Fix Android VPN startup state and duplicate connect handling (#9085)

* fix(android): serialize VPN startup preparation

* code review updates

* code review updates

* code review updates

* code review updates

* Notification: gate changes. (#9087)

Co-authored-by: atavism <atavism@users.noreply.github.com>

* code review updates

---------

Co-authored-by: jigar-f <132374182+jigar-f@users.noreply.github.com>

Author: atavism

.github/workflows/android-compile-check.yml

@@ -1,12 +1,12 @@
 name: Android Compile Check
 
-# Compiles all app Kotlin (by building the debug APK) on PRs that change Kotlin
-# source, to catch Kotlin compile breaks before they reach main. The full signed
+# Builds the debug APK and runs native unit tests on PRs that change Kotlin or
+# Gradle files, to catch regressions before they reach main. The full signed
 # release build (build-android.yml) is workflow_call-only and never runs on PRs,
 # so without this gate a Kotlin break (e.g. the bare success() call in #8754)
 # could merge undetected.
 #
-# Scope: the PR trigger covers Kotlin (*.kt) and shared CI setup changes. It
+# Scope: the PR trigger covers Kotlin, Android Gradle, and shared CI setup changes. It
 # does NOT run on Go/gomobile-AAR or Flutter/dep changes — a Go change that
 # breaks the AAR<->Kotlin interface would surface in build-android.yml /
 # release, not here. workflow_dispatch exists only for benchmarking/debugging.
@@ -18,6 +18,7 @@ on:
   pull_request:
     paths:
       - "**/*.kt"
+      - "android/**/*.gradle"
       # keep the self-trigger so edits to this workflow re-run it
       - ".github/workflows/android-compile-check.yml"
       - ".github/actions/setup-android/**"
@@ -91,3 +92,7 @@ jobs:
         run: make android-debug-ci
         env:
           GOMOBILECACHE: ${{ env.GOMOBILECACHE }}
+
+      - name: Run Android unit tests
+        working-directory: android
+        run: ./gradlew :app:testDebugUnitTest

android/app/build.gradle

@@ -538,6 +538,8 @@ dependencies {
     implementation 'androidx.work:work-runtime-ktx:2.10.0'
     coreLibraryDesugaring 'com.android.tools:desugar_jdk_libs:2.1.5'
 
+    testImplementation 'junit:junit:4.13.2'
+
     // Instrumentation harness for Flutter integration tests (Firebase Test Lab).
     // 1.2.0 matches what the integration_test Flutter plugin pins on the app
     // runtime classpath (AGP consistent resolution rejects anything newer).

android/app/src/main/kotlin/org/getlantern/lantern/MainActivity.kt

@@ -233,10 +233,19 @@ class MainActivity : FlutterFragmentActivity() {
     // Replays the pending selection after VPN consent, so consent doesn't fall back to auto.
     private fun resumePendingConnect() {
         val tag = pendingTag
-        if (tag != null) {
-            connectToServer(tag)
-        } else {
-            startVPN()
+        runCatching {
+            if (tag != null) {
+                connectToServer(tag)
+            } else {
+                startVPN()
+            }
+        }.onFailure { e ->
+            AppLogger.e(TAG, "Failed to start VPN after permission request", e)
+            VpnStatusManager.postVPNError(
+                errorCode = "start_vpn",
+                errorMessage = "Error starting VPN service",
+                error = e,
+            )
         }
     }
 
@@ -273,13 +282,15 @@ class MainActivity : FlutterFragmentActivity() {
         try {
             val intent = VpnService.prepare(this)
             if (intent != null) {
+                VpnStatusManager.postVPNStatus(VPNStatus.Connecting)
                 startActivityForResult(intent, VPN_PERMISSION_REQUEST_CODE)
                 return false;
             } else {
                 return true;
             }
         } catch (e: Exception) {
             AppLogger.e(TAG, "Error preparing VPN service", e)
+            VpnStatusManager.postVPNStatus(VPNStatus.MissingPermission)
             return false
         }
     }

android/app/src/main/kotlin/org/getlantern/lantern/handler/MethodHandler.kt

@@ -204,11 +204,9 @@ class MethodHandler : FlutterPlugin,
             Methods.Start.method -> {
                 scope.launch {
                     result.runCatching {
-                        VpnStatusManager.postVPNStatus(VPNStatus.Connecting)
                         MainActivity.instance.startVPN()
                         success("VPN started")
                     }.onFailure { e ->
-                        VpnStatusManager.postVPNStatus(VPNStatus.Disconnected)
                         result.error("start_vpn", e.localizedMessage ?: "Please try again", e)
                     }
                 }

android/app/src/main/kotlin/org/getlantern/lantern/notification/NotificationManager.kt

@@ -45,6 +45,7 @@ class NotificationHelper {
 
     private lateinit var dataUsageNotificationChannel: NotificationChannel
     private lateinit var vpnNotificationChannel: NotificationChannel
+    private var foregroundStarted = false
 
 
     init {
@@ -158,9 +159,16 @@ class NotificationHelper {
     /**
      * Shows the starting VPN notification as a foreground notification.
      * Also starts the service in the foreground and promotes it to a foreground service.
+     *
+     * @return true if this call promoted the service; false if it was already in the foreground.
      */
-    fun showStartingVPNConnectedNotification(vpnService: LanternVpnService) {
+    @Synchronized
+    fun showStartingVPNConnectedNotification(vpnService: LanternVpnService): Boolean {
+        // Duplicate starts must not replace an existing connected notification.
+        if (foregroundStarted) return false
         showForegroundNotification(vpnService, VPN_CONNECTED, buildStartingVpnNotification())
+        foregroundStarted = true
+        return true
     }
 
     /**
@@ -184,13 +192,15 @@ class NotificationHelper {
      * @param service The service whose foreground status should be stopped.
      * @param removeNotification Whether to remove the notification from the status bar.
      */
+    @Synchronized
     private fun stopForegroundNotification(service: LanternVpnService) {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
             service.stopForeground(STOP_FOREGROUND_REMOVE)
         } else {
             // For API < 24, stopForeground without flags
             service.stopForeground(true)
         }
+        foregroundStarted = false
     }
 
 

android/app/src/main/kotlin/org/getlantern/lantern/service/DefaultNetworkMonitor.kt

@@ -30,6 +30,7 @@ object DefaultNetworkMonitor {
     // different threads, so @Volatile guarantees the read sees the latest write.
     @Volatile
     private var listener: InterfaceUpdateListener? = null
+    @Volatile
     private var networkChangeCallback: ((Network?) -> Unit)? = null
 
     /**