TASK-002: Prove OAuth PKCE and App Link end to end

Status: core implementation ready; end-to-end verification blocked by external App Link configuration Owner: Codex Reviewer: Claude

Writable paths

app/src/main/java/com/ubisam/ubgitea/core/auth/
app/src/main/java/com/ubisam/ubgitea/feature/auth/
app/src/test/java/com/ubisam/ubgitea/core/auth/
app/src/test/java/com/ubisam/ubgitea/feature/auth/
app/src/main/AndroidManifest.xml
app/src/main/res/values/strings_auth.xml
app/build.gradle.kts
gradle/libs.versions.toml
docs/decisions/002-oauth-security.md
tasks/002-oauth-spike.md

Outcome

A user can authorize UBGitea through the system browser, return through the verified App Link, exchange the code using PKCE, and view their Gitea identity.

Acceptance criteria

Uses a system browser, not WebView.
Uses fresh random state and PKCE S256 per attempt.
Rejects mismatched state and malformed callbacks.
Does not require or contain a client secret.
Does not log codes or tokens.
Persists tokens with Keystore-backed protection.
Handles success, cancellation, denied authorization, network failure, and expired transaction state.
Calls the authenticated user endpoint and displays the user identity.
Tests cover URL construction, PKCE, callback validation, and error mapping.

External prerequisites

Debug and release signing certificate fingerprints
Correct assetlinks.json hosted on the Gitea domain
OAuth application configured as a public client

Evidence

Pending prerequisites and implementation.

1.6 KiB Raw Blame History