Ubisam-MobileGit/tasks/019-oauth-callback-crash-recovery.md

TASK-019: Recover OAuth callback without an app crash

Status: implemented; automated verification complete; device login pending Owner: Codex Reviewer: Claude

Outcome

OAuth approval returns safely to UBGitea. A rejected or malformed callback, corrupt pending transaction, and stale saved route produce a recoverable screen instead of terminating the process or creating a launch-crash loop.

Writable paths

• app/src/main/java/com/ubisam/ubgitea/core/auth/protocol/OAuthClientConfig.kt
• app/src/main/java/com/ubisam/ubgitea/feature/repositories/
• app/src/main/java/com/ubisam/ubgitea/ui/navigation/RouteStackSaver.kt
• matching unit tests
• TASK-018/019, ADR-004, and development-log incident evidence

Acceptance criteria

• Production defaults request only the previously device-verified read-only scopes.
• A callback-processing exception maps to a recoverable invalid-callback state.
• Debug diagnostics contain only stable reason tags and no code, token, verifier, or state.
• Malformed/truncated saved routes restore to the repository root without indexing missing fields.
• Focused OAuth, repository, and navigation tests pass.
• Physical device login and callback pass with the rebuilt APK.

Evidence

• Incident reproduction: after TASK-018 added write:user, Gitea returned error=server_error; after app data was cleared, callback approval was followed by process termination and stale-state relaunch failure.
• The default scope set is restored to the previously verified read-only set. Gitea-native star mutation remains disabled by lack of write scope until a separate server-compatible authorization design is approved and verified.
• Callback and route restoration now fail closed into UI state. No production credential or callback value is surfaced.
• assembleDebug testDebugUnitTest lintDebug passed: 184 tests across 30 suites, zero failures; lint and diff checks passed.