RobotAutomationDevelopment-Dept/Ubisam-MobileGit
16
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Ubisam-MobileGit/tasks/002-oauth-spike.md

1.1 KiB
Raw Blame History

TASK-002: Prove OAuth PKCE and App Link end to end

Status: blocked by TASK-001 and external App Link configuration Owner: Codex Reviewer: Claude

Outcome

A user can authorize UBGitea through the system browser, return through the verified App Link, exchange the code using PKCE, and view their Gitea identity.

Acceptance criteria

  • Uses a system browser, not WebView.
  • Uses fresh random state and PKCE S256 per attempt.
  • Rejects mismatched state and malformed callbacks.
  • Does not require or contain a client secret.
  • Does not log codes or tokens.
  • Persists tokens with Keystore-backed protection.
  • Handles success, cancellation, denied authorization, network failure, and expired transaction state.
  • Calls the authenticated user endpoint and displays the user identity.
  • Tests cover URL construction, PKCE, callback validation, and error mapping.

External prerequisites

  • Final application ID
  • Debug and release signing certificate fingerprints
  • Correct assetlinks.json hosted on the Gitea domain
  • OAuth application configured as a public client

Evidence

Pending prerequisites and implementation.