android: start IPNService foreground before browser opens in login (#747)

When the user taps on the log in button, the browser opens, and the app is backgrounded without a foreground service running. This can lead to network access restriction, causing the control client register request to fail with "software caused connection abort" / "context deadline exceeded". This fix:
-Starts IPNService as a foreground service before the browser opens wat the start of login

Updates tailscale/tailscale#18304

Signed-off-by: kari-ts <kari@tailscale.com>

Author: kari-ts

android/src/main/java/com/tailscale/ipn/App.kt

@@ -513,6 +513,23 @@ open class UninitializedApp : Application() {
     return getSharedPreferences(UNENCRYPTED_PREFERENCES, MODE_PRIVATE)
   }
 
+  /**
+   * Starts IPNService as a foreground service without creating a VPN tunnel. This prevents Android
+   * from freezing the process and restricting network access during interactive login while the
+   * user completes auth in the browser.
+   */
+  fun startForegroundForLogin() {
+    val intent =
+        Intent(this, IPNService::class.java).apply {
+          action = IPNService.ACTION_START_FOREGROUND_ONLY
+        }
+    try {
+      startForegroundService(intent)
+    } catch (e: Exception) {
+      TSLog.e(TAG, "startForegroundForLogin hit exception: $e")
+    }
+  }
+
   fun startVPN() {
     val intent = Intent(this, IPNService::class.java).apply { action = IPNService.ACTION_START_VPN }
     // FLAG_UPDATE_CURRENT ensures that if the intent is already pending, the existing intent will

android/src/main/java/com/tailscale/ipn/IPNService.kt

@@ -53,6 +53,13 @@ open class IPNService : VpnService(), libtailscale.IPNService {
           }
           START_NOT_STICKY
         }
+        ACTION_START_FOREGROUND_ONLY -> {
+          // Start the foreground service notification without creating a VPN tunnel.
+          // This is used during interactive login so that Android does not freeze the process
+          // or restrict network access while the user completes auth in the browser.
+          showForegroundNotification()
+          START_NOT_STICKY
+        }
         ACTION_START_VPN -> {
           showForegroundNotification()
           app.setWantRunning(true)
@@ -221,5 +228,6 @@ open class IPNService : VpnService(), libtailscale.IPNService {
     const val ACTION_START_VPN = "com.tailscale.ipn.START_VPN"
     const val ACTION_STOP_VPN = "com.tailscale.ipn.STOP_VPN"
     const val ACTION_RESTART_VPN = "com.tailscale.ipn.RESTART_VPN"
+    const val ACTION_START_FOREGROUND_ONLY = "com.tailscale.ipn.START_FOREGROUND_ONLY"
   }
 }

android/src/main/java/com/tailscale/ipn/ui/viewModel/IpnViewModel.kt

@@ -163,6 +163,11 @@ open class IpnViewModel : ViewModel() {
       authKey: String? = null,
       completionHandler: (Result<Unit>) -> Unit = {}
   ) {
+    // Start the IPNService foreground notification so that Android
+    // does not freeze the process or cut network access while the user is in the browser
+    // completing auth. The foreground service transitions to a full VPN service later when
+    // startVPN() is called after the backend reaches Running state.
+    UninitializedApp.get().startForegroundForLogin()
     val client = Client(viewModelScope)
 
     val finalMaskedPrefs = maskedPrefs?.deepCopy() ?: Ipn.MaskedPrefs()