# TASK-002: Prove OAuth PKCE and App Link end to end

Status: core implementation ready; end-to-end verification blocked by external App Link configuration
Owner: Codex
Reviewer: Claude

## Writable paths

- `app/src/main/java/com/ubisam/ubgitea/core/auth/`
- `app/src/main/java/com/ubisam/ubgitea/feature/auth/`
- `app/src/test/java/com/ubisam/ubgitea/core/auth/`
- `app/src/test/java/com/ubisam/ubgitea/feature/auth/`
- `app/src/main/AndroidManifest.xml`
- `app/src/main/res/values/strings_auth.xml`
- `app/build.gradle.kts`
- `gradle/libs.versions.toml`
- `docs/decisions/002-oauth-security.md`
- `tasks/002-oauth-spike.md`

## Outcome

A user can authorize UBGitea through the system browser, return through the verified App Link, exchange the code using PKCE, and view their Gitea identity.

## Acceptance criteria

- [ ] Uses a system browser, not WebView.
- [ ] Uses fresh random state and PKCE S256 per attempt.
- [ ] Rejects mismatched state and malformed callbacks.
- [ ] Does not require or contain a client secret.
- [ ] Does not log codes or tokens.
- [ ] Persists tokens with Keystore-backed protection.
- [ ] Handles success, cancellation, denied authorization, network failure, and expired transaction state.
- [ ] Calls the authenticated user endpoint and displays the user identity.
- [ ] Tests cover URL construction, PKCE, callback validation, and error mapping.

## External prerequisites

- Debug and release signing certificate fingerprints
- Correct `assetlinks.json` hosted on the Gitea domain
- OAuth application configured as a public client

## Evidence

Pending prerequisites and implementation.