# OAuth and App Link contract

## Registered values

```text
Authorization endpoint: https://gitea.ubisampaju.synology.me/login/oauth/authorize
Token endpoint:         https://gitea.ubisampaju.synology.me/login/oauth/access_token
Client ID:              225589df-b992-4676-aae0-b2534ba7452d
Redirect URI:           https://gitea.ubisampaju.synology.me/ubisampaju/oauth/callback
Grant:                  Authorization Code with PKCE
PKCE method:            S256
Client secret:          not used
```

## Required login flow

1. Create a random state and PKCE verifier.
2. Derive the S256 challenge.
3. Store only the minimum short-lived transaction state.
4. Open the authorization URL in the system browser.
5. Receive the verified HTTPS App Link.
6. Validate scheme, host, path, state, error, and authorization code.
7. Exchange the code using the original verifier.
8. Store tokens with Keystore-backed protection.
9. Clear transaction state on success, cancellation, or error.

## External prerequisite

The host must serve a valid Android Digital Asset Links file at:

```text
https://gitea.ubisampaju.synology.me/.well-known/assetlinks.json
```

It must identify the final Android application ID and signing-certificate SHA-256 fingerprint. OAuth end-to-end testing is blocked until those values and hosting are available.