# TASK-004: Implement the read-only Gitea API client

Status: implemented and verified — independent review deferred while Codex owns the serial workstream
Owner: Codex
Reviewer: Claude

## Writable paths

- `app/src/main/java/com/ubisam/ubgitea/core/network/`
- `app/src/main/java/com/ubisam/ubgitea/data/`
- `app/src/main/java/com/ubisam/ubgitea/domain/`
- `app/src/test/java/com/ubisam/ubgitea/core/network/`
- `app/src/test/java/com/ubisam/ubgitea/data/`
- `app/src/test/java/com/ubisam/ubgitea/domain/`
- `app/build.gradle.kts`
- `gradle/libs.versions.toml`
- `docs/decisions/003-http-client.md`
- `tasks/004-gitea-api-client.md`

## Outcome

Connect the repository browsing domain to authenticated, paginated Gitea API calls while keeping DTOs and tokens out of domain and UI layers.

## Acceptance criteria

- [x] Base URL is configurable with the approved production default.
- [x] DTOs are separate from domain models and mapping is tested.
- [x] Repository, branch, tag, tree, file, and commit endpoints support pagination where provided.
- [x] Authentication is injected without logging or exposing tokens.
- [x] HTTP, authorization, rate-limit, parsing, cancellation, and offline failures map to typed failures.
- [x] Branch, ref, owner, repository, and path values are safely encoded as individual URL components.
- [x] Tests use in-memory transport fixtures and a local MockWebServer and never contact production.

## Required checks

```text
./gradlew assembleDebug
./gradlew testDebugUnitTest
./gradlew lintDebug
```

## Evidence

- Implemented `GiteaRepositoryBrowserApi` for repositories, branches, tags, directory contents, Base64 files, and commits against Gitea 1.23-compatible response contracts.
- Added immutable `TagSummary` and tag-list domain/use-case contract.
- Focused adapter tests cover mapping, pagination, component encoding, authenticated headers, strict file decoding, malformed responses, 404, 429, and local HTTP transport behavior.
- Full debug build, unit tests, lint, diff check, and sensitive-pattern scan are recorded in `docs/development-log.md`.