From 448a3426a0e2e2bfdf55a3044b54a28a1ab9a128 Mon Sep 17 00:00:00 2001
From: zarzet <42882290+zarzet@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:01:06 +0700
Subject: [PATCH] fix(extensions): shorten verification timeout

---
 go_backend/extension_runtime.go                 | 2 +-
 go_backend/extension_runtime_supplement_test.go | 6 ++++++
 lib/utils/extension_auth_launcher.dart          | 6 ++++--
 test/extension_auth_launcher_test.dart          | 4 ++++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/go_backend/extension_runtime.go b/go_backend/extension_runtime.go
index 15e87ac5..ee784987 100644
--- a/go_backend/extension_runtime.go
+++ b/go_backend/extension_runtime.go
@@ -70,7 +70,7 @@ type PendingAuthRequest struct {
 
 // Challenge URLs are short-lived; serving one past this age sends the user
 // to an already-expired verification page.
-const pendingAuthRequestTTL = 5 * time.Minute
+const pendingAuthRequestTTL = 3 * time.Minute
 
 var (
 	pendingAuthRequests   = make(map[string]*PendingAuthRequest)
diff --git a/go_backend/extension_runtime_supplement_test.go b/go_backend/extension_runtime_supplement_test.go
index 0612bd41..6f01609c 100644
--- a/go_backend/extension_runtime_supplement_test.go
+++ b/go_backend/extension_runtime_supplement_test.go
@@ -15,6 +15,12 @@ import (
 	"github.com/dop251/goja"
 )
 
+func TestPendingAuthRequestExpiresAfterThreeMinutes(t *testing.T) {
+	if pendingAuthRequestTTL != 3*time.Minute {
+		t.Fatalf("pending auth request TTL = %v", pendingAuthRequestTTL)
+	}
+}
+
 func TestExtensionRuntimeAuthAndPolyfills(t *testing.T) {
 	vm := goja.New()
 	runtime := &extensionRuntime{
diff --git a/lib/utils/extension_auth_launcher.dart b/lib/utils/extension_auth_launcher.dart
index f6b110bc..9e072b78 100644
--- a/lib/utils/extension_auth_launcher.dart
+++ b/lib/utils/extension_auth_launcher.dart
@@ -12,6 +12,8 @@ import 'package:url_launcher/url_launcher.dart';
 
 final _log = AppLogger('ExtensionAuthLauncher');
 
+const extensionVerificationGrantTimeout = Duration(minutes: 3);
+
 bool isExtensionVerificationRequired(Object error) {
   final message = error.toString().toLowerCase();
   return message.contains('verify_required') ||
@@ -160,7 +162,7 @@ Timer? scheduleExtensionVerificationHelpDialog(
   });
 }
 
-/// Opens a pending extension verification challenge and waits (up to 5
+/// Opens a pending extension verification challenge and waits (up to 3
 /// minutes) for its grant result, returning whether it succeeded. When
 /// [cancellationSignal] completes, all local waiting resources are released
 /// and the method returns false without waiting for the timeout.
@@ -220,7 +222,7 @@ Future<bool> openVerificationAndAwaitGrant(
     final event = await _awaitVerificationStepOrCancellation(
       grantCompleter.future,
       cancellationSignal,
-    ).timeout(const Duration(minutes: 5));
+    ).timeout(extensionVerificationGrantTimeout);
     if (event == null) {
       _log.i('Stopped waiting for verification grant: $normalizedExtensionId');
       return false;
diff --git a/test/extension_auth_launcher_test.dart b/test/extension_auth_launcher_test.dart
index d54fbc7b..80269f50 100644
--- a/test/extension_auth_launcher_test.dart
+++ b/test/extension_auth_launcher_test.dart
@@ -4,6 +4,10 @@ import 'package:flutter_test/flutter_test.dart';
 import 'package:spotiflac_android/utils/extension_auth_launcher.dart';
 
 void main() {
+  test('verification challenge expires after three minutes', () {
+    expect(extensionVerificationGrantTimeout, const Duration(minutes: 3));
+  });
+
   test('extracts the extension that raised a verification challenge', () {
     expect(
       extensionIdFromVerificationError(