45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# TASK-002B: Integrate OAuth with Android and verify App Links
|
|
|
|
Status: completed through TASK-011 — device OAuth/App Link E2E passed
|
|
Owner: Codex
|
|
Reviewer: Claude
|
|
|
|
## Outcome
|
|
|
|
Launch authorization in the system browser, receive only the verified HTTPS App Link, exchange the code, protect tokens with Android Keystore, show the authenticated identity, and remove all authentication data on logout.
|
|
|
|
## Writable paths
|
|
|
|
- `app/src/main/java/com/ubisam/ubgitea/core/auth/android/`
|
|
- `app/src/main/java/com/ubisam/ubgitea/data/auth/`
|
|
- `app/src/main/java/com/ubisam/ubgitea/feature/auth/`
|
|
- Matching test paths
|
|
- `app/src/main/AndroidManifest.xml`
|
|
- `app/src/main/res/values/strings_auth.xml`
|
|
- `app/src/main/res/xml/data_extraction_rules.xml`
|
|
- `app/build.gradle.kts`
|
|
- `gradle/libs.versions.toml`
|
|
- `tasks/002-oauth-spike.md`
|
|
- `tasks/002b-oauth-android-integration.md`
|
|
|
|
## Acceptance criteria
|
|
|
|
- [x] Credentials are entered only through an external system browser flow; no WebView exists.
|
|
- [x] Only the registered HTTPS App Link scheme, host, and path reach callback handling.
|
|
- [x] Transaction state is short-lived and cleared on success, denial, cancellation, expiry, and error.
|
|
- [x] Token exchange sends the original verifier and never sends or requests a client secret.
|
|
- [x] Access and refresh tokens are encrypted using an Android Keystore-backed key and excluded from backup.
|
|
- [x] Tokens, authorization codes, cookies, identity data, verifier, and state are never logged.
|
|
- [x] 401 causes authentication-expired state while 403 remains permission denied.
|
|
- [x] Logout clears tokens, transaction state, and private cached authentication data.
|
|
- [x] Development fingerprints and hosted `assetlinks.json` were verified before the successful device E2E recorded in TASK-011.
|
|
- [x] Protocol/storage-codec/callback/token-exchange/identity/error tests plus the successful TASK-011 device E2E cover the integrated flow.
|
|
|
|
## Required checks
|
|
|
|
```text
|
|
./gradlew assembleDebug
|
|
./gradlew testDebugUnitTest
|
|
./gradlew lintDebug
|
|
```
|