fix(shell): auth-rejected hub no longer reported as unreachable

The sustained-failure banner treated every failed health poll as
'can't reach the hub'. With token auth active, a wrong or rotated
token gets UNAUTHENTICATED from a perfectly reachable hub — the
old wording sent the operator to fix the endpoint. The shell now
uses the SDK's probe() and, on auth rejection, switches the banner
to 'rejected the sign-in — check the access token' (key-off icon,
DE+EN). Two widget tests pin the wording per failure kind and the
banner clearing once the probe turns serving.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/hub.dart

@@ -212,6 +212,10 @@ class HubService {
 
   Future<bool> healthy() => _client.healthy();
 
+  /// Health probe that keeps the failure kind: an auth-rejected
+  /// hub is up and needs a token fix, not an endpoint fix.
+  Future<HubProbeResult> probeHealth() => _client.probe();
+
   /// Configured module stores (+ the bundled seed) for the store manager.
   Future<List<StoreSource>> listStores() => _client.listStores();
 

lib/l10n/app_de.arb

@@ -1671,6 +1671,12 @@
     }
   },
   "hubUnreachableOpenSettings": "Einstellungen öffnen",
+  "hubAuthRejectedBanner": "{endpoint} lehnt die Anmeldung ab — Zugriffstoken prüfen",
+  "@hubAuthRejectedBanner": {
+    "placeholders": {
+      "endpoint": {"type": "String"}
+    }
+  },
   "navFederation": "Föderation",
   "federationTitle": "Föderation",
   "federationReloadTooltip": "Satelliten neu laden",

lib/l10n/app_en.arb

@@ -1695,6 +1695,12 @@
     }
   },
   "hubUnreachableOpenSettings": "Open Settings",
+  "hubAuthRejectedBanner": "{endpoint} rejected the sign-in — check the access token",
+  "@hubAuthRejectedBanner": {
+    "placeholders": {
+      "endpoint": {"type": "String"}
+    }
+  },
   "navFederation": "Federation",
   "federationTitle": "Federation",
   "federationReloadTooltip": "Reload satellites",

lib/l10n/app_localizations.dart

@@ -4903,6 +4903,12 @@ abstract class AppLocalizations {
   /// **'Open Settings'**
   String get hubUnreachableOpenSettings;
 
+  /// No description provided for @hubAuthRejectedBanner.
+  ///
+  /// In en, this message translates to:
+  /// **'{endpoint} rejected the sign-in — check the access token'**
+  String hubAuthRejectedBanner(String endpoint);
+
   /// No description provided for @navFederation.
   ///
   /// In en, this message translates to:

lib/l10n/app_localizations_de.dart

@@ -2890,6 +2890,11 @@ class AppLocalizationsDe extends AppLocalizations {
   @override
   String get hubUnreachableOpenSettings => 'Einstellungen öffnen';
 
+  @override
+  String hubAuthRejectedBanner(String endpoint) {
+    return '$endpoint lehnt die Anmeldung ab — Zugriffstoken prüfen';
+  }
+
   @override
   String get navFederation => 'Föderation';
 

lib/l10n/app_localizations_en.dart

@@ -2891,6 +2891,11 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get hubUnreachableOpenSettings => 'Open Settings';
 
+  @override
+  String hubAuthRejectedBanner(String endpoint) {
+    return '$endpoint rejected the sign-in — check the access token';
+  }
+
   @override
   String get navFederation => 'Federation';
 

lib/main.dart

@@ -275,6 +275,18 @@ class StudioShellState extends State<StudioShell> {
   /// flash the banner — only sustained failure does.
   bool get _hubUnreachable => _failedPolls >= _unreachableThreshold;
 
+  /// True when the last failed poll was an auth rejection
+  /// (UNAUTHENTICATED / PERMISSION_DENIED): the hub is up, the
+  /// token is wrong. The banner must say so — "can't reach the
+  /// hub" would send the operator to fix the wrong thing.
+  bool _authRejected = false;
+
+  /// Test-only: replaces the hub health probe so widget tests can
+  /// simulate sustained unreachable / auth-rejected states
+  /// without a live hub.
+  @visibleForTesting
+  static Future<HubProbeResult> Function()? debugProbeOverride;
+
   /// Current connection state, for descendants (e.g. WelcomePage)
   /// that adapt their content to hub availability.
   bool? get connected => _connected;
@@ -411,17 +423,25 @@ class StudioShellState extends State<StudioShell> {
   }
 
   Future<void> _checkHealth() async {
-    final ok = await HubService.instance.healthy();
+    final probe = debugProbeOverride != null
+        ? await debugProbeOverride!()
+        : await HubService.instance.probeHealth();
     if (!mounted) return;
+    final ok = probe == HubProbeResult.serving;
+    final authRejected = probe == HubProbeResult.authRejected;
     final wasUnreachable = _hubUnreachable;
     final nextFailed = ok ? 0 : _failedPolls + 1;
     final connectionChanged = _connected != ok;
     final bannerChanged =
         wasUnreachable != (nextFailed >= _unreachableThreshold);
-    if (connectionChanged || _failedPolls != nextFailed || bannerChanged) {
+    if (connectionChanged ||
+        _failedPolls != nextFailed ||
+        bannerChanged ||
+        _authRejected != authRejected) {
       setState(() {
         _connected = ok;
         _failedPolls = nextFailed;
+        _authRejected = authRejected;
       });
     }
     if (ok) {
@@ -557,6 +577,7 @@ class StudioShellState extends State<StudioShell> {
                       if (_hubUnreachable)
                         _HubUnreachableBanner(
                           endpoint: HubService.instance.endpointLabel,
+                          authRejected: _authRejected,
                           onOpenSettings: () => ChainSettingsDialog.show(context),
                         ),
                       Expanded(
@@ -595,13 +616,17 @@ class StudioShellState extends State<StudioShell> {
 /// One-line banner shown when the hub has been unreachable for
 /// several consecutive health polls. Replaces the indefinite
 /// silent "connecting…" with an explicit message + a jump to
-/// Settings, where the operator can fix the endpoint.
+/// Settings, where the operator can fix the endpoint. When the
+/// failure is an auth rejection the wording flips to "check the
+/// access token" — the endpoint is fine in that case.
 class _HubUnreachableBanner extends StatelessWidget {
   final String endpoint;
+  final bool authRejected;
   final VoidCallback onOpenSettings;
 
   const _HubUnreachableBanner({
     required this.endpoint,
+    required this.authRejected,
     required this.onOpenSettings,
   });
 
@@ -619,14 +644,16 @@ class _HubUnreachableBanner extends StatelessWidget {
         child: Row(
           children: [
             Icon(
-              Icons.cloud_off_outlined,
+              authRejected ? Icons.key_off_outlined : Icons.cloud_off_outlined,
               size: 18,
               color: theme.colorScheme.onErrorContainer,
             ),
             const SizedBox(width: ChainSpace.sm),
             Expanded(
               child: Text(
-                l.hubUnreachableBanner(endpoint),
+                authRejected
+                    ? l.hubAuthRejectedBanner(endpoint)
+                    : l.hubUnreachableBanner(endpoint),
                 style: theme.textTheme.bodySmall?.copyWith(
                   color: theme.colorScheme.onErrorContainer,
                 ),