RobotAutomationDevelopment-Dept/Ubisam-MobileGit
16
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Ubisam-MobileGit/docs/oauth.md

1.3 KiB
Raw Blame History

OAuth and App Link contract

Registered values

Authorization endpoint: https://gitea.ubisampaju.synology.me/login/oauth/authorize
Token endpoint:         https://gitea.ubisampaju.synology.me/login/oauth/access_token
Client ID:              225589df-b992-4676-aae0-b2534ba7452d
Redirect URI:           https://gitea.ubisampaju.synology.me/ubisampaju/oauth/callback
Grant:                  Authorization Code with PKCE
PKCE method:            S256
Client secret:          not used

Required login flow

  1. Create a random state and PKCE verifier.
  2. Derive the S256 challenge.
  3. Store only the minimum short-lived transaction state.
  4. Open the authorization URL in the system browser.
  5. Receive the verified HTTPS App Link.
  6. Validate scheme, host, path, state, error, and authorization code.
  7. Exchange the code using the original verifier.
  8. Store tokens with Keystore-backed protection.
  9. Clear transaction state on success, cancellation, or error.

External prerequisite

The host must serve a valid Android Digital Asset Links file at:

https://gitea.ubisampaju.synology.me/.well-known/assetlinks.json

It must identify the final Android application ID and signing-certificate SHA-256 fingerprint. OAuth end-to-end testing is blocked until those values and hosting are available.