# TASK-002: Prove OAuth PKCE and App Link end to end

Status: blocked by TASK-001 and external App Link configuration
Owner: Codex
Reviewer: Claude

## Outcome

A user can authorize UBGitea through the system browser, return through the verified App Link, exchange the code using PKCE, and view their Gitea identity.

## Acceptance criteria

- [ ] Uses a system browser, not WebView.
- [ ] Uses fresh random state and PKCE S256 per attempt.
- [ ] Rejects mismatched state and malformed callbacks.
- [ ] Does not require or contain a client secret.
- [ ] Does not log codes or tokens.
- [ ] Persists tokens with Keystore-backed protection.
- [ ] Handles success, cancellation, denied authorization, network failure, and expired transaction state.
- [ ] Calls the authenticated user endpoint and displays the user identity.
- [ ] Tests cover URL construction, PKCE, callback validation, and error mapping.

## External prerequisites

- Final application ID
- Debug and release signing certificate fingerprints
- Correct `assetlinks.json` hosted on the Gitea domain
- OAuth application configured as a public client

## Evidence

Pending prerequisites and implementation.