
+              // it instead of repopulating a stale user / re-saving credentials.
+              if (getTokenFromStorage() !== token) return;
+              setUser(response.data);
 
-          try {
+              // Migrate current session to secure storage if not already saved
-            const response = await getUserApi(apiInstance).getCurrentUser();
+              if (storedUser?.Id && storedUser?.Name) {
-            setUser(response.data);
+                const existingCredential = await getAccountCredential(
-
-            // Migrate current session to secure storage if not already saved
-            if (storedUser?.Id && storedUser?.Name) {
-              const existingCredential = await getAccountCredential(
-                serverUrl,
-                storedUser.Id,
-              );
-              if (!existingCredential) {
-                await saveAccountCredential({
                   serverUrl,
-                  serverName: "",
+                  storedUser.Id,
-                  token,
+                );
-                  userId: storedUser.Id,
+                if (!existingCredential) {
-                  username: storedUser.Name,
+                  await saveAccountCredential({
-                  savedAt: Date.now(),
+                    serverUrl,
-                  securityType: "none",
+                    serverName: "",
-                  primaryImageTag: response.data.PrimaryImageTag ?? undefined,
+                    token,
-                });
+                    userId: storedUser.Id,
-              } else if (
+                    username: storedUser.Name,
-                response.data.PrimaryImageTag !==
+                    savedAt: Date.now(),
-                existingCredential.primaryImageTag
+                    securityType: "none",
-              ) {
+                    primaryImageTag: response.data.PrimaryImageTag ?? undefined,
-                // Update image tag if it has changed
+                  });
-                addAccountToServer(serverUrl, existingCredential.serverName, {
+                } else if (
-                  userId: existingCredential.userId,
+                  response.data.PrimaryImageTag !==
-                  username: existingCredential.username,
+                  existingCredential.primaryImageTag
-                  securityType: existingCredential.securityType,
+                ) {
-                  savedAt: existingCredential.savedAt,
+                  // Update image tag if it has changed
-                  primaryImageTag: response.data.PrimaryImageTag ?? undefined,
+                  addAccountToServer(serverUrl, existingCredential.serverName, {
-                });
+                    userId: existingCredential.userId,
+                    username: existingCredential.username,
+                    securityType: existingCredential.securityType,
+                    savedAt: existingCredential.savedAt,
+                    primaryImageTag: response.data.PrimaryImageTag ?? undefined,
+                  });
+                }
               }
-            }
+            })
-          } catch (e) {
+            .catch((e) => {
-            // Background fetch failed — app already rendered with cached data
+              // Expected, handled case (offline, or a token the server rejects —
-            console.warn("Background user fetch failed, using cached data:", e);
+              // the UI prompts re-login): warn, don't error. Log only
-          }
+              // status/message — never the raw error (axios errors carry the
-        } else {
+              // request config incl. the Authorization header / token).
-          setInitialLoaded(true);
+              console.warn(
+                "Background user validation failed:",
+                e?.response?.status ?? e?.message ?? "unknown error",
+              );
+            });
         }
       } catch (e) {
         console.error(e);
+      } finally {
         setInitialLoaded(true);
       }
     };
@@ -681,6 +800,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     removeServer: () => removeServerMutation.mutateAsync(),
     login: (username, password, serverName, options) =>
       loginMutation.mutateAsync({ username, password, serverName, options }),
+    saveCurrentAccount,
     logout: () => logoutMutation.mutateAsync(),
     initiateQuickConnect,
     stopQuickConnectPolling,

translations/en.json

@@ -56,6 +56,7 @@
   "save_account": {
     "title": "Save account",
     "save_for_later": "Save this account",
+    "not_saved": "Account was not saved",
     "security_option": "Security option",
     "no_protection": "No protection",
     "no_protection_desc": "Quick login without authentication",